v2.4.0: Hidden Space, WiFi sharing, Auto-Send (Enter)

Author: makepkg

CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## [2.4.0] — May 2026
+### Added
+- **Hidden Space** — second independent encrypted vault selectable at boot via
+  alternate PIN. Each space has isolated TOTP keys, passwords, web cabinet
+  credentials, WiFi config, BLE PIN, Device BLE PIN, Duress PIN, display theme,
+  startup mode, and HID mode. Spaces share only hardware-level settings: boot mode,
+  RTC config, display settings, web server timeout, session duration, AP password,
+  BLE device name, and mDNS hostname. Space B web cabinet hides all shared settings.
+- **WiFi sharing** — optional: share Space A WiFi credentials with Space B
+  via re-encryption with a chip-derived key (configurable in web cabinet,
+  Space A context only).
+- **Auto-Send (Enter)** — new per-password flag in Password Manager; when enabled, device automatically presses Enter via BLE/USB HID after typing the password. Configurable per entry in web cabinet and offline decrypt tool. ENT badge shown on device display.
+
+### Fixed
+- `quickUpdateCategory()` — quick category change via badge pill now preserves `auto_send` flag (previously reset to false on category switch)/
+- Name of key file obfuscated
+- PROGMEM copy bug(first web server open wasnt loading, loaded after page refresh)
+
 ## [2.3.0] — May 2026
 ### Security Enhancements
 - **Duress PIN with memory zeroing** — multi-layer duress PIN triggers advanced memory 

README.md

@@ -182,6 +182,14 @@
 - PIN protection for BLE transmission
 - Encrypted export/import for backup and migration
 
+### 🔒 Hidden Space
+- **Two independent vaults** — alternate PIN at boot unlocks a fully isolated 
+  second space with its own TOTP keys, passwords, and web cabinet account 
+- **Optional WiFi sharing** — Space B can inherit Space A WiFi credentials 
+  with one toggle; disabled by default 
+- **Full isolation** — separate BLE PIN, web admin credentials, and session 
+  per space; spaces cannot read each other's data 
+
 ### 🌐 Web Management Interface
 - Runs on the device itself — no cloud, no external servers
 - Full TOTP and password management from any browser
@@ -216,6 +224,8 @@ All sensitive data is encrypted with AES-256 using a unique per-device key deriv
 
 **Device security:** PIN with persistent lockout (5 attempts across reboots), secure memory wipe before deep sleep, encrypted BLE pairing.
 
+**Hidden Space:** two-slot device key file; Space B unlocked only by its own PIN via independent PBKDF2 derivation; wipe zeroes slot and deletes all HMAC-derived files.
+
 ### Known Limitations
 - PBKDF2 iteration count (25,000) is below OWASP 2023 recommendations due to ESP32 hardware constraints
 - No hardware secure enclave or secure boot by default
@@ -297,6 +307,7 @@ pio run -e lilygo-t-display-s3 -t upload
 | [Logging System](docs/development/LOGGING_SYSTEM.md) | Debug and log configuration |
 | [Multi-Board Support](docs/development/multi-board.md) | Internal multi-board development rules (for maintainers) |
 | [Hardware Porting Guide](docs/development/PORTING.md) | Port SecureGen to your own ESP32 board |
+| [Abandoned Ideas](docs/development/abandoned-ideas.md) | Rejected features and architectural decisions |
 
 ---
 
@@ -311,6 +322,7 @@ pio run -e lilygo-t-display-s3 -t upload
   device; ephemeral key derived on-device, never entered manually
 - Flash encryption and secure boot (optional hardening)
 - ATECC608 secure element support
+- SD Card Module Support for pin code + cryptokey unlock feature
 
 ### Cryptography
 - Migration ECDH P-256 → X25519 (~400ms → ~80ms key exchange)

decrypt_export.html

@@ -14,6 +14,7 @@
 - `url-obfuscation.md` — URL obfuscation layer internals, epoch rotation, endpoint registration checklist.
 - `multi-board.md` — Multi-board development rules. Three types of platform differences, scaling checklist, golden rule.
 - `PORTING.md` — Hardware porting guide. Step-by-step instructions for adapting SecureGen firmware to new ESP32/S3 boards. Covers hardware requirements, board header creation, platformio.ini configuration, capability flags (USB HID, PSRAM), deep sleep wake pins, display geometry, security checklist, and common mistakes to avoid.
+- `abandoned-ideas.md` — Rejected features and architectural decisions. Documents approaches that were considered but abandoned, with reasoning and alternatives.
 
