In @package.json:
- Around line 112-116: Add explicit documentation for the two entries in the
trustedDependencies list: update the package.json by adding a top-level
"trustedDependenciesNotes" (or similar descriptive field) explaining that
"electron-winstaller" is a transitive dependency used for Windows installer
generation via electron-builder and "objc-js" is a transitive macOS native
dependency required by electron-webauthn; mention that their versions are locked
in bun.lock for reproducibility and security. Ensure the notes reference the
trustedDependencies array and the exact dependency names ("electron-winstaller",
"objc-js") so reviewers can find the rationale without changing the dependency
list itself.
- Line 78: Replace the deprecated externalizeDepsPlugin usage in
electron.vite.config.ts: remove any imports and plugin entries referencing
externalizeDepsPlugin and instead add build.externalizeDeps configuration to
both the main and preload build configs; for the main build set
build.externalizeDeps.exclude to ["electron-context-menu","hono"] and for the
preload build set build.externalizeDeps.exclude to
["electron-chrome-extensions"], keeping all other build settings intact (note
electron-vite v5 enables externalization by default so only these override
arrays are required).

In @src/main/controllers/tabs-controller/tab.ts:
- Around line 98-104: The comment misstates behavior: explain that
nodeIntegration: false disables Node in the main renderer,
nodeIntegrationInSubFrames: true only enables Node in subframes/iframes (not
preload scripts), and contextIsolation: true isolates renderer globals so
preload scripts (enabled via the webPreferences.preload option) are used to
expose safe APIs; confirm whether Node in iframes is intentional and either set
nodeIntegrationInSubFrames to false or keep it and document the reason, and if
you intend to use a preload script, enable the preload option (uncomment/set
webPreferences.preload) and update the comment to accurately describe each
setting (nodeIntegration, nodeIntegrationInSubFrames, contextIsolation,
preload).

In @src/main/ipc/webauthn/index.ts:
- Around line 143-155: The getCredential branch currently awaits
webauthn.getCredential and either returns result.error or result.data but does
not wrap thrown exceptions; update the handler to mirror the create path by
surrounding the await call in a try/catch, catch any thrown error from
webauthn.getCredential(publicKeyOptions, { currentOrigin, topFrameOrigin,
isPublicSuffix, nativeWindowHandle: win.getNativeWindowHandle() }), map/shape
the caught error into the same AssertCredentialErrorCodes | null structure used
by the create handler, and return that shaped error instead of letting the
exception propagate.
- Around line 94-156: The get handler for "webauthn:get" can call
webauthn.getCredential with publicKeyOptions undefined; add an early return when
options.publicKey is missing (same guard as in webauthn:create) to avoid passing
undefined to webauthn.getCredential. Specifically, inside the ipcMain.handle for
"webauthn:get", check if options.publicKey (publicKeyOptions) is falsy and
return null (or the same sentinel used by create) before proceeding to call
webauthn.getCredential, so the addon always receives a defined publicKeyOptions.
- Around line 32-92: The IPC handler for "webauthn:create" currently calls
webauthn.createCredential(...) without a try/catch, so thrown exceptions can
escape the handler; wrap the call to webauthn.createCredential(publicKeyOptions,
{...}) in a try/catch and convert any thrown error into one of the declared
return values (a CreateCredentialErrorCodes value or null) before returning to
the caller, while keeping the existing handling for result.success === false and
returning result.data on success; ensure the catch covers both synchronous
throws and rejected promises and returns a sensible mapped error code (or null)
consistently.
- Around line 11-30: The TypeScript DOM types (BufferSource,
CredentialCreationOptions, CredentialRequestOptions) used by
bufferSourceToBuffer and related WebAuthn code aren’t available in the
main-process tsconfig, so the build will fail; fix by either adding the DOM lib
to the node compiler options (add "lib": ["DOM","ES2022"] to compilerOptions in
tsconfig.node.json) or by creating/using local type declarations (e.g., a shared
types file that exports BufferSource and the WebAuthn interfaces and import
those into src/main/ipc/webauthn/index.ts) and update imports; ensure whichever
approach you pick is applied consistently for all WebAuthn-related symbols
(BufferSource, CredentialCreationOptions, CredentialRequestOptions) referenced
in the file.

In @src/main/ipc/webauthn/module.ts:
- Around line 1-15: The getWebauthnAddon function can race on concurrent calls
and propagate import errors; introduce a module-level Promise cache (e.g.,
webauthnModulePromise: Promise<WebauthnModule | null> | null) alongside the
existing webauthnModule, populate that promise on the first import attempt, and
await it in subsequent callers to prevent duplicate imports; wrap the dynamic
import("electron-webauthn") in try/catch inside that promise, set webauthnModule
on success and return it, and on failure clear the promise cache and return null
(do not throw) so IPC callers receive null instead of an uncaught error.

In @src/main/ipc/webauthn/psl-check.ts:
- Around line 1-9: The isPublicSuffix function currently treats any input with
r.domain === null as a public suffix, which misclassifies invalid hostnames like
"localhost"; update the check to use the parse result's publicSuffix property:
call parseTld(d, { allowPrivateDomains: false }) as before but return true only
when r.publicSuffix !== null && r.publicSuffix === d (i.e., the parsed
publicSuffix exactly matches the input), leaving the function name
isPublicSuffix and the use of parseTld unchanged.

In @src/preload/index.ts:
- Around line 248-253: The implementation of
PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable calls
patchedCredentials.isAvailable() twice causing extra IPC; modify the function to
call patchedCredentials.isAvailable() once, store the boolean result in a local
variable, and then return that stored result (falling back to calling
oldIsUserVerifyingPlatformAuthenticatorAvailable() only if patched result is
falsy) so you avoid the duplicate IPC round-trip; locate the method by name
PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable and the helper
patchedCredentials.isAvailable()/oldIsUserVerifyingPlatformAuthenticatorAvailable
to apply this change.

