05/18 Enhanced codes and functionalities 8

CLAUDE.md

@@ -272,6 +272,26 @@ Requires Chrome 111+. `content.js` `onChanged` listener watches `area === 'sessi
 
 ## Key Implementation Details
 
+### Vault health notifications (background checks)
+
+`runBackgroundHealthCheck()` fires after every `loadVault()` call — async, non-blocking.
+
+**Flow:**
+1. Computes weak + reused counts synchronously from `_items` → updates sidebar badge instantly
+2. Runs HIBP k-anonymity checks in parallel (`checkHibp`) → updates badge + banner when done
+
+**Module state:**
+- `_healthCache` — `{ weak, reused, breached, breachedItems, hibpResults }` — set after first run
+- `_hibpRunning` — boolean guard prevents concurrent runs
+
+**`_updateHealthUI({ weak, reused, breached })`** — renders:
+- **Sidebar badge** (`#security-badge`) on the 🛡️ Security link: red for breaches, amber for weak/reused only, hidden when clean
+- **Dismissible banner** (`#health-banner`) above the vault list: summarises issues with "View report" link → Security tab; dismiss hides for the session (`banner.dataset.dismissed = "1"`); resets on next vault load
+
+**Security tab caching:** `renderSecurityDashboard` checks `_healthCache?.hibpResults` before querying HIBP — avoids double-calling the API within the same session.
+
+**Banner reset:** `banner.dataset.dismissed` is set to `"0"` on each vault reload so fresh results (e.g. after a password change) are visible again.
+
 ### WebAuthn / Passkey
 
 **Library:** `py-webauthn` (`webauthn>=2.0`). Installed via `pip install webauthn`.
@@ -594,6 +614,8 @@ webauthn>=2.0        # Passkey / WebAuthn (py-webauthn)
 ## Notes
 
 - Never log decrypted vault data server-side — audit details use `item_type` + `id` only
+- Background health check runs after every vault load — badge + banner update without user action
+- HIBP results cached in `_healthCache` per session — Security tab reuses them, no double-query
 - Tags live in `enc_data` as `plain.tags: string[]` — no schema change ever needed
 - `vault_items_cs` is in `chrome.storage.session` — decrypted data never written to disk
 - HIBP checks run progressively — synchronous sections render first, then parallel async checks