0.194.0: far more prominent encryption key-loss warnings

README.md

@@ -119,10 +119,22 @@ and out of the way when you don't:
   (`.zip` / `.tar.gz` / `.stash`) — Google's vendor-neutral Markdown format for handing
   curated knowledge to LLMs and agents. See [`docs/okf-guide.md`](docs/okf-guide.md).
 
-> 🔒 **On encryption:** it was written by an AI assistant and has **not** been
-> human-audited or security-tested. Treat it as a way to deter a casual snoop, **not**
-> a guarantee — don't rely on it for anything sensitive, and keep unencrypted backups.
-> It's optional and off by default.
+> 🔒 **On encryption — read before you encrypt anything.**
+>
+> **Save your folder password in a password manager first.** "Remember on this device
+> (keychain)" is a convenience, **not a backup**. An OS or keychain reset, a
+> wiped/restored profile, a reinstall, a new machine, or an IT event can erase it at
+> any time, without warning. If that was the only copy of your password, everything
+> encrypted under it is permanently unreadable — by you, by us, by anyone. Setting a
+> **Recovery password** as a second way in is strongly recommended.
+>
+> The encryption was also written by an AI assistant and has **not** been human-audited
+> or security-tested. Treat it as a way to deter a casual snoop, **not** a guarantee —
+> don't rely on it for anything sensitive, and keep unencrypted backups. It's optional
+> and off by default.
+>
+> *Stashpad cannot recover keys or passwords, and is not liable for the loss of keys,
+> passwords, or any data encrypted with them.*
 
 ## Feedback
 

manifest.json

@@ -1,7 +1,7 @@
 {
 	"id": "stashpad",
 	"name": "Stashpad",
-	"version": "0.193.0",
+	"version": "0.194.0",
 	"minAppVersion": "1.13.0",
 	"description": "A chat-style, nested-notes workspace: rapid capture, outliner navigation, fast search, tasks, and per-folder templates, with one-click Open Knowledge Format (OKF) export for LLMs and agents.",
 	"author": "Human",

package.json

@@ -1,6 +1,6 @@
 {
 	"name": "stashpad-obsidian",
-	"version": "0.193.0",
+	"version": "0.194.0",
 	"private": true,
 	"scripts": {
 		"dev": "node esbuild.config.mjs",

release-notes/0.194.0.md

@@ -0,0 +1,19 @@
+# 0.194.0
+
+## Encryption warnings
+
+Prompted by a real loss: a server/profile reset wiped a machine's OS keychain and took
+the only copy of a folder password with it.
+
+- **The keychain is called out as a convenience, not a backup.** "Remember on this
+  device (keychain)" now says so at the moment you tick it: an OS or keychain reset, a
+  wiped or restored profile, a reinstall, a new machine, or an IT event can erase it at
+  any time, without warning — and if that was the only copy of your password,
+  everything encrypted under it is permanently unreadable.
+- **"Save it in a password manager first" leads the warning**, in larger, bolder type,
+  ahead of everything else — along with a nudge to set a **Recovery password** as a
+  second way in. Both live outside the keychain, so they survive the events above.
+- The encryption warning callout is **larger and more prominent** overall, and the same
+  warning now appears in the README and in the password-setup dialog.
+- Added plainly: **Stashpad cannot recover keys or passwords, and is not liable for the
+  loss of keys, passwords, or any data encrypted with them.**

src/modals.ts

@@ -1972,7 +1972,10 @@ export class EncryptionPasswordModal extends Modal {
       const lbl = row.createEl("label", { text: "Remember on this device (keychain) — auto-unlock here without re-typing." });
       lbl.htmlFor = rememberCb.id;
       const note = this.contentEl.createDiv({ cls: "stashpad-export-remember-note" });
-      note.setText("Stored only in this device's keychain — doesn't sync to your other devices. Anyone with access to this unlocked device + keychain could decrypt.");
+      // 0.194.0: this checkbox is where people accidentally make the keychain the
+      // ONLY copy of their password. Say so here, at the moment of the decision.
+      note.setText("Stored only in this device's keychain — it doesn't sync, and anyone with access to this unlocked device could decrypt. This is a convenience, NOT a backup: an OS/keychain reset, a restored profile, a reinstall or a new machine can erase it without warning. Keep the password in a password manager too, or you will lose access to everything encrypted under it.");
+      note.addClass("stashpad-keychain-note");
       note.setCssStyles({ display: rememberCb.checked ? "" : "none" });
       rememberCb.onchange = () => { note.setCssStyles({ display: rememberCb!.checked ? "" : "none" }); };
     }

src/settings.ts

@@ -1108,7 +1108,7 @@ export class StashpadSettingTab extends PluginSettingTab {
   }
   private promptSetFolderPassword(folder: string): void {
     new EncryptionPasswordModal(this.app, { mode: "setup", offerKeychain: true, title: `Set password for “${folder.split("/").pop()}”`,
-      intro: "A separate password just for this folder. Share it with collaborators out-of-band (a password manager, Signal, in person). There is NO recovery if it's lost.",
+      intro: "A separate password just for this folder. Save it in a password manager BEFORE you continue — the device keychain is a convenience that can be wiped at any time, not a backup. There is NO recovery if it's lost: Stashpad cannot recover it, and everything encrypted under it becomes permanently unreadable.",
       onSubmit: async ({ next, remember }) => { if (!next) return "Enter a password."; try { await this.plugin.encryption.setupFolderKey(folder, next, this.folderKeyLabel(folder), remember); } catch (e) { return (e as Error).message; } new Notice("Folder password set — share it securely."); this.update?.(); this.pfeRerender?.(); return null; } }).open();
   }
   private promptChangeFolderPassword(folder: string): void {
@@ -1656,7 +1656,7 @@ export class StashpadSettingTab extends PluginSettingTab {
     const enc = this.plugin.encryption;
     const items: SettingDefinitionItem[] = [];
 
