PassVault v2.2.3-server — Linux 完整服务器版

PassVault v2.2.3-server

中文 · English

中文

这是 Linux/SQLite 服务器版 v2.2.3 的当前完整发行，替换此前的 v2.2.3-server 服务器归档。Cloudflare v2.2.3 的 tag、源码和资产保持不变。

服务器版能力

• 安全分享 v1/v2、附件对象上传、匿名领取、撤销与过期清理。
• 独立于密码库用户的 Admin 身份、凭据、Cookie 和会话。
• 概览、用户、注册、运维、安全、审计和设置七个 Admin 页面。
• Admin 可在设置页修改自身密码；成功后撤销全部 Admin 会话。
• 配额、封禁、会话撤销、用户删除/导出、邀请、维护修复和安全事件管理。
• 文件生命周期 fence、删除 outbox、启动协调和维护修复，保护附件和分享对象与 SQLite 状态一致。
• 移动优先 Admin 布局；改密入口位于设置页，避免 iPhone Safari 窄屏页头异常。

安全与兼容性

• Admin 身份体系与密码库用户完全隔离。
• Admin 密码使用持久化 scrypt verifier；原始密码不进入日志、审计或 URL。
• Cloudflare Worker、D1/R2 schema、Vault Key、KEK、主密码和加密协议均未修改。
• 归档不包含生产环境变量、数据库、附件、备份、日志、部署证据、Git 元数据或依赖目录。

验证

• 完整候选全仓门禁：681 tests / 679 pass / 0 fail / 2 skip，自然 exit 0。
• 替换命名及打包闭包定向门禁：48 pass / 0 fail / 2 skip。
• 从干净提交生成的 Linux 归档重新解压后：84/84 测试通过。
• lint、文档检查、typecheck、build、归档边界与 SHA256SUMS 校验全部通过。

发行资产

• pass-vault-v2-linux-2.2.3.tar.gz
• pass-vault-v2-linux-2.2.3.zip
• SHA256SUMS

sha256sum -c SHA256SUMS

---

English

This is the current complete Linux/SQLite server release for v2.2.3 and replaces the previous v2.2.3-server server archives. The Cloudflare v2.2.3 tag, source, and assets remain unchanged.

Server-edition capabilities

• Secure sharing v1/v2, attachment-object uploads, anonymous claims, revocation, and expiry cleanup.
• Admin identity, credentials, cookies, and sessions fully isolated from vault users.
• Seven Admin pages: Overview, Users, Registration, Operations, Security, Audit, and Settings.
• Administrators can change their own password from Settings; success revokes all Admin sessions.
• Quota, suspension, session revocation, user deletion/export, invitation, maintenance repair, and security-event management.
• File-lifecycle fences, deletion outbox, startup reconciliation, and maintenance repair to keep attachment/share objects consistent with SQLite state.
• Mobile-first Admin layout with password management in Settings, avoiding narrow-header defects on iPhone Safari.

Security and compatibility

• The Admin identity system is fully separate from vault users.
• Admin passwords use a persistent scrypt verifier; plaintext passwords are not written to logs, audit records, or URLs.
• The Cloudflare Worker, D1/R2 schema, Vault Key, KEK, master password, and encryption protocols are unchanged.
• Archives exclude production environment files, databases, attachments, backups, logs, deployment evidence, Git metadata, and dependency directories.

Verification

• Full candidate repository gate: 681 tests / 679 pass / 0 fail / 2 skip, natural exit 0.
• Replacement-name and package-closure focused gate: 48 pass / 0 fail / 2 skip.
• Fresh extraction of the Linux package from the clean release commit: 84/84 tests passed.
• Lint, documentation checks, typecheck, build, archive-boundary checks, and SHA256SUMS verification all passed.

Release assets

• pass-vault-v2-linux-2.2.3.tar.gz
• pass-vault-v2-linux-2.2.3.zip
• SHA256SUMS

sha256sum -c SHA256SUMS

PassVault v2.2.3

PassVault v2.2.3

中文

v2.2.3 汇总发布 v2.2.2 之后完成的 Cloudflare 移动端体验与敏感状态生命周期修复。它不改变数据格式、D1/R2 schema、API 协议或加密协议。

修复与改进

• 手机端文本输入、文本区域和下拉控件统一使用至少 16px 字号，降低 iOS Safari 聚焦输入时自动放大页面的概率。
• 首页与安全分享页采用固定缩放 viewport；这会禁用页面双指缩放，是本版本明确的移动端体验取舍。
• 手机长列表的条目操作菜单限制在列表真实可见区域内，避免顶部菜单项被搜索/筛选工具栏遮挡。
• 手机详情返回列表时，退场层在清理详情 DOM 前完全透明，避免 WebKit 尾帧出现可见跳变。
• 编辑器关闭、后台隐私遮挡和锁库时清理敏感编辑基线；锁库同时重置恢复中心与收藏/置顶客户端注册表，避免旧会话状态残留。

安全与兼容性

• 不改变 Passkey/WebAuthn、Vault Key、KEK、主密码、附件或安全分享加密协议。
• 不需要新增 migration；完整 Cloudflare migration 链仍截至 0034_admin_control_center.sql。
• 制品不包含生产凭据、数据库导出、备份、日志、截图、视频、Git 元数据或 node_modules。
• Cloudflare 制品包含公开源码、平台闭合测试、文档和 Agent 指引；依赖 Linux 后端或完整仓库布局的测试保留在 GitHub 完整源码分支，不进入 Cloudflare 归档。
• 本次只发布并验证 Cloudflare 归档；Linux 运行时未部署或生产验证。

