Release v2.0.0 — Cluster 5 UX, full localization, TOTP/HIBP polish & fixes

.gitignore

@@ -54,3 +54,9 @@ web-ext-artifacts/
 
 # ─── Publish output ──────────────────────────────────────────────────────────
 publish/
+
+# ─── claude-code workspace artefacts (per-developer, never commit) ───────────
+.claude/
+
+# ─── Password-manager export files (real plaintext credentials — test only) ──
+pm-export/

Installer/PassKey.iss

@@ -4,8 +4,8 @@
 [Setup]
 AppId={{A7F3C2D1-8E4B-4F9A-B6D5-3C1E7A2F0D84}
 AppName=PassKey
-AppVersion=1.0.17
-AppVerName=PassKey 1.0.17
+AppVersion=2.0.0
+AppVerName=PassKey 2.0.0
 AppPublisher=Giuseppe Imperato
 AppPublisherURL=https://github.com/pexatar/PassKey
 AppSupportURL=https://github.com/pexatar/PassKey/issues

README.md

@@ -59,8 +59,8 @@ PassKey stores your passwords, credit cards, identities, and secure notes in a l
 
 | Version | Platform | Type |
 |---------|----------|------|
-| [v1.0.17](https://github.com/pexatar/PassKey/releases/tag/v1.0.17) | Windows x64 | Installer EXE |
-| [v1.0.17](https://github.com/pexatar/PassKey/releases/tag/v1.0.17) | Windows x64 | Portable ZIP |
+| [v2.0.0](https://github.com/pexatar/PassKey/releases/tag/v2.0.0) | Windows x64 | Installer EXE |
+| [v2.0.0](https://github.com/pexatar/PassKey/releases/tag/v2.0.0) | Windows x64 | Portable ZIP |
 
 > **Requirements:** Windows 10 version 1809 (build 17763) or later, x64 processor.
 > No .NET runtime required — PassKey is fully self-contained.

extensions/chrome/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "PassKey",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "author": "Giuseppe Imperato",
   "homepage_url": "https://github.com/pexatar/PassKey",
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAjdNrt0WikUv9qMTjwXhpg5jIYvCLS0WYu8lRlUCzcvdB/aEuHOEqaQ4ByEES+eISVoOo4Vmdr4u3Zo1+IyPwE1zGqwX1agNMsZbctr3Ur8esnHp/gMaLkrONFHDrOXhaVdUJy5BDqa5yXuTN5jsZWhk3cmqxpxlfWu70piFWN4bsPPwdKNXuDYPSBQCcdUFlUxUz3GXX8zkm1GsXQONg1vMSYE9E5GHD4ORk5oSWlRDccsTHtnWVlfaNzlBLmuiXTbmrCBRO2zfKU+8T3byMZTWGf/0ygD7+XuNbHvMAxQgFFwdAeP9RX/kXnBej2KwXxlVE65rd/kSwfa5hFLcubQIDAQAB",

extensions/chrome/popup/popup.css

@@ -358,31 +358,15 @@ body {
   text-overflow: ellipsis;
 }
 
-/* Password presence indicator (visible at rest, hidden on hover) */
-.pk-pw-indicator {
-  color: var(--pk-text-3);
-  display: flex;
-  align-items: center;
-  flex-shrink: 0;
-  transition: opacity 0.12s;
-  margin-right: 2px;
-}
-.pk-cred-item:hover .pk-pw-indicator,
-.pk-cred-item:focus-within .pk-pw-indicator { opacity: 0; pointer-events: none; }
+/* Password presence indicator — hidden: the always-visible copy-password action
+   now conveys password presence, so the separate dot would be redundant. */
+.pk-pw-indicator { display: none; }
 
