Repository navigation
端末の緊急キットでパスワードボックスを復旧できるようにする - #695
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: 928a2eeb-806d-4a56-88de-37c70fe3fbc2) |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: 7ed9c242-5854-4e2e-8c71-203387f6ba8c) |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: dca4a983-9ac5-4eed-b7f1-27b953a8a106) |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: 088c0d9d-489d-4d77-9837-50b87c453e60) |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: 2e78f193-dac8-46e1-ba48-c251ef2e3a56) |
… source fingerprints
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: 51e344c9-8293-4622-ae44-7ceaea2b838a) |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: ffe9ed5c-f593-4a57-9f55-a85823434c85) |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: 6a146d97-20d9-473c-abb7-1f5f20615d21) |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: 92c7db65-fe7c-4e63-8450-9c222ae0b628) |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: 69102ee5-5b80-4902-898a-74de8ac2296a) |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: aff212fd-f233-4ccb-add1-ee0f7d6542db) |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: 3ebdaa48-69b0-48d3-9d92-18d28ec0b473) |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: 2bf81ad8-ad86-4dcb-83f6-f5f856299b60) |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: dbb78c0e-d4dd-4a37-a4de-8541d513b26e) |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: c920b262-3e52-433a-9b93-6ad3588de780) |
This branch was previously deployed
2 participants
マスターパスワードを失った端末のパスワードボックスを、緊急キットのコードで復旧できるようにします。新しいv2ファイルには本文の鍵を認証付きで包んだ復旧情報を保存し、既存v1は通常の読取り・保存で形式を維持します。v1は現在のパスワードによる明示的な有効化でだけ更新します。
コードでの読取りはファイルを変更しません。新しいパスワードの設定と原子保存が成功してから使用可能な状態を公開します。改ざん・別ファイル・古い読取り状態による保存を拒否し、復旧コード交換も現在のファイルだけに作用します。以前のコピーのコードまで無効になるとは案内しません。
認証済みの元JSONを保持し、追加フィールド・添付参照・配列・版を残します。URLの独自属性はURL自身に持たせ、同じURLの重複・順序変更・削除で別の属性を付け直す問題を解消しました。鍵は乱数生成または導出が成功してから型を構築し、入力と元JSONの消去範囲も文書に明記しました。
最新ソースのworkspace nextestは163件成功・省略0、doctest成功。関連Clippy・改ざん/失敗保存/復旧・独立した凍結v1データによる互換検査も成功しました。保存前に状態を入れ替える変異では期待する6検査が失敗し、修正後は成功しています。別モデルの実害ある指摘を修正し、追加差分の最終確認はMust/Shouldとも0件です。WASMは成功したCI38053698941の生成物と入力指紋を反映しています。
承認済みのデスクトップ画面は別PRで接続し、実画面・配布・全クライアントの受入を親ToDo1163で継続します。このCore変更を製品全体の完成とは扱いません。
Closes #694
Note
High Risk
Changes master-key handling, on-disk format (v2 recovery wrapper), and save/open integrity rules in security-critical crypto code; regressions could lock users out or weaken tamper detection.
Overview
Adds local password-box recovery via an emergency-kit code: new
.pboxv2 wraps the master key in an authenticated recovery blob (bound to the file header/ciphertext), while v1 boxes stay v1 untilenable_recoveryis called explicitly.PasswordBoxgains read-onlyrecover,rekey_recovered,rotate_recovery, and stricter save/open checks (file fingerprint, recovery binding,recovery_onlyblocks normal saves). Saves merge unknown JSON from the authenticated original payload so extra item/URL metadata survives edits;ItemUrlnow carries per-URLextensionsso duplicate/reordered URLs don’t lose attributes.Crypto/storage hardening includes bounded KDF params,
Zeroizingkey material, headerdeny_unknown_fields, and scrubbing of decrypted JSON buffers. Desktop/tests/import paths initialize the new URL field; acceptance tooling switches fixture SQL to a Base64\gexecstdin path; specs and cloud WASM fingerprints are updated.Reviewed by Cursor Bugbot for commit d64f7ca. Bugbot is set up for automated code reviews on this repo. Configure here.