Clavyn v0.1.2-alpha.2

What's new

Vault reset with passphrase-gated authorization (#25)

Adds the ability to permanently reset (destroy) the encrypted vault and start fresh with a new passphrase. This is a destructive, defense-in-depth operation gated behind passphrase verification — a wrong passphrase never destroys stored keys.

• Danger Zone UI — Unlocked vault view shows a "Danger Zone" card with a "Reset Vault" button. Clicking it reveals a confirmation form with a strong warning and a passphrase input; the destructive confirmation button enables only once a passphrase is entered. On success the UI transitions to the setup screen; on failure the error stays local to the confirmation form for retry.
• Authorization gate — secure_reset_vault verifies the current master passphrase against the vault payload before any destructive action. A wrong passphrase returns an error and the vault remains intact.
• Authoritative biometric cleanup — The vault-bound biometric Keychain credential is deleted before the vault binding id is destroyed. If deletion fails, reset aborts with the vault intact so cleanup can be retried safely.
• Cross-build macOS tracking — Biometric enrollment writes a durable, non-secret vault-binding marker. If a later build can no longer see a tracked Data Protection Keychain item because its code-signing access group changed, reset/disable fail closed instead of treating errSecItemNotFound as proof the credential is gone. Untracked legacy vaults transition directly to Pending without an intermediate Clear write, so a scope-probe failure leaves the vault untracked (Unknown) and disable fails closed rather than skipping Keychain deletion.
• Credential/reset serialization — Backend biometric enable/disable and vault reset share a mutation mutex, preventing direct IPC callers from recreating the old vault-bound credential between cleanup and destruction.
• Auth generation invalidation — After the vault file is destroyed, the auth generation is advanced before acquiring the passphrase mutex, so an in-flight unlock or biometric request that started before reset cannot commit its passphrase afterward.
• Crash-leftover cleanup + durability — Reset removes both vault.json.tmp and vault.json, deleting the temporary copy first. On Unix the containing directory is synced before success is reported so the unlink survives a crash/power loss.
• Frontend state fails closed — After reset, initialized=false, unlocked=false, biometricEnabled=false, and cached SSH-key metadata is cleared so host/identity forms cannot retain key IDs that no longer exist.

Fail closed when persisted state cannot be parsed (#20)

Persisted app state that fails to parse now fails closed rather than silently falling back to defaults, preventing a corrupt state file from masking a real configuration problem.

Write state files atomically and owner-only (#21)

State files are now written atomically (temp file + rename) with owner-only permissions, preventing partial writes and avoiding world-readable state on shared systems.

Track Cargo.lock and audit dependencies in CI (#23)

Cargo.lock is now committed and dependency auditing runs in CI, keeping Rust dependency versions reproducible and surfacing advisories automatically.

Full changelog

v0.1.2-alpha.1...v0.1.2-alpha.2