feat(tracker): add profile-bound API key management and overhaul Settings UI

[GiribaldiTTV]

Summary

This PR replaces the ambiguous TarkovTracker.org API token workflow with a verified, profile-bound API key system and a complete management interface.

Tarkov Monitor can now visibly and reliably store multiple PVE, PVP, and Seasonal keys, bind each key to an exact EFT account, profile, and game mode, and automatically select the correct key for the active session. It also introduces a responsive Settings overhaul, consistent dropdown and dialog styling, safer historical log replay, and several startup and profile-state fixes.

Startup also feels substantially faster because the interface now renders before watcher and update services finish initializing.

The branch also hardens profile activation and diagnostic reporting, supports clean startup when EFT is not installed, and keeps Tarkov.dev data isolated to the currently active session mode. Repeated profile notifications now share in-flight work, superseded requests are handled as expected state changes, and diagnostics retain endpoint, duration, and privacy-safe failure context.

TarkovTracker.io remains visible as a retired service with guidance directing users to TarkovTracker.org.

Fixes #191

Legacy profile-keyed .org upgrade behavior

Existing TarkovTracker.org records from the legacy profile-keyed store are intentionally recovered as Unassigned during upgrade. Tarkov Monitor does not infer ownership from a legacy record or silently bind it to the active session. Users must review the recovered key in Settings and explicitly assign it to the verified EFT account, profile, and game mode before tracker writes resume.

Commit-by-commit summary

e002f15 - feat(tracker): store and switch verified org keys by EFT profile

Author: Giribaldi_TTV

• Adds a versioned local TarkovTracker.org key store with guarded migration and corruption-aware persistence.
• Supports verified PVE, regular PVP, and Seasonal API keys.
• Verifies keys against the TarkovTracker.org endpoint before accepting or activating them.
• Binds each key to an exact EFT account ID, profile ID, and game mode.
• Automatically selects the matching key when Tarkov Monitor detects an active EFT profile.
• Prevents a key from another account, profile, or game mode from being used as a fallback.
• Treats unknown or future EFT modes as unsupported and revokes writable tracker state.
• Adds backend operations for assignment, reassignment, swapping, unbinding, removal, account nicknames, and profile-key nicknames.
• Preserves protected account and profile identifiers in Dashboard messages without displaying raw API keys.
• Keeps TarkovTracker.io state isolated and inactive.

f659649 - feat(settings): add guided TarkovTracker key management

Author: Giribaldi_TTV

• Replaces the single-token interface with assigned and unassigned key drawers.
• Adds guided API key import, endpoint verification, and saved-profile scanning.
• Adds dialogs for assignment, reassignment, swapping, unbinding, removal, account naming, profile-key naming, and key details.
• Filters assignment choices by the key's verified game mode.
• Clearly distinguishes available and unavailable profiles.
• Keeps API keys and protected identifiers masked until intentionally revealed.
• Displays storage recovery warnings when saved data cannot be safely modified.
• Disables only the affected write operations while keeping safe details and recovery information available.
• Opens Settings with key-management drawers collapsed while preserving normal in-session navigation state.
• Improves guidance for users with no saved matching profile and provides a visible Scan profiles action.
• Retains the retired TarkovTracker.io selector and migration guidance.

7407d56 - bugfix(raw-logs): replay task history chronologically and in profile scope

Author: Giribaldi_TTV

• Processes historical log folders and notifications from oldest to newest.
• Uses an isolated watcher so historical replay does not interfere with the active live watcher.
• Resolves the exact account, profile, and game mode represented by the selected log breakpoint.
• Requires a verified key assigned to that exact profile before sending task updates.
• Acquires a profile-scoped TarkovTracker lease instead of relying on ambient active-session state.
• Prevents historical replay while EFT is running.
• Stops before parsing or displaying task changes when no matching key is available.
• Restores watcher state and event subscriptions through guarded cleanup paths.
• Batches replay results so large histories remain bounded and readable.
• Keeps the resulting Dashboard messages in chronological order.

