From 97747d58fa04aa210af48dfe54333ca9defb5d9d Mon Sep 17 00:00:00 2001
From: Nico Wiedemann <nico.wiedemann@gmail.com>
Date: Thu, 1 Oct 2026 15:51:48 +0200
Subject: [PATCH 1/2] Say what turning on encryption does to existing access
 keys

A key made before encryption carries no copy of the new content key, so it
signs in and reads nothing afterwards, and the cloud now revokes OAuth
connections at the moment encryption is turned on so a Claude connector asks
to reconnect. The screen listing what encryption costs said neither. It now
has a line saying existing keys must be replaced and connected AI tools will
ask to connect again, in en, de and zh, with a CHANGELOG entry.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 CHANGELOG.md                              | 7 +++++++
 src/lib/components/EncryptionPanel.svelte | 1 +
 src/lib/i18n/locales/de.json              | 1 +
 src/lib/i18n/locales/en.json              | 1 +
 src/lib/i18n/locales/zh.json              | 1 +
 5 files changed, 11 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index abd0deb..e3e796e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,13 @@ popover, not for the person who wrote the commit.
 
 ## [Unreleased]
 
+### Changed
+- **Turning on encryption now says what happens to your existing access keys.** A key made
+  before encryption cannot read the encrypted account, because it carries no copy of the new
+  key, so it has to be replaced afterwards. AI tools connected by signing in, such as a
+  Claude connector, are disconnected when you turn encryption on and ask you to connect
+  again. Keys you made by hand are kept, and the account page marks the ones to replace
+
 ## [1.10.0] - 2026-10-01
 
 ### Added
diff --git a/src/lib/components/EncryptionPanel.svelte b/src/lib/components/EncryptionPanel.svelte
index 771b8da..9dfaf33 100644
--- a/src/lib/components/EncryptionPanel.svelte
+++ b/src/lib/components/EncryptionPanel.svelte
@@ -365,6 +365,7 @@ See the GNU Affero General Public License for more details.
         <ul class="list-disc space-y-1 pl-4 text-xs text-muted-foreground">
             <li>{$_("encryption.costRecovery")}</li>
             <li>{$_("encryption.costMcp")}</li>
+            <li>{$_("encryption.costExistingKeys")}</li>
             <li>{$_("encryption.costLocal")}</li>
         </ul>
         <button
diff --git a/src/lib/i18n/locales/de.json b/src/lib/i18n/locales/de.json
index 78179be..673b84d 100644
--- a/src/lib/i18n/locales/de.json
+++ b/src/lib/i18n/locales/de.json
@@ -288,6 +288,7 @@
     "offExplainer": "Deine Stashes liegen auf unserem Server, damit deine Geräte denselben Stand sehen. Schaltest du das ein, werden sie vorher auf diesem Rechner verschlüsselt — mit einem Schlüssel, den wir nicht aufbewahren.",
     "costRecovery": "Du bekommst einen Wiederherstellungscode. Verlierst du alle Installationen und diesen Code, kommt niemand mehr an deine Stashes — weder du noch wir.",
     "costMcp": "Ein Zugriffsschlüssel für KI-Werkzeuge trägt eine eigene Kopie des Schlüssels, unser Server kann dieses Konto also lesen, solange er eine solche Anfrage bearbeitet. Legst du keinen Zugriffsschlüssel an, können wir es gar nicht lesen.",
+    "costExistingKeys": "Bereits angelegte Zugriffsschlüssel können danach nichts mehr lesen - leg anschließend neue an. Per Anmeldung verbundene KI-Werkzeuge, etwa ein Claude-Connector, werden getrennt und bitten dich, sie neu zu verbinden.",
     "costLocal": "Das schützt, was auf unserem Server liegt. Was auf diesem Rechner liegt, bleibt unverändert.",
     "turnOn": "Verschlüsselung einschalten",
     "recoveryIntro": "Schreib ihn jetzt auf oder leg ihn in deinen Passwort-Manager. Er wird einmal angezeigt und lässt sich nicht noch einmal anzeigen.",
diff --git a/src/lib/i18n/locales/en.json b/src/lib/i18n/locales/en.json
index 24c4553..36bf3c5 100644
--- a/src/lib/i18n/locales/en.json
+++ b/src/lib/i18n/locales/en.json
@@ -288,6 +288,7 @@
     "offExplainer": "Your stashes are stored on our server so your devices see the same thing. Turn this on and they are encrypted on this machine first, with a key we do not keep.",
     "costRecovery": "You get a recovery code. Lose every installation and that code, and nobody can get your stashes back — not you, and not us.",
     "costMcp": "An access key for AI tools carries its own copy of the key, so our server can read that account while such a request is being served. Create no access key and we cannot read it at all.",
+    "costExistingKeys": "Access keys you already made cannot read anything once this is on - create new ones afterwards. AI tools connected through sign-in, such as a Claude connector, are disconnected and ask you to connect again.",
     "costLocal": "This protects what is stored on our server. What is on this computer is unchanged.",
     "turnOn": "Turn on encryption",
     "recoveryIntro": "Write this down now, or put it in your password manager. It is shown once and cannot be shown again.",
diff --git a/src/lib/i18n/locales/zh.json b/src/lib/i18n/locales/zh.json
index 2c7b11a..9758f07 100644
--- a/src/lib/i18n/locales/zh.json
+++ b/src/lib/i18n/locales/zh.json
@@ -288,6 +288,7 @@
     "offExplainer": "你的暂存项存储在我们的服务器上，这样你的各台设备看到的内容才能一致。开启此功能后，它们会先在这台电脑上加密，所用的密钥我们不会保存。",
     "costRecovery": "你会获得一个恢复码。如果你丢失了所有安装以及这个恢复码，任何人都无法找回你的暂存项，包括你和我们。",
     "costMcp": "用于 AI 工具的访问密钥自带一份该密钥的副本，因此在处理此类请求期间，我们的服务器能够读取该账户。如果你不创建访问密钥，我们就完全无法读取。",
+    "costExistingKeys": "开启后，你已创建的访问密钥将无法读取任何内容，请在之后创建新的密钥。通过登录连接的 AI 工具（例如 Claude 连接器）会被断开，并提示你重新连接。",
     "costLocal": "这保护的是存储在我们服务器上的内容。这台电脑上的内容保持不变。",
     "turnOn": "开启加密",
     "recoveryIntro": "请现在把它写下来，或保存到你的密码管理器中。它只显示这一次，之后无法再次显示。",

