Enable credential complementation by d2dyno1 · Pull Request #124 · securefolderfs-community/SecureFolderFS

d2dyno1 · 2026-04-30T22:31:05Z

No description provided.

Copilot

Pull request overview

Adds support for “credential complementation” (unlocking a vault using an alternative credential such as a key file/biometric) by persisting and consuming a complementation shares file, and updates UI + tests to exercise the new flow.

Changes:

Introduces a new vault complementation shares artifact (sfcomplement.sfsconfig) and cryptographic wrap/unwrap logic for complemented unlock.
Adds a new ModifyComplementationAsync path (routine + SDK service surface) and updates unlock logic to support alternative credentials.
Updates login/credentials UI to surface alternative login options and adds NUnit coverage for complementation scenarios.

Reviewed changes

Copilot reviewed 29 out of 29 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
tests/SecureFolderFS.Tests/VaultTests/CredentialTests.cs	Adds tests for add/replace/remove complementation and primary-change scenarios.
tests/SecureFolderFS.Tests/CliTests/CommandDiscoveryTests.cs	Updates CliFx namespace usage for command discovery.
tests/SecureFolderFS.Tests/CliTests/CliTestHost.cs	Updates CliFx app builder usage and command registration style.
src/Shared/SecureFolderFS.Shared/Models/ComplementationCredentials.cs	Adds model for passing current/new primary/new complement credentials into complementation routine.
src/Sdk/SecureFolderFS.Sdk/ViewModels/Views/Credentials/CredentialsSelectionViewModel.cs	Changes UI flagging for whether complementation is available based on selected auth VM capability.
src/Sdk/SecureFolderFS.Sdk/ViewModels/Views/Credentials/CredentialsConfirmationViewModel.cs	Routes certain credential changes through the new complementation routine and builds complementation credentials.
src/Sdk/SecureFolderFS.Sdk/ViewModels/Controls/LoginViewModel.cs	Adds “alternative login” UI mode and selection handling for complemented vaults.
src/Sdk/SecureFolderFS.Sdk/Services/IVaultManagerService.cs	Adds `ModifyComplementationAsync` to the SDK service interface.
src/Platforms/SecureFolderFS.Uno/Views/Vault/VaultLoginPage.xaml	Wires new alternative-login bindings into Uno login options.
src/Platforms/SecureFolderFS.Uno/UserControls/LoginOptions.xaml.cs	Adds dependency properties + handler for authentication option selection.
src/Platforms/SecureFolderFS.Uno/UserControls/LoginOptions.xaml	Adds ComboBox UI for selecting among alternative authentication options.
src/Platforms/SecureFolderFS.Uno/UserControls/InterfaceRoot/VaultPreviewRootControl.xaml	Wires alternative-login bindings in preview root login options.
src/Platforms/SecureFolderFS.Uno/Platforms/Windows/ServiceImplementation/WindowsVaultCredentialsService.cs	Enumerates login methods including complementation.
src/Platforms/SecureFolderFS.Uno/Platforms/MacCatalyst/ServiceImplementation/MacOsVaultCredentialsService.cs	Enumerates login methods including complementation.
src/Platforms/SecureFolderFS.Uno/Platforms/Desktop/ServiceImplementation/SkiaVaultCredentialsService.cs	Enumerates login methods including complementation.
src/Platforms/SecureFolderFS.Uno/Dialogs/CredentialsDialog.xaml	Adjusts complementation checkbox presentation in credentials dialog.
src/Platforms/SecureFolderFS.UI/ViewModels/Authentication/KeyFileViewModel.cs	Enables key file authentication to be used as a complement.
src/Platforms/SecureFolderFS.UI/ServiceImplementation/VaultManagerService.cs	Implements `ModifyComplementationAsync` by invoking the new core routine.
src/Platforms/SecureFolderFS.UI/ServiceImplementation/BaseVaultCredentialsService.cs	Adds shared helper to enumerate methods + complementation for login view model creation.
src/Platforms/SecureFolderFS.Maui/Platforms/iOS/ServiceImplementation/IOSVaultCredentialsService.cs	Enumerates login methods including complementation.
src/Platforms/SecureFolderFS.Maui/Platforms/Android/ServiceImplementation/AndroidVaultCredentialsService.cs	Enumerates login methods including complementation.
src/Core/SecureFolderFS.Core/VaultAccess/VaultWriter.cs	Adds writer for the new complementation shares file.
src/Core/SecureFolderFS.Core/VaultAccess/VaultReader.cs	Adds reader for the new complementation shares file.
src/Core/SecureFolderFS.Core/VaultAccess/VaultParser.cs	Adds HKDF derivation + AES-GCM wrap/unwrap helpers for complementation secrets.
src/Core/SecureFolderFS.Core/Routines/Operational/VaultRoutines.cs	Exposes new `ModifyComplementation()` routine entrypoint.
src/Core/SecureFolderFS.Core/Routines/Operational/UnlockRoutine.cs	Adds complemented unlock path using derived/unwrap complement secret.
src/Core/SecureFolderFS.Core/Routines/Operational/ModifyComplementationRoutine.cs	Adds routine to add/replace/remove complementation and update keystore/config/shares.
src/Core/SecureFolderFS.Core/DataModels/VaultSharesDataModel.cs	Adds data model for persisted complementation shares.
src/Core/SecureFolderFS.Core/Constants.cs	Adds filename constant for the complementation shares file.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

