FileLocker v1.3.0

FileLocker v1.3.0

繁體中文

新增資料夾防護閒置自動重新上鎖、CLI 靜默批次模式，以及背景模式（系統匣常駐＋跟隨 Windows 啟動）。

亮點

• 資料夾防護：新增閒置逾時自動重新上鎖
  • 解鎖之後如果忘記手動重新上鎖，預設 15 分鐘（可調整）閒置後會自動重新上鎖，避免防護形同虛設。啟動時會補跑一次（涵蓋上次關閉前忘記重新上鎖、重開機後才發現已經過期的情境），之後每 60 秒輪詢一次。
• CLI：新增靜默批次模式
  • 給指令碼／排程工作用的非互動模式：新增 --password-stdin（從標準輸入讀密碼，避免密碼留在 shell 歷史紀錄）、--password-file、--recovery-key、--hint、--yes（略過確認提示）幾個旗標，搭配結構化的結束碼（0 成功／1 用法錯誤／2 批次部分或全部失敗／3 使用者取消），方便呼叫端判斷執行結果。
• 新增背景模式（系統匣常駐＋跟隨 Windows 啟動）
  • 「關閉視窗後留在系統匣」與「跟著 Windows 啟動」是兩個獨立開關，切換任一個都會立刻生效，不用重開 App。
  • 系統匣右鍵選單改用自製的圓角彈出視窗（原本用 Windows 內建元件套用圓角時，角落會有殘影），外觀更貼近現代系統匣應用程式。
  • 修正已經在系統匣裡的 FileLocker 被再次雙擊執行檔時，視窗不會跳到前景的問題。
• 文件：新增密碼庫（Password Locker）功能的完整規劃文件與相關術語定義（FileLocker_密碼庫_功能規劃.md、CONTEXT.md、docs/adr/），這是下一階段要實作的功能，這次發布本身不包含任何密碼庫的實際功能。

已知限制

• 背景模式（系統匣常駐）下，主視窗與系統匣選單的實際彈出位置有時不如預期（可能出現在螢幕角落而非預期位置），不影響功能本身可以正常開啟與操作，僅彈出位置不理想；根因排查中。
• 資料夾防護的「使用 .lockfolder 開啟上鎖資料夾」預設關閉，開啟後 .lockfolder 標記檔會讓資料夾在「依檔案類型分組」檢視下跟真正的資料夾分開排列，這是接受的設計取捨，不是 bug。
• 安裝程式仍未申請數位簽章，執行安裝檔或更新下載回來的安裝檔時，Windows SmartScreen 可能會跳出警告，點「其他資訊」→「仍要執行」即可繼續。
• 軟體更新檢查需要能連上 GitHub（api.github.com），且僅支援透過正式安裝版比對版本；直接以原始碼執行的開發版不會顯示版本資訊。
• 密碼遺失無法復原，沒有任何後門機制——請務必妥善保存密碼與恢復金鑰。

---

English

Added Folder Guard idle-timeout auto-relock, a CLI silent batch mode, and background mode (minimize to tray + launch at startup).

Highlights

• Folder Guard: idle-timeout auto-relock
  • If you forget to manually relock a folder after unlocking it, it now relocks itself automatically after 15 minutes of idle time by default (configurable), so protection doesn't quietly lapse. A catch-up pass runs on startup (covering the case where the app was closed before the timeout fired), and a timer polls every 60 seconds afterward.
• CLI: silent batch mode
  • A non-interactive mode for scripts and scheduled jobs: new --password-stdin (read the password from standard input, keeping it out of shell history), --password-file, --recovery-key, --hint, and --yes (skip confirmation prompts) flags, paired with structured exit codes (0 success / 1 usage error / 2 partial or total batch failure / 3 cancelled) so callers can act on the result programmatically.
• New: background mode (minimize to tray + launch at startup)
  • "Stay in the system tray when the window closes" and "Launch at Windows startup" are two independent toggles; flipping either takes effect immediately without restarting the app.
  • The tray icon's right-click menu now uses a custom rounded popup window instead of the built-in Windows control (which showed visual ghosting artifacts around the rounded corners), giving it a look closer to modern tray applications.
  • Fixed an issue where double-clicking the executable while FileLocker was already running in the tray would not bring the window to the foreground.
• Docs: added a complete planning document and terminology for the upcoming Password Locker feature (FileLocker_密碼庫_功能規劃.md, CONTEXT.md, docs/adr/) — this is planning for the next phase of work; this release does not include any actual Password Locker functionality.

