add local-network vault sync — Noise NK transport, blob coordinator, mesh device propagation, subnet scan, Android bridge (v2.38.0)

@@ -1,7 +1,7 @@11 {22   "manifest_version": 3,33   "name": "Peach",4-  "version": "2.37.0",4+  "version": "2.38.0",55   "description": "Zero-knowledge password manager",66   "browser_specific_settings": {77     "gecko": {

@@ -1,7 +1,7 @@11 {22   "manifest_version": 3,33   "name": "Peach",4-  "version": "2.37.0",4+  "version": "2.38.0",55   "description": "Zero-knowledge password manager",66   "action": {77     "default_popup": "src/popup/index.html",@@ -52,6 +52,9 @@5252     "idle",5353     "favicon",5454     "webAuthenticationProxy"55+  ],56+  "host_permissions": [57+    "<all_urls>"5558   ],5659   "content_security_policy": {5760     "extension_pages": "script-src 'self' 'wasm-unsafe-eval'; object-src 'none'"

@@ -48,6 +48,7 @@4848   removePairedDevice,4949   removeTrustedNetwork,5050   setIncomingPairingRequest,51+  updatePairedDevice,5152 } from "./sync-storage";5253 import { getCurrentNetwork, isOnTailscale } from "./sync-network";5354 import {@@ -62,8 +63,13 @@6263   VaultEntry,6364 } from "../shared/types";6465 import { isPasskeyOnly } from "../shared/types";65-import type { SyncStatus } from "../shared/sync-types";66+import type { SyncStatus, SyncableDevice } from "../shared/sync-types";6667 import { isNativePlatform, nativePlugin } from "../shared/native";68+import { runBlobSyncSession, type SyncResult } from "./sync-coordinator";69+import type { SyncDeps } from "./sync-coordinator";70+import { createWebSocketSyncTransport } from "../shared/websocket-sync-transport";71+import { getLocalSubnet, discoverDevice, scanForPairingPhone } from "../shared/local-network";72+import { base64ToBytes, bytesToBase64 } from "../shared/sync-wire";6773 6874 /**6975  * The single Pro gate. Every gated handler calls this first; the broadcast@@ -148,6 +154,98 @@148154 // same private-IP/HTTPS rules that gate canary webhooks apply here.149155 const FEEDBACK_ENDPOINT = "";150156 157+// ---------------------------------------------------------------------------158+// Sync helpers159+// ---------------------------------------------------------------------------160+161+function buildSyncDeps(): SyncDeps {162+  return {163+    isVaultUnlocked: () => vault.isUnlocked(),164+    getVaultBlobForSync: async () => {165+      const base = await vault.getVaultBlobForSync();166+      if (!base) return null;167+      const paired = await getPairedDevices();168+      return {169+        ...base,170+        devices: paired171+          .filter(d => d.x25519PublicKey)172+          .map(d => ({173+            publicKeyHex: d.x25519PublicKey,174+            deviceName: d.displayName,175+            pairedAt: d.pairedAt,176+          })),177+      };178+    },179+    applyIncomingVault: async (blob, ts, license, devices) => {180+      const applied = await vault.applyIncomingVault(blob, ts, license);181+      if (devices?.length) await mergeDeviceRegistry(devices);182+      if (applied) await vault.reloadEntriesAfterSync();183+      return applied;184+    },185+  };186+}187+188+async function doVaultSync(ip: string, publicKeyHex: string): Promise<SyncResult> {189+  try {190+    const transport = await createWebSocketSyncTransport(`ws://${ip}:44100`, publicKeyHex);191+    return await runBlobSyncSession('initiator', transport, buildSyncDeps());192+  } catch (err) {193+    return { status: 'errored', applied: false, error: String(err) };194+  }195+}196+197+async function mergeDeviceRegistry(incoming: SyncableDevice[]): Promise<void> {198+  const existing = await getPairedDevices();199+  const existingKeys = new Set(existing.map(d => d.x25519PublicKey));200+  for (const device of incoming) {201+    if (!existingKeys.has(device.publicKeyHex)) {202+      await addPairedDevice({203+        deviceId: device.publicKeyHex,204+        displayName: device.deviceName,205+        x25519PublicKey: device.publicKeyHex,206+        pairedAt: device.pairedAt,207+        lastSeenAt: 0,208+        lastKnownIp: '',209+      }).catch(() => {});210+    }211+  }212+}213+214+// Background pairing scan — runs after START_PAIRING_SERVER fires on desktop.215+// Scans the local subnet for a phone that has accepted the pairing token,216+// stores it, runs the initial vault exchange, then notifies the popup.217+async function runPairingSubnetScan(token: string): Promise<void> {218+  const subnet = await getLocalSubnet();219+  if (!subnet) return;220+221+  const found = await scanForPairingPhone(subnet, token);222+  if (!found) return;223+224+  const { ip, publicKeyHex } = found;225+226+  try {227+    await addPairedDevice({228+      deviceId: publicKeyHex,229+      displayName: 'Peach',230+      x25519PublicKey: publicKeyHex,231+      pairedAt: Date.now(),232+      lastSeenAt: Date.now(),233+      lastKnownIp: ip,234+    });235+  } catch {236+    // Already paired — update IP237+    await updatePairedDevice(publicKeyHex, { lastKnownIp: ip, lastSeenAt: Date.now() });238+  }239+240+  // Immediate vault exchange — the free one-time transfer241+  await doVaultSync(ip, publicKeyHex);242+243+  chrome.runtime.sendMessage({244+    type: 'PAIRING_COMPLETED',245+    payload: { deviceName: 'Peach', publicKeyHex, deviceIp: ip },246+  }).catch(() => {});247+}248+151249 export function setupMessageHandler(): void {152250   chrome.runtime.onMessage.addListener(153251     (msg: unknown, sender, sendResponse) => {@@ -185,10 +283,7 @@185283     });186284   }187285 188-  // Android: subscribe to SyncPlugin pair-probe events. When a remote device189-  // connects to the phone's WS server and validates the pairing token, auto-190-  // accept and broadcast PAIRING_COMPLETED so AddDeviceView shows the success191-  // screen and the paired device is persisted.286+  // Android: subscribe to SyncPlugin events.192287   if (isNativePlatform()) {193288     const syncPlug = nativePlugin<{194289       addListener: (@@ -196,17 +291,21 @@196291         handler: (data: Record<string, string>) => void197292       ) => void;198293     }>("SyncPlugin");294+295+    // Pairing probe answered — store the paired device (desktop, no IP needed296+    // since the desktop never acts as a WS server).199297     syncPlug?.addListener?.("peach:pair-probe-answered", (data) => {200-      const deviceId = data.connectionId ?? "unknown";201298       const deviceName = data.deviceName ?? "Peach";299+      const publicKeyHex = data.publicKeyHex ?? "";202300       void (async () => {203301         const { addPairedDevice, setHasPaired: setPaired } = await import("./sync-storage");204302         await addPairedDevice({205-          deviceId,303+          deviceId: publicKeyHex || (data.connectionId ?? "unknown"),206304           displayName: deviceName,207-          x25519PublicKey: data.publicKeyHex ?? "",305+          x25519PublicKey: publicKeyHex,208306           pairedAt: Date.now(),209-        });307+          lastSeenAt: Date.now(),308+        }).catch(() => {});210309         await setPaired();211310         chrome.runtime.sendMessage({212311           type: "PAIRING_COMPLETED",@@ -214,6 +313,20 @@214313         }).catch(() => {});215314       })();216315     });316+317+    // Sync frame received — route to the waiting responder session.318+    syncPlug?.addListener?.("peach:sync-frame", (data) => {319+      const { connectionId, frame } = data;320+      if (connectionId && frame) deliverAndroidSyncFrame(connectionId, frame);321+    });322+323+    // Sync session started (SYNC_HELLO received by SyncPlugin) — dispatch as324+    // a background message so SYNC_SESSION_STARTED handler runs the responder.325+    syncPlug?.addListener?.