[nniiovoo]

Why

The owner found the Recovery Key step and typing hard, and couldn't tell where keys are kept. A verified audit (46 confirmed findings) also found steps that ended without a message, hidden rules, and wording that implied a key file exists.

What changed

Recovery Key step

• It has up to 10 minutes. It used to share a 2-minute limit with all of setup, and a timeout saved nothing and left the written key useless.
• The retype box shows what you type, and copy, cut and system text tools are blocked on it on Mac.
• The first Cancel only asks. If the step ends, the app says so.
• The check still compares the last two groups, and the screen now says to compare all 7 with your paper.

Typing in password boxes

• Time left, a Caps Lock warning, clearer errors and live advice on a new password. Return moves to the next empty box.
• Optional ways to check what you typed, each off by default:
  • Show what I type on Recovery Key entry (Mac): a separate line that turns off after 60 seconds without a key press.
  • Hold to show what I typed on the New and Confirm boxes (Mac): about 10 seconds, never the Current box.
  • Show in the Note editor, for Login passwords and API Key values only, never Wallet Kinds: hides after 30 seconds or on blur.
• The Mac options are refused while a known sharing app is running, and the screen says why.

Where keys are stored

• This is now the first section in Settings. Each row says what the item is, where it is and whether it's encrypted.
• The folder path can be copied or opened in Finder or File Explorer.
• The Agent Key is named as a plain-text file, and docs/guide.md gives the same answer.

Other screens

• Lock screen, first run, Note editor and Touch ID: better keyboard use, plainer words, and messages when something ends or fails.
• Leaving a Note field no longer cancels Wallet panels (GAP-1).

Decisions for the reviewer

Chosen by the owner:

• Keep the last-two-groups check, plus the compare-all-7 reminder.
• Tickbox to show Recovery Key typing.
• Both Hold to show and the Editor Show.
• Normal screen sleep.

Made during the build, and the owner can overrule them:

• Suggest a password still works after the Sharing Guard is dismissed. Blocking it would also block it whenever Zoom is merely open.
• Hold to show shows the box with the keyboard focus, otherwise the last-edited box.
• Editor Show also still works after a dismissal, and the wording now says so. A stricter rule needs a new status flag.
• Screen readers can still read the Recovery Key line, its retype box and a suggested password. Hiding them would lock out VoiceOver users.

Dependencies

No new crates, and Cargo.lock and package-lock.json are unchanged. Three feature flags and one Windows feature are added on crates already pinned:

• objc2-app-kit: NSActionCell, NSCell and NSTextFieldCell, for the retype box's own field editor. tao owns the window delegate, so this goes through a cell subclass.
• windows: Win32_UI_Input_Ime, to turn the input method off on the retype box.

The one new Tauri capability is allow-reveal-vault-folder. The command takes no arguments from the WebView. No network code is added.

Testing

• scripts/check.sh passes on Mac on this commit, rebased on f0d06e9: 719 tests, 0 failures.
• CI passes on macos-15 and windows-2025.
• An off-screen probe of the new Mac classes, with fake text, confirmed the retype box's copy and cut blocks. It wasn't the app.

Not tested:

• On screen: no hand check result has been reported for this build, on Mac or Windows, so these screens should not be described as working yet.
• Windows: CI builds and tests it, but it has never been run on a PC. Two behaviours need a real machine:
  • lib.rs now ignores Focused(false) while the app is still in front, and lock on focus loss depends on that path.
  • Typing while the core is busy relies on WM_CHAR still arriving after WM_KEYDOWN is swallowed.
• Hardware: Touch ID error codes and VoiceOver.
• Show in Finder on the signed sandboxed app: if macOS asks whether Finder may access another app's data, stop and review. Don't allow it.

Hand checks are in docs/native-credential-design.md ("Validation still required"), docs/capture-test.md ("Native panels and focus") and docs/quick-unlock-design.md. Use fake values only.

Issues #12 and #13 stay open until the owner's hand checks pass, and #11 stays open for Windows.

Known limits and follow-ups

• Windows panels use the default font and fixed pixel sizes, so text may be cut off at 125% and above. docs/capture-test.md records the font height to measure first.
• A few small fixes in these files are left for later, listed in the polish pass's handoff: companionOperation's per-start clause, "Wallet passphrase" wording and some guide lines. SAF-1 (the Start button gap) and SIM-6 also come after this.
• Combine the Agent Companion into this repository as companion/ #102 also touches README.md, on different lines.

🤖 Generated with Claude Code