Revert commits - #39
Closed
PatrykLs98 wants to merge 68 commits into
Closed
Conversation
Worker now frees the operation script, then posts WM_USER_PROGRDLG_WORKERCOMPLETE with an owned CWorkerCompletion; it no longer sends synchronous WM_COMMAND/IDOK or waits for UI release. [operations_core.cpp (line 1338)](/C:/Projects/FileManager/src/operations_core.cpp:1338) Progress dialog asynchronously consumes the result, closes worker handles, and schedules its normal delayed close. [dialogs_file_ops.cpp (line 1372)](/C:/Projects/FileManager/src/dialogs_file_ops.cpp:1372) Added a unique typed message ID and completion payload. [consts.h (line 1186)](/C:/Projects/FileManager/src/consts.h:1186) [worker.h (line 628)](/C:/Projects/FileManager/src/worker.h:628) Added deterministic close/cancel/shutdown protocol guard, wired into PR CI. [verify-operation-completion-protocol.ps1](/C:/Projects/FileManager/tools/verify-operation-completion-protocol.ps1) [pr-msbuild.yml (line 69)](/C:/Projects/FileManager/.github/workflows/pr-msbuild.yml:69) Marked improvement 4 as implemented. [refactoring.md (line 72)](/C:/Projects/FileManager/refactoring.md:72) Verified: tools\verify-operation-completion-protocol.ps1 — passed. Visual Studio 2026 Developer Command Prompt: Debug/x64 src\vcxproj\salamand.sln build — passed.
COperations now owns interlocked lifecycle state and a manual-reset cancellation event. Dialog/worker cancellation uses centralized, idempotent transitions; low-level code keeps a safe compatibility view instead of BOOL*. Worker completion reports terminal state and cancellation separately. Debug builds break on invalid transitions. Updated [architecture.md (line 310)](C:\\Projects\\FileManager\\architecture.md:310) and marked item 5 implemented in [refactoring.md (line 76)](C:\\Projects\\FileManager\\refactoring.md:76). Verified: Visual Studio 2026 Debug|x64 build of src\vcxproj\salamand.sln passed; git diff --check is clean.
Overwrites now copy to a unique sibling temp file, flush it, then commit via ReplaceFileW with write-through; a write-through rename handles a destination removed after confirmation. [async_copy.cpp (line 2187)](/C:/Projects/FileManager/src/async_copy.cpp:2187) Retry, cancel, low-space, and metadata-failure paths clean up only the temporary file, preserving the original destination until commit. Updated [refactoring.md (line 81)](/C:/Projects/FileManager/refactoring.md:81) to mark improvement 6 implemented. Verified with Visual Studio 2026: Debug|x64 salamand build succeeded with 0 warnings and 0 errors.
Core copies now request write-through, flush, close, then reopen and verify destination size/file metadata before success, replacement, or cross-volume source deletion: [async_copy.cpp (line 2247)](/C:/Projects/FileManager/src/async_copy.cpp:2247). Documented the boundary in [architecture.md (line 310)](/C:/Projects/FileManager/architecture.md:310). Marked improvement 7 implemented in [refactoring.md (line 85)](/C:/Projects/FileManager/refactoring.md:85). Added a CI protocol guard: [verify-durable-copy-commit.ps1](/C:/Projects/FileManager/tools/verify-durable-copy-commit.ps1) and [PR workflow (line 72)](/C:/Projects/FileManager/.github/workflows/pr-msbuild.yml:72). Verified: Visual Studio 2026 Debug x64 solution build passed with /warnaserror. Durable-copy guard and git diff --check passed. Existing verify-operation-completion-protocol.ps1 fails against unchanged operation-dialog code; unrelated to this change.
Retried copy paths now perform a full SHA-256 source/destination comparison before source deletion in [async_copy.cpp (line 5631)](C:\\Projects\\FileManager\\src\\async_copy.cpp:5631). Added retry tracking to the copy worker call path in [operations_core.cpp (line 26)](C:\\Projects\\FileManager\\src\\operations_core.cpp:26). Extended the CI regression guard in [verify-durable-copy-commit.ps1](C:\\Projects\\FileManager\\tools\\verify-durable-copy-commit.ps1). Marked item 8 implemented in [refactoring.md (line 90)](C:\\Projects\\FileManager\\refactoring.md:90). Verified: Durable-copy/cross-volume guard passes. Visual Studio 2026 Debug rebuilds pass for x64 and Win32. git diff --check passes.
Added durable append-only journals with intent, source identity, temporary paths, transitions, and terminal states in [operation_journal.cpp (line 288)](C:\\Projects\\FileManager\\src\\operation_journal.cpp:288). Wired journaling before each worker item and around transactional copy commits; startup offers safe commit-resume, temporary-file rollback, or reconciliation reporting. Added executable-level copy/journal regression coverage in [FileOperationUiTests.cs (line 29)](C:\\Projects\\FileManager\\tests\\FileManager.UiTests\\FileOperationUiTests.cs:29). Marked item 9 implemented in [refactoring.md (line 94)](C:\\Projects\\FileManager\\refactoring.md:94). Verification: Native Debug|x64 build passed using the Visual Studio 2026 developer environment, with 0 warnings/errors. The targeted UI test compiles but was skipped because this profile lacks the required isolated-profile opt-in (FILEMANAGER_UI_ISOLATED=1).
