Bugfix: an encrypted 7z now refuses honestly as "not supported" instead of "damaged archive"

With `sevenz-rust2`'s `aes256` feature off (it conflicts with `smb2`'s pinned `aes` pre-release), an AES-encrypted 7z has an unrecognized coder, so the crate returns `UnsupportedCompressionMethod("AES256_SHA256")` — at open (`ArchiveReader::new`) for a header-encrypted archive, at decode (`for_each_entries`) for a data-encrypted one. `map_sevenz_err` flattened EVERY sevenz error to `ArchiveError::Corrupt`, so an intact encrypted 7z surfaced to the user as a DAMAGED archive.

- `map_sevenz_err` now classifies by typed enum variant: the encryption/unknown-coder family (`UnsupportedCompressionMethod`, `Unsupported`, `ExternalUnsupported`, `UnsupportedVersion`, and the `aes256`-on-only `PasswordRequired` / `MaybeBadPassword`) maps to `ArchiveError::Unsupported` → `VolumeError::NotSupported`, the honest "can't open this kind" — never `Corrupt` ("damaged"), never `Encrypted` (a password prompt a 7z read can never satisfy here). A memory-limit refusal maps to `TooLarge`; byte-source I/O keeps the io-kind classifier; genuinely broken/truncated structure stays `Corrupt`.
- Pinned by `sevenz_test.rs`: unit tests over constructed `sevenz_rust2::Error` values (the crate can't encrypt with `aes256` off, so an in-memory encrypted fixture isn't buildable and a `7z`-CLI fixture would be absent from CI). The exact error shape was empirically confirmed against real `7z`-produced `-mhe=on` / `-mhe=off` fixtures (sevenz-rust2 0.21.2).
- Docs corrected to current state: the `sevenz.rs` module + function comments, `read/CLAUDE.md`, `read/DETAILS.md` § Decryption and § tar/7z, and the `archive-browsing-polish` spec §2 — which overstated 7z AES as a "one-line flip"; it needs a per-archive password threaded through `parse` and every `open_read` / `stream_subtree` re-open, not just the feature flag.

Author: vdavid

apps/desktop/src-tauri/src/file_system/volume/backends/archive/read/CLAUDE.md

@@ -39,7 +39,9 @@ planning, reorganizing, or advising.
   routed through the `zip` crate's `by_index_decrypt` by CENTRAL-DIRECTORY ORDINAL (rc-zip parses but can't decrypt; the
   ordinals align — pinned). No password ⇒ `Encrypted`; wrong ⇒ `WrongPassword` (ZipCrypto's wrong-password may surface
   late as an end-of-stream CRC, mapped by io-kind not message). WinZip AES and 7z AES are deferred (`aes` crate conflicts
-  with `smb2`) and return a typed refusal. Filename encoding is rc-zip's job — consume the decoded `entry.name`.
+  with `smb2`) and refuse honestly as `Unsupported` (→ `NotSupported`; never a "damaged archive", never a password
+  prompt that can't succeed) — for 7z via `sevenz.rs::map_sevenz_err`. Filename encoding is rc-zip's job — consume the
+  decoded `entry.name`.
 - **The index cache key is `(path, size, mtime)`** (external edits auto-invalidate); `index_for_local` is blocking, call
   it from `spawn_blocking`.
 - **Two DoS caps bound the synthetic tree**: per-entry depth (`name::MAX_COMPONENT_DEPTH`, over-deep entries quarantine)