("peach:sync-session-started", (data) => {326+      const { connectionId } = data;327+      if (!connectionId) return;328+      void handleMessage({ type: "SYNC_SESSION_STARTED", payload: { connectionId } });329+    });217330   }218331 }219332 @@ -783,6 +896,11 @@783896         const token = generateSixDigitToken();784897         const expiresAt = Date.now() + PAIRING_TOKEN_TTL_MS;785898         await setActivePairingToken({ token, expiresAt });899+        // Fire-and-forget subnet scan — finds the phone after it scans the QR900+        // and calls SCAN_PAIRING_QR to register the token with SyncPlugin.901+        if (!isNativePlatform()) {902+          void runPairingSubnetScan(token);903+        }786904         return { ok: true, data: { token, expiresAt } };787905       }788906       case "STOP_PAIRING_SERVER": {@@ -975,15 +1093,56 @@9751093         const gate = await requirePro("sync");9761094         if (!gate.allowed) return { ok: false, error: "pro_required" };9771095         if (!vault.isUnlocked()) return { ok: false, error: "vault_locked" };1096+9781097         if (isNativePlatform()) {1098+          // Phone is the server — ensure it's listening for desktop connections.9791099           syncBridge()?.ensureServerRunning?.();9801100           return { ok: true, data: { syncedCount: 0, mode: "server" as const } };9811101         }982-        // Desktop has no outbound sync path — paired devices are mobile, and983-        // the mobile side initiates. From desktop, "trigger sync" just means984-        // "make sure the pairing server is reachable", which is handled by985-        // START_PAIRING_SERVER. Surface no_paired_devices to keep callers tidy.986-        return { ok: false, error: "no_paired_devices" };1102+1103+        // Desktop: iterate all paired devices and sync with each.1104+        const paired = await getPairedDevices();1105+        if (!paired.length) return { ok: true, data: { syncedCount: 0, reason: "no_paired_devices" } };1106+1107+        const subnet = await getLocalSubnet();1108+        const results: Array<{ device: string } & SyncResult> = [];1109+1110+        for (const device of paired) {1111+          if (!device.x25519PublicKey) continue;1112+1113+          let result: SyncResult;1114+1115+          // Fast path — use last known IP1116+          if (device.lastKnownIp) {1117+            result = await doVaultSync(device.lastKnownIp, device.x25519PublicKey);1118+          } else {1119+            result = { status: 'errored', applied: false, error: 'no_ip' };1120+          }1121+1122+          // Discovery path — scan if fast path failed1123+          if (result.status === 'errored' && subnet) {1124+            const newIp = await discoverDevice(subnet, device.x25519PublicKey);1125+            if (newIp) {1126+              await updatePairedDevice(device.x25519PublicKey, { lastKnownIp: newIp });1127+              result = await doVaultSync(newIp, device.x25519PublicKey);1128+            }1129+          }1130+1131+          if (result.status === 'completed') {1132+            await updatePairedDevice(device.x25519PublicKey, {1133+              lastSeenAt: Date.now(),1134+              lastSyncAt: Date.now(),1135+            });1136+          }1137+1138+          results.push({ device: device.displayName, ...result });1139+        }1140+1141+        const syncedCount = results.filter(r => r.status === 'completed').length;1142+        if (syncedCount > 0) {1143+          await chrome.storage.local.set({ peach_last_sync_at: String(Date.now()) });1144+        }1145+        return { ok: true, data: { syncedCount, results } };9871146       }9881147       // Android-only: biometric unlock with pre-derived key.9891148       case "UNLOCK_WITH_KEY": {@@ -1018,6 +1177,23 @@10181177         syncBridge()?.startPairingSession?.({ token });10191178         return { ok: true };10201179       }1180+      // Android: desktop opened a sync connection to the phone's WS server.1181+      // Run the responder side of the vault exchange.1182+      case "SYNC_SESSION_STARTED": {1183+        if (!isNativePlatform()) return { ok: false };1184+        if (!vault.isUnlocked()) {1185+          return { ok: false, error: "vault_locked" };1186+        }1187+        const { connectionId } = (msg.payload ?? {}) as { connectionId?: string };1188+        if (!connectionId) return { ok: false, error: "missing_connection_id" };1189+1190+        const transport = createAndroidResponderTransport(connectionId);1191+        const result = await runBlobSyncSession('responder', transport, buildSyncDeps());1192+        if (result.applied) {1193+          await publishInMemoryVault(vault.getEntries());1194+        }1195+        return { ok: true, data: result };1196+      }10211197       // Android: returns the phone's WiFi IP address.10221198       case "GET_LOCAL_IP": {10231199         if (!isNativePlatform()) {@@ -1039,6 +1215,33 @@10391215         await publishInMemoryVault(entries);10401216         return { ok: true };10411217       }1218+      // --- PNA compatibility test handlers — REMOVE BEFORE RELEASE ---1219+      case "TEST_LOCAL_WEBSOCKET": {1220+        const { ip } = (msg.payload ?? {}) as { ip?: string };1221+        if (!ip) return { ok: false, error: "ip required" };1222+        return new Promise((resolve) => {1223+          try {1224+            const ws = new WebSocket(`ws://${ip}:44100`);1225+            ws.onopen = () => { ws.close(); resolve({ ok: true, data: { connected: true } }); };1226+            ws.onerror = () => resolve({ ok: false, error: "connection_failed" });1227+            setTimeout(() => { ws.close(); resolve({ ok: false, error: "timeout" }); }, 3000);1228+          } catch (err) {1229+            resolve({ ok: false, error: String(err) });1230+          }1231+        });1232+      }1233+      case "TEST_SUBNET_DETECTION": {1234+        const subnet = await getLocalSubnet();1235+        return { ok: true, data: { subnet } };1236+      }1237+      case "TEST_SUBNET_SCAN": {1238+        const subnet = await getLocalSubnet();1239+        if (!subnet) return { ok: false, error: "no_subnet" };1240+        const start = Date.now();1241+        const result = await discoverDevice(subnet, "000000000000000000000000000000000000000000000000000000000000000000");1242+        return { ok: true, data: { elapsed: Date.now() - start, found: !!result } };1243+      }1244+      // --- end test handlers ---10421245       default:10431246         return { ok: false, error: "unknown message type" };10441247     }@@ -1094,12 +1297,43 @@10941297   ensureServerRunning?: () => void;10951298   startPairingSession?: (args: { token: string }) => void;10961299   getLocalIp?: () => Promise<{ ip: string }>;1300+  sendToConnection?: (args: { connectionId: string; data: string }) => Promise<void>;1301+  addListener?: (event: string, handler: (data: Record<string, string>) => void) => void;10971302 }10981303 10991304 // Resolve the Capacitor SyncPlugin at call time — module-load resolution11001305 // races with Capacitor's plugin registration on the Android WebView.11011306 function syncBridge(): SyncBridge | null {11021307   return nativePlugin<SyncBridge>("SyncPlugin");1308+}1309+1310+// Build a SyncTransport for the Android responder path — the phone's WS server1311+// already has an open connection from the desktop. We send back via1312+// SyncPlugin.sendToConnection and receive via the peach:sync-frame queue.1313+const androidSyncFrameQueues = new Map<string, Array<(frame: string) => void>>();1314+1315+export function deliverAndroidSyncFrame(connectionId: string, frame: string): void {1316+  const queue = androidSyncFrameQueues.get(connectionId);1317+  if (queue?.length) queue.shift()!(frame);1318+}1319+1320+function createAndroidResponderTransport(connectionId: string) {1321+  const pendingReceivers: Array<(frame: string) => void> = [];1322+  androidSyncFrameQueues.set(connectionId, pendingReceivers);1323+1324+  return {1325+    send: async (data: Uint8Array) => {1326+      await syncBridge()?.sendToConnection?.({ connectionId, data: bytesToBase64(data) });1327+    },1328+    receive: (): Promise<Uint8Array> => new Promise((res) => {1329+      pendingReceivers.push((frame) => {1330+        res(frame ? base64ToBytes(frame) : new Uint8Array(0));1331+      });1332+    }),1333+    close: async () => {1334+      androidSyncFrameQueues.delete(connectionId);1335+    },1336+  };11031337 }11041338 11051339 // Returns username use-counts from the vault, sorted by frequency. Each row