Added handle-based identity capture/recheck and verified-handle deletion in [file_identity.cpp (line 145)](C:\\Projects\\FileManager\\src\\file_identity.cpp:145). Wired capture before each worker item; transactional replacements, moves, direct deletes, directories, and directory links refuse changed identities. [operations_core.cpp (line 1028)](C:\\Projects\\FileManager\\src\\operations_core.cpp:1028) · [async_copy.cpp (line 2223)](C:\\Projects\\FileManager\\src\\async_copy.cpp:2223) Added a focused regression guard in [NativeSafetyRegressionTests.cs (line 13)](C:\\Projects\\FileManager\\tests\\FileManager.UiTests\\NativeSafetyRegressionTests.cs:13). Marked item 10 implemented in [refactoring.md (line 99)](C:\\Projects\\FileManager\\refactoring.md:99). Verified: VS 2026 Debug x64 rebuild: succeeded, 0 warnings/errors. Focused NUnit regression test: passed (1/1).
Added typed CFileOffsetResult plus SalGetFileSizeEx / SalSetFilePointerEx wrappers with captured Win32 errors in [consts.h (line 111)](C:/Projects/FileManager/src/consts.h:111) and [path_checking.cpp (line 1459)](C:/Projects/FileManager/src/path_checking.cpp:1459). Migrated the copy/move engine’s ADS, retry, allocation, truncation, and overwrite paths; async_copy.cpp no longer executes raw legacy size/seek calls. Added regression coverage preventing their reintroduction in [NativeSafetyRegressionTests.cs (line 34)](C:/Projects/FileManager/tests/FileManager.UiTests/NativeSafetyRegressionTests.cs:34). Marked item 11 implemented in [refactoring.md (line 104)](C:/Projects/FileManager/refactoring.md:104). Validated: dotnet test ... --filter FullyQualifiedName~NativeSafetyRegressionTests: 2/2 passed. Visual Studio 2026 Developer Command Prompt: salamand.vcxproj, Debug x64 — succeeded with 0 warnings and 0 errors.
Replaced raw Winsock HTTP with WinHTTP TLS upload to /api/v1/crash-reports, normal certificate/hostname validation, explicit proxy handling, redirect blocking, and streamed multipart data in [upload.cpp](C:\\Projects\\FileManager\\src\\salmon\\upload.cpp). Added clear Send Report consent text and secure-upload errors. Added full transmission documentation in [reporting.md](C:\\Projects\\FileManager\\reporting.md). Marked refactoring item 12 implemented in [refactoring.md](C:\\Projects\\FileManager\\refactoring.md). Added regression coverage in [NativeSafetyRegressionTests.cs](C:\\Projects\\FileManager\\tests\\FileManager.UiTests\\NativeSafetyRegressionTests.cs). Verified: salmon Debug|x64 build: passed, 0 warnings. English language resource Debug|x64 build: passed, 0 warnings. Native safety regression tests: 3/3 passed.
…entation [upload.cpp](C:/Projects/FileManager/src/salmon/upload.cpp) now uses WinHTTP chunked framing, 64-bit tracked streaming, short-write handling, bounded 64 KiB response reads, deadlines, cancellation, and one pre-body-write retry only. [dialogs.cpp](C:/Projects/FileManager/src/salmon/dialogs.cpp) lets Close/Esc cancel an active upload while retaining the archive. [reporting.md](C:/Projects/FileManager/reporting.md) now documents the exact endpoint, protocol, wire fields, archive contents, limits, cancellation, and retry behavior. [NativeSafetyRegressionTests.cs](C:/Projects/FileManager/tests/FileManager.UiTests/NativeSafetyRegressionTests.cs) guards the framing/cancellation contract. Verified: salmon.vcxproj Debug|x64: passed, 0 warnings/errors. Focused NativeSafetyRegressionTests: 3/3 passed. No live crash report was transmitted.
Replaced the OpenSSL adapter with Windows SChannel TLS 1.2/1.3 support in [ssl.cpp (line 17)](C:/Projects/FileManager/src/plugins/ftp/ssl.cpp:17), preserving certificate validation and the explicit user exception flow. Removed legacy OpenSSL headers, CI download, staging, installer entries, and runtime DLL references. Added Secur32.lib, local TLS 1.2/TLS 1.3 plus certificate-rejection tests in [SChannelTlsIntegrationTests.cs (line 13)](C:/Projects/FileManager/tests/FileManager.UiTests/SChannelTlsIntegrationTests.cs:13), and made CI run them. Documented Windows-servicing upgrade cadence in [refactoring.md (line 121)](C:/Projects/FileManager/refactoring.md:121). [reporting.md (line 1)](C:/Projects/FileManager/reporting.md:1) already existed and precisely documents crash-report contents, HTTPS protocol, expected/current endpoint (https://reports.taskscape.com/api/v1/crash-reports), and legacy endpoint. Verification: dotnet test ...SChannelTlsIntegrationTests: passed 3/3. VS 2026 Debug x64 FTP compile-only build: passed with zero warnings/errors. Full FTP build remains blocked by an existing VS 2026 link.exe internal crash while linking lang_ftp, before FTP linking begins.
Startup now enforces restricted DLL directories and fails safely if the Windows 7 KB2533623 APIs are unavailable: [app_entry.cpp (line 61)](/C:/Projects/FileManager/src/app_entry.cpp:61). Debug and Release UTF-8 loaders canonicalize paths and use LoadLibraryExW with explicit safe flags: [handles.h (line 42)](/C:/Projects/FileManager/src/common/handles.h:42), [handles.cpp (line 2211)](/C:/Projects/FileManager/src/common/handles.cpp:2211). Added regression coverage and marked item 19 implemented: [NativeSafetyRegressionTests.cs (line 99)](/C:/Projects/FileManager/tests/FileManager.UiTests/NativeSafetyRegressionTests.cs:99), [refactoring.md (line 145)](/C:/Projects/FileManager/refactoring.md:145). Verified: Visual Studio 2026 x64 Debug forced rebuild: succeeded, 0 warnings/errors. Native safety regression tests: 4/4 passed. Executable UI startup check: 1/1 passed.