…r explicit separation of primary/complement keys Agent-Logs-Url: https://github.com/securefolderfs-community/SecureFolderFS/sessions/14c473bd-90b2-45f9-97c1-c6b0c6e075b2 Co-authored-by: d2dyno1 <53011783+d2dyno1@users.noreply.github.com>

Copilot · 2026-05-02T14:23:08Z

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

crl.godaddy.com
- Triggering command: /usr/bin/dotnet dotnet restore --no-dependencies /home/REDACTED/work/SecureFolderFS/SecureFolderFS/src/Platforms/SecureFolderFS.Uno/SecureFolderFS.Uno.csproj --packages /tmp/codeql-scratch-d52628fd4f0752cc/dbs/csharp/working/packages /p:DisableImplicitNuGetFallbackFolder=true --verbosity normal /p:TargetFrameworkRootPath=/tmp/codeql-scratch-d52628fd4f0752cc/dbs/csharp/working/emptyFakeDotnetRoot /p:NetCoreTargetingPackRoot=/tmp/codeql-scratch-d52628fd4f0752cc/dbs/csharp/working/emptyFakeDotnetRoot /p:AllowMissingPrunePackageData=true (dns block)
ocsp.godaddy.com
- Triggering command: /usr/bin/dotnet dotnet restore --no-dependencies /home/REDACTED/work/SecureFolderFS/SecureFolderFS/src/Platforms/SecureFolderFS.Uno/SecureFolderFS.Uno.csproj --packages /tmp/codeql-scratch-d52628fd4f0752cc/dbs/csharp/working/packages /p:DisableImplicitNuGetFallbackFolder=true --verbosity normal /p:TargetFrameworkRootPath=/tmp/codeql-scratch-d52628fd4f0752cc/dbs/csharp/working/emptyFakeDotnetRoot /p:NetCoreTargetingPackRoot=/tmp/codeql-scratch-d52628fd4f0752cc/dbs/csharp/working/emptyFakeDotnetRoot /p:AllowMissingPrunePackageData=true (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot

Pull request overview

Copilot reviewed 34 out of 34 changed files in this pull request and generated 8 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 38 out of 38 changed files in this pull request and generated 5 comments.

d2dyno1 · 2026-05-18T16:21:29Z

CI?

d2dyno1 · 2026-05-18T16:25:32Z

@copilot resolve the merge conflicts in this pull request. Aggressively merge changes from branch f_complementation. The original logic from upstream f_vault4 should remain untouched. Halt making changes if unsure.

