2 Commits

Include renames

Author	SHA1	Message	Date
grenadeandClaude Fable 5.1	7101ead194	feat(ui): onboarding: create a phrase, restore one, or open a quantus-cli file ... Three routes under /onboarding, reachable from the lock screen and from the shell, since a second wallet is the same flow as the first. Create picks a scheme (ML-DSA-65 by default), shows the 24 words once, and stands the backup challenge between seeing them and having a wallet; a failed challenge drops the phrase on the Rust side and starts over. Restore takes a phrase and a scheme, with a note that the same phrase gives a different account under each. Import opens a native file chooser through tauri-plugin-dialog, the first plugin, granted only dialog:allow-open with its reason in the capability file; the path goes to Rust, which reads the file. Every path ends unlocked on the accounts page. Driven through the WebKit inspector against the dev node: create wrote onboard_test.json and unlocked; restoring the same phrase under a new name produced the same address; importing a fixture file with the right password opened it and with a wrong one mapped to wrong_password. The chooser itself is a Wayland window nothing here can type into, so the permission is verified by the open promise staying pending rather than rejecting; CLAUDE.md and the inspector script now say so. Closes #26 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014ftBXYuba8ARhQeF74oUgW	2026-09-15 23:29:27 +03:00
grenadeandClaude Fable 5.1	2fcc519215	fix(app): a dev CSP so the Vite page renders, one data directory, and a way to verify the webview ... Running the shell for the first time showed a blank white window and no error anywhere: Vite's dev page injects an inline React Refresh preamble, the production CSP forbids inline scripts, and every component module then throws on `$RefreshReg$` before React mounts. `tauri.conf.json` now carries a `devCsp` for the dev server's origin; the production CSP is unchanged. `WALLET_DATA_DIR` relocates wallets, settings and profile overrides together, so a dev run lives in a throwaway directory instead of the real app data; `WALLET_KEYSTORE_DIR` still moves only the wallets, for sharing them with quantus-cli in place. Verified end to end against the local dev node by driving the webview through WebKitGTK's remote inspector (`script/webview-inspect.py`, kept with the reason in CLAUDE.md): the lock screen lists both dev accounts; unlocking crystal_alice shows 99,957.786510548 DEV at block 1832, 100 from final, with the status bar on ws://127.0.0.1:9944 at spec 152; the block number advances on its own; a settings change lands in settings.json; the idle rule locks the UI without a click after the configured minute and the Rust log says so; the Lock button locks; the console shows nothing but Vite connecting. GNOME refuses D-Bus screenshots and ImageMagick captures WebKit's GPU surface as flat grey, so the DOM was the evidence. Refs #25 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014ftBXYuba8ARhQeF74oUgW	2026-09-15 23:18:03 +03:00