最终验证

• 全仓最终候选：632 项，630 通过，0 失败，2 条件跳过。
• 干净提交归档门禁：5/5 通过，0 跳过。
• Cloudflare 归档新鲜解压后：npm ci 审计 0 漏洞；包内测试 220/220 通过。
• Lint、文档、TypeScript、Build、diff 与 283 个候选文件脱敏扫描通过。
• Chromium 与 WebKit 移动端回归通过；Linux WebKit 仅为 Safari 近似环境，不等同于真实 iPhone Safari。

SHA-256

8ae1e6b17ae12b9adbefcd7f96c224017c03764e8305bbb028d376d3e523bb24  pass-vault-v2-cloudflare-2.2.3.tar.gz
ca186e47c04882ae86ce6e31fd696dfaa8b62ed7fdf83544e269a6d3fb3c217f  pass-vault-v2-cloudflare-2.2.3.zip

---

English

PassVault v2.2.3 publishes the Cloudflare mobile-experience and sensitive-state lifecycle fixes completed after v2.2.2. It does not change data formats, the D1/R2 schema, API contracts, or cryptographic protocols.

Fixes and improvements

• Mobile text inputs, textareas, and selects use at least 16px text to reduce iOS Safari focus zoom.
• The main app and secure-share page use a fixed-scale viewport. This intentionally disables pinch zoom as an explicit mobile UX trade-off.
• Mobile row action menus stay inside the list's actual visible interval so search/filter chrome cannot cover upper actions.
• Mobile detail exits become fully transparent before detail DOM cleanup, preventing a visible WebKit end-frame jump.
• Editor close, background privacy shielding, and vault locking clear sensitive editor baselines; locking also resets recovery and favorite/pin client registries.

Security and compatibility

• No changes to Passkey/WebAuthn, Vault Key, KEK, master-password, attachment, or secure-share cryptographic protocols.
• No new migration is required; the Cloudflare migration chain still ends at 0034_admin_control_center.sql.
• Production credentials, database exports, backups, logs, screenshots, videos, Git metadata, and node_modules are excluded.
• Cloudflare archives contain public source, platform-closed tests, documentation, and Agent guidance. Tests requiring Linux or the full repository topology remain in the complete GitHub source branch.
• Only the Cloudflare archives were released and verified; Linux was not deployed or production-verified.

Final verification

• Repository candidate: 632 tests, 630 passed, 0 failed, 2 conditionally skipped.
• Clean-commit archive gate: 5/5 passed, 0 skipped.
• Fresh Cloudflare extraction: npm ci audit 0 vulnerabilities; archive suite 220/220 passed.
• Lint, documentation, TypeScript, build, diff, and secret scanning across 283 candidate files passed.
• Chromium and WebKit mobile regressions passed. Linux WebKit is only a Safari approximation, not real-device iPhone Safari evidence.

PassVault v2.2.2

PassVault v2.2.2

中文

v2.2.2 汇总发布今天完成的 Cloudflare 版本代码优化与回归加固，不改变数据格式、D1/R2 schema、API 协议或加密协议。

主要变化

• 将核心 Worker 的运行时、HTTP 与安全请求辅助逻辑拆分为清晰模块，同时保持单一 Worker 部署目标。
• 将 Admin Worker 的 Access 认证、运行时与 UI 边界模块化。
• 从主前端提取低耦合模块：历史差异、置顶排序、Dialog 通用 UI 辅助和密码生成算法核心。
• 将大列表动画索引从重复 indexOf 查找优化为线性索引。
• 修复 WebKit Dialog 几何测试在动画中间帧采样导致的偶发失败，并把最终几何误差约束收紧到 1px。
• 删除零调用的旧 Eye/EyeOff SVG 工厂。
• 增强模块依赖、循环依赖、语法、静态缓存身份、构建闭包、发行包成员及死代码回归门禁。

安全与兼容性

• 不改变 Passkey/WebAuthn、Vault Key、KEK、主密码、附件或分享加密协议。
• 不包含生产凭据、数据库导出、备份、日志、截图、视频、Git 元数据或 node_modules。
• Cloudflare 制品包含完整公开源码、部署模板、文档以及依赖闭合、可在该制品内独立运行的 Cloudflare 测试清单；依赖 Linux 后端或全仓布局的测试仍保留在 GitHub 源码分支，不进入 Cloudflare 包。测试仅用于本地或 CI，不会由 Wrangler 部署到生产。
• 从 v2.2.1 升级无需新增 migration；完整 Cloudflare migration 链截至 0034_admin_control_center.sql。仍应按部署指南检查远端 migration ledger，且不要重复运行已应用迁移。

Release 资产

• pass-vault-v2-cloudflare-2.2.2.tar.gz
• pass-vault-v2-cloudflare-2.2.2.zip
• SHA256SUMS

下载后请运行：

sha256sum -c SHA256SUMS

---

English

PassVault v2.2.2 publishes the Cloudflare code-structure and regression-hardening work completed today. It does not change data formats, the D1/R2 schema, API contracts, or cryptographic protocols.

Highlights

• Split the core Worker runtime, HTTP, and safe request helpers into explicit modules while retaining one Worker deployment target.
• Modularized Cloudflare Access authentication, runtime helpers, and UI boundaries in the Admin Worker.
• Extracted low-coupling frontend domains: history diffing, pinned ordering, shared dialog helpers, and the password generator core.
• Replaced repeated list-animation indexOf lookups with a linear map index.
• Stabilized WebKit dialog geometry checks by waiting for animation completion and layout settlement, tightening the final error allowance to 1px.
• Removed an unreferenced legacy Eye/EyeOff SVG factory.
• Added stronger gates for module dependencies, cycles, syntax, cache identities, build closure, release membership, and dead-code regression.

