$ show dyc3/steamguard-cli
steamguard-cli is a robust Rust-based command-line utility designed for managing Steam Two-Factor Authentication (2FA). It serves as a secure alternative to the official Steam Mobile App, allowing users to generate 2FA codes, respond to trade and market confirmations, and manage their authentication secrets locally. The architecture follows a clear separation of concerns: a core library (`steamguard`) handles the complex protocol interactions with Steam's APIs (authentication, confirmations, token management), while the CLI binary (`steamguard-cli`) manages user input, TUI, and file system operations. The tool emphasizes security by encrypting sensitive data (maFiles) using Argon2id-AES256 and leveraging the system keyring for passkey storage. It also features sophisticated migration logic to import accounts from legacy tools like Steam Desktop Authenticator (SDA) and WinAuth, ensuring data portability.
The LLM identified 4 files worth highlighting for reuse:
This module implements the core state management for Steam accounts. It handles loading, saving, and encrypting/decrypting account manifests. Crucially, it contains the migration logic (`migrate.rs` referenced within) that allows users to upgrade from legacy formats (SDA, WinAuth, Steam Mobile V2) to the current encrypted format. It demonstrates high craftsmanship by handling edge cases like missing fields, null values, and different encryption schemes seamlessly.
This library module implements the logic for interacting with Steam's mobile confirmation API. It correctly implements the HMAC-SHA1 hashing required to generate confirmation keys based on the identity secret and server time. It handles the complex flow of fetching, accepting, and denying trade offers and market listings, including retry logic for network failures and token refreshes.
This component implements the modern encryption scheme used by the application. It uses Argon2id for key derivation (password-based) and AES-256-CBC for data encryption. The implementation is secure, utilizing `zeroize` to clear sensitive data from memory and `secrecy` to prevent accidental logging of passkeys. It also maintains backward compatibility with the legacy SDA encryption scheme.
This module handles the approval of login sessions via QR codes. It implements the specific signature generation algorithm required by Steam's authentication protocol (HMAC-SHA256 over version, client ID, and Steam ID). This is a non-obvious cryptographic implementation that is critical for the QR login feature to function correctly.