fix: complete local-first improvement plan and restore app startup / tool IPC

browser-extension/native-host-manifest.json

@@ -1,9 +1,9 @@
 {
   "name": "com.soterios.credential_safety",
   "description": "Soterios Credential Safety Native Messaging Host",
-  "path": "src/native-host.bat",
+  "path": "native-host.bat",
   "type": "stdio",
   "allowed_origins": [
-    "chrome-extension://<EXTENSION_ID>/"
+    "chrome-extension://__EXTENSION_ID_PLACEHOLDER__/"
   ]
 }

browser-extension/package.json

@@ -6,7 +6,8 @@
   "scripts": {
     "build:icons": "node tools/build-icons.js",
     "package": "npm run build:icons && cd browser-extension && zip -r ../soterios-extension.zip . -x '*.DS_Store' 'icons/*.svg' 'tools/*'",
-    "install:host": "node tools/install-native-host.js"
+    "install:host": "node tools/install-native-host.js",
+    "postinstall": "node ../tools/validate-native-host.js"
   },
   "devDependencies": {
     "svgexport": "^0.4.2"

package.json

@@ -115,5 +115,11 @@
         "repo": "Soterios"
       }
     ]
+  },
+  "allowScripts": {
+    "better-sqlite3@13.0.2": true,
+    "canvas@3.2.3": true,
+    "electron-winstaller@5.4.0": true,
+    "unrs-resolver@1.12.2": true
   }
 }

src/core/auditLog.js

@@ -0,0 +1,52 @@
+/**
+ * Audit logging constants and helper.
+ *
+ * All sensitive security actions should call log() after the primary
+ * action completes so there is an immutable record of who did what.
+ */
+'use strict';
+
+/**
+ * Well-known audit action identifiers.
+ * @readonly
+ * @enum {string}
+ */
+const ACTIONS = Object.freeze({
+  FIREWALL_RULE_CREATE: 'firewall.rule.create',
+  FIREWALL_RULE_DELETE: 'firewall.rule.delete',
+  FIREWALL_RULE_TOGGLE: 'firewall.rule.toggle',
+  LOCKDOWN_ACTIVATE: 'lockdown.activate',
+  LOCKDOWN_RESTORE: 'lockdown.restore',
+  QUARANTINE_ADD: 'quarantine.add',
+  QUARANTINE_RESTORE: 'quarantine.restore',
+  QUARANTINE_DELETE: 'quarantine.delete',
+  PROCESS_KILL: 'process.kill',
+  SETTING_CHANGE: 'setting.change',
+  MAINTENANCE_RUN: 'maintenance.run',
+});
+
+/**
+ * Append an audit entry. Failures are swallowed so audit logging
+ * never breaks the primary action.
+ *
+ * @param {DatabaseService} db - Database service instance.
+ * @param {string} action - One of ACTIONS.
+ * @param {*} [detail] - Action detail payload.
+ * @param {*} [result] - Action result payload.
+ * @param {boolean} [userInitiated=false] - Whether the user triggered this.
+ */
+function log(db, action, detail, result, userInitiated = false) {
+  if (!db || !action) return;
+  try {
+    db.addAuditEntry({
+      action,
+      detail: JSON.stringify(detail),
+      result: JSON.stringify(result),
+      userInitiated: userInitiated ? 1 : 0,
+    });
+  } catch (_) {
+    // Audit logging must never break the primary action.
+  }
+}
+
+module.exports = { ACTIONS, log };