From 4bb3ab3bba43c502e5ebabe456d904d5b3ef8407 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Mon, 15 Jun 2026 23:52:23 +0800
Subject: [PATCH 01/64] Bump version to 0.14.4-beta.5

---
 pubspec.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pubspec.yaml b/pubspec.yaml
index bc6deef..32c0fe0 100644
--- a/pubspec.yaml
+++ b/pubspec.yaml
@@ -14,7 +14,7 @@ publish_to: "none"
 # https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html
 # In Windows, build-name is used as the major, minor, and patch parts
 # of the product and file versions while build-number is used as the build suffix.
-version: 0.14.4-beta.4+15
+version: 0.14.4-beta.5+15
 
 environment:
   sdk: ">=3.4.4 <4.0.0"

From 43a898bbfd4291d14d5e322192797e6e3a1c4a99 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 18:16:46 +0800
Subject: [PATCH 02/64] Add autofill service and selection activity to Android
 manifest

---
 android/app/src/main/AndroidManifest.xml | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/android/app/src/main/AndroidManifest.xml b/android/app/src/main/AndroidManifest.xml
index b4e19ca..123a573 100644
--- a/android/app/src/main/AndroidManifest.xml
+++ b/android/app/src/main/AndroidManifest.xml
@@ -78,6 +78,27 @@
             android:name="flutterEmbedding"
             android:value="2" />
 
+        <service
+            android:name=".AutofillService"
+            android:label="Latch"
+            android:exported="true"
+            android:permission="android.permission.BIND_AUTOFILL_SERVICE">
+            <intent-filter>
+                <action android:name="android.service.autofill.AutofillService" />
+            </intent-filter>
+            <meta-data
+                android:name="android.autofill"
+                android:resource="@xml/autofill_service" />
+        </service>
+
+        <activity
+            android:name=".AutofillSelectionActivity"
+            android:exported="false"
+            android:excludeFromRecents="true"
+            android:theme="@style/NormalTheme"
+            android:configChanges="orientation|keyboardHidden|keyboard|screenSize|smallestScreenSize|locale|layoutDirection|fontScale|screenLayout|density|uiMode"
+            android:windowSoftInputMode="adjustResize" />
+
     </application>
 
     <!-- Required to query activities that can process text, see:

From 99aa6febdb200a50fb7aa93e33c8f1c5127e0bae Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 18:17:13 +0800
Subject: [PATCH 03/64] Add password list navigation to vault explorer

---
 lib/screens/vault_explorer_screen.dart | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/lib/screens/vault_explorer_screen.dart b/lib/screens/vault_explorer_screen.dart
index f1ca876..f9244ba 100644
--- a/lib/screens/vault_explorer_screen.dart
+++ b/lib/screens/vault_explorer_screen.dart
@@ -18,6 +18,7 @@ import '../widgets/explorer_toolbar.dart';
 import '../widgets/operation_progress_sheet.dart';
 import '../widgets/media_multi_select_action_sheet.dart';
 import 'note_list_screen.dart';
+import 'password_list_screen.dart';
 
 class VaultExplorerScreen extends ConsumerStatefulWidget {
   const VaultExplorerScreen({super.key});
@@ -110,6 +111,16 @@ class _VaultExplorerScreenState extends ConsumerState<VaultExplorerScreen> {
             );
           },
         ),
+        IconButton(
+          icon: Icon(Icons.password, color: context.textSecondary),
+          tooltip: 'Passwords',
+          onPressed: () {
+            Navigator.push(
+              context,
+              MaterialPageRoute(builder: (_) => const PasswordListScreen()),
+            );
+          },
+        ),
       ],
     );
   }

From 251cca0ac9cca54ec70f22d892f8b353575f52fb Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 18:17:17 +0800
Subject: [PATCH 04/64] Include password index in vault backup

---
 lib/services/backup_service.dart | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/lib/services/backup_service.dart b/lib/services/backup_service.dart
index 2947e8e..b7ddae5 100644
--- a/lib/services/backup_service.dart
+++ b/lib/services/backup_service.dart
@@ -1,6 +1,7 @@
 import 'dart:io';
 import 'package:archive/archive_io.dart';
 import 'package:flutter/foundation.dart';
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
 import 'package:path_provider/path_provider.dart';
 import 'package:uuid/uuid.dart';
 import '../models/vaulted_file.dart';
@@ -26,9 +27,12 @@ class BackupService {
 
   static final BackupService instance = BackupService._();
   final VaultService _vaultService;
+  final FlutterSecureStorage _secureStorage = const FlutterSecureStorage();
 
   static const String _zipPrefix = 'locker_';
   static const String _zipSuffix = '.zip';
+  static const String _passwordIndexKey = 'locker_passwords_index';
+  static const String _passwordIndexEntry = '_passwords_index.json';
 
