Secure Files: encrypted .mydt file vault, shared format crate and CLI

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -77,8 +77,10 @@ body:
       options:
         - macOS (Apple Silicon)
         - macOS (Intel)
-        - Windows (built from source)
+        - Linux (.deb)
+        - Linux (AppImage)
         - Linux (built from source)
+        - Windows (built from source, unsupported)
         - Other (say which below)
     validations:
       required: true

.github/workflows/release.yml

@@ -18,9 +18,9 @@ jobs:
       matrix:
         include:
           # macOS universal (Intel + Apple Silicon).
-          # macOS-only for now — Windows/Linux runners were dropped to conserve
-          # the org's free Actions minutes (macOS bills at 10x). Re-add matrix
-          # entries here to build those platforms again.
+          # macOS-only in CI — the Linux runner was dropped to conserve the org's
+          # free Actions minutes; Linux artifacts are built and uploaded by
+          # scripts/release-local.sh instead. No Windows build for now.
           - platform: macos-latest
             args: '--target universal-apple-darwin'
             rust_target: 'aarch64-apple-darwin,x86_64-apple-darwin'

.github/workflows/rust.yml

@@ -63,9 +63,18 @@ jobs:
       - name: Rust cache
         uses: swatinem/rust-cache@v2
         with:
-          workspaces: apps/desktop/src-tauri -> target
+          workspaces: |
+            apps/desktop/src-tauri -> target
+            crates/mydt -> target
 
       # SQLCipher + OpenSSL are vendored (rusqlite bundled-sqlcipher-vendored-openssl),
       # so the first run compiles them; rust-cache makes later runs fast.
       - name: cargo test
         run: cargo test --locked
+
+      # Shared .mydt format crate + CLI (no Tauri deps, builds in seconds).
+      - name: mydt crate (format + CLI)
+        working-directory: crates/mydt
+        run: |
+          cargo test --locked
+          cargo build --locked --release --features cli

.gitignore

@@ -99,4 +99,6 @@ docs/superpowers/
 # graft's local graph cache — regenerable, not committed (run `graft build`).
 graft/
 # Local Linux build output (published to GitHub releases, never committed)
-dist-linux/
+dist-linux/
+# Rust crates outside the Tauri shell
+crates/*/target/

CONTRIBUTING.md

@@ -364,8 +364,8 @@ New here? Issues labelled
 [`good first issue`](https://github.com/mydevtools-tech/mydevtools/labels/good%20first%20issue)
 are scoped to be completable without deep knowledge of the codebase. If none are
 open, improving a translation, a tool description or a README translation is
-always welcome — and testing the desktop build on Windows or Linux is the most
-useful thing a new contributor can do right now.
+always welcome — and testing the Linux build (new in 0.1.15) is the most useful
+thing a new contributor can do right now.
 
 ---
 

README.md

@@ -106,7 +106,8 @@ It runs on your machine. There is no MyDevTools server, no account and no sync.
 | Platform | How |
 |---|---|
 | **macOS** (Apple Silicon + Intel) | [Download the latest `.dmg`](https://github.com/mydevtools-tech/mydevtools/releases/latest) — universal build, signed and notarized, updates itself in-app |
-| **Windows / Linux** | Not published yet. The Tauri shell builds on both — see [Building from source](#%EF%B8%8F-building-from-source) and the [roadmap](ROADMAP.md). Testing on these platforms is a great first contribution |
+| **Linux** (x86_64) | [Download the `.deb`](https://github.com/mydevtools-tech/mydevtools/releases/latest/download/MyDevTools-amd64.deb) (Debian / Ubuntu 22.04+) or the [AppImage](https://github.com/mydevtools-tech/mydevtools/releases/latest/download/MyDevTools-x86_64.AppImage) (runs anywhere, no install) — same release and version as macOS. No in-app updater yet; see the [Linux install guide](https://mydevtools.tech/linux-builds) |
+| **Windows** | No build for now. The Tauri shell compiles on Windows — see [Building from source](#%EF%B8%8F-building-from-source) and the [roadmap](ROADMAP.md) |
 
 Open it and start working: no sign-up, no configuration, no API keys.
 
