smcli: login-item support + convert command (notes -> username/password/apikey)

Founder follow-up: lifted items restructured to proper login items
(first-class username/password/URIs, remainder as named custom fields).
Classified from the env-key semantics; zero data loss.
Ticket: https://projects.knownelement.com/issues/829

cli/cmd/smcli/api.go

@@ -225,8 +225,6 @@ func (c *Client) EditCipher(id string, cipherJSON any) ([]byte, error) {
 	return c.api("PUT", "/api/ciphers/"+id, cipherJSON, true)
 }
 
-
-
 func deviceID() string {
 	// stable per machine: hash of hostname (no secrets involved)
 	hn := hostnameSafe()

cli/cmd/smcli/main.go

@@ -415,6 +415,11 @@ func main() {
 		for _, f := range sync.Folders {
 			fmt.Println(f.ID, f.Name)
 		}
+	case "convert":
+		if len(os.Args) < 3 {
+			fatal("convert <name>")
+		}
+		err = cmdConvert(os.Args[2])
 	default:
 		usage()
 		os.Exit(1)
@@ -448,3 +453,87 @@ func usage() {
   folders                      list folders
 `)
 }
+
+// classifyCreds maps lifted env fields to login-item structure.
+func classifyCreds(fields []PlainField) (username, password string, uris []string, rest []PlainField) {
+	used := map[int]bool{}
+	pick := func(res []string) (PlainField, bool) {
+		for i, f := range fields {
+			if used[i] {
+				continue
+			}
+			up := strings.ToUpper(f.Name)
+			for _, re := range res {
+				if strings.Contains(up, re) && f.Value != "" {
+					used[i] = true
+					return f, true
+				}
+			}
+		}
+		return PlainField{}, false
+	}
+	if f, ok := pick([]string{"USERNAME", "USER", "EMAIL", "LOGIN", "AUTH_ID"}); ok {
+		username = f.Value
+	}
+	if f, ok := pick([]string{"PASSWORD", "PASS", "TOKEN", "SECRET", "APIKEY", "API_KEY", "KEY", "HASH", "REFRESH"}); ok {
+		password = f.Value
+	}
+	for i, f := range fields {
+		up := strings.ToUpper(f.Name)
+		if !used[i] && (strings.HasSuffix(up, "URL") || strings.HasSuffix(up, "URI") || strings.HasSuffix(up, "DASH") || strings.Contains(up, "ENDPOINT")) && f.Value != "" {
+			used[i] = true
+			uris = append(uris, f.Value)
+		}
+	}
+	for i, f := range fields {
+		if used[i] || f.Value == "" {
+			continue
+		}
+		up := strings.ToUpper(f.Name)
+		hidden := strings.Contains(up, "PASS") || strings.Contains(up, "TOKEN") || strings.Contains(up, "SECRET") || strings.Contains(up, "KEY") || strings.Contains(up, "HASH")
+		t := 0
+		if hidden {
+			t = 1
+		}
+		rest = append(rest, PlainField{Type: t, Name: f.Name, Value: f.Value})
+	}
+	return
+}
+
+func cmdConvert(name string) error {
+	s, err := loadState()
+	if err != nil {
+		return err
+	}
+	c, err := newClientFromState(s)
+	if err != nil {
+		return err
+	}
+	pc, raw, err := findCipher(c, c.UserSymKey, name)
+	if err != nil {
+		return err
+	}
+	all := append([]PlainField{}, pc.Fields...)
+	var folderID string
+	var parsed map[string]any
+	_ = json.Unmarshal(raw, &parsed)
+	if v, ok := parsed["folderId"].(string); ok {
+		folderID = v
+	}
+	username, password, uris, rest := classifyCreds(all)
+	payload, err := BuildLoginJSON(c.UserSymKey, name, folderID, username, password, uris, rest, nil)
+	if err != nil {
+		return err
+	}
+	if _, err := c.CreateCipher(payload); err != nil {
+		return err
+	}
+	// remove the old note
+	var parsedOld map[string]any
+	_ = json.Unmarshal(raw, &parsedOld)
+	if id, ok := parsedOld["id"].(string); ok {
+		_ = c.DeleteCipher(id)
+	}
+	fmt.Printf("converted: %s (user=%v pass=%v uris=%d fields=%d)\n", name, username != "", password != "", len(uris), len(rest))
+	return nil
+}

cli/cmd/smcli/model.go

@@ -201,3 +201,65 @@ func parseEnvFields(text string) []PlainField {
 	}
 	return out
 }
+
+// BuildLoginJSON produces an encrypted login-item payload: username/password
+// as first-class login fields, URIs, and the remaining keys as custom fields
+// (hidden for secrets, text for URLs/IDs).
+func BuildLoginJSON(userKey []byte, name, folderID, username, password string, uris []string, fields []PlainField, existing *cipherRaw) (map[string]any, error) {
+	nameEnc, err := encStr(userKey, name)
+	if err != nil {
+		return nil, err
+	}
+	login := map[string]any{}
+	if username != "" {
+		u, err := encStr(userKey, username)
+		if err != nil {
+			return nil, err
+		}
+		login["username"] = u
+	}
+	if password != "" {
+		p, err := encStr(userKey, password)
+		if err != nil {
+			return nil, err
+		}
+		login["password"] = p
+	}
+	if len(uris) > 0 {
+		var list []map[string]any
+		for _, u := range uris {
+			ue, err := encStr(userKey, u)
+			if err != nil {
+				return nil, err
+			}
+			list = append(list, map[string]any{"uri": ue})
+		}
+		login["uris"] = list
+	}
+	var encFields []map[string]any
+	for _, f := range fields {
+		fn, err := encStr(userKey, f.Name)
+		if err != nil {
+			return nil, err
+		}
+		fv, err := encStr(userKey, f.Value)
+		if err != nil {
+			return nil, err
+		}
+		encFields = append(encFields, map[string]any{"type": f.Type, "name": fn, "value": fv})
+	}
+	payload := map[string]any{"type": 1, "name": nameEnc, "login": login}
+	if len(encFields) > 0 {
+		payload["fields"] = encFields
+	}
+	if folderID != "" {
+		payload["folderId"] = folderID
+	}
+	if existing != nil {
+		payload["id"] = existing.ID
+		if existing.OrganizationID != nil {
+			payload["organizationId"] = existing.OrganizationID
+		}
+	}
+	return payload, nil
+}

docker/compose.yaml

@@ -10,7 +10,7 @@
 name: knel-secretsmanager
 services:
   smcli:
-    image: git.knownelement.com/knel/knel-secretsmanager-cli@sha256:41fe9bf298ba6d338ee658cf84f9914f7d607bfb27232c8deb2479c22ed0545d
+    image: git.knownelement.com/knel/knel-secretsmanager-cli@sha256:a0482ad7ebbfed58e0662fa99fc1ac9416d2542058db7df02907a9fe7f9e21e7
     container_name: ukrrs-secretsmgr-cli
     restart: unless-stopped
     entrypoint: ["sleep", "infinity"]