1664912 - bugfix(settings): handle missing EFT profile identity

Author: Giribaldi_TTV

• Replaces the false default PVP profile display with a neutral "No EFT profile detected" state.
• Prevents empty startup state from generating a broken Tarkov.dev player link.
• Avoids unnecessary player-name requests when no complete profile identity exists.
• Applies asynchronous profile-name results only when the same account, profile, and session mode remain active.
• Prevents stale names from appearing after a profile change.
• Applies the same guarded profile presentation to Settings and Read Past Logs.

ea9f3a3 - bugfix(startup): stabilize first paint and window restoration

Author: Giribaldi_TTV

• Upgrades persisted user settings before startup options are read.
• Allows the WebView and Blazor interface to render before watcher and update services begin.
• Coordinates the optional splash screen with the first completed UI paint.
• Preserves immediate startup when the splash screen is disabled.
• Prevents historical offline profile data from being announced as a newly confirmed live EFT session.
• Deduplicates session messages using the exact account, profile, and game mode identity.
• Prevents tracker-management refreshes from generating false session-confirmation messages.
• Improves minimize, restore, maximize, title-bar double-click, and drag-to-restore behavior.
• Recalculates the native frame after restore to remove the stale upper window inset.
• Preserves the previous restored bounds and responsive layout.

57a46fb - feat(ui): overhaul responsive settings and dropdown interactions

Author: Giribaldi_TTV

• Reflows Settings into one, two, or three columns based on available width.
• Uses a denser masonry-style layout to reduce unused fullscreen space.
• Moves Language and Window behavior to predictable leading positions.
• Tightens card, row, banner, drawer, dialog, and control spacing without blurring section boundaries.
• Normalizes user-facing text throughout Settings, Sounds, Stats, Timers, and tracker dialogs.
• Adds a shared mid-dark dropdown design across all application dropdowns and menus.
• Constrains dropdowns to small windows while allowing long menus to expand on larger and fullscreen displays.
• Keeps dropdown positioning under MudBlazor while applying viewport-aware height limits.
• Supports reliable neutral-click, activator-toggle, and page-scroll dismissal.
• Preserves the exact native page-scroll delta when an open dropdown closes.
• Prevents dropdowns from detaching from their activators or jumping during responsive resizing.
• Removes persistent focus glow after pointer or scroll dismissal.
• Adds distinct keyboard navigation cues without changing committed selection styling.
• Standardizes selected-row fill, text contrast, borders, scrollbars, shadows, and child-dialog title colors.
• Improves Read Past Logs dialog structure and responsive behavior.
• Makes the Active profile label spacing explicit.
• Preserves minimum-window behavior and fullscreen dropdown expansion.

e9b70ee - merge(master): reconcile PR 212 with 2.0.5.0

Author: Giribaldi_TTV

• Reconciles the UI and API-key work with the 2.0.5.0 base.
• Incorporates the diagnostics, watcher resilience, Steam-log recovery, future-mode parsing, missing-profile handling, Tarkov.dev response handling, player-lookup safeguards, and version changes from the current base.
• Resolves overlap across startup, watcher, tracker, Tarkov.dev, logging, socket, and diagnostics code.

7446f45 - fix(tracker): harden profile activation and diagnostic reporting

Author: Giribaldi_TTV

• Coalesces concurrent Tarkov.dev player-name lookups and guards cache insertion, preventing duplicate-key failures.
• Makes tracker activation latest-wins and shares repeated activation requests for the same account, profile, and mode.
• Classifies superseded activation cancellations as expected state changes instead of user-facing errors.
• Preserves inner exceptions and adds endpoint and duration metadata to diagnostics.
• Improves diagnostic redaction for numeric identifiers and separates player-lookup failures from background refresh failures.

216e90b - fix(ui): make session messages and assets deterministic

Author: Giribaldi_TTV

• Makes tracker progress and Tarkov.dev messages identify the active EFT player, level/class, and session mode.
• Keeps the full tracker API key protected behind the existing hidden/reveal interaction.
• Changes localized guidance from ?set? to ?assign.?
• Reloads Tarkov.dev assets when the session mode changes.
• Cancels stale asset requests, clears superseded snapshots, and publishes complete asset sets atomically so Seasonal and Non-Seasonal PVP data cannot mix.
• Completes the follow-up for TM-API-TARKOVDEV-002 and TM-API-TRACKER-001.

cc748f3 - bump needed sdk version

Author: Razzmatazz

• Updates the required .NET SDK from 10.0.302 to 10.0.400.
• Retains latest-patch roll-forward behavior for reproducible branch builds.

5d961e5 - identify self on connect

Author: Razzmatazz

• Adds the application identity and version as the WebSocket Origin header during connection.
• Allows the socket service to identify the connecting Tarkov Monitor client in addition to the existing User-Agent.

bf0a282 - fix(watcher): treat missing EFT install as idle state

Author: Giribaldi_TTV

• Treats a missing Escape from Tarkov installation or logs folder as a valid first-run state.
• Keeps the watcher dormant instead of throwing a startup exception.
• Allows Tarkov Monitor to remain usable when EFT is installed after Tarkov Monitor.

63d58f0 - merge(master): apply current base fixes to PR 212

Author: Giribaldi_TTV

• Reconciles PR feat(tracker): add profile-bound API key management and overhaul Settings UI #212 with the then-current master.
• Brings the current SDK and socket-identification base commits into the PR history.
• Adds no further product-tree changes beyond its first parent; it is a branch-reconciliation commit.

Changelog

User-visible changes

• Multiple verified TarkovTracker.org API keys can now be stored and managed.
• Keys are automatically selected using the active EFT account, profile, and game mode.
• PVE, PVP, and Seasonal keys are supported.
• Assigned and unassigned keys have dedicated management drawers.
• Account names and profile-key nicknames can be managed separately.
• Historical task progress is replayed chronologically and only for the selected profile.
• Settings now adapts across compact, normal, and fullscreen window sizes.
• Dropdowns and child dialogs share consistent styling and interaction behavior.
• Startup, splash, minimize, restore, maximize, and drag-to-restore behavior is smoother.
• Empty profile state and session messages are more accurate.
• Tarkov Monitor remains usable when EFT is not installed.
• Expected superseded tracker requests no longer surface as user-facing failures.
• Tarkov.dev assets reload when switching between PVE, Seasonal PVP, and Non-Seasonal PVP.
• Session and tracker messages identify the active player and session mode deterministically.
• Tracker API keys remain hidden unless intentionally revealed.

Internal and technical changes

• Stores TarkovTracker.org keys, assignments, saved profiles, and nicknames together in a structured local settings record that can be safely upgraded when its format changes.
• Adds exact account/profile/mode request isolation.
• Adds guarded legacy recovery and malformed-store preservation.
• Adds profile-scoped historical update leases.
• Adds bounded and ordered Dashboard message batching.
• Adds viewport-aware dropdown constraints and owner-scoped dismissal handling.
• Adds latest-wins tracker activation with shared in-flight activation for duplicate profile notifications.
• Adds concurrent player-name lookup coalescing and guarded cache writes.
• Adds endpoint- and duration-aware diagnostics with expanded identifier redaction.
• Adds explicit handling for missing EFT installations and unavailable log folders.
• Adds WebSocket client identification through the Origin header.
• Requires the .NET 10.0.400 SDK for branch builds.

