Local vaults without a server; Snap package; version 1.2.2

The New vault tab can now skip the server, as Apple and Android already do. The snap
writes its browser manifests on start, since a strict snap can't install them itself.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

README.md

@@ -63,15 +63,21 @@ XWIN_ACCEPT_LICENSE=1 scripts/windows.sh
 `src-tauri/Cargo.toml`, tag the commit (`git tag v<version> && git push origin v<version>`), then:
 
 ```bash
-GITEA_TOKEN=<token with write:repository> TAURI_SIGNING_PRIVATE_KEY_PATH=<updater key> scripts/gitea-release.sh
+GITEA_TOKEN=<token with write:repository> scripts/gitea-release.sh
 ```
 
 It creates the release for the tag and uploads the installers, the browser helpers and a `SHA256SUMS` file.
 
-**Offer it as an update (Windows):** the script also signs the installer with the updater key, uploads the
-signature, and writes `updater/latest.json`. Sign the installer with the code-signing certificate first, because
-the updater signature covers the final file. Installed copies are offered the update once that file is committed
-and pushed to main; the script prints the commands. Keep the updater key and its password offline and backed up:
+**Put it on the website and offer it as an update (Windows):**
+
+```bash
+TAURI_SIGNING_PRIVATE_KEY_PATH=<updater key> scripts/publish-update.sh
+```
+
+This signs the installer with the updater key, copies it to `downloads/` in `kestrove-website` next to this repo,
+and writes `updates/latest.json` there. Sign the installer with the code-signing certificate first, because the
+updater signature covers the final file. Installed copies are offered the update once the website is deployed.
+Keep the updater key and its password offline and backed up:
 the app only accepts updates signed with it, so losing it means existing installs can't update.
 
 ## How the browser connection works
@@ -93,7 +99,7 @@ browser extension ─(native messaging)─▶ kestrove-nmh ─(local connection)
 ## Updates
 
 On Windows, Kestrove checks for a new version a minute after it starts and once a day. The check is a plain request
-for `updater/latest.json` on the Kestrove Gitea: it reveals this computer's IP address and app version, and nothing
+for `updates/latest.json` on the Kestrove website: it reveals this computer's IP address and app version, and nothing
 from your vault. A new version appears as a banner and installs only when you choose **Update and restart**. The app
 verifies the download's signature before running it. Turn checks off in **Settings → Updates**. On Linux, updates
 come through your package manager.

native-messaging/README.md

@@ -27,5 +27,9 @@ native-messaging/install.sh --uninstall
 | Firefox | `~/.mozilla/native-messaging-hosts/app.kestrove.nmh.json` | `HKCU\Software\Mozilla\NativeMessagingHosts\app.kestrove.nmh` |
 | Brave | `~/.config/BraveSoftware/Brave-Browser/NativeMessagingHosts/` | same key as Chrome |
 
+The Linux `.deb` and `.rpm` install these manifests system-wide (`src-tauri/linux/`), so they need no script. That
+covers snap Firefox too: it can't start the host itself, so the desktop portal does, after asking the user once.
+AppImage users run `install.sh`.
+
 `allowed_origins` / `allowed_extensions` pin the host to **your** extension id.
 That is the first line of defense against other extensions (docs/04 A8).

native-messaging/install.sh

@@ -84,6 +84,10 @@ esac
   eval "d=\$dir_$b"
   [ -d "$d" ] && BROWSERS="$BROWSERS $b"
 done
+# Snap Firefox keeps its profile in ~/snap, but its portal reads the host from ~/.mozilla like any other Firefox.
+case " $BROWSERS " in *" firefox "*) ;; *)
+  [ -n "$USER_DATA_DIR" ] || { [ -d /snap/firefox ] && BROWSERS="$BROWSERS firefox"; } || true ;;
+esac
 
 render() { # template → stdout
   sed -e "s|__NMH_PATH__|$NMH|" -e "s|chrome-extension://__CHROME_EXTENSION_ID__/|$CHROME_ORIGINS|" -e "s|__FIREFOX_EXTENSION_ID__|$FIREFOX_ID|" "$HERE/$HOST.$1.json"

