v0.1.4

What's new

Deep linking + desktop

• nopass:// URL scheme registered — the extension's "Open app" button and the web Devices page link open the desktop app directly
• Structured (tracing) logging in the desktop app via RUST_LOG

Observability

• API request IDs: every request gets a UUID in x-request-id (response header + tracing span); correlated across log lines
• JSON log format when LOG_FORMAT=json — now active in production
• tower_http request/response logging included in default filter

Extension

• Security: GET_CREDENTIALS (plaintext passwords) now restricted to the popup only — extension pages hosted in a browser tab can search/read items but cannot receive decrypted credentials
• Session persistence: unlocked vault survives MV3 service worker teardown via chrome.storage.session; auto-locks if the server rejects the token on restart
• "Remember me": last email pre-filled in the unlock form (extension + web)
• Scroll performance: autofill button repositions via requestAnimationFrame instead of forcing layout reflow on every scroll event
• Design system alignment: dark popup with Martian Mono / IBM Plex Sans, nopass:// "Open app" button

Desktop

• Touch ID unlock via LocalAuthentication (real biometric prompt — was a stub)
• Session persistence: unlocked vault survives Tauri reload via plugin-sql / keychain flow

Bug fixes

• Session restore failure now logged at error level (was warn, silenced in prod builds)
• Clippy: unit-struct default, redundant closure, is_multiple_of, too_many_arguments allowances in API crate

nopwd v0.1.2

First production release — live at https://nopwd.dev (API: https://api.nopwd.dev).

Changes since v0.1.0: production deployment (Kubernetes manifests, GHCR images, CIDR-aware trusted proxies), CLI nopwd recover + multi-vault support, passkey badges in the extension popup, production CSP hydration fix.

Attached: nopwd-extension.zip — Chrome extension built against the production API. Load via chrome://extensions → Developer mode, or wait for the Web Store listing.

nopwd v0.1.0

First feature-complete release of nopwd — a zero-knowledge password manager for individuals.

Vault: logins, secure notes, cards, identities, SSH keys — all encrypted on-device (Argon2id → AES-256-GCM, SRP-6a auth; the server stores only ciphertext).

Highlights

• Passkeys — the browser extension is a full WebAuthn authenticator; passkeys sync inside your encrypted vault (attached zip; conformance-tested against a real relying-party library)
• Offline recovery kit — a one-time code that can restore your vault without weakening zero-knowledge
• One-time sharing — expiring links whose decryption key never reaches the server
• TOTP, HaveIBeenPwned breach auditing, encrypted tags, favorites
• Multiple vaults, item moves, lossless 1Password import
• Trusted devices + account activity log
• Web app, CLI (nopwd run, --via-socket, nopwd:// env refs), Tauri desktop with biometrics + SSH agent

Attached: nopwd-extension.zip — Chrome extension built against api.nopwd.dev (sha256 4f678eb79beea20fda41…). Load via chrome://extensions → Developer mode → drag the zip, or wait for the Web Store listing.

Deployment runbook: DEPLOY.md.