docs: add the Compose editor implementation plan

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 3295 insertions, 0 deletions

diff --git a/docs/superpowers/plans/2026-11-02-compose-editor.md b/docs/superpowers/plans/2026-11-02-compose-editor.md
new file mode 100644
index 00000000..dbeb76db
--- /dev/null
+++ b/docs/superpowers/plans/2026-11-02-compose-editor.md
@@ -0,0 +1,3295 @@
+# Compose UI overhaul, step 4: Entry editor. Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Replace the legacy `PasswordCreationActivity`, its generator dialogs, the manual OTP dialog and `SelectFolderActivity` with Compose: an editor destination (`EditRoute`) in `MainActivity`, opened from the list's create sheet and from the entry view's edit action; a generator bottom sheet with random and diceware tabs; OTP from QR (camera or image) and manual; a folder picker dialog shared by the editor and the list's move action. The autofill save flow hosts the same editor. Every save-path check of 0.1.2 stays.
+
+**Architecture:** `EditRoute(dir, name?)` gets an `EditorViewModel` per back stack entry. The form (`EditorForm`: name, folder, password, username, extra) lives in Compose state in that ViewModel only. A new entry starts empty in the list's folder. An edit copies its plaintext once from the `EntryViewModel` of the `EntryRoute` below it on the back stack (`nav.getBackStackEntry<EntryRoute>()`), so plaintext never travels in a route or saved state and no second passphrase prompt is needed. Pure logic (form to pass file, validation, target file, overwrite check, atomic write, OTP URI, generator options) sits in `EditorModel.kt` with unit tests. Saving runs in `activity.lifecycleScope`, like the list's store operations: the ViewModel encrypts (CryptoRepository, unchanged) and writes off the main thread, the destination commits (`commitChange` needs the activity). `FLAG_SECURE` moves out of the destinations into a counted hold in `MainActivity` (`SecureWindow`), so entry and editor can overlap during a transition without clearing it. `AutofillSaveActivity` sets `FLAG_SECURE` for its window and shows `EditorDestination` directly. The legacy editor, its dialogs and layouts, the folder picker activity and fragment, and the now unused `flowbinding` and `swiperefreshlayout` dependencies are deleted.
+
+**Tech Stack:** Kotlin 2.4.21, Compose BOM 2024.09.03 (foundation 1.7.3: `KeyboardOptions(autoCorrectEnabled = ...)`; Material 3 1.3.0: `ModalBottomSheet(properties = ModalBottomSheetProperties(securePolicy = ...))`, `PrimaryTabRow`, `Tab`), navigation-compose 2.8.9 (`getBackStackEntry<T>()`, `popBackStack<T>(inclusive)`), `hilt-navigation-compose` 1.2.0 (`hiltViewModel(viewModelStoreOwner)`), zxing-android-embedded (unchanged), passgen modules (unchanged), kotlin-result 2.0.0. No new dependencies.
+
+Spec: `docs/superpowers/specs/2026-11-02-compose-ui-overhaul-design.md`. Earlier plans: `2026-11-02-compose-foundation.md`, `2026-11-02-compose-list.md`, `2026-11-02-compose-entry.md` (same folder).
+
+## Decisions taken in this plan
+
+- **How plaintext reaches the editor: the entry view's ViewModel.** The `EditRoute` composable looks up the `EntryRoute` back stack entry below it and reads `hiltViewModel<EntryViewModel>(that entry).entry`, then the editor copies it into its own ViewModel once (`EditorViewModel.start`, a no-op afterwards). Rejected: nav arguments or saved state (plaintext in a Bundle, forbidden); re-decrypting in the editor (a second passphrase prompt, or a silent dependency on the cache); an activity-scoped holder (outlives the entry). Consequences, all safe: after process death the restored `EditRoute` finds no plaintext and closes, so the entry view asks for the passphrase again (`ponytail:` marked). The entry's auto-close timer may drop its copy while the editor is open; the editor already has its own, and cancelling returns to an entry that then closes itself, as the old decrypt activity did.
+- **Routes and returns.** `EditRoute(dir, name = null)`: `dir` relative to the store root, `name` the entry's file name without `.gpg` (null for a new entry). From the list: `EditRoute(path)`. From the entry view: `EditRoute(folder, name)`. After save: pop to the topmost `ListRoute` (it re-reads the store on resume); with none below (entry opened from a shortcut) the list root replaces the stack, as step 3 decided. After cancel (close icon or system back): pop, back to the list or the entry view. Both go through one guarded path: only the editor on top acts, nothing happens while a save runs, the keyboard is hidden and focus cleared first.
+- **Folder picker: a dialog, not a destination.** `FolderPicker` (breadcrumbs plus subfolder rows with counts, New folder, Select, Cancel) returns its pick through a callback into the caller's own state, so there is no result channel across back stack entries. It shows no secrets; its window inherits `FLAG_SECURE` from the editor below. It replaces `SelectFolderActivity` for the editor and the list's move action. "New folder" creates a folder inside the folder shown and opens it, through the list's own `FolderNameDialog` and `folderNameError` (blank, already a file or folder, outside the store by path components), shared rather than copied (maintainer decision 2).
+- **Autofill save hosts the Compose editor.** `AutofillSaveActivity` stays an activity (the autofill service starts it) but now calls `setContent { EditorDestination(...) }` with the form prefilled from its intent, instead of starting `PasswordCreationActivity` for a result. It sets `FLAG_SECURE`, uses `NoActionBarThemeM3` and `configChanges="orientation|screenSize"`. After saving it records the autofill match and, for "generate password", returns the fill dataset, exactly as before. This is what lets the legacy editor and its dialogs go in this step (open question 1).
+- **FLAG_SECURE is counted.** `MainActivity.holdSecure()` / `releaseSecure()` and a private top-level `SecureWindow(activity)` composable (a `DisposableEffect`) wrap the entry and editor destinations in the `NavHost`. The flag goes on with the first hold and off with the last release, so entry to editor and back never clears it while either is composed. The `EntryDestination`'s own add/clear pair and its `ponytail:` note are removed. The generator sheet and the manual OTP dialog set `SecureFlagPolicy.SecureOn` explicitly; the picker inherits.
+- **Save path, every 0.1.2 check kept, three old gaps closed.** In order: `formError` (empty name, `/` in the name, empty password and extra: same messages); `isInsideRepository` on the target (component-wise since 0.1.2), now checked before anything is created (the old editor created the folder first, so a crafted autofill folder name such as `site/../../x` could create directories outside the store); recipients from the nearest `.gpg-id` (`getPGPIdentifiers`, same snackbars for short or invalid IDs); refusal to overwrite another entry, now also when an edit only moves to another folder (the old check missed that case and overwrote silently); encryption to every recipient, refused when a key is missing (`CryptoRepository.encrypt`, untouched): nothing is written and nothing committed, the folder is not even created; the write goes through a temporary file moved over the target, so a failed write cannot truncate the existing entry; on rename or move the old file is deleted, now also for a move without rename (the old editor left a copy), and its autofill matches and recently-used time follow it; then `git add` and commit with the old messages.
+- **Generator sheet.** One `ModalBottomSheet`, tabs Random and Diceware, the first tab chosen by the existing "Password generator" setting (`PREF_KEY_PWGEN_TYPE`, default diceware). Options, preference files and keys are the old ones (`PasswordGenerator` file for random, `pwgen` for diceware), so stored choices carry over. Every change regenerates (as the old dialogs did), Generate rolls again, Use fills the password. Errors show in the sheet instead of a toast. Generation runs off the main thread (the diceware word list is read on first use). Lengths are capped by the fields (3 digits, 2 for diceware words), `ponytail:` marked.
+- **OTP.** "OTP from QR" opens a small menu: "Scan QR code" (zxing `CaptureActivity`, unchanged, only when the device has a camera) and "Choose an image" (decoded off the main thread). "Manual OTP" opens a dialog with secret and account; spaces in the secret are dropped. The resulting URI line is appended to the extra content on its own line. Both actions hide once the extra content holds a TOTP secret, as before.
+- **Username always shown; "Encrypt username" switch dropped.** The spec puts a username field on the editor; the switch only moved text between the name and username fields for the file-based layout (open question 3).
+- **"Save and copy" kept, in the overflow.** It now copies only after a successful save, through `copyPasswordToClipboard` (sensitive flag and clear timer). The spec's top bar has Save only (open question 4).
+- **"No keys imported" prompt not ported to the editor.** The entry view still has it, and the editor can only edit an entry the entry view decrypted. A new entry on a store without keys fails at encryption with the 0.1.2 refusal ("Could not encrypt the password, nothing was saved: ...").
+- **Keyboard types.** Password and extra content use `KeyboardType.Password` (multi-line for the extras), keeping the old `textVisiblePassword` intent that keyboards do not learn them; Compose has no visible-password type, and the text stays visible unless masked by the reveal toggle. Name and username turn autocorrect off.
+- **Password visibility** starts from the "Show the password" setting, as in the entry view.
+- **Commit failures are not surfaced**, exactly like the list's move and delete (`commitChange` result ignored); a theme or locale change in the middle of a save cancels before the commit, and the next commit picks the file up. `ponytail:` marked.
+
+## Feature parity
+
+### `PasswordCreationActivity`
+
+| Behavior today | Decision |
+|---|---|
+| `FLAG_SECURE` on the whole activity (`BasePGPActivity`) | Port: counted hold while the editor is composed; `AutofillSaveActivity` sets it for its window |
+| Title "New password" / "Edit password", up arrow cancels | Port: "New entry" / "Edit entry" (the app's word), close icon and system back through one guarded close path |
+| Name field, focused on a new entry | Port (focus only on first show, not after recreation) |
+| Directory field: hidden for new entries from the list, editable text for edits and autofill, created with `createDirectories` before any check | Changed: breadcrumb chips plus "Change" (picker) everywhere; the folder is created when the file is written, after the inside-repository check |
+| Username field shown only for the encrypted-username layout or when prefilled | Changed: always shown (spec) |
+| "Encrypt username" switch (file-based layout, new entries) | Drop: both fields are always visible (open question 3) |
+| Password field, visible while typing, masked when prefilled or generated, toggle | Port: reveal toggle, initial state from "Show the password", monospace |
+| "Generate" button opens the classic or diceware dialog per setting | Port: generator icon in the password field opens the sheet; the setting picks the first tab |
+| Extra content, multi-line, `textVisiblePassword` | Port: multi-line, `KeyboardType.Password` |
+| "Add OTP" hidden once the extras hold a TOTP secret | Port (both OTP actions) |
+| OTP: scan QR (camera only), choose an image, enter manually; manual only without a camera | Port: "OTP from QR" menu (scan with a camera, image always), "Manual OTP" dialog |
+| OTP import snackbars (success, failure, no image selected) | Port |
+| Save | Port: top bar |
+| Save and Copy (copied before encrypting, even when the save then failed) | Port in the overflow; copies only after a successful save (open question 4) |
+| `requireKeysExist` "No keys imported" dialog with import | Drop: see decisions; a save without the recipient key is refused and writes nothing |
+| Validation: empty name, `/` in the name, empty password and extra content | Port (`formError`, same strings) |
+| Recipients from the nearest `.gpg-id`, snackbars for short or invalid IDs | Port (`getPGPIdentifiers`) |
+| Encrypt to every recipient, refuse when a key is missing (0.1.2) | Port unchanged (`CryptoRepository.encrypt`) |
+| Encrypt in memory before writing; nothing written or committed on failure (0.1.2) | Port; the target folder is now also left uncreated |
+| Duplicate check for new entries and renames | Port and fix: also for a move to another folder |
+| `isInsideRepository` on the target (after creating the folder) | Port, checked first |
+| File written in place | Changed: temporary file moved over the target |
+| Rename deletes the old file when the name changed | Port and fix: also when only the folder changed |
+| Old file not deletable: dialog, no commit, editor closes | Changed: long snackbar, the new file is committed and the editor closes |
+| Recently-used time carried over on rename | Port (`moveHistory`, shared with the list's folder rename) |
+| Autofill matches of a renamed entry | New: updated like the list's move does (the old editor lost them) |
+| Write error: dialog, editor closes | Changed: dialog, the editor stays open with its content |
+| Commit "Add generated password for ..." / "Edit password for ..." | Port (named after the new location) |
+| Result extras for the caller (created file, name, long name; password and username when generated) | Port as `SaveResult.Saved` for autofill; `MainActivity` returns to the list |
+| Rotation recreates the activity; the fields' text went into the saved instance state | Changed: no recreation (`configChanges`), form in ViewModel memory only, never in saved state |
+
+### Generator dialogs
+
+| Behavior today | Decision |
+|---|---|
+| Random: numerals, symbols, uppercase, lowercase, pronounceable, ambiguous, length; `PasswordGenerator` preferences | Port, same keys and defaults (length 20; 16 when the field is empty) |
+| Diceware: word count, separator; `pwgen` preferences | Port, same keys and defaults (5 words, `-`) |
+| Regenerate on every change, "Generate", OK, Cancel | Port: regenerate on change, "Generate", "Use", dismiss cancels |
+| Generator errors as a toast | Changed: shown in the sheet |
+| Monospace preview | Port |
+| Generation on the main thread | Changed: off the main thread |
+| Dialog window inherits the secure flag | Changed: `SecureOn` explicitly |
+
+### OTP import
+
+| Behavior today | Decision |
+|---|---|
+| Manual dialog: secret, account; `otpauth://totp?secret=...&issuer=...`; a blank secret appended an empty string | Port: OK disabled while the secret is blank; spaces dropped; issuer percent-encoded |
+| zxing `CaptureActivity` launched for a result | Keep as is |
+| QR image decoded on the main thread | Port, off the main thread |
+
+### Folder picker (`SelectFolderActivity`, `SelectFolderFragment`)
+
+| Behavior today | Decision |
+|---|---|
+| Separate activity with a RecyclerView of folders (hidden ones per "Show hidden contents", never `.git`), fast scroller, Select menu item, up arrow | Replace: `FolderPicker` dialog with breadcrumbs (jump up), folder rows with counts, Select, Cancel; same hidden filter; no fast scroller |
+| No way to create a folder (the old edit screen took a typed path instead) | New: "New folder" in the picker, the list's dialog and checks |
+| Used by the list's move action | Port: the list's move uses `FolderPicker` |
+
+### Deleted in this step (Task 7)
+
+`PasswordCreationActivity.kt`, `EditPasswordScreen.kt` (upstream WIP), `PasswordGeneratorDialogFragment.kt`, `DicewarePasswordGeneratorDialogFragment.kt`, `OtpImportDialogFragment.kt`, `SelectFolderActivity.kt`, `SelectFolderFragment.kt`, `PasswordItemRecyclerAdapter.kt`, layouts `password_creation_activity.xml`, `fragment_pwgen.xml`, `fragment_pwgen_diceware.xml`, `fragment_manual_otp_entry.xml`, `select_folder_layout.xml`, `password_recycler_view.xml`, `password_row_layout.xml`, menus `pgp_handler_new_password.xml`, `pgp_handler_select_folder.xml`, drawables `ic_save_24dp.xml`, `ic_save_copy_24dp.xml`, ui:compose `PasswordField.kt` (`PasswordField`, `CopyButton`: only `EditPasswordScreen` used them), the `flowbinding` and `swiperefreshlayout` dependencies (only the deleted dialogs and `password_recycler_view.xml` used them), the two manifest entries and the two baseline issues in the deleted dialogs.
+
+**What remains of `BasePGPActivity`** (for `AutofillDecryptActivity` until step 7): the class with `requireKeysExist`, the injected `settings`, `repository`, `dispatcherProvider` and `FLAG_SECURE` in `onCreate`; the companion's `EXTRA_FILE_PATH` (`LaunchActivity`, `MainActivity`), `getRelativePath`, `getParentPath`, `getLongName` (`PasswordItem`, `StoreActions`, entry and autofill); the `copyTextToClipboard`, `copyPasswordToClipboard` and `getPGPIdentifiers` extensions. Removed: `repoPath`, `fullPath`, `EXTRA_REPO_PATH` (only the editor used them).
+
+**Kept for later steps:** `PasswordDialog` and `dialog_password_entry.xml` (`AutofillDecryptActivity`, step 7); ui:compose `PasswordItem.kt` and `APSAppBar.kt` (unrelated to the editor; `PGPKeyListActivity` uses `APSAppBar`, steps 5 and 8); `recyclerview`, `recyclerview-selection`, `fastscroll`, `SearchableRepositoryAdapter`, `password_row_background.xml` (autofill filter and git log, steps 6 to 8).
+
+## Lessons from steps 2 and 3, designed in
+
+- `MainActivity` keeps `configChanges="orientation|screenSize"`; `AutofillSaveActivity` gets the same for the same reason (a save running in `lifecycleScope` must survive rotation).
+- Slack compose-lint: no composable members on activities (`SecureWindow` is a private top-level function taking the activity); every public composable has `modifier: Modifier = Modifier` as its first optional parameter; no collection parameters (the picker reads its own rows, kept as `ImmutableList`); `EditorViewModel` is a default parameter of `EditorDestination` and only method references and values are passed down.
+- Accessibility: every `IconButton` has a content description (close, more options, show or hide password, generate); the editor has no FAB.
+- Compose 1.7 focus and keyboard: the editor requests focus only on its first showing per ViewModel (name for a new entry, username for an autofill prefill, nothing for an edit); the guarded close path hides the keyboard and clears focus before leaving, so neither the entry view nor the list comes back with a stray keyboard (the list's own return handling from step 2 still applies).
+- Dialogs and sheets are composed only while shown, so each opening starts fresh; the passphrase-style `remember`, never `rememberSaveable`, holds the manual OTP secret and the generated preview.
+- Double submit: `EditorViewModel.save` sets `saving` before its first suspension (`lifecycleScope` runs on `Main.immediate`), Save is disabled while it is set, and it stays set after a success; the list's picker ignores a second Select.
+- Off the main thread: encryption (CryptoRepository), the overwrite check, the write and delete, subfolder listing, QR decoding, password generation. The `.gpg-id` read stays on the main thread inside `getPGPIdentifiers` (it shows snackbars), as in the entry view.
+- One ViewModel per back stack entry (`hiltViewModel()` in the destination).
+
+**Conventions for every task**
+
+- New files get this header:
+  ```kotlin
+  /*
+   * Copyright (C) 2026 Danilo M. <danix@danix.xyz>
+   * SPDX-License-Identifier: GPL-3.0-only
+   */
+  ```
+- Commits are GPG-signed (default config, never disable). End each message with
+  `Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>`.
+- No em dashes in docs, comments or commit messages.
+- Before each commit run `./gradlew spotlessApply`, then the step's checks.
+- Work on the `compose` branch.