Known limitations

• In background mode, the main window and tray menu don't always pop up exactly where expected (occasionally in a screen corner) — this doesn't affect the app opening or working normally, only where it visually appears; the root cause is still being investigated.
• Folder Guard's "Open locked folders with a .lockfolder file" is disabled by default; when enabled, the .lockfolder marker file sorts separately from the real folder under Explorer's "group by file type" view — this is an accepted design trade-off, not a bug.
• The installer still isn't code-signed — Windows SmartScreen may warn when running the installer or an update package you just downloaded; click "More info" → "Run anyway" to continue.
• The update check requires reaching GitHub (api.github.com) and only works from an installed build; running from source shows no version info.
• A lost password cannot be recovered — there is no backdoor. Keep your password and recovery key safe.

FileLocker v1.2.0

FileLocker v1.2.0

繁體中文

重做資料夾防護的「雙擊上鎖資料夾直接解鎖」機制，脫離實驗性階段；連帶調整介面文字與排版。

亮點

• 資料夾防護：「使用 .lockfolder 開啟上鎖資料夾」重新設計並脫離實驗性階段
  • v1.1.0 推出時的技術路線是自訂 Shell Namespace Extension（IShellFolder + desktop.ini 的 CLSID2），實測會造成 explorer.exe 整個行程死結，需要重開機才能解除，因此當時預設關閉、暫緩投入。這次改用跟 .locked 相同、已證明穩定的檔案關聯機制：開啟這個進階選項後，鎖定資料夾時會在同一層額外建立一個 .lockfolder 標記檔，雙擊它會直接跳出解鎖確認視窗，不需要先開啟 FileLocker，也不會先看到 Windows 原生的「存取被拒」畫面。
  • 資料夾本身完全不受影響，全程維持完整的 ACL 拒絕權限保護，不像先前的技術路線需要為了讓資料夾可瀏覽而降低保護強度。
  • 解鎖成功後會自動用檔案總管開啟該資料夾，不用再手動導覽過去。
  • .lockfolder 換上專屬圖示（不再借用主程式圖示）。
  • 這個選項預設仍是關閉狀態，需要在資料夾防護設定頁手動開啟；已知取捨是 .lockfolder 標記檔會讓資料夾在檔案總管「依檔案類型分組」檢視下跟真正的資料夾分開排列。
• 介面文字與排版：進階開關的說明提示（滑鼠移過「i」圖示跳出的內容）原本是一整段擠在窄欄位裡的長句，這次拆成前言＋條列重點並加寬欄位，不再是一大片文字牆；「使用說明」彈窗的資料夾防護章節同樣補上這個選項的說明，並拆成多個段落，不再是擠成一團的長句。
• 打包設定：安裝程式圖示改用正式品牌圖示（icon.png／icon.ico／Locked_File.ico），取代先前打包時暫用的圖示。
• 技術規格文件：依專案撰寫規範重新整理，已知限制與待辦事項統一移到文件最末尾兩個獨立章節。

已知限制

• 資料夾防護的「使用 .lockfolder 開啟上鎖資料夾」預設關閉，開啟後 .lockfolder 標記檔會讓資料夾在「依檔案類型分組」檢視下跟真正的資料夾分開排列，這是接受的設計取捨，不是 bug。
• 安裝程式仍未申請數位簽章，執行安裝檔或更新下載回來的安裝檔時，Windows SmartScreen 可能會跳出警告，點「其他資訊」→「仍要執行」即可繼續。
• 軟體更新檢查需要能連上 GitHub（api.github.com），且僅支援透過正式安裝版比對版本；直接以原始碼執行的開發版不會顯示版本資訊。
• 密碼遺失無法復原，沒有任何後門機制——請務必妥善保存密碼與恢復金鑰。

---

English

Reworked Folder Guard's "double-click to unlock a locked folder" mechanism and moved it out of the experimental stage; interface text and layout were also refined.