-/* Action buttons — hidden at rest, revealed on hover/focus */
+/* Action buttons — always visible for discoverability (Bitwarden/1Password pattern) */
 .pk-cred-actions {
   display: flex;
   gap: 3px;
   flex-shrink: 0;
-  opacity: 0;
-  pointer-events: none;
-  transition: opacity 0.15s;
-}
-.pk-cred-item:hover .pk-cred-actions,
-.pk-cred-item:focus-within .pk-cred-actions {
-  opacity: 1;
-  pointer-events: auto;
 }
 
 /* Labeled action buttons (icon + text) */
@@ -422,7 +406,10 @@ body {
   height: 28px;
   padding: 0;
   justify-content: center;
+  color: var(--pk-text-1);
+  background: var(--pk-fill-hover);
 }
+.pk-action-btn:not([data-action="fill"]):hover { background: var(--pk-fill-active); }
 .pk-action-btn:not([data-action="fill"]) .pk-action-label { display: none; }
 
 /* Legacy icon-only buttons (kept for other potential uses) */

extensions/chrome/popup/popup.js

@@ -50,8 +50,13 @@ const SPIN_SVG = `<svg class="pk-spin" width="15" height="15" viewBox="0 0 15 15
  * @param {string}  svgString - Raw SVG markup string.
  */
 function setSvgIcon(element, svgString) {
-  const doc = new DOMParser().parseFromString(svgString, 'image/svg+xml');
-  element.replaceChildren(doc.documentElement);
+  // Parse as text/html (not image/svg+xml): the HTML parser places <svg> in the
+  // SVG namespace automatically, so the inline icon strings render even without an
+  // explicit xmlns. Strict XML parsing left them in the null namespace → invisible.
+  // DOMParser stays CSP-safe (it never executes scripts).
+  const doc = new DOMParser().parseFromString(svgString, 'text/html');
+  const svg = doc.body.firstElementChild;
+  if (svg) element.replaceChildren(svg);
 }
 
 // ─── State ────────────────────────────────────────────────────────────────────

extensions/firefox/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "PassKey",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "author": "Giuseppe Imperato",
   "homepage_url": "https://github.com/pexatar/PassKey",
   "description": "Local password manager integration for PassKey desktop app. Autofill credentials, credit cards and identities stored securely on your PC — no cloud, no subscription.",

extensions/firefox/popup/popup.css

@@ -358,31 +358,15 @@ body {
   text-overflow: ellipsis;
 }
 
-/* Password presence indicator (visible at rest, hidden on hover) */
-.pk-pw-indicator {
-  color: var(--pk-text-3);
-  display: flex;
-  align-items: center;
-  flex-shrink: 0;
-  transition: opacity 0.12s;
-  margin-right: 2px;
-}
-.pk-cred-item:hover .pk-pw-indicator,
-.pk-cred-item:focus-within .pk-pw-indicator { opacity: 0; pointer-events: none; }
+/* Password presence indicator — hidden: the always-visible copy-password action
+   now conveys password presence, so the separate dot would be redundant. */
+.pk-pw-indicator { display: none; }
 
-/* Action buttons — hidden at rest, revealed on hover/focus */
+/* Action buttons — always visible for discoverability (Bitwarden/1Password pattern) */
 .pk-cred-actions {
   display: flex;
   gap: 3px;
   flex-shrink: 0;
-  opacity: 0;
-  pointer-events: none;
-  transition: opacity 0.15s;
-}
-.pk-cred-item:hover .pk-cred-actions,
-.pk-cred-item:focus-within .pk-cred-actions {
-  opacity: 1;
-  pointer-events: auto;
 }
 
 /* Labeled action buttons (icon + text) */
@@ -422,7 +406,10 @@ body {
   height: 28px;
   padding: 0;
   justify-content: center;
+  color: var(--pk-text-1);
+  background: var(--pk-fill-hover);
 }
+.pk-action-btn:not([data-action="fill"]):hover { background: var(--pk-fill-active); }
 .pk-action-btn:not([data-action="fill"]) .pk-action-label { display: none; }
 