+
+---
+
+### Task 1: Editor model and folder listing (TDD)
+
+**Files:**
+- Create: `app/src/main/java/app/passwordstore/ui/editor/EditorModel.kt`
+- Test: `app/src/test/java/app/passwordstore/ui/editor/EditorModelTest.kt`
+- Modify: `app/src/main/java/app/passwordstore/ui/list/ListModel.kt`
+- Modify: `app/src/test/java/app/passwordstore/ui/list/ListModelTest.kt`
+
+- [ ] **Step 1: Failing tests for the editor model**
+
+`app/src/test/java/app/passwordstore/ui/editor/EditorModelTest.kt`:
+
+```kotlin
+/*
+ * Copyright (C) 2026 Danilo M. <danix@danix.xyz>
+ * SPDX-License-Identifier: GPL-3.0-only
+ */
+
+package app.passwordstore.ui.editor
+
+import app.passwordstore.R
+import app.passwordstore.data.passfile.PasswordEntry
+import app.passwordstore.passgen.random.PasswordOption
+import app.passwordstore.util.time.UserClock
+import app.passwordstore.util.totp.UriTotpFinder
+import java.io.File
+import java.nio.file.Files
+import kotlin.test.AfterTest
+import kotlin.test.Test
+import kotlin.test.assertContentEquals
+import kotlin.test.assertEquals
+import kotlin.test.assertFalse
+import kotlin.test.assertNull
+import kotlin.test.assertTrue
+
+class EditorModelTest {
+
+  private val root = Files.createTempDirectory("aps").toFile()
+
+  @AfterTest
+  fun cleanUp() {
+    root.deleteRecursively()
+  }
+
+  private fun entry(content: String) =
+    PasswordEntry(UserClock(), UriTotpFinder(), content.encodeToByteArray())
+
+  @Test
+  fun editingWithoutChangesKeepsThePassFile() {
+    val files =
+      listOf(
+        "hunter2\nusername: alice\nurl: https://example.org\n",
+        "s3cret\notpauth://totp/example.com:carol?secret=JBSWY3DPEHPK3PXP&issuer=example.com\n",
+      )
+    for (content in files) assertEquals(content, passContent(editorForm(entry(content), "", "x")))
+  }
+
+  @Test
+  fun formFromAnEntrySplitsItsFields() {
+    val form =
+      editorForm(entry("hunter2\nusername: alice\nurl: https://example.org\n"), "work", "mail")
+    assertEquals(EditorForm("mail", "work", "hunter2", "alice", "url: https://example.org\n"), form)
+  }
+
+  @Test
+  fun newEntryContent() {
+    assertEquals(
+      "pw\nusername: bob\nnote: x",
+      passContent(EditorForm(name = "n", password = "pw", username = "bob", extra = "note: x")),
+    )
+    assertEquals("pw\n", passContent(EditorForm(name = "n", password = "pw")))
+  }
+
+  @Test
+  fun formErrors() {
+    assertEquals(R.string.file_toast_text, formError(EditorForm(name = " ", password = "pw")))
+    assertEquals(
+      R.string.invalid_filename_text,
+      formError(EditorForm(name = "a/b", password = "pw")),
+    )
+    assertEquals(R.string.empty_toast_text, formError(EditorForm(name = "a", username = "bob")))
+    assertNull(formError(EditorForm(name = "a", extra = "note")))
+    assertNull(formError(EditorForm(name = "a", password = "pw")))
+  }
+
+  @Test
+  fun entryFileTrimsTheNameAndUsesTheFolder() {
+    assertEquals(File(root, "work/mail.gpg"), entryFile(root, EditorForm(name = " mail ", dir = "work")))
+    assertEquals(File(root, "mail.gpg"), entryFile(root, EditorForm(name = "mail")))
+  }
+
+  @Test
+  fun overwritesOnlyAnotherFile() {
+    val taken = File(root, "a.gpg").apply { writeText("x") }
+    assertFalse(overwrites(File(root, "work/b.gpg"), null))
+    assertTrue(overwrites(taken, null))
+    assertFalse(overwrites(taken, taken))
+    assertTrue(overwrites(taken, File(root, "work/b.gpg")))
+  }
+
+  @Test
+  fun writeEntryCreatesTheFolderAndReplacesTheFile() {
+    val target = File(root, "new/dir/a.gpg")
+    writeEntry(target, byteArrayOf(1))
+    writeEntry(target, byteArrayOf(2, 3))
+    assertContentEquals(byteArrayOf(2, 3), target.readBytes())
+    assertEquals(listOf("a.gpg"), target.parentFile!!.list()!!.toList())
+  }
+
+  @Test
+  fun linesGoOnTheirOwnLine() {
+    assertEquals("otpauth://x", withLine("", "otpauth://x"))
+    assertEquals("a\notpauth://x", withLine("a", "otpauth://x"))
+    assertEquals("a\notpauth://x", withLine("a\n", "otpauth://x"))
+  }
+
+  @Test
+  fun manualTotpUriIsReadBackByTheParser() {
+    val uri = totpUri(" JBSW Y3DP EHPK 3PXP ", "Example Co")!!
+    assertEquals("JBSWY3DPEHPK3PXP", UriTotpFinder().findSecret(uri))
+    assertEquals("Example Co", UriTotpFinder().findIssuer(uri))
+    assertTrue(entry("PLACEHOLDER\n$uri").hasTotp())
+    assertEquals("otpauth://totp?secret=JBSWY3DPEHPK3PXP", totpUri("JBSWY3DPEHPK3PXP", " "))
+    assertNull(totpUri("  ", "Example Co"))
+  }
+
+  @Test
+  fun randomOptionsFollowTheCheckboxes() {
+    assertEquals(listOf(PasswordOption.FullyRandom), RandomSpec().options())
+    assertEquals(
+      listOf(
+        PasswordOption.NoDigits,
+        PasswordOption.AtLeastOneSymbol,
+        PasswordOption.NoUppercaseLetters,
+        PasswordOption.NoLowercaseLetters,
+        PasswordOption.NoAmbiguousCharacters,
+      ),
+      RandomSpec(
+          numerals = false,
+          symbols = true,
+          uppercase = false,
+          lowercase = false,
+          ambiguous = false,
+          pronounceable = true,
+        )
+        .options(),
+    )
+  }
+
+  @Test
+  fun randomPasswordOrWhyNot() {
+    assertEquals(20, randomPassword(RandomSpec()).value.length)
+    assertEquals(
+      R.string.pwgen_no_chars_error,
+      randomPassword(RandomSpec(numerals = false, uppercase = false, lowercase = false)).error,
+    )
+    assertEquals(
+      R.string.pwgen_length_too_short_error,
+      randomPassword(RandomSpec(length = 2)).error,
+    )
+  }
+}
+```
+
+Run: `./gradlew :app:testDebugUnitTest --tests app.passwordstore.ui.editor.EditorModelTest`
+Expected: compilation FAILS with `Unresolved reference 'EditorForm'` (and the other new names).
+
+- [ ] **Step 2: The editor model**
+
+`app/src/main/java/app/passwordstore/ui/editor/EditorModel.kt`:
+
+```kotlin
+/*
+ * Copyright (C) 2026 Danilo M. <danix@danix.xyz>
+ * SPDX-License-Identifier: GPL-3.0-only
+ */
+
+package app.passwordstore.ui.editor
+
+import androidx.annotation.StringRes
+import androidx.compose.runtime.Immutable
+import app.passwordstore.R
+import app.passwordstore.data.passfile.PasswordEntry
+import app.passwordstore.passgen.random.MaxIterationsExceededException
+import app.passwordstore.passgen.random.NoCharactersIncludedException
+import app.passwordstore.passgen.random.PasswordGenerator
+import app.passwordstore.passgen.random.PasswordLengthTooShortException
+import app.passwordstore.passgen.random.PasswordOption
+import com.github.michaelbull.result.Result
+import com.github.michaelbull.result.mapError
+import com.github.michaelbull.result.runCatching
+import java.io.File
+import java.io.IOException
+import java.net.URLEncoder
+import java.nio.file.Files
+import java.nio.file.StandardCopyOption
+
+/**
+ * What the editor edits. [dir] is the folder relative to the store root ("" is the root), [name]
+ * the file name without `.gpg`. Plaintext: held in memory only, never in saved state or a route.
+ */
+@Immutable
+data class EditorForm(
+  val name: String = "",
+  val dir: String = "",
+  val password: String = "",
+  val username: String = "",
+  val extra: String = "",
+)
+
+/** The form for [entry], stored as [name] in [dir], split as the old editor split it. */
+fun editorForm(entry: PasswordEntry, dir: String, name: String): EditorForm =
+  EditorForm(
+    name = name,
+    dir = dir,
+    password = entry.password.orEmpty(),
+    username = entry.username.orEmpty(),
+    extra = entry.extraContentWithoutUsername,
+  )
+
+/** The pass file, as the old editor wrote it: password, `username: ...` when set, the extras. */
+fun passContent(form: EditorForm): String {
+  val username = if (form.username.isEmpty()) "" else "\nusername: ${form.username}"
+  return "${form.password}$username\n${form.extra}"
+}
+
+/** Why [form] cannot be saved, as a string resource, or null when it can. */
+@StringRes
+fun formError(form: EditorForm): Int? =
+  when {
+    form.name.isBlank() -> R.string.file_toast_text
+    '/' in form.name -> R.string.invalid_filename_text
+    form.password.isEmpty() && form.extra.isEmpty() -> R.string.empty_toast_text
+    else -> null
+  }
+
+/** Where [form] is saved in the store at [root]. */
+fun entryFile(root: File, form: EditorForm): File =
+  File(File(root, form.dir), "${form.name.trim()}.gpg")
+
+/** True when saving to [target] would replace a file other than the [original] being edited. */
+fun overwrites(target: File, original: File?): Boolean =
+  target.exists() && target.canonicalPath != original?.canonicalPath
+
+/**
+ * Writes [bytes] to [target], creating its folder, through a temporary file moved over it, so a
+ * failed write never truncates an existing entry.
+ */
+fun writeEntry(target: File, bytes: ByteArray) {
+  val dir = target.parentFile ?: throw IOException("No folder for $target")
+  dir.mkdirs()
+  val temp = File(dir, ".${target.name}.tmp")
+  try {
+    temp.writeBytes(bytes)
+    Files.move(
+      temp.toPath(),
+      target.toPath(),
+      StandardCopyOption.REPLACE_EXISTING,
+      StandardCopyOption.ATOMIC_MOVE,
+    )
+  } finally {
+    temp.delete()
+  }
+}
+
+/** [extra] with [line] added on a line of its own. */
+fun withLine(extra: String, line: String): String =
+  if (extra.isEmpty() || extra.endsWith('\n')) "$extra$line" else "$extra\n$line"
+
+/**
+ * An `otpauth://totp` URI, as the old manual OTP dialog built it, for a typed [secret] (spaces
+ * dropped: authenticators show it in groups) and an optional [issuer]; null for a blank secret.
+ */
+fun totpUri(secret: String, issuer: String): String? {
+  val key = secret.filterNot(Char::isWhitespace)
+  if (key.isEmpty()) return null
+  fun encode(s: String) = URLEncoder.encode(s, "UTF-8").replace("+", "%20")
+  val tail = if (issuer.isBlank()) "" else "&issuer=${encode(issuer.trim())}"
+  return "otpauth://totp?secret=${encode(key)}$tail"
+}
+
+/** The random generator's options, as its checkboxes show them; defaults are the old dialog's. */
+@Immutable
+data class RandomSpec(
+  val numerals: Boolean = true,
+  val symbols: Boolean = false,
+  val uppercase: Boolean = true,
+  val lowercase: Boolean = true,
+  val ambiguous: Boolean = true,
+  val pronounceable: Boolean = false,
+  val length: Int = 20,
+)
+
+/** The generator's options for this spec, negated where the generator asks what to leave out. */
+fun RandomSpec.options(): List<PasswordOption> =
+  listOfNotNull(
+    PasswordOption.NoDigits.takeUnless { numerals },
+    PasswordOption.AtLeastOneSymbol.takeIf { symbols },
+    PasswordOption.NoUppercaseLetters.takeUnless { uppercase },
+    PasswordOption.NoLowercaseLetters.takeUnless { lowercase },
+    PasswordOption.NoAmbiguousCharacters.takeUnless { ambiguous },
+    PasswordOption.FullyRandom.takeUnless { pronounceable },
+  )
+
+/** A random password for [spec], or the string resource saying why there is none. */
+fun randomPassword(spec: RandomSpec): Result<String, Int> =
+  runCatching { PasswordGenerator.generate(spec.options(), spec.length) }
+    .mapError { e ->
+      when (e) {
+        is MaxIterationsExceededException -> R.string.pwgen_max_iterations_exceeded
+        is NoCharactersIncludedException -> R.string.pwgen_no_chars_error
+        is PasswordLengthTooShortException -> R.string.pwgen_length_too_short_error
+        else -> R.string.pwgen_some_error_occurred
+      }
+    }
+
+/** The diceware generator's options; defaults are the old dialog's. */
+@Immutable data class DicewareSpec(val words: Int = 5, val separator: Char = '-')
+```
+
+Run: `./gradlew :app:testDebugUnitTest --tests app.passwordstore.ui.editor.EditorModelTest`
+Expected: `BUILD SUCCESSFUL`, 11 tests pass. If `manualTotpUriIsReadBackByTheParser` fails on the
+issuer, the parser (`com.eygraber.uri.Uri`) decodes differently from `URLEncoder`: compare with
+`UriTotpFinderTest` and adjust `encode` only, never the test's expectations.
+
+- [ ] **Step 3: Failing test for the picker's folder listing**
+
+In `app/src/test/java/app/passwordstore/ui/list/ListModelTest.kt`, add inside the class, after
+the last test:
+
+```kotlin
+  @Test
+  fun pickerOffersFoldersByName() {
+    folder("b")
+    folder("A")
+    folder(".hidden")
+    folder(".git")
+    file("c.gpg")
+    assertEquals(listOf("A", "b"), subfolders(root, showHidden = false).map { it.name })
+    assertEquals(listOf(".hidden", "A", "b"), subfolders(root, showHidden = true).map { it.name })
+    assertEquals(emptyList<File>(), subfolders(File(root, "missing"), showHidden = false))
+  }
+```
+
+Run: `./gradlew :app:testDebugUnitTest --tests app.passwordstore.ui.list.ListModelTest`
+Expected: compilation FAILS with `Unresolved reference 'subfolders'`.
+
+- [ ] **Step 4: The folder listing**
+
+In `app/src/main/java/app/passwordstore/ui/list/ListModel.kt`, add after `childCount`:
+
+```kotlin
+/**
+ * Folders directly inside [dir] that the folder picker offers, by name: never `.git`, other hidden
+ * folders only with "Show hidden contents" ([showHidden]), as the list filters them.
+ */
+fun subfolders(dir: File, showHidden: Boolean): List<File> =
+  dir
+    .listFiles { f -> f.isDirectory && !f.name.startsWith(".git") && (showHidden || !f.isHidden) }
+    .orEmpty()
+    .sortedBy { it.name.lowercase() }
+```
+
+Run: `./gradlew :app:testDebugUnitTest --tests app.passwordstore.ui.list.ListModelTest`
+Expected: `BUILD SUCCESSFUL`.
+
+- [ ] **Step 5: Checks and commit**
+
+Run: `./gradlew spotlessApply && CI=1 ./gradlew :app:assembleDebug :app:testDebugUnitTest`
+Expected: `BUILD SUCCESSFUL`.
+
+```bash
+git add app/src/main/java/app/passwordstore/ui/editor/EditorModel.kt \
+  app/src/test/java/app/passwordstore/ui/editor/EditorModelTest.kt \
+  app/src/main/java/app/passwordstore/ui/list/ListModel.kt \
+  app/src/test/java/app/passwordstore/ui/list/ListModelTest.kt
+git commit -m "feat(app): add the editor model and the picker's folder listing
+
+Pure functions for the Compose editor: the form and the pass file it
+writes, validation, the target file, the overwrite check, an atomic
+write, OTP URI building and the random generator's options. The folder
+picker lists subfolders with the list's hidden filter.
+
+Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>"
+```
+
+---
+
+### Task 2: Folder picker dialog; the list's move uses it
+
+**Files:**
+- Create: `app/src/main/java/app/passwordstore/ui/list/FolderPicker.kt`
+- Modify: `app/src/main/java/app/passwordstore/ui/list/ListDestination.kt`
+- Modify: `app/src/main/res/values/strings.xml`
+- Modify: `app/src/main/res/values-it/strings.xml`
+
+`SelectFolderActivity` stays compiled but unused until Task 7.
+
+- [ ] **Step 1: The picker**
+
+`app/src/main/java/app/passwordstore/ui/list/FolderPicker.kt`:
+
+```kotlin
+/*
+ * Copyright (C) 2026 Danilo M. <danix@danix.xyz>
+ * SPDX-License-Identifier: GPL-3.0-only
+ */
+
+package app.passwordstore.ui.list
+
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.heightIn
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.rememberScrollState
+import androidx.compose.foundation.verticalScroll
+import androidx.compose.material3.AlertDialog
+import androidx.compose.material3.Text
+import androidx.compose.material3.TextButton
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.key
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.produceState
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.saveable.rememberSaveable
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.platform.LocalContext
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.unit.dp
+import app.passwordstore.R
+import app.passwordstore.ui.compose.BreadcrumbBar
+import app.passwordstore.ui.compose.FolderRow
+import app.passwordstore.ui.compose.crumbsFor
+import app.passwordstore.ui.compose.theme.SpacingMedium
+import app.passwordstore.util.extensions.sharedPrefs
+import app.passwordstore.util.settings.PreferenceKeys
+import java.io.File
+import kotlinx.collections.immutable.ImmutableList
+import kotlinx.collections.immutable.persistentListOf
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.withContext
+
+/**
+ * Picks a folder of the store at [root], starting at [start] (relative to the root, "" is the
+ * root): breadcrumbs jump up, rows open subfolders, "New folder" creates one inside the folder
+ * shown (the list's validation) and opens it, Select reports the folder shown, relative to the
+ * root. Used by the list's move action and by the editor. Shows no secrets; its window inherits
+ * FLAG_SECURE from the screen below.
+ */
+@Composable
+fun FolderPicker(
+  root: File,
+  start: String,
+  onPick: (relativePath: String) -> Unit,
+  onDismiss: () -> Unit,
+  modifier: Modifier = Modifier,
+) {
+  val context = LocalContext.current
+  var path by rememberSaveable { mutableStateOf(start) }
+  var naming by rememberSaveable { mutableStateOf(false) }
+  val showHidden = remember {
+    context.sharedPrefs.getBoolean(PreferenceKeys.SHOW_HIDDEN_CONTENTS, false)
+  }
+  val rows by
+    produceState<ImmutableList<ListRow>>(persistentListOf(), path, naming) {
+      val dir = File(root, path)
+      value = withContext(Dispatchers.IO) { listRows(subfolders(dir, showHidden), dir).folders }
+    }
+  if (naming) {
+    // The list's own dialog and checks: blank, already a file or folder, outside the store
+    // (component-wise isInsideRepository).
