[usermaneGermane]

Part of the task "rename everything: PassMan → SecretSpace" (your decision of 13 Nov: everything, the cryptography's labels too, with a new account format and a one-time re-key).

SecretSpace 3 still carried the old name where nobody looks: in the labels its keys are made with, in the markers at the start of its files, in the name of its data folder. This version uses its own name everywhere. The cryptography is unchanged; the format is new (format 2), and an account from SecretSpace 3 is converted the first time it is unlocked.

What the user sees

• At unlock: "This account will be converted", with Save a copy first…, Convert, Cancel. Cancel changes nothing.
• After it: a window asking for the 12 recovery words once, to convert the recovery copy too (it opens only with the words). Later is fine; Settings → Security has it afterwards.
• At the next sync: the server is told, and vaults are stored in the new format. A shared vault moves by itself once every member has updated; until then it stays readable for a member still on SecretSpace 3.
• The Emergency Kit stays valid: a Secret Key printed as A3-… is accepted; it is shown as A4-… now.
• The data folder %APPDATA%\PassMan is renamed to %APPDATA%\SecretSpace at start (renamed, not copied).

What must be known before installing

• SecretSpace 3.0 / 3.1 cannot open a converted account. Every device has to be updated.
• The server must be 2.1.0 (PRs open in both server repos). Until then the app works locally and says the server is too old.

How it is built

• account_crypto.Format: what differs between the formats. NOW is written; OLD is read, to convert — and written only for a vault that someone with an older app still opens.
• The signing key and the recovery proof were derived with the old labels. They are now stored in the keyset — for a converted account the values it always had, so its identity, every signature it made and the server's recovery check stay valid. Nobody has to compare fingerprints again.
• accounts.convert: keyset sealed again with the same salt (every device arrives at the same new login key on its own), then the vault files; account.json is the commit point.
• legacy_names.py is the one module with the old names; a test fails if the old name appears anywhere else in the program.

Proof

• 849 tests pass (88 new).
• The conversion is tested on accounts that the real 3.1.0 wrote, with its server 2.0.0 (tests/fixtures/format1, made by make_format1.py): a synced account with a shared vault, its other member, and an account that was never on a server.
• Covered: interruption at every write; two devices converting separately; a member who has not updated still reading and writing; sign-in and recovery of an unconverted account; an old Emergency Kit.
• Mutation check: 56 deliberate breaks, 55 caught, 1 equivalent (a guard that only saves a server call).
• Lab flows on the real app (source run): accounts 42/42, sync 22/22, vaults 56/56, sharing 101/101, recovery 83/83.

Not done

• A security review of the new format by fresh eyes (planned before the release).
• The conversion windows were not looked at on screen by me: the flows drive the logic, not these two new dialogs.
• Merging this before the two server PRs is harmless, but releasing it is not useful until the server 2.1.0 is out.

After the merge

Tag v4.0.0, build and release the installer. The local folders E:\CLAUDE\PassMan-* are renamed last, after all four merges.

🤖 Generated with Claude Code

https://claude.ai/code/session_011ojnyXb6JY4UPVU4waZe1w