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "kestrove-desktop",
-  "version": "1.2.0",
+  "version": "1.2.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "kestrove-desktop",
-      "version": "1.2.0",
+      "version": "1.2.2",
       "license": "Apache-2.0",
       "dependencies": {
         "@tauri-apps/api": "2.12.3"

package.json

@@ -1,6 +1,6 @@
 {
   "name": "kestrove-desktop",
-  "version": "1.2.0",
+  "version": "1.2.2",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

scripts/gitea-release.sh

@@ -1,17 +1,11 @@
 #!/bin/sh
-# Creates (or reuses) the Gitea release for this version, uploads the desktop bundles to it, and writes
-# updater/latest.json, which the Windows app checks for updates (src-tauri/src/updates.rs).
+# Creates (or reuses) the Gitea release for this version and uploads the desktop bundles to it. The website's
+# downloads and the Windows app's updates come from scripts/publish-update.sh instead.
 #
-#   GITEA_TOKEN=… TAURI_SIGNING_PRIVATE_KEY_PATH=… scripts/gitea-release.sh [dir-with-files]   (default ../release/desktop)
+#   GITEA_TOKEN=… scripts/gitea-release.sh [dir-with-files]   (default ../release/desktop)
 #
 # GITEA_TOKEN: a Gitea access token with the write:repository scope (Settings → Applications). The tag
 # v<version> must already be pushed. Files: *.AppImage, *.deb, *.rpm, *-setup.exe, kestrove-nmh-*, SHA256SUMS.
-#
-# Updates: the Windows installer needs an updater signature (<installer>.sig) from the Kestrove updater key, whose
-# public half is in src-tauri/tauri.conf.json. Sign after Authenticode signing: the signature covers the final
-# file. With TAURI_SIGNING_PRIVATE_KEY_PATH set, a missing .sig is made here (the key's password is asked for, or
-# read from TAURI_SIGNING_PRIVATE_KEY_PASSWORD). Optional NOTES: the text shown with the update.
-# Users get the update only once updater/latest.json is committed and pushed to main (printed at the end).
 set -eu
 cd "$(dirname "$0")/.."
 : "${GITEA_TOKEN:?set GITEA_TOKEN (Gitea → Settings → Applications → token with write:repository)}"
@@ -21,17 +15,8 @@ DIR=${1:-../release/desktop}
 V=$(node -p 'require("./package.json").version')
 TAG="v$V"
 AUTH="Authorization: token $GITEA_TOKEN"
-SETUP="$DIR/Kestrove_${V}_x64-setup.exe"
 
-if [ -f "$SETUP" ] && [ ! -f "$SETUP.sig" ]; then
-  : "${TAURI_SIGNING_PRIVATE_KEY_PATH:?$SETUP.sig is missing: set TAURI_SIGNING_PRIVATE_KEY_PATH to the updater key to sign it}"
-  # --app-version binds the signature to this version (the app requires it), so an older signed installer can't
-  # be offered again under a newer version number.
-  npx tauri signer sign -f "$TAURI_SIGNING_PRIVATE_KEY_PATH" ${TAURI_SIGNING_PRIVATE_KEY_PASSWORD+-p "$TAURI_SIGNING_PRIVATE_KEY_PASSWORD"} \
-    --app-version "$V" "$SETUP"
-fi
-
-(cd "$DIR" && rm -f SHA256SUMS && shasum -a 256 -- *.AppImage *.deb *.rpm *-setup.exe kestrove-nmh-* 2>/dev/null > SHA256SUMS; cat SHA256SUMS)
+(cd "$DIR" && rm -f SHA256SUMS && for f in *.AppImage *.deb *.rpm *-setup.exe kestrove-nmh-*; do if [ -f "$f" ]; then shasum -a 256 -- "$f"; fi; done > SHA256SUMS; cat SHA256SUMS)
 
 ID=$(curl -fsS -H "$AUTH" "$API/repos/$REPO/releases/tags/$TAG" 2>/dev/null | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{try{console.log(JSON.parse(s).id||"")}catch{console.log("")}})')
 if [ -z "$ID" ]; then
@@ -45,16 +30,3 @@ for f in "$DIR"/*.AppImage "$DIR"/*.deb "$DIR"/*.rpm "$DIR"/*-setup.exe "$DIR"/*
 done
 echo "Release: ${API%/api/v1}/$REPO/releases/tag/$TAG"
 
