Proton Pass Plus

Build me a local alias and vault organizer for a KeePassXC database as a limited substitute for Proton Pass Plus. Requirements:

- Build a Python CLI that records login and email-alias labels in a KDBX database through the installed KeePassXC tools; preflight the tool version and use its documented commands.
- Show each alias label, forwarding destination, linked login title, and notes in a local report generated only while the database is unlocked.
- Generate random passwords with the installed vault tool. Provide a dated encrypted database backup and a restore-to-new-path command.
- Store only the database path and display preferences in config; keep master passwords, API keys, and plaintext exports out of logs.
- Alias creation is manual: print instructions for adding an alias with the user's existing email provider, then record it. Do not pretend to create Proton relay addresses.
- No accounts, telemetry, browser autofill, breach monitoring, or unreviewed encryption code.
- README: a short threat model, backup recovery steps, and the missing Proton identity, relay, apps, and audited service.

# AGENTS.md — Build guide for Proton Pass Plus

## Project scope
Create a local password and alias vault with strong encryption, portable encrypted backups, explicit threat-model documentation, and no claim of replacing an audited service.

Catalogue verdict: no. A consolation build is possible, but the paid product's decisive value sits outside a solo rebuild. For Proton Pass Plus, create a local password and alias vault with portable encrypted backup. The hard boundary is proton identity, email alias infrastructure, audits, apps, recovery, and privacy operations, plus security assurance, infrastructure, and trust.
Use the implementation prompt below to define the deliverable. Complete each phase's acceptance checks before extending the scope.

## Working agreement
- Inspect the repository and its existing instructions before choosing paths, dependencies or commands. Keep one coherent stack and explain changes to the proposed architecture.
- Plan a vertical slice that accepts a real input and produces the useful output described below. Persist only the state the prompt calls for; respect memory-only and upstream-managed workflows. Use fixtures only when they are clearly labelled.
- After scaffolding, document the actual install, development, check and build commands in README and keep them synchronized with the package or project manifest. Do not report commands as successful unless they ran.
- Work in small steps. At handoff, list implemented flows, checks actually performed, remaining blockers, and any credentials or provider setup the owner must supply.
- Do not publish, spend money, contact customers, delete source data or run irreversible migrations without the project owner's authorization.

## Prerequisites
- desktop OS
- secure backup location
- modern cryptographic libraries
- careful review before real-world use

## Stack and architecture
- Python standard library CLI
- Installed KeePassXC and keepassxc-cli
- KDBX database

## Security and data integrity
- Use KeePassXC for cryptography rather than writing new vault encryption
- Do not persist unlock material
- Treat exported reports as sensitive and make persistence opt-in

## Agent implementation rules
- Consult installed KeePassXC command help
- Explain alias creation as a provider-side manual step

## Optional agent skills and references
No installable skill is listed for this guide; use the project rules and the stack documentation.

Read the linked SKILL.md and its dependencies before adding a skill. Select only the skills matching this project's runtime and task; their documentation does not supply API access, credentials or approval to perform external actions. Pin the reviewed revision where the tool supports it. Follow the chosen agent's documented project-level installation mechanism.

## Distribution ideas
These are optional planning notes. Obtain the owner's approval before publishing or contacting anyone.
- Describe this as a manual local workflow with no Proton service integration

## Engineering roadmap
1. Implement the local CLI and a KDBX-backed alias record workflow.
2. Add encrypted-file backup and restore-to-new-path commands.
3. Document missing alias infrastructure and service guarantees plainly.

## Paid-product capabilities outside this build
- Proton identity, email alias infrastructure, audits, apps, recovery, and privacy operations
- independent security audits
- global relay infrastructure
- breach monitoring data
- account recovery and support

## Implementation prompt
Build me a local alias and vault organizer for a KeePassXC database as a limited substitute for Proton Pass Plus. Requirements:

- Build a Python CLI that records login and email-alias labels in a KDBX database through the installed KeePassXC tools; preflight the tool version and use its documented commands.
- Show each alias label, forwarding destination, linked login title, and notes in a local report generated only while the database is unlocked.
- Generate random passwords with the installed vault tool. Provide a dated encrypted database backup and a restore-to-new-path command.
- Store only the database path and display preferences in config; keep master passwords, API keys, and plaintext exports out of logs.
- Alias creation is manual: print instructions for adding an alias with the user's existing email provider, then record it. Do not pretend to create Proton relay addresses.
- No accounts, telemetry, browser autofill, breach monitoring, or unreviewed encryption code.
- README: a short threat model, backup recovery steps, and the missing Proton identity, relay, apps, and audited service.

## Completion evidence
Demonstrate the prompt's acceptance scenarios against the scoped workflow. Include setup from a clean checkout and failure recovery. Check persistence across restart and export/restore only for the state the prompt says to store; for memory-only tools, confirm that temporary content is discarded as specified. Record actual results and remaining limitations. A detailed plan alone does not establish a working replacement.