From b85968c5fb7fdbe2bfce5de18f208199b7eb90c9 Mon Sep 17 00:00:00 2001
From: ZeekA McZeekA <148893598+TheZeekA@users.noreply.github.com>
Date: Thu, 24 Sep 2026 05:30:35 +1200
Subject: [PATCH 1/3] Fix decryption cleanup, RS repair and keyfile header MAC;
 bump to v1.52

Security:
- Derive the header-MAC subkey after the keyfile key is mixed in. For
  keyfile-only volumes it depended only on argon2id("", salt), so the
  header could be forged; since the data MAC doesn't cover the nonce,
  a forged nonce decrypted "successfully" to garbage. Breaking change
  for keyfile volumes from v1.50/1.51, which are recognized (never
  accepted) and pointed at v1.51. Password-only volumes are unaffected.
- broken() deleted outputFile instead of outputFile.incomplete, leaving
  unauthenticated plaintext behind and deleting a file the user chose
  to overwrite.
- Failed/cancelled deniable decrypts left the unwrapped .tmp (which has
  a readable header) next to the volume. Temp inputs are now tracked
  and removed by removeTempInput(), which only deletes files work()
  created and refuses to clobber an existing *.tmp.

Fixes:
- RS repair pass re-ran recombine/unwrap: crashed on deniable volumes,
  always failed on split ones. work(prepared bool) skips preparation.
- Crashes on an invalid PKCS#7 byte, a <136-byte RS tail, a too-short
  deniable file, and a deniable keyfile volume opened without keyfiles.
- Split cleanup used the wrong chunk names and globbed with
  metacharacter-unsafe paths.
- Enter could start a second work() mid-operation; the update modal
  and applyUpdate could exit mid-operation.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 Changelog.md               |  15 ++
 Internals.md               |   4 +-
 VERSION                    |   2 +-
 dist/windows/installer.wxs |   2 +-
 src/ZeeCrypt.go            | 310 ++++++++++++++++++++++++-------------
 src/winres/winres.json     |   6 +-
 6 files changed, 222 insertions(+), 117 deletions(-)

diff --git a/Changelog.md b/Changelog.md
index 983591b..1746ffd 100644
--- a/Changelog.md
+++ b/Changelog.md
@@ -1,5 +1,20 @@
 > History prior to the ZeeCrypt fork belongs to the original [Picocrypt](https://github.com/Picocrypt/Picocrypt) project. New entries for ZeeCrypt will be added above this note going forward.
 
+# v1.52 (Unreleased)
+<ul>
+	<li>✓ Security: the header HMAC subkey is now derived after the keyfile key is mixed in. Previously a keyfile-only volume's header HMAC depended only on an empty password, so anyone could tamper with its header and recompute a valid HMAC. Because the data MAC doesn't cover the nonce, a tampered nonce then decrypted "successfully" to garbage. This is a breaking change for keyfile volumes only: decrypt keyfile volumes made with v1.50/v1.51 using v1.51, then re-encrypt. Password-only volumes are unaffected.</li>
+	<li>✓ Security: a failed decryption (damaged or modified data) now deletes the partially decrypted <code>.incomplete</code> file. Previously it was left on disk with unauthenticated plaintext, and the file chosen for overwriting was deleted instead.</li>
+	<li>✓ Security: a failed or cancelled decryption of a deniable volume no longer leaves the unwrapped <code>.tmp</code> file (which has a readable header) next to the volume.</li>
+	<li>✓ Fixed: the Reed-Solomon repair pass crashed on deniable volumes and always failed on split volumes. It now reuses the already recombined/unwrapped input.</li>
+	<li>✓ Fixed: crashes when decrypting a Reed-Solomon volume with a corrupted final padding byte or a truncated/appended tail, and when a file too short to be a volume is treated as deniable.</li>
+	<li>✓ Fixed: cancelling or running out of space while splitting now removes the partial <code>.incomplete</code> chunks.</li>
+	<li>✓ Fixed: the update prompt no longer opens over a running operation, and "Update Now" can't exit while one is in progress.</li>
+	<li>✓ Fixed: decrypting a deniable volume that needs keyfiles without selecting any shows a message instead of crashing.</li>
+	<li>✓ Fixed: pressing Enter during an operation could start a second one on the same files at the same time.</li>
+	<li>✓ Fixed: an existing file with the name of a temporary file (<code>*.tmp</code>) is no longer overwritten or deleted; you're asked to remove it instead. Cleanup only ever deletes files the app created itself.</li>
+	<li>✓ Fixed: splitting a file whose name contains <code>[</code>, <code>*</code> or <code>?</code> deleted the volume and left its chunks unusable.</li>
+</ul>
+
 # v1.51 (Released 08/02/2026)
 <ul>
 	<li>✓ Added Explorer right-click integration: a single "Open with ZeeCrypt" entry for files and folders. The app already auto-detects encrypt vs. decrypt from what's opened, so there's no separate Encrypt/Decrypt entry to guess wrong. Multi-select launches one instance with every selected path passed along.</li>
diff --git a/Internals.md b/Internals.md
index dd345b8..72690c4 100644
--- a/Internals.md
+++ b/Internals.md
@@ -29,13 +29,15 @@ A ZeeCrypt volume's header is encoded with Reed-Solomon by default since it is,
 | 93+3C  | 96           | 32           | Salt for HKDF-SHA3
 | 189+3C | 48           | 16           | IV for Serpent
 | 237+3C | 72           | 24           | Nonce for XChaCha20
-| 309+3C | 192          | 64           | HMAC-SHA3-512 of the header (flags, salts, IVs), keyed by a subkey derived from the password
+| 309+3C | 192          | 64           | HMAC-SHA3-512 of the header (flags, salts, IVs), keyed by a subkey derived from the password and keyfiles
 | 501+3C | 96           | 32           | SHA3-256 of keyfile key
 | 597+3C | 192          | 64           | Authentication tag (BLAKE2b/HMAC-SHA3)
 | 789+3C |              |              | Encrypted contents of input data
 
 As of v1.50, this header HMAC replaces a bare SHA3-512 hash of the encryption key. Verifying it before any data is processed both detects an incorrect password and detects tampering with the header's decryption parameters (flags, salts, IVs) — closing findings PCC-001 and PCC-006 from the original Picocrypt security audit (Radically Open Security, September 2024). The comment field is deliberately excluded from this HMAC (see the in-app tooltip: comments are neither encrypted nor tamper-protected). This is a breaking format change — ZeeCrypt v1.50 cannot open volumes created by Picocrypt or by ZeeCrypt versions prior to 1.50.
 
+As of v1.52, the header HMAC subkey is derived (HKDF-SHA3, info `zeecrypt-header-mac`) from the final encryption key, i.e. after the Argon2 output has been XORed with the keyfile key. In v1.50–1.51 it was derived before that XOR, so for a keyfile-only volume (empty password) the subkey depended only on `argon2id("", salt)` — computable from the header alone — and anyone could rewrite the header parameters and recompute a valid HMAC. Because the data MAC authenticates the ciphertext but not the nonce/IV, a rewritten nonce then decrypted "successfully" to garbage. This is another breaking change, but only for volumes that use keyfiles: keyfile volumes made with v1.50 or v1.51 must be decrypted with v1.51 and re-encrypted. Password-only volumes are unaffected.
+
 # Keyfile Design
 ZeeCrypt allows the use of keyfiles as an additional form of authentication. ZeeCrypt's unique "Require correct order" feature enforces the user to drop keyfiles into the window in the same order as they did when encrypting in order to decrypt the volume successfully. Here's how it works:
 
diff --git a/VERSION b/VERSION
index 08369aa..d96ae40 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.51
+1.52
diff --git a/dist/windows/installer.wxs b/dist/windows/installer.wxs
index 90edaae..6785311 100644
--- a/dist/windows/installer.wxs
+++ b/dist/windows/installer.wxs
@@ -9,7 +9,7 @@
   before running this in a shell:
     dotnet tool install ‑‑global wix ‑‑version 5.0.2
     wix extension add WixToolset.UI.wixext/5.0.2
-    wix build dist/windows/installer.wxs -arch x64 -ext WixToolset.UI.wixext -d ExePath=src/ZeeCrypt.exe -d IconPath=images/lock.ico -d LicenseRtfPath=dist/windows/License.rtf -d ProductVersion=1.51.0.0 -o ZeeCrypt-Installer.msi
+    wix build dist/windows/installer.wxs -arch x64 -ext WixToolset.UI.wixext -d ExePath=src/ZeeCrypt.exe -d IconPath=images/lock.ico -d LicenseRtfPath=dist/windows/License.rtf -d ProductVersion=1.52.0.0 -o ZeeCrypt-Installer.msi
 
   Pinned to WiX v5: v7 introduced a mandatory "Open Source Maintenance Fee"
   EULA that must be accepted before the tool will run at all. Don't bump
diff --git a/src/ZeeCrypt.go b/src/ZeeCrypt.go
index 1d17f08..24af0b1 100644
--- a/src/ZeeCrypt.go
+++ b/src/ZeeCrypt.go
@@ -2,7 +2,7 @@ package main
 
