[Dvorf]

Summary

• add paired --target-mac and --key-output options for non-interactive extraction
• validate the target as a 48-bit MAC address before login
• request a BLE key only for the matching device and stop once a key-only lookup succeeds
• create the key file with owner-only permissions on POSIX and refuse to overwrite it
• return a non-zero status without replacing existing JSON output when the target or key is unavailable

Why

Automation that needs one BLE encryption key currently has to write and parse the account-wide JSON result. The targeted path reduces the amount of secret material written to disk and gives callers a direct success/failure contract.

The new options are independent of authentication method. Existing extraction behavior is unchanged when they are omitted.

Tests

• python -m unittest discover -s tests -v (7 public CLI cases)
• the same feature cases fail against the pre-change executable
• the fixture includes two synthetic BLE devices and proves only the target key is requested
• GitHub Actions runs the suite on Python 3.13 for Ubuntu and Windows

The example MAC is locally administered, and every account value and key in the acceptance fixture is synthetic.