Import authenticator codes into any key that can store them (re #170)

CLAUDE.md

@@ -29,7 +29,7 @@ tool. Workspace contains:
 | Crate | Purpose | External deps |
 |---|---|---|
 | `keyroost-proto` | Pure-Rust protocol layer (SM4, SHA-1, APDU builders, MAC) | none |
-| `keyroost-transport` | PC/SC reader discovery, Molto2 session, YubiKey CCID serial, OATH + OpenPGP applets | `pcsc`; `aes`/`des`/`cipher`/`getrandom`/`zeroize` (PIV mgmt-key auth); `hidapi` (non-Linux HID) |
+| `keyroost-transport` | PC/SC reader discovery, Molto2 session, YubiKey CCID serial, OATH + OpenPGP applets, import writers for OATH / Token2 OTP / Molto2 (in-tree `keyroost-import`) | `pcsc`; `aes`/`des`/`cipher`/`getrandom`/`zeroize` (PIV mgmt-key auth); `hidapi` (non-Linux HID) |
 | `keyroost-hid` | USB HID enumeration of FIDO devices via sysfs | `hidapi` (non-Linux only; Linux uses sysfs) |
 | `keyroost-ctap` | FIDO2/CTAP-HID transport, CBOR, PIN protocols, credential mgmt, largeBlob (incl. the on-key name entry, `docs/PROTOCOL-device-label.md`) | RustCrypto (`sha2`/`hmac`/`aes`/`cbc`/`p256`/`aes-gcm`), `rand_core`, `zeroize`, `miniz_oxide` (largeBlob DEFLATE); `hidapi` (non-Linux HID) |
 | `keyroost-oath` | Pure-Rust Yubico/Trussed OATH (TOTP/HOTP) byte layer (APDU + TLV) | `zeroize` |
@@ -41,7 +41,7 @@ tool. Workspace contains:
 | `keyroost-resolve` | Shared key-identity resolution (USB + CCID serials, topology match) and naming (on-key names, first-seen records) | in-tree only (incl. `keyroost-ctap`) |
 | `keyroost-rsakey` | Host-side RSA-2048 keygen + PKCS#1/PKCS#8 (PEM/DER) loading for OpenPGP import | `rsa`, `rand`, `zeroize` (scoped exception) |
 | `keyroost-pivtest` | Host-side verification for the PIV slot self-test (`piv test`): fixed challenges checked against the slot certificate's public key | `rsa`, `p256`/`p384`/`p521` (ECDH), `ed25519-dalek`, `x25519-dalek`, `zeroize` (scoped exception) |
-| `keyroost-import` | otpauth:// + Aegis / 2FAS / otpauth-list parsers | `zeroize`; `serde`/`serde_json` (behind `bulk`); `scrypt`/`aes-gcm`/`base64` (behind `encrypted`, for Aegis vaults) |
+| `keyroost-import` | otpauth:// + Aegis / 2FAS / otpauth-list parsers, file classification, per-key import plan and write loop | `zeroize`; `serde`/`serde_json` (behind `bulk`); `scrypt`/`aes-gcm`/`base64` (behind `encrypted`, for Aegis vaults) |
 | `keyroost-qr` | QR 2FA import from PNG/JPEG screenshots + Google Authenticator migration batches (always built; the GUI's separate `qr` feature gates *screen capture*, not this) | `rqrr`, `png`, `jpeg-decoder`, `zeroize` |
 | `keyroost-screengrab` | Windows-only GDI screen capture for QR-from-screen; the sole `unsafe` FFI crate; inert on non-Windows | `windows-sys` (Windows only) |
 | `keyroost-winwebauthn` | Windows-only non-admin FIDO2 helper: detect a FIDO key, open Windows' security-key settings, relaunch elevated; inert on non-Windows | `windows-sys` (Windows only) |

changelog.d/added-170-import-codes.md

@@ -0,0 +1,11 @@
+- **Import authenticator codes into any key that stores them.** `oath
+  import` adds every code in an Aegis (plain or encrypted), 2FAS,
+  `otpauth://` list or QR export to a YubiKey, Solo 2 or Nitrokey 3, and
+  `otp import` to a Token2 key's OTP storage. In the GUI, drop the file on
+  the window or click "Import file…" in the Authenticator, On-device OTP or
+  Molto2 view; the "Import authenticator codes" dialog works for every key
+  that stores codes. keyroost reads the key first and previews each entry:
+  a code whose name is already on the key is skipped (`--replace`
+  replaces it), and one the key can't store is listed with the reason.
+  `--dry-run` writes nothing. It asks once, writes one code at a time, and
+  stops at the first error with a report of what was added. ([#170])