Security and compatibility

• No changes to Passkey/WebAuthn, Vault Key, KEK, master-password, attachment, or secure-share cryptographic protocols.
• Production credentials, database exports, backups, logs, screenshots, videos, Git metadata, and node_modules are excluded.
• The Cloudflare archives contain the complete public source, deployment templates, documentation, and a dependency-closed Cloudflare test manifest runnable from that artifact. Tests that require the Linux backend or the full repository layout remain on the GitHub source branch and are excluded from the Cloudflare archive. Tests are for local/CI use and are not deployed by Wrangler.
• No new migration is required from v2.2.1. Continue to inspect the remote migration ledger according to the deployment guide and never reapply migrations already recorded.

Release assets

• pass-vault-v2-cloudflare-2.2.2.tar.gz
• pass-vault-v2-cloudflare-2.2.2.zip
• SHA256SUMS

Verify downloads with:

sha256sum -c SHA256SUMS

PassVault v2.2.1

PassVault v2.2.1

中文 · English

Cloudflare Worker / D1 / R2 与独立 Admin Worker 补丁发行版

中文

新增与改进

• 新增永久/限时用户封禁和解封；封禁会撤销已有会话，并在密码、Passkey、既有会话及附件补偿路径中 fail closed。
• 新增隐私聚合安全事件中心，可筛选、处理、忽略并记录非敏感备注。
• 新增页面通知及可选 Telegram 告警；服务端按小时去重和冷却，发送失败不影响业务。
• 新增 D1/R2 维护中心：扫描默认只读；修复要求精确确认、每批最多 20 项，并在入队前重新核验引用和 inflight 状态。
• 新增用户非敏感元数据 JSON/CSV 白名单导出，所有文本安全引用并防止 CSV 公式注入。
• 调整 Cloudflare 登录页文字层级：正文、输入和按钮为 16px，辅助提示与品牌眉题为 14px，改善中文可读性。

安全边界

• 安全事件和通知不返回主体哈希、IP、用户名、凭据、保险库内容、附件内容或 R2 object key。
• 截断或未完成的 R2 扫描 fail closed，不生成可修复报告；维护修复对当前附件、历史版本、分享、待删和 inflight 引用进行保护。
• Admin 写接口继续要求 Cloudflare Access、管理员邮箱白名单、同源和 JSON 校验；破坏性操作、维护修复和导出均写入审计。
• 公开包使用脱敏 Wrangler 模板，不包含生产域名、账号、资源 ID、数据库备份或凭据。

升级

1. 备份 D1，并确认无未归属的 R2 生命周期记录。
2. 按顺序应用全部待处理 D1 migrations，包括 0034_admin_control_center.sql。
3. 使用 --keep-vars 部署主 Worker。
4. 使用仓库外 Admin 严格 JSON 配置运行 PASS_VAULT_ADMIN_PROD_CONFIG=/path/outside/repository/admin-prod.json npm run deploy:admin。
5. 重新打开旧浏览器标签页，确保加载新 CSS。

本 Release 仅提供 Cloudflare 版压缩包。本轮不会生成或上传 Linux 压缩包；共享前端文件仍兼容 Linux 构建，但 Linux 版未发布、未做生产验证。

---

English

Additions and Improvements

• Adds permanent/timed user suspension and unsuspension. Suspension revokes existing sessions and fails closed across password, Passkey, established-session, and attachment-compensation paths.
• Adds a privacy-aggregated Security Events Center with filtering, resolution, dismissal, and non-sensitive notes.
• Adds in-page notifications and optional Telegram alerts with server-side hourly deduplication/cooldown; delivery failures never fail business operations.
• Adds a D1/R2 Maintenance Center: scans are read-only by default; repair requires exact confirmation, processes at most 20 items per batch, and revalidates references/inflight state before enqueueing.
• Adds allowlisted JSON/CSV export of non-sensitive user metadata with safe quoting and spreadsheet-formula injection protection.
• Improves Cloudflare login typography: 16px body/input/action text and 14px helper/eyebrow text for clearer Chinese readability.

Security Boundaries

• Security events and notifications never expose subject hashes, IPs, usernames, credentials, vault/attachment contents, or R2 object keys.
• Truncated/incomplete R2 scans fail closed and cannot become repairable reports. Repair protects current attachments, history, shares, pending deletions, and inflight references.
• Admin writes still require Cloudflare Access, the exact admin-email allowlist, same-origin validation, and JSON validation. Destructive actions, repair, and export are audited.
• Public archives use sanitized Wrangler templates and exclude production domains, accounts, resource IDs, database backups, and credentials.

Upgrade

1. Back up D1 and confirm there are no unowned R2 lifecycle rows.
2. Apply every pending D1 migration in order, including 0034_admin_control_center.sql.
3. Deploy the main Worker with --keep-vars.
4. Deploy Admin from an out-of-repository strict JSON config with PASS_VAULT_ADMIN_PROD_CONFIG=/path/outside/repository/admin-prod.json npm run deploy:admin.
5. Reopen old browser tabs so they load the new CSS.

This Release provides Cloudflare archives only. No Linux archive is generated or uploaded; shared frontend files remain compatible with the Linux build, but the Linux edition was not released or production-verified in this cycle.

Verification / 校验

Verify downloads with SHA256SUMS. If PassVault helps you, a GitHub Star is appreciated.

