OverviewFilesCommitsIssuesDocsReleasesPeers

hyper-wallet commits / 3003dd8

Phase 2: Fix token storage + add password confirmation
- Fixed token stored as 'apiToken' instead of 'hyper-wallet-token' - Now uses saveToken() helper instead of direct localStorage - Added password confirmation prompt for first-time setup - Prevents typos when setting encryption password - Fixes unauthorized API access errors Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
3003dd889a76b378fb8cae39c2c4bf2bc721e5fd
by plankatron <fleeky@gmail.com> · 2026-01-27T20:42:07.000Z

Changed files (2) +19 -4

.claude/tmux-registry.json +1 -1
……@@ -8,7 +8,7 @@
88 "purpose": "Seeding pear://18x3enb54ttcr6uuhg5hh1cqzwi8ydnm658fmgyyjkzoqxd1ybso",
99 "command": "pear seed pear://18x3enb54ttcr6uuhg5hh1cqzwi8ydnm658fmgyyjkzoqxd1ybso .",
1010 "persistent": true,
11 "latest_version": "11442",
11 "latest_version": "11447",
1212 "last_deployed": "2026-01-27",
1313 "features": "Phase 2 COMPLETE: Auth + Encryption + Validation + Rate Limiting + CORS + Signed Invites + Password Unlock UI ✅"
1414 },
ui/app.js +18 -3
……@@ -2252,6 +2252,21 @@ Enter your wallet password:
22522252 continue
22532253 }
22542254
2255 // For first-time setup, ask for confirmation
2256 if (isFirstTimeSetup) {
2257 const confirmPassword = prompt('🔐 CONFIRM PASSWORD\n\nPlease re-enter your password to confirm:')
2258
2259 if (confirmPassword === null) {
2260 continue // Let them try again
2261 }
2262
2263 if (password !== confirmPassword) {
2264 alert('❌ Passwords do not match. Please try again.')
2265 attempts++
2266 continue
2267 }
2268 }
2269
22552270 try {
22562271 // Call unlock endpoint
22572272 const res = await fetch(`${API_BASE}/unlock`, {
……@@ -2276,8 +2291,8 @@ Enter your wallet password:
22762291
22772292 const data = await res.json()
22782293
2279 // Store API token
2280 localStorage.setItem('apiToken', data.token)
2294 // Store API token using the correct function
2295 saveToken(data.token)
22812296
22822297 // Show success message
22832298 if (data.migrated) {
……@@ -2320,7 +2335,7 @@ async function init() {
23202335 const initialized = await checkStatus()
23212336
23222337 // If initialized but no API token, prompt for password
2323 if (initialized && !localStorage.getItem('apiToken')) {
2338 if (initialized && !getToken()) {
23242339 console.log('🔐 Wallet initialized but password needed')
23252340 const success = await promptForPassword()
23262341 if (!success) {