v1.4.0 — two-step and new-device logins

Logging in works again for accounts with a second factor. Eight defects stood
between such an account and a login that finishes; they compound, so each was
hidden behind the last.

Two-step login asks which method you use

The panel never sent --method, and a code without its method is a code the
server rejects. bw only puts the two-step token on the wire when a provider
came with it, so --code alone made the request a bare password grant — and an
email provider answers that by issuing a fresh code, invalidating the one
you just typed. Authenticator codes survived the omission because the server
does not issue them; emailed ones never could.

An account with more than one method fared worse still: the login failed with
Login failed. No provider selected. and no way forward.

So the method is now asked once per account, before any code is collected, and
remembered per login address. Choosing Email is also what makes Bitwarden
send the email. Change method on the code screen asks again.

A login waiting on an emailed code survives the panel closing

It could not before — closing dropped the master password and the login stage,
so going to read the code meant coming back to a blank form. An emailed code
cannot be read without leaving the panel, which made email two-step and
new-device verification impossible to complete here at all.

The login is now held for five minutes, on the wall clock so a suspend counts
against it, and reopening lands on the field that was waiting.

New-device verification (#4)

A login on a machine Bitwarden has not seen before used to ask for the emailed
code over and over: bw login has no flag for that code, and the step that
needs it never reads --code. The panel now answers bw's prompt directly, and
offers a terminal only if the login meets something it cannot answer.

Fixed

• A bw status check no longer cancels the login it lands in the middle of. It
  takes seconds and answers about the world as it was when it started, so it
  reported unauthenticated and the panel killed the login you had just
  submitted — the button dropped out of "Verifying…" and nothing was shown.
• A verification code typed into the panel is no longer discarded on the way
  out. Typing into a field breaks the binding to the state behind it, so
  clearing that state left the field showing a code the login could not see.
• A login no longer has to be submitted twice, from either of two causes: a
  submit queued against the output-buffer scrub was dropped, and a password
  delivery that missed its window left the button for you to press again.
• A vault that has never synced is no longer shown as an empty vault. bw login
  swallows a failed sync and still prints a working session, onto a local vault
  holding no ciphers.
• A login that ends without a session says so, instead of failing silently.
• An account whose only two-step methods are ones the CLI cannot perform — a
  passkey, or Duo — says so and points at API key login.

Security

• Logging out no longer takes the cursor out of the master password field a few
  seconds later, which moved the rest of the password into the unmasked email
  field. The same fix covers the API key form.
• The one login that runs with bw's prompts enabled answers on a pipe rather
  than a pty, so an unexpected prompt still ends the login instead of hanging it
  with the master password loaded.
• A closed panel holds one thing it did not before: a login stopped on a second
  factor keeps the master password and its stage for five minutes. A deliberate
  exception, bounded on the wall clock, ended early by locking, logging out, or
  succeeding.

Upgrading

Nothing to do. The remembered method is absent until a login writes it, so your
first login after upgrading behaves as it did before and remembers your method
on the way through.

Every login result is now logged with the branch it took, the exit code and byte
counts — lengths and flags only, never a session, never a code. Read it with
quickshell log -f | grep qs-bitwarden.

Full changelog: v1.3.1...v1.4.0