-# The update manifest, written only after the installer it points to is uploaded.
-if [ -f "$SETUP.sig" ]; then
-  mkdir -p updater
-  node -e '
-    const [v, url, sigFile, notes] = process.argv.slice(1);
-    const signature = require("fs").readFileSync(sigFile, "utf8").trim();
-    const doc = { version: v, notes, pub_date: new Date().toISOString().replace(/\.\d+Z$/, "Z"),
-      platforms: { "windows-x86_64": { signature, url } } };
-    require("fs").writeFileSync("updater/latest.json", JSON.stringify(doc, null, 2) + "\n");
-  ' "$V" "${API%/api/v1}/$REPO/releases/download/$TAG/$(basename "$SETUP")" "$SETUP.sig" "${NOTES:-Kestrove $V}"
-  echo "Wrote updater/latest.json. To offer the update, commit it and push to main:"
-  echo "  git add updater/latest.json && git commit -m \"Offer $V as an update\" && git push origin main"
-fi

scripts/publish-update.sh

@@ -0,0 +1,37 @@
+#!/bin/sh
+# Puts the Windows installer on the Kestrove website and offers it as an update: signs it with the updater key if
+# needed, copies it to the website's downloads/, and writes the website's updates/latest.json, which the app checks
+# (src-tauri/src/updates.rs).
+#
+#   TAURI_SIGNING_PRIVATE_KEY_PATH=… scripts/publish-update.sh [dir-with-installer]   (default ../release/desktop)
+#
+# Sign after Authenticode signing: the updater signature covers the final file. The key's password is asked for,
+# or read from TAURI_SIGNING_PRIVATE_KEY_PASSWORD. Optional NOTES: the text shown with the update. Optional
+# WEBSITE_DIR: the website folder (default ../kestrove-website). Users get the update once the website is deployed.
+set -eu
+cd "$(dirname "$0")/.."
+DIR=${1:-../release/desktop}
+SITE=${WEBSITE_DIR:-../kestrove-website}
+V=$(node -p 'require("./package.json").version')
+NAME="Kestrove_${V}_x64-setup.exe"
+SETUP="$DIR/$NAME"
+[ -f "$SETUP" ] || { echo "$SETUP not found" >&2; exit 1; }
+
+if [ ! -f "$SETUP.sig" ]; then
+  : "${TAURI_SIGNING_PRIVATE_KEY_PATH:?$SETUP.sig is missing: set TAURI_SIGNING_PRIVATE_KEY_PATH to the updater key to sign it}"
+  # --app-version binds the signature to this version (the app requires it), so an older signed installer can't
+  # be offered again under a newer version number.
+  npx tauri signer sign -f "$TAURI_SIGNING_PRIVATE_KEY_PATH" ${TAURI_SIGNING_PRIVATE_KEY_PASSWORD+-p "$TAURI_SIGNING_PRIVATE_KEY_PASSWORD"} \
+    --app-version "$V" "$SETUP"
+fi
+
+mkdir -p "$SITE/downloads" "$SITE/updates"
+cp "$SETUP" "$SITE/downloads/$NAME"
+node -e '
+  const [out, v, url, sigFile, notes] = process.argv.slice(1);
+  const signature = require("fs").readFileSync(sigFile, "utf8").trim();
+  const doc = { version: v, notes, pub_date: new Date().toISOString().replace(/\.\d+Z$/, "Z"),
+    platforms: { "windows-x86_64": { signature, url } } };
+  require("fs").writeFileSync(out, JSON.stringify(doc, null, 2) + "\n");
+' "$SITE/updates/latest.json" "$V" "https://kestrove.samialabri.com/downloads/$NAME" "$SETUP.sig" "${NOTES:-Kestrove $V}"
+echo "Copied $NAME to $SITE/downloads and wrote $SITE/updates/latest.json. Deploy the website to offer the update."