@@ -93,6 +93,21 @@9393   }9494 }9595 96+export async function updatePairedDevice(97+  x25519PublicKey: string,98+  patch: Partial<Pick<PairedDevice, 'lastSeenAt' | 'lastSyncAt' | 'lastKnownIp'>>,99+): Promise<void> {100+  try {101+    const devices = await getPairedDevices();102+    const updated = devices.map((d) =>103+      d.x25519PublicKey === x25519PublicKey ? { ...d, ...patch } : d,104+    );105+    await chrome.storage.local.set({ [PAIRED_DEVICES_KEY]: updated });106+  } catch (err) {107+    throw new Error(`Failed to update paired device: ${err}`);108+  }109+}110+96111 // ---------------------------------------------------------------------------97112 // Incoming Pairing Request98113 //

@@ -1956,3 +1956,125 @@19561956 19571957   return true;19581958 }1959+1960+// ---------------------------------------------------------------------------1961+// Sync helpers1962+// ---------------------------------------------------------------------------1963+1964+export async function getVaultBlobForSync(): Promise<{1965+  blob: string;1966+  timestamp: number;1967+  license?: string;1968+} | null> {1969+  const raw = await chrome.storage.local.get([SLOT_A, SLOT_B, 'peach_last_modified_at', 'peach_license']);1970+  const slotA = (raw as Record<string, unknown>)[SLOT_A];1971+  if (!slotA) return null;1972+  const slotB = (raw as Record<string, unknown>)[SLOT_B];1973+  const blob = JSON.stringify({ a: slotA, b: slotB });1974+  const rawTs = (raw as Record<string, unknown>)['peach_last_modified_at'];1975+  const timestamp = typeof rawTs === 'string' ? parseInt(rawTs) : 0;1976+  const license = (raw as Record<string, unknown>)['peach_license'];1977+  return {1978+    blob,1979+    timestamp,1980+    license: typeof license === 'string' ? license : undefined,1981+  };1982+}1983+1984+export async function applyIncomingVault(1985+  blobJson: string,1986+  remoteTimestamp: number,1987+  remoteLicense?: string,1988+): Promise<boolean> {1989+  const raw = await chrome.storage.local.get('peach_last_modified_at');1990+  const rawTs = (raw as Record<string, unknown>)['peach_last_modified_at'];1991+  const localTimestamp = typeof rawTs === 'string' ? parseInt(rawTs) : 0;1992+1993+  if (remoteLicense) {1994+    const licenseRaw = await chrome.storage.local.get('peach_license');1995+    const existing = (licenseRaw as Record<string, unknown>)['peach_license'];1996+    if (!existing) {1997+      await chrome.storage.local.set({ peach_license: remoteLicense });1998+    }1999+  }2000+2001+  if (remoteTimestamp <= localTimestamp) return false;2002+2003+  // Snapshot before overwriting — failure is non-fatal2004+  await takeVaultSnapshot('sync_received').catch(() => {});2005+2006+  const { a, b } = JSON.parse(blobJson) as { a: unknown; b?: unknown };2007+  await writeSlot(SLOT_A, a as StoredVault);2008+  if (b) await writeSlot(SLOT_B, b as StoredVault);2009+  await chrome.storage.local.set({2010+    peach_last_sync_at: String(Date.now()),2011+    peach_last_modified_at: String(remoteTimestamp),2012+  });2013+2014+  return true;2015+}2016+2017+export async function getSyncIdentity(): Promise<{2018+  privateKeyBytes: Uint8Array;2019+  publicKeyBytes: Uint8Array;2020+  publicKeyHex: string;2021+}> {2022+  const raw = await chrome.storage.local.get('peach_sync_identity');2023+  const stored = (raw as Record<string, unknown>)['peach_sync_identity'];2024+  if (typeof stored === 'string') {2025+    const { priv, pub } = JSON.parse(stored) as { priv: string; pub: string };2026+    const privateKeyBytes = base64DecodeBytes(priv);2027+    const publicKeyBytes = base64DecodeBytes(pub);2028+    return { privateKeyBytes, publicKeyBytes, publicKeyHex: bytesToHex(publicKeyBytes) };2029+  }2030+2031+  // Generate a fresh X25519 keypair and persist it.2032+  const { generateKeyPair } = await import('@stablelib/x25519');2033+  const keypair = generateKeyPair();2034+  await chrome.storage.local.set({2035+    peach_sync_identity: JSON.stringify({2036+      priv: base64EncodeBytes(keypair.secretKey),2037+      pub: base64EncodeBytes(keypair.publicKey),2038+    }),2039+  });2040+  return {2041+    