-    items.push(this.sectionDef("Vault Encryption", "Set one password to encrypt content in this vault. Stored only on this device — there is no recovery if you lose it.", (host) => {
+    items.push(this.sectionDef("Vault Encryption", "Encrypt notes per folder with a password you choose. Keep that password in a password manager — there is no recovery if it is lost.", (host) => {
       host.addClass("stashpad-encryption-section");
       const betaRow = host.createDiv({ cls: "stashpad-beta-row" });
       betaRow.createEl("span", { cls: "stashpad-beta-badge", text: "BETA" });
@@ -1665,6 +1665,20 @@ export class StashpadSettingTab extends PluginSettingTab {
       // a ⚠️ description paragraph here, and a "no recovery" callout at the top
       // of the per-folder section). Same .stashpad-enc-warning callout style.
       const warn = host.createEl("div", { cls: "stashpad-enc-warning" });
+      // 0.194.0: keychain loss leads, because it's the failure that actually happens.
+      // (Real incident: a server/profile reset wiped the OS keychain and took the only
+      // copy of a folder password with it.) The key itself lives in the folder's
+      // `.stashkey`; the keychain only ever held a CONVENIENCE copy of the password —
+      // so if that copy was the only one, the content is gone.
+      warn.createEl("p", { cls: "stashpad-enc-lead" }).setText(
+        "⚠️ Write your password down somewhere outside this computer — a password manager — BEFORE you encrypt anything.",
+      );
+      warn.createEl("p").setText(
+        "“Remember on this device (keychain)” is a convenience, NOT a backup. An OS or keychain reset, a wiped/restored profile, a reinstall, a new machine, or an IT/server event can erase it at any time, without warning and without asking you. If the only copy of your password was in the keychain, everything encrypted under it is permanently unreadable — by you, by us, by anyone.",
+      );
+      warn.createEl("p").setText(
+        "Store the password in a password manager (1Password, Bitwarden, KeePass…), and set a Recovery password as a second way in. Both are stored outside the keychain, so they survive the events above.",
+      );
       warn.createEl("p").setText(
         "⚠️ AI-built, NOT human-audited. This encryption was written by an AI assistant — not reviewed or security-audited by a human. Treat it as best-effort protection against a casual snoop, not a guarantee — and always keep your own unencrypted backups of anything important.",
       );
@@ -1674,6 +1688,9 @@ export class StashpadSettingTab extends PluginSettingTab {
       warn.createEl("p").setText(
         "Each device unlocks with its own password (it never leaves the device); collaborators get access by device approval, not a shared password. If everyone with access loses their password, the content is unrecoverable. While encrypting or decrypting, avoid having a sync/cloud service write the vault mid-operation — it can corrupt files.",
       );
+      warn.createEl("p", { cls: "stashpad-enc-liability" }).setText(
+        "Stashpad cannot recover keys or passwords, and is not liable for the loss of keys, passwords, or any data encrypted with them. Backing them up is yours to do.",
+      );
 
       // 0.137.4: ONE collapsible, toggle-free "how it works" reference block, so
       // the individual setting rows below can stay one-liners instead of each

styles.css

@@ -6090,11 +6090,30 @@ body.stashpad-folderpanel-resizing { cursor: row-resize; user-select: none; }
      Vault Encryption section (was three separate warnings) — inset 14px to
      line up with the section's setting rows. */
   margin: 4px 14px 18px;
-  font-size: 13px;
-  line-height: 1.5;
+  /* 0.194.0: bumped 13px -> 14px and the rule 3px -> 4px. A user lost an encryption
+     key to a keychain wipe; this callout is the last thing standing between someone
+     and permanent data loss, so it gets read-me-first weight. */
+  font-size: 14px;
+  line-height: 1.55;
 }
 .stashpad-enc-warning p { margin: 0; }
-.stashpad-enc-warning p + p { margin-top: 8px; }
+.stashpad-enc-warning p + p { margin-top: 9px; }
+/* The single most important sentence in the plugin — larger and bolder than the
+   paragraphs beneath it. */
+.stashpad-enc-warning .stashpad-enc-lead {
+  font-size: 15px;
+  font-weight: 600;
+  line-height: 1.45;
+}
+.stashpad-enc-warning strong { color: var(--text-normal); font-weight: 700; }
+/* Liability line: quieter than the warnings, but unmissable. */
+.stashpad-enc-warning .stashpad-enc-liability {
+  margin-top: 11px;
+  padding-top: 9px;
+  border-top: 1px solid rgba(var(--color-red-rgb, 224, 49, 49), 0.35);
+  font-size: 13px;
+  font-style: italic;
+}
 /* 0.137.4: collapsible "how encryption works" concepts block — one toggle-free
    reference so the individual setting rows can stay one-liners. Collapsed by
    default (details), neutral (not a warning). */
@@ -6229,3 +6248,15 @@ button.stashpad-btn-loading::after {
 .stashpad-import-view .stashpad-import-preview { max-height: none; }
 .stashpad-import-popicon { display: inline-flex; margin-left: 4px; vertical-align: -2px; }
 .stashpad-import-popicon svg { width: 14px; height: 14px; }
+
+/* 0.194.0 — the keychain opt-in note carries a real data-loss warning now, so it
+   gets warning colour instead of reading as neutral fine print. */
+.stashpad-keychain-note {
+  color: var(--text-normal);
+  border-left: 3px solid var(--color-red, #e03131);
+  background: rgba(var(--color-red-rgb, 224, 49, 49), 0.10);
+  padding: 8px 10px;
+  border-radius: 4px;
+  margin-top: 6px;
+  line-height: 1.5;
+}