PassVault v2.2.0

PassVault v2.2.0

中文 · English

Cloudflare Worker / D1 / R2 与独立 Admin Worker 发行版

v2.2.0 在 v2.1.0 自定义资料基础上，新增加密历史与恢复中心、安全分享 v2、跨页收藏/置顶状态，以及完整的 Cloudflare 运维管理能力。本次公开资产同时提供 Cloudflare 与 Linux 独立包；本轮生产功能与 Admin 管理能力仅在 Cloudflare 版完成验证和部署，Linux 包主要保持共享前端与既有服务端兼容，不代表新增 Cloudflare 协议能力已在 Linux 生产环境验证。

中文

资料历史与恢复中心

• 条目每项最多保留最近 10 个加密历史版本，当前版本更新成功后才原子归档旧密文。
• 附件支持 metadata 与内容版本；每附件最多 10 版、每用户最多 50 版。
• 历史版本可在浏览器内比较字段差异并恢复；密码、TOTP、secret 等敏感变化默认隐藏。
• 原“回收站”升级为“恢复中心”：支持预览、单项/批量恢复、批量永久删除和清空。
• 删除分组时写入加密墓碑；恢复资料时可同时恢复原分组，服务端看不到分组名称或资料关系。
• 锁库、退出和隐私遮罩会清理预览 DOM、Blob URL 与异步操作引用。

安全分享 v2

• 单个加密分享包可包含 1–50 条资料，并可携带最多 8 个附件、25 MiB 附件密文。
• 支持可选分享密码：使用 PBKDF2-SHA-256（310,000 次）派生 KEK 包装随机 package key；密码和派生密钥不发送到服务端。
• 支持精确到期、查看次数、单浏览器/一次性消费、撤销和分享管理。
• 分享采用 prepare / upload / commit 流程；未完成上传、撤销或过期对象由维护任务安全回收。
• manifest、资料和附件均使用 AES-GCM 加密，并通过 token/object AAD 隔离；旧 v1 分享继续兼容。
• 匿名分享页使用 no-store、noindex,nofollow 和 no-referrer，并在读取 fragment 后立即清除地址栏密钥材料。

收藏、置顶与资料体验

• 收藏/置顶状态从资料正文中独立为加密注册表，减少正文 revision 冲突。
• 跨标签页更新采用字段级补丁合并，保留远端同项的其他状态。
• 优化自定义字段条件显示、批量操作、分组、更多菜单及多资料交互。
• 统一弹窗滚动、焦点、手机窄屏布局与隐私状态清理。

Cloudflare Admin 管理平台

• 独立 Admin Worker，使用 Cloudflare Access 邮箱白名单保护；未授权请求不返回管理页面。
• 展示用户、加密条目、附件、会话、D1/R2 用量、健康状态、趋势、安全事件和维护任务。
• 管理注册状态和注册码摘要，支持强制退出、删除用户和安全重试维护任务。
• 用户配额支持条目数、附件数、附件总容量和有效期四个维度；恢复默认会删除覆盖配置。
• 主站 Worker 在所有写路径原子执行配额门禁，Admin 仅负责管理与展示，避免 TOCTOU 绕过。
• 配额预警按 70% / 85% / 95% 分级；零上限但已有用量会单独置顶。
• 用户风险筛选覆盖接近配额、长期未登录、未设置 Passkey、活跃会话异常；新用户不会被立即误报为长期未登录。
• 用户详情显示每个用户最近 20 条配额调整历史，仅含管理员、目标用户、动作、时间和非敏感差异。
• 所有管理写操作使用同源校验和审计；关键 D1 操作与审计原子提交，不记录对象键、IP、凭据或零知识内容。

安全与数据边界

• 零知识内容仍只以密文 envelope 保存；服务端不接收资料、模板、历史版本、恢复墓碑或分享明文。
• 新增安全事件只保存聚合分类与计数，不保存用户名、IP、凭据或秘密值。
• R2 删除会检查当前附件、附件历史和分享对象引用；并发维护使用条件更新避免重复扣减。
• 管理页面启用 CSP、HSTS、no-store、拒绝 framing、严格 referrer/permissions policy。
• 发行包使用脱敏 Wrangler 模板，不包含真实域名、管理员邮箱、Cloudflare 资源 ID、数据库备份或凭据。

升级说明

Cloudflare 用户应按顺序应用新增 migrations 0021–0028，然后分别部署主 Worker 与可选 Admin Worker：

npm ci
npm run build
npx wrangler d1 migrations apply <YOUR_D1_DATABASE> --remote --config apps/worker/wrangler.jsonc
npx wrangler deploy --config apps/worker/wrangler.jsonc
npx wrangler deploy --config apps/admin-worker/wrangler.jsonc

部署 Admin 前，请自行创建 Cloudflare Access Application，并将 Admin Worker 的 D1/R2 绑定指向与主 Worker 相同的资源。ADMIN_EMAILS、域名和资源标识均须替换为自己的值，敏感配置请使用 Wrangler secrets。

兼容性与限制

• 0021–0028 为 Cloudflare D1 migrations；不要对 Linux SQLite 数据库执行这些文件。
• 安全分享 v2、附件历史、Cloudflare 配额强制和 Admin 管理平台是 Cloudflare 版能力。
• Linux 发行包继续提供独立 Node/SQLite 部署，但本轮未部署或生产验证 Linux 新功能路径。
• 升级前请备份 D1 和 R2；历史/分享对象会增加存储占用，请根据业务设置配额和保留策略。

---

English

History and Recovery Center

• Keeps up to 10 encrypted entry revisions per item, archiving the previous ciphertext only after a successful atomic update.
• Adds attachment metadata/content history: up to 10 versions per attachment and 50 per user.
• Compares field-level changes locally and restores a selected revision; password, TOTP, and secret changes stay hidden by default.
• Upgrades Trash into a Recovery Center with preview, individual/bulk restore, permanent deletion, and clear-all actions.
• Stores deleted-group tombstones in an encrypted registry so a record and its original group can be restored without exposing group names or relationships to the server.
• Clears preview DOM, Blob URLs, selection state, and asynchronous references on lock, logout, or privacy shielding.

Secure Share v2

• One encrypted package can contain 1–50 records, up to 8 attachments, and up to 25 MiB of attachment ciphertext.
• Optional passwords wrap a random package key with a PBKDF2-SHA-256 KEK (310,000 iterations); passwords and derived keys never leave the browser.
• Supports precise expiration, view limits, one-browser/one-time consumption, revocation, and share management.
• Uses a prepare/upload/commit lifecycle; incomplete, revoked, and expired objects are reclaimed by safe maintenance jobs.
• Encrypts manifests, records, and objects with AES-GCM and token/object-scoped AAD while preserving v1 share compatibility.
• Anonymous pages use no-store, noindex,nofollow, and no-referrer, and remove fragment key material from the address bar immediately.

