Explore Better v0.2.7

Explore Better v0.2.7

A security, data-safety, reliability and performance release from a full-codebase audit. Nothing is removed: every existing feature keeps working, including autonomous AI Bridge actions.

Security

• The desktop backend no longer hands its launch capability to HTTP clients; Electron installs it directly on its own session. Absolute-form request targets are rejected, the capability is compared in constant time, and raw file previews can no longer be loaded as scripts, workers, or stylesheets.
• File names can no longer inject commands: PowerShell quoting now doubles curly single quotes (U+2018–U+201B), cmd.exe quoting escapes %, and .cmd/.bat launches pass arguments verbatim.
• Integrated terminals no longer inherit the backend port, host, or capability. Prompt markers carry a per-session nonce, remote UNC folder markers are ignored, and the elevated terminal broker is bound to its launch arguments.
• AI Bridge: archive creation stays inside allowed roots, UNC paths outside roots are rejected before any network access, sync items and dangling links are authorized individually, and writes to Startup folders and MCP client configuration files are refused.
• Release builds install and compile without a repository write token, releases are gated on the full Windows CI, and MCP bundle checksums are attested.

File Safety

• Inline rename refuses to replace an existing item (case-only renames still work), and bulk rename can no longer overwrite a selected item whose name is unchanged.
• Failed copies keep their completed list, undo, and retry-remaining details. Retry keeps every remaining item instead of the first 500, and concurrent retries of the same operation are refused.
• Sync applies exactly the items it previewed, overwrite plans cannot replace a folder that contains a source, and same-named sources get unique names instead of blocking the transfer.
• Archive extraction stages into a hidden sibling folder, and partially created links and shortcuts can be undone.
• Large non-ASCII text saves, PowerShell output, native helper output, and clipboard paths are decoded as UTF-8 without corrupting characters split across chunks.
• The elevated delete helper removes junctions and symbolic links without following them.
• Explorer integration keeps the original shell backup, understands localized reg.exe output, writes UTF-16 .reg files, restores the shell default first during cleanup, and handles drive-root launches.
• Renderer saves send only changed fields, so labels and collections changed by the AI Bridge or during moves are no longer reverted.

Reliability

• Fixed size- and date-filtered searches never showing results, auto-refresh reload loops when a folder watcher is unavailable, Ctrl+W in the terminal closing its tab, stale native-drag drops, column resizing reversing the sort, and orphaned shells after restoring tab groups or layouts.
• Access-denied folders, missing Open With programs, locked or deleted preview files, and helper crashes no longer produce server errors or crash the backend. A crashed renderer reloads automatically.
• Folder and state watchers start from canonical long paths, so browsing a folder through an 8.3 short name (for example C:\PROGRA~1) no longer aborts the backend.
• Timed-out scripts stop making changes, custom command timeouts end the whole process tree, and folder watchers recover after errors.
• Background indexes keep links searchable without reading their targets, watch each root recursively, and reject unsafe root ids.

Performance

• Operation progress is persisted at most once per second (copying 1,000 files dropped from 111 s to 5 s), and the operations poll uses a lightweight endpoint.
• Disk Map reports exact allocation from directory metadata, counts hardlinks once, includes cloud and compressed files, handles long paths, and scans small files several times faster.
• Path autocomplete is debounced and cached, filtering reuses the sorted order, drive probes run in parallel with timeouts, and device inventory is cached.
• The installer's application archive is 18.8 MB smaller.

Accessibility

• Keyboard focus is visible on every button, icons remain visible in High Contrast, the context menu is fully keyboard operable, every dialog is named in markup, and reduced-motion preferences are honoured.

File Safety And Recovery

• Revalidate snapshot entries and directory membership after the complete traversal, including changes with unchanged timestamps. Undo from older text saves retains later edits while refusing to replace directories.
• Preserve UTF-16 content in direct and indexed search, return complete substring matches, skip linked descendants, and rebuild outdated background indexes automatically.
• Avoid repeated background rebuilds when hidden files are excluded, and report exhausted content budgets accurately.
• Save text through a staged replacement while preserving UTF-8, UTF-16LE, UTF-16BE and their byte-order marks. Undo restores the original bytes; unsupported encodings are rejected before writing.
• Build ZIP archives before replacing their destination, reject source/destination overlap, and retain recoverable backups in App Trash.
• Verify persisted source and destination snapshots before finishing an interrupted cross-volume move. Changed files remain intact and produce a recovery conflict.
• Journal bulk-rename mappings before each rename so recovery remains possible after restart. Same-volume moves use the fast rename path without walking the source tree first.

Interaction Reliability

• Keep drafts, focus, and terminals alive when Windows opens another folder or the backend recovers. Confirm unsaved changes on window close and finish cleanup before installing an update.
• Bound health checks even when the backend disconnects mid-response, and finish pending startup and native process shutdown before quitting.
• Prevent delayed searches, listings, comparisons, previews, and dialog Apply actions from overwriting newer work.
• Serialize terminal restart and close, avoid duplicate keyboard paste, bound early terminal events, and release exited ports.
• Preserve operation-control focus, label dialogs for screen readers, and correct STEP mesh normals.
• Preserve newer drafts when a save finishes, protect dirty dialogs through every close route, and keep focus stable during delayed row and terminal updates.
• Prefer the current Windows clipboard when pasting and clear completed cuts only while the app still owns that clipboard version.
• Bound filter-history memory and retain accessible position and focus information for virtualized file lists.
• Parse STL models in a worker and bound edge generation, keeping browsing responsive during model preparation.
• Cancel terminal creation when its owner closes, clean up sessions on reload, and wait for native exit during shutdown. Preserve percent signs in folder markers and quote administrator launch arguments correctly.
• Resolve each PowerShell profile's own modules first, preventing inherited module paths from stalling Windows PowerShell startup.
• Pin the native terminal component to node-pty@1.2.0-beta.14, which includes Microsoft's fix for concurrent Windows terminal exit races.

