Skip to content

feat: lock the browser after 1 hour of inactivity - #63

Merged
b-sw merged 1 commit into
mainfrom
feat/idle-browser-lock
Nov 8, 2026
Merged

b-sw merged 1 commit into
mainfrom
feat/idle-browser-lock

Conversation

@b-sw

@b-sw b-sw commented Nov 8, 2026

Copy link
Copy Markdown
Contributor

What changes

  • New lock setting, "After 1 hour of inactivity". It is the default for users with no saved lockBrowserOn, through the Mongoose default and serializer fallback. Users with a saved choice keep it. There is no migration.
  • Activity in any tab keeps every tab unlocked, through a shared last-active time in localStorage.
  • The first input after a long absence locks instead of renewing the session, because timers stop while a device sleeps. A reload also locks.
  • An idle locked tab stops reconnecting its device-flow requester stream until someone returns.
  • The unlock dialog says why it locked, but only after an idle lock.
  • Fix: on phones, the user menu was hidden under the editor because the mobile header had no z-index. The lock settings could not be reached there. The header now uses relative z-20, as the desktop header does.

The server-side session does not change. No crypto flow changes. The lock wipes local keys through the existing keystore.wipeAll.

Behavior to know

  • The lock clears the decrypted editor state, so unsaved edits are lost.
  • A locked tab cannot approve device requests. Users who rely on that can choose "After closing the tab".
  • Closing every tab still locks under all three settings.
  • Open tabs run the old JavaScript until they reload.

Verification

  • apps/web: pnpm lint, pnpm check, pnpm build pass. pnpm test:browser-lock: 16 passed.
  • backend: pnpm test (205 passed), pnpm build pass.
  • pnpm generate:backend-sdk output is committed.
  • The new phone menu test fails without the header fix.
  • CI does not run these e2e tests.

The existing test "an open tab stays unlocked across reloads and idle time" is flaky. It failed on clean main and passed in the final full run on this branch. This PR does not change it.

Visual review

Screenshots of the running app (user menu and idle lock dialog, 1280px and 390px) went through an independent UI review. The app has only a dark theme. gh cannot upload images, so they are not attached here.

Fixed: the clipped phone menu, the missing lock reason, and early text wrap in the dialog.
Not addressed, because these parts existed before this work: "Log out" placement in the dialog, the visual weight of the device card, dialog copy, touch target size, backdrop blur strength, and the "Saved" control overlapping tabs on phones.

🤖 Generated with Claude Code

Add "After 1 hour of inactivity" as a lock setting and make it the
default for users with no saved choice. Activity in any tab keeps every
tab unlocked. The first input after a long absence locks, because timers
stop while a device sleeps. An idle locked tab stops reconnecting its
device-flow stream until someone returns, and the unlock dialog says why
the browser locked.

Also raise the mobile header above the page content, so the user menu is
no longer hidden under the editor on phones.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@vercel

vercel Bot commented Nov 8, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
cryptly Ready Ready Preview Nov 8, 2026 7:50pm UTC

@b-sw
b-sw merged commit df69d00 into main Nov 8, 2026
3 checks passed
@b-sw
b-sw deleted the feat/idle-browser-lock branch November 8, 2026 19:53

This branch was successfully deployed

1 active deployment
Preview — 204776ee Deployed Nov 8, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant