Add legacy remote credential migration notices

main_test.go

@@ -4560,6 +4560,44 @@ func TestUILoadRecentRemotesIgnoresLegacySavedCredentials(t *testing.T) {
 	if got := u.recentRemotes[0]; got.BaseURL != "https://dav.example.com" || got.Path != "vaults/home.kdbx" {
 		t.Fatalf("recentRemotes[0] = %#v, want location-only record", got)
 	}
+	if !u.recentRemotes[0].NeedsMigration {
+		t.Fatal("recentRemotes[0].NeedsMigration = false, want true for legacy saved credentials")
+	}
+	if got := u.recentRemotes[0].Username; got != "" {
+		t.Fatalf("recentRemotes[0].Username = %q, want empty after migration strip", got)
+	}
+	if got := u.recentRemotes[0].Password; got != "" {
+		t.Fatalf("recentRemotes[0].Password = %q, want empty after migration strip", got)
+	}
+}
+
+func TestUINewUIShowsMigrationStatusForLegacyRecentRemoteCredentials(t *testing.T) {
+	t.Parallel()
+
+	dir := t.TempDir()
+	recentRemotesPath := filepath.Join(dir, "recent-remotes.json")
+	content := `[
+  {
+    "baseUrl": "https://dav.example.com",
+    "path": "vaults/home.kdbx",
+    "username": "alice",
+    "password": "secret-1"
+  }
+]`
+	if err := os.WriteFile(recentRemotesPath, []byte(content), 0o600); err != nil {
+		t.Fatalf("WriteFile(recent-remotes.json) error = %v", err)
+	}
+
+	u := newUIWithState("desktop", &session.Manager{}, statePaths{
+		DefaultSaveAsPath: filepath.Join(dir, "default.kdbx"),
+		RecentVaultsPath:  filepath.Join(dir, "recent-vaults.json"),
+		RecentRemotesPath: recentRemotesPath,
+		UIPreferencesPath: filepath.Join(dir, "ui-prefs.json"),
+	})
+
+	if got := u.state.StatusMessage; got != "This saved remote came from an older local-sign-in format. Open it again, then save the remote in the vault to migrate it." {
+		t.Fatalf("StatusMessage = %q, want legacy recent-remote migration notice for the selected startup remote", got)
+	}
 }
 
 func TestUIApplyRecentRemoteRecordRestoresVaultBindingSelection(t *testing.T) {
@@ -4586,6 +4624,22 @@ func TestUIApplyRecentRemoteRecordRestoresVaultBindingSelection(t *testing.T) {
 	}
 }
 
+func TestUIApplyRecentRemoteRecordShowsMigrationNoticeForLegacySavedCredentials(t *testing.T) {
+	t.Parallel()
+
+	u := newUIWithSession("desktop", &session.Manager{})
+
+	u.applyRecentRemoteRecord(recentRemoteRecord{
+		BaseURL:        "https://dav.example.com",
+		Path:           "vaults/home.kdbx",
+		NeedsMigration: true,
+	})
+
+	if got := u.state.StatusMessage; got != "This saved remote came from an older local-sign-in format. Open it again, then save the remote in the vault to migrate it." {
+		t.Fatalf("StatusMessage = %q, want legacy per-record migration notice", got)
+	}
+}
+
 func TestUIStartupPreselectsNewestTargetAcrossLocalAndRemote(t *testing.T) {
 	t.Parallel()