Co-authored-by: d2dyno1 <53011783+d2dyno1@users.noreply.github.com>

Copilot · 2026-05-18T16:32:45Z

CI?

The latest CI runs on the branch are passing (commits bd63012, 25078f8, a598681, 5f1949b all show success). The in-progress run on 05dd60a was also green. The merge commit 16152bd has now been pushed and CI should trigger on it.

@copilot resolve the merge conflicts in this pull request. Aggressively merge changes from branch f_complementation. The original logic from upstream f_vault4 should remain untouched. Halt making ...

Resolved in commit 16152bd. There were 2 conflicts:

LoginOptions.xaml — kept f_complementation's version (has the full ComboBox + inner StackPanel structure; f_vault4's two checkboxes are already present inside the inner StackPanel).
LoginViewModel.cs — kept f_complementation's refactored InitializeLoginAsync() call; the CanRestoreVault additions from f_vault4 that landed outside the conflict region were already auto-merged cleanly.

All other files merged automatically without conflict.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

crl.godaddy.com
- Triggering command: /usr/bin/dotnet dotnet restore --no-dependencies /home/REDACTED/work/SecureFolderFS/SecureFolderFS/src/Platforms/SecureFolderFS.Uno/SecureFolderFS.Uno.csproj --packages /tmp/codeql-scratch-d52628fd4f0752cc/dbs/csharp/working/packages /p:DisableImplicitNuGetFallbackFolder=true --verbosity normal /p:TargetFrameworkRootPath=/tmp/codeql-scratch-d52628fd4f0752cc/dbs/csharp/working/emptyFakeDotnetRoot /p:NetCoreTargetingPackRoot=/tmp/codeql-scratch-d52628fd4f0752cc/dbs/csharp/working/emptyFakeDotnetRoot /p:AllowMissingPrunePackageData=true conf�� derFS.Uno/ViewModels/YubiKey/YubiKeyCreationViewModel.cs pull.rebase es (dns block)
ocsp.godaddy.com
- Triggering command: /usr/bin/dotnet dotnet restore --no-dependencies /home/REDACTED/work/SecureFolderFS/SecureFolderFS/src/Platforms/SecureFolderFS.Uno/SecureFolderFS.Uno.csproj --packages /tmp/codeql-scratch-d52628fd4f0752cc/dbs/csharp/working/packages /p:DisableImplicitNuGetFallbackFolder=true --verbosity normal /p:TargetFrameworkRootPath=/tmp/codeql-scratch-d52628fd4f0752cc/dbs/csharp/working/emptyFakeDotnetRoot /p:NetCoreTargetingPackRoot=/tmp/codeql-scratch-d52628fd4f0752cc/dbs/csharp/working/emptyFakeDotnetRoot /p:AllowMissingPrunePackageData=true conf�� derFS.Uno/ViewModels/YubiKey/YubiKeyCreationViewModel.cs pull.rebase es (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Copilot

Pull request overview

Copilot reviewed 38 out of 38 changed files in this pull request and generated 3 comments.

Agent-Logs-Url: https://github.com/securefolderfs-community/SecureFolderFS/sessions/7f21ec24-91c8-445f-b546-67ee44448ae4 Co-authored-by: d2dyno1 <53011783+d2dyno1@users.noreply.github.com>