Highlights

• Folder Guard: "Open locked folders with a .lockfolder file" redesigned and no longer experimental
  • The v1.1.0 implementation used a custom Shell Namespace Extension (IShellFolder + desktop.ini's CLSID2), which was found to cause a full explorer.exe deadlock requiring a reboot to clear — so it shipped disabled by default and development was paused. This release switches to the same file-association mechanism already proven stable for .locked: with this advanced option enabled, locking a folder also creates a companion .lockfolder marker file next to it — double-clicking that file pops up the unlock confirmation directly, without opening FileLocker first or hitting Windows' native "Access Denied" screen.
  • The folder itself is completely unaffected and keeps full ACL deny-rule protection throughout — unlike the previous approach, which had to weaken protection to keep the folder browsable.
  • The folder now opens automatically in File Explorer once unlocked, no manual navigation needed.
  • .lockfolder now has its own dedicated icon instead of borrowing the main app's icon.
  • The option is still disabled by default and must be turned on from the Folder Guard settings page. Known trade-off: the .lockfolder marker file sorts separately from the real folder under Explorer's "group by file type" view.
• Interface text and layout: the advanced toggle's info tooltip (hovering the "i" icon) used to cram one long sentence into a narrow box; it's now split into an intro line plus bullet points in a wider box, no longer a wall of text. The Folder Guard section of the in-app Help dialog was likewise updated to cover this option and broken into multiple paragraphs instead of one dense block.
• Packaging: the installer now uses the official brand icons (icon.png / icon.ico / Locked_File.ico) instead of the placeholder icons used in earlier packaging.
• Technical spec document: restructured per the project's documentation conventions, with known limitations and to-do items consolidated into two dedicated sections at the end of the document.

Known limitations

• Folder Guard's "Open locked folders with a .lockfolder file" is disabled by default; when enabled, the .lockfolder marker file sorts separately from the real folder under Explorer's "group by file type" view — this is an accepted design trade-off, not a bug.
• The installer still isn't code-signed — Windows SmartScreen may warn when running the installer or an update package you just downloaded; click "More info" → "Run anyway" to continue.
• The update check requires reaching GitHub (api.github.com) and only works from an installed build; running from source shows no version info.
• A lost password cannot be recovered — there is no backdoor. Keep your password and recovery key safe.

FileLocker v1.1.2

FileLocker v1.1.2

繁體中文

CLI 正式隨安裝程式一起發布並加入系統 PATH。

亮點

• CLI 隨裝發布（全新）：FileLocker.Cli 現在會一起打包進安裝內容（獨立的 cli/ 子資料夾，不跟 GUI 混在同一層），並透過安裝程式加入系統 PATH，安裝完成後可以直接在任何終端機打 FileLocker.Cli --encrypt／--list 等指令，不需要自己找路徑。

已知限制

• 資料夾防護的「雙擊已上鎖資料夾直接解鎖」仍是實驗性功能，預設關閉：實測曾經在特定情境下造成 explorer.exe 整個行程死結（需重開機才能解除），程式碼保留但暫不繼續開發測試。
• CLI 不涵蓋 Passkey（設計決定），未來若要支援應為獨立指令。
• 安裝程式仍未申請數位簽章，執行安裝檔或更新下載回來的安裝檔時，Windows SmartScreen 可能會跳出警告，點「其他資訊」→「仍要執行」即可繼續。
• 密碼遺失無法復原，沒有任何後門機制——請務必妥善保存密碼與恢復金鑰。

---

English

The CLI now ships with the installer and is added to the system PATH.

Highlights

• CLI ships with the installer (new): FileLocker.Cli is now packaged into the installer content (its own cli/ subfolder, kept separate from the GUI) and added to the system PATH by the installer — after installing, you can run FileLocker.Cli --encrypt / --list etc. from any terminal without hunting for the path yourself.