 /*
 
-ZeeCrypt v1.51 (fork of Picocrypt by Evan Su)
+ZeeCrypt v1.52 (fork of Picocrypt by Evan Su)
 Copyright (c) Evan Su
 Released under GPL-3.0-only
 https://github.com/TheZeekA/ZeeCrypt
@@ -66,7 +66,7 @@ var TRANSPARENT = color.RGBA{0x00, 0x00, 0x00, 0x00}
 
 // Generic variables
 var window *giu.MasterWindow
-var version = "v1.51"
+var version = "v1.52"
 var dpi float32
 var mode string
 var working bool
@@ -168,6 +168,12 @@ var rs64, rsErr6 = infectious.NewFEC(64, 192)
 var rs128, rsErr7 = infectious.NewFEC(128, 136)
 var fastDecode bool
 
+// Temporary files created by work(), so failure paths only ever delete
+// files that work() itself made (see removeTempInput)
+var tempZipFile string    // zip of the selected items, when encrypting
+var recombinedFile string // split volume recombined into one file
+var unwrappedFile string  // deniable volume with the deniability layer removed
+
 // Compression variables and passthrough
 var compressDone int64
 var compressTotal int64
@@ -223,6 +229,12 @@ func (ezr *encryptedZipReader) Read(data []byte) (n int, err error) {
 }
 
 func onClickStartButton() {
+	// Enter calls this even while a modal is open; never start a second
+	// operation, or one that a pending self-update would kill
+	if working || showProgress || showOverwrite || updateApplying {
+		return
+	}
+
 	// Start button should be disabled if these conditions are true; don't do anything if so
 	if (len(keyfiles) == 0 && password == "") || (mode == "encrypt" && password != cpassword) {
 		return
@@ -271,7 +283,7 @@ func onClickStartButton() {
 		giu.Update()
 		if !recursively {
 			go func() {
-				work()
+				work(false)
 				working = false
 				showProgress = false
 				giu.Update()
@@ -314,8 +326,9 @@ func onClickStartButton() {
 					splitSize = oldSplitSize
 					splitSelected = oldSplitSelected
 					delete = oldDelete
+					fastDecode = true // a repair pass on the previous file clears it
 
-					work()
+					work(false)
 					if !working {
 						resetUI()
 						cancel(nil, nil)
@@ -432,7 +445,7 @@ func draw() {
 							modalId++
 							giu.Update()
 							go func() {
-								work()
+								work(false)
 								working = false
 								showProgress = false
 								giu.Update()
@@ -1261,7 +1274,9 @@ func onDrop(names []string) {
 	}()
 }
 
-func work() {
+// 'prepared' is true on the Reed-Solomon repair pass, where 'inputFile' is
+// already the recombined and/or unwrapped volume from the first pass
+func work(prepared bool) {
 	popupStatus = "Starting..."
 	mainStatus = "Working..."
 	mainStatusColor = NEUTRAL
@@ -1269,6 +1284,10 @@ func work() {
 	padded := false
 	giu.Update()
 
+	if !prepared {
+		tempZipFile, recombinedFile, unwrappedFile = "", "", ""
+	}
+
 	// Cryptography values
 	var salt []byte                    // Argon2 salt, 16 bytes
 	var hkdfSalt []byte                // HKDF-SHA3 salt, 32 bytes
@@ -1323,11 +1342,17 @@ func work() {
 
 		// Open a temporary .zip for writing
 		inputFile = strings.TrimSuffix(outputFile, ".pcv") + ".tmp"
+		if _, err := os.Stat(inputFile); err == nil {
+			mainStatus = "Please remove " + filepath.Base(inputFile)
+			mainStatusColor = RED
+			return
+		}
 		file, err := os.Create(inputFile)
 		if err != nil { // Make sure file is writable
 			accessDenied("Write")
 			return
 		}
+		tempZipFile = inputFile
 
 		// Add each file to the .zip
 		tempZip := encryptedZipWriter{
@@ -1422,7 +1447,7 @@ func work() {
 	}
 
 	// Recombine a split file if necessary
-	if recombine {
+	if recombine && !prepared {
 		totalFiles := 0
 		totalBytes := int64(0)
 		done := 0
@@ -1501,12 +1526,13 @@ func work() {
 		if err := fout.Close(); err != nil {
 			panic(err)
 		}
+		recombinedFile = outputFile + ".pcv"
 		inputFileOld = inputFile
 		inputFile = outputFile + ".pcv"
 	}
 
 	// Input volume has plausible deniability
-	if mode == "decrypt" && deniability {
+	if mode == "decrypt" && deniability && !prepared {
 		popupStatus = "Removing deniability protection..."
 		progressInfo = ""
 		progress = 0
@@ -1531,19 +1557,30 @@ func work() {
 			inputFile = strings.TrimSuffix(inputFile, ".tmp")
 		}
 		inputFile += ".tmp"
+		if _, err := os.Stat(inputFile); err == nil {
+			fin.Close()
+			mainStatus = "Please remove " + filepath.Base(inputFile)
+			mainStatusColor = RED
+			inputFile = strings.TrimSuffix(inputFile, ".tmp")
+			removeTempInput()
+			return
+		}
 		fout, err := os.Create(inputFile)
 		if err != nil {
 			panic(err)
 		}
+		unwrappedFile = inputFile
 
 		// Get the Argon2 salt and XChaCha20 nonce from input volume
 		salt := make([]byte, 16)
 		nonce := make([]byte, 24)
 		if n, err := fin.Read(salt); err != nil || n != 16 {
-			panic(errors.New("failed to read 16 bytes from file"))
+			broken(fin, fout, "The file is too short to be a volume", true)
+			return
 		}
 		if n, err := fin.Read(nonce); err != nil || n != 24 {
-			panic(errors.New("failed to read 24 bytes from file"))
+			broken(fin, fout, "The file is too short to be a volume", true)
+			return
 		}
 
 		// Generate key and XChaCha20
@@ -1565,9 +1602,9 @@ func work() {
 			dst := make([]byte, len(src))
 			chacha.XORKeyStream(dst, src)
 			if n, err := fout.Write(dst); err != nil || n != len(dst) {
-				fout.Close()
-				os.Remove(fout.Name())
-				panic(errors.New("failed to write dst"))
+				insufficientSpace(fin, fout)
+				removeTempInput()
+				return
 			}
 
 			// Update stats
@@ -1605,19 +1642,15 @@ func work() {
 		}
 		tmp := make([]byte, 15)
 		if n, err := fin.Read(tmp); err != nil || n != 15 {
-			panic(errors.New("failed to read 15 bytes from file"))
+			broken(fin, nil, "Password is incorrect or the file is not a volume", true)
+			return
 		}
 		if err := fin.Close(); err != nil {
 			panic(err)
 		}
 		tmp, err = rsDecode(rs5, tmp)
 		if valid, _ := regexp.Match(`^v1\.\d{2}`, tmp); err != nil || !valid {
-			os.Remove(inputFile)
-			inputFile = strings.TrimSuffix(inputFile, ".tmp")
 			broken(nil, nil, "Password is incorrect or the file is not a volume", true)
-			if recombine {
-				inputFile = inputFileOld
-			}
 			return
 		}
 	}
@@ -1630,6 +1663,7 @@ func work() {
 	// Subtract the header size from the total size if decrypting
 	stat, err := os.Stat(inputFile)
 	if err != nil {
+		removeTempInput()
 		resetUI()
 		accessDenied("Read")
 		return
@@ -1642,6 +1676,7 @@ func work() {
 	// Open input file in read-only mode
 	fin, err := os.Open(inputFile)
 	if err != nil {
+		removeTempInput()
 		resetUI()
 		accessDenied("Read")
 		return
@@ -1662,9 +1697,7 @@ func work() {
 		_, err = os.Stat(outputFile)
 		if split && err == nil { // File already exists
 			fin.Close()
-			if len(allFiles) > 1 || len(onlyFolders) > 0 || compress {
-				os.Remove(inputFile)
-			}
+			removeTempInput()
 			mainStatus = "Please remove " + filepath.Base(outputFile)
 			mainStatusColor = RED
 			return
@@ -1674,9 +1707,7 @@ func work() {
 		fout, err = os.Create(outputFile + ".incomplete")
 		if err != nil {
 			fin.Close()
-			if len(allFiles) > 1 || len(onlyFolders) > 0 || compress {
-				os.Remove(inputFile)
-			}
+			removeTempInput()
 			accessDenied("Write")
 			return
 		}
@@ -1693,9 +1724,7 @@ func work() {
 		if len(comments) > 99999 {
 			fin.Close()
 			fout.Close()
-			if len(allFiles) > 1 || len(onlyFolders) > 0 || compress {
-				os.Remove(inputFile)
-			}
+			removeTempInput()
 			os.Remove(fout.Name())
 			mainStatus = "Comment exceeds the maximum length of 99,999 characters"
 			mainStatusColor = RED
@@ -1773,9 +1802,7 @@ func work() {
 		for _, err := range errs {
 			if err != nil {
 				insufficientSpace(fin, fout)
-				if len(allFiles) > 1 || len(onlyFolders) > 0 || compress {
-					os.Remove(inputFile)
-				}
+				removeTempInput()
 				os.Remove(fout.Name())
 				return
 			}
@@ -1856,6 +1883,12 @@ func work() {
 		}
 	}
 