scripts/snap.sh

@@ -0,0 +1,15 @@
+#!/bin/sh
+# Builds the Snap Store package. Needs snapcraft and LXD. Run from anywhere; kestrove-core must sit next to this repo.
+# The snap is built from a copy, because snapcraft only sees files under the project and the app needs both repos.
+#
+#   scripts/snap.sh      writes kestrove_<version>_amd64.snap to ../release/desktop
+set -eu
+cd "$(dirname "$0")/../.."
+OUT=$(pwd)/release/desktop
+WORK=$(mktemp -d "${TMPDIR:-$HOME}/kestrove-snap.XXXXXX")
+trap 'rm -rf "$WORK"' EXIT
+tar --exclude=node_modules --exclude=target --exclude=dist --exclude=.git -cf - kestrove-core kestrove-desktop | tar -xf - -C "$WORK"
+cp -r kestrove-desktop/snap "$WORK/snap"
+mkdir -p "$OUT"
+(cd "$WORK" && snapcraft pack && cp kestrove_*.snap "$OUT/")
+ls -la "$OUT"/kestrove_*.snap

snap/gui/kestrove.desktop

@@ -0,0 +1,9 @@
+[Desktop Entry]
+Type=Application
+Name=Kestrove
+Comment=Self-hosted, end-to-end encrypted password manager
+Exec=kestrove %U
+Icon=${SNAP}/meta/gui/kestrove.png
+Categories=Utility;Security;
+StartupWMClass=kestrove-desktop
+Terminal=false

snap/snapcraft.yaml

@@ -0,0 +1,62 @@
+# Kestrove for the Snap Store. Build with scripts/snap.sh, which lays out kestrove-core next to kestrove-desktop.
+name: kestrove
+title: Kestrove
+base: core24
+version: "1.2.2"
+summary: Self-hosted, end-to-end encrypted password manager
+description: |
+  Kestrove keeps your passwords, passkeys and one-time codes in a vault encrypted on your device. Sync it through a
+  server you run yourself, or keep it on one computer. The Kestrove browser extension fills logins through this app.
+license: Apache-2.0
+website: https://kestrove.samialabri.com
+grade: stable
+confinement: strict
+
+plugs:
+  # Lets the app write the browser manifests (src-tauri/src/snap.rs). Needs store approval to connect automatically.
+  browser-native-hosts:
+    interface: personal-files
+    write:
+      - $HOME/.mozilla/native-messaging-hosts
+      - $HOME/.config/google-chrome/NativeMessagingHosts
+      - $HOME/.config/chromium/NativeMessagingHosts
+      - $HOME/.config/microsoft-edge/NativeMessagingHosts
+      - $HOME/.config/BraveSoftware/Brave-Browser/NativeMessagingHosts
+
+apps:
+  kestrove:
+    command: usr/bin/kestrove-desktop
+    extensions: [gnome]
+    plugs:
+      - network
+      - password-manager-service
+      - browser-native-hosts
+  nmh:
+    command: usr/bin/kestrove-nmh
+
+parts:
+  kestrove:
+    plugin: nil
+    source: .
+    build-snaps:
+      - node/22/stable
+    build-packages:
+      - curl
+      - libayatana-appindicator3-dev
+      - librsvg2-dev
+      - libsecret-1-dev
+      - libssl-dev
+      - libxdo-dev
+      - patchelf
+      - pkg-config
+    stage-packages:
+      - libayatana-appindicator3-1
+      - libxdo3
+    override-build: |
+      curl -fsSL https://sh.rustup.rs | sh -s -- -y --profile minimal
+      . "$HOME/.cargo/env"
+      cd kestrove-desktop
+      npm ci --no-audit --no-fund
+      npm run tauri build -- --no-bundle
+      install -D src-tauri/target/release/kestrove-desktop "$CRAFT_PART_INSTALL/usr/bin/kestrove-desktop"
+      install -D src-tauri/target/release/kestrove-nmh "$CRAFT_PART_INSTALL/usr/bin/kestrove-nmh"