Added restricted-token salbroker.exe with versioned, size-validated named-pipe IPC, job memory/CPU limits, timeouts, and kill/restart recovery. Moved thumbnail loading off the in-process plug-in callback; failures now safely yield no thumbnail. Added brokered archive-file metadata request before archive handling. Added installer/solution/project wiring and regression coverage. Marked item 21 implemented in [refactoring.md (line 157)](C:\\Projects\\FileManager\\refactoring.md:157), including the deliberately limited archive-metadata scope. Verified: dotnet test ...NativeSafetyRegressionTests — 5/5 passed. Visual Studio 2026 Debug|x64 build of [salamand.vcxproj (line 1)](C:\\Projects\\FileManager\\src\\vcxproj\\salamand.vcxproj:1) — succeeded, 0 warnings/errors. The new broker protocol and client are in [parserbroker_protocol.h (line 1)](C:\\Projects\\FileManager\\src\\parserbroker_protocol.h:1), [parserbroker.cpp (line 1)](C:\\Projects\\FileManager\\src\\parserbroker.cpp:1), and [salbroker.cpp (line 1)](C:\\Projects\\FileManager\\src\\parserbroker\\salbroker.cpp:1).
Added CPluginEntryScope: always clears temporary interface sentinels, restores SalamanderGeneral, releases the data lock, and calls LeavePlugin() when the entry point unwinds. Made nesting transitions atomic and serialized with an SRW lock; callers now use IsInPlugin(). Added a native safety regression test and marked item 22 implemented in [refactoring.md (line 162)](C:\\Projects\\FileManager\\refactoring.md:162). Verified: NativeSafetyRegressionTests: 6 passed. Visual Studio 2026 x64 Debug build of salamand.vcxproj: succeeded, 0 warnings/errors. Note: restoring test dependencies touched tracked NuGet obj metadata only by final-newline normalization; no functional generated changes.
Added shared callback boundary, owner tracing/quarantine, deferred unload, and safe fallback results. Replaced the process-terminating plug-in thread exception path. Added regression coverage and marked item 23 implemented. Verified: Debug x64 native build: succeeded, 0 warnings/errors. NativeSafetyRegressionTests: 7/7 passed.
Full settings save to inactive registry generation, checksum/marker validation, flush, then atomic active-generation switch. Startup validates selected generation and falls back to prior valid generation; cleanup occurs after successful startup. FTP and other plug-in commits now use the host transaction instead of in-place registry writes. Updated [architecture.md](C:\\Projects\\FileManager\\architecture.md) and marked item 24 implemented in [refactoring.md](C:\\Projects\\FileManager\\refactoring.md). Added regression coverage in [NativeSafetyRegressionTests.cs](C:\\Projects\\FileManager\\tests\\FileManager.UiTests\\NativeSafetyRegressionTests.cs). Verified: Visual Studio 2026 Debug x64 rebuild: succeeded, 0 warnings/errors. NativeSafetyRegressionTests: 8/8 passed.
Added schema versioning, idempotent v0→v1 migration, pre-load validation, range/cross-field checks, fallback diagnostics, and default-profile recovery. Updated architecture and marked item 25 implemented in [refactoring.md (line 179)](C:\\Projects\\FileManager\\refactoring.md:179). Added regression coverage in [NativeSafetyRegressionTests.cs (line 257)](C:\\Projects\\FileManager\\tests\\FileManager.UiTests\\NativeSafetyRegressionTests.cs:257). Verified: Visual Studio 2026 Debug x64 build: 0 warnings, 0 errors. Focused native-safety tests: 9 passed.
Added scoped, isolated-profile fault injection at registry write boundaries, including transaction flushes. Added exhaustive executable/UI test that measures all write boundaries, crashes at each one, restarts, and accepts only the full old or full new profile. Routed plug-in icon persistence through the common registry boundary so it is covered. Documented the opt-in FaultInjection lane and marked item 26 implemented in [refactoring.md](C:\\Projects\\FileManager\\refactoring.md). Added test: [ConfigurationRecoveryUiTests.cs](C:\\Projects\\FileManager\\tests\\FileManager.UiTests\\ConfigurationRecoveryUiTests.cs). Verification passed: Visual Studio 2026 Debug/x64 build of salamand.vcxproj: 0 warnings, 0 errors. UI test project compiled and discovered the new test. Targeted test correctly skipped without the required disposable-profile environment; run it with FILEMANAGER_UI_ISOLATED=1, FILEMANAGER_UI_EXE, and FILEMANAGER_UI_CONFIG_FAULT_INJECTION=1. git diff --check passed.
Added immutable, deep-copied [`COperationPlan`](/C:/Projects/FileManager/src/operation_plan.h) snapshots and persists PLAN|1 / PLANITEM golden-master records before execution. Added the read-only [`CFileOperationFileSystem`](/C:/Projects/FileManager/src/file_operation_filesystem.h) adapter for planner attribute/free-space queries; production behavior remains Win32-backed. Enhanced the copy journal test to assert exact planned source/target intent. Marked item 27 implemented in [refactoring.md (line 189)](/C:/Projects/FileManager/refactoring.md:189). Verification: Visual Studio 2026 Debug x64 build: succeeded, 0 warnings/errors. Focused planning regression: passed (1/1). Full NativeSafetyRegressionTests: 9 passed, 1 existing unrelated failure in configuration-save assertions (RegFlushKey(generationKey) absent).