+	// A deniable volume only reveals that it needs keyfiles once unwrapped
+	if mode == "decrypt" && keyfile && len(keyfiles) == 0 {
+		broken(fin, nil, "This volume requires keyfiles, please select them", true)
+		return
+	}
+
 	popupStatus = "Deriving key..."
 	giu.Update()
 
@@ -1990,25 +2023,41 @@ func work() {
 	popupStatus = "Calculating values..."
 	giu.Update()
 
+	var passwordKey []byte // pre-keyfile key, only to recognize v1.50/1.51 volumes
+	if len(keyfiles) > 0 || keyfile {
+		// Prevent an even number of duplicate keyfiles
+		if bytes.Equal(keyfileKey, make([]byte, 32)) {
+			mainStatus = "Duplicate keyfiles detected"
+			mainStatusColor = RED
+			fin.Close()
+			removeTempInput()
+			if fout != nil {
+				fout.Close()
+				os.Remove(fout.Name())
+			}
+			return
+		}
+
+		// XOR the encryption key with the keyfile key
+		tmp := key
+		passwordKey = tmp
+		key = make([]byte, 32)
+		for i := range key {
+			key[i] = tmp[i] ^ keyfileKey[i]
+		}
+	}
+
 	// Authenticate the header's decryption parameters (flags, salts, IVs) with
 	// an HMAC keyed by a subkey independent from the data-encryption and
 	// data-MAC keys. A successful comparison proves both a correct password
-	// and an untampered header, replacing the old bare hash of the key.
+	// and keyfiles, and an untampered header, replacing the old bare hash of
+	// the key. The subkey is derived after the keyfile key is mixed in (v1.52):
+	// otherwise a keyfile-only volume's header MAC would depend only on an
+	// empty password, letting anyone forge it.
 	// The comment field is intentionally excluded (see the UI tooltip warning
 	// that comments aren't tamper-protected): it isn't re-derived from disk
 	// during decryption, so including it here could cause spurious failures.
-	headerSubkey := make([]byte, 32)
-	headerHKDF := hkdf.New(sha3.New256, key, hkdfSalt, []byte("zeecrypt-header-mac"))
-	if n, err := headerHKDF.Read(headerSubkey); err != nil || n != 32 {
-		panic(errors.New("fatal hkdf.Read error"))
-	}
-	headerMACFunc := hmac.New(sha3.New512, headerSubkey)
-	for _, part := range [][]byte{flags, salt, hkdfSalt, serpentIV, nonce} {
-		if _, err := headerMACFunc.Write(part); err != nil {
-			panic(err)
-		}
-	}
-	headerMAC = headerMACFunc.Sum(nil)
+	headerMAC = computeHeaderMAC(key, hkdfSalt, flags, salt, hkdfSalt, serpentIV, nonce)
 
 	// Validate the password and/or keyfiles
 	if mode == "decrypt" {
@@ -2024,24 +2073,23 @@ func work() {
 			if keep {
 				kept = true
 			} else {
-				if !keyCorrect {
-					mainStatus = "The provided password is incorrect, or the file has been tampered with"
-				} else {
+				// Wrong keyfiles also fail the header MAC, so check them first
+				if (keyfile || len(keyfiles) > 0) && !keyfileCorrect {
 					if keyfileOrdered {
 						mainStatus = "Incorrect keyfiles or ordering"
 					} else {
 						mainStatus = "Incorrect keyfiles"
 					}
-					if deniability {
-						fin.Close()
-						os.Remove(inputFile)
-						inputFile = strings.TrimSuffix(inputFile, ".tmp")
-					}
+				} else if passwordKey != nil && subtle.ConstantTimeCompare(headerMACRef,
+					computeHeaderMAC(passwordKey, hkdfSalt, flags, salt, hkdfSalt, serpentIV, nonce)) == 1 {
+					// v1.52 changed the header MAC for keyfile volumes. The old
+					// MAC is only recognized for this message, never accepted:
+					// without a password anyone can forge it.
+					mainStatus = "This keyfile volume is from v1.50/1.51, use ZeeCrypt v1.51 to decrypt it"
+				} else {
+					mainStatus = "The provided password is incorrect, or the file has been tampered with"
 				}
 				broken(fin, nil, mainStatus, true)
-				if recombine {
-					inputFile = inputFileOld
-				}
 				return
 			}
 		}
@@ -2050,36 +2098,12 @@ func work() {
 		fout, err = os.Create(outputFile + ".incomplete")
 		if err != nil {
 			fin.Close()
-			if recombine {
-				os.Remove(inputFile)
-			}
+			removeTempInput()
 			accessDenied("Write")
 			return
 		}
 	}
 
-	if len(keyfiles) > 0 || keyfile {
-		// Prevent an even number of duplicate keyfiles
-		if bytes.Equal(keyfileKey, make([]byte, 32)) {
-			mainStatus = "Duplicate keyfiles detected"
-			mainStatusColor = RED
-			fin.Close()
-			if len(allFiles) > 1 || len(onlyFolders) > 0 || compress {
-				os.Remove(inputFile)
-			}
-			fout.Close()
-			os.Remove(fout.Name())
-			return
-		}
-
-		// XOR the encryption key with the keyfile key
-		tmp := key
-		key = make([]byte, 32)
-		for i := range key {
-			key[i] = tmp[i] ^ keyfileKey[i]
-		}
-	}
-
 	done, counter := 0, 0
 	chacha, err := chacha20.NewUnauthenticatedCipher(key, nonce)
 	if err != nil {
@@ -2123,9 +2147,7 @@ func work() {
 	for {
 		if !working {
 			cancel(fin, fout)
-			if recombine || len(allFiles) > 1 || len(onlyFolders) > 0 || compress {
-				os.Remove(inputFile)
-			}
+			removeTempInput()
 			os.Remove(fout.Name())
 			return
 		}
@@ -2211,6 +2233,15 @@ func work() {
 							giu.Update()
 						}
 					}
+				} else if len(dst) < 136 {
+					// A trailing fragment smaller than one encoded chunk can only
+					// come from a truncated or appended-to file
+					if keep {
+						kept = true
+					} else {
+						broken(fin, fout, "The input file is irrecoverably damaged", false)
+						return
+					}
 				} else {
 					// Decode the full chunks
 					chunks := len(dst)/136 - 1
@@ -2264,9 +2295,7 @@ func work() {
 		_, err = fout.Write(dst)
 		if err != nil {
 			insufficientSpace(fin, fout)
-			if recombine || len(allFiles) > 1 || len(onlyFolders) > 0 || compress {
-				os.Remove(inputFile)
-			}
+			removeTempInput()
 			os.Remove(fout.Name())
 			return
 		}
@@ -2345,7 +2374,8 @@ func work() {
 				fastDecode = false
 				fin.Close()
 				fout.Close()
-				work()
+				os.Remove(fout.Name()) // unverified fast-pass output
+				work(true)
 				return
 			}
 
@@ -2528,7 +2558,17 @@ func work() {
 		startTime := time.Now()
 		for i := range chunks {
 			// Make the chunk
-			fout, _ := os.Create(fmt.Sprintf("%s.%d.incomplete", outputFile, i))
+			fout, err := os.Create(fmt.Sprintf("%s.%d.incomplete", outputFile, i))
+			if err != nil {
+				fin.Close()
+				removeTempInput()
+				os.Remove(outputFile)
+				for _, j := range splitted { // Remove existing chunks
+					os.Remove(j)
+				}
+				accessDenied("Write")
+				return
+			}
 			done := 0
 
 			// Copy data into the chunk
@@ -2544,14 +2584,12 @@ func work() {
 				}
 				if !working {
 					cancel(fin, fout)
-					if len(allFiles) > 1 || len(onlyFolders) > 0 || compress {
-						os.Remove(inputFile)
-					}
+					removeTempInput()
 					os.Remove(outputFile)
 					for _, j := range splitted { // Remove existing chunks
 						os.Remove(j)
 					}
-					os.Remove(fmt.Sprintf("%s.%d", outputFile, i))
+					os.Remove(fmt.Sprintf("%s.%d.incomplete", outputFile, i))
 					return
 				}
 
@@ -2559,14 +2597,12 @@ func work() {
 				_, err = fout.Write(data)
 				if err != nil {
 					insufficientSpace(fin, fout)
-					if len(allFiles) > 1 || len(onlyFolders) > 0 || compress {
-						os.Remove(inputFile)
-					}
+					removeTempInput()
 					os.Remove(outputFile)
 					for _, j := range splitted { // Remove existing chunks
 						os.Remove(j)
 					}
-					os.Remove(fmt.Sprintf("%s.%d", outputFile, i))
+					os.Remove(fmt.Sprintf("%s.%d.incomplete", outputFile, i))
 					return
 				}
 				done += read
@@ -2589,7 +2625,7 @@ func work() {
 			if finishedFiles == chunks {
 				finishedFiles--
 			}
-			splitted = append(splitted, fmt.Sprintf("%s.%d", outputFile, i))
+			splitted = append(splitted, fmt.Sprintf("%s.%d.incomplete", outputFile, i))
 			progressInfo = fmt.Sprintf("%d/%d", finishedFiles+1, chunks)
 			giu.Update()
 		}
@@ -2600,11 +2636,7 @@ func work() {
 		if err := os.Remove(outputFile); err != nil {
 			panic(err)
 		}
-		names, err = filepath.Glob(outputFile + ".*.incomplete")
-		if err != nil {
-			panic(err)
-		}
-		for _, i := range names {
+		for _, i := range splitted {
 			if err := os.Rename(i, strings.TrimSuffix(i, ".incomplete")); err != nil {
 				panic(err)
 			}
@@ -2724,12 +2756,33 @@ func broken(fin *os.File, fout *os.File, message string, keepOutput bool) {
 	mainStatus = message
 	mainStatusColor = RED
 