src-tauri/Cargo.lock

@@ -3064,7 +3064,7 @@ dependencies = [
 
 [[package]]
 name = "kestrove-desktop"
-version = "1.2.0"
+version = "1.2.2"
 dependencies = [
  "arboard",
  "base64 0.22.1",

src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "kestrove-desktop"
-version = "1.2.0"
+version = "1.2.2"
 edition = "2021"
 rust-version = "1.82"
 license = "Apache-2.0"
@@ -73,7 +73,7 @@ windows-sys = { version = "0.61", features = [
   "Win32_UI_Input_KeyboardAndMouse",
   "Win32_UI_WindowsAndMessaging",
 ] }
-# In-app updates (updates.rs): signed installers listed in latest.json on the Kestrove Gitea.
+# In-app updates (updates.rs): signed installers listed in latest.json on the Kestrove website.
 tauri-plugin-updater = "2"
 # Windows Hello (KeyCredentialManager); the same version Tauri already pulls in.
 windows = { version = "0.62", features = ["Foundation", "Security_Credentials", "Security_Cryptography", "Storage_Streams"] }

src-tauri/linux/app.kestrove.nmh.chrome.json

@@ -0,0 +1,7 @@
+{
+  "name": "app.kestrove.nmh",
+  "description": "Kestrove native messaging host",
+  "path": "/usr/bin/kestrove-nmh",
+  "type": "stdio",
+  "allowed_origins": ["chrome-extension://pmhfoafjoogobhfadaicklhkldgnafmk/", "chrome-extension://kogapfibnnpeapfcjkkpgjddbhnjfein/"]
+}

src-tauri/linux/app.kestrove.nmh.firefox.json

@@ -0,0 +1,7 @@
+{
+  "name": "app.kestrove.nmh",
+  "description": "Kestrove native messaging host",
+  "path": "/usr/bin/kestrove-nmh",
+  "type": "stdio",
+  "allowed_extensions": ["[email protected]"]
+}

src-tauri/src/lib.rs

@@ -7,6 +7,7 @@ pub mod autolock;
 pub mod device_key;
 pub mod hello;
 pub mod qr;
+pub mod snap;
 pub mod sync;
 pub mod title_bar;
 pub mod updates;

src-tauri/src/main.rs

@@ -232,6 +232,14 @@ async fn create_account(
     sk.map(|s| s.to_string())
 }
 
+/// A new vault on this computer only.
+#[tauri::command]
+async fn create_local_account(app: State<'_, App>, master_password: String) -> CmdResult<String> {
+    let sk = app.sync.create_local_account(Zeroizing::new(master_password));
+    app.activity.touch();
+    sk.map(|s| s.to_string())
+}
+
 /// `secret_key` may be omitted once this device remembers it.
 #[tauri::command]
 async fn unlock(app: State<'_, App>, master_password: String, secret_key: Option<String>) -> CmdResult<()> {
@@ -814,6 +822,7 @@ fn setup(app: &mut tauri::App) -> Result<(), Box<dyn std::error::Error>> {
 }
 
 fn main() {
+    kestrove_desktop::snap::register_native_host();
     let builder = tauri::Builder::default();
     #[cfg(windows)]
     let builder = builder.plugin(tauri_plugin_updater::Builder::new().build());
@@ -830,6 +839,7 @@ fn main() {
             state,
             set_title_bar_colors,
             create_account,
+            create_local_account,
             unlock,
             hello_unlock,
             set_hello,