Known limitations

• Folder Guard's "double-click a locked folder to unlock directly" is still an experimental feature, disabled by default: it was found to cause a full explorer.exe deadlock (requiring a reboot to clear) under certain conditions during testing. The code stays in the repo but isn't under active development for now.
• The CLI doesn't cover Passkey (a design decision); if support is added later it should be a separate command.
• The installer still isn't code-signed — Windows SmartScreen may warn when running the installer or an update package you just downloaded; click "More info" → "Run anyway" to continue.
• A lost password cannot be recovered — there is no backdoor. Keep your password and recovery key safe.

FileLocker v1.1.1

FileLocker v1.1.1

繁體中文

CLI 正式隨安裝程式一起發布並加入系統 PATH，並修正資料夾防護在背景執行時的兩個崩潰/誤判問題。

亮點

• CLI 隨裝發布（全新）：FileLocker.Cli 現在會一起打包進安裝內容（獨立的 cli/ 子資料夾，不跟 GUI 混在同一層），並透過安裝程式加入系統 PATH，安裝完成後可以直接在任何終端機打 FileLocker.Cli --encrypt／--list 等指令，不需要自己找路徑。
• 資料夾防護：修正背景執行時右鍵完全無反應：FileLocker 已經在背景執行時，右鍵「上鎖」／「解鎖」原本完全沒有反應——負責轉送這次動作的行程會在轉送完畢後嘗試釋放一個自己從未持有的系統鎖而當掉，現在已修正，並補上讓確認小視窗確實跳到最前面的處理（背景行程原本無法自行搶回前景焦點）。
• 資料夾防護：修正右鍵選單鎖定狀態誤判：右鍵選單原本無法正確判斷資料夾是否已上鎖（位元遮罩算錯，永遠判定成「未鎖定」，導致解鎖選項不會出現），已修正，並改成單一來源、執行期讀取，避免之後又漂移出錯。

已知限制

• 資料夾防護的「雙擊已上鎖資料夾直接解鎖」仍是實驗性功能，預設關閉：實測曾經在特定情境下造成 explorer.exe 整個行程死結（需重開機才能解除），程式碼保留但暫不繼續開發測試。
• CLI 不涵蓋 Passkey（設計決定），未來若要支援應為獨立指令。
• 安裝程式仍未申請數位簽章，執行安裝檔或更新下載回來的安裝檔時，Windows SmartScreen 可能會跳出警告，點「其他資訊」→「仍要執行」即可繼續。
• 密碼遺失無法復原，沒有任何後門機制——請務必妥善保存密碼與恢復金鑰。

---

English

The CLI now ships with the installer and is added to the system PATH; two Folder Guard crash/misdetection issues during background operation are also fixed.

Highlights

• CLI ships with the installer (new): FileLocker.Cli is now packaged into the installer content (its own cli/ subfolder, kept separate from the GUI) and added to the system PATH by the installer — after installing, you can run FileLocker.Cli --encrypt / --list etc. from any terminal without hunting for the path yourself.
• Folder Guard: fixed right-click doing nothing while running in the background: right-click Lock/Unlock did nothing while FileLocker was already running in the background. The process that forwards the click to the running instance used to crash right after forwarding (releasing a system lock it never owned), and the confirmation window couldn't reliably grab foreground focus from a background process either — both are now fixed.
• Folder Guard: fixed the context menu misreading lock state: the context menu couldn't correctly tell whether a folder was already locked (a miscalculated bitmask always evaluated to "not locked," so "Unlock" never appeared) — fixed, and moved to a single source read at runtime so it can't drift out of sync again.

Known limitations

• Folder Guard's "double-click a locked folder to unlock directly" is still an experimental feature, disabled by default: it was found to cause a full explorer.exe deadlock (requiring a reboot to clear) under certain conditions during testing. The code stays in the repo but isn't under active development for now.
• The CLI doesn't cover Passkey (a design decision); if support is added later it should be a separate command.
• The installer still isn't code-signed — Windows SmartScreen may warn when running the installer or an update package you just downloaded; click "More info" → "Run anyway" to continue.
• A lost password cannot be recovered — there is no backdoor. Keep your password and recovery key safe.