-	// Clean up files since decryption failed
-	if recombine {
-		os.Remove(inputFile)
-	}
+	// Clean up files since decryption failed. The output is only ever
+	// written to the ".incomplete" file; 'outputFile' itself may be an
+	// existing file the user chose to overwrite, so it's left alone.
+	removeTempInput()
 	if !keepOutput {
-		os.Remove(outputFile)
+		os.Remove(outputFile + ".incomplete")
+	}
+}
+
+// Remove the temporary input that work() prepared: the zip of the selected
+// items when encrypting, or the recombined and/or unwrapped deniable volume
+// when decrypting. 'inputFile' is restored to what the user selected so the
+// operation can be retried (e.g. with the correct password).
+func removeTempInput() {
+	if tempZipFile != "" {
+		os.Remove(tempZipFile)
+		tempZipFile = ""
+	}
+	if unwrappedFile != "" {
+		os.Remove(unwrappedFile)
+		unwrappedFile = ""
+		inputFile = strings.TrimSuffix(inputFile, ".tmp")
+	}
+	if recombinedFile != "" {
+		os.Remove(recombinedFile)
+		recombinedFile = ""
+		inputFile = inputFileOld
 	}
 }
 
@@ -2801,6 +2854,23 @@ func resetUI() {
 	giu.Update()
 }
 
+// HMAC-SHA3-512 over the header's decryption parameters, keyed by an HKDF-SHA3
+// subkey of 'key' that's independent from the data-encryption and MAC keys
+func computeHeaderMAC(key []byte, hkdfSalt []byte, parts ...[]byte) []byte {
+	subkey := make([]byte, 32)
+	r := hkdf.New(sha3.New256, key, hkdfSalt, []byte("zeecrypt-header-mac"))
+	if n, err := r.Read(subkey); err != nil || n != 32 {
+		panic(errors.New("fatal hkdf.Read error"))
+	}
+	mac := hmac.New(sha3.New512, subkey)
+	for _, part := range parts {
+		if _, err := mac.Write(part); err != nil {
+			panic(err)
+		}
+	}
+	return mac.Sum(nil)
+}
+
 // Reed-Solomon encoder
 func rsEncode(rs *infectious.FEC, data []byte) []byte {
 	res := make([]byte, rs.Total())
@@ -2843,9 +2913,13 @@ func pad(data []byte) []byte {
 	return append(data, padding...)
 }
 
-// PKCS#7 unpad
+// PKCS#7 unpad; invalid padding (a corrupted final byte) is left in place
+// so the MAC check fails and triggers repair instead of crashing here
 func unpad(data []byte) []byte {
 	padLen := int(data[127])
+	if padLen < 1 || padLen > 128 {
+		return data
+	}
 	return data[:128-padLen]
 }
 
@@ -3196,8 +3270,14 @@ func checkForUpdates() {
 		updateDownloadURL = downloadURL
 		updateChecksum = m[1]
 		updateAvailable = true
-		showUpdate = true
-		modalId++
+
+		// Don't open over the progress (or any other) modal: that would
+		// allow "Update Now" to exit mid-operation. The version label now
+		// reads "Update available" and can be clicked once things are idle.
+		if !working && !showProgress && !showOverwrite && !showKeyfile && !showPassgen {
+			showUpdate = true
+			modalId++
+		}
 	}()
 }
 
@@ -3207,7 +3287,8 @@ func checkForUpdates() {
 // current exe is renamed aside, the verified new one takes its place, and a
 // new process is spawned before this one exits.
 func applyUpdate() {
-	if updateApplying {
+	// Never swap the exe and exit while an operation is running
+	if updateApplying || working || showProgress {
 		return
 	}
 	updateApplying = true
@@ -3262,6 +3343,13 @@ func applyUpdate() {
 			return
 		}
 
+		// An operation may have started during the download
+		if working || showProgress {
+			os.Remove(tmpPath)
+			updateError = "Finish the current operation, then update again"
+			return
+		}
+
 		currentExe, err := os.Executable()
 		if err != nil {
 			os.Remove(tmpPath)
diff --git a/src/winres/winres.json b/src/winres/winres.json
index d06ebb2..4a569b5 100644
--- a/src/winres/winres.json
+++ b/src/winres/winres.json
@@ -16,13 +16,13 @@
     "#1": {
       "0000": {
         "fixed": {
-          "file_version": "1.51.0.0",
-          "product_version": "1.51.0.0"
+          "file_version": "1.52.0.0",
+          "product_version": "1.52.0.0"
         },
         "info": {
           "0409": {
             "CompanyName": "Teddy Jones",
-            "FileVersion": "1.51",
+            "FileVersion": "1.52",
             "LegalCopyright": "© Evan Su & contributors, GPLv3",
             "ProductName": "ZeeCrypt"
           }

From 7d7df035b4311784359c99ed9ed27ed080cae70f Mon Sep 17 00:00:00 2001
From: ZeekA McZeekA <148893598+TheZeekA@users.noreply.github.com>
Date: Thu, 24 Sep 2026 05:30:36 +1200
Subject: [PATCH 2/3] Add headless end-to-end tests

Drive onDrop()/work() the way the UI does, without a window: round
trips across every option, tampering and corruption, RS repair on
deniable/split volumes, temp-file cleanup on failure and cancel, the
keyfile header forgery, and compatibility with v1.51 volumes checked
in under testdata/legacy-v1.51. Each bug test was confirmed to fail
against v1.51.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 src/README.md                         |   3 +
 src/forge_test.go                     |  46 +++
 src/helpers_test.go                   | 147 +++++++++
 src/testdata/legacy-v1.51/README.md   |   6 +
 src/testdata/legacy-v1.51/kf.key      |   1 +
 src/testdata/legacy-v1.51/kf.txt.pcv  | Bin 0 -> 817 bytes
 src/testdata/legacy-v1.51/pkf.txt.pcv | Bin 0 -> 817 bytes
 src/testdata/legacy-v1.51/plain.orig  |   1 +
 src/testdata/legacy-v1.51/pw.txt.pcv  | Bin 0 -> 817 bytes
 src/work_test.go                      | 437 ++++++++++++++++++++++++++
 10 files changed, 641 insertions(+)
 create mode 100644 src/forge_test.go
 create mode 100644 src/helpers_test.go
 create mode 100644 src/testdata/legacy-v1.51/README.md
 create mode 100644 src/testdata/legacy-v1.51/kf.key
 create mode 100644 src/testdata/legacy-v1.51/kf.txt.pcv
 create mode 100644 src/testdata/legacy-v1.51/pkf.txt.pcv
 create mode 100644 src/testdata/legacy-v1.51/plain.orig
 create mode 100644 src/testdata/legacy-v1.51/pw.txt.pcv
 create mode 100644 src/work_test.go

diff --git a/src/README.md b/src/README.md
index 97d9380..f150d33 100644
--- a/src/README.md
+++ b/src/README.md
@@ -19,6 +19,9 @@ Note: Make sure to set `CGO_ENABLED=1` if it isn't already. Also make sure **not
 # 5. Done!
 You should now see a compiled executable (`ZeeCrypt.exe`) in your directory, with the app icon already embedded. You can run it by double-clicking or executing it in your terminal. That wasn't too hard, right? Enjoy!
 