In @src/preload/webauthn/fido2-utils.ts:
- Around line 97-105: bufferToString duplicates the base64url conversion logic;
change it to call the existing fromB64toUrlB64 helper instead of performing
manual replace operations. Specifically, after obtaining b64 from
fromBufferToB64, pass it into Fido2Utils.fromB64toUrlB64 (and handle the
null/error case consistently with existing behavior) so bufferToString returns
the normalized base64url string using the shared implementation used by
fromB64toUrlB64.
- Around line 97-105: bufferToString currently casts uint8Array.buffer to
ArrayBuffer which breaks if the backing store is a SharedArrayBuffer; update
bufferToString (and use Fido2Utils.bufferSourceToUint8Array) to detect if
uint8Array.buffer instanceof SharedArrayBuffer and, in that case, create a new
ArrayBuffer by slicing/copying the Uint8Array (e.g., using uint8Array.slice()
and taking its .buffer) before passing it to Fido2Utils.fromBufferToB64,
otherwise continue using uint8Array.buffer directly; ensure the resulting
variable is an ArrayBuffer for fromBufferToB64.

In @src/preload/webauthn/helpers.ts:
- Around line 42-46: rpId.includes(":") wrongly blocks IPv6 and isLocalhostLike
uses isIpLiteral(host) which makes all IPs treated as localhost; instead, ensure
IPv6 rpIds are handled by checking isIpLiteral(host) (or a dedicated
isIPv6/isLoopback helper) before rejecting on colon, and restrict
isLocalhostLike to true only for literal loopback addresses or the hostname
"localhost" (e.g., replace isIpLiteral(host) with an isLoopbackAddress(host)
check). Update the secureEnough expression to use that isLoopbackAddress(host)
with allowInsecureLocalhost && scheme === "http:" so only loopback allows http,
and remove or reorder the rpId.includes(":") guard so IPv6 rpIds pass into the
IP-origin branch; apply the same changes to the other similar block referenced
(lines ~56-64).
- Around line 76-91: Skip PSL rejection for localhost and IP literals by
checking rpId before calling isPublicSuffix: if rpId === "localhost" or it's an
IP literal (IPv4 or IPv6) then treat as safe and do not return the public-suffix
error. Update the branch that calls isPublicSuffix(rpId) to first detect IPs
(use an existing utility like net.isIP or add a small IP check helper) and skip
the check for those cases; also adjust the fallback branch so it does not reject
localhost or IP literals when doing the single-label check; keep the same return
shapes (ok:false, rpId, reason) for other failures and ensure references to
isPublicSuffix and rpId are used to locate the changes.

In @src/shared/types/fido2-types.ts:
- Around line 220-229: Update the JSDoc above the CreateCredentialErrorCodes
type to accurately describe it as error codes for creating a credential (not
asserting); replace the incorrect "Error codes for asserting a credential"
comment with something like "Error codes for creating a credential" and ensure
the AssertCredentialErrorCodes comment remains describing asserting a credential
to avoid the copy-paste mismatch between CreateCredentialErrorCodes and
AssertCredentialErrorCodes.
- Around line 257-262: The FallbackRequestedError class should set the error
name for clearer identification; update the constructor of
FallbackRequestedError to assign this.name = "FallbackRequestedError" (and
optionally call Error.captureStackTrace(this, FallbackRequestedError) for proper
stack traces in V8) while preserving the existing readonly fallbackRequested
flag and super("FallbackRequested") call.

In @src/main/ipc/webauthn/index.ts:
- Line 47: The handler reads options.publicKey into publicKeyOptions and may
pass it undefined to the native addon; add a guard that verifies
options.publicKey is defined before calling the addon (use the same pattern used
in the webauthn:get handler) and return or throw a clear error/log when it's
missing, and when present pass the validated publicKeyOptions to the addon;
update both the create/register flow (the variable publicKeyOptions used for the
addon call around the current addon invocation) and the webauthn:get handler
branch to perform the same existence check and early exit so the addon never
receives undefined.

In @src/preload/index.ts:
- Around line 113-123: Update the type annotations for the IPC responses to
match the actual values returned: change the type of the serialized variable in
the create method (the result of ipcRenderer.invoke("webauthn:create", options))
from CreateCredentialResult | null to CreateCredentialResult |
CreateCredentialErrorCodes | null, and do the same for the get() handler’s
serialized variable (ipcRenderer.invoke("webauthn:get", ...)); keep the existing
runtime checks unchanged so error-code strings still pass through to
tinyPasskeysScript.
- Around line 256-263: The override of
PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable redundantly
calls patchedCredentials.isAvailable() twice; change it to call
patchedCredentials.isAvailable() once, store the boolean result in a local
variable (e.g., available) and use that value for both the conditional check and
the return, preserving the fallback to
oldIsUserVerifyingPlatformAuthenticatorAvailable() when unavailable.

In @src/shared/types/fido2-types.ts:
- Around line 49-132: CreateCredentialParams marks timeout as optional but
AssertCredentialParams currently requires timeout, which is inconsistent with
the WebAuthn spec; change the AssertCredentialParams interface's timeout
property to be optional (timeout?: number) to match CreateCredentialParams (or
if intentional, add a comment on AssertCredentialParams explaining the
defaulting behavior). Update any callers of AssertCredentialParams to handle an
undefined timeout or to supply an explicit default where necessary.