sshkeeper v0.8.6

sshkeeper v0.8.6 — password-only sync recovery

Changed

• New installations restore an existing encrypted sync with the storage
  location and original vault master password. No device pairing is required.
• Creating a sync space publishes a separately encrypted, password-recoverable
  copy of the random 256-bit sync key.
• Existing spaces can enable the new workflow in place without rewriting
  existing encrypted bundle data. Recovery keys and legacy pairing CLI remain
  compatible for older installations.
• The TUI no longer shows device pairing controls. A recovery-password action
  lets existing users enable or update the password needed for new restores.
• Folder sync stores the access envelope in sshkeeper.access; Git sync uses
  the dedicated sshkeeper-access branch to avoid interference from old clients.
• Tests cover new/legacy restore, wrong passwords, SSH private keys and secrets,
  orphaned access files and Git storage.

Security note

A stolen password-protected access file can be subjected to offline master
password guesses, unlike the previous randomly keyed recovery-only approach.
The key wrapper uses Argon2id (128 MiB, three passes) and XChaCha20-Poly1305.
Use a strong unique master password and restrict remote storage permissions.
Server-side version history is needed to recover from deletion or rollback.

Upgrade notes

• Existing devices continue syncing normally; on an already connected machine
  choose Enable / update password recovery (or
  sshkeeper sync enable-password) once before replacing all devices.
• After changing your original master password, re-publish recovery with the
  new password; existing joined devices keep their locally saved random key.
• If the original installation is already gone and migration was never
  enabled, restoring an old bundle still needs its random recovery key.