AI Bridge Reliability

• Preserve retained analysis policy bindings, cancel recursive inspection promptly, and recheck permissions after UI waits and allowed-root changes.
• Observe operation completion even when it happens during the initial status read, and show current authorized progress when a wait times out.
• Bound resource subscriptions and individual transport frames, serialize subscription state, and clean up interrupted bridge startup and staged files.
• Preserve existing profiles when configuration reads fail, and require successful backup before replacing malformed configuration.
• Recheck current permissions when applying previews, controlling operations, reading retained results, and dispatching actions against implicit UI targets. Permission changes invalidate old previews; collection mutations check existing contents too.
• Keep explicit empty client roots restrictive and fail requests when supported root discovery fails. Serialize configuration updates so concurrent changes preserve revocations.
• Preserve Unicode across pipe chunks, validate protocol frames, propagate cancellation, and count analysis workers until they actually stop.
• Bound retained analysis data and responses, stop pagination when scan budgets are exhausted, and decode text pages using the file's encoding.
• Preserve unrelated client configuration formatting and detect concurrent edits before replacement. Registry publication now uses verified, immutable assets from an explicit published release.

Live Disk Analysis

• Starts scanning when Disk Map or Analyzer opens and when its target changes, with no entry limit by default.
• Streams native scan progress into the totals, tables, and treemap while keeping file summaries bounded.
• Defaults disk maps to allocated size, preserves zero allocation for sparse files, and accounts for volume use that cannot be enumerated.
• Keeps map header controls clickable and supports cancellation, warm scan reuse, and explicit partial scan limits.

Maintenance

• Cancel native filesystem work when its parent closes the transport, and preserve Windows timestamps outside the nanosecond conversion range.
• Update the compatible YAML parser pin to 4.3.2 and correct landing-page clipboard failure feedback and focus restoration.
• Make native binaries reproducible across Windows checkouts, preserve prior binaries on failed build publication, and update Pages deployment actions to Node 24.
• Updated vulnerable dependency patches, including the pinned YAML parser, and excluded local editor state and backup files from version control.
• Preserves path edits during pane refreshes and keeps drive buttons at a readable minimum width.

Local STL And STEP Preview

• Added interactive 3D previews for .stl, .step, and .stp files in both the Preview inspector and the large Viewer.
• Keeps an unchanged model canvas alive across selection and folder refreshes, and ignores repeat clicks on the active Viewer item, eliminating unnecessary flashes, refetches, and WebGL reconstruction.
• Added orbit, pan, wheel and button zoom, fit, isometric/front/top views, edge toggling, dimensions, mesh counts, and triangle counts.
• Tessellates STEP geometry locally in a dedicated OpenCascade WebAssembly worker; model files never leave the device, and the main app retains its stricter script policy.
• Lazy-loads the 736 KB 3D renderer only after the first model selection and loads the 7.3 MB CAD engine only for STEP, keeping the normal application runtime at 567 KB.
• Cancels stale loads and disposes workers, geometry, materials, observers, and WebGL contexts when changing models or closing Viewer. Files above 100 MB receive an explicit bounded fallback.
• Packages the CAD runtime and complete Three.js/OpenCascade license notices for offline and release builds.

ZIP Extraction

• Added Extract Here directly to the right-click menu for ZIP files.
• Changed the Archive dialog's extraction target to the folder containing the selected ZIP instead of the opposite pane, with an explicit Here shortcut to restore that target.
• Keeps extraction safe and undoable by creating a sibling folder named after the archive rather than scattering files into an existing folder.
• Made long right-click menus vertically scrollable so lower actions remain reachable on shorter windows.

Compact Tab Overflow

• Replaced the native horizontal scrollbar in crowded pane headers with compact 68 px minimum tabs and measured overflow—no tab buttons remain off-canvas.
• Keeps the active tab visible automatically and moves only the tabs that do not fit into an accessible numbered menu with the complete tab name and path.
• Preserves tab closing, locking, dragging, keyboard cycling, new-tab access, pane activity, and source/target labels in the same 40 px header row.

Verification

• Added a real-browser STL/STEP suite with 15/15 passing checks across packaged runtime assets/licenses, API classification, list metadata, inspector and Viewer rendering, stable unchanged-model refreshes, every view control, worker output, dimensions/statistics, WebGL replacement/disposal, and clean browser/API diagnostics.
• Kept startup verification at 12/12 and the focused performance guard at 20/20 with no regression watch items after separating the model runtime.
• Added an end-to-end ZIP fixture that verifies the right-click label, containing-folder dialog default, safe sibling output, journaled completion, visible outcome, and protection against accidental opposite-pane extraction.
• Expanded pane-layout coverage to create 13–28 tabs at 1100, 1360, and 1500 px and verify fixed header height, hidden scrollbar chrome, active-tab visibility, complete overflow-menu contents, viewport-safe positioning, Escape dismissal, and focus restoration.

Downloads

• Windows x64 per-user installer (unsigned preview; SmartScreen will warn about an unknown publisher)
• MCPB package and SHA-256 manifests, with GitHub build-provenance attestations
• Installer SHA-256: 6dbcdbaa72502b7aa196af62be887b051426735f3548f5e237c6cb703a3943d2

Verify before installing:

Get-FileHash .\ExploreBetter-0.2.7-x64-setup.exe -Algorithm SHA256