Validation conducted

• Built the final branch using the bundled .NET 10.0.400 SDK with zero build errors.
• Restored the final win-x64 runtime target successfully.
• Produced a fresh self-contained, single-file Windows publication with zero publish errors.
• Confirmed the published executable and required native dependencies were present.
• Confirmed the published index.html and app.css exactly matched the committed source.
• Confirmed the branch remained clean after build and publication.
• Reviewed the committed branch for accidental credentials and non-product artifacts.
• Exercised live and historical PVE, PVP, Seasonal, and unsupported future-mode parsing.
• Verified unsupported modes fail closed without retaining another mode's writable state.
• Exercised API key prefix handling, verified-mode matching, store migration, malformed-store rejection, and populated-store round trips.
• Exercised chronological log breakpoint discovery, exact-profile replay, ordered task batching, and bounded Dashboard messages.
• Exercised fresh-user storage with no imported keys or profiles.
• Exercised populated-user migration while preserving existing keys, bindings, accounts, profiles, and nicknames.
• Tested Settings at minimum, default, medium, maximized, and fullscreen dimensions.
• Confirmed one-, two-, and three-column layouts with no card overlap or horizontal overflow.
• Tested all Settings dropdowns for opening, internal scrolling, selection, keyboard navigation, neutral dismissal, activator dismissal, external page scrolling, focus release, responsive resizing, flipping, and fullscreen expansion.
• Tested key-management and Read Past Logs dialogs at compact and normal window sizes.
• Tested minimize, restore, maximize, title-bar restore, and previous-bounds restoration.
• Observed no Blazor error interface, unhandled runtime exception, repeated render failure, or dropdown interaction regression during the completed local validation matrix.

Follow-up validation required for the reconciled head

The post-reconciliation fixes in 7446f45, 216e90b, and bf0a282 should be revalidated at 63d58f0 before release:

• Duplicate player-name lookup protection and concurrent cache access.
• Superseded tracker activation and cancellation handling.
• Diagnostic redaction of numeric identifiers and endpoint/duration reporting.
• Startup with no EFT installation or logs folder.
• Session-mode asset reload, stale-request cancellation, and atomic snapshot publication.
• WebSocket connection identity headers.

Author-reported live EFT client testing

The author tested the current branch runtime while actively using Escape from Tarkov over several weeks.

The reported live-use checks included:

• Starting Tarkov Monitor before EFT and allowing the active profile to be detected after EFT launched.
• Starting Tarkov Monitor after an EFT profile had already loaded.
• Detecting profile and session changes without requiring an application restart.
• Confirming the active account, profile, and game mode were represented correctly.
• Exercising PVE, PVP, and Seasonal profile recognition.
• Confirming the matching TarkovTracker.org key was selected for the active identity.
• Importing and verifying TarkovTracker.org keys.
• Exercising assignment, reassignment, swapping, unbinding, removal, account naming, and profile-key nickname workflows.
• Restarting Tarkov Monitor and confirming saved key-management state remained available.
• Confirming Settings drawers returned to their intended closed startup state.
• Confirming Tarkov.dev received the current map and session context.
• Reviewing Dashboard session, tracker, task, and protected-identifier messages.
• Confirming duplicate session messages and offline previous-session announcements no longer appeared during the tested workflow.
• Exercising Read Past Logs with a matching assigned key and reviewing chronological task results.
• Exercising compact, resized, maximized, minimized, restored, and fullscreen window states.
• Reviewing dropdowns, child dialogs, warnings, links, focus states, scrolling, and responsive card placement during normal use.
• Testing both splash-enabled and splash-disabled startup behavior.

A later beta-runtime test did report TM-API-TARKOVDEV-002 and TM-API-TRACKER-001 diagnostics during profile activation. The follow-up commits above address the duplicate player-lookup, superseded-activation, deterministic-message, and session-specific asset-reload paths.

The author reported no errors, unhandled exceptions, or functional issues during the earlier completed live-use period; that statement predates the later beta-runtime report and should not be read as coverage of the post-report fixes.

Validation scope note

The live-client section records author-reported manual usage. It is separate from independently captured local validation. Exhaustive release validation across every possible EFT profile transition, production first-launch migration, network failure, and Seasonal endpoint-write condition remains part of the release process rather than this PR's automated evidence.

Merge-order note

PR #211 and the 2.0.5.0 base changes were reconciled through e9b70ee. The final branch reconciliation at 63d58f0 also incorporates the current master commits c9f7b4e and 0cc5107. No outstanding PR #211 merge-order action remains; the branch should only be rechecked if master advances again.