Added real-executable tests for overwrite/overwrite-all, skip/skip-all, metadata preservation, worker-stage cancellation, recycle-bin behavior, same-volume moves, cross-volume moves, and startup reconciliation. Added disposable second-volume support and documented FILEMANAGER_UI_CROSS_VOLUME_ROOT / FILEMANAGER_UI_RECYCLE_BIN. Marked item 28 implemented in [refactoring.md (line 195)](C:\\Projects\\FileManager\\refactoring.md:195). Added a static regression guard in [NativeSafetyRegressionTests.cs (line 87)](C:\\Projects\\FileManager\\tests\\FileManager.UiTests\\NativeSafetyRegressionTests.cs:87).
Added an injectable execution adapter covering create, write, metadata, flush, replace/rename, and identity-guarded deletion in [file_operation_filesystem.h](C:\\Projects\\FileManager\\src\\file_operation_filesystem.h). Routed transactional copy/move paths through it in [async_copy.cpp](C:\\Projects\\FileManager\\src\\async_copy.cpp) and [file_identity.cpp](C:\\Projects\\FileManager\\src\\file_identity.cpp). Added regression coverage locking each persistence boundary and journal transition in [NativeSafetyRegressionTests.cs](C:\\Projects\\FileManager\\tests\\FileManager.UiTests\\NativeSafetyRegressionTests.cs). Marked item 29 implemented in [refactoring.md](C:\\Projects\\FileManager\\refactoring.md). Verified: Targeted regression test: passed. Native Debug x64 build via Visual Studio 2026: passed, 0 warnings. git diff --check: passed. Note: the broader native-safety test group has one pre-existing unrelated failure: it expects RegFlushKey(generationKey) in mainwnd_config.cpp, which is not present.
…tive worker Cross-volume moves now show unacknowledged metadata losses before each source deletion; default No retains sources and continues copying. Recorded planned ADS/ACL losses and runtime timestamp, attribute, ACL, ADS, and compression/EFS losses. Documented the contract in [architecture.md (line 312)](/C:/Projects/FileManager/architecture.md:312) and marked item 31 implemented in [refactoring.md (line 213)](/C:/Projects/FileManager/refactoring.md:213). Added focused regression coverage in [NativeSafetyRegressionTests.cs (line 387)](/C:/Projects/FileManager/tests/FileManager.UiTests/NativeSafetyRegressionTests.cs:387).
Implemented ADS end-to-end coverage and marked item 32 complete. Added executable-level ADS scenarios for multi/empty/large/edge-named streams, overwrite cleanup, and retry after a temporarily denied stream. Added cross-volume ADS preservation plus an opt-in ADS-unsupported target test that confirms declining metadata loss retains the source. Documented FILEMANAGER_UI_ADS_UNSUPPORTED_TARGET_ROOT. Updated refactoring.md item 32 to implemented. Verification: dotnet restore succeeded. Focused structural regression test passed. ADS category discovers five tests; they safely skip without an authorized isolated UI profile. Full NativeSafetyRegressionTests build ran, with one unrelated existing failure expecting RegFlushKey(generationKey) in configuration code. git diff --check passed.
[async_copy.cpp](C:\\Projects\\FileManager\\src\\async_copy.cpp) now snapshots, verifies, and rolls back security updates; it preserves explicit deny ACEs and inheritance state, and avoids temporary ownership/permissive-DACL fallback without restore privilege. [architecture.md](C:\\Projects\\FileManager\\architecture.md) includes the privilege-aware descriptor matrix. [NativeSafetyRegressionTests.cs](C:\\Projects\\FileManager\\tests\\FileManager.UiTests\\NativeSafetyRegressionTests.cs) covers the matrix and safeguards. [refactoring.md](C:\\Projects\\FileManager\\refactoring.md) marks item 33 implemented. Verified: Focused regression test passed. VS 2026 x64 Debug build passed with 0 warnings/errors.
Reparse directories are now hard planning boundaries; copy/move/count/etc. do not traverse them. Reparse files are skipped before accidental cloud-placeholder hydration. Moves retain a parent source directory when it contains a skipped reparse entry. Added disposable junction topology UI tests for outside targets, retargeting, cycles, safe deletion, plus optional symlink coverage. Updated [architecture.md (line 312)](C:\\Projects\\FileManager\\architecture.md:312) and [refactoring.md (line 230)](C:\\Projects\\FileManager\\refactoring.md:230). Verified: Focused reparse regression test: passed. VS 2026 x64 Debug native build: passed, 0 warnings/errors. The broader native-safety class still has two unrelated existing configuration/metadata assertion failures. Reparse UI tests require the isolated interactive UI environment and were not launched here.
Added [wide_path.h (line 14)](C:\\Projects\\FileManager\\src\\common\\wide_path.h:14): owned UTF-16 display/API paths, dynamic sizing, long-drive and UNC extended prefixes. Migrated core file, directory, attributes, enumeration, and DLL-loading boundaries. Updated [NativeSafetyRegressionTests.cs (line 14)](C:\\Projects\\FileManager\\tests\\FileManager.UiTests\\NativeSafetyRegressionTests.cs:14) and marked the item implemented in [refactoring.md (line 236)](C:\\Projects\\FileManager\\refactoring.md:236). Verified: x64 Debug salamand.vcxproj build: passed, 0 warnings. Targeted regression tests: 2/2 passed. Full native source-contract suite: 14/16 passed; two unrelated existing configuration/metadata contract assertions remain out of sync with current source.