 /* Legacy icon-only buttons (kept for other potential uses) */

extensions/firefox/popup/popup.js

@@ -51,8 +51,13 @@ const SPIN_SVG = `<svg class="pk-spin" width="15" height="15" viewBox="0 0 15 15
  * @param {string} svgString - SVG markup string.
  */
 function setSvgIcon(element, svgString) {
-  const doc = new DOMParser().parseFromString(svgString, 'image/svg+xml');
-  element.replaceChildren(doc.documentElement);
+  // Parse as text/html (not image/svg+xml): the HTML parser places <svg> in the
+  // SVG namespace automatically, so the inline icon strings render even without an
+  // explicit xmlns. Strict XML parsing left them in the null namespace → invisible.
+  // DOMParser stays CSP-safe (it never executes scripts).
+  const doc = new DOMParser().parseFromString(svgString, 'text/html');
+  const svg = doc.body.firstElementChild;
+  if (svg) element.replaceChildren(svg);
 }
 
 // ─── State ────────────────────────────────────────────────────────────────────

src/PassKey.Core/Models/CreditCardEntry.cs

@@ -1,4 +1,5 @@
 using PassKey.Core.Constants;
+using PassKey.Core.Services;
 
 namespace PassKey.Core.Models;
 
@@ -27,6 +28,18 @@ public sealed class CreditCardEntry : IVaultEntry
     /// <summary>Gets or sets the Primary Account Number (PAN) of the card.</summary>
     public string CardNumber { get; set; } = string.Empty;
 
+    /// <summary>
+    /// Gets the card number masked for display (e.g., "•••• •••• •••• 1234"). Returns
+    /// a fully-masked placeholder if the card number is empty. Used by the list view
+    /// so the raw PAN is never shown alongside the rest of the entry — only the last
+    /// digits are visible, matching the skeuomorphic card view. Mirrors the
+    /// <see cref="ExpiryFormatted"/> pattern of exposing a display-ready computed value
+    /// directly on the model.
+    /// </summary>
+    public string MaskedCardNumber => string.IsNullOrWhiteSpace(CardNumber)
+        ? "•••• •••• •••• ••••"
+        : CardTypeDetector.MaskCardNumber(CardNumber, CardType);
+
     /// <summary>Gets or sets the expiry month (1–12).</summary>
     public int ExpiryMonth { get; set; }
 

src/PassKey.Core/Models/IdentityEntry.cs

@@ -16,6 +16,9 @@ public sealed class IdentityEntry : IVaultEntry
     /// <summary>Gets or sets the person's first name.</summary>
     public string FirstName { get; set; } = string.Empty;
 
+    /// <summary>Gets or sets the person's middle name (FU5).</summary>
+    public string MiddleName { get; set; } = string.Empty;
+
     /// <summary>Gets or sets the person's last name (surname).</summary>
     public string LastName { get; set; } = string.Empty;
 
@@ -28,6 +31,12 @@ public sealed class IdentityEntry : IVaultEntry
     /// <summary>Gets or sets the primary phone number (including country code if applicable).</summary>
     public string Phone { get; set; } = string.Empty;
 
+    /// <summary>Gets or sets the company / organisation name (FU5).</summary>
+    public string Company { get; set; } = string.Empty;
+
+    /// <summary>Gets or sets a generic username associated with this identity (FU5).</summary>
+    public string Username { get; set; } = string.Empty;
+
     /// <summary>Gets or sets the street address (number and street name).</summary>
     public string Street { get; set; } = string.Empty;
 

src/PassKey.Core/Services/BitwardenImporter.cs

@@ -26,6 +26,12 @@ public Vault ParseBitwarden(string jsonContent)
         var vault = new Vault();
         var export = JsonSerializer.Deserialize(jsonContent, BitwardenJsonContext.Default.BitwardenExport);
 
