Repository navigation
OnlyKey App 6.0.0 - #245
Conversation
React 19 + Vite + TypeScript rewrite with full 5.6 feature surface (setup, slots, keys, backup, firmware, preferences, advanced, tools), NW.js desktop shell, packaging scripts, and automated tests. Version labeled 5.7.0 (not 6.x).
Remove vulnerable nw-autoupdater, harden MockTransport for automated testing, fix NW blank UI and desktop Vitest shebang, improve multi-OS release packaging, and lock dependencies for reproducible installs.
- Package/install: world-readable NW libs, onlykey-launch, desktop Exec/Path - Tray: rebuild menus without Linux remove/insert (empty menu fix) - Unlock: poll lock state via OKSETTIME; default tab Slots when initialized - Restore: silent intermediate OKRESTORE packets + progress UI (SVG spinner) - Security: wipe store + remount session UI on unplug and lock - deps: bump tar override to ^7.5.22 (audit clean for release)
5.7 has never shipped, so leftover aliases and experiment hosts are unused. Drop the one-off debug/repro scripts that mutated package.json to probe discarded tray approaches.
Rewrite agent instructions for the current tree and NW 0.104.1 pin. Mark firmware load and app auto-update as unverified rather than done.
* Add Tier 1 CI quality gates and desktop OS-matrix tests. Split the Ubuntu test workflow into typecheck, lint, audit, and unit/coverage jobs with concurrency and least-privilege permissions. Add a fail-fast-disabled desktop matrix on Ubuntu (Xvfb), Windows, and macOS so tray/HID regressions are caught before merging to 5.7. Ignore Dependabot bumps of the pinned NW.js 0.104.1 runtime. * Stop tray init from using nw after test teardown. initTray is async (auto-launch probe). Unit afterEach called stop() and deleted global.nw while that promise was still running, so buildTrayMenu logged ReferenceError: nw is not defined even though the tests passed. Abort in-flight init on stop() and talk to the mock via global.nw from the ESM test file.
5.6 used packages.*.size as the nw-autoupdater progress denominator (rounded MB on the live 5.3.4 channel). SHA-256 is the only payload check. Prefer Content-Length for progress when present.
Replace window.confirm with AppUpdateHost + AppUpdateDialog outside sessionEpoch. Tools checkbox and Check now; tray/React pref sync; autoUpdate defaults on (5.6 continuity). Ready state is Show in folder / OK. No installer launch.
Startup check was easy to miss (StrictMode cancel, DevTools reload + session skip, tray toggle only hydrated state). Defer the GET until after paint, start a check when autoUpdate goes from off to on, and log skip/current so the console shows what happened.
arrayBuffer() only reported 100% after the file was already in memory, so the dialog stayed at 0% until the ready modal. Read response.body when getReader exists; keep arrayBuffer as the test fallback.
applyAppUpdate verifies SHA-256 on disk, launches a detached NSIS/open/xdg-open process, then quits so files can be replaced. Spawn failure shows the folder and does not quit. Ready dialog is Install now / Show in folder / Later.
Shorten the downloaded-update copy to version plus SHA-256. Later opens the installer in the file manager and dismisses. Spawn or quit failure also reveals the file and reports apply-failed.
… size After each OS artifact, hash it, write releases/update-manifest.d/<key>.json, and merge same-version fragments into releases/manifest.json. Packaged package.json honors ONLYKEY_UPDATE_MANIFEST_URL and ONLYKEY_UPDATE_BASE_URL. Does not upload to S3.
Authenticode/notarization changes bytes, so npm run release no longer writes the update manifest. After signing in place, npm run update-manifest hashes that file, refuses NotSigned on Windows/macOS, and reminds the operator to upload the same signed artifact.
Replace HTML scrape with GitHub API; injectable I/O; restore 5.6 load gate floor.
Host/dialog/Tools/pref events; Ready is Open Firmware tab only; no HID.
…h FirmwareUpdate dialog
Extract kick/pending/stream; dialog Load when legal; tab Download Latest stays one-shot.
Manual check ignores pref; Setup Step 11 Download Latest / use-downloaded.
Correct firmware SHA-256 and auto-check UX; hardware remains a lab gate.
Leave Check now / load on the Firmware tab. Tools keeps the same autoUpdateFW checkbox as the tray menu.