Update for pushed head 5c541ce

This section supersedes the earlier follow-up list for the reconciled head. Six focused commits were added to PR212 and pushed together as the reviewed correction set.

7756b28 ? fix(security): protect profile-bound tracker tokens with DPAPI

• Keeps the existing JSON settings container and migrates legacy plaintext tracker tokens during load.
• Stores new token values as user-scoped DPAPI-protected data with versioned recovery handling.
• Fails closed when the current Windows user cannot decrypt protected settings.
• Preserves exact account, profile, and session binding for verified TarkovTracker.org keys.
• Prevents prefix-only automatic binding and preserves manual-unbind suppression across reloads.

7664b14 ? fix(settings): make tracker key assignment state explicit

• Changes guidance from setting a token to assigning a token.
• Adds the clear MANUAL ASSIGNMENT ONLY state for keys intentionally unbound from their previous EFT account.
• Keeps assignment, reassignment, conflict, and removal flows explicit to the user.

2884169 ? fix(tarkov.dev): make session data lifecycle identity-safe

• Preloads read-only Tarkov.dev assets from the most recent complete profile recovered from EFT log history when a prior profile exists.
• Keeps tracker writes inactive until live EFT identity is available.
• Cancels stale asset requests, clears invalid or superseded snapshots, and publishes only the exact account/profile/session context.
• Refreshes replacement application logs through the profile-ready transition, stops updates on EFT exit, and keeps timer registration idempotent.

a2a524a ? fix(replay): isolate historical task catalogs and renderer work

• Resolves historical task IDs through the selected session?s catalog.
• Moves large replay parsing and event processing away from the Blazor renderer.
• Preserves chronological, profile-scoped, immutable replay results.

8fbfa11 ? fix(ui): reject expired message actions at execution time

• Adds one-shot expiry notifications for Dashboard messages.
• Rechecks expiration when an action is clicked, including after confirmation dialogs.
• Prevents expired actions from remaining executable during the redraw interval.

5c541ce ? fix(startup): validate WebView2 before constructing UI

• Runs WebView2 prerequisite repair before constructing the main WebView host.
• Covers normal, skip-splash, and minimized startup paths.
• Establishes the executable working directory before startup services begin.

Regression and compatibility review

• Existing PR212 behavior for profile-bound keys, assignment persistence, responsive Settings, historical replay, deterministic session messaging, missing-EFT startup, and current-base diagnostics remains in the branch.
• Previously merged tracker endpoint, Seasonal verification, .io retirement, .NET 10, media-state, logs-folder, overlay, diagnostics, and timestamp-prefixed log handling were checked against the current base and remain present.
• Socket resilience remains outside this PR; no socket-resilience implementation was folded into these commits.
• Legacy profile-keyed .org upgrade behavior remains intentional: recovered records are unassigned until the user explicitly assigns them.

Validation for pushed head

• dotnet build TarkovMonitor.sln -c Release --no-restore: passed with 0 errors and 186 existing project warnings.
• The same final source tree restored and published successfully as a self-contained win-x64 single-file runtime with 0 publish errors.
• Profile/key smoke validation passed, including automatic first-account binding, persistence, cross-account separation, ambiguous-key manual fallback, unbind suppression, explicit reassignment, and protected JSON serialization.
• Protected-store probe passed, including binding persistence, unbind suppression, and same-profile non-rebinding.
• git diff --check passed before publication.
• No source token-shaped literals or non-product artifacts were included in the pushed commits.
• The author confirmed the live startup workflow now preloads Tarkov.dev assets from the previous session log without requiring EFT to be launched first.

Remaining release boundary

The pushed branch is build- and focused-validation green. The remaining release gate is the organic live EFT matrix: PVE, Seasonal PVP, Non-Seasonal PVP, account switching, EFT shutdown, tracker writes, first-launch migration, and network failure behavior. These require normal user workflows rather than injected triggers.

[Razzmatazzz]

Huge PR! The changes look great in the video! Thanks for taking this on!