Icons: the taskbar, title bar, tray and installer icons are now the Kestrove
mark (kestrel wing and keyhole on the Spruce tile) instead of the placeholder
keyhole. Generated with `tauri icon` from icons/kestrove-mark.svg, the brand
mark with the eye in the `accent` token (#b4481f), as the brand book asks.
Windows Hello (docs/02 "Local unlock"): Settings > General > "Unlock with
Windows Hello". Turning it on creates a TPM-backed KeyCredentialManager key
for this vault, which signs a fixed label plus a random salt; HKDF of the
deterministic RSA signature seals the core's Local Unlock Key with
XChaCha20-Poly1305 in windows-hello.json. The unlock screen then offers
"Unlock with Windows Hello" above the master password.
- The master password is still required every 14 days; Hello is not offered
while it is due, and the LUK is kept.
- A cancelled prompt falls back to the password. The LUK is deleted only when
Hello's key is gone or doesn't open it.
- Hello calls block, so they run on a blocking thread; the prompt is brought
in front of the window.
- Not offered on Linux or where Windows Hello isn't set up.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
scripts/linux.Dockerfile builds the AppImage, .deb and Linux native host in Debian 12 (amd64);
scripts/gitea-release.sh creates the v<version> release and uploads them with SHA256SUMS.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The broker, pairing channel, IPC and kestrove-nmh moved to kestrove-core so the macOS app serves
the extension too (a Mac no longer needs this app). Old module paths are re-exports.
rustls-webpki 0.103.16 and webpki-roots 1.0.10 (RUSTSEC-2026-0381/0382).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
uniffi 0.32 drops bincode (RUSTSEC-2025-0141) and paste (RUSTSEC-2024-0436).
The basic-toml ignore (RUSTSEC-2026-0374) stays: askama_derive 0.16 in
uniffi_bindgen 0.32 still depends on it. No source changes needed.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
DeviceKey implements kv-ffi's DeviceSigner.reset(): it deletes the key material
(TPM key, DPAPI file, Secret Service / keychain entry, or key file) and the
device-id and store files, then creates a new key with a new id in the best
store available. The core calls it on device_revoked and retries a setup code's
ticket once, so a fresh Add-a-device code signs a removed computer straight in.
DeviceRevoked explains how to set it up again; the fingerprint shown refreshes.
Removing a device warns that it must be set up again as a new one.
Test: end to end through kv-sync's test server (new dev-dependency).
The Windows TPM/DPAPI paths could not be compiled here (no Windows SDK for ring).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- Device key (DeviceSigner): Windows TPM via CNG with a DPAPI-sealed software
fallback, Linux Secret Service with a 0600 file fallback (warned in Settings),
macOS keychain for dev runs. The store used is recorded; no silent switching.
- SyncService (Tauri-free): server URL and pins, create account with the
server's setup code, sync after unlock/save/browser save, every 15 min while
unlocked and on demand, status events, integrity alarm, device list with
fingerprint approval and revoke.
- Onboarding: "Use my phone" (join_start/poll, QR rendered locally, 6-digit
code), Emergency Kit from PDF/PNG/JPEG (hayro + rqrr), paste setup code, new
account. Then only the master password.
- From a signed-in desktop: "Add a phone or tablet" QR with countdown (cancel,
lock and quit revoke the ticket) and "Approve a computer" via pasted join code.
- KESTROVE_DATA_DIR / KESTROVE_DEVICE_NAME for a second instance; ignored
live test drives three instances against a real server.
- deny: ignore three unmaintained notices for zbus 5 sub-crates (Linux keyring).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- Builds and runs (tauri build --debug); placeholder icons; persistent VaultCore::open in the
OS app-data dir; Secret Key remembered on the device; tray keeps the app serving the extension.
- Auto-lock: idle (system idle on Windows/macOS, in-app activity on Linux), screen lock, sleep.
- Local IPC for kestrove-nmh: 0700 dir + 0600 Unix socket with peer-uid checks; Windows named
pipe (first instance, local only, user DACL, client SID check) behind cfg.
- Pairing channel: X25519 → HKDF → 6-word fingerprint confirmed in both UIs, per-connection
session keys, AES-256-GCM with strict counters. Test vectors shared with kestrove-browser.
- Broker: query/fill/totp/save with origin re-checks; pairing and save prompts in the UI.
- kestrove-nmh relays ciphertext only; native-host installers for Linux/macOS/Windows.
- Tests: unit tests, tests/nmh_stdio.rs (real kestrove-nmh over stdio), examples/test-host.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
samiandClaude Opus 5.5