+# Running the tests
+<code>go test .</code> (with `CGO_ENABLED=1`) runs headless end-to-end tests that drive the same code paths as the UI: round trips across every option, tampering/corruption and Reed-Solomon repair, cleanup of temporary files on failure, and compatibility with the v1.51 volumes in `testdata/`. Each encryption or decryption runs Argon2id with 1 GiB of memory, so the suite takes about a minute and needs a few GiB of free RAM.
+
 # Updating the app icon
 The icon is embedded automatically via `rsrc_windows_386.syso`/`rsrc_windows_amd64.syso` in this directory, which `go build` links in without any extra flags. If you change `images/lock.ico`, regenerate these files:
 ```
diff --git a/src/forge_test.go b/src/forge_test.go
new file mode 100644
index 0000000..67ad918
--- /dev/null
+++ b/src/forge_test.go
@@ -0,0 +1,46 @@
+package main
+
+import (
+	"crypto/hmac"
+	"os"
+	"testing"
+
+	"golang.org/x/crypto/argon2"
+	"golang.org/x/crypto/hkdf"
+	"golang.org/x/crypto/sha3"
+)
+
+// forgeKeyfileOnlyHeader rewrites the nonce of a keyfile-only (empty password),
+// comment-less, non-paranoid volume and recomputes the header MAC the way an
+// attacker without the keyfiles could: from argon2id("", salt) alone.
+func forgeKeyfileOnlyHeader(t *testing.T, vol string) {
+	t.Helper()
+	b, err := os.ReadFile(vol)
+	if err != nil {
+		t.Fatal(err)
+	}
+	must := func(d []byte, err error) []byte {
+		if err != nil {
+			t.Fatal(err)
+		}
+		return d
+	}
+	flags := must(rsDecode(rs5, b[30:45]))
+	salt := must(rsDecode(rs16, b[45:93]))
+	hkdfSalt := must(rsDecode(rs32, b[93:189]))
+	serpentIV := must(rsDecode(rs16, b[189:237]))
+	nonce := randBytes(t, 24)
+	copy(b[237:309], rsEncode(rs24, nonce))
+
+	key := argon2.IDKey([]byte(""), salt, 4, 1<<20, 4, 32)
+	sub := make([]byte, 32)
+	if _, err := hkdf.New(sha3.New256, key, hkdfSalt, []byte("zeecrypt-header-mac")).Read(sub); err != nil {
+		t.Fatal(err)
+	}
+	m := hmac.New(sha3.New512, sub)
+	for _, p := range [][]byte{flags, salt, hkdfSalt, serpentIV, nonce} {
+		m.Write(p)
+	}
+	copy(b[309:501], rsEncode(rs64, m.Sum(nil)))
+	writeFile(t, vol, b)
+}
diff --git a/src/helpers_test.go b/src/helpers_test.go
new file mode 100644
index 0000000..d2d51be
--- /dev/null
+++ b/src/helpers_test.go
@@ -0,0 +1,147 @@
+package main
+
+// Headless test harness: drives onDrop()/work() the way the UI does, without a
+// window. Tests share the app's globals, so they must not run in parallel.
+// Each encrypt/decrypt runs Argon2id with 1 GiB of memory; the suite takes ~1 min.
+
+import (
+	"bytes"
+	"crypto/rand"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/Picocrypt/imgui-go"
+)
+
+func TestMain(m *testing.M) {
+	imgui.CreateContext(nil) // resetUI() calls imgui.ClearActiveID()
+	os.Exit(m.Run())
+}
+
+func setup() {
+	resetUI()
+	working = false
+	fastDecode = true
+	showProgress = false
+}
+
+func waitScan() {
+	for scanning {
+		time.Sleep(5 * time.Millisecond)
+	}
+}
+
+func randBytes(t *testing.T, n int) []byte {
+	b := make([]byte, n)
+	if _, err := rand.Read(b); err != nil {
+		t.Fatal(err)
+	}
+	return b
+}
+
+func writeFile(t *testing.T, path string, data []byte) {
+	if err := os.WriteFile(path, data, 0600); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// encrypt drops 'paths', applies options and runs work(). Returns the output path and status.
+func encrypt(t *testing.T, paths []string, pw string, kf []string, opt func()) (string, string) {
+	t.Helper()
+	setup()
+	onDrop(paths)
+	waitScan()
+	password, cpassword = pw, pw
+	keyfiles = kf
+	if opt != nil {
+		opt()
+	}
+	out := outputFile
+	work(false)
+	working = false
+	return out, mainStatus
+}
+
+// decrypt drops 'vol', applies options and runs work(). Returns the output path and status.
+func decrypt(t *testing.T, vol string, pw string, kf []string, opt func()) (string, string) {
+	t.Helper()
+	setup()
+	onDrop([]string{vol})
+	waitScan()
+	password = pw
+	keyfiles = kf
+	if opt != nil {
+		opt()
+	}
+	out := outputFile
+	work(false)
+	working = false
+	return out, mainStatus
+}
+
+func mustStatus(t *testing.T, got, want string) {
+	t.Helper()
+	if !strings.Contains(got, want) {
+		t.Fatalf("status = %q, want it to contain %q", got, want)
+	}
+}
+
+func mustContent(t *testing.T, path string, want []byte) {
+	t.Helper()
+	got, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("read %s: %v", path, err)
+	}
+	if !bytes.Equal(got, want) {
+		t.Fatalf("%s: content mismatch (%d vs %d bytes)", path, len(got), len(want))
+	}
+}
+
+// listDir returns the base names in dir, for asserting no leftovers.
+func listDir(t *testing.T, dir string) []string {
+	t.Helper()
+	ents, err := os.ReadDir(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var names []string
+	for _, e := range ents {
+		names = append(names, e.Name())
+	}
+	return names
+}
+
+func mustOnly(t *testing.T, dir string, want ...string) {
+	t.Helper()
+	got := listDir(t, dir)
+	set := map[string]bool{}
+	for _, w := range want {
+		set[w] = true
+	}
+	for _, g := range got {
+		if !set[g] {
+			t.Fatalf("unexpected leftover %q in %v (want only %v)", g, got, want)
+		}
+	}
+	for _, w := range want {
+		if _, err := os.Stat(filepath.Join(dir, w)); err != nil {
+			t.Fatalf("expected %q to exist; dir = %v", w, got)
+		}
+	}
+}
+
+func flipByte(t *testing.T, path string, off int64) {
+	t.Helper()
+	b, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if off < 0 {
+		off += int64(len(b))
+	}
+	b[off] ^= 0x5a
+	writeFile(t, path, b)
+}
diff --git a/src/testdata/legacy-v1.51/README.md b/src/testdata/legacy-v1.51/README.md
new file mode 100644
index 0000000..bbdd6fc
--- /dev/null
+++ b/src/testdata/legacy-v1.51/README.md
@@ -0,0 +1,6 @@
+Volumes encrypted by ZeeCrypt v1.51, used by `TestLegacyVolumes`:
+
+- `pw.txt.pcv`: password `legacy-pw`
+- `kf.txt.pcv`: keyfile `kf.key` only, no password
+- `pkf.txt.pcv`: password `legacy-pw` and keyfile `kf.key`
+- `plain.orig`: the plaintext of all three
diff --git a/src/testdata/legacy-v1.51/kf.key b/src/testdata/legacy-v1.51/kf.key
new file mode 100644
index 0000000..0617fcb
--- /dev/null
+++ b/src/testdata/legacy-v1.51/kf.key
@@ -0,0 +1 @@
+legacy keyfile contents
\ No newline at end of file
diff --git a/src/testdata/legacy-v1.51/kf.txt.pcv b/src/testdata/legacy-v1.51/kf.txt.pcv
new file mode 100644
index 0000000000000000000000000000000000000000..182f239ca4efd6087b18dbe911e272f37e8137f8
GIT binary patch
literal 817
zcmV-11J3+*F)lSRQEqFoo<g^p3@R`%FfcGMFfcGMFfcGMFaQAn004Bc|ESfhRk<`i
zEj*)oT(WzyM;NJbNu4^I&Dqn`sW2)o0Dowg{Z=X#a%B{PxL;g@1M`v@_*0ob1$~>J
