# tsafe-tui

Terminal UI for [tsafe](https://crates.io/crates/tsafe-cli) — full-screen vault
browser built with [ratatui](https://ratatui.rs) and crossterm.

Run with:

```
tsafe ui
```

## Layout

```
┌─ Profiles ──────────┬─ Secrets [default] ─────────────────────────────────┐
│ > default           │  Filter: /                                           │
│   staging           │                                                       │
│   ci                │  myapp/                                               │
│                     │    myapp/DB_PASSWORD                    ••••••••     │
│                     │    myapp/API_KEY                        ••••••••     │
│                     │  GITHUB_TOKEN                           ••••••••     │
│                     │  STRIPE_SECRET                          ••••••••     │
└─────────────────────┴──────────────────────────────────────────────────────┘
 n new  e/↵ edit  d del  r reveal  y copy  m move  h history  / search  ? help
```

## Features

- **Browse and edit secrets** with keyboard navigation — add (`n`), edit
  (`e`/`Enter`), delete (`d` with confirmation), move/rename (`m`)
- **Fuzzy search** with `/` powered by nucleo — filters keys as you type
- **Namespace tree** — collapsible `namespace/` group headers in the secret list
- **Reveal and clipboard** — `r` decrypts and shows a value for 60 seconds then
  auto-conceals; `y` copies to the clipboard and clears it after 30 seconds
- **Secret history viewer** — `h` opens a scrollable version history for any key
- **Audit log viewer** — `a` opens a full-screen view of the HMAC-chained audit log
- **Snapshot restore** — `S` lists available snapshots and restores on `Enter`
- **Password rotation** — `R` launches an in-TUI password-change wizard
- **Profile switching** — `p` cycles between named profiles without leaving the UI
- **New profile wizard** — create a profile and set its password without dropping
  to the shell
- **Quick-unlock via biometric / agent session** — pressing `Enter` on an empty
  password field triggers the OS keyring (Touch ID on macOS, Windows Credential
  Manager on Windows); the TUI suspends raw mode so the OS auth UI can appear
- **Theme cycling** — `T` rotates through dark, light, and high-contrast themes
- **Idle timeout** — session ends automatically after 5 minutes with no input
- **Undo** — `u` within 5 seconds of a delete restores the entry
- **Namespace bulk operations** — copy or move every key under a prefix at once

## Keyboard reference

| Key | Action |
|---|---|
| `n` | New secret |
| `e` / `Enter` | Edit selected secret |
| `d` | Delete (prompts for confirmation) |
| `r` | Reveal plaintext (60 s TTL, then auto-conceals) |
| `y` | Copy to clipboard (30 s TTL, then clears) |
| `m` | Move / rename secret |
| `h` | Version history for selected key |
| `a` | Audit log viewer |
| `S` | Snapshot restore picker |
| `R` | Rotate master password |
| `/` | Fuzzy search |
| `p` | Switch profile |
| `T` | Cycle theme (dark / light / high-contrast) |
| `u` | Undo last delete (5 s window) |
| `q` / `Ctrl-C` | Quit |
| `?` | Help overlay |

## Note

This crate is published separately for modular compilation. End users should
install `tsafe-cli`, which includes the TUI when compiled with the `tui` feature
(on by default). The standalone `tsafe-ui` binary produced by this crate is a
thin shim for direct invocation.

## License

AGPL-3.0-or-later for v1.1.0 and later. Pre-v1.1.0 releases remain available
under the original MIT-OR-Apache-2.0 terms; see the repository root license
files.

Repository: <https://github.com/0ryant/tsafe>