   /// Map file type to ZIP subdir name (images/videos/documents).
   String _subdirForType(VaultedFileType type) {
@@ -113,6 +117,17 @@ class BackupService {
           onProgress?.call(current, total);
         }
 
+        final passwordIndex =
+            await _secureStorage.read(key: _passwordIndexKey);
+        if (passwordIndex != null && passwordIndex.isNotEmpty) {
+          final indexFile = File('${workDir.path}/$_passwordIndexEntry');
+          await indexFile.writeAsString(passwordIndex);
+          await encoder.addFile(indexFile, _passwordIndexEntry);
+          try {
+            await indexFile.delete();
+          } catch (_) {}
+        }
+
         await encoder.close();
         return BackupResult(success: true, zipPath: zipPath);
       } finally {

From a5320c1470d88fa78050ed350e4feb7dc0018db2 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 18:17:24 +0800
Subject: [PATCH 05/64] Add autofill entry point and password vault
 registration methods

---
 lib/main.dart                   |  4 +++
 lib/services/vault_service.dart | 63 +++++++++++++++++++++++++++++++++
 2 files changed, 67 insertions(+)

diff --git a/lib/main.dart b/lib/main.dart
index b2e517e..cd045d5 100644
--- a/lib/main.dart
+++ b/lib/main.dart
@@ -12,6 +12,7 @@ import 'providers/vault_providers.dart';
 import 'services/auth_service.dart';
 import 'screens/auth_method_selection_screen.dart';
 import 'screens/unlock_screen.dart';
+import 'autofill_app.dart';
 import 'utils/frame_rate_optimizer.dart';
 import 'utils/performance_config.dart';
 
@@ -150,3 +151,6 @@ class _AppInitializerState extends ConsumerState<AppInitializer> {
     }
   }
 }
+
+@pragma('vm:entry-point')
+void autofillMain() => runApp(AutofillApp());
diff --git a/lib/services/vault_service.dart b/lib/services/vault_service.dart
index 04fda4d..db281a9 100644
--- a/lib/services/vault_service.dart
+++ b/lib/services/vault_service.dart
@@ -2458,6 +2458,69 @@ class VaultService {
       await _saveFileIndex();
     }
   }
+
+  Future<void> registerPasswordEntry({
+    required String passwordId,
+    required String title,
+    required String encryptedContentPath,
+    List<String> tags = const [],
+    bool isEncrypted = false,
+    EncryptionAlgorithm encryptionAlgorithm = EncryptionAlgorithm.aes256Gcm,
+    int kdfIterations = 0,
+    bool isDecoy = false,
+  }) async {
+    final files = isDecoy
+        ? (_cachedDecoyFiles ??= await _loadFileIndex(isDecoy: true))
+        : (_cachedFiles ??= await _loadFileIndex());
+
+    final existingIndex =
+        files.indexWhere((f) => f.metadata?['passwordId'] == passwordId);
+
+    final entry = VaultedFile(
+      id: existingIndex != -1 ? files[existingIndex].id : passwordId,
+      originalName: '$title.pwd',
+      vaultPath: encryptedContentPath,
+      type: VaultedFileType.document,
+      mimeType: 'application/octet-stream',
+      fileSize: 0,
+      dateAdded: existingIndex != -1
+          ? files[existingIndex].dateAdded
+          : DateTime.now(),
+      dateModified: DateTime.now(),
+      tags: ['password', ...tags],
+      isEncrypted: isEncrypted,
+      encryptionAlgorithm: encryptionAlgorithm,
+      kdfIterations: kdfIterations,
+      metadata: {'passwordId': passwordId},
+    );
+
+    if (existingIndex != -1) {
+      files[existingIndex] = entry;
+    } else {
+      files.insert(0, entry);
+    }
+
+    if (isDecoy) {
+      await _saveFileIndex(isDecoy: true);
+    } else {
+      await _saveFileIndex();
+    }
+  }
+
+  Future<void> removePasswordEntry(String passwordId,
+      {bool isDecoy = false}) async {
+    final files = isDecoy
+        ? (_cachedDecoyFiles ??= await _loadFileIndex(isDecoy: true))
+        : (_cachedFiles ??= await _loadFileIndex());
+
+    files.removeWhere((f) => f.metadata?['passwordId'] == passwordId);
+
+    if (isDecoy) {
+      await _saveFileIndex(isDecoy: true);
+    } else {
+      await _saveFileIndex();
+    }
+  }
 }
 