apps/desktop/src-tauri/src/file_system/volume/backends/archive/read/DETAILS.md

@@ -157,8 +157,10 @@ the per-entry decrypt engine.
   feature. **WinZip AES** (the `Method::Aex` marker) would need the `zip` crate's `aes-crypto` feature, and **7z AES**
   the `sevenz-rust2` `aes256` feature — both pull `aes ^0.9` (stable 0.9.1), which CONFLICTS with `smb2`'s pinned
   `aes =0.9.0-rc.4` (its SMB3 AEAD stack), so Cargo can't unify. Until the `aes` versions align, an AES zip entry returns
-  a typed `Unsupported` (honest — not a password prompt that could never succeed) and encrypted 7z stays a typed refusal.
-  Flipping the two features on (plus the AES branch in `zip::open_read`, already stubbed) is the whole AES follow-up.
+  a typed `Unsupported` (honest — not a password prompt that could never succeed), and an encrypted 7z refuses the same
+  way: `sevenz.rs::map_sevenz_err` classifies the unrecognized `AES256_SHA256` coder as `Unsupported`.
+  Flipping zip's `aes-crypto` on (plus the AES branch in `zip::open_read`, already stubbed) is the zip AES follow-up; 7z
+  AES needs more than the feature flag (see below).
 - **Wrong-password detection.** zip AES verifies a 2-byte password check at open (`InvalidPassword` → `WrongPassword`,
   instant) — relevant once AES lands. ZipCrypto checks a single byte at open, so ~1/256 of wrong passwords slip through
   and surface LATE as an end-of-stream CRC mismatch: the `zip` crate returns `io::ErrorKind::InvalidData` ("Invalid
@@ -205,8 +207,16 @@ at offset 0 — a plain tar's `ustar` at offset 257, so the confirm reads a 512-
 streaming `.xz` reader `lzma-rs` lacks), zstd → `ruzstd`'s `StreamingDecoder`. Each handles concatenated members
 (`gzip -c a b`). tar parsing/streaming rides the `tar` crate over a `SourceReader` (a `Read`+`Seek` cursor on the byte
 source); 7z uses `sevenz-rust2`'s `ArchiveReader` (needs `Read`+`Seek`, hence `SourceReader`). LZMA/LZMA2 (the common 7z
-codec) is built into `sevenz-rust2`; `bzip2`/`deflate`/`ppmd` are feature-enabled. `aes256` is OFF, so an encrypted 7z
-surfaces a typed error rather than being decrypted (matches zip's "encrypted → reject").
+codec) is built into `sevenz-rust2`; `bzip2`/`deflate`/`ppmd` are feature-enabled. `aes256` is OFF, so an AES-encrypted
+7z has an unrecognized coder: `sevenz-rust2` returns `UnsupportedCompressionMethod("AES256_SHA256")` — at open
+(`ArchiveReader::new`) for a header-encrypted archive (`7z -mhe=on`, browsing itself refused), at decode
+(`for_each_entries`) for a data-encrypted one (`7z -mhe=off`, browsing works, extraction refused). `map_sevenz_err`
+classifies both (plus the `aes256`-on-only `PasswordRequired` / `MaybeBadPassword`) as `Unsupported` → `NotSupported`:
+the honest "can't open this kind", NOT `Corrupt` ("damaged") and NOT `Encrypted` (a password prompt a 7z read can never
+satisfy here). Pinned by `sevenz_test.rs`. (Verified on sevenz-rust2 0.21.2, `aes256` off, against real `7z` fixtures,
+2026-07-08.) Enabling it isn't a one-line feature flip: `sevenz-rust2` needs the password at `ArchiveReader::new` time
+(a `Password`, not `Password::empty()`), so a real 7z-AES path must thread a per-archive password through `parse` AND
+every `open_read` / `stream_subtree` re-open — the parse/read plumbing zip's ZipCrypto path already has, which 7z lacks.
 
 **Access class — the sequential trap (`ArchiveFormat::is_sequential`, `Volume::extraction_is_sequential`).** A plain
 `.tar` is RANDOM-access: `TarStore` records each member's data offset, so `open_read` seeks and streams the member's

apps/desktop/src-tauri/src/file_system/volume/backends/archive/read/sevenz.rs

@@ -11,8 +11,10 @@
 //!
 //! Encryption is out of scope: the `aes256` feature is off (it would pull an
 //! `aes` version conflicting with `smb2`'s pinned pre-release; see the archive
-//! `DETAILS.md`), so an AES-encrypted 7z surfaces a typed error rather than being
-//! decrypted — matching the deferral of WinZip AES zip.
+//! `DETAILS.md`), so an AES-encrypted 7z refuses honestly as `Unsupported` (a
+//! "can't open this kind" the user sees, never a "damaged archive" or a password
+//! prompt) rather than being decrypted. The classification lives in
+//! [`map_sevenz_err`]; matching the deferral of WinZip AES zip.
 
 use std::collections::HashMap;
 use std::sync::Arc;
@@ -208,9 +210,58 @@ pub(super) fn stream_subtree(source: Arc<dyn ArchiveByteSource>, mut wanted: Has
     }
 }
 
-/// Maps a `sevenz-rust2` error to a typed [`ArchiveError`]. Encryption without
-/// the `aes256` feature, and any unknown codec, surface as `Unsupported`; a
-/// malformed header as `Corrupt`.
+/// Maps a `sevenz-rust2` error to a typed [`ArchiveError`], classifying by enum
+/// variant (never message text, per `no-string-matching`).
+///
+/// The load-bearing case is encryption. We build `sevenz-rust2` with the
+/// `aes256` feature OFF (its `aes` crate conflicts with `smb2`'s pin; see the
+/// archive `DETAILS.md`), so an AES-encrypted 7z has an unrecognized coder and
+/// the crate returns `UnsupportedCompressionMethod("AES256_SHA256")` — for a
+/// header-encrypted archive at open (`ArchiveReader::new`), for a data-encrypted
+/// one at decode (`for_each_entries`). Both must land on [`ArchiveError::Unsupported`]
+/// (→ `VolumeError::NotSupported`, the honest "can't open this kind"), NOT
+/// [`ArchiveError::Corrupt`] (which reads to the user as a DAMAGED archive) and NOT
+/// [`ArchiveError::Encrypted`] (which prompts for a password a 7z read can never
+/// satisfy here). A genuinely-unknown codec produces the same variant and is
+/// honestly "unsupported" too, so no AES-specific coder-id check is needed.
+/// (Verified on sevenz-rust2 0.21.2, `aes256` off, against real `7z`-produced
+/// `-mhe=on`/`-mhe=off` fixtures, 2026-07-08.)
+///
+/// The `PasswordRequired` / `MaybeBadPassword` variants only arise with `aes256`
+/// ON; they're mapped to `Unsupported` too so encryption never reads as damaged
+/// if the feature is ever enabled without a matching password-threading path.
 fn map_sevenz_err(err: sevenz_rust2::Error) -> ArchiveError {
-    ArchiveError::Corrupt(format!("7z: {err}"))
+    use sevenz_rust2::Error as E;
+    match err {
+        // Encryption (our `aes256`-off build) and any unknown/unsupported coder:
+        // an honest "can't serve this kind", never "damaged".
+        E::UnsupportedCompressionMethod(method) => ArchiveError::Unsupported(format!("7z coder: {method}")),
+        E::Unsupported(msg) => ArchiveError::Unsupported(format!("7z: {msg}")),
+        E::ExternalUnsupported => ArchiveError::Unsupported("7z uses an unsupported external coder".to_string()),
+        E::UnsupportedVersion { major, minor } => ArchiveError::Unsupported(format!("7z format version {major}.{minor}")),
+        E::PasswordRequired | E::MaybeBadPassword(_) => ArchiveError::Unsupported("7z is encrypted".to_string()),
+        // A memory-limit refusal is a resource cap, not damage: reuse the tree-size
+        // rejection so it never reads as "damaged".
+        E::MaxMemLimited { max_kb, actaul_kb } => {
+            ArchiveError::TooLarge(format!("7z needs {actaul_kb} KB to decode, over the {max_kb} KB limit"))
+        }
+        // Underlying byte-source I/O: reuse the io-kind classifier (UnexpectedEof ⇒ Corrupt).
+        E::Io(io, _) | E::FileOpen(io, _) => ArchiveError::from(io),
+        // Everything else is a structurally broken or truncated archive. `err` is
+        // still owned here (every sub-pattern binds nothing), so format it whole.
+        E::BadSignature(_)
+        | E::ChecksumVerificationFailed
+        | E::NextHeaderCrcMismatch
+        | E::BadTerminatedStreamsInfo(_)
+        | E::BadTerminatedUnpackInfo
+        | E::BadTerminatedPackInfo(_)
+        | E::BadTerminatedSubStreamsInfo
+        | E::BadTerminatedHeader(_)
+        | E::Other(_)
+        | E::FileNotFound => ArchiveError::Corrupt(format!("7z: {err}")),
+    }
 }
+
+#[cfg(test)]
+#[path = "sevenz_test.rs"]
+mod sevenz_test;

apps/desktop/src-tauri/src/file_system/volume/backends/archive/read/sevenz_test.rs

@@ -0,0 +1,81 @@
+//! Unit tests for [`super::map_sevenz_err`], the sevenz-rust2 → [`ArchiveError`]
+//! classifier.
+//!
+//! The encryption cases are the point: with the `aes256` feature off (our build),
+//! a real `7z`-produced encrypted archive makes sevenz-rust2 return
+//! `UnsupportedCompressionMethod("AES256_SHA256")` — at `ArchiveReader::new` for a
+//! header-encrypted archive (`7z -mhe=on`), at `for_each_entries` for a
+//! data-encrypted one (`7z -mhe=off`). Both shapes must classify as `Unsupported`
+//! so the user gets the honest "can't open this kind" experience, never "damaged
+//! archive". (Empirically confirmed on sevenz-rust2 0.21.2 against both fixtures,
+//! 2026-07-08.) We pin the predicate on constructed error values rather than a
+//! checked-in encrypted blob: the crate can't encrypt with `aes256` off, so an
+//! in-memory encrypted fixture isn't buildable, and shelling out to `7z` would
+//! make the test depend on a tool absent from CI.
+
+use sevenz_rust2::Error as E;
+
+use super::{ArchiveError, map_sevenz_err};
+
+#[test]
+fn encrypted_7z_classifies_as_unsupported_not_corrupt() {
+    // The exact error a real AES-encrypted 7z yields in our `aes256`-off build,
+    // for BOTH the header-encrypted (open-time) and data-encrypted (decode-time)
+    // shapes.
+    let mapped = map_sevenz_err(E::UnsupportedCompressionMethod("AES256_SHA256".to_string()));
+    assert!(
+        matches!(mapped, ArchiveError::Unsupported(_)),
+        "an encrypted 7z must refuse as Unsupported (honest 'can't open this kind'), got {mapped:?}"
+    );
+    // Guard the two failure modes the honesty fix exists to prevent:
+    assert!(
+        !matches!(mapped, ArchiveError::Corrupt(_)),
+        "must not read as a damaged archive"
+    );
+    assert!(
+        !matches!(mapped, ArchiveError::Encrypted | ArchiveError::WrongPassword),
+        "must not trigger a password prompt a 7z read can never satisfy here"
+    );
+}
+
+#[test]
+fn unknown_7z_codec_also_unsupported() {
+    let mapped = map_sevenz_err(E::UnsupportedCompressionMethod("SOME_FUTURE_CODEC".to_string()));
+    assert!(matches!(mapped, ArchiveError::Unsupported(_)), "got {mapped:?}");
+}
+
+#[test]
+fn aes256_on_password_shapes_map_to_unsupported() {
+    // These only arise with the `aes256` feature ON; mapped defensively so
+    // encryption never reads as damaged if the feature is ever enabled.
+    assert!(matches!(map_sevenz_err(E::PasswordRequired), ArchiveError::Unsupported(_)));
+    let io = std::io::Error::new(std::io::ErrorKind::InvalidData, "bad pw");
+    assert!(matches!(map_sevenz_err(E::MaybeBadPassword(io)), ArchiveError::Unsupported(_)));
+}
+
+#[test]
+fn broken_7z_structure_still_reads_as_corrupt() {
+    // The fix must not over-reach: a genuinely damaged archive stays Corrupt.
+    assert!(matches!(map_sevenz_err(E::NextHeaderCrcMismatch), ArchiveError::Corrupt(_)));
+    assert!(matches!(map_sevenz_err(E::ChecksumVerificationFailed), ArchiveError::Corrupt(_)));
+    assert!(matches!(map_sevenz_err(E::BadSignature([0; 6])), ArchiveError::Corrupt(_)));
+}
+
+#[test]
+fn memory_limit_maps_to_too_large() {
+    let mapped = map_sevenz_err(E::MaxMemLimited {
+        max_kb: 1024,
+        actaul_kb: 4096,
+    });
+    assert!(matches!(mapped, ArchiveError::TooLarge(_)), "got {mapped:?}");
+}
+
+#[test]
+fn byte_source_io_classifies_by_io_kind() {
+    // A truncated stream (UnexpectedEof) is a damaged archive, not a live fault.
+    let eof = std::io::Error::new(std::io::ErrorKind::UnexpectedEof, "short read");
+    assert!(matches!(map_sevenz_err(E::Io(eof, "".into())), ArchiveError::Corrupt(_)));
+    // A real I/O fault stays Io.
+    let denied = std::io::Error::new(std::io::ErrorKind::PermissionDenied, "denied");
+    assert!(matches!(map_sevenz_err(E::Io(denied, "".into())), ArchiveError::Io(_)));
+}