@@ -175,6 +176,7 @@ go straight from your machine to your database.
 | Tool | Description |
 |---|---|
 | **Password Manager** | Credential vault encrypted with a password only you know |
+| **Secure Files** | Encrypt files and folders into masked `.mydt` objects in any folder you choose; browse, preview and export them after unlocking ([format spec](docs/MYDT_FORMAT.md), [`mydt` CLI](crates/mydt/README.md)) |
 | **Encryption Playground** | AES-GCM with a raw key or passphrase; encrypt/decrypt JSON bundles |
 | **JWT Decoder** | Decode JWT header, payload and expiry |
 | **Hash Generator** | MD5, SHA-1, SHA-256/384/512 digests for text or files |

ROADMAP.md

@@ -52,9 +52,6 @@ Current focus — stability and polish over new surface area.
 
 Agreed direction, not yet scheduled.
 
-- **Windows and Linux builds.** The Tauri shell can already be built on both;
-  what is missing is CI, signing and enough testing to publish them. This is the
-  most-requested item.
 - **More developer utilities**, driven by what people actually ask for in issues.
 - **API client depth**: smoother collection workflows, better environment and
   secret handling, richer request/response inspection.
@@ -79,6 +76,9 @@ Ideas we like, with nothing committed. Feedback genuinely decides these.
   generation and certificate tooling.
 - **Local automation**: chaining tools together for repeated workflows, on-device.
 - **A public tool API** so the desktop app's logic can be scripted locally.
+- **A Windows build.** Not planned for now. The Tauri shell compiles on Windows,
+  but a published build needs CI minutes, a code-signing certificate and regular
+  testing we do not have yet. Linux shipped in 0.1.15.
 
 ## Not planned
 
@@ -104,7 +104,7 @@ The fastest way to move something up this list:
 - **Open an issue** describing the problem, not just the fix you have in mind.
 - **Pick up a [good first issue](https://github.com/mydevtools-tech/mydevtools/labels/good%20first%20issue)** — see [`docs/GOOD_FIRST_ISSUES.md`](docs/GOOD_FIRST_ISSUES.md) for scoped starter work.
 - **Improve a translation** — 27 locales, and native speakers always beat a sync script.
-- **Test on Windows or Linux** and report what breaks. That is the concrete work
-  standing between those builds and a release.
+- **Test on Linux** and report what breaks. The Linux build is new as of 0.1.15
+  and has seen far less use than macOS.
 
 See [CONTRIBUTING.md](CONTRIBUTING.md) to get set up.

SUPPORT.md

@@ -64,9 +64,10 @@ No. The vault key is derived from your password and never leaves your device, so
 there is no reset path. That is what makes the vault meaningful.
 
 **Which platforms are supported?**
-Published builds are macOS only today (universal — Apple Silicon and Intel,
-signed and notarized). Windows and Linux builds are not published yet; the Tauri
-shell can be built from source on those platforms, but is untested.
+macOS (universal — Apple Silicon and Intel, signed and notarized) and Linux
+(x86_64, as a `.deb` or AppImage) ship in every release. There is no Windows
+build for now; the Tauri shell can be built from source on Windows, but is
+untested.
 