z^U2}r^8tCvZn~t^HxeP2lT&%}FIhyBaZ0|W&ON;V^J-WJRK}Ldd|mMdHti-`gSDgj
zktYCJNfz8Z-=NqScjOed=a7t2nt^zSM<u)QVWLd!C0+2jlBn)4NExI?DjxD_9Ykd{
zc|Yim-E^00#v;l|%XKUIM9XX4;!lgb&zFgPn=TaJvz<S34pX7J(%`*uSzpG9CO&Ki
zW_iC5PbYO8={M$M9v8So@Y6FG32!eGK&6Je_Ppp~0JLFms+cg_&_Jo23IUsCIKUe9
z3-TkLZTEiSay5a&bd1GtI3WJQ>ui2KU<`asI5yIJBDq_)-ETNyxG(a>u|3+2rI$?|
z#?8JnoNGc!H`<NIgkN_m*r?=%tZ+QS;+uDTUAKnBwA=y>K&(RPb)~p~5fs?P9;P~t
zlnz7f7yYl=P1(n?Ep(`ddwtbeOX`vSVt>Py-M~xw5Uu(Oj8JH9jN&v<9;#xkry3bF
zMiT<}ThVxMl$H&TrPO-SF4}bg=ARile^F@L<2UY3{LlpprTKPbJ02%y2*(A5fyZH+
z1&L1*+VOqhDLa&0(Ijr*yHuEstZRGRnMfAgee||$zXqBrD}X#<WzJybn1#SbQ9YV!
zxB=<gqfwAh_^vL)TLhF1+sIrclbq4SYP~ly!%-k?T7d&YeVlGgZcWL#P*nXw8NURZ
z18_#!vII-@@1vi4(#k189o8r<xIw8b$9lo>{=~2!_BIm^nODOc>KFO4`Vz8EV|Uc3
z+T!^J7wOp2x(|J}TCJyxx&eidlyp2+45oU!Fwf=hi@s%UHT#;B?HwfMng*Dno8)58
zyP&i9ynRoCw92q8LVc=QIdG>CYS3(>fe*cq>TQsVc0vjp)kwPx*pmVK0#vTM-&~li
vV@q=P;EQYN_}DpP2AnJ=>36-~(xra6yZFhCRm?~&-%-FWw{M474I>2w4B3#7

literal 0
HcmV?d00001

diff --git a/src/testdata/legacy-v1.51/pkf.txt.pcv b/src/testdata/legacy-v1.51/pkf.txt.pcv
new file mode 100644
index 0000000000000000000000000000000000000000..a93ad7d9a3753daf96ad785aa31c40d7c4b31fd0
GIT binary patch
literal 817
zcmV-11J3+*F)lSRQEqFoo<g^p3@R`%FfcGMFfcGMFfcGMFaQAn004Bc|ESfhRk<`i
zN1VhiJ2KJ`e&0*Q%FWo?N?Tg0$xKsCGmzAz^|-LlM`o!cMMNuJDU4zeK1R(y3qhAS
z;7)b)bJQ9HC4BzKurLeIXFOZ~9fP{C*Nzf)(X{F?6_l(UR@JQGqZ&}F(8@|KADMwy
zYGe8wXzXS~mDZXLM?+1;N9ACshv#7pdf#Bq?Q{0&Esk~6Ys>Xd=}J3kEd|plf}F@=
z1QS~~EA>FNiL3t00w^oE_p`%Y3br`mn$tmbRvDe))Z5P&Wd1j%!@(-`BDZVEdh0d^
z6mY4@w=9OD9>x1w9=9JR5yQsaGymdIo;i7`EkAiC`SLDl1$JwGOJO=6gt^!)v^I!q
zxtTU)m$69P(V)4}pUpF!yN3sa`P2SWXMJQIx@N0EAUGi`+%1Kl`*5VnT_6xm$3nz5
zrU*b?*1CV;Y9bwi$tRfbQ-aH~8O_V4pLF=qpIwXy;kW>2_x(S~#^5P3KJd}&_Ps54
z?&$~GEZnW+{pxQ1BL@h*DrzkeV;uN@r<#cNKe0ldZED$f7)v?+KeL*B5;(*gpmSsN
zDFem{0ztg3O+#9woyR)cFGZAj*!$1y#A&D83B9#BBIg$;f~z*oJ02%y2*(A5fyZH+
z1&L1*+VOqhDLa&0(Ijr*yHuEstZRGRnMfAgee||$zXqBrD}X#<WzJybn1#SbQ9YV!
zxB=<gqfwAh_^vL)TLhF1+sIrclbq4SYP~ly!%-k?!DNCZr%iZE?1Go;B?G$temn5c
z)BtZhZc;E)lvze{dejF1KCNrOA121q)W?U#VuWn=2W_&Lc3#sAk;-J6!B#z$0_6=n
z!51eM?OJ1}BtaJw;!O{FL$;F+xC%d#@I>O)slf6(lDCq%=NL}E-(_#Tu2@g5z4n%=
z`psj^Pz8V1fZRrlNH{|2PYPJQOIOYCz@?RO<>t*745)`cK9Y`{XwSW29=-0&46{xA
vS?mnHe00k%6^RUn)1#||zI`5k-;-A&H0qV?>Y+EqZbs}xizQ8&nUe5Y!2Xea

literal 0
HcmV?d00001

diff --git a/src/testdata/legacy-v1.51/plain.orig b/src/testdata/legacy-v1.51/plain.orig
new file mode 100644
index 0000000..9f2bdec
--- /dev/null
+++ b/src/testdata/legacy-v1.51/plain.orig
@@ -0,0 +1 @@
+legacy plaintext from v1.51
diff --git a/src/testdata/legacy-v1.51/pw.txt.pcv b/src/testdata/legacy-v1.51/pw.txt.pcv
new file mode 100644
index 0000000000000000000000000000000000000000..47f8da11d569864c0728166c6c8a7bcf3ab2e501
GIT binary patch
literal 817
zcmXRj)H5{<%*)<5&uRNC9xVe@z<>&5jHLb6C@<81`H`)nuVLE%>fN8Lsw01}t(02h
z%BOo_7PDVm@9t@t?#G#@sm$5TSgP43xoFq@Ej)68Q;jF(w;1G|wC<U7#dKYG3Gc}z
ze`JpCI=Niom~fSU=S}&tZ<24{H86#9@8oo<pLg5s!eJfXe80cJu5WU^Ogff5_U~Qs
zHts^e$0WxeiknO~svlmzOKH}%l>+Q8`HyEfGahAlG{5TR>eHpQ{S(ACeG%!~$5GJx
zbjf*5jcoaV2lIE97PMU7wU;INSkPzXvh?fcRZrU+`hC5@qkCK;be?Q>9Al*WqC=0r
z^?f^X$z$=xl4o*}A$^O5B~7PxCh?q>;p6ALdus1_pOzgheWf*%etI8^E&2A@aB=%o
zr+ByR>Te`6)!*;nJHUN%`nCAXLdi)t=ND`bxsrP2ZOEJD&M9kD66KwaItcde6mKjF
zs^%`+$6&H#gL=}PDdA^!e~&wn>X>u<qRyTeZ>EI&n=NS;+^&~Z&%98oUzQu%bL+Fw
zo5}NQ7OiVZpLOxxwLd;5!+YDRmuG~F{j)o;^K4Kx-#eX*jyZ?kME?rx<PA>#x^JQ6
ziO+kyGG3mRt`%!|@bbMz&AB~0))_>vPgQDM9LC9*|6}tu)L5lHFQi7B`B=ry^T)m|
zV*7W1YeLq0X0~;aD<&O`5D}iVIc^X4|DBQL%~ks~SG;$5H~poUn)eZH!7o1A^+(n?
z%@f%f_sWHJ|FvzR9|KM|Zj(+giR4`>_i{-_(sD5lHXqU5Z{mJG-*~+JX-QY=^#z9x
zClt0UNSf{#HT8Y@`^$x!gctSJMe|y4G_tIDaV~uSr$x)Rt315D$>i1=(IbBSR!`+6
zrrX*-zdn8S!wu)eXNYpY<w}^-@cQXG`)G~VLLOU1i+A-@PU%_qXJ^dT?OWb52j6`5
TUV1ir_#~f{+h6zP?&AgkLd#uA

literal 0
HcmV?d00001

diff --git a/src/work_test.go b/src/work_test.go
new file mode 100644
index 0000000..f32743c
--- /dev/null
+++ b/src/work_test.go
@@ -0,0 +1,437 @@
+package main
+
+import (
+	"archive/zip"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+// ---------- Regression: normal round trips must keep working ----------
+
+func TestRoundTrips(t *testing.T) {
+	cases := []struct {
+		name string
+		pw   string
+		nkf  int
+		opt  func()
+	}{
+		{"password", "pw-1", 0, nil},
+		{"paranoid", "pw-2", 0, func() { paranoid = true }},
+		{"reedsolo", "pw-3", 0, func() { reedsolo = true }},
+		{"keyfile-only", "", 1, nil},
+		{"pw+2 keyfiles ordered", "pw-4", 2, func() { keyfileOrdered = true }},
+		{"paranoid+rs+keyfiles+comment", "pw-5", 2, func() { paranoid = true; reedsolo = true; comments = "hello" }},
+		{"deniable", "pw-6", 0, func() { deniability = true }},
+		{"deniable+keyfile", "pw-7", 1, func() { deniability = true }},
+		{"deniable+rs+split", "pw-8", 0, func() { deniability = true; reedsolo = true; split = true; splitSize = "2"; splitSelected = 0 }},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			dir := t.TempDir()
+			in := filepath.Join(dir, "f.bin")
+			data := randBytes(t, 70000)
+			writeFile(t, in, data)
+			var kf []string
+			for i := 0; i < c.nkf; i++ {
+				p := filepath.Join(dir, "k"+string(rune('0'+i))+".key")
+				writeFile(t, p, randBytes(t, 100))
+				kf = append(kf, p)
+			}
+			vol, st := encrypt(t, []string{in}, c.pw, kf, c.opt)
+			mustStatus(t, st, "Completed")
+			os.Remove(in)
+			isSplit := strings.Contains(c.name, "split")
+			drop := vol
+			if isSplit {
+				drop = vol + ".0"
+			}
+			out, st := decrypt(t, drop, c.pw, kf, nil)
+			mustStatus(t, st, "Completed")
+			mustContent(t, out, data)
+			for _, n := range listDir(t, dir) {
+				if strings.HasSuffix(n, ".tmp") || strings.HasSuffix(n, ".incomplete") || (isSplit && n == "f.bin.pcv") {
+					t.Fatalf("leftover %s in %v", n, listDir(t, dir))
+				}
+			}
+		})
+	}
+}
+
+func TestMultiFileZipKeepsInputs(t *testing.T) {
+	dir := t.TempDir()
+	a, b := filepath.Join(dir, "a.txt"), filepath.Join(dir, "b.txt")
+	writeFile(t, a, []byte("aaa"))
+	writeFile(t, b, []byte("bbb"))
+	vol, st := encrypt(t, []string{a, b}, "pw", nil, func() { compress = true })
+	mustStatus(t, st, "Completed")
+	mustContent(t, a, []byte("aaa"))
+	mustContent(t, b, []byte("bbb"))
+	out, st := decrypt(t, vol, "pw", nil, nil)
+	mustStatus(t, st, "Completed")
+	zr, err := zip.OpenReader(out)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer zr.Close()
+	if len(zr.File) != 2 {
+		t.Fatalf("zip has %d entries", len(zr.File))
+	}
+	mustOnly(t, dir, "a.txt", "b.txt", filepath.Base(vol), filepath.Base(out))
+}
+
+func TestWrongCredentialsMessages(t *testing.T) {
+	dir := t.TempDir()
+	in := filepath.Join(dir, "f.bin")
+	k1, k2, k3 := filepath.Join(dir, "1.key"), filepath.Join(dir, "2.key"), filepath.Join(dir, "3.key")