Favorites, Pins, and Record UX

• Moves favorite/pin state out of record bodies into a separate encrypted registry to reduce revision conflicts.
• Replays field-level patches across tabs while preserving unrelated remote marker state.
• Improves conditional custom fields, bulk actions, grouping, More menus, dialogs, focus handling, narrow-screen layouts, and privacy cleanup.

Cloudflare Admin Platform

• Ships an independent Admin Worker protected by an exact Cloudflare Access email allowlist.
• Shows users, encrypted record/attachment/session counts, D1/R2 usage, health, trends, security events, and maintenance tasks.
• Manages registration state/invite digest, session revocation, user deletion, and safe maintenance retries.
• Provides four-dimensional per-user quotas: entry count, attachment count, total attachment ciphertext, and optional expiry; resetting removes the override.
• Enforces quotas atomically in every main Worker write path; the Admin Worker only aggregates and manages policy.
• Grades quota warnings at 70% / 85% / 95%, with explicit priority for zero-limit overages.
• Filters user risk by quota pressure, inactivity, missing Passkeys, and anomalous active sessions without misclassifying newly created accounts as inactive.
• Shows the latest 20 quota changes per user with only actor, target, action, time, and allowlisted non-sensitive differences.
• Applies same-origin checks and audit logging to admin writes, atomically coupling critical D1 mutations with their audits.

Security and Data Boundaries

• Zero-knowledge content remains encrypted envelopes; the server does not receive record, template, history, recovery-registry, or share plaintext.
• Security events store aggregate categories and counts only—no usernames, IPs, credentials, or secret values.
• R2 cleanup checks current attachment, attachment-history, and share references, with conditional updates preventing duplicate accounting under concurrency.
• Admin responses use CSP, HSTS, no-store, frame denial, and strict referrer/permissions policies.
• Public archives contain sanitized Wrangler templates and exclude production domains, admin emails, Cloudflare resource IDs, backups, and credentials.

Upgrade

Cloudflare deployments must apply D1 migrations 0021–0028 in order, then deploy the main Worker and optional Admin Worker:

npm ci
npm run build
npx wrangler d1 migrations apply <YOUR_D1_DATABASE> --remote --config apps/worker/wrangler.jsonc
npx wrangler deploy --config apps/worker/wrangler.jsonc
npx wrangler deploy --config apps/admin-worker/wrangler.jsonc

Create a Cloudflare Access Application for the Admin Worker and point its D1/R2 bindings at the same resources as the main Worker. Replace all placeholder domains, resource identifiers, and ADMIN_EMAILS; store sensitive values with Wrangler secrets.

Compatibility and Limits

• Migrations 0021–0028 are Cloudflare D1 migrations and must not be applied to Linux SQLite.
• Secure Share v2, attachment history, Cloudflare quota enforcement, and the Admin platform are Cloudflare-specific capabilities.
• The Linux archive remains available for independent Node/SQLite deployments, but new Linux feature paths were not deployed or production-verified in this release cycle.
• Back up D1 and R2 before upgrading; history/share objects increase storage usage, so configure quotas and retention policies accordingly.

Verification / 校验

Verify downloaded files with SHA256SUMS. If this project helps you, a GitHub Star is always appreciated.

PassVault v2.1.0 — Cloudflare 大版本

PassVault v2.1.0

Cloudflare Worker / D1 / R2 公开发行版

本版本聚焦移动端资料整理能力，新增完整的自定义资料和加密个人模板流程，并包含标签、收藏、隐私保护及 Cloudflare 管理能力改进。

主要更新

• 自定义资料：可从空白资料或六种内置模板创建，自由增删、排序字段并选择适合的字段类型。
• 个人模板：将当前字段结构保存为加密模板；只保存字段名称、类型和顺序，不保存任何字段内容。
• 完整资料生命周期：自定义资料支持搜索、分组、置顶、回收站、批量操作、备份导出和恢复。
• 移动端体验：优化个人模板、更多操作、标签筛选和管理弹窗；覆盖 Chromium/WebKit 的桌面、390px 与 320px 视口。
• Cloudflare 管理面板：注册控制、用户与审计操作、配额及系统状态视图。

升级说明

1. 按顺序应用 D1 migrations；本版本新增 apps/worker/migrations/0020_custom_entries.sql。
2. 将示例 Wrangler 配置中的 D1、R2、路由和管理员邮箱替换为自己的资源。
3. 通过 Wrangler secrets 配置敏感值，不要把 token、密钥或生产配置写进仓库。
4. 构建并部署 Cloudflare Worker：

npm ci
npm run build
npx wrangler deploy --config apps/worker/wrangler.jsonc

安全边界

• 资料和个人模板内容均以密文 envelope 保存；服务端不接收资料明文。
• 发布资产不含生产域名、账户邮箱、Cloudflare 资源 ID、数据库备份或凭据。
• Passkey 辅助解锁会改变纯客户端零知识边界；启用前请阅读界面提示并继续保管主密码。

校验

下载资产后可使用 Release 中的 SHA-256 校验值复核完整性。

Pass Vault V2 v2.0.0 · 服务器版 / Linux Server Edition

Pass Vault V2 v2.0.0（服务器版 / Linux Server Edition）

本发布为 服务器版（Linux Node.js + SQLite 自托管）。适用部署指南：
中文 · English

This release is the Linux server edition (self-hosted Node.js + SQLite).