 **Is it really free?**
 Yes — every tool and every feature, no paid tier and no limits. It is open source

apps/desktop-ui/messages/af.json

@@ -76,7 +76,8 @@
     "tokenCounter": "Token-teller",
     "webhookTester": "Webhook-toetser",
     "websocketTester": "WebSocket-toetser",
-    "whoisLookup": "Whois-opsoek"
+    "whoisLookup": "Whois-opsoek",
+    "secureFiles": "Lêers"
   },
   "Help": {
     "title": "Hulp en dokumentasie",
@@ -183,6 +184,7 @@
       "namePlaceholder": "e.g. Alex",
       "avatarLabel": "Avatar URL",
       "avatarPlaceholder": "https://…",
+      "edit": "Wysig",
       "save": "Save",
       "saved": "Profile saved",
       "saveError": "Could not save your profile"
@@ -307,6 +309,22 @@
       "restoring": "Herstel tans…",
       "restoreSuccess": "Rugsteun herstel",
       "restoreError": "Herstel het misluk — verkeerde wagfrase of ongeldige rugsteunlêer"
+    },
+    "backupCodes": {
+      "title": "Rugsteunkodes",
+      "description": "Eenmalige kodes wat jou kluis herstel as jy jou meesterwagwoord vergeet.",
+      "remaining": "{remaining} van {total} kodes oor",
+      "none": "Geen rugsteunkodes gestoor nie.",
+      "hint": "'n Nuwe stel maak alle bestaande kodes ongeldig.",
+      "passwordPlaceholder": "Meesterwagwoord",
+      "regenerateButton": "Genereer nuwe kodes",
+      "generating": "Genereer tans…",
+      "wrongPassword": "Verkeerde meesterwagwoord",
+      "success": "Nuwe rugsteunkodes gegenereer",
+      "error": "Kon nie rugsteunkodes genereer nie",
+      "newCodesWarning": "Jy kan dit nie weer sien nie. Laai dit af of kopieer dit nou.",
+      "downloadButton": "Laai af",
+      "doneButton": "Ek het my kodes gestoor"
     }
   },
   "Dashboard": {
@@ -635,6 +653,10 @@
       "whoisLookup": {
         "title": "Whois-opsoek",
         "description": "Soek domein- en IP-registrasiebesonderhede op via RDAP."
+      },
+      "secureFiles": {
+        "title": "Lêers",
+        "description": "Enkripteer lêers en vouers na gemaskerde .mydt-objekte; blaai en voorskou hulle nadat jy ontsluit het."
       }
     },
     "tabs": {
@@ -2278,7 +2300,8 @@
       "responseCopied": "Antwoord na knipbord gekopieer",
       "codeCopied": "Kode na knipbord gekopieer",
       "copyFailed": "Failed to copy to clipboard",
-      "curlCopied": "cURL-opdrag gekopieer"
+      "curlCopied": "cURL-opdrag gekopieer",
+      "curlNoUrl": "No URL found in that cURL command"
     },
     "layout": {
       "collections": "Versamelings",
@@ -2448,7 +2471,16 @@
       "save": "Save request",
       "importCurl": "Import cURL",
       "environments": "Environments",
-      "shortcuts": "Keyboard shortcuts"
+      "shortcuts": "Keyboard shortcuts",
+      "importCollection": "Import collection (Postman / HAR)",
+      "cookies": "Cookies",
+      "perfRun": "Performance run",
+      "fuzzRun": "Fuzz run",
+      "publicMocks": "Public mocks",
+      "plugins": "Plugins",
+      "metrics": "Metrics",
+      "recorder": "Capture & replay",
+      "extensionImported": "Imported {method} {url} from extension"
     }
   },
   "RichEditor": {
@@ -5211,5 +5243,92 @@
       "accept": "Deel anoniem",
       "decline": "Nee dankie"
     }
+  },
+  "SecureFiles": {
+    "title": "Lêers",
+    "subtitle": "Lêers wat privaat bly totdat jy hulle ontsluit — geënkripteer op jou toestel, gemasker op skyf",
+    "desktopOnly": "Secure Files is in die rekenaartoepassing beskikbaar.",
+    "allFiles": "Alle lêers",
+    "overview": "Oorsig",
+    "statFiles": "Lêers",
+    "statFolders": "Vouers",
+    "statContent": "Inhoudgrootte",
+    "statContentHint": "Totale grootte van die oorspronklike lêers",
+    "statOnDisk": "Op skyf",
+    "statOverhead": "{size} enkripsie-oorhoofse koste",
+    "byType": "Volgens tipe",
