KeyPlus interactive CLI reference

Running keyplus opens an interactive prompt after setup or unlock:

KeyPlus ❯

This is a REPL, not a conventional scriptable subcommand interface. Commands such as keyplus add are not currently supported as process arguments. The CLI and GUI call the same application service, but they are separate processes and do not share an unlocked in-memory session.

Commands

Command	Behaviour
`help`	Display available commands.
`list`	List the first eight characters of each ID, name, and domain.
`view <identifier>`	Display the complete entry, including its password.
`add`	Prompt for name, domain, and a hidden password.
`edit <identifier>`	Prompt for replacement fields; blank values retain current values.
`delete <identifier>`	Confirm, then permanently remove an entry.
`backup`	Create a timestamped encrypted vault backup.
`backups`	List encrypted backups, their sizes, and backup directory.
`restore <path>`	Confirm and validate an encrypted backup before restoring it.
`passwd`	Reauthenticate and change the active vault’s master password.
`lock`	Lock, then require the master password before returning to the prompt.
`exit` or `quit`	Lock the service and leave the program.

view, edit, and delete accept a complete UUID, an unambiguous beginning of an ID, or an exact case-insensitive name when that name is unique. Ambiguous names or ID prefixes are refused. Use list to obtain the displayed ID prefix.

Entry passwords and master passwords are collected with getpass, not as inline command text. Names and domains remain visible terminal input. view prints the password to the terminal, where it may remain visible or be retained by terminal scrollback.

passwd asks for the current password, the replacement, and confirmation. A successful change re-encrypts the active vault with a new salt and derived key. The prior encrypted vault is retained as last-good.vault; older backups keep the passwords that originally protected them.

Startup and migration options

Use keyplus --gui to start the desktop interface. On a first 0.3 launch, use keyplus --migrate <directory> to select a folder containing both legacy auth.db and vault.json. Other conventional command-line options, shell completion, machine-readable output, and defined command-specific exit codes are not implemented.

Locking behaviour

End-of-file, Ctrl+C at the main prompt, exit, and quit lock the service before returning. An interrupt during top-level startup returns status 130; handled application or validation failures at startup return status 1. Errors inside the REPL are displayed and the prompt continues.