Added [wide_path.h (line 14)](C:\\Projects\\FileManager\\src\\common\\wide_path.h:14): owned UTF-16 display/API paths, dynamic sizing, long-drive and UNC extended prefixes. Migrated core file, directory, attributes, enumeration, and DLL-loading boundaries. Updated [NativeSafetyRegressionTests.cs (line 14)](C:\\Projects\\FileManager\\tests\\FileManager.UiTests\\NativeSafetyRegressionTests.cs:14) and marked the item implemented in [refactoring.md (line 236)](C:\\Projects\\FileManager\\refactoring.md:236). Verified: x64 Debug salamand.vcxproj build: passed, 0 warnings. Targeted regression tests: 2/2 passed. Full native source-contract suite: 14/16 passed; two unrelated existing configuration/metadata contract assertions remain out of sync with current source.
Implemented item 38 and marked it complete in [refactoring.md](C:\\Projects\\FileManager\\refactoring.md). FTP control replies now cap dynamic unread input at 64 KiB and fail with WSAEMSGSIZE. Configuration fault-injection environment values use bounded owned strings (32,767-char maximum). Crash reporter shared-memory fields and dump paths are validated and assembled in bounded dynamic storage; fixed arrays remain compatibility outputs only. Added a targeted regression test in [NativeSafetyRegressionTests.cs](C:\\Projects\\FileManager\\tests\\FileManager.UiTests\\NativeSafetyRegressionTests.cs). Verified: New regression test passes. salamand, FTP plug-in, and salmon x64 Debug builds pass with 0 warnings/errors. git diff --check passes.
…C boundaries Added reusable helpers in [checked_arithmetic.h](C:\\Projects\\FileManager\\src\\common\\checked_arithmetic.h). Guarded uploader response/framing/file-stream conversions in [upload.cpp](C:\\Projects\\FileManager\\src\\salmon\\upload.cpp). Guarded parser-broker path and thumbnail byte calculations on both host and broker sides. Added a regression covering each boundary in [NativeSafetyRegressionTests.cs](C:\\Projects\\FileManager\\tests\\FileManager.UiTests\\NativeSafetyRegressionTests.cs). Marked item 39 implemented in [refactoring.md](C:\\Projects\\FileManager\\refactoring.md). Verification: salamand.vcxproj Debug/x64: passed, 0 warnings/errors. salmon.vcxproj Debug/x64: passed, 0 warnings/errors. New checked-arithmetic regression: passed. Full NativeSafetyRegressionTests: 17 passed, 3 existing unrelated assertions fail (including missing configuration-generation implementation).
…and transactional overwrite commit Added [operation_result.h](C:\\Projects\\FileManager\\src\\operation_result.h) with phase, Win32/HRESULT codes, source/destination, retryability, partial-effect flags, and a legacy BOOL/error adapter. Migrated transactional copy paths in [async_copy.cpp](C:\\Projects\\FileManager\\src\\async_copy.cpp) while preserving existing dialog behavior. Added regression coverage in [NativeSafetyRegressionTests.cs](C:\\Projects\\FileManager\\tests\\FileManager.UiTests\\NativeSafetyRegressionTests.cs). Marked item 40 implemented in [refactoring.md](C:\\Projects\\FileManager\\refactoring.md). Verified: VS 2026 x64 Debug build: succeeded, 0 warnings/errors. New focused regression test: passed. The broader native-safety test group has four unrelated existing source-contract failures.
Implemented bounded, generation-aware icon work queues in [iconpool.h](C:\\Projects\\FileManager\\src\\iconpool.h) and [iconpool.cpp](C:\\Projects\\FileManager\\src\\iconpool.cpp). They now provide fixed-capacity backpressure, deduplication, visible-item priority/preemption, obsolete-generation cancellation, event-driven completion, safe shutdown joins, and queue metrics. Updated the refactoring ledger in [refactoring.md](C:\\Projects\\FileManager\\refactoring.md) and added regression coverage in [NativeSafetyRegressionTests.cs](C:\\Projects\\FileManager\\tests\\FileManager.UiTests\\NativeSafetyRegressionTests.cs). Verified: VS 2026 Debug x64 native build: succeeded, 0 warnings/errors. NativeSafetyRegressionTests: 30 passed. git diff --check: passed.
Bounded directory checkpoints every 256 entries, with cooperative yield/cancel probing. Capped retained panel metadata at 100,000 items; capped listings remain usable and show a localized explanation. Preserved the existing count-based/visible-range list rendering to avoid per-entry UI updates. Added million-entry synthetic budget coverage and marked item 51 implemented in [refactoring.md (line 338)](C:\\Projects\\FileManager\\refactoring.md:338). Verification passed: 32 native source-regression tests. VS 2026 Debug x64 ClCompile target, including fileswindow_navigation.cpp. The full Debug x64 build was attempted but remains blocked by an existing VS linker crash: LNK1000: IMAGE::EmitRelocations in the language project.
Added a 64 KiB emergency heap reserve, released atomically on first OOM. Persists a write-through memory-pressure recovery marker and routes an orderly forced-close request to the main window. Rejects queued and starting file operations once fatal memory pressure is active. Added regression coverage and marked item 52 implemented in [refactoring.md (line 344)](C:\\Projects\\FileManager\\refactoring.md:344). Verified: dotnet test ... --filter FullyQualifiedName~NativeSafetyRegressionTests — 33 passed. Visual Studio 2026 Debug x64 native build — succeeded, 0 warnings/errors.
