From d40fd5713337de60962a5dc034646751eb6fba1a Mon Sep 17 00:00:00 2001
From: r-zakarya <82443831+r-zakarya@users.noreply.github.com>
Date: Sat, 25 Jul 2026 16:31:29 +0100
Subject: [PATCH] fix(health): invalidate the dashboard cache whenever entries
 change
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

healthCache was only dropped on lock, on save and by the Recompute button.
Import, sync, delete, batch ops, duplicate, restore and the master-password
rotation all left it in place, so Vault health kept showing a pre-mutation
score and listed entries that no longer exist.

Invalidate inside loadEntries() — the choke point every mutation path already
goes through — instead of one opt-in per caller. Recompute stays lazy: it only
runs when the dashboard is next rendered.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 js/app.js | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/js/app.js b/js/app.js
index 7349418..7a094f7 100644
--- a/js/app.js
+++ b/js/app.js
@@ -1501,6 +1501,13 @@ async function loadEntries() {
         const r = await api('/entries', { headers: authHeaders() });
         state.entries = Array.isArray(r) ? r : [];
         await decryptEntryMeta(state.entries);
+        // The entry list just changed → the health dashboard's decrypted cache
+        // is stale. Invalidating HERE covers every mutation path at once
+        // (import, sync, delete, batch, duplicate, restore, master-pw change)
+        // instead of one opt-in per caller — which is how import and sync were
+        // left showing a pre-import score. Recompute is lazy: it only runs when
+        // the dashboard is actually rendered.
+        if (typeof healthCache !== 'undefined') healthCache = null;
     } catch (e) {
         if (e.message === 'Invalid session' || e.message === 'Session expired') {
             return doLogout();