FEAT: Multi-profile vaults with isolated credentials and per-profile master passwords

kashish commented

2026-08-02 16:57:16 +00:00

Owner

Summary

Introduces profiles: each profile is a separate vault file with its own
Curve25519 keypair, its own Argon2id salt and its own master password. Every
command operates on the active profile only, so unrelated secrets - work and
personal, say - stay cryptographically isolated on the same machine.

Existing vaults are migrated automatically and losslessly on first run.

Functional Changes

New commands

kosh use [profile] - switch the active profile. With no arguments, opens an
interactive picker (type to filter, enter to select, esc to cancel). Fails if
the named profile does not exist; it does not create profiles. The choice is
persisted to config.
kosh profile list [filter] - table of profiles and which one is active.
Reads filenames only, so it opens no vault and requires no master password.
kosh profile create <name> - creates the profile, switches to it, and
initializes its vault with a master password of its own. kosh init is not
needed afterwards.
kosh profile delete <name> - deletes a profile and every credential in it.
Guarded four ways: the active profile cannot be deleted, the target profile's
own master password must be verified, a confirmation phrase must be typed out
in full, and the vault file is overwritten with random bytes and synced to
disk before it is unlinked.
kosh copy <id> <profile> - copies a credential into another profile's vault.
The secret is decrypted with the active profile's password and re-encrypted
for the target under a fresh ephemeral keypair and nonce. The original is left
untouched.

On-disk layout and migration

~/.kosh/kosh.db becomes ~/.kosh/profiles/<name>.db, with the active profile
recorded in ~/.kosh/config.json (0600; ~/.kosh stays 0700).

Migration runs on every startup and acts once: if profiles/default.db already
exists it exits early, otherwise a legacy kosh.db is renamed into place as
the default profile. Nothing is re-encrypted and the master password is
unchanged. The early exit also means a stray kosh.db can never clobber an
existing default profile.

Existing commands

kosh init - now scoped to the active profile, idempotent, and reports
vault already initialized rather than touching existing data.
kosh list- auto-sized table instead of fixed-width truncation; adds
Access Count, and renders last-used/last-updated as relative times.
kosh add / kosh delete / kosh update - destructive paths now show a
caution block and require a typed confirmation phrase.
kosh generate - flag state moved off package globals onto a per-command
struct.
Every command gained a full Long description and worked Example block.

Internal Changes

Dependency injection. Commands are NewCmdX(ctx *app.Context) constructors
registered in cmd/root.go, replacing package-level globals and init() side
effects. The store is opened in PersistentPreRun, closed in
PersistentPostRun.
Service interfaces. core.VaultService and core.ProfileService are now
interfaces (KoshVault, KoshProfile), so commands can be tested with fakes.
Schema migrations. New schema_migrations table and an ordered migration
list applied transactionally on store init. DDL moved out of
InitializeVault, which now only inserts the vault row.
Logging. Custom logger replaced with log/slog. Lower layers return
errors without logging them; Execute() logs once and prints once.
Error boundaries. Storage returns constants.ErrCredentialNotFound
instead of leaking sql.ErrNoRows; vault/store errors are wrapped with %w.
New internal/ui surface: output.go (profile prefix, glyphs, Caution),
table.go (zero-dependency auto-sized table), time.go (RelativeTime).
New packages: internal/config, internal/app, internal/model/profile.go,
internal/crypto/file.go, cmd/profile/.

Security

Profiles are fully isolated - unlocking one grants no access to another.
DecryptCredential returns []byte rather than string, so plaintext is not
copied into an immutable value.
Credential, CredentialData and CredentialSummary implement
slog.LogValue and redact secrets, nonces and ephemeral keys, so debug output
cannot print ciphertext by accident.
Master-password and secret confirmation use crypto/subtle constant-time
comparison.
Profile deletion overwrites the vault file with random bytes before unlinking,
on top of SQLite's secure_delete=ON.

Bug Fixes

Ctrl+C during a password prompt no longer leaves the terminal with echo
disabled - terminal state is restored and the process exits 130.
kosh generate --lower was documented as "include uppercase letters".

⚠ Breaking Change

Debug logging no longer requires a rebuild. The
logger.BuildMode ldflag is removed from .goreleaser.yaml; set KOSH_DEBUG
to a truthy value instead. Logs are structured and go to stderr.

