[bashhack]

Stacked on #221 (it retargets to main once that merges).

Backups keep an entry's earlier secrets (its history), and so does sync; the encrypted export, the way to move a vault by hand, dropped them. Now it doesn't:

• The store: Earlier(k, reading) is an entry's earlier secrets, the newest first, with when each was replaced; each read is recorded in the audit log ("History: version N, to export"), as reading an earlier secret is.
• The export: ExportEntry gains history (replaced_at, secret, encoded as the entry's secret is: base64 for a file). Only the encrypted export fills it (ExportOptions.History); JSON and CSV leave earlier secrets out, so a plain export exposes no more than the current secrets.
• The import: seshexport.Entries gives them to the importer as Earlier, which SaveImported already keeps (within history.keep), as for Bitwarden and KeePass. An earlier secret that won't decode skips the entry, saying why.
• Compatibility, decided here: the export's format version stays 1. history is optional: v0.1.1's exports have none and import as before (internal/compat's v0.1.1 export, now read through the same path sesh import uses), and v0.1.1 reading a new export ignores the field (its decoder takes unknown fields) and imports the current secrets, rather than refusing the file. Once this ships, its release adds internal/compat/testdata/<version>/ with an export that has history, as AGENTS.md says.
• Tests: a CLI round trip (TestImport_SeshKeepsHistory): a password's two earlier secrets and a file's binary earlier content come back, with their times; a plain JSON export holds none. seshexport decodes history, a file's from base64, and skips an entry whose history won't decode. Each of these fails with its part undone: no history in the encrypted export, file history not base64, the import dropping it, a plain export getting it.
• Docs: the usage guide says what the encrypted export holds and that JSON/CSV leave history out; importing a sesh export brings old passwords in as Bitwarden's does; the export-based recipes now lose only the trash. The security model says the same.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 38.29787% with 58 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/database/history.go	14.28%	36 Missing ⚠️
internal/password/export.go	20.00%	20 Missing ⚠️
sesh/cmd/sesh/export_cmd.go	85.71%	1 Missing ⚠️
sesh/cmd/sesh/import_cmd.go	80.00%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!