The Microsoft Store doesn't update EXE installs, so the app updates itself
with Tauri's updater. It reads updater/latest.json from the Kestrove Gitea a
minute after startup and once a day. A new version shows as a banner and in
Settings > Updates, and installs only on "Update and restart". The vault locks
before the installer takes over.
The installer must be signed with the Kestrove updater key, with the signature
bound to its version (requireSignedVersion), so a compromised download server
can hold updates back but can't ship one or replay an old installer. Signing
is a release step, after Authenticode: gitea-release.sh signs, uploads the
.sig, and writes latest.json last. Plain builds need no key.
Checks reveal only the IP address and app version, and can be turned off in
Settings. endpoints is a list, so a mirror can be added. Linux packages update
through their package manager.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A browser keeps kestrove-nmh.exe running while the extension is connected,
so an update couldn't replace it and stopped half way: the old version's
uninstall had already removed the browser registration, and the new one was
never written. The installer only closes the app itself, so the hooks now
stop the helper too. It holds no state; the browser starts it again.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Windows and Linux app 1.2.0, from the beta work: colour themes synced across
devices, unlock with Windows Hello, the official Kestrove icon, and the Chrome
Web Store extension id.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The store build has its own id, so the native-messaging manifest refused it
and the extension reported the app as not running. Chrome now allows the
store id and the unpacked development id, in the NSIS hook and in both
install scripts; --chrome-id / -ChromeId take a list.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
tauri-build only reruns for tauri.conf.json and capabilities/, so an
incremental build after the new icons kept the old keyhole in the exe
resource and the window icon. Clean builds were unaffected.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Icons: the taskbar, title bar, tray and installer icons are now the Kestrove
mark (kestrel wing and keyhole on the Spruce tile) instead of the placeholder
keyhole. Generated with `tauri icon` from icons/kestrove-mark.svg, the brand
mark with the eye in the `accent` token (#b4481f), as the brand book asks.
Windows Hello (docs/02 "Local unlock"): Settings > General > "Unlock with
Windows Hello". Turning it on creates a TPM-backed KeyCredentialManager key
for this vault, which signs a fixed label plus a random salt; HKDF of the
deterministic RSA signature seals the core's Local Unlock Key with
XChaCha20-Poly1305 in windows-hello.json. The unlock screen then offers
"Unlock with Windows Hello" above the master password.
- The master password is still required every 14 days; Hello is not offered
while it is due, and the LUK is kept.
- A cancelled prompt falls back to the password. The LUK is deleted only when
Hello's key is gone or doesn't open it.
- Hello calls block, so they run on a blocking thread; the prompt is brought
in front of the window.
- Not offered on Linux or where Windows Hello isn't set up.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Seven themes (Spruce, Ocean, Violet, Rose, Crimson, Amber, Graphite) that
change only the brand colour, all AA in light and dark. "Same theme on all
my devices" saves the choice in the encrypted vault and adopts it after
unlocking and syncing.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A Tags group in the sidebar filters the list, the item page shows its tags
with an Edit tags action, new logins take tags, and search matches tags.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The app comes forward with a prompt to sign in with or save a passkey,
confirmed with the master password (the user verification each use needs).
Asked while locked: unlock, then it continues.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Create account takes an email and an invite or setup code (none with open
sign-up), joins servers that already have accounts, and Settings shows the
account email (admins manage people from the web vault).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- main.rs: the Windows clipboard branch dropped the copy's Result (only the non-Windows branch was
checked), which failed to compile for Windows; both now report a failed copy.
- windows/hooks.nsh: the NSIS installer writes the native messaging manifests next to kestrove-nmh.exe
and registers them under HKCU for Chrome, Chromium, Edge, Brave, Vivaldi and Firefox; uninstall
removes them. Per-user install.
- scripts/windows.sh: cross-build with cargo-xwin, compile the installer with NSIS 3.11 in a Debian 13
container (Homebrew's makensis 3.13 crashes on macOS).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
scripts/linux.Dockerfile builds the AppImage, .deb and Linux native host in Debian 12 (amd64);
scripts/gitea-release.sh creates the v<version> release and uploads them with SHA256SUMS.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The broker, pairing channel, IPC and kestrove-nmh moved to kestrove-core so the macOS app serves
the extension too (a Mac no longer needs this app). Old module paths are re-exports.
rustls-webpki 0.103.16 and webpki-roots 1.0.10 (RUSTSEC-2026-0381/0382).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
uniffi 0.32 drops bincode (RUSTSEC-2025-0141) and paste (RUSTSEC-2024-0436).
