aaravmaloo · aaravmaloo · Mar 14, 2026 · Mar 14, 2026 · Mar 14, 2026 · Mar 14, 2026
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -0,0 +1,19 @@
+# Contributing to APM
+
+Thanks for contributing. APM is a security-sensitive CLI, so we prioritize small, well-tested changes.
+
+## Build
+There is a faceid tag, for people contributing to ```faceid``` feature. It takes quite a while to setup, since it requires OpenCV and GoCV; and would certainly be a time-waster for people contributing to not faceid realted features.
+
+```bash
+# Standard build
+go build -o pm.exe
+
+# Face ID build (requires native OpenCV + dlib)
+go build -tags faceid -o pm.exe
+```
+
+Face ID is behind a build tag because it depends on native OpenCV/dlib libraries that are not required for the core CLI.
+
+## AI-Generated Code
+While contributing to APM, I would strongly advise writing code by yourself and using AI to refactor it. However, AI written code is also NOT discouraged, but it will take longer than usual to review the AI generated code.
diff --git a/docs/contributing.md b/docs/contributing.md
@@ -0,0 +1,25 @@
+# Contributing
+
+Thanks for contributing to APM. This page covers the fastest path to a clean build and a smooth review.
+
+## Build
+
+```bash
+# Standard build
+go build -o pm.exe
+
+# Face ID build (requires native OpenCV + dlib)
+go build -tags faceid -o pm.exe
+```
+
+Face ID is behind a build tag because it depends on native OpenCV/dlib libraries that are not required for the core CLI.
+
+## Pull Requests
+
+- Keep changes focused and scoped.
+- Include a short description of what changed and why.
+- Mention any manual test steps you ran.
+
+## AI-Generated Code
+
+AI-generated changes take longer to review. If possible, write the code yourself and use AI only as a collaborator or reviewer while building APM.
diff --git a/docs/getting-started/features.md b/docs/getting-started/features.md
@@ -186,6 +186,33 @@ A Windows-only autofill daemon that works **system-wide without a browser extens
 
 ---
 
+## :material-face-recognition: Face ID Unlock (Optional)
+
+Face ID provides biometric unlock using local face recognition. It is **optional** and only available when APM is built with the `faceid` build tag because it depends on native OpenCV and dlib libraries.
+
+```bash
+# Standard build (no Face ID)
+go build -o pm.exe
+
+# Face ID build
+go build -tags faceid -o pm.exe
+```
+
+Once built with `faceid`:
+
+```bash
+pm faceid enroll
+pm faceid status
+pm faceid test
+pm faceid remove
+```
+
+Notes:
+- Models are downloaded automatically to your user config directory under `apm/faceid/models`.
+- Enrollment metadata is stored next to the vault at `faceid/enrollment.json`.
+
+---
+
 ## :material-shield-check: Health, Trust & Audit
 