+	writeFile(t, in, randBytes(t, 3000))
+	for _, k := range []string{k1, k2, k3} {
+		writeFile(t, k, randBytes(t, 50))
+	}
+	vol, st := encrypt(t, []string{in}, "right", []string{k1, k2}, func() { keyfileOrdered = true })
+	mustStatus(t, st, "Completed")
+	os.Remove(in)
+
+	_, st = decrypt(t, vol, "wrong", []string{k1, k2}, nil)
+	mustStatus(t, st, "password is incorrect")
+	_, st = decrypt(t, vol, "right", []string{k1, k3}, nil)
+	mustStatus(t, st, "Incorrect keyfiles or ordering")
+	_, st = decrypt(t, vol, "right", []string{k2, k1}, nil)
+	mustStatus(t, st, "Incorrect keyfiles or ordering")
+	_, st = decrypt(t, vol, "wrong", []string{k1, k3}, nil)
+	mustStatus(t, st, "Incorrect keyfiles")
+	mustOnly(t, dir, "f.bin.pcv", "1.key", "2.key", "3.key")
+}
+
+func TestDuplicateKeyfiles(t *testing.T) {
+	dir := t.TempDir()
+	in := filepath.Join(dir, "f.bin")
+	k1, k2 := filepath.Join(dir, "1.key"), filepath.Join(dir, "2.key")
+	writeFile(t, in, []byte("x"))
+	writeFile(t, k1, []byte("same"))
+	writeFile(t, k2, []byte("same"))
+	_, st := encrypt(t, []string{in}, "pw", []string{k1, k2}, nil)
+	mustStatus(t, st, "Duplicate keyfiles")
+	mustOnly(t, dir, "f.bin", "1.key", "2.key")
+}
+
+func TestForceDecryptStillOutputs(t *testing.T) {
+	dir := t.TempDir()
+	in := filepath.Join(dir, "f.bin")
+	writeFile(t, in, randBytes(t, 5000))
+	vol, _ := encrypt(t, []string{in}, "pw", nil, nil)
+	os.Remove(in)
+	flipByte(t, vol, 789+10)
+	out, st := decrypt(t, vol, "pw", nil, func() { keep = true })
+	mustStatus(t, st, "modified. Please be careful")
+	if _, err := os.Stat(out); err != nil {
+		t.Fatal("force decrypt produced no output")
+	}
+}
+
+// ---------- Finding #1: failed decrypt leaves plaintext / deletes overwritten file ----------
+
+func TestFailedDecryptCleansIncompleteAndKeepsExisting(t *testing.T) {
+	dir := t.TempDir()
+	in := filepath.Join(dir, "doc.txt")
+	writeFile(t, in, randBytes(t, 300000))
+	vol, _ := encrypt(t, []string{in}, "pw", nil, nil)
+	writeFile(t, in, []byte("EXISTING")) // the file the user chose to overwrite
+	flipByte(t, vol, 789+1000)
+	out, st := decrypt(t, vol, "pw", nil, nil)
+	mustStatus(t, st, "damaged or modified")
+	mustContent(t, out, []byte("EXISTING"))
+	mustOnly(t, dir, "doc.txt", "doc.txt.pcv")
+}
+
+// ---------- Finding #2/#3: Reed-Solomon repair on deniable and split volumes ----------
+
+func TestRepairDeniable(t *testing.T) {
+	dir := t.TempDir()
+	in := filepath.Join(dir, "f.bin")
+	data := randBytes(t, 50000)
+	writeFile(t, in, data)
+	vol, st := encrypt(t, []string{in}, "pw", nil, func() { deniability = true; reedsolo = true })
+	mustStatus(t, st, "Completed")
+	os.Remove(in)
+	flipByte(t, vol, 40+789+500) // outer layer is a stream cipher: flips one inner byte
+	out, st := decrypt(t, vol, "pw", nil, nil)
+	mustStatus(t, st, "Completed")
+	mustContent(t, out, data)
+	mustOnly(t, dir, "f.bin", "f.bin.pcv")
+}
+
+func TestRepairSplit(t *testing.T) {
+	dir := t.TempDir()
+	in := filepath.Join(dir, "f.bin")
+	data := randBytes(t, 5000)
+	writeFile(t, in, data)
+	vol, st := encrypt(t, []string{in}, "pw", nil, func() { reedsolo = true; split = true; splitSize = "2"; splitSelected = 0 })
+	mustStatus(t, st, "Completed")
+	os.Remove(in)
+	flipByte(t, vol+".1", 50) // (2048+50-789)%136 = 85: a data byte, not parity
+	out, st := decrypt(t, vol+".1", "pw", nil, nil)
+	mustStatus(t, st, "Completed")
+	mustContent(t, out, data)
+	mustOnly(t, dir, "f.bin", "f.bin.pcv.0", "f.bin.pcv.1", "f.bin.pcv.2", "f.bin.pcv.3")
+}
+
+func TestRepairDeniableSplit(t *testing.T) {
+	dir := t.TempDir()
+	in := filepath.Join(dir, "f.bin")
+	data := randBytes(t, 5000)
+	writeFile(t, in, data)
+	vol, st := encrypt(t, []string{in}, "pw", nil, func() { deniability = true; reedsolo = true; split = true; splitSize = "2"; splitSelected = 0 })
+	mustStatus(t, st, "Completed")
+	os.Remove(in)
+	flipByte(t, vol+".0", 40+789+20)
+	out, st := decrypt(t, vol+".0", "pw", nil, nil)
+	mustStatus(t, st, "Completed")
+	mustContent(t, out, data)
+	mustOnly(t, dir, "f.bin", "f.bin.pcv.0", "f.bin.pcv.1", "f.bin.pcv.2", "f.bin.pcv.3")
+}
+
+// ---------- Finding #4 (+ tail fragment): corrupted padding / appended bytes ----------
+
+func TestCorruptPaddingByteRepaired(t *testing.T) {
+	dir := t.TempDir()
+	in := filepath.Join(dir, "f.bin")
+	data := randBytes(t, 1000)
+	writeFile(t, in, data)
+	vol, _ := encrypt(t, []string{in}, "pw", nil, func() { reedsolo = true })
+	os.Remove(in)
+	b, _ := os.ReadFile(vol)
+	b[len(b)-9] = 0xff // PKCS#7 length byte of the final RS block (valid: 24)
+	writeFile(t, vol, b)
+	out, st := decrypt(t, vol, "pw", nil, nil)
+	mustStatus(t, st, "Completed")
+	mustContent(t, out, data)
+}
+
+func TestAppendedTailRejectedCleanly(t *testing.T) {
+	dir := t.TempDir()
+	in := filepath.Join(dir, "f.bin")
+	writeFile(t, in, randBytes(t, 1<<20))
+	vol, _ := encrypt(t, []string{in}, "pw", nil, func() { reedsolo = true })
+	os.Remove(in)
+	f, _ := os.OpenFile(vol, os.O_APPEND|os.O_WRONLY, 0)
+	f.Write([]byte("0123456789"))
+	f.Close()
+	_, st := decrypt(t, vol, "pw", nil, nil)
+	mustStatus(t, st, "irrecoverably damaged")
+	mustOnly(t, dir, "f.bin.pcv")
+}
+
+// ---------- Finding #5: keyfile-only header forgery ----------
+
+func TestKeyfileOnlyForgedHeaderRejected(t *testing.T) {
+	dir := t.TempDir()
+	in, kf := filepath.Join(dir, "s.bin"), filepath.Join(dir, "k.key")
+	writeFile(t, in, randBytes(t, 5000))
+	writeFile(t, kf, randBytes(t, 64))
+	vol, st := encrypt(t, []string{in}, "", []string{kf}, nil)
+	mustStatus(t, st, "Completed")
+	os.Remove(in)
+	forgeKeyfileOnlyHeader(t, vol)
+	_, st = decrypt(t, vol, "", []string{kf}, nil)
+	// Rejected at the header, with no output. (It's forged with the old derivation,
+	// so it's reported as a v1.50/1.51 volume; either message means "not accepted".)
+	if strings.Contains(st, "Completed") || !(strings.Contains(st, "tampered") || strings.Contains(st, "v1.51")) {
+		t.Fatalf("forged header not rejected: %q", st)
+	}
+	mustOnly(t, dir, "s.bin.pcv", "k.key")
+}
+
+// ---------- Finding #6: deniable failures must not leave the unwrapped .tmp ----------
+
+func TestDeniableFailuresLeaveNoTmp(t *testing.T) {
+	dir := t.TempDir()
+	in, kf := filepath.Join(dir, "f.bin"), filepath.Join(dir, "k.key")
+	data := randBytes(t, 20000)
+	writeFile(t, in, data)
+	writeFile(t, kf, randBytes(t, 64))
+	vol, _ := encrypt(t, []string{in}, "pw", []string{kf}, func() { deniability = true })
+	os.Remove(in)
+
+	// Wrong password
+	_, st := decrypt(t, vol, "nope", []string{kf}, nil)
+	mustStatus(t, st, "incorrect")
+	mustOnly(t, dir, "f.bin.pcv", "k.key")