Copilot · 2026-05-18T21:25:06Z

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

crl.godaddy.com
- Triggering command: /usr/bin/dotnet dotnet restore --no-dependencies /home/REDACTED/work/SecureFolderFS/SecureFolderFS/src/Platforms/SecureFolderFS.Uno/SecureFolderFS.Uno.csproj --packages /tmp/codeql-scratch-d52628fd4f0752cc/dbs/csharp/working/packages /p:DisableImplicitNuGetFallbackFolder=true --verbosity normal /p:TargetFrameworkRootPath=/tmp/codeql-scratch-d52628fd4f0752cc/dbs/csharp/working/emptyFakeDotnetRoot /p:NetCoreTargetingPackRoot=/tmp/codeql-scratch-d52628fd4f0752cc/dbs/csharp/working/emptyFakeDotnetRoot /p:AllowMissingPrunePackageData=true (dns block)
ocsp.godaddy.com
- Triggering command: /usr/bin/dotnet dotnet restore --no-dependencies /home/REDACTED/work/SecureFolderFS/SecureFolderFS/src/Platforms/SecureFolderFS.Uno/SecureFolderFS.Uno.csproj --packages /tmp/codeql-scratch-d52628fd4f0752cc/dbs/csharp/working/packages /p:DisableImplicitNuGetFallbackFolder=true --verbosity normal /p:TargetFrameworkRootPath=/tmp/codeql-scratch-d52628fd4f0752cc/dbs/csharp/working/emptyFakeDotnetRoot /p:NetCoreTargetingPackRoot=/tmp/codeql-scratch-d52628fd4f0752cc/dbs/csharp/working/emptyFakeDotnetRoot /p:AllowMissingPrunePackageData=true (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Agent-Logs-Url: https://github.com/securefolderfs-community/SecureFolderFS/sessions/2bad546b-bd5e-4ad9-918d-0f1c2501790e Co-authored-by: d2dyno1 <53011783+d2dyno1@users.noreply.github.com>

d2dyno1 · 2026-05-19T12:55:45Z

@copilot, some of your recent changes have caused the CI to fail. Please readjust your changes.

Agent-Logs-Url: https://github.com/securefolderfs-community/SecureFolderFS/sessions/97747175-69cf-4f84-9b88-ba52b9ef01f2 Co-authored-by: d2dyno1 <53011783+d2dyno1@users.noreply.github.com>

Copilot · 2026-05-19T13:02:05Z

@copilot, some of your recent changes have caused the CI to fail. Please readjust your changes.

Resolved in 2cebcbf. The CI failure was caused by ReadComplementationAsync throwing on missing sfcomplement files; it now returns null only for FileNotFoundException and still propagates other read/parse errors so complementation tests pass.