From b3be7e6923c3b459f6297cf57e94f4c508c7b3fd Mon Sep 17 00:00:00 2001
From: Nico Wiedemann <nico.wiedemann@gmail.com>
Date: Thu, 1 Oct 2026 15:56:12 +0200
Subject: [PATCH 2/2] chore: bump version to v1.10.1

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 CHANGELOG.md              | 2 ++
 package.json              | 2 +-
 src-tauri/Cargo.lock      | 2 +-
 src-tauri/Cargo.toml      | 2 +-
 src-tauri/tauri.conf.json | 2 +-
 5 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e3e796e..ce86602 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,8 @@ popover, not for the person who wrote the commit.
 
 ## [Unreleased]
 
+## [1.10.1] - 2026-10-01
+
 ### Changed
 - **Turning on encryption now says what happens to your existing access keys.** A key made
   before encryption cannot read the encrypted account, because it carries no copy of the new
diff --git a/package.json b/package.json
index 9a2721e..d6b627b 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "stashpad",
-  "version": "1.10.0",
+  "version": "1.10.1",
   "description": "The staging area for your AI context.",
   "author": {
     "name": "Nico Wiedemann",
diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock
index 1ec45ec..77882e2 100644
--- a/src-tauri/Cargo.lock
+++ b/src-tauri/Cargo.lock
@@ -5934,7 +5934,7 @@ checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 
 [[package]]
 name = "stashpad"
-version = "1.10.0"
+version = "1.10.1"
 dependencies = [
  "active-win-pos-rs",
  "aes-gcm",
diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml
index 1ab8a7d..d8c84cf 100644
--- a/src-tauri/Cargo.toml
+++ b/src-tauri/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "stashpad"
-version = "1.10.0"
+version = "1.10.1"
 description = "The staging area for your AI context."
 authors = ["Nico Wiedemann <nico.wiedemann@gmail.com>"]
 repository = "https://github.com/EarMaster/stashpad"
diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json
index 7004978..6e0ed10 100644
--- a/src-tauri/tauri.conf.json
+++ b/src-tauri/tauri.conf.json
@@ -1,7 +1,7 @@
 {
   "$schema": "../node_modules/@tauri-apps/cli/config.schema.json",
   "productName": "stashpad",
-  "version": "1.10.0",
+  "version": "1.10.1",
   "identifier": "org.stashpad",
   "build": {
     "frontendDist": "../dist",