Remove firmware prefs from Tools. The Firmware tab checkbox uses the same autoUpdateFW key as the tray and follows tray toggles.
Drop the internal feature-parity checklist from the tree and add the GitHub release note.
* Preferences: 3.1.0 user input modes and Webcrypt access Field 30 (web and agent derived keys: challenge code, button press or none) is saved together with fields 21 and 22, and field 31 sets what the web app may do with the key. * Preferences: write only the settings the user chose The app cannot read fields 21, 22, 30 or 31 back from the key, so the form no longer starts from assumed values. Nothing is selected until the user picks it, and Save writes only the families picked; if a later write fails, the error says which were already saved. Webcrypt Access is one choice (stored and derived keys, derived keys only, off) instead of two checkboxes, so 0x03 is no longer sent and the legacy off state survives until the user saves a choice. Fields 30 and 31 are shown only on firmware 3.1.0 and later; older firmware gives no reply to them. Help icons sit beside the choices, not inside their labels. Tests cover the OKSETSLOT bytes for fields 30 and 31, and the mock requires config mode for them.
Lockfile: follow-redirects 1.16.1 and vite 7.3.7.
…n-rewrite # Conflicts: # .gitignore # package-lock.json
|
@onlykey The README on this branch still mixes the 6.0 desktop app with the old Chrome-app install steps. Proposed text is below. It is not committed. Three calls I would like from you:
OnlyKey AppThis is the official app for OnlyKey. OnlyKey can be purchased here: OnlyKey order Getting StartedJust getting started with OnlyKey? AboutOnlyKey App is the desktop app for an OnlyKey or OnlyKey Duo. Use it to:
The app is required on any computer where OATH-TOTP (Google Authenticator) codes are used. Windows, macOS, and Linux installers are on the releases page. Closing the window hides the app in the system tray. The app can also start with the computer. For how to use the app, see the OnlyKey User's Guide or the OnlyKey DUO User's Guide. InstallationDesktop app (Windows, macOS, Linux)
Linux users installing the ChromeOS and some ARM systems This repository is the Windows, macOS, and Linux desktop app. Where that app cannot be installed, the app install guide covers the Chrome app, which has a smaller feature set. SupportCheck out the OnlyKey Support Forum Check out the OnlyKey Documentation Developer NotesOnlyKey App 6.0.0 is a React 19 + TypeScript app, built with Vite 7 and run in NW.js 0.104.1. NW.js stays on 0.104.1 because tray menu clicks do not work on 0.105 or later.
To run with Vite HMR: To build the project: To run tests: Unit tests do not require NW.js. Desktop tests use the NW.js runtime from To create a release installer, run this on the OS you are packaging: The installer is written to the
Cryptography NoticeThis distribution includes cryptographic software. The country in which you currently reside may have restrictions on the import, possession, use, and/or re-export to another country, of encryption software. The U.S. Government Department of Commerce, Bureau of Industry and Security (BIS), has classified this software as Export Commodity Control Number (ECCN) 5D002.C.1, which includes information security software using or performing cryptographic functions with asymmetric algorithms. The following cryptographic software is included in this distribution: "OpenPGP.js - OpenPGP JavaScript Implementation." - https://openpgpjs.org/ For more information on export restrictions see: http://www.apache.org/licenses/exports/ Source |
Summary
OnlyKey App 6.0.0 replaces the Chrome-app tree (
app/,tasks/) with a React desktop app. The HID protocol is unchanged. Device I/O goes throughOnlyKeyDeviceonly.132 commits. 1,397 files, +37,141 / −15,757 vs
master.npm ciis clean.npm auditandnpm audit --omit=optionalreport no vulnerabilities. Lockfile isfollow-redirects1.16.1 andvite7.3.7.master's lockfile commit is merged; this branch's lockfile and.gitignoreare the ones kept.Stack
package-lock.jsonis committedApp
Desktop
desktopInject.js→desktopBg.cjs). Close hides to the trayonlykey-launch, tray menu is rebuilt rather than mutatedhdiutil(noappdmg). Tray paths resolve inside the bundleUpdates
npm run releasewrites per-OS manifest fragments (sha256 and size)Firmware 3.1.0 preferences
Included from #244:
Protocol fixes
Behavior aligned with the 5.6 app:
CI
Test plan
npm ciandnpm audit --omit=optionalnpm testnpm starton OnlyKey and Duo: unlock, slots, keys, backup, preferences