samiandClaude Opus 5.5
923c466dea
- Builds and runs (tauri build --debug); placeholder icons; persistent VaultCore::open in the OS app-data dir; Secret Key remembered on the device; tray keeps the app serving the extension. - Auto-lock: idle (system idle on Windows/macOS, in-app activity on Linux), screen lock, sleep. - Local IPC for kestrove-nmh: 0700 dir + 0600 Unix socket with peer-uid checks; Windows named pipe (first instance, local only, user DACL, client SID check) behind cfg. - Pairing channel: X25519 → HKDF → 6-word fingerprint confirmed in both UIs, per-connection session keys, AES-256-GCM with strict counters. Test vectors shared with kestrove-browser. - Broker: query/fill/totp/save with origin re-checks; pairing and save prompts in the UI. - kestrove-nmh relays ciphertext only; native-host installers for Linux/macOS/Windows. - Tests: unit tests, tests/nmh_stdio.rs (real kestrove-nmh over stdio), examples/test-host. Co-Authored-By: Claude Opus 5.5 <[email protected]>
Native messaging manifests
install.sh (Linux, macOS) and install.ps1 (Windows) fill in the placeholders and register the
manifests for the current user. Default ids are the development ones: the unpacked Chrome build is pinned
to kogapfibnnpeapfcjkkpgjddbhnjfein by the manifest key in kestrove-browser, Firefox uses
[email protected]. Pass --chrome-id / -ChromeId for a Web Store build.
native-messaging/install.sh # every browser with a profile dir, host from target/
native-messaging/install.sh --browsers chrome --nmh /opt/kestrove/kestrove-nmh
native-messaging/install.sh --user-data-dir /tmp/profile # a Chromium started with --user-data-dir (tests)
native-messaging/install.sh --uninstall
| Browser | macOS (dev only; the Apple app ships its own host) |
|---|---|
| Chrome | ~/Library/Application Support/Google/Chrome/NativeMessagingHosts/ |
| Edge / Brave / Chromium | ~/Library/Application Support/{Microsoft Edge,BraveSoftware/Brave-Browser,Chromium}/NativeMessagingHosts/ |
| Firefox | ~/Library/Application Support/Mozilla/NativeMessagingHosts/ |
| Browser | Linux | Windows |
|---|---|---|
| Chrome | ~/.config/google-chrome/NativeMessagingHosts/app.kestrove.nmh.json |
HKCU\Software\Google\Chrome\NativeMessagingHosts\app.kestrove.nmh → path to json |
| Edge | ~/.config/microsoft-edge/NativeMessagingHosts/ |
HKCU\Software\Microsoft\Edge\NativeMessagingHosts\app.kestrove.nmh |
| Firefox | ~/.mozilla/native-messaging-hosts/app.kestrove.nmh.json |
HKCU\Software\Mozilla\NativeMessagingHosts\app.kestrove.nmh |
| Brave | ~/.config/BraveSoftware/Brave-Browser/NativeMessagingHosts/ |
same key as Chrome |
allowed_origins / allowed_extensions pin the host to your extension id.
That is the first line of defense against other extensions (docs/04 A8).