- **Justification:** `src/common/allochan.cpp` serializes allocation failure handling and can display message boxes or sleep while the failing thread holds unrelated locks, creating deadlock and re-entrancy risks. - **Proposed solution:** Make the handler allocation-free and non-interactive: release the reserve, set an atomic fatal-pressure state, and notify the UI through a preallocated channel. Never loop indefinitely inside allocator recovery. - **Implementation:** `TaskscapeLtdNewHandler` now releases the 64 KiB reserve once, records fatal pressure atomically, and immediately returns failure. It no longer serializes callers, formats diagnostics, displays modal UI, sleeps, retries, or invokes recovery callbacks. The pre-registered `WM_USER_ALLOCATION_EMERGENCY` channel transfers journal persistence and the existing controlled-close request to the main UI thread. - **Verification:** `NativeSafetyRegressionTests.Allocation_emergency_is_noninteractive_and_defers_recovery_to_the_ui_thread` protects the reserve/state transition and window handoff while rejecting modal dialogs, sleeps, allocator-thread locking, and recovery callbacks.
- **Justification:** Much operational logging is debug-only, so field deadlocks and intermittent I/O failures lack the event sequence needed for diagnosis. - **Proposed solution:** Keep a low-overhead in-memory ring of sanitized operation transitions, waits, retries, and plug-in identities. Attach it to user-approved reports and allow local export. - **Implementation:** `release_diagnostics.cpp` provides a 128-entry, allocation-free ring with per-entry publication markers. Worker lifecycle, startup waits, copy retries, and plug-in DLL leaf names record only sanitized labels. The crash text report renders the ring before `End.` and writes a local `.OPS` sidecar, which Salmon packages/uploads only after the user selects **Send Report**. - **Verification:** `NativeSafetyRegressionTests.Release_diagnostic_ring_is_bounded_sanitized_and_reported_only_through_the_existing_consent_flow` pins the capacity, publication protocol, safe fields, producer coverage, report attachment, local-view documentation, project registration, and implemented ledger entry.
- **Justification:** Parallel copies, dialogs, callbacks, and retries otherwise produce ambiguous traces, especially after a crash or cancellation race. - **Proposed solution:** Generate an operation ID at command dispatch and propagate it through plan, worker, UI, journal, and log records. Include item sequence and attempt number. - **Implementation:** `COperations` creates an immutable process/tick/dispatch-sequence ID. Plans, worker startup/completion, visible progress-dialog titles, journals, and debug execution-log records retain that ID. The journal and logs also record each item sequence and initial or retried attempt; synchronous retry dialogs and automatic retry paths advance the attempt. - **Verification:** `FileOperationUiTests.Copy_file_persists_a_completed_recovery_journal_with_item_intent` checks durable plan/item correlation, and `NativeSafetyRegressionTests.File_operation_correlation_ids_cross_plan_worker_ui_journal_and_log_boundaries` pins every handoff.
- **Justification:** Repeated cleanup calls can overwrite `GetLastError`, while log-only failures lose the operation phase and affected path. - **Proposed solution:** Capture errors immediately into the explicit result type, append cleanup errors without replacing the primary cause, and present a copyable diagnostic summary. - **Implementation (2026-08-10):** `COperationResult` now retains the initial phase/error/path outcome and records up to two named cleanup failures as secondary evidence. Durable-copy verification captures its result before closing the target handle, so a close failure cannot replace an earlier metadata or size failure; retry cleanup likewise records a failed deletion of an unverified target. The existing progress dialog now renders a fixed-buffer phase/error/source/destination/effects summary after the localized error text; users can copy the whole message with its established Ctrl+C behavior. - **Verification:** `NativeSafetyRegressionTests.File_operation_failures_capture_the_primary_error_before_cleanup_and_offer_copyable_context` pins the cleanup phases, bounded append-only evidence, capture-before-close ordering, retry-cleanup recording, copyable dialog text, and this implementation ledger entry.
- **Justification:** Repeated cleanup calls can overwrite `GetLastError`, while log-only failures lose the operation phase and affected path. - **Proposed solution:** Capture errors immediately into the explicit result type, append cleanup errors without replacing the primary cause, and present a copyable diagnostic summary. - **Implementation (2026-08-10):** `COperationResult` now retains the initial phase/error/path outcome and records up to two named cleanup failures as secondary evidence. Durable-copy verification captures its result before closing the target handle, so a close failure cannot replace an earlier metadata or size failure; retry cleanup likewise records a failed deletion of an unverified target. The existing progress dialog now renders a fixed-buffer phase/error/source/destination/effects summary after the localized error text; users can copy the whole message with its established Ctrl+C behavior. - **Verification:** `NativeSafetyRegressionTests.File_operation_failures_capture_the_primary_error_before_cleanup_and_offer_copyable_context` pins the cleanup phases, bounded append-only evidence, capture-before-close ordering, retry-cleanup recording, copyable dialog text, and this implementation ledger entry.
- **Justification:** FTP, update, and report paths can block on DNS, connect, TLS, send, or receive while shutdown waits on their threads. - **Proposed solution:** Define phase-specific timeouts, propagate one cancellation token, close sockets/requests to interrupt blocking I/O, and distinguish timeout from authentication or protocol failure. - **Implementation:** CheckVer now applies 15-second DNS/connect and send deadlines plus a 30-second receive deadline to its WinINet session. Its single cancellation token closes the currently active session or URL handle, so dismissing the dialog or unloading the plug-in interrupts a blocked network phase instead of merely detaching its thread. The existing nonblocking FTP transport now names its DNS, TCP-connect, and FTP/TLS protocol deadlines separately, bounds the temporary blocking SChannel handshake with socket send/receive deadlines, and retains its established socket-close cancellation path plus distinct resolve/connect/reply errors. Salmon retains its bounded WinHTTP phases, now registers both the session and request against the upload token, closes both on cancellation, and reports timeout, authentication, and protocol/TLS failures distinctly. - **Verification:** `NativeSafetyRegressionTests.Network_operations_have_phase_deadlines_cancellation_and_failure_classification` pins the timeout settings, cancellation-handle closure, FTP phase boundaries, failure classification, and this implementation ledger entry.
- **Justification:** Network interruption and resume logic can leave a destination that looks complete but contains stale or duplicated bytes. - **Proposed solution:** Download to a side file with persisted remote identity/size/time, validate resume offsets and server responses, flush and atomically rename on success, and keep incomplete files clearly marked. - **Implementation:** Viewer/cache downloads now write to a sibling `.ftp-incomplete` file and a write-through `.meta` sidecar that records the remote host, path, name, byte size, and available last-write time. Only an exact metadata match, a binary transfer, and a staged length no greater than the remote size can issue `REST`; a refused response discards that prefix rather than appending to it. The staged file is flushed, checked against the expected size, and promoted with `MoveFileExW(MOVEFILE_REPLACE_EXISTING | MOVEFILE_WRITE_THROUGH)` only after the final FTP success response and data flush. Interrupted or validation-failed data stay marked as incomplete and the visible cache name is untouched. - **Verification:** `NativeSafetyRegressionTests.Ftp_downloads_stage_identity_validate_resume_and_publish_only_after_a_durable_commit` guards the persisted identity, binary-only resume offset check, `REST` response gate, append offset, size verification, write-through rename, incomplete suffix, and this ledger entry.
- **Justification:** Certificate checking exists, but resilience depends on binding any user exception to the intended host and certificate lifecycle rather than a broadly reusable approval. - **Proposed solution:** Store hostname, port, SPKI/certificate fingerprint, decision scope, and expiry; warn on change; and test hostname mismatch, expiry, chain failure, and renewed certificates. - **Implementation:** FTPS exceptions now use a bounded, synchronized plug-in store. Each decision records the case-insensitive hostname, control port, SHA-256 SPKI and leaf-certificate fingerprints, explicit session or remembered scope, and expiry. The dialog defaults to an eight-hour session exception; the new opt-in “Remember” checkbox persists a 30-day exception in the FTP profile immediately. A reused exception requires the exact host, port, SPKI, certificate fingerprint, and unexpired lifetime. An endpoint record with a changed or renewed certificate is logged as changed and falls back to the warning dialog; ordinary Windows chain and hostname validation still runs before any exception lookup. - **Verification:** `NativeSafetyRegressionTests.Ftp_certificate_exceptions_are_endpoint_bound_expiring_and_pinned` guards endpoint matching, fingerprint dual-pinning, scope/expiry persistence, chain-failure exception routing, renewed-certificate warning, and the implementation ledger. `SChannelTlsIntegrationTests` continues to verify that a self-signed chain fails without an explicit exception.
- **Justification:** The vendored 7-Zip version is 16.04, leaving years of parser, format, and robustness fixes unapplied in a component that handles untrusted archives. - **Proposed solution:** Move through supported releases with corpus differential tests, fuzz regression cases, and extraction compatibility snapshots before enabling the new version by default. - **Implementation:** Replaced the patched 16.04 source tree with upstream 7-Zip 26.02 and updated `7za.dll`, the crash-report `7zwrapper`, and the in-process `7zip.spl` COM callbacks to current interface conventions. The retryable input/output adapters now compose 26.02's final file streams, retaining the host retry prompts and stream capabilities. `src/plugins/7zip/doc/upgrade-26.02.md` pins the upstream artifact and records the mandatory corpus, fuzz, and extraction-snapshot gate for subsequent upgrades. - **Verification:** `NativeSafetyRegressionTests.Bundled_7zip_uses_26_02_and_preserves_upgrade_compatibility_contract` guards the version, source-integrity record, callback/stream compatibility seams, and build inputs. Visual Studio 2026 Debug x64 builds of the aggregate `7zip.vcxproj` succeeded with 0 warnings and 0 errors, producing `7zip.spl`.
- **Resolution:** Upgraded the verified SQLite amalgamation and public header from 3.28.0 to 3.53.4, recorded the archive and source SHA3-256 values, and made the durability/API-validation compile options explicit. The product currently has no owned SQLite database; its sole use reads Google Drive's configuration database with `SQLITE_OPEN_READONLY`, so it is deliberately outside FileManager recovery behavior. The vendor record defines the mandatory WAL, full-synchronous transaction, integrity-check, preservation, and explicit-recovery contract for any future owned database. - **Verification:** `tools/test-sqlite-recovery.ps1` runs against the Debug x64 `sqlite.dll` in CI. It verifies WAL settings, interruption of an uncommitted `BEGIN IMMEDIATE` transaction, reopen/integrity success for committed data, and integrity-check failure after a controlled b-tree-page corruption. `NativeSafetyRegressionTests.Bundled_sqlite_uses_a_verified_current_amalgamation_and_exercises_the_owned_database_recovery_contract` keeps the version, source ID, compile options, ownership boundary, recovery probe, and workflow hook from drifting.
- **Resolution:** Upgraded the direct-build zlib vendor source from 1.2.11 to 1.3.2, including the complete in-memory API source set. `src/common/dep/zlib/VENDOR.md` records the official archive, SHA-256, no-local-patch policy, and quarterly plus security-release review cadence. - **Verification:** `tools/test-zlib-compatibility.ps1` compiles the checked-in native sources and verifies both compression and decompression against the retained 1.2.11 vector. It also proves that the truncated, bad-checksum, and invalid-deflate regression fixtures are rejected, and runs in pull-request CI.