+
+	// No keyfiles selected (only discoverable after unwrapping), then retry in the same UI state
+	_, st = decrypt(t, vol, "pw", nil, nil)
+	mustStatus(t, st, "requires keyfiles")
+	mustOnly(t, dir, "f.bin.pcv", "k.key")
+	keyfiles = []string{kf}
+	fastDecode = true
+	work(false)
+	working = false
+	mustStatus(t, mainStatus, "Completed")
+	mustContent(t, filepath.Join(dir, "f.bin"), data)
+}
+
+func TestDeniableTamperedLeavesNoTmp(t *testing.T) {
+	dir := t.TempDir()
+	in := filepath.Join(dir, "f.bin")
+	writeFile(t, in, randBytes(t, 20000))
+	vol, _ := encrypt(t, []string{in}, "pw", nil, func() { deniability = true })
+	os.Remove(in)
+	flipByte(t, vol, 40+789+100) // auth tag mismatch
+	_, st := decrypt(t, vol, "pw", nil, nil)
+	mustStatus(t, st, "damaged or modified")
+	mustOnly(t, dir, "f.bin.pcv")
+}
+
+func TestDeniableSplitWrongPasswordThenRetry(t *testing.T) {
+	dir := t.TempDir()
+	in := filepath.Join(dir, "f.bin")
+	data := randBytes(t, 5000)
+	writeFile(t, in, data)
+	vol, _ := encrypt(t, []string{in}, "pw", nil, func() { deniability = true; split = true; splitSize = "2"; splitSelected = 0 })
+	os.Remove(in)
+	chunks := listDir(t, dir)
+	_, st := decrypt(t, vol+".0", "bad", nil, nil)
+	mustStatus(t, st, "incorrect")
+	mustOnly(t, dir, chunks...)
+	password = "pw"
+	fastDecode = true
+	work(false)
+	working = false
+	mustStatus(t, mainStatus, "Completed")
+	mustContent(t, filepath.Join(dir, "f.bin"), data)
+	mustOnly(t, dir, append(chunks, "f.bin")...)
+}
+
+func TestTinyFileTreatedAsDeniable(t *testing.T) {
+	dir := t.TempDir()
+	vol := filepath.Join(dir, "junk.pcv")
+	writeFile(t, vol, randBytes(t, 20))
+	_, st := decrypt(t, vol, "pw", nil, nil)
+	mustStatus(t, st, "too short")
+	mustOnly(t, dir, "junk.pcv")
+}
+
+// ---------- Finding #7: cancelled split leaves no chunks ----------
+
+func TestCancelledSplitLeavesNothing(t *testing.T) {
+	dir := t.TempDir()
+	in := filepath.Join(dir, "f.bin")
+	writeFile(t, in, randBytes(t, 4<<20))
+	go func() {
+		deadline := time.Now().Add(60 * time.Second)
+		for !strings.HasPrefix(popupStatus, "Splitting") && time.Now().Before(deadline) {
+			time.Sleep(time.Millisecond)
+		}
+		working = false
+	}()
+	_, st := encrypt(t, []string{in}, "pw", nil, func() { split = true; splitSize = "100"; splitSelected = 0 })
+	mustStatus(t, st, "cancelled")
+	mustOnly(t, dir, "f.bin")
+}
+
+// ---------- Finding #8: no self-update while working ----------
+
+func TestApplyUpdateRefusedWhileWorking(t *testing.T) {
+	setup()
+	working, showProgress = true, true
+	applyUpdate()
+	if updateApplying {
+		t.Fatal("applyUpdate started while an operation was running")
+	}
+	working, showProgress = false, false
+}
+
+// ---------- Compat: volumes produced by v1.51 ----------
+// Password-only volumes still open; keyfile volumes are rejected with a pointer to v1.51.
+
+func TestLegacyVolumes(t *testing.T) {
+	// Volumes made by v1.51 (see testdata/legacy-v1.51/README.md)
+	src := filepath.Join("testdata", "legacy-v1.51")
+	dir := t.TempDir()
+	for _, n := range []string{"pw.txt.pcv", "kf.txt.pcv", "pkf.txt.pcv", "kf.key", "plain.orig"} {
+		b, err := os.ReadFile(filepath.Join(src, n))
+		if err != nil {
+			t.Fatal(err)
+		}
+		writeFile(t, filepath.Join(dir, n), b)
+	}
+	want, _ := os.ReadFile(filepath.Join(dir, "plain.orig"))
+
+	out, st := decrypt(t, filepath.Join(dir, "pw.txt.pcv"), "legacy-pw", nil, nil)
+	mustStatus(t, st, "Completed")
+	mustContent(t, out, want)
+
+	kf := []string{filepath.Join(dir, "kf.key")}
+	_, st = decrypt(t, filepath.Join(dir, "kf.txt.pcv"), "", kf, nil)
+	mustStatus(t, st, "use ZeeCrypt v1.51")
+	_, st = decrypt(t, filepath.Join(dir, "pkf.txt.pcv"), "legacy-pw", kf, nil)
+	mustStatus(t, st, "use ZeeCrypt v1.51")
+	_, st = decrypt(t, filepath.Join(dir, "pkf.txt.pcv"), "typo", kf, nil)
+	mustStatus(t, st, "password is incorrect")
+	mustOnly(t, dir, "pw.txt", "pw.txt.pcv", "kf.txt.pcv", "pkf.txt.pcv", "kf.key", "plain.orig")
+}
+
+// ---------- Review follow-ups ----------
+
+func TestExistingTmpNotClobbered(t *testing.T) {
+	dir := t.TempDir()
+	in := filepath.Join(dir, "f.bin")
+	writeFile(t, in, randBytes(t, 3000))
+	vol, _ := encrypt(t, []string{in}, "pw", nil, func() { deniability = true })
+	os.Remove(in)
+	writeFile(t, vol+".tmp", []byte("USERDATA"))
+	_, st := decrypt(t, vol, "pw", nil, nil)
+	mustStatus(t, st, "Please remove f.bin.pcv.tmp")
+	mustContent(t, vol+".tmp", []byte("USERDATA"))
+	mustOnly(t, dir, "f.bin.pcv", "f.bin.pcv.tmp")
+}
+
+func TestStartIgnoredWhileWorking(t *testing.T) {
+	setup()
+	dir := t.TempDir()
+	in := filepath.Join(dir, "f.bin")
+	writeFile(t, in, []byte("x"))
+	onDrop([]string{in})
+	waitScan()
+	password, cpassword = "pw", "pw"
+	working = true
+	onClickStartButton() // what the Enter key does mid-operation
+	working = false
+	if showProgress || showOverwrite {
+		t.Fatal("onClickStartButton started an operation while one was running")
+	}
+	mustOnly(t, dir, "f.bin")
+}
+
+func TestSplitNameWithGlobMetacharacters(t *testing.T) {
+	dir := t.TempDir()
+	in := filepath.Join(dir, "report[1].bin")
+	data := randBytes(t, 5000)
+	writeFile(t, in, data)
+	vol, st := encrypt(t, []string{in}, "pw", nil, func() { split = true; splitSize = "2"; splitSelected = 0 })
+	mustStatus(t, st, "Completed")
+	os.Remove(in)
+	mustOnly(t, dir, "report[1].bin.pcv.0", "report[1].bin.pcv.1", "report[1].bin.pcv.2")
+	out, st := decrypt(t, vol+".0", "pw", nil, nil)
+	mustStatus(t, st, "Completed")
+	mustContent(t, out, data)
+}
+
+func TestRemoveTempInputIdempotent(t *testing.T) {
+	setup()
+	dir := t.TempDir()
+	user := filepath.Join(dir, "foo.pcv")
+	writeFile(t, user, []byte("user volume"))
+	rec := filepath.Join(dir, "bar.pcv")
+	writeFile(t, rec, []byte("recombined"))
+	mode, recombine = "decrypt", true
+	inputFileOld, inputFile, recombinedFile = user, rec, rec
+	removeTempInput()
+	removeTempInput()
+	mustOnly(t, dir, "foo.pcv")
+	if inputFile != user {
+		t.Fatalf("inputFile = %q", inputFile)
+	}
+}

From 6b8d24d5188bf0ee7fae3bcf67c179d1efc69c93 Mon Sep 17 00:00:00 2001
From: ZeekA McZeekA <148893598+TheZeekA@users.noreply.github.com>
Date: Thu, 24 Sep 2026 05:30:46 +1200
Subject: [PATCH 3/3] Mark test fixtures as binary so autocrlf can't alter them

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 src/testdata/.gitattributes | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 src/testdata/.gitattributes

diff --git a/src/testdata/.gitattributes b/src/testdata/.gitattributes
new file mode 100644
index 0000000..fa1385d
--- /dev/null
+++ b/src/testdata/.gitattributes
@@ -0,0 +1 @@
+* -text