docs/specs/later/archive-browsing-polish.md

@@ -30,9 +30,19 @@ Backend half (decrypt in the read path, the typed `ArchiveNeedsPassword` signal,
 `DETAILS.md` § "Archive-password prompt".
 
 **WinZip AES zip and 7z AES still deferred.** Enabling the `aes` crate (zip `aes-crypto` / sevenz `aes256`) pulls stable
-`aes 0.9.1`, which conflicts with `smb2`'s pinned `aes =0.9.0-rc.4` (its SMB3 AEAD stack) — Cargo can't unify. An AES
-entry returns a typed `Unsupported` (honest, not a prompt that can't succeed); the AES branch is stubbed for a one-line
-flip once the versions align.
+`aes 0.9.1`, which conflicts with `smb2`'s pinned `aes =0.9.0-rc.4` (its SMB3 AEAD stack) — Cargo can't unify. Both AES
+kinds refuse honestly as `Unsupported` today (never "damaged", never a prompt that can't succeed): zip via the stubbed
+AES branch in `zip::open_read`, 7z via `sevenz.rs::map_sevenz_err` (the unrecognized `AES256_SHA256` coder). The two
+follow-ups differ in size once the `aes` versions align:
+
+- **WinZip AES zip is close to a one-line flip:** turn on `aes-crypto` and fill the already-stubbed AES branch — the
+  password plumbing (per-archive storage, prompt, re-dispatch, wrong-password detection) is the same ZipCrypto path,
+  already shipped.
+- **7z AES is NOT a one-line flip.** Beyond the `aes256` feature, `sevenz-rust2` wants the password at
+  `ArchiveReader::new` time, so a real 7z-AES path must thread a per-archive password through `read/sevenz.rs`'s `parse`
+  AND every `open_read` / `stream_subtree` re-open (each currently passes `Password::empty()`), then surface
+  `Encrypted` / `WrongPassword` from `map_sevenz_err` instead of `Unsupported`. That's new parse/read plumbing, not a
+  flag.
 
 ## 3. M-append: fast in-place zip edits (perf, research spike)