跳转到 English

中文

新增功能

• 隐私模式（界面防窥）：三档强度 + 切换到后台自动遮挡 + 详情页逐项临时显示，密码库可在公共场合使用时降低被窥视的风险（界面级保护，非额外加密）。
• 自定义资料字段：账号类型支持自定义字段（字段名 + 类型 + 内容 + 排序，密码字段默认隐藏可复制），详情页按类型动态展示。
• 加密回收站：删除的条目进入加密回收站，可恢复或彻底清除。
• 本地全站搜索：在更多菜单中提供全站模糊搜索，解密后仅在浏览器内匹配。
• 密码生成器：随机强密码生成；空闲自动锁定 与 自动锁定时间设置。
• 密码历史 / 修改时间 与 最近查看 记录。
• 加密 TOTP 条目：账号类型支持加密的一次性验证码（TOTP）。
• 安全中心会话控制：查看并撤销其他会话；改用户名/改密码时自动撤销全部会话。
• 安全设备快速解锁：可选的安全设备快速解锁流程。
• 条目创建时间（created_at）：服务端记录条目创建时间，与既有更新时间并存。

修复与改进

• 自定义资料弹窗、分组排序/置顶补齐自定义资料 tab，长分组名单行省略。
• 移动端表单与弹窗布局全面梳理，账号凭证行拖拽手柄移到标题行右上角。
• 分组选中框在 iOS Safari 的裁切、详情退场动画卡顿、深色模式下的浅色底问题。
• 反代后按可信 CLIENT_IP_HEADER 隔离限流，防止全站登录 DoS。
• 部署健康门禁与回收站流程加固。

验证

• 完整自动化测试通过；Lint、TypeScript 类型检查、构建及生产资源检查通过。

安全

• 详细架构与安全模型见 README.md 与 SECURITY.md。
• 服务端只保存认证材料、被包装的 vault key、条目/附件元数据密文与附件密文对象，不接触主密码、vault key 或明文。

---

English

What's New

• Privacy mode (shoulder-surfing protection): three intensity levels + auto-hide when switching away + per-field temporary reveal in details.
• Custom fields for account records: editable custom fields (name/type/value/order, password fields hidden by default with reveal-on-click).
• Encrypted recycle bin: deleted entries go to an encrypted recycle bin; restore or purge.
• Local full-site search from the More menu; decrypted matches stay in the browser.
• Password generator and idle auto-lock with configurable lockout time.
• Password history / modified time and recently viewed.
• Encrypted TOTP entries.
• Security center session controls: view and revoke other sessions; password/username changes revoke all sessions.
• Secure device quick unlock.
• Entry creation time (created_at) recorded server-side.

Fixes & Improvements

• Custom-record dialogs, group ordering/pinning for the custom tab, and long-name ellipsis.
• Mobile form & dialog layout overhaul; account credential drag handle moved to the header.
• iOS Safari group-selection clipping, detail-exit animation jank, dark-mode contrast fixes.
• Trusted CLIENT_IP_HEADER rate limiting behind a reverse proxy to prevent site-wide login DoS.
• Hardened deployment health gate and recycle-bin flow.

Verification

• Full automated test suite passes; lint, type-check, build, and production-asset checks pass.

Security

• See README.md and SECURITY.md for architecture and security model.
• The server stores only auth material, the wrapped vault key, ciphertext metadata, and attachment ciphertext — never the master password, vault key, or plaintext.

v1.1.72 — 原子并发与附件补偿加固 / Atomic concurrency and attachment compensation hardening

v1.1.72 — 原子并发与附件补偿加固 / Atomic concurrency and attachment compensation hardening

中文 · English

中文

本 Release 对应 tag v1.1.72，包含分别面向 Cloudflare 与 Linux 的独立制品。它不会移动或覆盖历史 v1.1.71 tag 与资产。

一致性与可靠性

• 条目和附件新增服务端 revision CAS，过期写入返回冲突，避免并发页面静默覆盖新数据。
• 删除后保留 revision tombstone，避免旧页面在删除后重新创建已删除对象。
• Cloudflare D1 与 Linux SQLite 分别使用原子条件写入；Cloudflare迁移链新增 0014–0016。
• 备份导入锁增加续租、所有权校验和 fencing；成功及显式错误响应都会先释放锁再返回客户端。
• Linux附件删除使用持久化outbox；进程异常后可继续重试，避免数据库记录与文件对象长期分叉。

会话与附件安全

• 上传、重命名、删除与失败补偿均绑定操作开始时捕获的会话、CSRF、revision和vault key。
• 锁库或切换账户后的迟到响应不得写入新会话；跨账户补偿使用严格限权的旧会话端点。
• Cloudflare在R2写入后失锁、D1写入失败等路径执行精确补偿，并保持存储预留与pending删除账本一致。
• 密码库业务字段、附件metadata与内容仍为客户端加密；服务端revision不包含明文业务数据。

验证与生产状态

• 最终完整串行门禁：359/359通过，0失败、0跳过，自然exit 0。
• Lint、文档检查、TypeScript、Build、Node语法、public/与dist/一致性及三路独立审查通过。
• 发布候选完成串行门禁与双端独立审查；Cloudflare已应用0014–0016并100%切流；Linux已使用不可变版本目录原子部署。
• Cloudflare Chromium与Linux WebKit生产烟测均为7个检查点、0错误；临时账户、子记录及附件对象已精确清理。

升级建议

• 建议所有旧版本直接升级到v1.1.72；不要只复制前端文件而跳过后端和迁移。
• Cloudflare升级前同点备份D1/R2，保留bindings、routes、vars、Secrets和Cron，然后应用完整migration链至0016。
• Linux升级前一致性备份SQLite与附件目录，使用新的不可变版本目录和原子软链切换。
• 两端不共享在线账户、会话、数据库或附件，不会自动同步生产数据。
• 可选服务器辅助Passkey会改变默认零知识边界；主密码仍不上传，但服务器KEK与通过用户验证的Passkey流程可恢复vault key。请阅读部署文档中的完整披露。

下载与校验

VERSION=1.1.72
curl -fLO "https://github.com/17sho/pass-vault-v2/releases/download/v$VERSION/SHA256SUMS"
# 下载与部署目标匹配的tar.gz或zip后：
sha256sum -c SHA256SUMS

如果项目对你有帮助，欢迎点一个Star ⭐️。问题和改进建议可通过Issues提交；安全漏洞请使用GitHub Private Vulnerability Reporting私下报告。

English

This Release corresponds to tag v1.1.72 and provides separate artifacts for Cloudflare and Linux. It does not move or overwrite the historical v1.1.71 tag or assets.