changelog.d/added-170-solo2-name-limit.md

@@ -0,0 +1,7 @@
+- **Solo 2 names are capped at 127 bytes.** `oath add`, `oath import` and
+  the GUI refuse a longer Solo 2 name before sending it: a 128-byte name
+  made the key stop responding until it was unplugged. ([#170])
+- **YubiKey 4 prefix names.** On YubiKey 4 firmware 4.0 to 4.3.4, `oath
+  add`, `oath import` and the GUI refuse a name that is the start of
+  another name already on the key, following the same rule as Yubico's
+  `ykman`. ([#170])

changelog.d/changed-165-key-selection.md

@@ -3,7 +3,9 @@
   from (now on every platform); a script gets a refusal that lists the
   `--device` value for each key. No command takes "the first key found"
   any more. `--device` takes a name, a serial or a `list` number
-  (`name:`, `serial:` or `list:` forces which). `--device` with `--reader`
-  or `--path` is refused, and so is `--device` on commands that touch no
-  key. `--reader` and `--path` skip the capability check, and a value that
-  matches no detected key is used as typed. ([#165])
+  (`name:`, `serial:` or `list:` forces which); a Molto2 answers to either
+  serial keyroost shows for it, the one in `list` or the one `molto info`
+  prints. `--device` with `--reader` or `--path` is refused, and so is
+  `--device` on commands that touch no key. `--reader` and `--path` skip
+  the capability check, and a value that matches no detected key is used
+  as typed. ([#165])

changelog.d/changed-170-file-password.md

@@ -0,0 +1,5 @@
+- **`molto import --file-password`.** An encrypted Aegis export's password
+  now comes from `--file-password env:NAME` or `--file-password stdin`, the
+  same flag `oath import` and `otp import` use (v0.12's `import-file
+  --password-env` / `--password-stdin` are refused with an error naming
+  it). ([#170])

changelog.d/changed-170-import-dialog.md

@@ -0,0 +1,5 @@
+- **The Molto2 "Bulk import" dialog is replaced.** "Import file…" in the
+  Molto2 view, or a file dropped on the window, opens the shared "Import
+  authenticator codes" dialog. Every dropped file is identified first: a
+  certificate or key file gets a note saying where to import it, and any
+  other file gets "keyroost can't import this file". ([#170])

changelog.d/changed-170-molto-import-rules.md

@@ -0,0 +1,8 @@
+- **`molto import --in` follows the shared import rules.** An entry the
+  Molto2 can't store (for example a SHA-512 code or a 45-second period) is
+  skipped with the reason instead of refusing the whole file, and entries
+  past slot #99 are skipped. An entry with no issuer or account no longer
+  takes a slot. The preview, the one question before writing (`--yes` in
+  a script), the report and `--json` are the same as `oath import`.
+  `--dry-run` shows which slots are in use when a Molto2 is connected
+  (`--device` picks which one). ([#170])

changelog.d/fixed-170-bulk-import-dialog.md

@@ -1,10 +1,9 @@
-- **The Molto2 bulk import dialog closes and says why "Program all" is
-  gray.** Close in the bulk import dialog, and Cancel in the "Import to
-  slot" dialog, did nothing; both now close the dialog, and closing
-  either dialog by any route wipes the typed vault password or pasted URI
-  and drops the parsed entries (which carry seeds).
-  When "Program all" can't run, one line under the buttons now says why:
-  the file is still loading, no Molto2 is selected, the Molto2 isn't
-  unlocked yet (with an Authenticate button right there, and a failed
-  attempt is reported in that line too), or the entries
-  don't all fit before slot #99 (with how many do). ([#170])
+- **The Molto2 import dialog closes and says why adding is gray.** Close
+  in the import dialog, and Cancel in the "Import to slot" dialog, did
+  nothing; both now close the dialog, and closing either dialog by any
+  route wipes the typed file password or pasted URI and drops the parsed
+  entries (which carry seeds).
+  When adding can't start, one line under the buttons now says why: the
+  file is still loading, or the Molto2 isn't open or unlocked yet (with
+  an Authenticate button right there, and a failed attempt is reported in
+  that line too). ([#170])

changelog.d/fixed-170-oath-period-codes.md

@@ -0,0 +1,4 @@
+- **Codes for OATH entries named `60/…` use their period.** `oath code`
+  (without `--period`) and the GUI computed them at 30 seconds, so they
+  were wrong. `--period` now defaults to the name's `period/` prefix, and
+  the GUI shows the period next to the code. ([#170])

changelog.d/fixed-170-oath-period-zero.md

@@ -0,0 +1,2 @@
+- **`oath code --period 0` is a usage error.** It crashed; it is now
+  refused with exit 2. ([#170])