build.log, config.txt, PMServer.rar, quickunlock.bin, vault copies and
screenshot drops were cluttering `git status`. None of these belong in
the repo: build/config/rar are per-machine, quickunlock.bin is a DPAPI
blob bound to the dev user's Windows account, vault copies are personal
data, screenshots are scratch.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
vault.db was tracked from the start of the repo, meaning every commit
since the initial import has captured snapshots of the user's password
data. Even though entries are AES-GCM encrypted in the DB, the file
also contains:
- PBKDF2 salt + hash of the master password (offline-crackable)
- Audit log with timestamps + IP addresses
- Session tokens (transient but historical)
- Login attempt counters per username
Future commits no longer include vault.db. The Delphi/PHP backend
auto-creates the schema via CREATE TABLE IF NOT EXISTS on first run,
so a fresh clone needs no migration step.
Also ignore the SQLite sidecar files (-journal, -wal, -shm).
NOTE: this only stops future leaks. The historical commits still
contain old snapshots. Purging history requires git filter-repo +
force-push, which rewrites every commit hash and breaks existing
clones. See README for instructions if a history purge is desired.
Introduces the Delphi 12 FMX backend (PMServer) that hosts the embedded
WebView2 vault on 127.0.0.1, and a native bridge between JS and Delphi
that wires three privacy-focused features:
1. Secure clipboard
Copying a password registers the Win32 "ExcludeClipboardContentFromMonitorProcessing"
format alongside CF_UNICODETEXT, so Win+V clipboard history never sees
the value. Auto-clears after 30s via TTimer. Bridge.copySecure() in
app.js routes all password/username/secret copy paths through the
native layer when running inside the Delphi WebView2 (falls back to
navigator.clipboard for the PHP standalone).
2. Tray icon (X-to-tray when server running)
Closing the dev panel hides both the form HWND and the TFMAppClass
per-process proxy window that owns the FMX taskbar entry — the form's
HWND alone is not the taskbar-visible one in FMX (took some iteration
to discover). Tray menu: Open, Lock vault, Quit. Clipboard is force-
cleared on minimize as extra safety. First-time minimize fires a
balloon notification so the user knows the app is still running.
3. Auto-lock on Windows session lock (Win+L)
wtsapi32.dll!WTSRegisterSessionNotification on a dedicated message-only
window. On WM_WTSSESSION_CHANGE / WTS_SESSION_LOCK, the bridge calls
ExecuteJavaScript('lockVault()'). Same path used by the tray "Lock vault"
menu item.
Bridge architecture:
- JS → Delphi via cmd:// URLs intercepted in OnBeforeNavigate
(pattern lifted from DeskInsight Monaco). Currently exposes
cmd://clipboard/copy?text=...&clear=... and cmd://clipboard/clear.
- Delphi → JS via TTMSFNCWebBrowser.ExecuteJavaScript with guarded
calls (typeof check) so the bridge degrades cleanly if app.js isn't
loaded yet.
Files:
- Source/PM.Bridge.pas (new) — TSecureClipboard + TPMBridge
- UMainForm.pas/.fmx — bridge wiring, FormCloseQuery intercept, tray
callbacks (BridgeTrayRestore / BridgeLockRequest / BridgeQuit)
- js/app.js — Bridge object, 5 navigator.clipboard sites migrated to
Bridge.copySecure with PHP-compatible fallback, Bridge.onTrayRestore
handler that resets the auto-lock timer
.gitignore extended with Delphi build artifacts (*.dcu, Win32/, Win64/,
__history/, __recovery/, *.identcache, *.dsk, *.local, etc.) so source
checkouts stay clean.
r-zakarya
Zaki