GVault 0.1.14

What's Changed

• Keep the production Web/API wrapper inside the same bounded request error boundary as the standalone API server.
• Return malformed/oversized JSON errors as 400/413 without terminating gvault-public.service.
• Add direct regression coverage for the deployed scripts/dev/serve-public.mjs entrypoint.

Validation: strict RED/GREEN, 175/175 tests, server smoke 1/1, npm audit 0 vulnerabilities, and CodeRabbit review with 0 issues.

Full Changelog: v0.1.13...v0.1.14

GVault 0.1.13

What's Changed

• Bound declared and streamed JSON API request bodies with explicit 400 and 413 responses.
• Added independent per-account and per-source authentication throttles before synchronous password hashing.
• Added explicit trusted-proxy handling, bounded limiter state, hardened proxy/deployment guidance, and audit-safe source evidence.

Validation: strict TDD, 173/173 tests, server smoke 1/1, npm audit 0 vulnerabilities, independent CodeRabbit review with 0 remaining findings.

Full Changelog: v0.1.12...v0.1.13

GVault 0.1.12

What's Changed

• Session expiry, revocation, and logout by @guberm in #504

Full Changelog: v0.1.11...v0.1.12

GVault 0.1.11

Zero-knowledge account-password recovery for Web and Android.

• Master password and recovery private key remain client-side.
• Server stores only the public verifier and master-protected encrypted envelope.
• One-time expiring challenges, proof verification, rate limits, redacted audit events, and mandatory recovery-key rotation.
• Existing accounts require explicit authenticated enrollment.
• Regular login continues to require only email and account password; the master password is used for registration, vault unlock/restore, and account recovery.

Validation: independent Reviewer APPROVED; repository gate 145/145 + server smoke 1/1; production Web recovery E2E PASS. Physical Pixel 7 Pro acceptance uses the exact attached APK.

GVault 0.1.10

Account and vault-password separation release.

• Regular Web and Android login uses only email and the server account password.
• Registration requires a confirmed master password without sending it to the server.
• Vault unlock/restore is a separate client-side step after login.
• Restore candidates are authenticated against all ciphertext, including deleted tombstones, before decrypted state or Autofill becomes available.
• Web restore is pull-only until the candidate key is authenticated.
• Browser-extension/desktop/Linux future account flows must follow the same documented contract.
• Secure account-password recovery remains tracked by #501.

Validation: 138/138 repository tests, server smoke 1/1, independent Reviewer approval, production Web browser acceptance, and full Pixel 7 Pro Android 17/API 37 device acceptance.

PR: #502

GVault 0.1.9

Android security and compatibility hotfix.

• Encrypts the Android Autofill cache with Android Keystore AES-GCM.
• Adds a 15-minute explicit Autofill unlock grant and restart/sign-out/expiry cleanup.
• Enforces the shared 12-character Android master-password minimum.
• Emits canonical Android Login fields with monotonic timestamps.

Validated with 10/10 Android-focused tests and physical Pixel 7 Pro acceptance against https://gvault.guber.dev. The APK is a signed preview build using the documented public GVault preview key; production deployments should rebuild with a private production keystore.

GVault 0.1.8

GVault 0.1.8 aligns the web vault with the provided dashboard reference.

Highlights:

• Rebuilt the web vault dashboard around the reference structure: light sidebar, top server/account/sync bar, item list pane, detail panel, generator card, edit form, create card, and bottom health strip.
• Kept unlock, create item, password generation, sync, search, and theme toggle flows working in the new layout.
• Updated e2e selectors for the new reference-aligned UI.

Validation:

• Passed: npm run e2e:all -- -AndroidSerial 29221FDH300MLF
• Rendered dashboard screenshot checked locally against the provided reference.
• Docker runtime smoke skipped because Docker CLI is not installed on the build machine.

GVault 0.1.7

GVault 0.1.7 adds light/dark mode controls across client surfaces.

Highlights:

• Web vault light/dark toggle with local persistence.
• Admin client light/dark toggle.
• Browser extension popup/options light/dark toggle shared through chrome.storage.sync.
• Windows desktop client light/dark toggle persisted under user AppData.
• Android client light/dark toggle persisted through SharedPreferences.
• E2E assertions added for web, extension popup, and Android theme controls.

Validation:

• Passed: npm run e2e:all -- -AndroidSerial 29221FDH300MLF
• Docker runtime smoke skipped because Docker CLI is not installed on the build machine.

GVault 0.1.6

GVault 0.1.6 adds autofill service plumbing for Android and browser extensions.

Highlights:

• Android AutofillService registered in the APK with login-field detection and GVault dataset entry.
• Browser extension service worker now routes active-tab fill requests and supports session-only per-site autofill.
• Browser content script now reports form context and uses native input setters with input/change events.
• Android device e2e now verifies the installed package includes GVaultAutofillService.

Validation:

• Passed: npm run e2e:all -- -AndroidSerial 29221FDH300MLF
• Docker runtime smoke skipped because Docker CLI is not installed on the build machine.

GVault 0.1.5

GVault 0.1.5 focuses on client UI readiness and end-to-end platform validation.

Highlights:

• Rebuilt the web vault into a real end-user shell with lock/unlock, server connection, fast search, categories, item list, detail panel, multi-type editor, password generator, and encrypted sync status.
• Updated Chrome/Firefox/Edge extension popup UI for manual autofill, detected form status, and self-hosted server URL storage.
• Updated Windows desktop and Android client preview UIs with clearer product status and web vault entry points.
• Added stronger e2e coverage across web, Chrome, Edge, Windows, Linux via WSL, Firefox lint, and physical Android device.

Validation:

• Passed: npm run e2e:all -- -AndroidSerial 29221FDH300MLF
• Docker runtime smoke skipped because Docker CLI is not installed on the build machine.