src-tauri/src/snap.rs

@@ -0,0 +1,79 @@
+//! Browser registration for the Snap Store build. A snap can't ship files into the user's home, so the app writes
+//! the native messaging manifests itself on startup, through the `browser-native-hosts` plug
+//! (snap/snapcraft.yaml). Outside a snap this does nothing: the .deb and .rpm install them system-wide.
+
+use std::fs;
+use std::path::Path;
+
+const HOST: &str = "app.kestrove.nmh";
+/// The helper's snap command. A browser, or the portal for snap Firefox, starts it inside the Kestrove snap, where
+/// it shares the app's runtime directory and so its socket.
+const NMH: &str = "/snap/bin/kestrove.nmh";
+const FIREFOX_IDS: &[&str] = &["[email protected]"];
+/// The Chrome Web Store build, then the unpacked development build.
+const CHROME_ORIGINS: &[&str] =
+    &["chrome-extension://pmhfoafjoogobhfadaicklhkldgnafmk/", "chrome-extension://kogapfibnnpeapfcjkkpgjddbhnjfein/"];
+const FIREFOX_DIR: &str = ".mozilla/native-messaging-hosts";
+const CHROME_DIRS: &[&str] = &[
+    ".config/google-chrome/NativeMessagingHosts",
+    ".config/chromium/NativeMessagingHosts",
+    ".config/microsoft-edge/NativeMessagingHosts",
+    ".config/BraveSoftware/Brave-Browser/NativeMessagingHosts",
+];
+
+/// Writes the manifests when running as a snap. A browser that isn't installed, or a plug that isn't connected, only
+/// means no browser integration for that browser, so failures are logged and the app carries on.
+pub fn register_native_host() {
+    if std::env::var_os("SNAP").is_none() {
+        return;
+    }
+    let Some(home) = std::env::var_os("SNAP_REAL_HOME") else {
+        eprintln!("kestrove: SNAP_REAL_HOME is not set; browser integration not registered");
+        return;
+    };
+    for (dir, res) in write_manifests(Path::new(&home)) {
+        if let Err(e) = res {
+            eprintln!("kestrove: can't register the browser helper in {dir}: {e}");
+        }
+    }
+}
+
+fn write_manifests(home: &Path) -> Vec<(&'static str, std::io::Result<()>)> {
+    let manifest = |key: &str, ids: &[&str]| {
+        let doc = serde_json::json!({
+            "name": HOST, "description": "Kestrove native messaging host", "path": NMH, "type": "stdio", key: ids,
+        });
+        doc.to_string()
+    };
+    let firefox = manifest("allowed_extensions", FIREFOX_IDS);
+    let chrome = manifest("allowed_origins", CHROME_ORIGINS);
+    let targets = std::iter::once((FIREFOX_DIR, &firefox)).chain(CHROME_DIRS.iter().map(|d| (*d, &chrome)));
+    targets.map(|(dir, body)| (dir, write(&home.join(dir), body))).collect()
+}
+
+fn write(dir: &Path, body: &str) -> std::io::Result<()> {
+    fs::create_dir_all(dir)?;
+    fs::write(dir.join(format!("{HOST}.json")), body)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn writes_a_manifest_for_each_browser() {
+        let home = tempfile::tempdir().unwrap();
+        assert!(write_manifests(home.path()).iter().all(|(_, r)| r.is_ok()));
+
+        let read = |dir: &str| -> serde_json::Value {
+            let body = fs::read_to_string(home.path().join(dir).join(format!("{HOST}.json"))).unwrap();
+            serde_json::from_str(&body).unwrap()
+        };
+        let firefox = read(FIREFOX_DIR);
+        assert_eq!(firefox["path"], NMH);
+        assert_eq!(firefox["allowed_extensions"][0], FIREFOX_IDS[0]);
+        for dir in CHROME_DIRS {
+            assert_eq!(read(dir)["allowed_origins"].as_array().unwrap().len(), CHROME_ORIGINS.len());
+        }
+    }
+}

src-tauri/src/sync.rs

@@ -403,6 +403,17 @@ impl SyncService {
         Ok(sk)
     }
 
+    /// A vault on this computer only. Settings → Sync can connect it to a server later. Returns the Secret Key for
+    /// the Emergency Kit.
+    pub fn create_local_account(&self, master_password: Zeroizing<String>) -> Result<Zeroizing<String>, String> {
+        if self.core.has_account() {
+            return Err("This computer already has a vault.".into());
+        }
+        let sk = Zeroizing::new(self.core.create_account(master_password.to_string()).map_err(|e| describe(&e))?);
+        self.remember_secret_key(&sk);
+        Ok(sk)
+    }
+
     /// For a vault created before sync was set up: registers it with the server (setup code, invite, or nothing
     /// with open sign-up).
     pub async fn register(&self, setup_code: &str, email: &str) -> Result<(), String> {
@@ -668,6 +679,19 @@ mod tests {
         assert!(!device_name().is_empty());
     }
 