+    val dir = File(root, path)
+    FolderNameDialog(
+      title = stringResource(R.string.title_create_folder),
+      message = null,
+      confirm = stringResource(R.string.button_create),
+      validate = { folderNameError(it, File(dir, it)) },
+      onConfirm = { name ->
+        val folder = File(dir, name).canonicalFile
+        folder.mkdirs()
+        naming = false
+        path = folder.relativeTo(root.canonicalFile).path
+      },
+      onDismiss = { naming = false },
+    )
+  }
+  AlertDialog(
+    onDismissRequest = onDismiss,
+    modifier = modifier,
+    title = { Text(stringResource(R.string.folder_picker_title)) },
+    text = {
+      Column {
+        BreadcrumbBar(
+          crumbsFor(path),
+          stringResource(R.string.list_store_root),
+          onCrumbClick = { path = it },
+          modifier = Modifier.fillMaxWidth().padding(bottom = SpacingMedium),
+        )
+        // ponytail: a plain scrolling column, fine for the folders of one level; a LazyColumn
+        // if a store ever has thousands of subfolders in one folder.
+        Column(Modifier.heightIn(max = 360.dp).verticalScroll(rememberScrollState())) {
+          rows.forEach { row ->
+            key(row.path) {
+              FolderRow(
+                name = row.label,
+                count = row.count,
+                onClick = { path = File(row.path).relativeTo(root).path },
+              )
+            }
+          }
+        }
+      }
+    },
+    confirmButton = {
+      TextButton(onClick = { onPick(path) }) { Text(stringResource(R.string.crypto_select)) }
+    },
+    dismissButton = {
+      Row {
+        TextButton(onClick = { naming = true }) {
+          Text(stringResource(R.string.folder_picker_new))
+        }
+        TextButton(onClick = onDismiss) { Text(stringResource(R.string.dialog_cancel)) }
+      }
+    },
+  )
+}
+```
+
+`mkdirs` runs on the main thread, as the list's own "Create folder" does: one directory, no
+listing. An empty folder is not tracked by git, so nothing is committed until an entry lands in
+it, exactly as with the list's "Create folder".
+
+- [ ] **Step 2: Share the list's folder name dialog**
+
+In `app/src/main/java/app/passwordstore/ui/list/ListDestination.kt`, replace
+
+```kotlin
+/** Asks for a folder name; [validate] returns an error string resource or null. */
+@Composable
+private fun FolderNameDialog(
+```
+
+with
+
+```kotlin
+/**
+ * Asks for a folder name; [validate] returns an error string resource or null. Shared with the
+ * folder picker's "New folder".
+ */
+@Composable
+internal fun FolderNameDialog(
+```
+
+(`internal`, not public: Slack's `ComposeModifierMissing` checks public composables only, and the
+dialog has no layout to modify. If lint still flags it, add `modifier: Modifier = Modifier` after
+`onDismiss` and pass it to its `AlertDialog`.)
+
+- [ ] **Step 3: Strings**
+
+In `app/src/main/res/values/strings.xml`, before `</resources>`, add:
+
+```xml
+
+  <!-- Compose folder picker -->
+  <string name="folder_picker_title">Choose a folder</string>
+  <string name="folder_picker_new">New folder</string>
+```
+
+In `app/src/main/res/values-it/strings.xml`, before `</resources>`, add:
+
+```xml
+
+  <!-- Compose folder picker -->
+  <string name="folder_picker_title">Scegli una cartella</string>
+  <string name="folder_picker_new">Nuova cartella</string>
+```
+
+- [ ] **Step 4: The list's move uses the picker**
+
+In `app/src/main/java/app/passwordstore/ui/list/ListDestination.kt`:
+
+Delete these imports:
+
+```kotlin
+import android.app.Activity
+import android.content.Intent
+import androidx.activity.compose.rememberLauncherForActivityResult
+import androidx.activity.result.contract.ActivityResultContracts.StartActivityForResult
+```
+
+and
+
+```kotlin
+import app.passwordstore.ui.folderselect.SelectFolderActivity
+```
+
+In `enum class ListDialog`, replace
+
+```kotlin
+  Delete,
+```
+
+with
+
+```kotlin
+  Delete,
+  Move,
+```
+
+Delete the whole `moveLauncher` block:
+
+```kotlin
+  val moveLauncher =
+    rememberLauncherForActivityResult(StartActivityForResult()) { result ->
+      val data = result.data
+      val target = data?.getStringExtra("SELECTED_FOLDER_PATH")?.let(::File)
+      val files = data?.getStringArrayExtra("Files")?.map(::File)
+      if (result.resultCode == Activity.RESULT_OK && target?.isDirectory == true && files != null) {
+        selected = emptyList()
+        activity.lifecycleScope.launch {
+          activity.moveItems(files, target)
+          refresh()
+        }
+      }
+    }
+
+```
+
+Replace
+
+```kotlin
+      onMove = {
+        moveLauncher.launch(
+          Intent(activity, SelectFolderActivity::class.java)
+            .putExtra("Files", selected.toTypedArray())
+        )
+      },
+```
+
+with
+
+```kotlin
+      onMove = { dialog = ListDialog.Move },
+```
+
+In the `when (dialog)` block, after the `ListDialog.Delete -> Prompt(...)` case (before
+`ListDialog.Clone ->`), add:
+
+```kotlin
+      ListDialog.Move ->
+        FolderPicker(
+          root = root,
+          start = path,
+          onPick = { target ->
+            // One move per pick: a double tap on Select must not move twice.
+            if (dialog == ListDialog.Move) {
+              val files = selected.map(::File)
+              dialog = ListDialog.None
+              selected = emptyList()
+              activity.lifecycleScope.launch {
+                activity.moveItems(files, File(root, target))
+                refresh()
+              }
+            }
+          },
+          onDismiss = { dialog = ListDialog.None },
+        )
+```
+
+In the KDoc of `ListDestination`, replace
+
+```kotlin
+ * The list at [path] (relative to the store root): wires [ListScreen] to the [viewModel], the
+ * legacy activities and the store operations. [onOpenFolder] takes a path relative to the root,
+ * [onOpenEntry] an entry file.
+```
+
+with
+
+```kotlin
+ * The list at [path] (relative to the store root): wires [ListScreen] to the [viewModel], the
+ * folder picker, the legacy activities and the store operations. [onOpenFolder] takes a path
+ * relative to the root, [onOpenEntry] an entry file.
+```
+
+- [ ] **Step 5: Checks and commit**
+
+Run: `./gradlew spotlessApply && CI=1 ./gradlew :app:assembleDebug :app:testDebugUnitTest :app:lintDebug`
+Expected: `BUILD SUCCESSFUL`. (Full move and "New folder" check on the emulator in Task 8,
+step 9.)
+
+```bash
+git add app/src/main/java/app/passwordstore/ui/list/FolderPicker.kt \
+  app/src/main/java/app/passwordstore/ui/list/ListDestination.kt \
+  app/src/main/res/values/strings.xml app/src/main/res/values-it/strings.xml
+git commit -m "feat(app): add the Compose folder picker for moves
+
+A dialog with breadcrumbs, subfolder rows and New folder replaces the
+legacy folder picker activity for the list's move action; the editor will
+share it. New folder reuses the list's name dialog and checks. A second
+tap on Select no longer moves twice.
+
+Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>"
+```
+
+---
+
+### Task 3: Editor ViewModel
+
+**Files:**
+- Create: `app/src/main/java/app/passwordstore/ui/editor/EditorViewModel.kt`
+- Modify: `app/src/main/java/app/passwordstore/ui/list/StoreActions.kt`
+- Modify: `app/src/main/java/app/passwordstore/injection/pwgen/DicewareModule.kt`
+
+- [ ] **Step 1: Shared recently-used move in StoreActions**
+
+In `app/src/main/java/app/passwordstore/ui/list/StoreActions.kt`, replace `renameFolder`:
+
+```kotlin
+/** Renames the folder [from] to [to], keeps its recently-used time, then commits. */
+suspend fun BaseGitActivity.renameFolder(from: File, to: File) {
+  if (!moveFile(from, to)) return
+  val history = getSharedPreferences(HISTORY, Context.MODE_PRIVATE)
+  val time = history.getString(from.absolutePath.base64())
+  if (time != null)
+    history.edit {
+      remove(from.absolutePath.base64())
+      putString(to.absolutePath.base64(), time)
+    }
+  commitChange(getString(R.string.git_commit_move_text, from.name, to.name))
+}
+```
+
+with
+
+```kotlin
+/** Renames the folder [from] to [to], keeps its recently-used time, then commits. */
+suspend fun BaseGitActivity.renameFolder(from: File, to: File) {
+  if (!moveFile(from, to)) return
+  moveHistory(from, to)
+  commitChange(getString(R.string.git_commit_move_text, from.name, to.name))
+}
+
+/** Carries the "recently used" time of [from] over to [to]. */
+fun Context.moveHistory(from: File, to: File) {
+  val history = getSharedPreferences(HISTORY, Context.MODE_PRIVATE)
+  val time = history.getString(from.absolutePath.base64()) ?: return
+  history.edit {
+    remove(from.absolutePath.base64())
+    putString(to.absolutePath.base64(), time)
+  }
+}
+```
+
+- [ ] **Step 2: Diceware generator for ViewModels**
+
+In `app/src/main/java/app/passwordstore/injection/pwgen/DicewareModule.kt`, add the import
+
+```kotlin
+import dagger.hilt.android.components.ViewModelComponent
+```
+
+and replace
+
+```kotlin
+@InstallIn(FragmentComponent::class)
+```
+
+with
+
+```kotlin
+@InstallIn(FragmentComponent::class, ViewModelComponent::class)
+```
+
+(`FragmentComponent` goes with the legacy dialog in Task 7.)
+
+- [ ] **Step 3: The ViewModel**
+
+`app/src/main/java/app/passwordstore/ui/editor/EditorViewModel.kt`:
+
+```kotlin
+/*
+ * Copyright (C) 2026 Danilo M. <danix@danix.xyz>
+ * SPDX-License-Identifier: GPL-3.0-only
+ */
+
+package app.passwordstore.ui.editor
+
+import android.content.Context
+import android.content.SharedPreferences
+import android.graphics.Bitmap
+import android.graphics.ImageDecoder
+import android.net.Uri
+import android.os.Build
+import android.provider.MediaStore
+import androidx.annotation.StringRes
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.setValue
+import androidx.core.content.edit
+import androidx.lifecycle.ViewModel
+import app.passwordstore.R
+import app.passwordstore.crypto.PGPIdentifier
+import app.passwordstore.data.crypto.CryptoRepository
+import app.passwordstore.data.passfile.PasswordEntry
+import app.passwordstore.injection.prefs.PasswordGeneratorPreferences
+import app.passwordstore.passgen.diceware.DicewarePassphraseGenerator
+import app.passwordstore.passgen.random.PasswordOption
+import app.passwordstore.ui.list.moveHistory
+import app.passwordstore.util.autofill.AutofillMatcher
+import app.passwordstore.util.coroutines.DispatcherProvider
+import app.passwordstore.util.extensions.getString
+import app.passwordstore.util.settings.PreferenceKeys
+import com.github.michaelbull.result.Result
+import com.github.michaelbull.result.get
+import com.github.michaelbull.result.runCatching
+import com.google.zxing.BinaryBitmap
+import com.google.zxing.RGBLuminanceSource
+import com.google.zxing.common.HybridBinarizer
+import com.google.zxing.qrcode.QRCodeReader
+import dagger.hilt.android.lifecycle.HiltViewModel
+import java.io.ByteArrayOutputStream
+import java.io.File
+import java.io.IOException
+import javax.inject.Inject
+import kotlinx.coroutines.withContext
+import logcat.LogPriority.ERROR
+import logcat.asLog
+import logcat.logcat
+
+/** What a save did. */
+sealed interface SaveResult {
+
+  /**
+   * Written to [file] from [form]. [staleOriginal] is the old file of a rename or move, left
+   * behind because it could not be deleted.
+   */
+  data class Saved(val file: File, val form: EditorForm, val staleOriginal: File?) : SaveResult
+
+  /** Nothing was written; [message] (a string resource, formatted with [arg]) says why. */
+  data class Failed(@StringRes val message: Int, val arg: String = "") : SaveResult
+}
+
+/**
+ * The editor's state and work: the [form] (plaintext, in memory only: never in saved state, reset
+ * when this ViewModel is cleared), the generators and their stored options, QR decoding, and the
+ * save (encrypt, write, replace the original). Holds no Context; calls take one and use the
+ * application context.
+ */
+@HiltViewModel
+class EditorViewModel
+@Inject
+constructor(
+  private val repository: CryptoRepository,
+  private val entryFactory: PasswordEntry.Factory,
+  private val diceware: dagger.Lazy<DicewarePassphraseGenerator>,
+  @PasswordGeneratorPreferences private val pwgenPrefs: SharedPreferences,
+  private val dispatcherProvider: DispatcherProvider,
+) : ViewModel() {
+
+  /** The fields being edited. */
+  var form by mutableStateOf(EditorForm())
+
+  /** Set while a save runs, and after one succeeded (the editor is leaving): saves and closes wait. */
+  var saving by mutableStateOf(false)
+    private set
+
+  /** Whether [start] filled the form. */
+  var started = false
+    private set
+
+  /** Fills the form the first time only and returns true then; a recreated activity keeps edits. */
+  fun start(initial: EditorForm): Boolean {
+    if (started) return false
+    started = true
+    form = initial
+    return true
+  }
+
+  /** True when [extra] already holds a TOTP secret (the OTP actions hide), as the old editor did. */
+  fun hasOtp(extra: String): Boolean =
+    entryFactory.create("PLACEHOLDER\n$extra".encodeToByteArray()).hasTotp()
+
+  /** The random generator's options as the old dialog stored them. */
+  fun randomSpec(context: Context): RandomSpec {
+    val prefs = context.randomPrefs()
+    return RandomSpec(
+      numerals = !prefs.getBoolean(PasswordOption.NoDigits.key, false),
+      symbols = prefs.getBoolean(PasswordOption.AtLeastOneSymbol.key, false),
+      uppercase = !prefs.getBoolean(PasswordOption.NoUppercaseLetters.key, false),
+      lowercase = !prefs.getBoolean(PasswordOption.NoLowercaseLetters.key, false),
+      ambiguous = !prefs.getBoolean(PasswordOption.NoAmbiguousCharacters.key, false),
+      pronounceable = !prefs.getBoolean(PasswordOption.FullyRandom.key, true),
+      length = prefs.getInt(PreferenceKeys.LENGTH, 20),
+    )
+  }
+
+  /** Stores [spec], as the old dialog did on every generation, then generates off the main thread. */
+  suspend fun generateRandom(spec: RandomSpec, context: Context): Result<String, Int> {
+    val options = spec.options()
+    context.randomPrefs().edit {
+      PasswordOption.entries.forEach { putBoolean(it.key, it in options) }
+      putInt(PreferenceKeys.LENGTH, spec.length)
+    }
+    return withContext(dispatcherProvider.default()) { randomPassword(spec) }
+  }
+
+  /** The diceware generator's options as the old dialog stored them. */
+  fun dicewareSpec(): DicewareSpec =
+    DicewareSpec(
+      words = pwgenPrefs.getInt(PreferenceKeys.DICEWARE_LENGTH, 5),
+      separator = pwgenPrefs.getString(PreferenceKeys.DICEWARE_SEPARATOR)?.firstOrNull() ?: '-',
+    )
+
+  /** Stores [spec] and generates a passphrase; the word list is read on first use, off main. */
+  suspend fun generateDiceware(spec: DicewareSpec): String {
+    pwgenPrefs.edit {
+      putInt(PreferenceKeys.DICEWARE_LENGTH, spec.words)
+      putString(PreferenceKeys.DICEWARE_SEPARATOR, spec.separator.toString())
+    }
+    return withContext(dispatcherProvider.io()) {
+      diceware.get().generatePassphrase(spec.words, spec.separator)
+    }
+  }
+
+  /** The text of the QR code in the image at [uri], or null when it has none. Off main. */
+  suspend fun readQr(uri: Uri, context: Context): String? {
+    val resolver = context.applicationContext.contentResolver
+    return withContext(dispatcherProvider.io()) {
+      runCatching {
+          val bitmap =
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.P) {
+              ImageDecoder.decodeBitmap(ImageDecoder.createSource(resolver, uri))
+                .copy(Bitmap.Config.ARGB_8888, false)
+            } else {
+              @Suppress("DEPRECATION") MediaStore.Images.Media.getBitmap(resolver, uri)
+            }
+          val pixels = IntArray(bitmap.width * bitmap.height)
+          bitmap.getPixels(pixels, 0, bitmap.width, 0, 0, bitmap.width, bitmap.height)
+          val source = RGBLuminanceSource(bitmap.width, bitmap.height, pixels)
+          QRCodeReader().decode(BinaryBitmap(HybridBinarizer(source))).text
+        }
+        .get()
+    }
+  }
+
+  /**
+   * Encrypts the form to [ids] and writes it to [target], replacing [original] when the entry was
+   * renamed or moved. Nothing is written (not even the folder) when [target] would replace another
+   * entry or when encryption fails; a recipient whose key is missing fails it (see
+   * CryptoRepository.encrypt). The caller checked [formError] and that [target] is inside the
+   * store. Returns null when a save already ran or is running.
+   */
+  suspend fun save(
+    ids: List<PGPIdentifier>,
+    target: File,
+    original: File?,
+    context: Context,
+  ): SaveResult? {
+    if (saving) return null
+    saving = true
+    var result: SaveResult? = null
+    try {
+      result = write(ids, target, original, context.applicationContext)
+    } finally {
+      // Stays set after a success (the editor is leaving); cleared on failure or cancellation.
