Skip to content

Derived X-Wing: device-side decapsulation; drop vault and password generator from production #4

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
0c-coder merged 19 commits into from
Sep 16, 2026
Merged

Derived X-Wing: device-side decapsulation; drop vault and password generator from production #4

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
19 commits
Select commit Hold shift + click to select a range
61f4c70
Drop the DERIVE_*_REQ_PRESS opcodes; press_required is now ignored
claude Sep 10, 2026
740f1c9
Remove the dead history module
claude Sep 10, 2026
024a2a2
Drop vault and password-generator from production builds
claude Sep 14, 2026
2727c24
Derived X-Wing: the device holds both halves now
claude Sep 14, 2026
483de91
Rename: web derivation -> web and agent derivation
claude Sep 14, 2026
8064b46
Ship the PQC pages in production; drop chat and password-generator; r…
onlykey Sep 15, 2026
f5d068a
Keep console output on while onlyagent.app is the test site
onlykey Sep 15, 2026
74baec5
Fix console service: swap console.js for console_debug.js, not delete it
onlykey Sep 15, 2026
6712b5c
TEMP: dev build to A/B test production-only FIDO2 connect hang
onlykey Sep 15, 2026
46f4de4
TEMP: XWTRACE instrumentation in the X-Wing derive path (not for merge)
onlykey Sep 15, 2026
699030d
TEMP dev build: reassemble the X-Wing ciphertext before decrypting it
onlykey Sep 15, 2026
79bc36e
TEMP dev build: decrypt the derived X-Wing shared secret in transit
onlykey Sep 15, 2026
5bb062e
TEMP dev build: adopt the transit key the derive establishes
onlykey Sep 15, 2026
2a5a2a3
TEMP: probe encap ss vs decap raw/decrypted (not for merge)
onlykey Sep 15, 2026
3830515
TEMP: probe ct at encaps vs at decaps (not for merge)
onlykey Sep 15, 2026
4b5110e
Production build; drop the XWTRACE probes, keep the three derive fixes
onlykey Sep 16, 2026
fca5ab6
FIDO2 transit: counter IV and a verified tag, instead of one keystream
onlykey Sep 16, 2026
6fed30f
Open the PQC composite responses, now that the device seals them
onlykey Sep 16, 2026
452803c
Merge pull request #5 from 0c-coder/security/transit-v2
0c-coder Sep 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Binary file added .DS_Store
View file
Open in desktop
Binary file not shown.
76 changes: 1 addition & 75 deletions docs/app/age-derive.html
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,75 +1 @@
<!DOCTYPE html><html><head><meta http-equiv="Content-Security-Policy" content="base-uri 'none'; object-src 'none'; script-src 'self' 'unsafe-eval' 'nonce-/U4aw5LeqftmlF1cHX6h0w=='; style-src 'self' 'unsafe-eval' 'nonce-4mVTYMznb9Nh/DsRWKIHEg==' 'nonce-RhjqR+Yq8/IrtTn9EBlVGw==' 'nonce-4QcEry5gptCNZjtuLrCc+Q==' 'nonce-F361huZoc5y5WenDwXMmMQ=='; default-src 'self'; img-src 'self' data: https://www.gravatar.com https://raw.githubusercontent.com/keybase/client/master/browser/images/icon-keybase-logo-128.png https://s3.amazonaws.com/keybase_processed_uploads/; connect-src 'self' https://keybase.io https://onlykey.herokuapp.com wss://onlykey.herokuapp.com">
<title>OnlyAgent — Encrypt &amp; sign in your browser</title>
<meta name="viewport" content="width=device-width,initial-scale=1">
<link href="css/bootstrap.min.css" rel="stylesheet" nonce="4mVTYMznb9Nh/DsRWKIHEg==">
<link href="css/font-awesome.min.css" rel="stylesheet" nonce="RhjqR+Yq8/IrtTn9EBlVGw==">
<link href="css/onlyagent-theme.css" rel="stylesheet" nonce="4QcEry5gptCNZjtuLrCc+Q==">
<link href="css/tokenizer.css" rel="stylesheet" nonce="F361huZoc5y5WenDwXMmMQ==">
</head>

<body data-page="age-derive">
<header class="oa-nav"><div class="inner">
<a class="oa-brand" href="/"><span class="oa-dot"></span> OnlyAgent</a>
<nav class="oa-navlinks">

<a href="./encrypt"><i class="fa fa-lock" aria-hidden="true"></i><span>encrypt</span></a>

<a href="./decrypt"><i class="fa fa-unlock" aria-hidden="true"></i><span>decrypt</span></a>

<a href="./encrypt-file"><i class="fa fa-file-archive-o" aria-hidden="true"></i><span>encrypt-file</span></a>

<a href="./decrypt-file"><i class="fa fa-file-text" aria-hidden="true"></i><span>decrypt-file</span></a>

<a href="./search"><i class="fa fa-search" aria-hidden="true"></i><span>search</span></a>

<a href="./pgp-pqc"><i class="fa fa-lock" aria-hidden="true"></i><span>pgp-pqc</span></a>

<a href="./age-derive" class="active"><i class="fa fa-lock" aria-hidden="true"></i><span>age-derive</span></a>

<a href="./password-generator"><i class="fa fa-key" aria-hidden="true"></i><span>password-generator</span></a>

<a href="./vault"><i class="fa fa-shield" aria-hidden="true"></i><span>vault</span></a>

<a href="./chat"><i class="fa fa-comments-o" aria-hidden="true"></i><span>chat</span></a>