+        // FU3: an encrypted export has no plaintext items — surface a clear message
+        // instead of silently importing an empty vault. Throws an error CODE; the Desktop
+        // layer maps it to a localized message (Core stays UI/i18n-free).
+        if (export?.Encrypted == true)
+            throw new ImportFileException("IMPORT_BW_ENCRYPTED");
+
         if (export?.Items is null) return vault;
 
         foreach (var item in export.Items)
@@ -163,24 +169,33 @@ private static IdentityEntry MapIdentity(BitwardenItem item)
             Id = Guid.NewGuid(),
             Label = item.Name ?? string.Empty,
             FirstName = id?.FirstName ?? string.Empty,
+            MiddleName = id?.MiddleName ?? string.Empty,
             LastName = id?.LastName ?? string.Empty,
             Email = id?.Email ?? string.Empty,
             Phone = id?.Phone ?? string.Empty,
-            Street = CombineAddress(id?.Address1, id?.Address2),
+            Company = id?.Company ?? string.Empty,
+            Username = id?.Username ?? string.Empty,
+            Street = CombineAddress(id?.Address1, id?.Address2, id?.Address3),
             City = id?.City ?? string.Empty,
             Province = id?.State ?? string.Empty,
             PostalCode = id?.PostalCode ?? string.Empty,
             Country = id?.Country ?? string.Empty,
+            // For Italian users Codice Fiscale and Tessera Sanitaria coincide in common use,
+            // so Bitwarden's "ssn" maps onto the existing HealthCardNumber field (FU4/FU5).
+            HealthCardNumber = id?.Ssn ?? string.Empty,
+            PassportNumber = id?.PassportNumber ?? string.Empty,
+            DrivingLicenseNumber = id?.LicenseNumber ?? string.Empty,
             Notes = item.Notes ?? string.Empty,
             CreatedAt = DateTime.UtcNow,
             ModifiedAt = DateTime.UtcNow
         };
     }
 
-    private static string CombineAddress(string? address1, string? address2)
+    private static string CombineAddress(string? address1, string? address2, string? address3)
     {
-        if (string.IsNullOrEmpty(address2)) return address1 ?? string.Empty;
-        if (string.IsNullOrEmpty(address1)) return address2;
-        return $"{address1}, {address2}";
+        var parts = new[] { address1, address2, address3 }
+            .Where(a => !string.IsNullOrWhiteSpace(a))
+            .Select(a => a!.Trim());
+        return string.Join(", ", parts);
     }
 }

src/PassKey.Core/Services/BitwardenJsonContext.cs

@@ -6,6 +6,15 @@ namespace PassKey.Core.Services;
 
 public sealed class BitwardenExport
 {
+    /// <summary>True for an encrypted Bitwarden export (account-restricted or
+    /// password-protected). Such files have no plaintext <see cref="Items"/> and cannot
+    /// be imported — detected so the user gets a clear message (FU3).</summary>
+    public bool Encrypted { get; set; }
+
+    /// <summary>True when the encrypted export is protected by a file password (as
+    /// opposed to the account key). Informational companion to <see cref="Encrypted"/>.</summary>
+    public bool PasswordProtected { get; set; }
+
     public BitwardenItem[]? Items { get; set; }
 }
 
@@ -45,11 +54,18 @@ public sealed class BitwardenCard
 public sealed class BitwardenIdentity
 {
     public string? FirstName { get; set; }
+    public string? MiddleName { get; set; }
     public string? LastName { get; set; }
+    public string? Username { get; set; }
+    public string? Company { get; set; }
+    public string? Ssn { get; set; }
+    public string? PassportNumber { get; set; }
+    public string? LicenseNumber { get; set; }
     public string? Email { get; set; }
     public string? Phone { get; set; }
     public string? Address1 { get; set; }
     public string? Address2 { get; set; }
+    public string? Address3 { get; set; }
     public string? City { get; set; }
     public string? State { get; set; }
     public string? PostalCode { get; set; }