perf: locking never blocks on argon2; feat: add-code dialog, brand icons, NUL-safe TOTP keys

[pyramation]

Summary

Lock felt sluggish (spinning cursor) because every save() — including the one inside lock() and every 2s autosave — re-ran Argon2id at the moderate profile (256 MiB, 3 passes) on the main process, blocking the event loop for seconds.

Vault now derives the snapshot key once at open and reuses it, so a save costs only gzip + one AEAD pass:

// packages/core: KDF split out of encrypt()
const derived = deriveEnvelopeKey(passphrase, kdf);   // argon2id, once
encryptWithDerivedKey(tarball, derived);               // per save

The envelope is byte-compatible — the header still carries that salt and the cost params, so decrypt(envelope, passphrase) is unchanged. The salt is reused across saves of the same file (same secret either way); each envelope still gets a fresh random 24-byte nonce. Vault no longer retains the passphrase at all, only the derived key, which is zeroed on lock; changePassphrase re-derives.

totp:list crashed with null character not permitted for any secret whose decoded key contains a 0x00 byte (~1 in 16 real secrets). The vendored @pgpm/totp decoded through base32.decode, which assembles its result with chr(byte) and returns text — and Postgres text cannot hold a NUL. Vendors the binary-safe totp.base32_to_hex that already exists on constructive-db@main (emits hex per byte, never materialising the key as text); these copies drop back to the published module once it ships, since npm's @pgpm/totp@0.36.0 predates that fix. Covered by a vault test that generates a code for an all-zero key.

Also:

• VaultService.lock() clears this.vault synchronously and tracks the in-flight flush, so unlock() awaits it rather than racing; the renderer switches to the unlock screen immediately instead of awaiting the IPC round-trip.
• Adding a TOTP was only possible via URI/JSON import. The Codes tab gains an "Add code" dialog: name + base32 secret, with digits/period fields for non-default services.
• Brand icons on the vault list, code cards and item detail. Full-colour logos come from svgl (MIT), vendored at build time by scripts/vendor-svgl.mjs into src/main/svgl-icons.json, falling back to simple-icons monochrome glyphs and then a monogram. Both sets are bundled: nothing is fetched at runtime, so the app never reveals to a third party which services you hold accounts with. Lookup lives in the main process behind one batched IPC call, keeping ~4,000 icons out of the renderer bundle (unchanged at 1.37 MB); matching normalizes titles, so GitHub (alice@example.com) and github.com both resolve.

Link to Devin session: https://app.devin.ai/sessions/04636534e07048089ffb6b78142e12cd
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	simple-icons@​16.26.0

View full report