feat(vault): vault register + vault login (account profile)

Add the last two PRD §7.1 verbs as an account-profile flow (not the
Bitwarden personal API-key model, which stays a tracked follow-up).

register: records the account — server, lower-cased email, and a freshly
minted stable device_id — into a new [account] table in config.toml. No
agent or network; a light http(s):// check is the only validation, with
real errors surfacing at first login. Re-registering preserves the
existing device_id.

login: authenticates against the registered account (master password →
Request::Unlock) and ends on a status-backed sync summary ("logged in as
<email> · <n> items · synced <ts>", or --json). Auto-spawns the agent, so
a cold `vault login` brings everything up.

unlock: now resolves server/email from the profile too, so its flags
(and $VAULT_SERVER/$VAULT_EMAIL) are optional once registered. Precedence
is explicit flag/env → profile → error. login and unlock share one
Request::Unlock; the difference is resolution and login's verbose,
status-backed success.

Stable device id: Request::Unlock gains a serde-defaulted
device_id: Option<String>; the agent uses it as the Bitwarden
deviceIdentifier instead of minting a fresh UUID each unlock, so the
account stops accumulating a new device per session. Old Unlock frames
without the field still decode (regression-tested).

CLI-only beyond that one optional IPC field: no vault-api surface, no
agent auth split. New uuid dep on vault-cli (already in the workspace).

Tests: [account] round-trip + no-empty-table-until-set + device-id
mint/preserve + email lower-casing; resolve_account precedence
(flag → profile → error); Unlock device-id round-trip and
old-frame-decode regression. Verified live: register (lower-case +
mint), --json, non-http rejection, no-profile login error, and flag-less
unlock resolving from the profile.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: UnbreakableMJ

CHANGELOG.md

@@ -10,6 +10,34 @@ range may break in any release.
 
 ### Added
 
+- **`vault register` + `vault login` — account profile (PRD §7.1).** The last
+  two unimplemented verbs, as an account-profile flow (not the Bitwarden
+  personal API-key model, which stays a tracked follow-up).
+  - **`register`** records the account — server, email (lower-cased), and a
+    freshly minted stable `device_id` — into a new `[account]` table in
+    `config.toml`. No agent or network (a light `http(s)://` check is the only
+    validation; real errors surface at first `login`). Re-registering keeps the
+    existing `device_id`.
+  - **`login`** authenticates against the registered account (master password →
+    `Request::Unlock`) and ends on a sync summary
+    (`logged in as <email> · <n> items · synced <ts>`, or `--json`). It
+    auto-spawns the agent, so a cold `vault login` brings everything up.
+  - **`unlock`** now resolves `server`/`email` from the profile too, so its
+    flags (and `$VAULT_SERVER`/`$VAULT_EMAIL`) are optional once registered;
+    precedence is explicit flag/env → profile → error. `login` and `unlock`
+    share one `Request::Unlock` — the difference is resolution and `login`'s
+    verbose, status-backed success.
+  - **Stable device id.** `Request::Unlock` gains a serde-defaulted
+    `device_id: Option<String>`; the agent uses it as the Bitwarden
+    `deviceIdentifier` instead of minting a fresh UUID each unlock, so the
+    account stops accumulating a new device per session. Old `Unlock` frames
+    without the field still decode (regression-tested).
+  - Tests: `[account]` round-trip + "no empty table until set" + device-id
+    mint/preserve + email lower-casing; `resolve_account` precedence
+    (flag → profile → error); the `Unlock` device-id round-trip and
+    old-frame-decode regression. New `uuid` dep on `vault-cli` (already in the
+    workspace tree).
+
 - **`vault config` + `vault purge` (PRD §7.1).** A persistent, typed config
   file and the two remaining settings/maintenance verbs.
   - **Config file** at `$XDG_CONFIG_HOME/vault/config.toml`, modeled as a

Cargo.lock

@@ -44,6 +44,20 @@ sibling of the `vault` binary, then `$PATH` (override with
 `$VAULT_AGENT_BIN`; opt out per-call with `--no-auto-spawn`). A spawned
 agent logs to `agent.log` beside the socket.
 
+## Getting started
+
+```sh
+vault register --server https://vault.example.org --email me@example.org
+vault login      # master password → authenticate + confirm a sync
+vault list       # browse; server/email come from the registered profile
+```
+
+`register` records the account (server, email, and a stable device id) in the
+config file; `login` and `unlock` then resolve those from the profile, so their
+`--server`/`--email` flags (and `$VAULT_SERVER`/`$VAULT_EMAIL`) are optional
+once registered. `login` is the first-time "authenticate and verify sync";
+`unlock` is the routine "hand the agent my key again".
+
 ## Configuration
 
 Persistent settings live at `$XDG_CONFIG_HOME/vault/config.toml`, managed with

README.md

@@ -80,11 +80,12 @@ async fn dispatch(req: Request, state: &Arc<Mutex<AgentState>>) -> Response {
             server,
             email,
             password,
+            device_id,
         } => {
             // Wrap the password so it is zeroised on drop no matter how
             // perform_unlock fares; deref coercion hands it to the API as &[u8].
             let password = zeroize::Zeroizing::new(password);
-            let unlock_res = perform_unlock(&server, &email, &password).await;
+            let unlock_res = perform_unlock(&server, &email, &password, device_id.as_deref()).await;
             match unlock_res {
                 Ok(vault) => {
                     let mut s = state.lock().await;

crates/vault-agent/src/server.rs

@@ -16,10 +16,20 @@ use crate::state::Vault;
 