KOSH_DEBUG=1 kosh list          # bash / zsh
$env:KOSH_DEBUG=1; kosh list    # PowerShell

## Summary Introduces **profiles**: each profile is a separate vault file with its own Curve25519 keypair, its own Argon2id salt and its own master password. Every command operates on the active profile only, so unrelated secrets - work and personal, say - stay cryptographically isolated on the same machine. Existing vaults are migrated automatically and losslessly on first run. ## Functional Changes ### New commands * `kosh use [profile]` - switch the active profile. With no arguments, opens an interactive picker (type to filter, enter to select, esc to cancel). Fails if the named profile does not exist; it does not create profiles. The choice is persisted to config. * `kosh profile list [filter]` - table of profiles and which one is active. Reads filenames only, so it opens no vault and requires no master password. * `kosh profile create <name>` - creates the profile, switches to it, and initializes its vault with a master password of its own. `kosh init` is not needed afterwards. * `kosh profile delete <name>` - deletes a profile and every credential in it. Guarded four ways: the active profile cannot be deleted, the target profile's own master password must be verified, a confirmation phrase must be typed out in full, and the vault file is overwritten with random bytes and synced to disk before it is unlinked. * `kosh copy <id> <profile>` - copies a credential into another profile's vault. The secret is decrypted with the active profile's password and re-encrypted for the target under a fresh ephemeral keypair and nonce. The original is left untouched. ### On-disk layout and migration `~/.kosh/kosh.db` becomes `~/.kosh/profiles/<name>.db`, with the active profile recorded in `~/.kosh/config.json` (`0600`; `~/.kosh` stays `0700`). Migration runs on every startup and acts once: if `profiles/default.db` already exists it exits early, otherwise a legacy `kosh.db` is **renamed** into place as the `default` profile. Nothing is re-encrypted and the master password is unchanged. The early exit also means a stray `kosh.db` can never clobber an existing default profile. ### Existing commands * `kosh init` - now scoped to the active profile, idempotent, and reports `vault already initialized` rather than touching existing data. * `kosh list`- auto-sized table instead of fixed-width truncation; adds `Access Count`, and renders last-used/last-updated as relative times. * `kosh add` / `kosh delete` / `kosh update` - destructive paths now show a caution block and require a typed confirmation phrase. * `kosh generate` - flag state moved off package globals onto a per-command struct. * Every command gained a full `Long` description and worked `Example` block. ## Internal Changes * **Dependency injection.** Commands are `NewCmdX(ctx *app.Context)` constructors registered in `cmd/root.go`, replacing package-level globals and `init()` side effects. The store is opened in `PersistentPreRun`, closed in `PersistentPostRun`. * **Service interfaces.** `core.VaultService` and `core.ProfileService` are now interfaces (`KoshVault`, `KoshProfile`), so commands can be tested with fakes. * **Schema migrations.** New `schema_migrations` table and an ordered migration list applied transactionally on store init. DDL moved out of `InitializeVault`, which now only inserts the vault row. * **Logging.** Custom logger replaced with `log/slog`. Lower layers return errors without logging them; `Execute()` logs once and prints once. * **Error boundaries.** Storage returns `constants.ErrCredentialNotFound` instead of leaking `sql.ErrNoRows`; vault/store errors are wrapped with `%w`. * New `internal/ui` surface: `output.go` (profile prefix, glyphs, `Caution`), `table.go` (zero-dependency auto-sized table), `time.go` (`RelativeTime`). * New packages: `internal/config`, `internal/app`, `internal/model/profile.go`, `internal/crypto/file.go`, `cmd/profile/`. ## Security * Profiles are fully isolated - unlocking one grants no access to another. * `DecryptCredential` returns `[]byte` rather than `string`, so plaintext is not copied into an immutable value. * `Credential`, `CredentialData` and `CredentialSummary` implement `slog.LogValue` and redact secrets, nonces and ephemeral keys, so debug output cannot print ciphertext by accident. * Master-password and secret confirmation use `crypto/subtle` constant-time comparison. * Profile deletion overwrites the vault file with random bytes before unlinking, on top of SQLite's `secure_delete=ON`. ## Bug Fixes * `Ctrl+C` during a password prompt no longer leaves the terminal with echo disabled - terminal state is restored and the process exits `130`. * `kosh generate --lower` was documented as "include uppercase letters". ## ⚠ Breaking Change Debug logging no longer requires a rebuild. The `logger.BuildMode` ldflag is removed from `.goreleaser.yaml`; set `KOSH_DEBUG` to a truthy value instead. Logs are structured and go to stderr. ```sh KOSH_DEBUG=1 kosh list # bash / zsh $env:KOSH_DEBUG=1; kosh list # PowerShell

