LocalPass v0.2.1

What's Changed

• fix(deps): clear the desktop's Dependabot alerts by @RMV-Coder in #63
• fix: lock on GUI close, keep the MCP server alive, show agent activity by @RMV-Coder in #64
• chore(gui): release v0.2.1 by @RMV-Coder in #65

Full Changelog: desktop-v0.2.0...desktop-v0.2.1

LocalPass v0.2.0

What's Changed

• Sync with a nearby device: direct LAN transport (spec, core, daemon, CLI) by @RMV-Coder in #55
• Sync with a nearby device: desktop Devices screen + Android in-process backend by @RMV-Coder in #56
• Windows code signing through SignPath Foundation by @RMV-Coder in #49
• docs: 1.0 release checklist review (2026-10-22) by @RMV-Coder in #51
• Sync by QR code: offline transport over an animated QR stream (spec, core, daemon, CLI, GUI) by @RMV-Coder in #57
• Explain why a vault share was not received, and guide sharing by @RMV-Coder in #54
• ci(deny): make cargo-deny pass for the desktop workspace and check it in CI by @RMV-Coder in #53
• chore(gui): release v0.2.0 by @RMV-Coder in #58

Full Changelog: desktop-v0.1.5...desktop-v0.2.0

LocalPass v0.1.5

What's Changed

• feat(gui): navigation, list and detail polish; fix Dev screen effect loop by @RMV-Coder in #39
• fix(autofill): no https→http downgrade; treat shared-hosting suffixes as public by @RMV-Coder in #41
• fix(gui): keep copied secrets out of clipboard history and clear them by @RMV-Coder in #42
• fix(sync): sign vault-key shares and accept them only from pinned peers by @RMV-Coder in #43
• fix(native-host): require an explicit Firefox extension id by @RMV-Coder in #44
• fix(mcp): mask notes, redact encoded echoes, keep run_with_secrets children from driving LocalPass by @RMV-Coder in #40
• docs: refresh the MVP scorecard and add a 1.0 release checklist by @RMV-Coder in #45
• feat(daemon): require the master password for consent and changes while an AI agent is connected by @RMV-Coder in #46
• fix(deps): clear new cargo-deny advisories (zip 9, accept basic-toml) by @RMV-Coder in #48
• GUI redesign: one mark, design system, click-to-copy, Windows Hello, signed updates by @RMV-Coder in #47
• README: app screenshots by @RMV-Coder in #50
• chore(gui): release v0.1.5 by @RMV-Coder in #52

Full Changelog: desktop-v0.1.4...desktop-v0.1.5

LocalPass v0.1.4

What's Changed

• chore: pin the Rust toolchain to 1.98.0 by @RMV-Coder in #34
• ci: enforce the declared MSRV by @RMV-Coder in #35
• docs: specify agent-triggered autofill (fill_login) by @RMV-Coder in #36
• feat: agent-triggered autofill (fill_login) without the credential in the transcript by @RMV-Coder in #37
• chore(gui): release v0.1.4 by @RMV-Coder in #38

Full Changelog: desktop-v0.1.3...desktop-v0.1.4

LocalPass v0.1.3

What's Changed

• fix(cli): strip LOCALPASS_PASSWORD from child envs; mask empty secrets by @RMV-Coder in #31
• feat: Dev tab - CLI/MCP guides, activity log, and keep-alive auto-lock by @RMV-Coder in #32
• chore(gui): release v0.1.3 by @RMV-Coder in #33

Full Changelog: desktop-v0.1.2...desktop-v0.1.3

LocalPass v0.1.2

What's Changed

• feat: trash restore path (CLI item trash list/untrash + GUI Trash section) by @RMV-Coder in #26
• chore(gui): release v0.1.2 by @RMV-Coder in #30

Full Changelog: desktop-v0.1.1...desktop-v0.1.2

LocalPass v0.1.1

What's Changed

• fix: return to the unlock screen automatically on idle auto-lock by @RMV-Coder in #28
• chore(gui): release v0.1.1 by @RMV-Coder in #29