- **Resolution:** Updated the IE Viewer’s vendored cmark-gfm source to verified upstream 0.29.0.gfm.13. Markdown rendering explicitly retains cmark’s safe default, validates UTF-8, and rejects inputs above 1 MiB, trees above 100,000 nodes or 128 levels, and generated HTML above 4 MiB. The renderer passes its complete enabled extension list to cmark so `autolink`, `strikethrough`, `table`, `tagfilter`, and `tasklist` remain consistent at parse and render time. - **Verification:** `tools/test-cmark-gfm-hardening.ps1` compiles the production renderer with the vendored sources, checks retained output snapshots and unsafe-link/raw-HTML handling, exercises each extension combination with deterministic fuzz inputs, and proves input, nesting, and output-expansion limits. The x64 pull-request lane runs this probe and `NativeSafetyRegressionTests` guards the vendor, policy, artifacts, and CI hook.
- **Justification:** Vendored bzip2 1.0.6 dates from 2010 (`src/common/dep/bzip2/decompress.c:11`), increasing maintenance and parser risk. - **Proposed solution:** Update to the current maintained release or replace it behind the archive adapter, then run golden archives, truncation cases, and fuzz corpus replay. - **Implementation (2026-08-10):** Replaced the `BZ_NO_STDIO` vendored library source with verified upstream bzip2 1.0.8. The existing `CSalamanderBZIP2Abstract` streaming adapter remains the only host integration boundary. `src/common/dep/bzip2/VENDOR.md` pins the upstream SHA-512, no-local-patch policy, and review cadence. - **Verification:** `tools/test-bzip2-compatibility.ps1` compiles the checked-in parser sources and uses its streaming API to decode two golden archives, reject a truncation fixture, and replay five malformed-input fuzz fixtures. The Debug x64 pull-request lane runs the probe, while `NativeSafetyRegressionTests.Bundled_bzip2_uses_the_verified_release_and_replays_archive_parser_regressions` prevents the version, vendor record, adapter, corpus, or CI hook from drifting.
Implemented the 7‑Zip task-dispatch hardening in [7zthreads.cpp (line 318)](C:\\Projects\\FileManager\\src\\plugins\\7zip\\7zthreads.cpp:318). Replaced raw CreateThread/manual handle cleanup with CPluginThreadOwner. Added owned completion payload posting to the progress window. Added cooperative cancellation and a 5-second bounded shutdown diagnostic. Restores the prior progress-dialog procedure via a scope guard on all exits. Added a focused regression contract in [NativeSafetyRegressionTests.cs (line 474)](C:\\Projects\\FileManager\\tests\\FileManager.UiTests\\NativeSafetyRegressionTests.cs:474). Verified: Focused NUnit test: passed. Raw-thread creation ratchet: passed. VS 2026 Debug/x64 7‑Zip project build: passed, 0 warnings / 0 errors.
[compress.cpp (line 124)](/C:/Projects/FileManager/src/salmon/compress.cpp:124) now derives and canonically loads the bundled wrapper with constrained LoadLibraryExW; it no longer changes CWD or uses fixed mask/archive buffers. Compression uses an owned, cancellable CThreadOwner with correlation IDs and deadline-safe teardown. [dialogs.cpp (line 406)](/C:/Projects/FileManager/src/salmon/dialogs.cpp:406) joins compression before releasing dialog-owned parameters. Added focused regression coverage in [NativeSafetyRegressionTests.cs (line 436)](/C:/Projects/FileManager/tests/FileManager.UiTests/NativeSafetyRegressionTests.cs:436). Verified: Visual Studio 2026 Debug|x64 Salmon rebuild: 0 warnings, 0 errors. Focused native safety test: passed (1/1).
Added shared CFileOffsetResult and SalGetPluginFileSizeEx without changing the plug-in virtual ABI. CheckVer and NetHood now enforce their fixed-buffer caps from a checked 64-bit size. PE Viewer passes CQuadWord mapping sizes and explicitly rejects values its DWORD parser cannot represent. TAR preserves the 64-bit file size and avoids wrap-prone offset addition. Added maximum, successful 0xFFFFFFFF, over-cap, and failure regression cases. Verification passed: NativeSafetyRegressionTests: 52/52 Visual Studio 2026 Debug/x64 builds: host, CheckVer, PE Viewer, TAR, NetHood — all 0 warnings, 0 errors.
- **Delivered:** The plug-in SDK now adapts the existing success/error file-size ABI to `CFileOffsetResult`, preserving a successful `0xFFFFFFFF` low word. CheckVer and the NetHood `desktop.ini` scan reject only their explicit fixed-buffer caps before narrowing; PE Viewer carries a `CQuadWord` into its mapping boundary and rejects values its DWORD parser cannot represent; TAR preserves the 64-bit size and compares remaining input without wrap-prone offset addition. - **Verification:** `NativeSafetyRegressionTests.Plugin_readers_preserve_full_file_sizes_and_reject_only_their_explicit_caps` covers the maximum DWORD, successful sentinel value, over-cap, and failed-query cases and prevents raw `GetFileSize` from returning to these four readers.
# Conflicts: # tests/FileManager.UiTests/FileOperationUiTests.cs # tests/FileManager.UiTests/Infrastructure/FileOperationUiTestBase.cs # tests/FileManager.UiTests/Infrastructure/NativeCommands.cs # tests/FileManager.UiTests/NativeSafetyRegressionTests.cs # tests/FileManager.UiTests/obj/FileManager.UiTests.csproj.nuget.dgspec.json # tests/FileManager.UiTests/obj/FileManager.UiTests.csproj.nuget.g.props # tests/FileManager.UiTests/obj/project.assets.json # tests/FileManager.UiTests/obj/project.nuget.cache
This reverts commit b3722dd.
This reverts commit 668f0d5.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.