<span class="sep"></span>
<a href="/"><i class="fa fa-home" aria-hidden="true"></i><span>Home</span></a>
<a href="https://docs.crp.to"><i class="fa fa-question" aria-hidden="true"></i><span>Help</span></a>
<a href="https://onlyagent.us"><i class="fa fa-shopping-cart" aria-hidden="true"></i><span>Get OnlyAgent</span></a>
</nav>
</div></header>

<main class="oa-main">
<div class="oa-page-head">
<h1 id="fancy-icons">
<i class="fi-a fa fa-paper-plane" aria-hidden="true"></i>
<i class="fi-b fa fa-long-arrow-right" aria-hidden="true"></i>
<i class="fi-c fa fa-lock" aria-hidden="true"></i>
</h1>
<div id="header_messages"></div>
</div>

<div id="container" class="oa-content">
<div class="text-center">
<h1>Loading...</h1>
<noscript>
<h2 class="text-danger">This App Requires JavaScript to work.</h2>
</noscript>
</div>
</div>
<div id="container">
<div id="terminal_messages"></div>
</div>
</main>

<footer class="oa-footer"><div class="inner">
<div><a href="https://crp.to/">CryptoTrust LLC</a> © 2026 · OnlyAgent</div>
<div style="display:flex;gap:20px;flex-wrap:wrap">
<a href="https://onlyagent.us">onlyagent.us</a>
<a href="https://docs.crp.to">Help</a>
</div>
</div></footer>
<script src=".././app/bundle.ec54b1a2108ecf924f09.js" nonce="/U4aw5LeqftmlF1cHX6h0w=="></script>


</body></html>
<!DOCTYPE html><html><head><meta http-equiv="Content-Security-Policy" content="base-uri 'none'; object-src 'none'; script-src 'self' 'unsafe-eval' 'nonce-vg5nCNv+Nbf4feXQx2fohQ=='; style-src 'self' 'unsafe-eval' 'nonce-Vy4agJrxDhhKSniKWScbOg==' 'nonce-1C3R3+ZoZ6gp9QkJL9BOOA==' 'nonce-6qflvDRYCMbWpXgLDbaUnA==' 'nonce-CRwUITBnC0eVS34JMI2a+A=='; default-src 'self'; img-src 'self' data: https://www.gravatar.com https://raw.githubusercontent.com/keybase/client/master/browser/images/icon-keybase-logo-128.png https://s3.amazonaws.com/keybase_processed_uploads/; connect-src 'self' https://keybase.io https://onlykey.herokuapp.com wss://onlykey.herokuapp.com"><title>OnlyAgent — Encrypt &amp; sign in your browser</title><meta name="viewport" content="width=device-width,initial-scale=1"><link href="css/bootstrap.min.css" rel="stylesheet" nonce="Vy4agJrxDhhKSniKWScbOg=="><link href="css/font-awesome.min.css" rel="stylesheet" nonce="1C3R3+ZoZ6gp9QkJL9BOOA=="><link href="css/onlyagent-theme.css" rel="stylesheet" nonce="6qflvDRYCMbWpXgLDbaUnA=="><link href="css/tokenizer.css" rel="stylesheet" nonce="CRwUITBnC0eVS34JMI2a+A=="></head><body data-page="age-derive"><header class="oa-nav"><div class="inner"><a class="oa-brand" href="/"><span class="oa-dot"></span> OnlyAgent</a><nav class="oa-navlinks"><a href="./encrypt"><i class="fa fa-lock" aria-hidden="true"></i><span>encrypt</span></a> <a href="./decrypt"><i class="fa fa-unlock" aria-hidden="true"></i><span>decrypt</span></a> <a href="./encrypt-file"><i class="fa fa-file-archive-o" aria-hidden="true"></i><span>encrypt-file</span></a> <a href="./decrypt-file"><i class="fa fa-file-text" aria-hidden="true"></i><span>decrypt-file</span></a> <a href="./search"><i class="fa fa-search" aria-hidden="true"></i><span>search</span></a> <a href="./pgp-pqc"><i class="fa fa-lock" aria-hidden="true"></i><span>pgp-pqc</span></a> <a href="./age-derive" class="active"><i class="fa fa-lock" aria-hidden="true"></i><span>age-derive</span></a> <span class="sep"></span> <a href="/"><i class="fa fa-home" aria-hidden="true"></i><span>Home</span></a> <a href="https://docs.crp.to"><i class="fa fa-question" aria-hidden="true"></i><span>Help</span></a> <a href="https://onlyagent.us"><i class="fa fa-shopping-cart" aria-hidden="true"></i><span>Get OnlyAgent</span></a></nav></div></header><main class="oa-main"><div class="oa-page-head"><h1 id="fancy-icons"><i class="fi-a fa fa-paper-plane" aria-hidden="true"></i> <i class="fi-b fa fa-long-arrow-right" aria-hidden="true"></i> <i class="fi-c fa fa-lock" aria-hidden="true"></i></h1><div id="header_messages"></div></div><div id="container" class="oa-content"><div class="text-center"><h1>Loading...</h1><noscript><h2 class="text-danger">This App Requires JavaScript to work.</h2></noscript></div></div><div id="container"><div id="terminal_messages"></div></div></main><footer class="oa-footer"><div class="inner"><div><a href="https://crp.to/">CryptoTrust LLC</a> © 2026 · OnlyAgent</div><div style="display:flex;gap:20px;flex-wrap:wrap"><a href="https://onlyagent.us">onlyagent.us</a> <a href="https://docs.crp.to">Help</a></div></div></footer><script src=".././app/bundle.25696c3cb9729a3b4dad.js?25696c3cb9729a3b4dad" nonce="vg5nCNv+Nbf4feXQx2fohQ=="></script></body></html>
Loading
Loading