The Enter-key handlers were expression-bodied arrows assigned to DOM on…
properties: `(e) => e.key === "Enter" && submit()` returns false for every
other key, and an on… handler returning false cancels the event, so the
server URL ("Use my phone") and both master-password fields accepted no input.
Use block bodies, and add scripts/check-handlers.mjs (run by npm run build)
to fail the build on handlers that can return false.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- Builds and runs (tauri build --debug); placeholder icons; persistent VaultCore::open in the
OS app-data dir; Secret Key remembered on the device; tray keeps the app serving the extension.
- Auto-lock: idle (system idle on Windows/macOS, in-app activity on Linux), screen lock, sleep.
- Local IPC for kestrove-nmh: 0700 dir + 0600 Unix socket with peer-uid checks; Windows named
pipe (first instance, local only, user DACL, client SID check) behind cfg.
- Pairing channel: X25519 → HKDF → 6-word fingerprint confirmed in both UIs, per-connection
session keys, AES-256-GCM with strict counters. Test vectors shared with kestrove-browser.
- Broker: query/fill/totp/save with origin re-checks; pairing and save prompts in the UI.
- kestrove-nmh relays ciphertext only; native-host installers for Linux/macOS/Windows.
- Tests: unit tests, tests/nmh_stdio.rs (real kestrove-nmh over stdio), examples/test-host.
Co-Authored-By: Claude Opus 5.5 <[email protected]>