[ericliswan]

Summary

Implements pwv add <site> and pwv list [--search <text>]. add unlocks the vault first, then prompts for username, password and notes; password and notes use hidden prompts. list prints a sorted table of site and username only. --search keeps entries whose site or username contains the text, ignoring case.

Closes #30

Type of change

• feat - [ ] fix - [ ] docs - [x] test - [ ] refactor - [ ] ci/chore - [ ] security

How was this tested?

• cargo fmt --all --check, cargo clippy --workspace --all-targets --all-features -- -D warnings (and without features), cargo test --workspace --all-features, cargo deny check
• Unit tests: the table is sorted, aligned and contains no password or notes text; search matches site or username ignoring case and never matches the password
• Integration test through the real binary: init → add ×2 (plus an empty password, which is rejected) → list → list --search (hit and miss), then unlock in-process to check the stored password and notes; no command output contains the secrets
• By hand: add against a missing vault (exit 1 with an init hint) and with a wrong master password (exit 3)

Security checklist

• No secret in args, env vars, logs, Debug output, errors or panics
• Crypto is called only from pwv-core::kdf / pwv-core::crypto
• Any new header/file-format field is inside the AAD and validated on load (no format change)
• Failure paths have tests (wrong password, tampering, bad input)
• Docs (README / DESIGN / THREAT_MODEL) updated if behaviour changed (command reference comes with the v0.5 README)

Notes for the reviewer

• The master password is asked before the entry fields, so a typo fails before the user types anything else.
• Notes use a hidden prompt because the model stores them as SecretText. The trade-off: you can't see notes while typing them.
• Duplicate sites are allowed (two accounts on one site); get, edit and delete will ask which one in the next PR.
• The entry password is entered once, without confirmation. add --generate (PR feat(storage): atomic vault persistence #17) will be the main way to set one.

[ericliswan]

Self-review: read the full gh pr diff. Checked the following:

• Output: add prints only the site name; list prints only site and username columns. The tests assert passwords and notes never appear.
• Secret copies: secret_text copies the SecretString straight into SecretText (a zeroizing String), and the SecretString is zeroized on drop.
• --search lowercases the query once and never looks at secret fields.
• unlock checks the vault exists before prompting, so a missing file is a clear exit-1 error instead of a password prompt followed by an I/O error.
• 211 changed lines excluding Cargo.lock.

Not covered: terminal control characters in site or username names are printed as-is. It's the user's own data, and it's noted for the hardening PR.