pock

pock://changelog

Changelog

Everything that shipped, in plain language. Over a few weeks Pock went from a shared crypto core to a full password manager, desktop apps, and end-to-end encrypted chat.

  1. web

    See how chat encryption works, live

    • A new interactive explainer at /how-chat-works runs the real cryptography in your browser: follow a message's journey end to end, watch channel keys get created and rotated, and step through the post-quantum X-Wing handshake.
    • Search engines get a proper map of the site: sitemap, structured data, and canonical URLs. Private, per-user pages are explicitly kept out of search results.
  2. chat

    Chat verifies keys before it trusts them

    • Key transparency in chat: before your device encrypts to a teammate, their key is checked against Pock's public key log. A substituted key is blocked instead of silently trusted.
    • Opening chat now lands on a proper home screen instead of "pick a channel."
    • Security details across the chat UI now say what's protected and how, in plain language instead of warning icons.
  3. chat

    Replies, mentions, encrypted profiles, notifications

    • Message replies, markdown formatting, and @mentions.
    • End-to-end encrypted profiles: set a display name and avatar for everywhere or per server, sealed on your device like everything else, so the server never sees them.
    • Notifications now reach you across channels, with unread badges; the desktop app shows counts on its dock icon and tab.
    • Everything feels faster: messages send instantly, the composer grows as you type, you can paste images straight into a message, and photos open in a lightbox.
  4. vault

    Simpler onboarding: your face + one recovery kit

    • Passkey-first unlock: Touch ID / Face ID is now the primary way into your vault, backed by a single downloadable recovery kit.
    • A guided, plain-language onboarding flow. The same recovery kit works on the web, the desktop app, and the CLI.
    • The desktop login was reworked as a vault door: an animated seal that makes the something-you-know + something-you-have model visible.
    • Chat hardening: closed a hole that let members be listed too broadly, and remote images in messages are now click-to-load so they can't quietly ping third-party servers.
  5. desktop

    Chat comes to the desktop app

    • Vault and chat now live side by side in one window with an app rail: sign in once and both surfaces share it.
    • The app keeps itself current: it checks for signed releases and updates with one click.
    • A release pipeline builds signed macOS, Windows, and Linux installers automatically.
    • Chat picked up link previews, drag-and-drop attachments, and message reactions along the way.
  6. chat

    chat.pock.sh: end-to-end encrypted team chat

    • A Discord-style chat where the server can't read anything: messages, images, and files are sealed on your device before they leave it.
    • Teams got easier: create an organization, switch between them, and invite teammates without leaving the app. Shared secrets automatically re-encrypt when membership changes.
    • The vault gained a full key-rotation suite, encrypted binary backups, and per-item history you can browse.
    • A new /download page and a consolidated navigation across the site.
  7. cli

    Pock for CI and coding agents

    • Scoped machine identities: mint a key that can only read the secrets a job needs. `pock vault machine --github owner/repo` provisions it straight into GitHub Actions secrets.
    • `pock run -e staging` injects an environment's secrets as env vars around any command.
    • Recovery codes now actually unlock your vault, and you can use one to reset a forgotten passphrase.
    • Deleted items go to a trash and can be restored, and you can export your vault whenever you want.
    • Task-oriented recipes at /guides, plus a dedicated setup page for AI agents.
  8. desktop

    Desktop app v1, Touch ID, and tamper-evidence

    • The Pock desktop app arrived: the full vault (passwords, editor, generator, 2FA codes, health) with native Touch ID / biometric unlock.
    • Tamper-evidence work: every release is recorded in a public transparency log, the cryptography runs in an isolated, independently verifiable origin (crypto.pock.sh), and the native app can vouch for the web app it loads.
    • The browser extension learned to autofill, save new logins, generate passwords, and show live 2FA codes.
    • Send a secret: self-expiring, end-to-end encrypted share links for any file type.
    • A second security audit turned up 8 findings, all fixed the same day.
  9. vault

    The vault becomes a password manager

    • Typed items (logins, notes, and more) with password and passphrase generators, built-in 2FA codes, and import from other password managers and .env files.
    • Vault Health: see reused, weak, and breached passwords at a glance and fix them with one tap.
    • Key trust: teammates' keys are pinned on first use and recorded in a public transparency log, so a swapped key can't go unnoticed.
    • Team namespaces with shared secrets encrypted to each member, plus optional extra protection (passphrase or 2FA prompt) on sensitive namespaces, with a security audit log.
    • The first browser-extension release (unlock, view, copy), and the first security audit: 9 findings, all fixed.
  10. vault

    The web vault: unlock with Touch ID

    • Create and unlock a vault entirely in the browser, with your passphrase, your Secret Key, or just Touch ID / Face ID.
    • Enroll multiple passkeys, one per device, and manage them from your profile.
    • Opt-in stay-unlocked with a 30-minute idle auto-lock for people who unlock often.
    • Six plain-language articles landed at /about explaining how the crypto actually works.
  11. core

    New foundations: one crypto core, post-quantum by default

    • All of Pock now runs on a single Rust crypto core (pock-core), shared by the CLI, the web app, and later the desktop app: one implementation to test and audit instead of three.
    • Share links gained X-Wing, a hybrid post-quantum cipher, so what you share today stays sealed against tomorrow's quantum computers.
    • The zero-knowledge vault went end to end: `pock vault init / set / get / run` round-trips through a server that only ever sees ciphertext.

Curated from the commit history; dates are when the work landed on main. For how the cryptography works, see /security and /how-chat-works.