Connect

Passwords

Fill logins from Proton Pass, or hand off to Passbolt.

Proton Pass

With Proton Pass turned on, gl fills the login form of the current page and gL fills the one-time code of the login filled last in that tab. Cmd+Shift+L and Cmd+Shift+O do the same and also work in insert mode.

Set up

1. Install Proton's command line tool: brew install protonpass/tap/pass-cli
2. Turn on Proton Pass in the settings (g,), or set "protonPass": true.
3. Press gl on a login page. Proton's sign-in opens in your default browser; confirm it there, then press gl again.

Filling

Lean finds the login by its title. One match fills at once; otherwise you pick from a list and can type to filter all your logins. The best matches show their user name and whether they are saved for this site.

Before a password or a code is filled, the address saved with the login is compared with the page: the host must be the saved one or a subdomain of it. If it differs, or the page is not encrypted, Lean asks first.

How the vault is guarded

• Lean's own sign-in. It is kept encrypted in ~/.config/lean/pass-session, with a key in the macOS Keychain that is bound to Lean. Running pass-cli in a terminal finds no session.
• Touch ID. Asked before the vault is used; one confirmation holds for 5 minutes (passAuthMinutes).
• The tool itself. Before every start Lean checks that pass-cli is signed by Proton. Anything else in its place is not started.
• Sign-out. After 60 minutes without a fill (passLogoutMinutes), and when Lean quits.
• Nothing is stored. A password is fetched for the one login you picked and goes straight into the form. Titles are kept in memory for 15 minutes.

Signing in without the browser

Store a Proton personal access token under Settings → General → “Set access token…”. Lean then signs in by itself after Touch ID. A token can be read-only, limited to the vaults you grant, expires, and can be deleted at any time. Create it once in a terminal:

pass-cli login
pass-cli pat create --name lean --expiration 3m     # shows the token once
pass-cli pat access grant --personal-access-token-name lean \
    --vault-name "<vault>" --role viewer
pass-cli logout

pass-cli pat renew issues a new token when it expires, pass-cli pat delete revokes it.

Not covered

Forms inside iframes, saving new logins, passkeys.

Passbolt

Lean cannot load the Passbolt extension, and it holds no Passbolt key. Instead it hands you over to the browser that has the extension.

1. gb or Cmd+Shift+P copies the current site's host name and opens Passbolt in that other browser.
2. Paste the name into Passbolt's search and copy the password.
3. Return to Lean and paste.

Lean wipes the clipboard 30 seconds after you return (clipboardClearSeconds), unless it has changed again.