Vault

.github/workflows/ci.yml

@@ -0,0 +1,45 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+      - master
+      - develop
+  workflow_dispatch:
+
+jobs:
+  vault-crypto-known-answer:
+    name: Vault crypto known-answer (${{ matrix.platform }})
+    strategy:
+      fail-fast: false
+      matrix:
+        platform: [ubuntu-22.04, windows-latest, macos-latest]
+    runs-on: ${{ matrix.platform }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install dependencies (Ubuntu)
+        if: matrix.platform == 'ubuntu-22.04'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libssl-dev
+
+      - name: Rust setup
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Rust cache
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: src-tauri
+
+      - name: Run vault crypto known-answer tests
+        working-directory: src-tauri
+        env:
+          # Required only because sync commands compile with env!("GOOGLE_CLIENT_ID").
+          # The vault crypto known-answer tests do not use Google OAuth.
+          GOOGLE_CLIENT_ID: ci-known-answer-test-client-id
+        run: cargo test known_answer

.github/workflows/release.yml

@@ -53,6 +53,7 @@ jobs:
         uses: tauri-apps/tauri-action@v0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GOOGLE_CLIENT_ID: ${{ secrets.GOOGLE_CLIENT_ID }}
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
         with:
@@ -123,4 +124,4 @@ jobs:
           git config user.email "actions@github.com"
           git add .
           git commit -m "APT repo update: ${{ github.ref_name }}"
-          git push
+          git push

CHANGELOG.md

@@ -4,6 +4,21 @@ All notable changes to Zync are documented in this file. The format is based on
 
 ## [Unreleased]
 
+### Added
+- **Global Vault Workspace**: Introduced Vault as a first-class sidebar/workspace surface with profile-based navigation for Local Vault and Google Vault Sync. Added dedicated vault workspace UI, unlock/recovery flows, and vault-focused panels. ([6e8dd42], [d9d3663])
+- **Vault Core Backend Foundation**: Added backend vault modules for crypto, schema, storage, lifecycle commands, and migration scaffolding to support encrypted credential storage and recovery workflows. ([6e8dd42])
+- **Google Drive Vault Sync Module**: Added sync command module and IPC surface for connect/disconnect/backup/restore flows dedicated to vault data sync. ([8cdb20d])
+- **Vault Credential Identity Model**: Added durable `credentialId`-based vault credential identity, key-first credential creation/assignment flows, self-healing auth-ref relinking/backfill, and dedicated docs for future rotation/history work. ([1d865ed], [bdbd81b], [bf01457])
+
+### Changed
+- **Settings Information Architecture**: Removed Vault from Settings navigation; vault management now lives in the dedicated Vault workspace flow. Updated related UX copy from “Settings → Vault” to “Vault tab/workspace” guidance. ([d9d3663])
+- **Sync Status UX Resilience**: Sync IPC status events now use canonical post-operation status refresh and last-known-state fallback behavior to avoid false disconnected states when status refresh fails. ([8cdb20d])
+- **Vault Credential Lifecycle UX**: Refined vault flows around secure-to-vault naming, modular vault panels/modals, bulk host assignment/unassignment, rotation prompts, repair actions, and reset tooling for clean vault test states. ([1d865ed], [bdbd81b], [bf01457])
+
+### Fixed
+- **Command Palette Vault Icon Semantics**: Corrected icon mapping so Local Vault and Google Vault Sync entries use appropriate visual semantics. ([d9d3663])
+- **Pasted Key Vaulting Consistency**: Converted pasted private-key flow to controlled state handling and centralized private-key marker validation logic to keep save/validation behavior consistent. ([d9d3663])
+
 ## [2.15.1] - 2026-04-27
 
 ### Fixed

README.md

@@ -172,6 +172,15 @@ npm run tauri dev
 npm run tauri build
 ```
 
+Release builds require a real `GOOGLE_CLIENT_ID` for the Google Drive vault sync
+OAuth flow. This is validated in `src-tauri/build.rs`, and release builds will
+fail fast if the value is missing or still set to a placeholder.
+
+If your Google OAuth client also requires a secret, set `GOOGLE_CLIENT_SECRET`
+in `src-tauri/.env` or your build environment. `src-tauri/build.rs` intentionally
+allowlists this variable so the local desktop OAuth token exchange continues to
+work even though other secret-like env keys are filtered out.
+
 ### Available Scripts
 
 | Command | Description |