Husk v0.1.2 — Popup windows + quieter vault prompt

Patch release on top of v0.1.1. Two UX fixes around the login flow: OAuth popups now behave like real popups, and the "save password to vault" prompt no longer hijacks the sidebar.

Downloads

File	Size	SHA-256
Husk-Portable-0.1.2.zip	1.8 MB	af98e0172bf0478ca799945666ea1a8101cde9bbb63289c11ce963af60b760e2
husk.exe (raw, for inspection)	4.0 MB	450de3bbf79f7b439795fe8a4217d70c6a8d65200dd7713d55a309e6e92c49b7

Verify before running

Get-FileHash .\Husk-Portable-0.1.2.zip -Algorithm SHA256

Match the output against the hash above. If it differs — do not run.

What's new

OAuth popups open as real popup windows

"Sign in with Google / Microsoft / GitHub / Apple" used to land in a new TAB inside the current window. The login form was there, the auth completed, the tab closed (since v0.1.1) — but the visual experience was wrong: an OAuth flow is supposed to feel like a transient dialog, not "your browser is now hosting two tabs."

v0.1.2 routes window.open(url, _, "width=X,height=Y,...") — the universal popup pattern — to a new Husk window sized to the requested dimensions (with a sane 320×240 minimum), inheriting the parent tab's mode (Normal / Private / Paranoia). When the auth flow calls window.close(), the whole popup window disappears and you're back on the parent page.

Implementation: native add_NewWindowRequested hook reads WindowFeatures.HasSize / HasPosition. With a hint, popup window. Without, fall through to the v0.1.0 behaviour (new tab). Middle-click and target="_blank" on regular links still open as tabs.

Vault save prompt no longer auto-opens the sidebar

When you submitted a login form, Husk would offer to save the credentials to your vault. In v0.1.1 this was an in-place toast at the top of the chrome IF the vault was already unlocked — but if the vault was locked (or you hadn't set one up yet), the sidebar would automatically expand to show the unlock prompt. On a banking, mail, or work-tool login that you didn't want to save, the sidebar expansion felt like Husk was reaching into a private surface uninvited.

v0.1.2 keeps the offer as a thin horizontal toast in all states. The toast wording adapts ("Save", "Vault is locked — Open vault", "Set up your Husk vault to save this"). The sidebar opens only if you explicitly click "Save" or "Open vault" on the toast — or if it was already open at the time of the form submit.

OAuth credentials are never offered for save

Related: credentials entered into an OAuth popup window are not offered for save in your vault at all. The credential belongs to Google / Microsoft / etc., not the parent site, so saving it would be confusing at best and dangerous at worst.

Everything else

Unchanged from v0.1.1 — same Argon2id + ChaCha20-Poly1305 vault, same DoH proxy, same anti-fingerprint stack, same boss key, same crypto source at husk-crypto.

Upgrade path

Drop the new husk.exe into your existing portable folder, replacing the old one. Your HuskData/ directory stays untouched.

Known limitations carried over

• Taskbar pin AUMID identity is still consolidated by Windows Shell in development setups where multiple husk.exe binaries live on the same machine. Affects users running both a dev tree and the portable release — i.e. nobody who only downloaded the public binary. Investigation continues.
• macOS + Linux still v0.2 targets.

Coming next

• Chromeless OAuth popup option (currently popups carry the full Husk chrome — fine for security, but mainstream browsers go minimal)
• Mac and Linux work begins after this patch ships
• A --profile=<name> argument for users who want a non-default startup profile from a desktop shortcut

---

If Husk is useful to you, support keeps it free, ad-free and account-free: husk.run/donate.