+      if (result !is SaveResult.Saved) saving = false
+    }
+    return result
+  }
+
+  override fun onCleared() {
+    form = EditorForm()
+  }
+
+  private suspend fun write(
+    ids: List<PGPIdentifier>,
+    target: File,
+    original: File?,
+    app: Context,
+  ): SaveResult {
+    val form = form
+    if (withContext(dispatcherProvider.io()) { overwrites(target, original) })
+      return SaveResult.Failed(R.string.password_creation_duplicate_error)
+    val out = ByteArrayOutputStream()
+    val encrypted = repository.encrypt(ids, passContent(form).byteInputStream(), out)
+    if (!encrypted.isOk) {
+      logcat(ERROR) { encrypted.error.asLog() }
+      return SaveResult.Failed(
+        R.string.password_creation_encrypt_fail_message,
+        encrypted.error.message.orEmpty(),
+      )
+    }
+    return withContext(dispatcherProvider.io()) {
+      try {
+        writeEntry(target, out.toByteArray())
+      } catch (e: IOException) {
+        logcat(ERROR) { e.asLog() }
+        return@withContext SaveResult.Failed(R.string.password_creation_file_write_fail_message)
+      }
+      var stale: File? = null
+      if (original != null && original.canonicalPath != target.canonicalPath) {
+        if (original.delete() || !original.exists()) {
+          AutofillMatcher.updateMatches(app, moveFromTo = mapOf(original to target))
+          app.moveHistory(original, target)
+        } else {
+          stale = original
+        }
+      }
+      SaveResult.Saved(target, form, stale)
+    }
+  }
+
+  private fun Context.randomPrefs(): SharedPreferences =
+    getSharedPreferences(RANDOM_PREFS, Context.MODE_PRIVATE)
+
+  private companion object {
+    /** The old random generator dialog's preferences file. */
+    const val RANDOM_PREFS = "PasswordGenerator"
+  }
+}
+```
+
+- [ ] **Step 4: Checks and commit**
+
+Run: `./gradlew spotlessApply && CI=1 ./gradlew :app:assembleDebug :app:testDebugUnitTest :app:lintDebug`
+Expected: `BUILD SUCCESSFUL` (Hilt generates the ViewModel factory; nothing uses it yet). If Hilt
+reports a missing binding for `PasswordEntry.Factory` in `ViewModelComponent`, check that
+`TotpModule` still lists `ViewModelComponent` (added in step 3).
+
+```bash
+git add app/src/main/java/app/passwordstore/ui/editor/EditorViewModel.kt \
+  app/src/main/java/app/passwordstore/ui/list/StoreActions.kt \
+  app/src/main/java/app/passwordstore/injection/pwgen/DicewareModule.kt
+git commit -m "feat(app): add the editor ViewModel
+
+Holds the form in memory only, generates passwords with the stored
+generator options, decodes QR images and saves off the main thread:
+nothing is written when the target would replace another entry or when
+encryption fails, the file is written through a temporary file, and a
+renamed or moved entry takes its autofill matches and recently-used time
+along.
+
+Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>"
+```
+
+---
+
+### Task 4: Editor screen, generator sheet, OTP dialog and strings
+
+**Files:**
+- Create: `app/src/main/java/app/passwordstore/ui/editor/EditorScreen.kt`
+- Create: `app/src/main/java/app/passwordstore/ui/editor/GeneratorSheet.kt`
+- Modify: `app/src/main/res/values/strings.xml`
+- Modify: `app/src/main/res/values-it/strings.xml`
+
+- [ ] **Step 1: Strings**
+
+In `app/src/main/res/values/strings.xml`, before `</resources>`, add:
+
+```xml
+
+  <!-- Compose editor -->
+  <string name="editor_new_title">New entry</string>
+  <string name="editor_edit_title">Edit entry</string>
+  <string name="editor_close">Close</string>
+  <string name="editor_folder">Folder</string>
+  <string name="editor_change_folder">Change</string>
+  <string name="editor_otp_qr">OTP from QR</string>
+  <string name="editor_otp_manual">Manual OTP</string>
+  <string name="generator_random">Random</string>
+  <string name="generator_diceware" translatable="false">Diceware</string>
+  <string name="generator_use">Use</string>
+```
+
+In `app/src/main/res/values-it/strings.xml`, before `</resources>`, add:
+
+```xml
+
+  <!-- Compose editor -->
+  <string name="editor_new_title">Nuova voce</string>
+  <string name="editor_edit_title">Modifica voce</string>
+  <string name="editor_close">Chiudi</string>
+  <string name="editor_folder">Cartella</string>
+  <string name="editor_change_folder">Cambia</string>
+  <string name="editor_otp_qr">OTP da QR</string>
+  <string name="editor_otp_manual">OTP manuale</string>
+  <string name="generator_random">Casuale</string>
+  <string name="generator_use">Usa</string>
+```
+
+(`generator_diceware` is not translatable, so it must not appear in `values-it`: lint's
+`ExtraTranslation` would fail. Everything else reuses existing translated strings.)
+
+- [ ] **Step 2: The screen and the OTP dialog**
+
+`app/src/main/java/app/passwordstore/ui/editor/EditorScreen.kt`:
+
+```kotlin
+/*
+ * Copyright (C) 2026 Danilo M. <danix@danix.xyz>
+ * SPDX-License-Identifier: GPL-3.0-only
+ */
+
+package app.passwordstore.ui.editor
+
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.rememberScrollState
+import androidx.compose.foundation.text.KeyboardOptions
+import androidx.compose.foundation.verticalScroll
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.filled.Close
+import androidx.compose.material.icons.filled.MoreVert
+import androidx.compose.material3.AlertDialog
+import androidx.compose.material3.DropdownMenu
+import androidx.compose.material3.DropdownMenuItem
+import androidx.compose.material3.ExperimentalMaterial3Api
+import androidx.compose.material3.Icon
+import androidx.compose.material3.IconButton
+import androidx.compose.material3.LocalTextStyle
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.OutlinedButton
+import androidx.compose.material3.OutlinedTextField
+import androidx.compose.material3.Scaffold
+import androidx.compose.material3.Text
+import androidx.compose.material3.TextButton
+import androidx.compose.material3.TopAppBar
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.focus.FocusRequester
+import androidx.compose.ui.focus.focusRequester
+import androidx.compose.ui.res.painterResource
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.text.font.FontFamily
+import androidx.compose.ui.text.input.ImeAction
+import androidx.compose.ui.text.input.KeyboardType
+import androidx.compose.ui.text.input.PasswordVisualTransformation
+import androidx.compose.ui.text.input.VisualTransformation
+import androidx.compose.ui.window.DialogProperties
+import androidx.compose.ui.window.SecureFlagPolicy
+import app.passwordstore.R
+import app.passwordstore.ui.compose.BreadcrumbBar
+import app.passwordstore.ui.compose.R as composeR
+import app.passwordstore.ui.compose.crumbsFor
+import app.passwordstore.ui.compose.theme.SpacingLarge
+import app.passwordstore.ui.compose.theme.SpacingMedium
+
+/** Which field takes focus when the editor first opens. */
+enum class EditorFocus {
+  None,
+  Name,
+  Username,
+}
+
+/**
+ * The editor: name, folder (breadcrumbs; they and "Change" open the picker), password with reveal
+ * and generator, username, free-text extra content (the pass format as text) and the OTP actions,
+ * shown while the extras hold no TOTP secret ([showOtpActions]). [onScanQr] is null on a device
+ * without a camera. Only the reveal toggle and the menus keep state here.
+ */
+@OptIn(ExperimentalMaterial3Api::class)
+@Composable
+fun EditorScreen(
+  form: EditorForm,
+  editing: Boolean,
+  saving: Boolean,
+  showOtpActions: Boolean,
+  initiallyRevealed: Boolean,
+  focus: EditorFocus,
+  onFormChange: (EditorForm) -> Unit,
+  onClose: () -> Unit,
+  onSave: (copy: Boolean) -> Unit,
+  onChangeFolder: () -> Unit,
+  onGenerate: () -> Unit,
+  onScanQr: (() -> Unit)?,
+  onQrImage: () -> Unit,
+  onManualOtp: () -> Unit,
+  modifier: Modifier = Modifier,
+) {
+  var revealed by remember { mutableStateOf(initiallyRevealed) }
+  var menu by remember { mutableStateOf(false) }
+  var qrMenu by remember { mutableStateOf(false) }
+  val nameFocus = remember { FocusRequester() }
+  val usernameFocus = remember { FocusRequester() }
+  LaunchedEffect(Unit) {
+    when (focus) {
+      EditorFocus.Name -> nameFocus.requestFocus()
+      EditorFocus.Username -> usernameFocus.requestFocus()
+      EditorFocus.None -> Unit
+    }
+  }
+  val field = Modifier.fillMaxWidth().padding(horizontal = SpacingLarge)
+  Scaffold(
+    modifier = modifier,
+    topBar = {
+      TopAppBar(
+        title = {
+          Text(
+            stringResource(if (editing) R.string.editor_edit_title else R.string.editor_new_title)
+          )
+        },
+        navigationIcon = {
+          IconButton(onClick = onClose) {
+            Icon(Icons.Filled.Close, stringResource(R.string.editor_close))
+          }
+        },
+        actions = {
+          TextButton(onClick = { onSave(false) }, enabled = !saving) {
+            Text(stringResource(R.string.crypto_save))
+          }
+          Box {
+            IconButton(onClick = { menu = true }) {
+              Icon(Icons.Filled.MoreVert, stringResource(R.string.list_more_options))
+            }
+            DropdownMenu(expanded = menu, onDismissRequest = { menu = false }) {
+              DropdownMenuItem(
+                text = { Text(stringResource(R.string.crypto_save_and_copy)) },
+                onClick = {
+                  menu = false
+                  onSave(true)
+                },
+                enabled = !saving,
+              )
+            }
+          }
+        },
+      )
+    },
+  ) { padding ->
+    Column(
+      Modifier.padding(padding)
+        .fillMaxSize()
+        .verticalScroll(rememberScrollState())
+        .padding(bottom = SpacingLarge),
+      verticalArrangement = Arrangement.spacedBy(SpacingMedium),
+    ) {
+      OutlinedTextField(
+        value = form.name,
+        onValueChange = { onFormChange(form.copy(name = it)) },
+        modifier = field.focusRequester(nameFocus),
+        label = { Text(stringResource(R.string.crypto_name_hint)) },
+        singleLine = true,
+        keyboardOptions = KeyboardOptions(autoCorrectEnabled = false, imeAction = ImeAction.Next),
+      )
+      Text(
+        stringResource(R.string.editor_folder),
+        field,
+        style = MaterialTheme.typography.labelMedium,
+        color = MaterialTheme.colorScheme.onSurfaceVariant,
+      )
+      Row(verticalAlignment = Alignment.CenterVertically) {
+        BreadcrumbBar(
+          crumbsFor(form.dir),
+          stringResource(R.string.list_store_root),
+          onCrumbClick = { onChangeFolder() },
+          modifier = Modifier.weight(1f),
+        )
+        TextButton(onClick = onChangeFolder, modifier = Modifier.padding(end = SpacingMedium)) {
+          Text(stringResource(R.string.editor_change_folder))
+        }
+      }
+      OutlinedTextField(
+        value = form.password,
+        onValueChange = { onFormChange(form.copy(password = it)) },
+        modifier = field,
+        label = { Text(stringResource(R.string.crypto_pass_label)) },
+        singleLine = true,
+        textStyle = LocalTextStyle.current.copy(fontFamily = FontFamily.Monospace),
+        visualTransformation =
+          if (revealed) VisualTransformation.None else PasswordVisualTransformation(),
+        keyboardOptions =
+          KeyboardOptions(
+            autoCorrectEnabled = false,
+            keyboardType = KeyboardType.Password,
+            imeAction = ImeAction.Next,
+          ),
+        trailingIcon = {
+          Row {
+            IconButton(onClick = { revealed = !revealed }) {
+              Icon(
+                painterResource(
+                  if (revealed) composeR.drawable.baseline_visibility_off_24
+                  else composeR.drawable.baseline_visibility_24
+                ),
+                contentDescription =
+                  stringResource(
+                    if (revealed) R.string.entry_hide_password else R.string.entry_show_password
+                  ),
+              )
+            }
+            IconButton(onClick = onGenerate) {
+              Icon(
+                painterResource(R.drawable.ic_password_24px),
+                contentDescription = stringResource(R.string.pwgen_title),
+              )
+            }
+          }
+        },
+      )
+      OutlinedTextField(
+        value = form.username,
+        onValueChange = { onFormChange(form.copy(username = it)) },
+        modifier = field.focusRequester(usernameFocus),
+        label = { Text(stringResource(R.string.crypto_username_hint)) },
+        singleLine = true,
+        keyboardOptions = KeyboardOptions(autoCorrectEnabled = false, imeAction = ImeAction.Next),
+      )
+      OutlinedTextField(
+        value = form.extra,
+        onValueChange = { onFormChange(form.copy(extra = it)) },
+        modifier = field,
+        label = { Text(stringResource(R.string.crypto_extra_label)) },
+        minLines = 3,
+        // A password keyboard does not learn what is typed, as the old textVisiblePassword.
+        keyboardOptions =
+          KeyboardOptions(autoCorrectEnabled = false, keyboardType = KeyboardType.Password),
+      )
+      if (showOtpActions)
+        Row(field, horizontalArrangement = Arrangement.spacedBy(SpacingMedium)) {
+          Box {
+            OutlinedButton(onClick = { qrMenu = true }) {
+              Icon(painterResource(R.drawable.ic_qr_code_scanner), contentDescription = null)
+              Text(stringResource(R.string.editor_otp_qr), Modifier.padding(start = SpacingMedium))
+            }
+            DropdownMenu(expanded = qrMenu, onDismissRequest = { qrMenu = false }) {
+              if (onScanQr != null)
+                DropdownMenuItem(
+                  text = { Text(stringResource(R.string.otp_import_qr_code)) },
+                  onClick = {
+                    qrMenu = false
+                    onScanQr()
+                  },
+                )
+              DropdownMenuItem(
+                text = { Text(stringResource(R.string.otp_import_from_file)) },
+                onClick = {
+                  qrMenu = false
+                  onQrImage()
+                },
+              )
+            }
+          }
+          OutlinedButton(onClick = onManualOtp) {
+            Text(stringResource(R.string.editor_otp_manual))
+          }
+        }
+    }
+  }
+}
+
+/**
+ * Asks for a TOTP secret and an optional account (the URI's issuer), as the old manual OTP dialog
+ * did. Both live in [remember] only, and the window is FLAG_SECURE.
+ */
+@Composable
+fun OtpDialog(
+  onAdd: (secret: String, account: String) -> Unit,
+  onDismiss: () -> Unit,
+  modifier: Modifier = Modifier,
+) {
+  var secret by remember { mutableStateOf("") }
+  var account by remember { mutableStateOf("") }
+  val focus = remember { FocusRequester() }
+  AlertDialog(
+    onDismissRequest = onDismiss,
+    modifier = modifier,
+    properties = DialogProperties(securePolicy = SecureFlagPolicy.SecureOn),
+    title = { Text(stringResource(R.string.add_otp)) },
+    text = {
+      Column {
+        OutlinedTextField(
+          value = secret,
+          onValueChange = { secret = it },
+          modifier = Modifier.focusRequester(focus),
+          label = { Text(stringResource(R.string.otp_import_manual_hint_secret)) },
+          singleLine = true,
+          keyboardOptions =
+            KeyboardOptions(
+              autoCorrectEnabled = false,
+              keyboardType = KeyboardType.Password,
+              imeAction = ImeAction.Next,
+            ),
+        )
+        OutlinedTextField(
+          value = account,
+          onValueChange = { account = it },
+          label = { Text(stringResource(R.string.otp_import_manual_hint_account)) },
+          singleLine = true,
+          keyboardOptions = KeyboardOptions(autoCorrectEnabled = false),
+        )
+      }
+      LaunchedEffect(Unit) { focus.requestFocus() }
+    },
+    confirmButton = {
+      TextButton(onClick = { onAdd(secret, account) }, enabled = secret.isNotBlank()) {
+        Text(stringResource(R.string.dialog_ok))
+      }
+    },
+    dismissButton = {
+      TextButton(onClick = onDismiss) { Text(stringResource(R.string.dialog_cancel)) }
+    },
+  )
+}
+```
+
+- [ ] **Step 3: The generator sheet**
+
+`app/src/main/java/app/passwordstore/ui/editor/GeneratorSheet.kt`:
+
+```kotlin
+/*
+ * Copyright (C) 2026 Danilo M. <danix@danix.xyz>
+ * SPDX-License-Identifier: GPL-3.0-only
+ */
+
+package app.passwordstore.ui.editor
+
+import androidx.annotation.StringRes
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.rememberScrollState
+import androidx.compose.foundation.selection.toggleable
+import androidx.compose.foundation.text.KeyboardOptions
+import androidx.compose.foundation.verticalScroll
+import androidx.compose.material3.Button
+import androidx.compose.material3.Checkbox
+import androidx.compose.material3.ExperimentalMaterial3Api
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.ModalBottomSheet
+import androidx.compose.material3.ModalBottomSheetProperties
+import androidx.compose.material3.OutlinedTextField
+import androidx.compose.material3.PrimaryTabRow
+import androidx.compose.material3.Tab
+import androidx.compose.material3.Text
+import androidx.compose.material3.TextButton
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableIntStateOf
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.semantics.Role
+import androidx.compose.ui.text.font.FontFamily
+import androidx.compose.ui.text.input.KeyboardType
+import androidx.compose.ui.window.SecureFlagPolicy
+import app.passwordstore.R
+import app.passwordstore.passgen.random.PasswordGenerator
+import app.passwordstore.ui.compose.theme.SpacingLarge
+import app.passwordstore.ui.compose.theme.SpacingMedium
+import app.passwordstore.ui.compose.theme.SpacingSmall
+import com.github.michaelbull.result.Result
+
+private const val RANDOM_TAB = 0
+private const val DICEWARE_TAB = 1
+
+/**
+ * The password generator as a bottom sheet: a random tab and a diceware tab with the old dialogs'
+ * options, starting from [random] and [diceware]. [classicFirst] opens the random tab (the
+ * "Password generator" setting). Every change generates again; [onUse] takes the password shown.
+ * The password lives in [remember] only, and the sheet's window is FLAG_SECURE.