d2dyno1 added 4 commits May 1, 2026 00:30

Enable complementation

6694289

Merge branch 'master' into f_complementation

2eb49d0

Added Shares

f2fea42

Begin working on complementation

bbacd85

d2dyno1 requested a review from Copilot May 1, 2026 16:46

Copilot started reviewing on behalf of d2dyno1 May 1, 2026 16:47 View session

Copilot AI reviewed May 1, 2026

View reviewed changes

d2dyno1 added 2 commits May 1, 2026 22:14

Fixed tests

986eaba

Added support for complementation on MAUI

09326ad

d2dyno1 mentioned this pull request May 1, 2026

Implemented Vault V4 #106

Draft

8 tasks

d2dyno1 added 4 commits May 2, 2026 11:59

Fix formatting

ee3fa8a

Prefer AES-NI if available

c3a49c7

Fixed complementation detection when saved credentials are discarded

b6fee87

Apply code review

950f7d9

Copilot started work on behalf of d2dyno1 May 2, 2026 14:07 View session

Copilot finished work on behalf of d2dyno1 May 2, 2026 14:23

d2dyno1 requested a review from Copilot May 2, 2026 15:02

Copilot started reviewing on behalf of d2dyno1 May 2, 2026 15:03 View session

Copilot AI reviewed May 2, 2026

View reviewed changes

d2dyno1 requested a review from Copilot May 2, 2026 20:21

Copilot started reviewing on behalf of d2dyno1 May 2, 2026 20:21 View session

Copilot AI reviewed May 2, 2026

View reviewed changes

d2dyno1 added 2 commits May 5, 2026 20:16

Update SystemFolderEx.cs

a598681

Fixed changing primary credentials when complementation is enabled

25078f8

d2dyno1 requested a review from Copilot May 9, 2026 16:18

Copilot started reviewing on behalf of d2dyno1 May 9, 2026 16:19 View session

Copilot AI reviewed May 9, 2026

View reviewed changes

Apply code review

bd63012

Fixed changing first-stage credentials in chained mode

05dd60a

Update Constants.cs

2986d69

Copilot started work on behalf of d2dyno1 May 18, 2026 16:25 View session

Merge branch 'f_vault4' into f_complementation

16152bd

Co-authored-by: d2dyno1 <53011783+d2dyno1@users.noreply.github.com>

Copilot finished work on behalf of d2dyno1 May 18, 2026 16:33

d2dyno1 marked this pull request as ready for review May 18, 2026 21:13

d2dyno1 requested a review from Copilot May 18, 2026 21:13

Copilot AI reviewed May 18, 2026

View reviewed changes

Comment thread src/Platforms/SecureFolderFS.UI/ServiceImplementation/BaseVaultCredentialsService.cs

Comment thread src/Core/SecureFolderFS.Core/Routines/Operational/ModifyComplementationRoutine.cs Outdated

Comment thread src/Core/SecureFolderFS.Core/VaultAccess/VaultReader.cs

Copilot started work on behalf of d2dyno1 May 18, 2026 21:17 View session

fix: avoid redundant entropy decryption in complementation recovery

04aef11

Agent-Logs-Url: https://github.com/securefolderfs-community/SecureFolderFS/sessions/7f21ec24-91c8-445f-b546-67ee44448ae4 Co-authored-by: d2dyno1 <53011783+d2dyno1@users.noreply.github.com>

Copilot started reviewing on behalf of d2dyno1 May 18, 2026 21:22 View session

chore: refine complementation recovery tuple handling

e642156

Agent-Logs-Url: https://github.com/securefolderfs-community/SecureFolderFS/sessions/7f21ec24-91c8-445f-b546-67ee44448ae4 Co-authored-by: d2dyno1 <53011783+d2dyno1@users.noreply.github.com>

Copilot started work on behalf of d2dyno1 May 18, 2026 21:25 View session

Copilot finished work on behalf of d2dyno1 May 18, 2026 21:25

fix: propagate complementation read errors from VaultReader

6edf734

Agent-Logs-Url: https://github.com/securefolderfs-community/SecureFolderFS/sessions/2bad546b-bd5e-4ad9-918d-0f1c2501790e Co-authored-by: d2dyno1 <53011783+d2dyno1@users.noreply.github.com>

Copilot finished work on behalf of d2dyno1 May 18, 2026 21:29

Copilot started work on behalf of d2dyno1 May 19, 2026 12:55 View session

fix: treat missing complementation file as non-fatal

2cebcbf

Agent-Logs-Url: https://github.com/securefolderfs-community/SecureFolderFS/sessions/97747175-69cf-4f84-9b88-ba52b9ef01f2 Co-authored-by: d2dyno1 <53011783+d2dyno1@users.noreply.github.com>

Copilot finished work on behalf of d2dyno1 May 19, 2026 13:03

Update VaultReader.cs

e42abb2

d2dyno1 added the approved The pull request has been reviewed and approved label May 19, 2026

d2dyno1 merged commit 0c21e4f into f_vault4 May 19, 2026

Conversation

d2dyno1 commented Apr 30, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI commented May 2, 2026

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

d2dyno1 commented May 18, 2026

Uh oh!

d2dyno1 commented May 18, 2026

Uh oh!

Copilot AI commented May 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI commented May 18, 2026

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

d2dyno1 commented May 19, 2026

Uh oh!

Copilot AI commented May 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented May 18, 2026 •

edited

Loading