FileLocker v1.1.0

FileLocker v1.1.0

繁體中文

新增「資料夾防護」與「軟體更新檢查」兩項功能，並修正多處介面細節。

亮點

• 資料夾防護（全新功能）：獨立於加密之外的第二種保護方式，純粹透過 Windows 存取權限（ACL）限制資料夾，不加密內容——只能防止普通人隨手點開，無法防止蓄意繞過權限的人存取，重要資料仍建議使用「加密」。
  • 檔案總管右鍵可直接對資料夾「上鎖」與「解鎖」；首次使用需先設定共用密碼，之後可另外啟用 Passkey 快速解鎖。已上鎖的資料夾右鍵選單會改顯示「解鎖」，同一個入口進出，不用額外記兩套操作。
  • 獨立分頁統一管理所有上鎖中的資料夾：可個別解鎖、一次全部解鎖；已解鎖項目可「前往資料夾」直接開啟總管，或「再次上鎖」恢復保護。
  • 加密流程偵測到選取範圍內含正在上鎖的資料夾時，會先提示解鎖再繼續，避免漏掉裡面的內容。
  • Passkey 已設定時，解鎖／停用一律只認 Passkey，不會自動退回密碼；設定頁另外提供「停用 Passkey」（保留密碼），作為 Passkey 硬體異常時的逃生門，避免使用者被鎖死。
  • 忘記密碼、Passkey 也無法使用時，仍可透過檔案總管「內容→安全性→進階」手動拿回資料夾存取權——這不是加密，沒有無法復原的風險。
  • FileLocker 已在背景執行時，右鍵「上鎖」／「解鎖」原本完全沒有反應：轉送這次動作的行程會在轉送完畢後嘗試釋放一個自己從未持有的系統鎖而當掉，現在已修正，並補上讓確認小視窗確實跳到最前面的處理（背景行程原本無法自行搶回前景焦點）。
  • 右鍵選單原本無法正確判斷資料夾是否已上鎖（位元遮罩算錯，永遠判定成「未鎖定」，導致解鎖選項不會出現），已修正。
• 軟體更新檢查（全新功能）：設定頁可一鍵檢查是否有新版本，發現更新會自動跳出彈窗，內容是 GitHub Release 說明的 Markdown 渲染結果（獨立可捲動框框，不會撐爆版面）；確認後直接下載安裝檔並啟動安裝程式，安裝程式成功啟動才會關閉 FileLocker 本體，避免安裝時檔案被鎖住而失敗。
• 正式安裝程式：對接 mac-style-windows-installer 已完成並可用，含 .locked 副檔名關聯與圖示、解除安裝程式。
• 使用說明：補上「資料夾防護」章節，說明功能定位與操作方式。
• 介面細節修正：解密／資料夾防護等多處密碼欄位補上「顯示/隱藏密碼」切換；資料夾防護清單版面重新調整，欄位寬度與按鈕對齊問題一併修正。

已知限制

• 「資料夾防護」的右鍵選單項目需要重新編譯過的 Shell Extension（FileLockerShellExtension.dll）才會出現；如果是從舊版直接更新、右鍵選單還沒看到「鎖定資料夾」，通常是因為系統上還在使用舊版右鍵選單登錄，重新安裝最新版本、必要時重新啟動檔案總管即可。
• 資料夾防護的「雙擊已上鎖資料夾直接解鎖」是實驗性功能，預設關閉：實測曾經在特定情境下造成 explorer.exe 整個行程死結（需重開機才能解除），程式碼保留但暫不繼續開發測試。
• 軟體更新檢查需要能連上 GitHub（api.github.com），且僅支援透過正式安裝版（含 installer_config.json）比對版本；直接以原始碼執行的開發版不會顯示版本資訊。
• 安裝程式仍未申請數位簽章，執行安裝檔或更新下載回來的安裝檔時，Windows SmartScreen 可能會跳出警告，點「其他資訊」→「仍要執行」即可繼續。
• 密碼遺失無法復原，沒有任何後門機制——請務必妥善保存密碼與恢復金鑰。

---

English

Adds two new features — Folder Guard and software update checking — plus several interface refinements.