 ### Vault Health Dashboard
@@ -280,4 +307,4 @@ For organizations, the **Team Edition** (`pm-team`) adds:
 
 - **[Vault Management Guide](../guides/vault-management.md)** — Deep dive into day-to-day usage
 - **[CLI Reference](../reference/cli.md)** — Every command documented
-- **[Architecture](../concepts/architecture.md)** — How it all fits together
+- **[Architecture](../concepts/architecture.md)** — How it all fits together
diff --git a/docs/guides/faceid.md b/docs/guides/faceid.md
@@ -0,0 +1,32 @@
+# Face ID (Optional)
+
+Face ID enables biometric unlock using local face recognition. It is **optional** and only available when APM is built with the `faceid` build tag because it depends on native OpenCV and dlib libraries.
+
+## Build
+
+```bash
+# Standard build (no Face ID)
+go build -o pm.exe
+
+# Face ID build
+go build -tags faceid -o pm.exe
+```
+
+## Commands
+
+```bash
+pm faceid enroll
+pm faceid status
+pm faceid test
+pm faceid remove
+```
+
+## Storage
+
+- **Models** are downloaded automatically to your user config directory under `apm/faceid/models`.
+- **Enrollment** metadata is stored next to the vault at `faceid/enrollment.json`.
+
+## Notes
+
+- Face ID uses the default camera (index `0`).
+- If Face ID fails, you can always unlock with your master password.
diff --git a/docs/index.md b/docs/index.md
@@ -11,6 +11,7 @@
 - **Multi-Cloud Sync** — Native support for Google Drive, GitHub, and Dropbox. Your vault is uploaded as an encrypted blob; providers never see plaintext.
 - **AI-Agent Integration** — Built-in MCP (Model Context Protocol) server lets AI assistants like Claude, Cursor, and Windsurf read and manage vault entries with permission-scoped, token-based access.
 - **Windows Autofill** — A local daemon that detects credential forms and injects keystrokes via hotkey — no browser extension required.
+- **Face ID Unlock (Optional)** — Biometric unlock powered by local face recognition. Available when built with the `faceid` build tag.
 - **Plugin Ecosystem** — Manifest-based plugins with 100+ granular permissions, a marketplace, and hook-based lifecycle integration.
 - **Team Edition** — Multi-user credential sharing with RBAC, departments, and approval workflows.
 

diff --git a/go.mod b/go.mod
@@ -1,6 +1,6 @@
 module github.com/aaravmaloo/apm
 
-go 1.25
+go 1.25.0
 
 require (
 	github.com/AlecAivazis/survey/v2 v2.3.7
@@ -15,23 +15,25 @@ require (
 	github.com/hnakamur/w32uiautomation v0.0.0-20210808143226-23a1f2281c99
 	github.com/modelcontextprotocol/go-sdk v1.2.0
 	github.com/spf13/cobra v1.10.2
-	golang.org/x/crypto v0.47.0
-	golang.org/x/term v0.39.0
+	golang.org/x/crypto v0.48.0
+	golang.org/x/term v0.40.0
 	gopkg.in/gomail.v2 v2.0.0-20160411212932-81ebce5c23df
 	gopkg.in/yaml.v3 v3.0.1
 )
 
 require (
+	github.com/Kagami/go-face v0.0.0-20210630145111-0c14797b4d0e
 	github.com/fatih/color v1.18.0
 	github.com/fsnotify/fsnotify v1.9.0
 	github.com/pquerna/otp v1.5.0
-	golang.org/x/oauth2 v0.34.0
-	golang.org/x/sys v0.40.0
-	google.golang.org/api v0.263.0
+	gocv.io/x/gocv v0.43.0
+	golang.org/x/oauth2 v0.36.0
+	golang.org/x/sys v0.41.0
+	google.golang.org/api v0.271.0
 )
 
 require (
-	cloud.google.com/go/auth v0.18.1 // indirect
+	cloud.google.com/go/auth v0.18.2 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
 	cloud.google.com/go/compute/metadata v0.9.0 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
@@ -57,8 +59,8 @@ require (
 	github.com/google/jsonschema-go v0.3.0 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.3.11 // indirect
-	github.com/googleapis/gax-go/v2 v2.16.0 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.14 // indirect
+	github.com/googleapis/gax-go/v2 v2.17.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
 	github.com/lucasb-eyer/go-colorful v1.3.0 // indirect
@@ -81,10 +83,10 @@ require (
 	go.opentelemetry.io/otel v1.39.0 // indirect
 	go.opentelemetry.io/otel/metric v1.39.0 // indirect
 	go.opentelemetry.io/otel/trace v1.39.0 // indirect
-	golang.org/x/net v0.49.0 // indirect
-	golang.org/x/text v0.33.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 // indirect
-	google.golang.org/grpc v1.78.0 // indirect
+	golang.org/x/net v0.51.0 // indirect
+	golang.org/x/text v0.34.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 // indirect
+	google.golang.org/grpc v1.79.2 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc // indirect
 )