In the Proton Pass apps you can add hidden custom fields to any item: logins, notes, cards and so on. pass-cli can't do this for most item types:
- item create login and item create note templates have no custom-fields section. Login templates only accept title, username, email, password and urls.
- Only item create custom accepts sections with "fieldtype": "hidden".
- item update can add a custom field to an existing item, but only as plain text.
So a script that wants to store an API key, token or recovery code next to a login has two bad choices. It can create a separate Custom item, or it can store the secret as an unmasked text field that shows in clear text in every Pass client. Tools built on pass-cli, such as the SecretSpec Proton Pass provider, refuse to create fields for this reason.
Requested:
1. Support extrafields (custom fields) in the --from-template JSON for every item type, with a type per field:
{
"title": "Production DB",
"username": "app",
"password": "…",
"extrafields": [
{ "name": "apikey", "type": "hidden", "value": "…" }
]
}
2. Use the same field types everywhere: text, hidden, totp and timestamp, as item create custom already does.
3. Show the template shape with --get-template for each item type, so scripts can find it.
This brings pass-cli in line with what the apps can already do. It also means automation never has to choose between keeping a secret next to its login and keeping it masked.
👍 Vote if you create Pass items from scripts, CI, or secret-management tools.