Highlights

• Folder Guard (new): a second, separate protection method alongside encryption — it restricts a folder purely through Windows access permissions (ACL) without encrypting its contents. It only stops casual browsing, not a determined attacker bypassing permissions; use Encrypt for anything truly sensitive.
  • Right-click a folder in File Explorer to lock or unlock it directly. The first time you use it, set a shared password; afterward you can optionally enable Passkey for quick unlocking. Once a folder is locked, the same context menu entry switches to "Unlock" — one entry point for both directions.
  • A dedicated tab manages all locked folders: unlock individually or all at once. Unlocked entries can be opened directly in Explorer via "Open Folder," or re-locked with "Lock Again."
  • If an encryption request includes a folder that contains locked sub-folders, you'll be prompted to unlock them first so nothing inside gets skipped.
  • Once Passkey is enabled, unlocking and disabling only accept Passkey — there's no automatic fallback to the password. Settings includes a standalone "Disable Passkey" option (keeping the password) as an escape hatch if the Passkey hardware ever stops working, so you're never locked out.
  • If you forget the password and Passkey isn't available either, you can still manually reclaim access via Explorer's Properties → Security → Advanced — this isn't encryption, so there's no unrecoverable risk.
  • Fixed: right-click Lock/Unlock did nothing while FileLocker was already running in the background. The process that forwards the click to the running instance used to crash right after forwarding (releasing a system lock it never owned), and the confirmation window couldn't reliably grab foreground focus from a background process either — both are now fixed.
  • Fixed: the context menu couldn't correctly tell whether a folder was already locked (a miscalculated bitmask always evaluated to "not locked," so "Unlock" never appeared).
• Software update check (new): check for updates from Settings with one click. When a new version is found, a dialog pops up automatically showing the GitHub release notes rendered as Markdown in a scrollable box (so long notes never overflow the dialog). Confirming downloads the installer and launches it directly — FileLocker only closes itself once the installer has actually started, so installation won't fail from locked files.
• Official installer: packaging via mac-style-windows-installer is complete and in use, including the .locked file association/icon and an uninstaller.
• Help: added a Folder Guard section explaining what it is and how to use it.
• Interface polish: added show/hide password toggles to several password fields (decrypt, Folder Guard setup, etc.); reworked the Folder Guard list layout, fixing column widths and button alignment.

Known limitations

• The Folder Guard right-click menu item requires a rebuilt Shell Extension (FileLockerShellExtension.dll). If you updated from an older version and don't see "Lock Folder" in the context menu, your system is likely still using the old registered menu — reinstalling the latest version (and restarting Explorer if needed) resolves this.
• Folder Guard's "double-click a locked folder to unlock directly" is an experimental feature, disabled by default: it was found to cause a full explorer.exe deadlock (requiring a reboot to clear) under certain conditions during testing. The code stays in the repo but isn't under active development for now.
• The update check requires reaching GitHub (api.github.com) and only works from an installed build (one that has installer_config.json); running from source shows no version info.
• The installer still isn't code-signed — Windows SmartScreen may warn when running the installer or an update package you just downloaded; click "More info" → "Run anyway" to continue.
• A lost password cannot be recovered — there is no backdoor. Keep your password and recovery key safe.

FileLocker v1.0.0

FileLocker v1.0.0

繁體中文

FileLocker 第一個正式版本。Windows 檔案／資料夾加密工具：檔案總管右鍵加密，內容集中存放到 Vault，原位置留下 .locked 指標檔；密碼、Passkey（Windows Hello）、恢復金鑰三種互相獨立的解鎖方式。