 /// Lock-step the unlock sequence:
 /// prelogin → derive master key → login → decrypt user key → sync → assemble.
-pub async fn perform_unlock(server: &str, email: &str, password: &[u8]) -> Result<Vault, IpcError> {
+pub async fn perform_unlock(
+    server: &str,
+    email: &str,
+    password: &[u8],
+    device_id: Option<&str>,
+) -> Result<Vault, IpcError> {
     let email_lower = email.trim().to_lowercase();
     let urls = BaseUrls::self_hosted(server).map_err(|e| IpcError::Internal(e.to_string()))?;
-    let mut client = BitwardenClient::new(urls, Uuid::new_v4(), "vault-agent").map_err(api_err)?;
+    // Prefer the account profile's stable device id; fall back to a fresh one
+    // so an unregistered unlock still works (it just registers a new device).
+    let device = device_id
+        .and_then(|s| Uuid::parse_str(s).ok())
+        .unwrap_or_else(Uuid::new_v4);
+    let mut client = BitwardenClient::new(urls, device, "vault-agent").map_err(api_err)?;
 
     let prelogin = client.prelogin(&email_lower).await.map_err(api_err)?;
     let params = prelogin.into_kdf_params().map_err(crypto_err)?;

crates/vault-agent/src/unlock.rs

@@ -37,6 +37,7 @@ serde_json = { workspace = true }
 tempfile = { workspace = true }
 tokio = { workspace = true }
 toml = { workspace = true }
+uuid = { workspace = true }
 zeroize = { workspace = true }
 vault-core = { path = "../vault-core" }
 vault-ipc = { path = "../vault-ipc" }

crates/vault-cli/Cargo.toml

@@ -33,6 +33,11 @@ pub struct Config {
     pub clipboard: ClipboardCfg,
     /// Agent settings.
     pub agent: AgentCfg,
+    /// Registered account profile (written by `vault register`). Skipped from
+    /// the file until something is set, so an unregistered config carries no
+    /// empty `[account]` table.
+    #[serde(skip_serializing_if = "AccountCfg::is_empty")]
+    pub account: AccountCfg,
 }
 
 /// `[clipboard]` table.
@@ -51,6 +56,31 @@ pub struct AgentCfg {
     pub idle_lock_secs: Option<u64>,
 }
 
+/// `[account]` table — the registered account, written by `vault register`
+/// and read by `login`/`unlock` to default `server`/`email`/`device_id`.
+#[derive(Clone, Debug, Default, PartialEq, Eq, Deserialize, Serialize)]
+#[serde(default, deny_unknown_fields)]
+pub struct AccountCfg {
+    /// Server origin (`https://vault.example.org`).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub server: Option<String>,
+    /// Account email (lower-cased on write).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub email: Option<String>,
+    /// Stable per-account device identifier (uuid v4), minted once at register
+    /// time so the agent stops registering a fresh device each unlock.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub device_id: Option<String>,
+}
+
+impl AccountCfg {
+    /// Whether no account field is set (drives skipping the table on write).
+    #[must_use]
+    pub const fn is_empty(&self) -> bool {
+        self.server.is_none() && self.email.is_none() && self.device_id.is_none()
+    }
+}
+
 impl Config {
     /// Effective `clipboard.clear_secs`, if set.
     #[must_use]
@@ -64,6 +94,23 @@ impl Config {
         self.agent.idle_lock_secs
     }
 
+    /// The registered account profile.
+    #[must_use]
+    pub const fn account(&self) -> &AccountCfg {
+        &self.account
+    }
+
+    /// Record the account `server` + `email`, lower-casing the email and
+    /// minting a `device_id` once (a pre-existing id is preserved so the
+    /// account keeps its identity across re-registration).
+    pub fn set_account(&mut self, server: &str, email: &str) {
+        self.account.server = Some(server.to_owned());
+        self.account.email = Some(email.trim().to_lowercase());
+        if self.account.device_id.is_none() {
+            self.account.device_id = Some(uuid::Uuid::new_v4().to_string());
+        }
+    }
+
     /// Current value of `key` as a display string, `None` when unset. Errors
     /// (as the offending key) when `key` is not recognised.
     pub fn get(&self, key: &str) -> Result<Option<String>, String> {
@@ -262,6 +309,39 @@ mod tests {
         assert_eq!(back, c);
     }
 
+    #[test]
+    fn set_account_lowercases_email_and_mints_device_id_once() {
+        let mut c = Config::default();
+        c.set_account("https://vault.example.org", "Me@Example.org");
+        assert_eq!(
+            c.account().server.as_deref(),
+            Some("https://vault.example.org")
+        );
+        assert_eq!(c.account().email.as_deref(), Some("me@example.org"));
+        let id = c.account().device_id.clone().expect("device_id minted");
+        // Re-registering a different server/email keeps the same device id.
+        c.set_account("https://other.example.org", "Other@Example.org");
+        assert_eq!(c.account().device_id.as_deref(), Some(id.as_str()));
+        assert_eq!(c.account().email.as_deref(), Some("other@example.org"));
+    }
+
+    #[test]
+    fn account_round_trips_and_absent_until_set() {
+        // A config with nothing set must not emit an [account] table.
+        let empty = toml::to_string_pretty(&Config::default()).expect("serialise");
+        assert!(
+            !empty.contains("[account]"),
+            "empty config grew [account]:\n{empty}"
+        );
+
+        let mut c = Config::default();
+        c.set_account("https://vault.example.org", "me@example.org");
+        let text = toml::to_string_pretty(&c).expect("serialise");
+        assert!(text.contains("[account]"), "account table missing:\n{text}");
+        let back: Config = toml::from_str(&text).expect("parse");
+        assert_eq!(back.account(), c.account());
+    }
+
     #[test]
     fn agent_args_emits_only_set_keys_in_order() {
         let mut c = Config::default();