Full Changelog: desktop-v0.1.0...desktop-v0.1.1

LocalPass v0.1.0

What's Changed

• feat(gui): add a Help / quick-guide tab by @RMV-Coder in #3
• docs: Android port architecture & setup plan by @RMV-Coder in #5
• feat: offline password-health audit ("Watchtower") — CLI + GUI by @RMV-Coder in #4
• fix(cli): resolve PATHEXT so run -- npm works on Windows by @RMV-Coder in #6
• feat(mobile): in-process vault backend for Android (no daemon) by @RMV-Coder in #7
• feat(android): drop daemon sidecar on Android; runs on device by @RMV-Coder in #8
• feat(gui): responsive mobile layout, vault deletion, unified icon by @RMV-Coder in #9
• refactor(sync): abstract channel I/O behind a Store trait (mobile-sync groundwork) by @RMV-Coder in #10
• docs(spec): device pairing — QR transport, pairing mode, channel announce by @RMV-Coder in #11
• feat(gui): show this device's identity as a pairing QR by @RMV-Coder in #12
• refactor(sync): inject the channel backend via a StoreFactory by @RMV-Coder in #14
• feat(mobile): scan a peer's pairing QR to fill the identity box by @RMV-Coder in #15
• feat(mobile): sync to a user-picked folder via Android SAF by @RMV-Coder in #16
• feat(gui): scan a peer's pairing QR with the desktop webcam by @RMV-Coder in #17
• fix(gui): clear svelte-check type errors and a11y warnings by @RMV-Coder in #18
• feat(pairing): time-boxed pairing mode gates new device trust by @RMV-Coder in #19
• feat(pairing): channel-announce — discover peers via the shared folder by @RMV-Coder in #20
• test(daemon): cover channel-announce write-on-setup + mutual discovery by @RMV-Coder in #21
• feat(porter): real KeePass KDBX 4 import (AES-256 / Argon2) by @RMV-Coder in #22
• feat(extension): MV3 browser extension for autofill (fill-scoped) by @RMV-Coder in #23
• fix(gui): pad the inline new-vault form and wrap long field names by @RMV-Coder in #24
• feat(cli): localpass mcp - MCP stdio server that never returns secrets by @RMV-Coder in #25
• chore(gui): auto-bump the app version on every bundle build by @RMV-Coder in #27

Full Changelog: v0.1.0...desktop-v0.1.0

LocalPass v0.1.0 (MVP preview)

LocalPass is a fully local, open-source password & secrets manager with a developer focus — .env secrets, API keys, SSH keys, TOTP, and sync across your own machines with no cloud.

⚠️ Pre-1.0 — do not store real secrets yet. This is the first tagged milestone (MVP). It is not independently audited and the on-disk format may still change before 1.0. Use it for evaluation only. There is no cloud reset: losing your master password, Secret Key, and devices means the data is gone by design.

Highlights

• Local-only, encrypted at rest — XChaCha20-Poly1305 under a key hierarchy rooted in your master password and a locally generated 128-bit Secret Key, so a stolen vault file can't be brute-forced offline. Every ciphertext is bound to its exact vault/item/version (no cut-and-paste), and every change is a signed, hash-chained operation.
• Desktop app (Tauri + Svelte) — create your account, browse/search, item CRUD, reveal/copy, live TOTP, password/passphrase generator, .env secure documents, encrypted file attachments, and device linking + sync. The app bundles the daemon and starts it automatically.
• CLI (localpass) — init/vault/item/search/generate, run/env secret injection into dev servers, totp, ssh (vault-backed SSH agent), backup, import/export, sync, device, kit.
• Vault-backed SSH agent — serves your stored SSH keys on the OpenSSH-compatible endpoint; keys never leave the daemon.
• Sync across your own devices — signed op-log with deterministic merge, file-based shipping, cross-device key sharing, and content-addressed encrypted attachment blobs. (Live LAN/mDNS transport is a documented follow-up.)
• Cross-platform — CI green on Windows, Linux, and macOS.

Install (Windows)

Download LocalPass_0.1.0_x64-setup.exe (NSIS) or the .msi below and run it. The daemon ships inside the installer and auto-starts — nothing else to set up.

The installer is unsigned (pre-1.0), so Windows SmartScreen shows an "unrecognized app" prompt → More info → Run anyway.

Other platforms / from source: see the README — cd apps/desktop && npm run bundle produces the installer for your OS.

Verify the download (SHA-256)

Because the installer is unsigned, verify its checksum against SHA256SUMS.txt before running (Get-FileHash .\LocalPass_0.1.0_x64-setup.exe):

79f69e92784d5d3df45de7d1b913000686eb64c412b9118b3a77314ca85bcbd1  LocalPass_0.1.0_x64-setup.exe
8a2511c70b2da660b25fae45621542681035a93cc52684494e6666175a3bacd4  LocalPass_0.1.0_x64_en-US.msi

Notable fixes since the MVP

• Cross-platform daemon transport (macOS getpeereid, per-username Unix socket, Linux stop-race handling).
• Forward-only migration for vaults created before attachment sync (created_at column).
• GUI: live vault-count refresh, and editing an env-set now loads its existing variables instead of silently replacing them.

Security

See SECURITY.md for the threat model and disclosure process. Again: not yet audited — don't put real secrets in it.

🤖 Release notes generated with Claude Code