亮點

• 加密引擎：Argon2id 金鑰衍生 + AES-256-GCM 串流分塊加密，大型檔案/資料夾不需要整份讀進記憶體。
• 三種解鎖方式：密碼（必要）、Passkey（TPM 保護的裝置金鑰）、恢復金鑰（一次性顯示的備援代碼），三者互相獨立，各自只包裝內容金鑰,不影響彼此。
• 資料夾加密：先封裝成 zip 再走同一套檔案加密流程，完整性以整包 AEAD 單元保證；巢狀 .locked 項目會被記錄並在刪除外層紀錄時擋下，避免使用者失去追蹤線索。
• 右鍵選單批次操作：C++ COM Shell Extension 支援多選檔案/資料夾一次加密；App 啟動時自我檢查並修復右鍵選單登錄，不需要安裝程式介入。
• CLI：--encrypt／--unlock／--unlock-recovery／--list／--delete，支援批次操作與 FILELOCKER_VAULT_PATH 環境變數，方便無 GUI 環境使用。
• 關鍵操作驗證：清除使用紀錄、停用保護機制、搬移 Vault 等破壞性操作可設定 Windows Hello 驗證門檻。
• 雲端同步：Vault 位置可指向 OneDrive／Dropbox／Google Drive 等既有同步資料夾，同步軟體只會看到密文，達到零知識跨裝置備份。
• GUI：WebView2 + Vue 3 前端，macOS 風格無邊框視窗、深色模式、拖放檔案、加密精靈進度動畫。
• 多語言：繁體中文／英文雙語介面，含後端錯誤代碼翻譯。
• 安全性強化：明文安全清除（覆寫後刪除）、密碼錯誤指數退避鎖定、.locked 指標檔 HMAC-SHA256 簽章防竄改、Vault 設定檔 ACL 限制、Vault 相關檔案原子寫入。

已知限制

• 安裝程式已透過我的另一個專案 mac-style-windows-installer 打包完成並發布在本專案的 GitHub Releases，但尚未申請數位簽章，第一次執行時 Windows SmartScreen 可能會跳出警告，點「其他資訊」→「仍要執行」即可繼續安裝。
• .locked 副檔名的檔案總管圖示關聯待安裝程式階段接入。
• 雲端同步情境僅完成自動化測試，跨裝置人工實測待使用者自行進行。
• CLI 尚未納入安裝包（獨立建置產物）；Passkey 因需要跳出系統 UI，與命令行工具定位衝突，故不在 CLI 中提供。
• 密碼遺失無法復原，沒有任何後門機制——請務必妥善保存密碼與恢復金鑰。

---

English

The first stable release of FileLocker — a Windows file/folder encryption tool. Right-click to encrypt from File Explorer; content moves into a centrally managed Vault, leaving a .locked marker file behind. Three independent unlock methods: password, Windows Hello passkey, and recovery key.

Highlights

• Encryption engine: Argon2id key derivation + chunked, streaming AES-256-GCM — large files and folders are never fully loaded into memory.
• Three unlock methods: password (required), passkey (TPM-backed device key), and a one-time-shown recovery key — each independently wraps the content key, so none of them affect the others.
• Folder encryption: folders are zipped and run through the same file-encryption pipeline, with integrity guaranteed as a single AEAD unit; nested .locked items are tracked and block deletion of the containing record so users don't lose track of what's inside.
• Batch context-menu operations: a C++ COM Shell Extension supports encrypting multiple files/folders at once; the app self-checks and repairs its context-menu registration on every launch, no installer step required.
• CLI: --encrypt / --unlock / --unlock-recovery / --list / --delete, with batch support and a FILELOCKER_VAULT_PATH environment variable for headless environments.
• Critical action verification: destructive operations (clearing history, disabling protection, moving the Vault) can require a Windows Hello check.
• Cloud sync: point the Vault at an existing OneDrive/Dropbox/Google Drive sync folder — the sync client only ever sees ciphertext, giving zero-knowledge cross-device backup.
• GUI: WebView2 + Vue 3 frontend, macOS-style borderless window, dark mode, drag & drop, and an animated encryption wizard.
• Bilingual: Traditional Chinese and English UI, including translated backend error codes.
• Hardening: secure plaintext erasure (overwrite then delete), exponential-backoff password lockout, HMAC-SHA256-signed .locked markers, ACL-restricted Vault config, atomic writes for all Vault-related files.

Known limitations

• The installer is packaged with my other project mac-style-windows-installer and published on this repo's GitHub Releases, but it isn't code-signed yet — Windows SmartScreen may warn on first run; click "More info" → "Run anyway" to continue.
• The .locked file-association icon isn't wired up yet — pending the installer stage.
• Cloud-sync scenarios have automated test coverage only; manual cross-device testing is still pending.
• The CLI isn't bundled into the installer yet (separate build artifact); passkey requires system UI, which conflicts with the CLI's command-line-only design, so it isn't offered there.
• A lost password cannot be recovered — there is no backdoor. Keep your password and recovery key safe.