+ */
+@OptIn(ExperimentalMaterial3Api::class)
+@Composable
+fun GeneratorSheet(
+  classicFirst: Boolean,
+  random: RandomSpec,
+  diceware: DicewareSpec,
+  onRandom: suspend (RandomSpec) -> Result<String, Int>,
+  onDiceware: suspend (DicewareSpec) -> String,
+  onUse: (String) -> Unit,
+  onDismiss: () -> Unit,
+  modifier: Modifier = Modifier,
+) {
+  var tab by remember { mutableIntStateOf(if (classicFirst) RANDOM_TAB else DICEWARE_TAB) }
+  var randomSpec by remember { mutableStateOf(random) }
+  var dicewareSpec by remember { mutableStateOf(diceware) }
+  var length by remember { mutableStateOf(random.length.toString()) }
+  var words by remember { mutableStateOf(diceware.words.toString()) }
+  var separator by remember { mutableStateOf(diceware.separator.toString()) }
+  var rolls by remember { mutableIntStateOf(0) }
+  var password by remember { mutableStateOf("") }
+  var problem by remember { mutableStateOf<Int?>(null) }
+  LaunchedEffect(tab, randomSpec, dicewareSpec, rolls) {
+    if (tab == RANDOM_TAB) {
+      val result = onRandom(randomSpec)
+      password = if (result.isOk) result.value else ""
+      problem = if (result.isOk) null else result.error
+    } else {
+      password = onDiceware(dicewareSpec)
+      problem = null
+    }
+  }
+  ModalBottomSheet(
+    onDismissRequest = onDismiss,
+    modifier = modifier,
+    properties = ModalBottomSheetProperties(securePolicy = SecureFlagPolicy.SecureOn),
+  ) {
+    PrimaryTabRow(selectedTabIndex = tab) {
+      Tab(
+        selected = tab == RANDOM_TAB,
+        onClick = { tab = RANDOM_TAB },
+        text = { Text(stringResource(R.string.generator_random)) },
+      )
+      Tab(
+        selected = tab == DICEWARE_TAB,
+        onClick = { tab = DICEWARE_TAB },
+        text = { Text(stringResource(R.string.generator_diceware)) },
+      )
+    }
+    Column(
+      Modifier.verticalScroll(rememberScrollState()).padding(SpacingLarge),
+      verticalArrangement = Arrangement.spacedBy(SpacingSmall),
+    ) {
+      val shown = problem
+      Text(
+        if (shown == null) password else stringResource(shown),
+        style = MaterialTheme.typography.titleMedium.copy(fontFamily = FontFamily.Monospace),
+        color =
+          if (shown == null) MaterialTheme.colorScheme.onSurface
+          else MaterialTheme.colorScheme.error,
+      )
+      if (tab == RANDOM_TAB) {
+        CheckRow(R.string.pwgen_numerals, randomSpec.numerals) {
+          randomSpec = randomSpec.copy(numerals = it)
+        }
+        CheckRow(R.string.pwgen_symbols, randomSpec.symbols) {
+          randomSpec = randomSpec.copy(symbols = it)
+        }
+        CheckRow(R.string.pwgen_uppercase, randomSpec.uppercase) {
+          randomSpec = randomSpec.copy(uppercase = it)
+        }
+        CheckRow(R.string.pwgen_lowercase, randomSpec.lowercase) {
+          randomSpec = randomSpec.copy(lowercase = it)
+        }
+        CheckRow(R.string.pwgen_pronounceable, randomSpec.pronounceable) {
+          randomSpec = randomSpec.copy(pronounceable = it)
+        }
+        CheckRow(R.string.pwgen_ambiguous, randomSpec.ambiguous) {
+          randomSpec = randomSpec.copy(ambiguous = it)
+        }
+        OutlinedTextField(
+          value = length,
+          onValueChange = { text ->
+            // ponytail: at most 999 characters; the generator has no upper bound of its own.
+            val digits = text.filter(Char::isDigit).take(3)
+            length = digits
+            randomSpec =
+              randomSpec.copy(length = digits.toIntOrNull() ?: PasswordGenerator.DEFAULT_LENGTH)
+          },
+          label = { Text(stringResource(R.string.pwgen_length)) },
+          singleLine = true,
+          keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.Number),
+        )
+      } else {
+        OutlinedTextField(
+          value = words,
+          onValueChange = { text ->
+            // ponytail: at most 99 words.
+            val digits = text.filter(Char::isDigit).take(2)
+            words = digits
+            dicewareSpec =
+              dicewareSpec.copy(words = digits.toIntOrNull()?.takeIf { it > 0 } ?: 5)
+          },
+          label = { Text(stringResource(R.string.pwgen_length)) },
+          singleLine = true,
+          keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.Number),
+        )
+        OutlinedTextField(
+          value = separator,
+          onValueChange = { text ->
+            separator = text.take(1)
+            dicewareSpec = dicewareSpec.copy(separator = separator.firstOrNull() ?: '-')
+          },
+          label = { Text(stringResource(R.string.pwgen_separator)) },
+          singleLine = true,
+        )
+      }
+      Row(
+        Modifier.fillMaxWidth(),
+        horizontalArrangement = Arrangement.spacedBy(SpacingMedium, Alignment.End),
+      ) {
+        TextButton(onClick = { rolls++ }) { Text(stringResource(R.string.pwgen_generate)) }
+        Button(
+          onClick = { onUse(password) },
+          enabled = password.isNotEmpty() && problem == null,
+        ) {
+          Text(stringResource(R.string.generator_use))
+        }
+      }
+    }
+  }
+}
+
+@Composable
+private fun CheckRow(@StringRes label: Int, checked: Boolean, onChange: (Boolean) -> Unit) {
+  Row(
+    Modifier.fillMaxWidth()
+      .toggleable(value = checked, role = Role.Checkbox, onValueChange = onChange),
+    verticalAlignment = Alignment.CenterVertically,
+  ) {
+    Checkbox(checked = checked, onCheckedChange = null)
+    Text(stringResource(label), Modifier.padding(start = SpacingMedium))
+  }
+}
+```
+
+- [ ] **Step 4: Checks and commit**
+
+Run: `./gradlew spotlessApply && CI=1 ./gradlew :app:assembleDebug :app:lintDebug`
+Expected: `BUILD SUCCESSFUL`. If `composeR` does not resolve, check the ui:compose namespace in
+`ui/compose/build.gradle.kts` (`app.passwordstore.ui.compose`). If lint flags `PrimaryTabRow` or
+`ModalBottomSheetProperties` as experimental beyond the existing `@OptIn`, add
+`ExperimentalMaterial3Api` to that `@OptIn` only.
+
+```bash
+git add app/src/main/java/app/passwordstore/ui/editor/EditorScreen.kt \
+  app/src/main/java/app/passwordstore/ui/editor/GeneratorSheet.kt \
+  app/src/main/res/values/strings.xml app/src/main/res/values-it/strings.xml
+git commit -m "feat(app): add the Compose editor screen and generator sheet
+
+Stateless editor: name, folder breadcrumbs with Change, password with
+reveal and generator, username, extra content and the OTP actions. The
+generator sheet has random and diceware tabs with the old options; the
+manual OTP dialog and the sheet are FLAG_SECURE.
+
+Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>"
+```
+
+---
+
+### Task 5: Editor destination and navigation
+
+After this task the list and the entry view open the Compose editor. `PasswordCreationActivity`
+is still started by `AutofillSaveActivity` (Task 6).
+
+**Files:**
+- Create: `app/src/main/java/app/passwordstore/ui/editor/EditorDestination.kt`
+- Modify (replace whole file): `app/src/main/java/app/passwordstore/ui/main/MainActivity.kt`
+- Modify: `app/src/main/java/app/passwordstore/ui/entry/EntryDestination.kt`
+- Modify: `app/src/main/java/app/passwordstore/ui/list/ListDestination.kt`
+
+- [ ] **Step 1: The destination**
+
+`app/src/main/java/app/passwordstore/ui/editor/EditorDestination.kt`:
+
+```kotlin
+/*
+ * Copyright (C) 2026 Danilo M. <danix@danix.xyz>
+ * SPDX-License-Identifier: GPL-3.0-only
+ */
+
+package app.passwordstore.ui.editor
+
+import android.app.Activity
+import android.content.pm.PackageManager
+import androidx.activity.compose.BackHandler
+import androidx.activity.compose.rememberLauncherForActivityResult
+import androidx.activity.result.contract.ActivityResultContracts.GetContent
+import androidx.activity.result.contract.ActivityResultContracts.StartActivityForResult
+import androidx.compose.foundation.layout.Box
+import androidx.compose.material3.AlertDialog
+import androidx.compose.material3.Text
+import androidx.compose.material3.TextButton
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.rememberCoroutineScope
+import androidx.compose.runtime.saveable.rememberSaveable
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.platform.LocalFocusManager
+import androidx.compose.ui.platform.LocalSoftwareKeyboardController
+import androidx.compose.ui.res.stringResource
+import androidx.fragment.app.FragmentActivity
+import androidx.hilt.navigation.compose.hiltViewModel
+import androidx.lifecycle.lifecycleScope
+import app.passwordstore.R
+import app.passwordstore.data.repo.PasswordRepository
+import app.passwordstore.ui.crypto.copyPasswordToClipboard
+import app.passwordstore.ui.crypto.getPGPIdentifiers
+import app.passwordstore.ui.list.FolderPicker
+import app.passwordstore.util.extensions.commitChange
+import app.passwordstore.util.extensions.getString
+import app.passwordstore.util.extensions.isInsideRepository
+import app.passwordstore.util.extensions.sharedPrefs
+import app.passwordstore.util.extensions.snackbar
+import app.passwordstore.util.settings.PreferenceKeys
+import com.google.android.material.snackbar.Snackbar
+import com.google.zxing.integration.android.IntentIntegrator
+import java.io.File
+import kotlinx.coroutines.launch
+
+/**
+ * The editor: wires [EditorScreen] to the [viewModel], the generator sheet, the folder picker, OTP
+ * import and the save path (checks, recipients from `.gpg-id`, encryption, write, git commit).
+ * [initial] fills the form the first time; null means the entry to edit is no longer in memory
+ * (process death) and the editor closes. [original] is the file being edited, null for a new
+ * entry. [generate] opens the generator at once (autofill's "generate password"). [onClose]
+ * leaves without saving; [onSaved] runs after the commit.
+ */
+@Composable
+fun EditorDestination(
+  activity: FragmentActivity,
+  initial: EditorForm?,
+  original: File?,
+  onClose: () -> Unit,
+  onSaved: (SaveResult.Saved) -> Unit,
+  modifier: Modifier = Modifier,
+  generate: Boolean = false,
+  viewModel: EditorViewModel = hiltViewModel(),
+) {
+  val root = PasswordRepository.getRepositoryDirectory()
+  // ponytail: filled once per ViewModel, so a recreated activity keeps the edits; an edit restored
+  // after process death has nothing to fill from (the entry view's plaintext is gone) and closes,
+  // back to the entry view's passphrase prompt.
+  val first = remember { initial != null && viewModel.start(initial) }
+  val lost = !viewModel.started
+  LaunchedEffect(lost) { if (lost) onClose() }
+  if (lost) return
+
+  val keyboard = LocalSoftwareKeyboardController.current
+  val focusManager = LocalFocusManager.current
+  val scope = rememberCoroutineScope()
+  var sheet by rememberSaveable { mutableStateOf(first && generate) }
+  var picker by rememberSaveable { mutableStateOf(false) }
+  var otp by rememberSaveable { mutableStateOf(false) }
+  var failure by remember { mutableStateOf<String?>(null) }
+  val form = viewModel.form
+  val hasOtp = remember(form.extra) { viewModel.hasOtp(form.extra) }
+  val hasCamera = remember {
+    activity.packageManager.hasSystemFeature(PackageManager.FEATURE_CAMERA_ANY)
+  }
+  val showPassword = remember {
+    activity.sharedPrefs.getBoolean(PreferenceKeys.SHOW_PASSWORD, true)
+  }
+  val classicFirst = remember {
+    activity.sharedPrefs.getString(PreferenceKeys.PREF_KEY_PWGEN_TYPE) == "classic"
+  }
+
+  fun say(message: Int) {
+    activity.snackbar(message = activity.getString(message))
+  }
+
+  fun addLine(line: String) {
+    viewModel.form = viewModel.form.copy(extra = withLine(viewModel.form.extra, line))
+  }
+
+  // The one way out without saving: only while no save runs, keyboard and focus dropped first.
+  fun close() {
+    if (viewModel.saving) return
+    keyboard?.hide()
+    focusManager.clearFocus()
+    onClose()
+  }
+
+  fun save(copy: Boolean) {
+    if (viewModel.saving) return
+    val current = viewModel.form
+    val target = entryFile(root, current)
+    val problem =
+      formError(current)
+        ?: R.string.message_error_destination_outside_repo.takeUnless {
+          target.isInsideRepository()
+        }
+    if (problem != null) return say(problem)
+    // Recipients from the nearest .gpg-id, as pass does; null: an invalid ID, already reported.
+    val ids = activity.getPGPIdentifiers(current.dir) ?: return
+    activity.lifecycleScope.launch {
+      when (val result = viewModel.save(ids, target, original, activity)) {
+        null -> Unit
+        is SaveResult.Failed -> failure = activity.getString(result.message, result.arg)
+        is SaveResult.Saved -> {
+          if (copy) activity.copyPasswordToClipboard(result.form.password)
+          result.staleOriginal?.let {
+            activity.snackbar(
+              message =
+                activity.getString(
+                  R.string.password_creation_file_delete_fail_message,
+                  it.nameWithoutExtension,
+                ),
+              length = Snackbar.LENGTH_LONG,
+            )
+          }
+          // ponytail: commit failures are not shown, as for the list's move and delete; a theme
+          // or locale change in the middle of a save cancels before this commit, and the next
+          // commit picks the file up.
+          activity.commitChange(
+            activity.getString(
+              if (original != null) R.string.git_commit_edit_text
+              else R.string.git_commit_add_text,
+              target.relativeTo(root).path.removeSuffix(".gpg"),
+            )
+          )
+          keyboard?.hide()
+          focusManager.clearFocus()
+          onSaved(result)
+        }
+      }
+    }
+  }
+
+  BackHandler(onBack = ::close)
+
+  val scan =
+    rememberLauncherForActivityResult(StartActivityForResult()) { result ->
+      val text = IntentIntegrator.parseActivityResult(result.resultCode, result.data)?.contents
+      if (result.resultCode == Activity.RESULT_OK && text != null) {
+        addLine("$text\n")
+        say(R.string.otp_import_success)
+      } else {
+        say(R.string.otp_import_failure_generic)
+      }
+    }
+  val image =
+    rememberLauncherForActivityResult(GetContent()) { uri ->
+      if (uri == null) {
+        say(R.string.otp_import_failure_no_selection)
+      } else {
+        scope.launch {
+          val text = viewModel.readQr(uri, activity)
+          if (text != null) {
+            addLine(text)
+            say(R.string.otp_import_success)
+          } else {
+            say(R.string.otp_import_failure_generic)
+          }
+        }
+      }
+    }
+
+  Box(modifier) {
+    EditorScreen(
+      form = form,
+      editing = original != null,
+      saving = viewModel.saving,
+      showOtpActions = !hasOtp,
+      initiallyRevealed = showPassword,
+      focus =
+        when {
+          !first -> EditorFocus.None
+          form.name.isEmpty() -> EditorFocus.Name
+          original == null -> EditorFocus.Username
+          else -> EditorFocus.None
+        },
+      onFormChange = { viewModel.form = it },
+      onClose = ::close,
+      onSave = ::save,
+      onChangeFolder = { picker = true },
+      onGenerate = { sheet = true },
+      onScanQr =
+        if (hasCamera) {
+          {
+            scan.launch(
+              IntentIntegrator(activity)
+                .setOrientationLocked(false)
+                .setBeepEnabled(false)
+                .setDesiredBarcodeFormats(IntentIntegrator.QR_CODE)
+                .createScanIntent()
+            )
+          }
+        } else null,
+      onQrImage = { image.launch("image/*") },
+      onManualOtp = { otp = true },
+    )
+    if (sheet)
+      GeneratorSheet(
+        classicFirst = classicFirst,
+        random = viewModel.randomSpec(activity),
+        diceware = viewModel.dicewareSpec(),
+        onRandom = { spec -> viewModel.generateRandom(spec, activity) },
+        onDiceware = viewModel::generateDiceware,
+        onUse = { password ->
+          viewModel.form = viewModel.form.copy(password = password)
+          sheet = false
+        },
+        onDismiss = { sheet = false },
+      )
+    if (picker)
+      FolderPicker(
+        root = root,
+        start = form.dir,
+        onPick = { dir ->
+          viewModel.form = viewModel.form.copy(dir = dir)
+          picker = false
+        },
+        onDismiss = { picker = false },
+      )
+    if (otp)
+      OtpDialog(
+        onAdd = { secret, account ->
+          totpUri(secret, account)?.let(::addLine)
+          otp = false
+        },
+        onDismiss = { otp = false },
+      )
+    failure?.let { message ->
+      AlertDialog(
+        onDismissRequest = { failure = null },
+        title = { Text(stringResource(R.string.password_creation_file_fail_title)) },
+        text = { Text(message) },
+        confirmButton = {
+          TextButton(onClick = { failure = null }) { Text(stringResource(R.string.dialog_ok)) }
+        },
+      )
+    }
+  }
+}
+```
+
+- [ ] **Step 2: MainActivity**
+
+Replace `app/src/main/java/app/passwordstore/ui/main/MainActivity.kt` with:
+
+```kotlin
+/*
+ * Copyright (C) 2026 Danilo M. <danix@danix.xyz>
+ * SPDX-License-Identifier: GPL-3.0-only
+ */
+
+package app.passwordstore.ui.main
+
+import android.os.Bundle
+import android.view.WindowManager
+import androidx.activity.compose.setContent
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.DisposableEffect
+import androidx.compose.runtime.remember
+import androidx.hilt.navigation.compose.hiltViewModel
+import androidx.navigation.compose.NavHost
+import androidx.navigation.compose.composable
+import androidx.navigation.compose.rememberNavController
+import androidx.navigation.toRoute
+import app.passwordstore.data.password.PasswordItem
+import app.passwordstore.data.repo.PasswordRepository
+import app.passwordstore.ui.compose.theme.APSTheme
+import app.passwordstore.ui.crypto.BasePGPActivity
+import app.passwordstore.ui.editor.EditorDestination
+import app.passwordstore.ui.editor.EditorForm
+import app.passwordstore.ui.editor.editorForm
+import app.passwordstore.ui.entry.EntryDestination
+import app.passwordstore.ui.entry.EntryViewModel
+import app.passwordstore.ui.git.base.BaseGitActivity
+import app.passwordstore.ui.list.ListDestination
+import app.passwordstore.ui.list.folderMoves
+import app.passwordstore.ui.onboarding.activity.OnboardingActivity
+import app.passwordstore.ui.settings.SettingsActivity
+import app.passwordstore.util.extensions.launchActivity
+import app.passwordstore.util.extensions.sharedPrefs
+import app.passwordstore.util.settings.AuthMode
+import app.passwordstore.util.settings.PreferenceKeys
+import app.passwordstore.util.shortcuts.ShortcutHandler
+import com.github.michaelbull.result.onFailure
+import dagger.hilt.android.AndroidEntryPoint
+import java.io.File
+import javax.inject.Inject
+import kotlinx.collections.immutable.ImmutableList
+import kotlinx.collections.immutable.persistentListOf
+import kotlinx.serialization.Serializable
+
+/**
+ * The password list of the folder at [path], relative to the store root ("" is the root). The back
+ * stack holds one entry per folder level.
+ */
+@Serializable data class ListRoute(val path: String = "")
+
+/**
+ * One entry, by absolute path. Paths from [LaunchActivity] passed [LaunchActivity.isFileInRepo];
+ * the entry destination checks again before decrypting.