privateKeyBytes: keypair.secretKey,2042+    publicKeyBytes: keypair.publicKey,2043+    publicKeyHex: bytesToHex(keypair.publicKey),2044+  };2045+}2046+2047+// Re-decrypt vault entries from storage using the current in-memory key.2048+// Called after applyIncomingVault so the in-memory state stays consistent2049+// with what was just written to storage.2050+export async function reloadEntriesAfterSync(): Promise<boolean> {2051+  if (!derivedKey) return false;2052+  const slotA = await loadSlot(SLOT_A);2053+  if (!slotA) return false;2054+  try {2055+    const payload = await tryDecryptSlot(slotA, derivedKey);2056+    if (!payload) return false;2057+    entries = payload.entries;2058+    buildDomainIndexSync(entries);2059+    return true;2060+  } catch {2061+    return false;2062+  }2063+}2064+2065+function bytesToHex(bytes: Uint8Array): string {2066+  return Array.from(bytes).map(b => b.toString(16).padStart(2, '0')).join('');2067+}2068+2069+function base64EncodeBytes(bytes: Uint8Array): string {2070+  let binary = '';2071+  for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);2072+  return btoa(binary);2073+}2074+2075+function base64DecodeBytes(b64: string): Uint8Array {2076+  const binary = atob(b64);2077+  const bytes = new Uint8Array(binary.length);2078+  for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);2079+  return bytes;2080+}

@@ -449,6 +449,23 @@449449     // backgrounds the app. We measure elapsed background time on resume.450450     if (isNativePlatform()) {451451       let backgroundedAt: number | null = null;452+      let syncPollInterval: ReturnType<typeof setInterval> | null = null;453+454+      function startSyncPolling() {455+        if (syncPollInterval) return;456+        syncPollInterval = setInterval(async () => {457+          const res = await sendMessage({ type: 'TRIGGER_SYNC' }).catch(() => null);458+          const r = res as { ok?: boolean; data?: { syncedCount?: number } } | null;459+          if (r?.ok && (r?.data?.syncedCount ?? 0) > 0) {460+            await sendMessage({ type: 'GET_ENTRIES' }).catch(() => null);461+          }462+        }, 60_000);463+      }464+465+      function stopSyncPolling() {466+        if (syncPollInterval) { clearInterval(syncPollInterval); syncPollInterval = null; }467+      }468+452469       const CapApp = nativePlugin<{453470         addListener: (454471           ev: string,@@ -461,6 +478,7 @@461478           ({ isActive }: { isActive: boolean }) => {462479             if (!isActive) {463480               backgroundedAt = Date.now();481+              stopSyncPolling();464482               return;465483             }466484             if (backgroundedAt !== null && autoLockMinutes() > 0) {@@ -468,11 +486,14 @@468486               if (elapsed >= autoLockMinutes() * 60_000) handleHeaderLock();469487             }470488             backgroundedAt = null;489+            // Resume polling when app comes to foreground (Pro only).490+            if (proStatus()) startSyncPolling();471491           }472492         );473493         // Capacitor 6 listeners return a Promise<{ remove: () => Promise<void> }>.474494         onCleanup(() => {475495           Promise.resolve(sub).then((s) => s?.remove?.()).catch(() => {});496+          stopSyncPolling();476497         });477498       }478499     }@@ -880,6 +901,17 @@880901   }881902 882903   async function openVault(preferredEntryId?: string, skipViewSet = false) {904+    // Desktop: fire-and-forget sync on every vault open (Pro only).905+    // Never blocks popup load; refreshes entries if new data arrives.906+    if (!isNativePlatform() && proStatus()) {907+      void sendMessage({ type: 'TRIGGER_SYNC' }).then((res) => {908+        const r = res as { ok?: boolean; data?: { syncedCount?: number } } | null;909+        if (r?.ok && (r?.data?.syncedCount ?? 0) > 0) {910+          void loadEntries();911+        }912+      }).catch(() => {});913+    }914+883915     // Purge expired trash entries on each vault open884916     const retDays = trashRetentionDays();885917     if (retDays > 0) {