[replydev]

Summary

Expand cotp's CLI authentication workflows and protect vault changes across processes. Code generation now supports unambiguous account selection, structured output, validity thresholds, watch mode, and noninteractive password input. HOTP counters are persisted before codes are returned.

• Add stable account IDs, aliases, tags, favorites, custom ordering, configuration profiles, shell completions, and manual pages.
• Add atomic vault writes, cross-process locking, stale-write checks, encrypted backup management, and explicit encrypted snapshot merging with conflict and HOTP policies.
• Add local QR enrollment, validated import plans and duplicate policies, 2FAS/Ente/Bitwarden/1Password migration formats, selective exports, and encrypted Aegis exports.
• Add session locking with encrypted pending-edit restoration, clipboard expiration, opt-in OS keychain unlocking, and YubiKey OATH support through ykman.
• Add RFC conformance and malformed-input coverage, headless CI, release checksums and provenance configuration, and user/security documentation.

Features were developed in independent worktrees and merged into this feature branch. See the implementation inventory for branch coverage and deliberate boundaries.

Validation

Passed locally on Linux aarch64:

cargo fmt --all -- --check
cargo clippy -- -D warnings
cargo test --locked --quiet
cargo test --locked --release --quiet
cargo clippy --locked --no-default-features -- -D warnings
cargo test --locked --no-default-features --quiet
uv run --with pytest python -m pytest -q converters

Each Rust configuration passed 120 unit tests and 24 integration tests. The ignored cross-process locking helper is invoked explicitly by its parent test. All four Python converter tests passed.

Compatibility and verification limits

Plaintext export requires explicit consent; read-only commands do not create a missing vault. Account indexes are one-based and ambiguous selectors fail. Vault schema migration adds persistent account metadata.

Snapshot exchange is explicit and local; HOTP counter merging does not make concurrent offline generation safe. Native clipboard expiration is best effort, and OSC52 copies cannot be cleared with an ownership check.

macOS, Windows, physical YubiKeys, native credential stores, and the release attestation workflow were not exercised locally. Backend tests use fixtures and mocks.

[github-advanced-security]

CodeQL found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.