kosh copy

Copy a credential from the active profile into another profile’s vault.

kosh copy <id> <profile>

Arguments: exactly two — the numeric credential ID and the target profile name.

Run kosh list to find the ID and kosh profile list to see the available profiles.

Notes

• The secret is decrypted with the active profile’s master password and re-encrypted for the target profile with a fresh ephemeral keypair and nonce.
• The target profile’s vault must already be initialized, otherwise target profile vault is not initialized.
• The original credential is left untouched — this is a copy, not a move.
• The target profile name is matched ignoring case, and the credential is written to the profile under the spelling it is stored as. The name is matched whole, and is not cleaned up the way kosh profile create cleans it — pass it exactly as kosh profile list shows it.
• A target that does not exist is reported as profile does not exist; that check runs before the active-profile check below.
• Copying to the active profile is rejected with cannot copy credential to active profile, and that guard folds case too — copying to WORK while work is active is rejected.
• Collision is on the (label, user) pair. If the target already holds that pair, a caution block is shown and you must type overwrite <label> <user> in <target>. The overwritten secret is unrecoverable.

The target profile’s password is not requested

Writing into a vault needs only its public key, so copy never prompts for the target’s master password. Anyone who can unlock the source profile can add entries to a target profile without knowing its password — but they still cannot read anything in it.

See Cross-profile copy asymmetry.

Examples

kosh copy 3 work

kosh list -l github
kosh copy 7 personal

See also

• Profiles — the guide