+    "fileCount": "{count, plural, one {# lêer} other {# lêers}}",
+    "largestFiles": "Grootste lêers",
+    "recentlyAdded": "Onlangs bygevoeg",
+    "openContainingFolder": "Open die vouer wat dit bevat",
+    "types": {
+      "image": "Beelde",
+      "video": "Video",
+      "audio": "Klank",
+      "pdf": "PDF",
+      "archive": "Argiewe",
+      "code": "Kode",
+      "doc": "Dokumente",
+      "sheet": "Sigblaaie",
+      "file": "Ander"
+    },
+    "breadcrumb": "Vouerpad",
+    "addFiles": "Voeg lêers by",
+    "addFolder": "Voeg vouer by",
+    "importFolder": "Voer vouer in",
+    "newFolder": "Nuwe vouer",
+    "lock": "Sluit",
+    "settings": "Bergingsinstellings",
+    "storageFolder": "Bergingsvouer",
+    "notSet": "Nie gestel nie",
+    "chooseFolder": "Kies vouer",
+    "changeFolder": "Verander vouer…",
+    "chooseFolderTitle": "Kies waar geënkripteerde lêers gestoor word",
+    "chooseFolderBody": "Kies enige vouer op hierdie toestel of op 'n eksterne skyf. Buite MyDevTools bevat dit net gemaskerde .mydt-lêers.",
+    "changeFolderTitle": "Skuif geënkripteerde lêers?",
+    "changeFolderBody": "Alle .mydt-lêers word van die huidige bergingsvouer geskuif na die een wat jy volgende kies.",
+    "folderSet": "Bergingsvouer gestel",
+    "folderMissingTitle": "Bergingsvouer nie gevind nie",
+    "folderMissingBody": "“{dir}” is nie beskikbaar nie — dit is dalk op 'n ontkoppelde skyf of kom van 'n herstelde rugsteun van 'n ander masjien. Koppel dit weer, of kies 'n nuwe vouer.",
+    "movedCount": "{count} geënkripteerde lêers geskuif",
+    "importedCount": "{count} lêers geënkripteer",
+    "emptyFolderAdded": "Vouer bygevoeg — dit het geen lêers gehad om te enkripteer nie",
+    "emptyTitle": "Nog geen lêers hier nie",
+    "emptyBody": "Voeg lêers of 'n hele vouer by. Elke lêer word geënkripteer na 'n .mydt-objek met 'n lukrake naam; die oorspronklike naam, tipe en inhoud is net hier sigbaar.",
+    "name": "Naam",
+    "size": "Grootte",
+    "modified": "Gewysig",
+    "actions": "Aksies",
+    "expand": "Vou oop",
+    "collapse": "Vou toe",
+    "preview": "Voorskou",
+    "noPreview": "Geen voorskou vir hierdie lêertipe nie — voer dit uit om dit in 'n ander toepassing te open.",
+    "export": "Voer uit",
+    "exportWarningTitle": "Voer 'n gedekripteerde kopie uit?",
+    "exportWarningBody": "Die lêer word ongeënkripteer geskryf na die plek wat jy kies. Enigiets op daardie toestel kan dit lees.",
+    "exported": "Gedekripteerde kopie uitgevoer",
+    "replace": "Vervang inhoud…",
+    "replaced": "Lêerinhoud vervang",
+    "rename": "Hernoem",
+    "fileName": "Lêernaam",
+    "move": "Skuif na vouer",
+    "targetFolder": "Vouer",
+    "targetFolderHint": "Gebruik skuinsstrepe vir geneste vouers, byvoorbeeld projek/config. Laat leeg vir die boonste vlak.",
+    "folderName": "Vouernaam",
+    "delete": "Vee uit",
+    "deleted": "Lêer uitgevee",
+    "deletedCount": "{count} lêers uitgevee",
+    "deleteFileTitle": "Vee hierdie lêer uit?",
+    "deleteFileBody": "“{name}” word permanent uit die geënkripteerde bergingsvouer verwyder.",
+    "deleteFolderTitle": "Vee hierdie vouer uit?",
+    "deleteFolderBody": "Elke lêer onder “{dir}” word permanent uit die geënkripteerde bergingsvouer verwyder.",
+    "unreadableCount": "Onleesbare lêers in die bergingsvouer: {count}",
+    "unreadableHint": "Hulle is met 'n ander meesterwagwoord geënkripteer, behoort aan 'n ander kluis, of is beskadig.",
+    "dismiss": "Maak toe",
+    "viewGrid": "Roosteraansig",
+    "viewList": "Lysaansig",
+    "footerNote": "Lêers tot 20 MB. Geënkripteer met Argon2id + XChaCha20-Poly1305; die sleutel bly net in geheue terwyl die kluis ontsluit is.",
+    "cancel": "Kanselleer",
+    "save": "Stoor"
   }
 }