+ */
+@Serializable data class EntryRoute(val filePath: String)
+
+/**
+ * The editor: a new entry in [dir] (relative to the store root, "" is the root), or the entry
+ * [name] (file name without `.gpg`) there. An edit takes its plaintext from the entry view below
+ * it on the back stack, never from the route.
+ */
+@Serializable data class EditRoute(val dir: String, val name: String? = null)
+
+/**
+ * Single-activity host for the Compose UI. Not exported: it is only started by [LaunchActivity],
+ * after its biometric gate and path check. Extends [BaseGitActivity] (an AppCompatActivity, so also
+ * the FragmentActivity BiometricPrompt needs) because the git operations require one; it hosts no
+ * fragments.
+ */
+@AndroidEntryPoint
+class MainActivity : BaseGitActivity() {
+
+  @Inject lateinit var shortcutHandler: ShortcutHandler
+
+  /** Composed destinations that show secrets; FLAG_SECURE is on while this is above zero. */
+  private var secureHolds = 0
+
+  override fun onCreate(savedInstanceState: Bundle?) {
+    super.onCreate(savedInstanceState)
+    val filePath = intent.getStringExtra(BasePGPActivity.EXTRA_FILE_PATH)
+    val start: Any = if (filePath != null) EntryRoute(filePath) else ListRoute()
+    setContent {
+      APSTheme {
+        val nav = rememberNavController()
+        NavHost(nav, startDestination = start) {
+          composable<ListRoute> { entry ->
+            val path = entry.toRoute<ListRoute>().path
+            ListDestination(
+              activity = this@MainActivity,
+              path = path,
+              onOpenFolder = { target ->
+                // Only the folder on top may move the stack: a double tap must not push twice.
+                if (nav.currentBackStackEntry?.id == entry.id) {
+                  val (pops, pushes) = folderMoves(path, target)
+                  repeat(pops) { nav.popBackStack() }
+                  pushes.forEach { nav.navigate(ListRoute(it)) }
+                }
+              },
+              onOpenEntry = { file ->
+                if (nav.currentBackStackEntry?.id == entry.id) {
+                  addShortcut(file)
+                  nav.navigate(EntryRoute(file.absolutePath))
+                }
+              },
+              onNewEntry = {
+                if (nav.currentBackStackEntry?.id == entry.id) nav.navigate(EditRoute(path))
+              },
+            )
+          }
+          composable<EntryRoute> { entry ->
+            val file = File(entry.toRoute<EntryRoute>().filePath)
+            SecureWindow(this@MainActivity)
+            EntryDestination(
+              activity = this@MainActivity,
+              file = file,
+              onClose = {
+                // Only the entry on top closes: the auto-close timer can race a back press.
+                if (nav.currentBackStackEntry?.id == entry.id) {
+                  if (nav.previousBackStackEntry == null) finish() else nav.popBackStack()
+                }
+              },
+              onEdit = {
+                if (nav.currentBackStackEntry?.id == entry.id) {
+                  val root = PasswordRepository.getRepositoryDirectory().canonicalFile
+                  val dir = file.canonicalFile.parentFile?.relativeTo(root)?.path.orEmpty()
+                  nav.navigate(EditRoute(dir, file.nameWithoutExtension))
+                }
+              },
+            )
+          }
+          composable<EditRoute> { entry ->
+            val route = entry.toRoute<EditRoute>()
+            val name = route.name
+            // An edit reads the decrypted entry from the entry view below it. After process
+            // death that ViewModel is new and empty, and the editor closes.
+            val decrypted =
+              if (name == null) null
+              else
+                remember(entry) { runCatching { nav.getBackStackEntry<EntryRoute>() }.getOrNull() }
+                  ?.let { hiltViewModel<EntryViewModel>(it).entry }
+            SecureWindow(this@MainActivity)
+            EditorDestination(
+              activity = this@MainActivity,
+              initial =
+                if (name == null) EditorForm(dir = route.dir)
+                else decrypted?.let { editorForm(it, route.dir, name) },
+              original =
+                name?.let { File(File(PasswordRepository.getRepositoryDirectory(), route.dir), "$it.gpg") },
+              onClose = {
+                if (nav.currentBackStackEntry?.id == entry.id) nav.popBackStack()
+              },
+              onSaved = {
+                // Back to the list, which re-reads the store on resume. An entry opened from a
+                // shortcut has no list below it: the list root replaces the stack.
+                if (nav.currentBackStackEntry?.id == entry.id) {
+                  if (!nav.popBackStack<ListRoute>(inclusive = false))
+                    nav.navigate(ListRoute()) { popUpTo<EntryRoute> { inclusive = true } }
+                }
+              },
+            )
+          }
+        }
+      }
+    }
+  }
+
+  /** Counts a destination that shows secrets; the first one turns FLAG_SECURE on. */
+  fun holdSecure() {
+    if (secureHolds++ == 0) window.addFlags(WindowManager.LayoutParams.FLAG_SECURE)
+  }
+
+  /** Ends a [holdSecure]; FLAG_SECURE goes off when no secret-showing destination is left. */
+  fun releaseSecure() {
+    if (--secureHolds == 0) window.clearFlags(WindowManager.LayoutParams.FLAG_SECURE)
+  }
+
+  /** Re-reads the store; starts onboarding and returns false when there is none yet. */
+  fun checkStore(): Boolean {
+    PasswordRepository.initialize()
+    if (sharedPrefs.getBoolean(PreferenceKeys.REPOSITORY_INITIALIZED, false)) return true
+    launchActivity(OnboardingActivity::class.java)
+    return false
+  }
+
+  /** Git actions offered in the list's menu, chosen as the old list chose its menu. */
+  fun gitOps(): ImmutableList<GitOp> =
+    when {
+      gitSettings.authMode == AuthMode.None -> persistentListOf(GitOp.PULL)
+      PasswordRepository.isGitRepo() -> persistentListOf(GitOp.SYNC, GitOp.PULL, GitOp.PUSH)
+      else -> persistentListOf()
+    }
+
+  /** Runs [op]; failures show the usual git error dialog. */
+  suspend fun runGit(op: GitOp) {
+    launchGitOperation(op).onFailure { promptOnErrorHandler(it) }
+  }
+
+  /** Adds [file] to the launcher's dynamic shortcuts, as opening it from the list always did. */
+  fun addShortcut(file: File) {
+    val item = entryItem(file)
+    shortcutHandler.addDynamicShortcut(item, item.createAuthEnabledIntent(this))
+  }
+
+  fun pinEntry(file: File) {
+    val item = entryItem(file)
+    shortcutHandler.addPinnedShortcut(item, item.createAuthEnabledIntent(this))
+  }
+
+  fun openSettings() {
+    launchActivity(SettingsActivity::class.java)
+  }
+
+  private fun entryItem(file: File) =
+    PasswordItem.newPassword(file.name, file, PasswordRepository.getRepositoryDirectory())
+}
+
+/**
+ * FLAG_SECURE while composed. Counted in [MainActivity], because in a transition (entry view to
+ * editor and back) the entering destination is composed before the leaving one is disposed.
+ */
+@Composable
+private fun SecureWindow(activity: MainActivity) {
+  DisposableEffect(activity) {
+    activity.holdSecure()
+    onDispose { activity.releaseSecure() }
+  }
+}
+```
+
+(`createEntry` is gone: the list navigates to `EditRoute` itself.)
+
+- [ ] **Step 3: EntryDestination opens the Compose editor**
+
+In `app/src/main/java/app/passwordstore/ui/entry/EntryDestination.kt`:
+
+Delete these imports:
+
+```kotlin
+import android.view.WindowManager
+```
+
+```kotlin
+import androidx.compose.runtime.DisposableEffect
+```
+
+```kotlin
+import app.passwordstore.data.passfile.PasswordEntry
+```
+
+```kotlin
+import app.passwordstore.ui.crypto.BasePGPActivity
+```
+
+```kotlin
+import app.passwordstore.ui.crypto.PasswordCreationActivity
+```
+
+Replace the KDoc and signature start:
+
+```kotlin
+/**
+ * One entry: wires [EntryScreen] to the [viewModel], the biometric and passphrase prompts, the
+ * clipboard and the legacy editor. [onClose] leaves the destination; [onSaved] runs after the
+ * editor saved the entry (the host returns to the list).
+ */
+@Composable
+fun EntryDestination(
+  activity: MainActivity,
+  file: File,
+  onClose: () -> Unit,
+  onSaved: () -> Unit,
+```
+
+with
+
+```kotlin
+/**
+ * One entry: wires [EntryScreen] to the [viewModel], the biometric and passphrase prompts and the
+ * clipboard. [onClose] leaves the destination; [onEdit] opens the editor on the decrypted entry.
+ * The host keeps FLAG_SECURE on while this is composed.
+ */
+@Composable
+fun EntryDestination(
+  activity: MainActivity,
+  file: File,
+  onClose: () -> Unit,
+  onEdit: () -> Unit,
+```
+
+Delete:
+
+```kotlin
+  // Secrets stay out of screenshots and recents while this destination is composed.
+  // ponytail: plain add/clear, fine while no other secret-showing destination can overlap this
+  // one in a transition; count in MainActivity once the editor (step 4) becomes a destination.
+  DisposableEffect(Unit) {
+    activity.window.addFlags(WindowManager.LayoutParams.FLAG_SECURE)
+    onDispose { activity.window.clearFlags(WindowManager.LayoutParams.FLAG_SECURE) }
+  }
+
+```
+
+Replace
+
+```kotlin
+  // ponytail: after process death during key import or the editor, the unlock flow can start
+```
+
+with
+
+```kotlin
+  // ponytail: after process death during key import, the unlock flow can start
+```
+
+Delete:
+
+```kotlin
+  val editor =
+    rememberLauncherForActivityResult(StartActivityForResult()) { result ->
+      if (result.resultCode == Activity.RESULT_OK) onSaved()
+    }
+```
+
+Replace
+
+```kotlin
+      onEdit = { entry?.let { editor.launch(editIntent(activity, file, root, it)) } },
+```
+
+with
+
+```kotlin
+      onEdit = { if (entry != null) onEdit() },
+```
+
+Delete the whole `editIntent` function with its KDoc:
+
+```kotlin
+/** The legacy editor, filled exactly as the old decrypt screen filled it. */
+private fun editIntent(activity: Activity, file: File, root: File, entry: PasswordEntry): Intent =
+  Intent(activity, PasswordCreationActivity::class.java)
+    .setAction(Intent.ACTION_VIEW)
+    .putExtra(BasePGPActivity.EXTRA_FILE_PATH, getParentPath(file.absolutePath, root.absolutePath))
+    .putExtra(BasePGPActivity.EXTRA_REPO_PATH, root.absolutePath)
+    .putExtra(PasswordCreationActivity.EXTRA_FILE_NAME, file.nameWithoutExtension)
+    .putExtra(PasswordCreationActivity.EXTRA_USERNAME, entry.username)
+    .putExtra(PasswordCreationActivity.EXTRA_PASSWORD, entry.password)
+    .putExtra(PasswordCreationActivity.EXTRA_EXTRA_CONTENT, entry.extraContentWithoutUsername)
+    .putExtra(PasswordCreationActivity.EXTRA_EDITING, true)
+
+```
+
+(`Activity`, `Intent`, the result launcher imports and `getParentPath` stay: the key import
+launcher, the share intent and `unlock()` use them.)
+
+- [ ] **Step 4: The list opens the editor**
+
+In `app/src/main/java/app/passwordstore/ui/list/ListDestination.kt`, replace
+
+```kotlin
+ * The list at [path] (relative to the store root): wires [ListScreen] to the [viewModel], the
+ * folder picker, the legacy activities and the store operations. [onOpenFolder] takes a path
+ * relative to the root, [onOpenEntry] an entry file.
+ */
+@Composable
+fun ListDestination(
+  activity: MainActivity,
+  path: String,
+  onOpenFolder: (relativePath: String) -> Unit,
+  onOpenEntry: (File) -> Unit,
+```
+
+with
+
+```kotlin
+ * The list at [path] (relative to the store root): wires [ListScreen] to the [viewModel], the
+ * folder picker, the legacy activities and the store operations. [onOpenFolder] takes a path
+ * relative to the root, [onOpenEntry] an entry file; [onNewEntry] opens the editor in this folder.
+ */
+@Composable
+fun ListDestination(
+  activity: MainActivity,
+  path: String,
+  onOpenFolder: (relativePath: String) -> Unit,
+  onOpenEntry: (File) -> Unit,
+  onNewEntry: () -> Unit,
+```
+
+and replace
+
+```kotlin
+            ifInitialized { activity.createEntry(dir) }
+```
+
+with
+
+```kotlin
+            ifInitialized(onNewEntry)
+```
+
+- [ ] **Step 5: Build and smoke check**
+
+Run: `./gradlew spotlessApply && CI=1 ./gradlew :app:assembleDebug :app:testDebugUnitTest :app:lintDebug`
+Expected: `BUILD SUCCESSFUL`. If `popBackStack<ListRoute>(inclusive = false)` does not resolve,
+use `nav.popBackStack(ListRoute::class, inclusive = false)`. If Slack lint's
+`ComposeViewModelInjection` flags the `hiltViewModel<EntryViewModel>(it)` call in the `NavHost`
+builder, move the lookup into a private top-level `@Composable fun editedEntry(nav:
+NavHostController, entry: NavBackStackEntry): PasswordEntry?` in `MainActivity.kt` with a
+`@Suppress("ComposeViewModelInjection")` and a one-line reason (it reads another destination's
+ViewModel, it does not own one).
+
+With the emulator from Task 8 running and the store cloned (`export ANDROID_SERIAL=emulator-5554`
+first; a phone may be connected), `./gradlew :app:installDebug`, open the app, tap "New entry",
+"Create new password": the Compose editor opens (`adb exec-out uiautomator dump /dev/tty | grep -o
+'text="Save"'`); the close icon returns to the list. Full checks are in Task 8.
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add app/src/main/java/app/passwordstore/ui/editor/EditorDestination.kt \
+  app/src/main/java/app/passwordstore/ui/main/MainActivity.kt \
+  app/src/main/java/app/passwordstore/ui/entry/EntryDestination.kt \
+  app/src/main/java/app/passwordstore/ui/list/ListDestination.kt
+git commit -m "feat(app): open the Compose editor from the list and entry view
+
+EditRoute replaces the legacy editor for new entries and edits. An edit
+copies its plaintext from the entry view's ViewModel below it, never
+through the route or saved state. Saving returns to the list, closing
+returns to where the editor was opened. FLAG_SECURE is now counted in
+MainActivity, so moving between the entry view and the editor never
+clears it.
+
+Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>"
+```
+
+---
+
+### Task 6: Autofill save hosts the Compose editor
+
+**Files:**
+- Modify (replace whole file): `app/src/main/java/app/passwordstore/ui/autofill/AutofillSaveActivity.kt`
+- Modify: `app/src/main/AndroidManifest.xml`
+
+- [ ] **Step 1: The activity**
+
+Replace `app/src/main/java/app/passwordstore/ui/autofill/AutofillSaveActivity.kt` with:
+
+```kotlin
+/*
+ * Copyright © 2014-2024 The Android Password Store Authors. All Rights Reserved.
+ * SPDX-License-Identifier: GPL-3.0-only
+ */
+package app.passwordstore.ui.autofill
+
+import android.app.PendingIntent
+import android.content.Context
+import android.content.Intent
+import android.content.IntentSender
+import android.os.Bundle
+import android.view.WindowManager
+import android.view.autofill.AutofillManager
+import androidx.activity.compose.setContent
+import androidx.appcompat.app.AppCompatActivity
+import androidx.core.os.bundleOf
+import app.passwordstore.ui.compose.theme.APSTheme
+import app.passwordstore.ui.editor.EditorDestination
+import app.passwordstore.ui.editor.EditorForm
+import app.passwordstore.ui.editor.SaveResult
+import app.passwordstore.util.autofill.AutofillMatcher
+import app.passwordstore.util.autofill.AutofillPreferences
+import app.passwordstore.util.autofill.AutofillResponseBuilder
+import app.passwordstore.util.extensions.unsafeLazy
+import com.github.androidpasswordstore.autofillparser.AutofillAction
+import com.github.androidpasswordstore.autofillparser.Credentials
+import com.github.androidpasswordstore.autofillparser.FormOrigin
+import dagger.hilt.android.AndroidEntryPoint
+import logcat.LogPriority.ERROR
+import logcat.logcat
+
+/**
+ * Saves credentials the autofill service caught (or generates a password for a form) in the
+ * Compose editor, prefilled from the form's origin, then records the autofill match and, for a
+ * generated password, fills it in.
+ */
+@AndroidEntryPoint
+class AutofillSaveActivity : AppCompatActivity() {
+
+  companion object {
+
+    private const val EXTRA_FOLDER_NAME = "app.passwordstore.autofill.oreo.ui.EXTRA_FOLDER_NAME"
+    private const val EXTRA_PASSWORD = "app.passwordstore.autofill.oreo.ui.EXTRA_PASSWORD"
+    private const val EXTRA_NAME = "app.passwordstore.autofill.oreo.ui.EXTRA_NAME"
+    private const val EXTRA_SHOULD_MATCH_APP =
+      "app.passwordstore.autofill.oreo.ui.EXTRA_SHOULD_MATCH_APP"
+    private const val EXTRA_SHOULD_MATCH_WEB =
+      "app.passwordstore.autofill.oreo.ui.EXTRA_SHOULD_MATCH_WEB"
+    private const val EXTRA_GENERATE_PASSWORD =
+      "app.passwordstore.autofill.oreo.ui.EXTRA_GENERATE_PASSWORD"
+
+    private var saveRequestCode = 1
+
+    fun makeSaveIntentSender(
+      context: Context,
+      credentials: Credentials?,
+      formOrigin: FormOrigin,
+    ): IntentSender {
+      val identifier = formOrigin.getPrettyIdentifier(context, untrusted = false)
+      // Prevent directory traversals
+      val sanitizedIdentifier =
+        identifier.replace('\\', '_').replace('/', '_').trimStart('.').takeUnless { it.isBlank() }
+          ?: formOrigin.identifier
+      val directoryStructure = AutofillPreferences.directoryStructure(context)
+      val folderName =
+        directoryStructure.getSaveFolderName(
+          sanitizedIdentifier = sanitizedIdentifier,
+          username = credentials?.username,
+        )
+      val fileName =
+        directoryStructure.getSaveFileName(
+          username = credentials?.username,
+          identifier = identifier,
+        )
+      val intent =
+        Intent(context, AutofillSaveActivity::class.java).apply {
+          putExtras(
+            bundleOf(
+              EXTRA_FOLDER_NAME to folderName,
+              EXTRA_NAME to fileName,
+              EXTRA_PASSWORD to credentials?.password,
+              EXTRA_SHOULD_MATCH_APP to
+                formOrigin.identifier.takeIf { formOrigin is FormOrigin.App },
+              EXTRA_SHOULD_MATCH_WEB to
+                formOrigin.identifier.takeIf { formOrigin is FormOrigin.Web },
+              EXTRA_GENERATE_PASSWORD to (credentials == null),
+            )
+          )
+        }
+      return PendingIntent.getActivity(
+          context,
+          saveRequestCode++,
+          intent,
+          PendingIntent.FLAG_CANCEL_CURRENT or PendingIntent.FLAG_IMMUTABLE,
+        )
+        .intentSender
+    }
+  }
+
+  private val formOrigin by unsafeLazy {
+    val shouldMatchApp: String? = intent.getStringExtra(EXTRA_SHOULD_MATCH_APP)
+    val shouldMatchWeb: String? = intent.getStringExtra(EXTRA_SHOULD_MATCH_WEB)
+    if (shouldMatchApp != null && shouldMatchWeb == null) {
+      FormOrigin.App(shouldMatchApp)
+    } else if (shouldMatchApp == null && shouldMatchWeb != null) {
+      FormOrigin.Web(shouldMatchWeb)
+    } else {
+      null
+    }
+  }
+
+  private val generate by unsafeLazy { intent.getBooleanExtra(EXTRA_GENERATE_PASSWORD, false) }
+
+  override fun onCreate(savedInstanceState: Bundle?) {
+    super.onCreate(savedInstanceState)
+    // The whole window is the editor: keep it out of screenshots and recents.