The basic-toml ignore (RUSTSEC-2026-0374) stays: askama_derive 0.16 in
uniffi_bindgen 0.32 still depends on it. No source changes needed.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
No known vulnerability and no safe upgrade; only askama_derive 0.12 in uniffi_bindgen 0.28's code generator uses it. Goes away with a uniffi upgrade.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
DeviceKey implements kv-ffi's DeviceSigner.reset(): it deletes the key material
(TPM key, DPAPI file, Secret Service / keychain entry, or key file) and the
device-id and store files, then creates a new key with a new id in the best
store available. The core calls it on device_revoked and retries a setup code's
ticket once, so a fresh Add-a-device code signs a removed computer straight in.
DeviceRevoked explains how to set it up again; the fingerprint shown refreshes.
Removing a device warns that it must be set up again as a new one.
Test: end to end through kv-sync's test server (new dev-dependency).
The Windows TPM/DPAPI paths could not be compiled here (no Windows SDK for ring).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Tauri 2 overlays web content on the title bar only on macOS, so Windows and
Linux keep the native title bar and window controls. On Windows 11 the
caption, title and border now take the theme's bg and text (DWM), re-applied
on every theme change and when the OS setting changes under "System", so the
caption and the app header read as one custom title bar. Linux (GTK) keeps
its own colours.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- src/ui: tokens.css (generated from the design system's tokens.json), kv.css components, fonts.css with
the bundled Inter and JetBrains Mono woff2, kv.ts DOM builders (icons, tiles, item rows, secrets,
codes, TOTP ring, pills, banners). The browser extension uses the same module.
- Layout: custom title bar in bg (macOS overlay title bar, traffic lights kept), left rail, list and detail.
- Item detail: field rows with 10-dot masking, coloured digits/symbols on reveal (re-masks after 30 s),
copy turns into a check for 1.5 s, TOTP in code-lg with the ring.
- Add-a-device QR card, Use my phone QR with countdown and confirmation code, approve sheet.
- Status pills, banners and the integrity alert; Light / Dark / System in Settings (also sets the window theme).
- totp command returns the period for the ring.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- Device key (DeviceSigner): Windows TPM via CNG with a DPAPI-sealed software
fallback, Linux Secret Service with a 0600 file fallback (warned in Settings),
macOS keychain for dev runs. The store used is recorded; no silent switching.
- SyncService (Tauri-free): server URL and pins, create account with the
server's setup code, sync after unlock/save/browser save, every 15 min while
unlocked and on demand, status events, integrity alarm, device list with
fingerprint approval and revoke.
- Onboarding: "Use my phone" (join_start/poll, QR rendered locally, 6-digit
code), Emergency Kit from PDF/PNG/JPEG (hayro + rqrr), paste setup code, new
account. Then only the master password.
- From a signed-in desktop: "Add a phone or tablet" QR with countdown (cancel,
lock and quit revoke the ticket) and "Approve a computer" via pasted join code.
- KESTROVE_DATA_DIR / KESTROVE_DEVICE_NAME for a second instance; ignored
live test drives three instances against a real server.
- deny: ignore three unmaintained notices for zbus 5 sub-crates (Linux keyring).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The old workflow was invalid YAML (unquoted ${{ }} in a flow mapping) and never ran.
deny.toml: allows BSL-1.0 (arboard's Windows deps) and CDLA-Permissive-2.0
(webpki-roots); ignores three unmaintained-crate notices for build-time proc-macros
(uniffi 0.28, glib-macros 0.18) that need upstream upgrades.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
src-tauri/fuzz: nmh_session drives a whole kestrove-nmh connection through
Broker::serve (framing, outer JSON, pair_init/pair_confirm/open/msg); frame_read
checks read_frame. 8 min each (2.5 M / 2.7 M execs): no findings.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- Builds and runs (tauri build --debug); placeholder icons; persistent VaultCore::open in the
OS app-data dir; Secret Key remembered on the device; tray keeps the app serving the extension.
- Auto-lock: idle (system idle on Windows/macOS, in-app activity on Linux), screen lock, sleep.
- Local IPC for kestrove-nmh: 0700 dir + 0600 Unix socket with peer-uid checks; Windows named
pipe (first instance, local only, user DACL, client SID check) behind cfg.
- Pairing channel: X25519 → HKDF → 6-word fingerprint confirmed in both UIs, per-connection
session keys, AES-256-GCM with strict counters. Test vectors shared with kestrove-browser.
- Broker: query/fill/totp/save with origin re-checks; pairing and save prompts in the UI.
- kestrove-nmh relays ciphertext only; native-host installers for Linux/macOS/Windows.
- Tests: unit tests, tests/nmh_stdio.rs (real kestrove-nmh over stdio), examples/test-host.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
samiandClaude Opus 5.5