kashish added 21 commits

2026-08-02 16:57:16 +00:00

feat(user profiles): implemented fs & schema migration ec57a936f6

fix(user profiles): prevent profile overwrite by stray kosh.db 72e045ce3f

feat(user profiles): implement 'use' command with interactive search & new vault validation in 'list' command 1b859b912b

refactor(logging): separate ui output text, and use slog for debug logs instead decf5cc70b

docs(command): add/update command descriptions and arg checks for consistency 685158f3aa

feat(use command): add '--create' flag to create a new profile if it does not exist b8a1b6d4f6

fix(field input): interrupting read password with SIGINT no longer leaves terminal in bad state 6ad70f52d2

change(profile): move Profile type to model 795c24e7e8

change(cmd di): Commands now registered in root with App Context for dependency injection 10dee528b9

Refactored code for consistency and testibility e3ce4a952f

- Profile functions as part of service for consistency
- All services now implement as interface for mocking
- App Context moved to separate package to avoid cycle imports
- Misc. code cleanup

add(profile list, table UI) 02b65e48e0

- Added profile list subcommand
- Improved Table UI implemented as UI entity

add(output): added a caution ui output 7097e2ac30

add(profile): add create and delete profile commands, code cleanup and refactor 88ed8ddb56

fix(text): search profile prompt for interactive search fixed bb925164eb

change(add): add command now also uses common ui field to read secret and confirm 028ff6a9fa

change(store): getCredentialById and getCredentialByLabelAndUser now return application error instead of sql.ErrNoRows 7e37d96b85

change(vault service): removed unnecessary []byte -> string conversion of decrypted secret 5a5c2b3e57

add(user messages): added success message on profile subcommands and new error messages 96e2749030

feat(credential): added copy command to duplicate credential from current to target profile eac122eb1b

doc(commands): added descriptions to new commands and updated existing 96c008081c

ux(messages): updated messages, errors, prompts to be more consistent, coherent and precise afdb38ba3c

kashish self-assigned this

2026-08-02 16:58:24 +00:00

kashish commented

2026-08-02 17:05:40 +00:00

Author

Owner

Update README.md

- [ ] Update README.md

kashish added 1 commit

2026-08-03 17:24:27 +00:00

fix(scrub delete): file overwrite was not working earlier, now opening with Write permissions and add unit tests for file delete, relative time and crypto functions 2bf6c8c897

kashish added 2 commits

2026-08-05 18:01:00 +00:00

add(profile): sanitize profile name before creating profile 0a86932d71

fix(profile): delete uninitialized vaults without password 24e4ef4db4

kashish added 1 commit

2026-08-06 06:36:25 +00:00

change(profile): sanitize profile name on creation and rollback partially created profiles 4f616d9b58

kashish added 1 commit

2026-08-07 17:25:42 +00:00

add(profile): added profile name sanitization & case insensitive lookup, also added e2e profile service tests ed247d7930

kashish added 1 commit

2026-08-07 17:42:12 +00:00

change(error): supress cobra help and error on application error d0cd8e50c2

kashish added 1 commit

2026-08-07 18:03:20 +00:00

fix(profile): create profile first via vault init and then switch to rollback effectively 4319f2954c

kashish commented

2026-08-07 19:04:12 +00:00

Author

Owner

Added

Profile Name Sanitization
Partial Profile creation rollback
e2e tests for profile creation, name sanitization and access

Changed

kosh profile create now first initializes vault and then switches to it. Switch profile only when persisted.
Suppress cobra Error & Help command on application error

Added - Profile Name Sanitization - Partial Profile creation rollback - e2e tests for profile creation, name sanitization and access Changed - `kosh profile create` now first initializes vault and then switches to it. Switch profile only when persisted. - Suppress cobra Error & Help command on application error

kashish added 1 commit

2026-08-07 19:08:48 +00:00

update(docs): update README.md 00ba658069

kashish changed title from ~~WIP: FEAT: Multi-profile vaults with isolated credentials and per-profile master passwords~~ to FEAT: Multi-profile vaults with isolated credentials and per-profile master passwords

2026-08-07 19:12:08 +00:00

kashish merged commit d63876d772 into main

2026-08-07 19:15:57 +00:00

kashish referenced this pull request from a commit

2026-08-07 19:15:58 +00:00

FEAT: Multi-profile vaults with isolated credentials and per-profile master passwords (#19)