+    window.addFlags(WindowManager.LayoutParams.FLAG_SECURE)
+    val initial =
+      EditorForm(
+        name = intent.getStringExtra(EXTRA_NAME).orEmpty(),
+        dir = intent.getStringExtra(EXTRA_FOLDER_NAME).orEmpty().trim('/'),
+        password = intent.getStringExtra(EXTRA_PASSWORD).orEmpty(),
+      )
+    setContent {
+      APSTheme {
+        EditorDestination(
+          activity = this,
+          initial = initial,
+          original = null,
+          onClose = {
+            setResult(RESULT_CANCELED)
+            finish()
+          },
+          onSaved = ::finishSaved,
+          generate = generate,
+        )
+      }
+    }
+  }
+
+  /** Records the autofill match and, for a generated password, returns it to fill the form. */
+  private fun finishSaved(saved: SaveResult.Saved) {
+    formOrigin?.let { AutofillMatcher.addMatchFor(this, it, saved.file) }
+    val resultIntent =
+      if (generate) {
+        val clientState =
+          intent?.getBundleExtra(AutofillManager.EXTRA_CLIENT_STATE)
+            ?: run {
+              logcat(ERROR) { "AutofillSaveActivity started without EXTRA_CLIENT_STATE" }
+              finish()
+              return
+            }
+        val username =
+          saved.form.username.ifEmpty { null }
+            ?: AutofillPreferences.directoryStructure(this).getUsernameFor(saved.file)
+        val credentials = Credentials(username, saved.form.password, null)
+        val fillInDataset =
+          AutofillResponseBuilder.makeFillInDataset(
+            this,
+            credentials,
+            clientState,
+            AutofillAction.Generate,
+          )
+        Intent().putExtra(AutofillManager.EXTRA_AUTHENTICATION_RESULT, fillInDataset)
+      } else {
+        // The password came from the form: there is nothing to fill.
+        Intent()
+      }
+    setResult(RESULT_OK, resultIntent)
+    finish()
+  }
+}
+```
+
+- [ ] **Step 2: Manifest**
+
+In `app/src/main/AndroidManifest.xml`, replace
+
+```xml
+    <activity
+      android:name=".ui.autofill.AutofillSaveActivity"
+      android:exported="false"
+      android:theme="@style/NoBackgroundThemeM3" />
+```
+
+with
+
+```xml
+    <!-- ponytail: rotation must not cancel a save running in lifecycleScope, as in MainActivity. -->
+    <activity
+      android:name=".ui.autofill.AutofillSaveActivity"
+      android:configChanges="orientation|screenSize"
+      android:exported="false"
+      android:theme="@style/NoActionBarThemeM3"
+      android:windowSoftInputMode="adjustResize" />
+```
+
+(The old transparent theme hid a trampoline that started the editor; the activity now is the
+editor.)
+
+- [ ] **Step 3: Checks and commit**
+
+Run: `./gradlew spotlessApply && CI=1 ./gradlew :app:assembleDebug :app:testDebugUnitTest :app:lintDebug`
+Expected: `BUILD SUCCESSFUL`. `grep -rn PasswordCreationActivity app/src/main/java` now lists only
+`PasswordCreationActivity.kt` and the three legacy dialogs.
+
+```bash
+git add app/src/main/java/app/passwordstore/ui/autofill/AutofillSaveActivity.kt \
+  app/src/main/AndroidManifest.xml
+git commit -m "feat(app): host the Compose editor in the autofill save flow
+
+AutofillSaveActivity shows the editor itself, prefilled from the form
+and FLAG_SECURE, instead of starting the legacy editor for a result. The
+autofill match and the generated-password fill work as before.
+
+Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>"
+```
+
+---
+
+### Task 7: Remove the legacy editor, generators and folder picker
+
+**Files:**
+- Delete: the files listed in "Deleted in this step" above
+- Modify: `app/src/main/AndroidManifest.xml`
+- Modify: `app/src/main/java/app/passwordstore/ui/crypto/BasePGPActivity.kt`
+- Modify: `app/src/main/java/app/passwordstore/injection/pwgen/DicewareModule.kt`
+- Modify: `app/build.gradle.kts`, `gradle/libs.versions.toml`
+- Modify: `app/lint-baseline.xml`
+- Modify: `docs/superpowers/specs/2026-11-02-compose-ui-overhaul-design.md`
+
+- [ ] **Step 1: Delete the files**
+
+```bash
+git rm app/src/main/java/app/passwordstore/ui/crypto/PasswordCreationActivity.kt \
+  app/src/main/java/app/passwordstore/ui/crypto/EditPasswordScreen.kt \
+  app/src/main/java/app/passwordstore/ui/dialogs/PasswordGeneratorDialogFragment.kt \
+  app/src/main/java/app/passwordstore/ui/dialogs/DicewarePasswordGeneratorDialogFragment.kt \
+  app/src/main/java/app/passwordstore/ui/dialogs/OtpImportDialogFragment.kt \
+  app/src/main/java/app/passwordstore/ui/folderselect/SelectFolderActivity.kt \
+  app/src/main/java/app/passwordstore/ui/folderselect/SelectFolderFragment.kt \
+  app/src/main/java/app/passwordstore/ui/adapters/PasswordItemRecyclerAdapter.kt \
+  app/src/main/res/layout/password_creation_activity.xml \
+  app/src/main/res/layout/fragment_pwgen.xml \
+  app/src/main/res/layout/fragment_pwgen_diceware.xml \
+  app/src/main/res/layout/fragment_manual_otp_entry.xml \
+  app/src/main/res/layout/select_folder_layout.xml \
+  app/src/main/res/layout/password_recycler_view.xml \
+  app/src/main/res/layout/password_row_layout.xml \
+  app/src/main/res/menu/pgp_handler_new_password.xml \
+  app/src/main/res/menu/pgp_handler_select_folder.xml \
+  app/src/main/res/drawable/ic_save_24dp.xml \
+  app/src/main/res/drawable/ic_save_copy_24dp.xml \
+  ui/compose/src/main/kotlin/app/passwordstore/ui/compose/PasswordField.kt
+```
+
+- [ ] **Step 2: Manifest**
+
+In `app/src/main/AndroidManifest.xml`, delete
+
+```xml
+    <activity
+      android:name=".ui.crypto.PasswordCreationActivity"
+      android:exported="false"
+      android:label="@string/new_password_title"
+      android:windowSoftInputMode="adjustResize" />
+
+```
+
+and
+
+```xml
+    <activity
+      android:name=".ui.folderselect.SelectFolderActivity"
+      android:exported="false" />
+```
+
+- [ ] **Step 3: BasePGPActivity**
+
+In `app/src/main/java/app/passwordstore/ui/crypto/BasePGPActivity.kt`, delete
+
+```kotlin
+  /** Full path to the repository */
+  val repoPath by unsafeLazy { intent.getStringExtra("REPO_PATH")!! }
+
+  /** Full path to the password file being worked on */
+  val fullPath by unsafeLazy { intent.getStringExtra("FILE_PATH")!! }
+
+```
+
+the line
+
+```kotlin
+    const val EXTRA_REPO_PATH = "REPO_PATH"
+```
+
+and the import
+
+```kotlin
+import app.passwordstore.util.extensions.unsafeLazy
+```
+
+- [ ] **Step 4: Diceware only for ViewModels**
+
+In `app/src/main/java/app/passwordstore/injection/pwgen/DicewareModule.kt`, replace
+
+```kotlin
+@InstallIn(FragmentComponent::class, ViewModelComponent::class)
+```
+
+with
+
+```kotlin
+@InstallIn(ViewModelComponent::class)
+```
+
+and delete the import `import dagger.hilt.android.components.FragmentComponent`.
+
+- [ ] **Step 5: Unused dependencies**
+
+In `app/build.gradle.kts`, delete the lines
+
+```kotlin
+  implementation(libs.androidx.swiperefreshlayout)
+```
+
+```kotlin
+  implementation(libs.thirdparty.flowbinding.android)
+```
+
+In `gradle/libs.versions.toml`, delete the lines
+
+```toml
+flowbinding = "1.2.0"
+```
+
+```toml
+androidx-swiperefreshlayout = "androidx.swiperefreshlayout:swiperefreshlayout:1.2.0"
+```
+
+```toml
+thirdparty-flowbinding-android = { module = "io.github.reactivecircus.flowbinding:flowbinding-android", version.ref = "flowbinding" }
+```
+
+- [ ] **Step 6: Lint baseline**
+
+`app/lint-baseline.xml` has two `SetTextI18n` issues located in the deleted generator dialogs.
+Remove both `<issue>` blocks:
+
+```bash
+perl -0pi -e 's/\n    <issue\n        id="SetTextI18n"\n(?:(?!<\/issue>).)*?GeneratorDialogFragment\.kt(?:(?!<\/issue>).)*?<\/issue>\n//gs' app/lint-baseline.xml
+grep -c GeneratorDialogFragment app/lint-baseline.xml
+```
+Expected: `0`, and `git diff app/lint-baseline.xml` shows exactly two removed `<issue>` blocks.
+
+- [ ] **Step 7: Nothing refers to the removed code**
+
+```bash
+grep -rnwE 'PasswordCreationActivity|PasswordGeneratorDialogFragment|DicewarePasswordGeneratorDialogFragment|OtpImportDialogFragment|SelectFolderActivity|SelectFolderFragment|PasswordItemRecyclerAdapter|EditPasswordScreen|CopyButton|EXTRA_REPO_PATH|repoPath|fullPath|flowbinding|swiperefreshlayout' app/src ui/compose/src app/build.gradle.kts gradle/libs.versions.toml
+grep -rnE 'PasswordCreationActivityBinding|FragmentPwgen|FragmentManualOtpEntryBinding|SelectFolderLayoutBinding|PasswordRecyclerViewBinding|R\.menu\.pgp_handler_(new_password|select_folder)|ic_save(_copy)?_24dp|ui\.compose\.PasswordField' app/src ui/compose/src
+```
+Expected: no output from either.
+
+- [ ] **Step 8: The spec**
+
+In `docs/superpowers/specs/2026-11-02-compose-ui-overhaul-design.md`, section "Editor", replace
+
+```
+- "OTP from QR" and "OTP manual" actions.
+```
+
+with
+
+```
+- "OTP from QR" (camera or image) and "OTP manual" actions.
+- "Save and copy" in the overflow. Saving returns to the list; closing returns to where the
+  editor was opened. The folder picker is a dialog, shared with the list's move action. The
+  autofill save flow (`AutofillSaveActivity`) hosts the same editor.
+```
+
+and in section "Security", replace
+
+```
+- `FLAG_SECURE` is set on the window while the entry view or editor destination is shown and
+  cleared when leaving it, so secrets stay out of screenshots and recents.
+```
+
+with
+
+```
+- `FLAG_SECURE` is set on the window while the entry view or editor destination is shown and
+  cleared when leaving it, so secrets stay out of screenshots and recents. It is counted, so
+  moving between the two never clears it.
+```
+
+- [ ] **Step 9: Full local check**
+
+Run:
+```bash
+./gradlew spotlessApply
+CI=1 ./gradlew spotlessCheck test -PslimTests :app:assembleDebug :app:assembleRelease \
+  lint metalavaCheckCompatibilityRelease
+```
+Expected: `BUILD SUCCESSFUL`. If lint reports unused resources, they were used only by the
+deleted files (likely candidates: `new_password_title`, `directory_hint`, `path_toast_text`,
+`crypto_encrypt_username_label`, `pwd_generate_button`, `otp_import_manual_entry`,
+`pwgen_include`, `select_folder`-style strings, `password_row_background` only if
+`oreo_autofill_filter_row.xml` no longer uses it): confirm with `grep -rn` that nothing else uses
+them, then delete them from every `values*/strings.xml` (a string left only in a translation is an
+`ExtraTranslation` error) or from `res/drawable`, and re-run. If lint reports an issue in a file
+from Tasks 1 to 6, fix it there and include it in this commit.
+
+- [ ] **Step 10: Commit**
+
+```bash
+git add -A app/src/main app/build.gradle.kts gradle/libs.versions.toml app/lint-baseline.xml \
+  ui/compose/src docs/superpowers/specs/2026-11-02-compose-ui-overhaul-design.md
+git commit -m "refactor(app): remove the legacy editor, generators and folder picker
+
+The Compose editor, generator sheet, OTP dialog and folder picker
+replace PasswordCreationActivity, the generator and manual OTP dialog
+fragments, SelectFolderActivity with its fragment and adapter, their
+layouts and menus, and upstream's unused EditPasswordScreen with the
+PasswordField it used. flowbinding and swiperefreshlayout had no other
+users. BasePGPActivity keeps what autofill decryption still needs.
+
+Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>"
+```
+
+---
+
+### Task 8: Emulator check and push
+
+No real store or keys: the e2e environment from AGENTS.md only. A physical phone may be
+connected over USB: every `adb` and Gradle install command in this task targets the emulator
+through `ANDROID_SERIAL`; never touch the phone. The PIN `1234` below is the emulator's own test
+PIN, never the owner's.
+
+- [ ] **Step 1: Server, emulator, unlock, clean install**
+
+```bash
+export ANDROID_SERIAL=emulator-5554
+scripts/e2e-env.sh up
+$ANDROID_HOME/emulator/emulator -avd aps-test -no-window -no-audio -no-boot-anim \
+  -no-snapshot-save -gpu swiftshader_indirect &
+adb wait-for-device
+until [ "$(adb shell getprop sys.boot_completed | tr -d '\r')" = 1 ]; do sleep 2; done
+adb shell input keyevent KEYCODE_WAKEUP; adb shell input keyevent 82
+adb shell input text 1234; adb shell input keyevent 66
+for s in animator_duration_scale transition_animation_scale window_animation_scale; do
+  adb shell settings put global $s 0; done
+adb shell settings put secure autofill_service null
+adb uninstall xyz.danix.hardenedpass.debug || true
+./gradlew :app:installDebug
+adb shell pm grant xyz.danix.hardenedpass.debug android.permission.CAMERA
+scripts/e2e-env.sh push-keys
+OUT=$(mktemp -d)
+```
+
+(`ANDROID_HOME` is the `sdk.dir` from `local.properties`. `push-keys` only after the unlock.
+`installDebug` and `adb` both honor `ANDROID_SERIAL`. The uninstall also avoids a signature
+mismatch between checkouts, see AGENTS.md. The camera grant keeps zxing's permission prompt out
+of step 6; if `pm grant` says the permission is not requested, drop it and answer the prompt.)
+
+Helpers for this shell. `center`, `tap` and `field` take an optional match index (1 = first);
+in the editor the text fields are, in order, 1 name, 2 password, 3 username, 4 extra content.
+`cmd clipboard` is not available on this image: clipboard checks paste into the list's search
+field (keycode 279) instead.
+
+```bash
+ui() { adb exec-out uiautomator dump /dev/tty; }
+center() { local b; b=$(ui | grep -o "<node [^>]*$1[^>]*>" | sed -n "${2:-1}p" | grep -o 'bounds="[^"]*"' | grep -oE '[0-9]+' | tr '\n' ' '); [ -n "$b" ] || { echo "not found: $1" >&2; return 1; }; set -- $b; echo "$(( ($1 + $3) / 2 )) $(( ($2 + $4) / 2 ))"; }
+tap() { local c; c=$(center "$1" "$2") && adb shell input tap $c; sleep 1; }
+hold() { local c; c=$(center "$1") && set -- $c && adb shell input swipe $1 $2 $1 $2 900; sleep 1; }
+field() { tap 'class="android.widget.EditText"' "$1"; adb shell input keycombination 113 29; adb shell input keyevent 67; adb shell input text "$2"; }
+value() { ui | grep -o '<node [^>]*class="android.widget.EditText"[^>]*>' | sed -n "${1}p" | grep -o ' text="[^"]*"' | cut -d'"' -f2; }
+seen() { ui | grep -q "$1" && echo "ok: $1" || echo "MISSING: $1"; }
+top() { adb shell dumpsys activity activities | grep topResumedActivity; }
+open() { adb shell am start -n xyz.danix.hardenedpass.debug/app.passwordstore.ui.main.LaunchActivity; sleep 3; }
+secure() { adb shell dumpsys window windows | awk -v a="${1:-ui[.]main[.]MainActivity}" '/Window #/{w=($0 ~ a)} w && /fl=/{print (/SECURE/ ? "secure" : "not secure"); w=0}'; }
+pass() { tap 'class="android.widget.EditText"'; adb shell input text "$1"; tap 'text="OK"'; sleep 2; }
+store() { adb shell run-as xyz.danix.hardenedpass.debug ls -a "files/store/$1"; }
+srv() { docker exec -u git aps-e2e-git git -C /srv/git/store.git "$@"; }
+reveal() { srv show "master:$1.gpg" > "$OUT/x.gpg"; GNUPGHOME=.e2e/gnupg gpg -q --batch --pinentry-mode loopback --passphrase test -d "$OUT/x.gpg"; }
+```
+
+- [ ] **Step 2: Onboarding and clone**
+
+`open`, then go through onboarding: "Let's Go", "Clone Remote Repo", Repository URL
+`ssh://git@10.0.2.2:2222/srv/git/store.git`, authentication mode "SSH key" (the toggle may need a
+second tap before it shows as selected), Save; import the SSH key `aps-e2e-ssh-key` from Download
+when asked, accept the host key, then "Select key" and import `aps-e2e-pgp-key.asc` from Download.