Consistency and reliability

• Entries and attachments now use server-side revision CAS. Stale writes return conflicts instead of silently overwriting newer data.
• Revision tombstones survive deletion so an old page cannot recreate an object after it was deleted.
• Cloudflare D1 and Linux SQLite use atomic conditional writes; Cloudflare adds migrations 0014–0016.
• Backup-import locks now use renewal, ownership checks, and fencing. Success and explicit error responses release the lock before replying to the client.
• Linux attachment deletion uses a durable outbox so cleanup can resume after a process interruption.

Session and attachment security

• Upload, rename, delete, and failure compensation are bound to the initiating session, CSRF token, revision, and vault key.
• Late responses after lock or account switch cannot write through a new session. Cross-account cleanup uses a narrowly authorized endpoint tied to the old session.
• Cloudflare performs exact compensation after R2-write lock loss or D1 failure while keeping storage reservations and pending-deletion accounting consistent.
• Vault business fields, attachment metadata, and content remain client-encrypted. Server revisions do not contain plaintext business data.

Verification and production status

• Final serialized gate: 359/359 passed, 0 failed, 0 skipped, natural exit 0.
• Lint, documentation checks, TypeScript, build, Node syntax, public//dist/ parity, and three independent reviews passed.
• The release candidate completed its serialized gate and independent reviews for both runtimes. Cloudflare applied migrations 0014–0016 and shifted 100% traffic; Linux deployed through a new immutable version directory.
• Cloudflare Chromium and Linux WebKit production smoke tests each passed seven checkpoints with zero errors. Temporary principals, child rows, and attachment objects were removed exactly.

Upgrade guidance

• All earlier versions should upgrade directly to v1.1.72. Do not copy only frontend files while skipping backend code and migrations.
• Before Cloudflare upgrades, take a consistent D1/R2 backup, preserve bindings, routes, vars, Secrets, and Cron, then apply the complete migration chain through 0016.
• Before Linux upgrades, take a consistent SQLite and attachment-directory backup and switch through a new immutable release directory.
• The two runtimes do not share hosted accounts, sessions, databases, or attachments and do not synchronize production data automatically.
• Optional server-assisted Passkey changes the default zero-knowledge boundary. The master password is still never uploaded, but the server KEK plus a user-verified Passkey flow can recover the vault key. Read the full disclosure in the deployment guides.

Download and verify

VERSION=1.1.72
curl -fLO "https://github.com/17sho/pass-vault-v2/releases/download/v$VERSION/SHA256SUMS"
# After downloading the tar.gz or zip for your target:
sha256sum -c SHA256SUMS

If this project is useful, a Star ⭐️ is appreciated. Issues and improvements are welcome; report vulnerabilities through GitHub Private Vulnerability Reporting, not public disclosure.

v1.1.71 — 批量操作与会话边界热修 / Bulk actions and session-boundary hardening

v1.1.71 — 批量操作与会话边界热修 / Bulk actions and session-boundary hardening

中文 · English

中文

本 Release 说明对应仓库 tag v1.1.71 的稳定代码与双端制品。文档、依赖安全修复和仓库元数据的后续更新位于 main；不要把未打 tag 的 main 当作 v1.1.71 制品来源。

新功能

• 账号、网站、笔记、TOTP 与附件均支持在当前类型、分组、搜索结果和附件分类范围内批量设置分组。
• 同一选择范围内支持批量置顶、取消置顶和移入回收站；删除是加密软删除，不提前物理删除记录或附件对象。
• 同批删除使用统一 deletedAt。批量删除笔记时，仅联动软删除未被其他存活笔记共享的附件。

一致性与安全修复

• 后端没有跨记录事务，客户端采用顺序写入、逆序补偿；补偿失败后重新加载权威密文，重载也失败时明确要求锁定并重新登录。
• 批量设置分组、置顶、取消置顶、删除及其补偿，全部显式绑定操作开始时捕获的 vault key 与会话代际。
• 加密前和真正发送请求前都会重新验证原会话；等待期间锁库并登录另一个账户时，旧密码库密文不会借用新会话继续写入。
• 置顶、分组和回收站状态继续保存在客户端加密 payload/附件 metadata 中，不增加服务端明文字段。

架构说明

• Cloudflare 与 Linux 使用同一套 public/ 前端源码和 shared/ 密文契约，但分别打包、分别部署。
• Cloudflare 使用 Worker + D1 + R2；Linux 使用 Node.js + SQLite + 本地附件目录。
• 两端不共用在线前端实例、账户、会话、数据库或附件，也不会自动同步数据。

验证

• 完整项目测试：331/331 通过（文档与制品更新后的最终全量门禁）。
• 当前安全热修专项：批量分组与批量置顶/删除 13/13 通过，覆盖 Chromium、WebKit、320px、失败补偿，以及锁库后登录第二账户再释放旧写入。
• Lint、文档检查、TypeScript、Build、制品边界测试和 git diff --check 通过。
• Cloudflare/Linux 两个制品均提供 tar.gz、zip 与统一 SHA256SUMS；发布后无认证重新下载校验 4/4 OK。
• 发布时 Linux/Cloudflare 双端已部署并核对会话边界热修代码；生产测试数据已清理。