+    #[tokio::test]
+    async fn a_local_vault_needs_no_server() {
+        let dir = tempfile::tempdir().unwrap();
+        let core = VaultCore::new_in_memory();
+        let key = DeviceKey::load_or_create_file(dir.path()).map_err(|e| e.to_string());
+        let svc = SyncService::new(core.clone(), dir.path(), key, Box::new(|_| {}));
+        let sk = svc.create_local_account(Zeroizing::new("correct horse battery".into())).unwrap();
+        assert!(core.has_account());
+        assert_eq!(svc.status().server_url, None);
+        assert_eq!(svc.stored_secret_key().as_deref().map(String::as_str), Some(sk.as_str()));
+        assert!(svc.create_local_account(Zeroizing::new("correct horse battery".into())).is_err());
+    }
+
     #[tokio::test]
     async fn settings_persist_and_secrets_stay_out_of_views() {
         let dir = tempfile::tempdir().unwrap();

src-tauri/src/updates.rs

@@ -1,7 +1,7 @@
 //! In-app updates on Windows. The Microsoft Store doesn't update EXE installs, so the app does it itself.
 //!
 //! Tauri's updater fetches `latest.json` from the first address in tauri.conf.json → plugins.updater.endpoints
-//! that answers (the Kestrove Gitea; a mirror can be added after it), and offers the newer version. Nothing is
+//! that answers (the Kestrove website; a mirror can be added after it), and offers the newer version. Nothing is
 //! downloaded until the user chooses "Update and restart". The installer must carry a signature from the
 //! Kestrove updater key, whose public half is in tauri.conf.json, so a compromised download server can hold
 //! updates back but can't ship one.

src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "Kestrove",
-  "version": "1.2.0",
+  "version": "1.2.2",
   "identifier": "app.kestrove.desktop",
   "build": {
     "beforeDevCommand": "npm run dev",
@@ -41,6 +41,24 @@
       "icons/icon.ico",
       "icons/icon.png"
     ],
+    "linux": {
+      "deb": {
+        "files": {
+          "/usr/lib/mozilla/native-messaging-hosts/app.kestrove.nmh.json": "linux/app.kestrove.nmh.firefox.json",
+          "/etc/opt/chrome/native-messaging-hosts/app.kestrove.nmh.json": "linux/app.kestrove.nmh.chrome.json",
+          "/etc/chromium/native-messaging-hosts/app.kestrove.nmh.json": "linux/app.kestrove.nmh.chrome.json",
+          "/etc/opt/edge/native-messaging-hosts/app.kestrove.nmh.json": "linux/app.kestrove.nmh.chrome.json"
+        }
+      },
+      "rpm": {
+        "files": {
+          "/usr/lib/mozilla/native-messaging-hosts/app.kestrove.nmh.json": "linux/app.kestrove.nmh.firefox.json",
+          "/etc/opt/chrome/native-messaging-hosts/app.kestrove.nmh.json": "linux/app.kestrove.nmh.chrome.json",
+          "/etc/chromium/native-messaging-hosts/app.kestrove.nmh.json": "linux/app.kestrove.nmh.chrome.json",
+          "/etc/opt/edge/native-messaging-hosts/app.kestrove.nmh.json": "linux/app.kestrove.nmh.chrome.json"
+        }
+      }
+    },
     "windows": {
       "nsis": {
         "installerHooks": "windows/hooks.nsh",
@@ -53,7 +71,7 @@
       "pubkey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDZFRUM4RDQ2Mzk0Rjg5Q0IKUldUTGlVODVSbzNzYml1ZTN3d0pBN1IwWkRoZXNROTRmbk5WOE5CR2VJQVYrTUJLN21PNzI4eHEK",
       "requireSignedVersion": true,
       "endpoints": [
-        "https://gitea.samialabri.com/kestrove/kestrove-desktop/raw/branch/main/updater/latest.json"
+        "https://kestrove.samialabri.com/updates/latest.json"
       ],
       "windows": {
         "installMode": "passive"