+Expected afterwards: `top` shows `MainActivity`; `seen 'text="example.org"'` prints `ok`;
+`secure` prints `not secure`.
+
+- [ ] **Step 3: New entry in the root, random generator, Save and copy**
+
+```bash
+tap 'text="New entry"'; tap 'text="Create new password"'
+top; seen 'text="Save"'; seen 'text="New entry"'; secure
+adb shell input text site.example.net                       # the name field has focus
+tap 'content-desc="Generate Password"'; tap 'text="Random"'
+seen 'text="Numerals"'; seen 'text="Pronounceable"'; seen 'text="Ambiguous"'
+tap 'text="Pronounceable"'                                   # an option change regenerates
+adb exec-out screencap -p > "$OUT/sheet.png"
+tap 'text="Use"'
+PW=$(value 2); echo "${#PW} $PW"
+field 3 erin
+tap 'content-desc="More options"'; tap 'text="Save and Copy"'
+sleep 3; top; seen 'text="site.example.net"'; secure
+tap 'text="Search"'; adb shell input keyevent 279; seen "text=\"$PW\""
+adb shell input keyevent 4; adb shell input keyevent 4
+```
+Expected: the editor is a `MainActivity` destination (no `PasswordCreationActivity`), `secure`;
+the sheet shows the random options; `$OUT/sheet.png` is black (open it); the password field holds
+a 20-character password (`20 ...`); after saving, the list shows `site.example.net`, the window is
+`not secure`, and the paste puts the same password in the search field (copied with the clear
+timer).
+
+- [ ] **Step 4: New entry in a subfolder, diceware generator**
+
+```bash
+tap 'text="work"'; tap 'text="New entry"'; tap 'text="Create new password"'
+seen 'text="work"'                                            # folder crumb
+adb shell input text vpn
+tap 'content-desc="Generate Password"'; tap 'text="Diceware"'
+seen 'text="Separator"'
+field 2 _                                                     # in the sheet: 1 words, 2 separator
+ui | grep -o 'text="[^"]*_[^"]*"'
+tap 'text="Use"'; DW=$(value 2); echo "$DW"
+tap 'text="Save"'; sleep 3; seen 'text="vpn"'; secure
+```
+Expected: the editor shows the `work` crumb; the sheet's preview turns into five words joined by
+`_`; the password field holds it; `vpn` is listed in `work`; `not secure`.
+
+- [ ] **Step 5: Edit: rename, move with the picker, new password; cancel back to the entry**
+
+```bash
+adb shell input keyevent 4                                    # root
+tap 'text="example.org"'; pass test; seen 'text="hunter2"'; secure
+tap 'content-desc="Edit password"'
+seen 'text="Edit entry"'; seen 'text="example.org"'; seen 'text="hunter2"'; seen 'text="alice"'
+seen 'url: https://example.org'; secure
+tap 'content-desc="Close"'; seen 'text="hunter2"'; secure      # cancel: back on the entry view
+tap 'content-desc="Edit password"'
+field 1 example-login
+tap 'text="Change"'; seen 'text="Choose a folder"'; top
+tap 'text="work"'; tap 'text="Select"'; seen 'text="work"'
+field 2 n3w-pass
+tap 'text="Save"'; sleep 3
+top; seen 'text="otp"'; seen 'text="example.org"'; secure
+store; store work
+tap 'text="work"'; tap 'text="example-login"'; pass test
+seen 'text="n3w-pass"'; seen 'text="alice"'; seen 'text="https://example.org"'
+adb shell input keyevent 4
+```
+Expected: the editor opens filled in and `secure`; Close returns to the decrypted entry view, still
+`secure` (entry to editor to entry never cleared the flag); the picker is a dialog over
+`MainActivity`; after Save the root list is back (`ok: text="otp"`), `MISSING:
+text="example.org"`, `not secure`; `store` lists no `example.org.gpg` at the root and `store work`
+lists `example-login.gpg`; the moved entry decrypts with the new password, its username and url.
+
+- [ ] **Step 6: OTP from QR (menu only) and manual OTP**
+
+```bash
+tap 'text="vpn"'; pass test; tap 'content-desc="Edit password"'
+tap 'text="OTP from QR"'; seen 'text="Scan QR code"'; seen 'text="Choose an image"'
+tap 'text="Choose an image"'; sleep 2; top
+adb shell input keyevent 4; sleep 1; seen 'text="No image file was selected"'
+tap 'text="OTP from QR"'; tap 'text="Scan QR code"'; sleep 3; top
+adb shell input keyevent 4; sleep 1; seen 'text="Failed to import TOTP configuration"'
+tap 'text="Manual OTP"'; seen 'text="Add OTP"'
+adb shell input text JBSWY3DPEHPK3PXP                          # the secret field has focus
+tap 'class="android.widget.EditText"' 2; adb shell input text example.net
+tap 'text="OK"'
+seen 'otpauth://totp?secret=JBSWY3DPEHPK3PXP&amp;issuer=example.net'; seen 'text="Manual OTP"'
+tap 'text="Save"'; sleep 3; seen 'text="vpn"'
+```
+Expected: the QR menu offers both sources; "Choose an image" opens the system picker
+(`com.android.documentsui` or `com.google.android.documentsui` on top) and backing out shows the
+"no image" snackbar; "Scan QR code" opens zxing's `CaptureActivity`, backing out shows the failure
+snackbar. QR decoding itself cannot be exercised on the emulator (no QR in front of its virtual
+camera, no QR image on the device); the maintainer checks it on the phone. The manual dialog adds
+the URI line to the extra content and both OTP actions disappear (`MISSING: text="Manual OTP"`).
+The OTP entry view never goes idle, so its code is checked on the server in step 11, not here.
+
+- [ ] **Step 7: Missing recipient refusal (0.1.2)**
+
+```bash
+FPR=$(cat .e2e/seed/.gpg-id)
+printf '%s\nMissing Key <missing@example.org>\n' "$FPR" | adb exec-in "run-as xyz.danix.hardenedpass.debug sh -c 'mkdir -p files/store/missing && cat > files/store/missing/.gpg-id'"
+adb shell input keyevent 4; sleep 1                            # root, re-read on resume
+tap 'text="missing"'; tap 'text="New entry"'; tap 'text="Create new password"'
+adb shell input text nope; field 2 x
+tap 'text="Save"'; sleep 2
+seen 'text="Error"'; ui | grep -o 'nothing was saved[^"]*'
+tap 'text="OK"'; seen 'text="nope"'
+tap 'content-desc="Close"'; sleep 1; seen 'text="nope"'
+store missing
+adb shell run-as xyz.danix.hardenedpass.debug rm -r files/store/missing
+adb shell input keyevent 4
+```
+Expected: saving shows the "Error" dialog with "Could not encrypt the password, nothing was saved:
+No key found with id: ..." naming the missing recipient; OK leaves the editor open with its
+content; Close returns to the folder without a `nope` entry; `store missing` lists only `.`, `..`
+and `.gpg-id` (no file, not even an empty one). The folder is removed again before the sync.
+
+- [ ] **Step 8: Cancel paths and rotation mid-edit**
+
+```bash
+tap 'text="New entry"'; tap 'text="Create new password"'
+adb shell input text cancel-test; tap 'content-desc="Close"'; sleep 1
+seen 'text="cancel-test"'; secure
+tap 'text="New entry"'; tap 'text="Create new password"'
+adb shell input text rot-test; field 2 abc123; field 4 line1
+adb shell settings put system accelerometer_rotation 0; adb shell settings put system user_rotation 1; sleep 2
+seen 'text="rot-test"'; seen 'text="abc123"'; seen 'text="line1"'; secure
+adb shell settings put system user_rotation 0; sleep 2; seen 'text="rot-test"'
+for i in 1 2; do ui | grep -q 'text="Save"' && adb shell input keyevent 4; sleep 1; done
+seen 'text="rot-test"'; secure; store
+```
+Expected: Close discards (`MISSING: text="cancel-test"`, `not secure`); after rotation the editor
+still shows all three values and is `secure`; system back (after the keyboard, if it was up)
+discards too (`MISSING: text="rot-test"`, `not secure`), and `store` lists neither file.
+
+- [ ] **Step 9: List move with the new picker**
+
+```bash
+hold 'text="site.example.net"'; tap 'content-desc="Move"'
+seen 'text="Choose a folder"'; top
+tap 'text="work"'; tap 'content-desc="Password store"'        # into a folder, back to the root
+tap 'text="New folder"'; seen 'text="Create folder"'
+tap 'text="Create"'; seen 'Category name can'                 # blank
+adb shell input text work; tap 'text="Create"'; seen 'text="A folder by that name already exists"'
+field 1 ../outside; tap 'text="Create"'; seen 'text="Destination must be within the repository"'
+field 1 archive; tap 'text="Create"'; seen 'text="archive"'; seen 'text="Choose a folder"'
+store; store archive; adb shell run-as xyz.danix.hardenedpass.debug ls files
+tap 'content-desc="Password store"'
+tap 'text="otp"'; tap 'text="Select"'; sleep 2
+seen 'text="site.example.net"'; seen 'text="archive"'
+tap 'text="otp"'; seen 'text="site.example.net"'
+adb shell input keyevent 4
+```
+Expected: the picker is a dialog over `MainActivity` (no `SelectFolderActivity`), its breadcrumbs
+jump back to the root. "New folder" opens the list's "Create folder" dialog over the picker and
+refuses, with the list's messages, a blank name, an existing folder (`work` at the root) and a
+name that resolves outside the store (`../outside`); `archive` is created and the picker shows it
+(crumb `archive`, still the picker); `store` lists `archive`, `store archive` lists only `.` and
+`..`, and `ls files` shows no `outside` next to `store`. Back at the root crumb, Select on `otp` moves
+the entry: gone from the root (`MISSING: text="site.example.net"`), `archive` listed in the
+root, the entry listed in `otp`. (`archive` stays empty, so git never sees it and step 11's
+server tree is unchanged.)
+
+- [ ] **Step 10: Autofill save flow (if `adb root` works on this image)**
+
+```bash
+if adb root | grep -q 'cannot run as root'; then echo "skip: no adb root"; else
+  adb wait-for-device; sleep 2
+  adb shell am start -n xyz.danix.hardenedpass.debug/app.passwordstore.ui.autofill.AutofillSaveActivity \
+    --es app.passwordstore.autofill.oreo.ui.EXTRA_FOLDER_NAME example.net \
+    --es app.passwordstore.autofill.oreo.ui.EXTRA_NAME dave \
+    --es app.passwordstore.autofill.oreo.ui.EXTRA_PASSWORD from-the-form \
+    --es app.passwordstore.autofill.oreo.ui.EXTRA_SHOULD_MATCH_WEB example.net
+  sleep 3; top; seen 'text="dave"'; seen 'text="from-the-form"'; seen 'text="example.net"'
+  secure 'AutofillSaveActivity'
+  tap 'text="Save"'; sleep 3; top
+  adb shell am start -n xyz.danix.hardenedpass.debug/app.passwordstore.ui.autofill.AutofillSaveActivity \
+    --es app.passwordstore.autofill.oreo.ui.EXTRA_FOLDER_NAME example.net \
+    --es app.passwordstore.autofill.oreo.ui.EXTRA_NAME frank \
+    --ez app.passwordstore.autofill.oreo.ui.EXTRA_GENERATE_PASSWORD true
+  sleep 3; seen 'text="Use"'; tap 'text="Use"'; tap 'text="Save"'; sleep 3; top
+  adb unroot; adb wait-for-device; sleep 2
+fi
+open; tap 'text="example.net"'; seen 'text="dave"'; seen 'text="frank"'; adb shell input keyevent 4
+```
+Expected (with root): `AutofillSaveActivity` on top showing the editor prefilled with `dave`,
+`from-the-form` and the `example.net` crumb, `secure`; Save finishes it. The second start opens
+with the generator sheet already up; Use and Save finish it (no autofill client state from the
+shell, so it only logs that and closes; the file is still saved and committed). The list then
+shows `example.net` with `dave` and `frank`. Without root, the step prints `skip` and the list
+check is skipped too. Either way the real flow is the maintainer's check, not part of this run
+(maintainer decision 1): on the tablet with Firefox, submit a login form and save it from the
+autofill prompt, then use "Generate password" on a sign-up form; both open this editor, save,
+and the generated password is filled in. Record the result in the session handoff.
+
+- [ ] **Step 11: Sync, and what the server got**
+
+```bash
+adb shell input swipe 540 700 540 1800 400; sleep 8
+srv log --format=%s
+srv ls-tree -r --name-only master
+reveal otp/site.example.net; echo ---
+reveal work/example-login; echo ---
+reveal work/vpn; echo ---
+python3 -c 'import hmac,hashlib,struct,time,base64;k=base64.b32decode("JBSWY3DPEHPK3PXP");h=hmac.new(k,struct.pack(">Q",int(time.time())//30),hashlib.sha1).digest();o=h[-1]&15;print("%06d"%((struct.unpack(">I",h[o:o+4])[0]&0x7fffffff)%1000000))'
+```
+Expected: no error dialog. The log shows, above `Initial test store`: `Add generated password
+for site.example.net using HardenedPass.`, `Add generated password for work/vpn using
+HardenedPass.`, `Edit password for work/example-login using HardenedPass.`, `Edit password for
+work/vpn using HardenedPass.`, `Rename site.example.net to otp/site.example.net.` (plus the two
+`example.net/...` additions when step 10 ran). The tree has no `example.org.gpg`, no
+`missing/`, no `rot-test.gpg` or `cancel-test.gpg`, no `.tmp` file. Decrypted:
+`otp/site.example.net` is `$PW`, then `username: erin`; `work/example-login` is `n3w-pass`,
+`username: alice`, `url: https://example.org`; `work/vpn` is `$DW` then
+`otpauth://totp?secret=JBSWY3DPEHPK3PXP&issuer=example.net`. (The Python line prints the current
+code for that secret, for a by-eye comparison if wanted: open `work/vpn` and take an emulator
+console screenshot, as in step 3's plan.)
+
+- [ ] **Step 12: Tear down and push**
+
+```bash
+adb shell settings put system user_rotation 0; adb shell settings put system accelerometer_rotation 1
+adb uninstall xyz.danix.hardenedpass.debug
+adb shell rm -f /sdcard/Download/aps-e2e-ssh-key /sdcard/Download/aps-e2e-pgp-key.asc
+adb emu kill
+scripts/e2e-env.sh down
+unset ANDROID_SERIAL
+rm -rf "$OUT"
+git push
+```
+
+Expected: push succeeds to every `origin` push URL.
+
+---
+
+## Self-review notes
+
+- **Spec coverage for step 4:** `EditRoute` is a Compose destination in `MainActivity`, opened from
+  the create sheet in the current folder and from the entry view's edit action (Task 5); after save
+  the list, after cancel back where it came from (Task 5, checked in Task 8 steps 3, 5, 8). Top bar
+  close, title, Save; name; folder chips with Change opening the picker; password with reveal and
+  generator; generator bottom sheet with random and diceware tabs and the old options; username;
+  free-text extras; OTP from QR and manual (Tasks 4, 5). Strings in `values/` and `values-it/`
+  ("voce" for entry; Tasks 2, 4). Folder picker shared with the list's move (Tasks 2, 5; checked
+  in steps 5 and 9, "New folder" with its refusals in step 9). `FLAG_SECURE` counted across entry and editor, explicit on the sheet and the
+  OTP dialog, on for the autofill editor (Tasks 4 to 6; steps 3, 5, 8, 10). Plaintext only in
+  ViewModel memory; edits copy it from the entry view's ViewModel (Tasks 3, 5). Save path keeps
+  every check and closes three gaps (Task 3; steps 5, 7, 11). Autofill save keeps working, now on
+  the Compose editor (Task 6; step 10 and the maintainer's device check). Deletions and what is
+  left of `BasePGPActivity` (Task 7). TDD for the pure logic (Task 1). Full local CI (Task 7).
+  Emulator check of every scenario asked for (Task 8).
+- **Parity summary:** ported: secure window, titles, name focus, password reveal and monospace,
+  generators with all options and stored preferences, OTP scan, image and manual import with
+  snackbars, OTP actions hidden when a secret exists, validation messages, `.gpg-id` recipients,
+  missing-key refusal, nothing written on failed encryption, duplicate check, inside-repository
+  check, rename with recently-used time, commit messages, autofill result. Changed: folder chips
+  and picker instead of a path field, username always shown, password visibility from the setting,
+  Save and copy in the overflow and only after success, generator errors in the sheet, write
+  errors keep the editor open, an undeletable old file is a snackbar, rotation keeps the form in
+  memory instead of saved state. Fixed: overwrite on a move, copy left behind on a move, folder
+  created before the inside check, failed write truncating an entry, autofill matches lost on
+  rename. Dropped: "Encrypt username" switch, the editor's "No keys imported" prompt.
+- **Deliberate shortcuts (`ponytail:`):** an edit restored after process death closes (Task 5);
+  commit failures not shown and a mid-save theme change committing later (Task 5); the picker's
+  plain scrolling column (Task 2); generator length caps (Task 4); `AutofillSaveActivity`'s
+  `configChanges` (Task 6).
+- **Type and name consistency:** `EditorForm`, `editorForm`, `passContent`, `formError`,
+  `entryFile`, `overwrites`, `writeEntry`, `withLine`, `totpUri`, `RandomSpec.options`,
+  `randomPassword`, `DicewareSpec` (Task 1) are used with the same signatures in Tasks 3 and 5;
+  `SaveResult.Saved(file, form, staleOriginal)` in Tasks 3, 5, 6; `EditorViewModel.start`,
+  `started`, `saving`, `hasOtp`, `randomSpec`, `generateRandom`, `dicewareSpec`,
+  `generateDiceware`, `readQr`, `save` (Task 3) match their calls in Task 5; `FolderPicker(root,
+  start, onPick, onDismiss)` in Tasks 2 and 5, `FolderNameDialog` and `folderNameError` shared by
+  the list and the picker; `ListDestination(..., onNewEntry)` and
+  `EntryDestination(..., onEdit)` match `MainActivity` (Task 5).
+
+## Maintainer decisions (2026-11-03)
+
+1. Autofill save moves to the Compose editor in this step (Task 6 as planned). The tablet and
+   Firefox check of the real autofill save and generate flows is the maintainer's; Task 8, step 10
+   says so.
+2. The folder picker gets a "New folder" action: it creates a folder inside the folder the picker
+   shows, with the list's validation (blank, inside the repository by path components, already
+   exists), then shows it so Select picks it. The list's `FolderNameDialog` (now `internal`) and
+   `folderNameError` are reused, not duplicated. New string `folder_picker_new` in `values/` and
+   `values-it/`. Applied in Task 2, checked in Task 8, step 9.
+3. "Encrypt username" switch: dropped, as planned.
+4. "Save and copy": kept in the overflow menu, copies only after a successful save, as planned.