Import selected logins into Managed Auth

[IlyaasK]

What

Adds the second CLI import layer on top of #223:

• discovers matching Bitwarden and 1Password login metadata for the 5–10 selected sites
• unlocks Bitwarden interactively for this import when the local vault is locked
• asks the user to choose at most one account per site
• reveals only approved secrets after the browser profile has been created
• creates or reconciles Kernel credentials and Managed Auth connections
• imports supported TOTP secrets
• optionally installs a small Managed Auth skill into detected local agent directories
• selects the destination project in Terminal when the account has multiple projects

Why

The customer outcome is one local wizard: choose a project, import useful browser cookies, approve a small set of matching accounts, and leave agents with profile state plus Managed Auth connections. It avoids uploading an entire vault, requiring hundreds of manual Managed Auth setups, or copying a project ID from the dashboard.

How

• Bitwarden authorization stays local. Its session key remains in the CLI process and is passed to child commands through their environment, never argv or shell state.
• Bitwarden uses site-scoped metadata queries and fetches only approved item IDs.
• 1Password uses personal-vault metadata, prefers long list records containing URLs, and reveals only selected item IDs.
• Provisioning uses stable provider item identities, checks existing profile/domain connections first, and reconciles response-loss retries.
• Project selection pages active projects, auto-selects the only project, and prompts only when there are multiple.
• Terminal option text is single-line, ANSI/control sanitized, and bounded by display-cell width to avoid wrapped selector redraw artifacts.
• Agent-skill installation rejects symlinks and customized existing skills and writes atomically.

Verification

• affected package tests: go test ./internal/passwordmanager ./internal/agentskills ./internal/browserimport ./cmd -count=1
• affected package vet: go vet ./internal/passwordmanager ./internal/agentskills ./internal/browserimport ./cmd
• focused normal and race tests for password managers, browser import, Managed Auth reconciliation, TOTP removal, agent-skill installation, project selection, and terminal rendering
• independent Dave Cheney, eBlog, and thermonuclear reviews; all actionable findings addressed

Stack

• Parent: Add local Chrome profile import to the Kernel CLI #223
• This PR is API-deployment dependent on kernel/kernel#3244 for Idempotency-Key response-loss recovery.

---

Note

High Risk
Handles passwords and TOTP from local vaults, creates/updates cloud credentials, and writes files into agent skill directories. Failures in selection, reveal, or reconciliation can leak or overwrite auth state.

Overview
kernel profiles import-local can now match Bitwarden/1Password logins for the selected sites, create Kernel credentials plus Managed Auth connections (including supported TOTP), and optionally install a Managed Auth agent skill.

Secrets are revealed only after the browser profile exists, and only for user-approved items (at most one login per site). Bitwarden can unlock in-process; 1Password is limited to personal vaults. Provisioning uses stable import names, refreshes existing connections, and refuses to overwrite a domain already bound to another credential.

The wizard also prompts for the destination project when several are active, counts cookies before site selection, retries browser-import create with an idempotency key, and writes SKILL.md atomically while refusing symlinks and customized skills.

^{Reviewed by Cursor Bugbot for commit abd122d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit abd122d. Configure here.}

[cursor]

Project name client option mismatch

Medium Severity

The Managed Auth client is built with option.WithProjectID using the raw --project / KERNEL_PROJECT value. When that value is a project name, chooseImportProject returns it unchanged. Elsewhere the CLI uses option.WithProject, which is documented to accept a name or ID, so credential and connection calls can be scoped incorrectly while the cookie import still proceeds.

Additional Locations (1)

• cmd/profiles_import_local.go#L796-L800

 

^{Reviewed by Cursor Bugbot for commit abd122d. Configure here.}