src/main.ts

@@ -208,7 +208,7 @@ type Tab = "phone" | "kit" | "paste" | "create";
 async function renderOnboarding(tab: Tab = "phone") {
   const status = await invoke<SyncStatus>("sync_status");
   const body = stack();
-  const tabs: [Tab, string][] = [["phone", "Use my phone"], ["kit", "Emergency Kit"], ["paste", "Paste setup code"], ["create", "New account"]];
+  const tabs: [Tab, string][] = [["phone", "Use my phone"], ["kit", "Emergency Kit"], ["paste", "Paste setup code"], ["create", "New vault"]];
   const nav = h("div", "seg", ...tabs.map(([t, label]) => {
     const b = button(label, "quiet", async () => {
       await invoke("join_cancel");
@@ -417,8 +417,17 @@ function createPanel(body: HTMLElement, status: SyncStatus) {
   const pins = input({ placeholder: "base64, comma-separated", spellcheck: false }, true);
   const pw = input({ type: "password", autocomplete: "new-password" });
   const pw2 = input({ type: "password", autocomplete: "new-password" });
+  const useServer = input({ type: "checkbox", checked: true });
+  useServer.className = "switch";
+  useServer.setAttribute("aria-label", "Sync with a server");
+  const serverFields = stack();
   const err = errBox();
   const btn = button("Create account", "primary");
+  const label = () => (useServer.checked ? "Create account" : "Create vault");
+  useServer.onchange = () => {
+    serverFields.hidden = !useServer.checked;
+    btn.textContent = label();
+  };
   btn.onclick = async () => {
     err.replaceChildren();
     if (pw.value !== pw2.value) {
@@ -430,25 +439,31 @@ function createPanel(body: HTMLElement, status: SyncStatus) {
     btn.disabled = true;
     btn.textContent = "Creating…";
     try {
-      const secretKey = await invoke<string>("create_account", { serverUrl: url.value, pins: pins.value, setupCode: code.value, email: email.value, masterPassword: pw.value });
+      const secretKey = useServer.checked
+        ? await invoke<string>("create_account", { serverUrl: url.value, pins: pins.value, setupCode: code.value, email: email.value, masterPassword: pw.value })
+        : await invoke<string>("create_local_account", { masterPassword: pw.value });
       pw.value = pw2.value = "";
       await showSecretKey(secretKey);
     } catch (e) {
       setErr(err, e);
       btn.disabled = false;
-      btn.textContent = "Create account";
+      btn.textContent = label();
       // A vault created here whose server registration failed: continue to the vault (Settings → Sync retries).
       if ((await invoke<AppState>("state")).has_account) {
         body.append(button("Continue to the vault", "secondary", render));
       }
     }
   };
-  body.append(
-    p("kv-muted", "A new account on your Kestrove server. You'll get a Secret Key: keep it with your Emergency Kit."),
+  serverFields.append(
     field("Your Kestrove server", url),
     field("Email", email, "You sign in with it on new devices."),
     field("Invite or setup code", code, "The invite from your server's admin, or KV_SETUP_CODE from its .env for the first account. Empty with open sign-up."),
     h("details", "", h("summary", "kv-small", "Certificate pins (advanced)"), field("SPKI pins", pins)),
+  );
+  body.append(
+    p("kv-muted", "A new vault. You'll get a Secret Key: keep it with your Emergency Kit."),
+    field("Sync with a server", useServer, "Turn this off to use Kestrove on this computer only. You can connect a server later in Settings."),
+    serverFields,
     field("Master password", pw, "10 or more characters."),
     field("Repeat master password", pw2),
     h("div", "actions", btn), err,

src/style.css

@@ -11,6 +11,7 @@ h1, h2, h3 { margin: 0; }
 .grow { flex: 1 1 auto; min-width: 0; }
 .row { display: flex; gap: var(--space-2); align-items: center; flex-wrap: wrap; }
 .stack { display: flex; flex-direction: column; gap: var(--space-4); min-width: 0; }
+.stack[hidden] { display: none; }
 .actions { display: flex; gap: var(--space-2); align-items: center; }
 .actions.end { justify-content: flex-end; }
 .center-row { display: flex; justify-content: center; }