Release v0.6.0

Security

• Daemon now runs as a dedicated immurok system user in a sandboxed systemd unit. No more $HOME paths; PAM socket moved to /run/immurok/pam.sock.
• Per-command authorization tiers replace the old same-uid check. AUTH only from root/polkitd, management commands require an active local session, rejections return DENY:NOT_AUTHORIZED.
• Owner uid is persisted and checked on every AUTH, so another account's sudo can't be approved by your touch.
• PAM helper installs to /usr/local/bin instead of a user-writable directory.

New

• immurok-session-agent: user-session process for dialogs, notifications and ~/.ssh/config. Holds no keys.
• CLI/TUI read key cache and logs over the socket (KEY:CACHE, SUBSCRIBE:LOG).
• settings and the TUI show whether the daemon is isolated.
• Packaging: system unit, tmpfiles.d, BlueZ D-Bus policy, polkit rule, install/migrate/purge scripts.

Fixed

• Factory-reset device no longer fails silently while the UI says "Paired: Yes". NOT_PAIRED from the device is now honored with a notification and status flag.
• pair no longer refuses with "Already paired" when the device denies the pairing.
• Daemon waits for the BLE helper before sending commands; a session that never exchanged a byte could report itself verified.
• Socket bind failure exits non-zero so systemd restarts the daemon.
• Screen-lock detection rewritten on logind LockedHint; touch-to-unlock works under the system daemon.
• PAM connect() capped at 2 s.
• TUI: Hosts panel marks this machine, explicit slot selection for unpair, enroll can pick auth or switch fingerprint, no black screen at startup.

Verified on Arch, Fedora 44 (SELinux Enforcing), Ubuntu 24.04.

Release v0.5.0

Major update!

Two-host support — pair one device with two computers and switch between them with a fingerprint.

Added

• Register a second host with fingerprint + device button (two-step, no shared secret to type).
• Switch fingerprint (slot 5) hands the device to the other host — each slot advertises its own BLE identity.
• Cross-slot unpair clears the other host and rotates that slot's BLE address so it won't auto-reconnect.
• TUI Hosts panel (H menu) and slot CLI commands — status, per-slot unpair, and a separate whole-device factory-reset.

Fixed

• unpair no longer deadlocks when parked on an unpaired slot; misleading wording corrected.
• Pairing progress hardened; no more startup black screen; Hosts panel survives transient BLE hiccups.
• TUI aligned with the CLI (u confirms, pairing matches exactly).

Release v0.4.0

Added — SSH takeover toggle: daemon-managed sentinel block in ~/.ssh/config (Host * / IdentityAgent $XDG_RUNTIME_DIR/immurok/agent.sock), atomic 0600 rewrite, preserves user content, persisted + reconciled at startup; h in the TUI Unlock panel or SET:SSH_TAKEOVER:1|0.

Fixed —

• Ctrl+C cancels the fingerprint wait for sudo/ssh/git (PAM via signalfd folded into the select() loop rather than a sigaction handler in a dlopen'd module; SSH agent watches the client socket for disconnect)
• gate release on cancel goes through auth_dialog_cancel instead of the queued GATE_CANCEL that was stuck behind the parked BLE worker
• gdm-password returns PAM_IGNORE so a typed password isn't stalled up to 40 s
• PAM module installed via temp file + mv -f so it never overwrites a mapped .so in place
• agent authorization dialog word-wraps long commands (5 lines, 560 px, 300-char truncate)

Changed — TUI SSH toggle applies immediately with a non-blocking note instead of a y/n confirm dialog.

Release v0.3.1

Fix the bug of preventing system from sleep.

Release v0.3.0

Full Changelog: 0.2.0...0.3.0

• Add firmware upgrade functionality
• Remove sound setup

Release v0.2.0

Full Changelog: https://github.com/immurok/app-linux-rs/commits/0.2.0