 #### development/boards/
 Hardware reference for supported targets. Each file covers: MCU, display, pinout, USB/flashing specifics, known quirks.

docs/README.md

@@ -112,26 +112,58 @@ Returns password list metadata. Passwords are not included — use `/api/passwor
       "name": "Gmail",
       "category": "web",
       "strength": 2,
-      "pw_hash": "a1b2c3d4"
+      "pw_hash": "a1b2c3d4",
+      "auto_send": false
     }
   ]
 }
 ```
 
-Fields: `name` (string), `category` ("web"|"app"|"local"|"key"|""), `strength` (0–3), `pw_hash` (first 8 bytes of SHA-256, hex, for duplicate detection). Passwords are never included in the list response — use `/api/passwords/get`.
+| Field | Type | Description |
+|-------|------|-------------|
+| name | string | Password entry name |
+| category | string | Category: "web", "app", "local", "key", or "" |
+| strength | int | Password strength: 0=unknown, 1=weak, 2=medium, 3=strong |
+| pw_hash | string | First 8 bytes of SHA-256 (hex) for duplicate detection |
+| auto_send | bool | Whether Enter is sent after password output |
+
+Passwords are never included in the list response — use `/api/passwords/get`.
 
 ### POST /api/passwords/add 🔐 🛡️ 🔒
-Request: `{ "name": "...", "password": "...", "category": "web" }`
+Request: `{ "name": "...", "password": "...", "category": "web", "auto_send": false }`
+
+| Parameter | Type | Default | Description |
+|-----------|------|---------|-------------|
+| name | string | required | Password entry name |
+| password | string | required | Password value |
+| category | string | "" | Category: "web", "app", "local", "key", or "" |
+| auto_send | bool | false | Automatically press Enter after HID output |
 
-Note: `category` optional — omit or pass "" for no category.
+Note: `category` and `auto_send` are optional.
 
 ### POST /api/passwords/get 🔐 🛡️ 🔒
 Returns the plaintext password for one entry.  
 Request: `{ "index": 0 }`  
-Response: `{ "success": true, "password": "..." }`
+Response: `{ "success": true, "password": "...", "name": "...", "category": "web", "auto_send": false }`
+
+| Response Field | Type | Description |
+|----------------|------|-------------|
+| success | bool | Operation status |
+| password | string | Plaintext password value |
+| name | string | Password entry name |
+| category | string | Category: "web", "app", "local", "key", or "" |
+| auto_send | bool | Whether Enter is sent after password output |
 
 ### POST /api/passwords/update 🔐 🛡️ 🔒
-Request: `{ "index": 0, "name": "...", "password": "...", "category": "web" }`
+Request: `{ "index": 0, "name": "...", "password": "...", "category": "web", "auto_send": false }`
+
+| Parameter | Type | Default | Description |
+|-----------|------|---------|-------------|
+| index | int | required | Password entry index |
+| name | string | required | Password entry name |
+| password | string | required | Password value |
+| category | string | "" | Category: "web", "app", "local", "key", or "" |
+| auto_send | bool | false | Automatically press Enter after HID output |
 
 ### POST /api/passwords/delete 🔐 🛡️ 🔒
 Request: `{ "index": 0 }`
@@ -318,6 +350,80 @@ Request: `{ "new_password": "..." }`
 
 ---
 
+## Hidden Space 
+
+### GET /api/hidden_space 🔐 🔒 
+
+Returns current hidden space status. Response differs by active space. 
+
+**Space A response:** 
+```json 
+{ 
+  "hidden_space_enabled": true, 
+  "current_space": "A", 
+  "can_enable": true, 
+  "can_disable": true, 
+  "share_wifi": false 
+} 
+``` 
+
+**Space B response:** 
+```json 
+{ 
+  "hidden_space_enabled": true, 
+  "current_space": "B", 
+  "can_enable": false, 
+  "can_disable": true, 
+  "share_wifi": false 
+} 
+``` 
+
+`hidden_space_enabled` reflects whether Space B is provisioned (sentinel 
+file detected). `share_wifi` is only meaningful in Space A context. 
+
+### POST /api/hidden_space 🔐 🛡 🔒 
+
+Manages hidden space lifecycle. All actions require Space A context except 
+`disable` (which requires Space B context). 
+
+**Action: enable** 
+Writes `/.setup_hidden_space` trigger file and restarts the device. 
+On next boot, PIN entry flow creates Space B slot. 
+
+```json 
+{ "action": "enable" } 
+``` 
+
+**Action: disable** 
+Wipes Space B: overwrites slot B with random bytes, deletes all 
+HMAC-derived data files, removes sentinel and shared cache. 
+Must be called from Space B context. 
+
+```json 
+{ "action": "disable" } 
+``` 
+
+**Action: set_share_wifi** 
+Copies Space A WiFi credentials re-encrypted with chip-derived key to 
+`/.conn_cache`. Space B WifiManager uses this file as fallback if its own 
+credentials are absent. Calling with `enabled: false` removes the cache file. 
+Space A context only. 
+
+```json 
+{ "action": "set_share_wifi", "enabled": true } 
+``` 
+
+Response (all actions on success): 
+```json 
+{ "status": "ok" } 
+``` 
+
+> **Registration:** this endpoint follows the 6-location checklist 
+> (direct handler, two tunnel dispatchers, obfuscation manager, 
+> `shouldTunnelEndpoint`, `shouldSecureEndpoint`).
+
+---
+
 ## Utility
 
 ### GET /api/csrf_token 🔐 🔒