- AES-256-CBC store with PBKDF2-SHA256 (600k iters), passphrase auth
- FIDO2/PAM opt-in second factor via pam_u2f + pamtester
- fzf TUI: vim-style nav (j/k/g/G//), a=add, d=delete, q=quit
- Full-screen tput add form with Tab/Enter field advance, star-masked password
- SSH_ASKPASS_REQUIRE=force for stored password auth (no sshpass)
- First-launch dialog to choose passphrase vs FIDO2
- Hyprland keybind: SUPER-ALT-CTRL-S
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The_miro