升级建议

• v1.1.69 和 v1.1.70 缺少完整的批量操作会话边界修复，建议直接升级到 v1.1.71。
• Cloudflare 升级前备份 D1/R2、保留完整 bindings/routes/vars/secrets/Cron，并确认 migration 链到 0013。
• Linux 升级前一致性备份 SQLite 与附件目录，使用原子版本目录发布。
• 不移动旧 tag，不用新制品覆盖旧版本；生产配置和秘密不进入仓库或压缩包。

下载与校验

VERSION=1.1.71
curl -fLO "https://github.com/17sho/pass-vault-v2/releases/download/v$VERSION/SHA256SUMS"
# 下载与部署目标匹配的 tar.gz 或 zip 后：
sha256sum -c SHA256SUMS

如果这个项目对你有帮助，欢迎点一个 Star ⭐️；问题和改进建议也欢迎通过 Issues 提交。安全漏洞请通过 GitHub Private Vulnerability Reporting 私下报告，不要公开披露。

English

This release note describes the stable code and dual-runtime artifacts for tag v1.1.71. Later documentation, dependency-security, and repository-metadata updates are on main; do not treat an untagged main commit as the v1.1.71 artifact source.

Features

• Accounts, websites, notes, TOTP, and attachments support bulk grouping within the current type, group, search-result, and attachment-category scope.
• The same selection scope supports bulk pin, unpin, and move-to-Trash. Deletion is encrypted soft deletion and does not prematurely remove records or attachment objects.
• One deletion batch uses one deletedAt. Deleting notes in bulk only soft-deletes attachments that are not shared by another live note.

Consistency and security fixes

• Because the backends do not provide a transaction spanning records, the client writes sequentially and compensates in reverse order. If compensation fails, it reloads authoritative ciphertext; if reload also fails, it explicitly requires lock and reauthentication.
• Bulk grouping, pinning, unpinning, deletion, and all compensation writes are explicitly bound to the vault key and session generation captured when the operation starts.
• The originating session is checked before encryption and immediately before the request. If the vault is locked and another account signs in while an operation is waiting, old-vault ciphertext cannot continue through the new session.
• Pin, group, and Trash state remain inside client-encrypted record payloads or attachment metadata; no new server-visible business fields are added.

Architecture clarification

• Cloudflare and Linux use the same public/ frontend source and shared/ ciphertext contract, but they are packaged and deployed separately.
• Cloudflare uses Worker + D1 + R2; Linux uses Node.js + SQLite + a local attachment directory.
• They do not share a hosted frontend instance, accounts, sessions, databases, or attachments, and production data does not synchronize automatically.

Verification

• Full project gate: 331/331 tests passed after the documentation and artifact update.
• Current security-hotfix suites: 13/13 bulk-group and bulk pin/delete tests passed, covering Chromium, WebKit, 320px, failed-write compensation, and lock → second-account sign-in → stale-write release races.
• Lint, documentation checks, TypeScript, build, artifact-boundary tests, and git diff --check passed.
• Separate Cloudflare/Linux tar.gz and zip artifacts are published with one SHA256SUMS; unauthenticated post-publication downloads verified 4/4 OK.
• At publication time, both production targets were deployed and checked for the session-boundary fix, and production smoke data was removed.

Upgrade guidance

• v1.1.69 and v1.1.70 do not contain the complete bulk-operation session-boundary fix. Upgrade directly to v1.1.71.
• Before Cloudflare upgrades, back up D1/R2, preserve all bindings/routes/vars/secrets/Cron, and confirm migrations through 0013.
• Before Linux upgrades, take a consistent SQLite and attachment backup and use an atomic version-directory deployment.
• Never move old tags or overwrite old-version artifacts; production configuration and secrets must remain outside the repository and archives.

Download and verify

VERSION=1.1.71
curl -fLO "https://github.com/17sho/pass-vault-v2/releases/download/v$VERSION/SHA256SUMS"
# After downloading the tar.gz or zip for your target:
sha256sum -c SHA256SUMS

If this project is useful, a Star ⭐️ is appreciated. Issues and improvements are welcome; report vulnerabilities through GitHub Private Vulnerability Reporting, not public disclosure.

v1.1.70 — 批量写入会话边界热修

v1.1.70 — 批量写入会话边界热修 / Bulk-write session boundary hotfix

中文 · English

中文

安全修复

• 批量置顶、取消置顶、批量删除及其补偿写入现在绑定操作开始时捕获的密码库密钥和会话代际。
• 每次写入会在加密前以及网络请求发出前重新验证会话；若用户在操作等待期间锁库并登录另一账户，旧库密文不会被发送到新会话。

验证

• 新增“批量操作等待 → 锁库 → 登录第二账户 → 恢复旧操作”的竞态回归测试。
• Chromium 与 WebKit 均验证 320px 批量操作栏无横向溢出，所有操作按钮触控高度至少 44px。

升级

建议所有 v1.1.69 部署升级到 v1.1.70。v1.1.69 标签和制品保持不变。

English

Security fix

• Bulk pin, unpin, soft-delete, and compensation writes now remain bound to the vault key and session generation captured when the operation starts.
• Every write revalidates that session both before encryption and immediately before issuing the network request. If the vault is locked and another account signs in while an operation is waiting, ciphertext from the old vault is not sent to the new session.

Verification

• Added a regression test for: pending bulk operation → lock vault → sign in to a second account → release the old operation.
• Verified the bulk action bar in Chromium and WebKit at 320px with no horizontal overflow and touch targets of at least 44px.

Upgrade

All v1.1.69 deployments should upgrade to v1.1.70. The existing v1.1.69 tag and artifacts remain unchanged.