 /// Helper class for batch file import

From 9f29d2d4e2aadb2f396f90b59d9ecb2cf1f250fc Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 18:17:54 +0800
Subject: [PATCH 06/64] Add AutofillCallbackHolder to manage autofill callbacks

---
 .../mossapps/locker/AutofillCallbackHolder.kt | 31 +++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100644 android/app/src/main/kotlin/com/mossapps/locker/AutofillCallbackHolder.kt

diff --git a/android/app/src/main/kotlin/com/mossapps/locker/AutofillCallbackHolder.kt b/android/app/src/main/kotlin/com/mossapps/locker/AutofillCallbackHolder.kt
new file mode 100644
index 0000000..81c2f08
--- /dev/null
+++ b/android/app/src/main/kotlin/com/mossapps/locker/AutofillCallbackHolder.kt
@@ -0,0 +1,31 @@
+package com.mossapps.locker
+
+import android.app.assist.AssistStructure
+import android.service.autofill.FillCallback
+import android.view.autofill.AutofillId
+
+enum class FieldType { USERNAME, PASSWORD }
+
+data class AutofillField(val autofillId: AutofillId, val type: FieldType)
+
+object AutofillCallbackHolder {
+    var callback: FillCallback? = null
+        private set
+    var fields: List<AutofillField>? = null
+        private set
+
+    fun set(callback: FillCallback, fields: List<AutofillField>) {
+        this.callback = callback
+        this.fields = fields
+    }
+
+    fun cancel() {
+        try { callback?.onSuccess(null) } catch (_: Exception) {}
+        clear()
+    }
+
+    fun clear() {
+        callback = null
+        fields = null
+    }
+}

From 13bda93ae4e64118e8b5314759ea6bbc5df9e1bf Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 18:18:00 +0800
Subject: [PATCH 07/64] Add AutofillSelectionActivity for credential selection
 UI

---
 .../locker/AutofillSelectionActivity.kt       | 108 ++++++++++++++++++
 1 file changed, 108 insertions(+)
 create mode 100644 android/app/src/main/kotlin/com/mossapps/locker/AutofillSelectionActivity.kt

diff --git a/android/app/src/main/kotlin/com/mossapps/locker/AutofillSelectionActivity.kt b/android/app/src/main/kotlin/com/mossapps/locker/AutofillSelectionActivity.kt
new file mode 100644
index 0000000..343574f
--- /dev/null
+++ b/android/app/src/main/kotlin/com/mossapps/locker/AutofillSelectionActivity.kt
@@ -0,0 +1,108 @@
+package com.mossapps.locker
+
+import android.app.assist.AssistStructure
+import android.os.Build
+import android.os.Bundle
+import android.service.autofill.Dataset
+import android.service.autofill.FillResponse
+import android.util.Log
+import android.view.View
+import android.view.WindowManager
+import android.view.autofill.AutofillValue
+import android.widget.RemoteViews
+import androidx.annotation.RequiresApi
+import io.flutter.embedding.android.FlutterFragmentActivity
+import io.flutter.embedding.engine.FlutterEngine
+import io.flutter.plugin.common.MethodChannel
+
+@RequiresApi(Build.VERSION_CODES.O)
+class AutofillSelectionActivity : FlutterFragmentActivity() {
+
+    private val CHANNEL = "com.mossapps.locker/autofill"
+
+    override fun getDartEntrypointFunctionName(): String = "autofillMain"
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+        window.setFlags(WindowManager.LayoutParams.FLAG_SECURE, WindowManager.LayoutParams.FLAG_SECURE)
+    }
+
+    override fun configureFlutterEngine(flutterEngine: FlutterEngine) {
+        super.configureFlutterEngine(flutterEngine)
+        MethodChannel(flutterEngine.dartExecutor.binaryMessenger, CHANNEL).setMethodCallHandler { call, result ->
+            when (call.method) {
+                "fillCredentials" -> {
+                    val username = call.argument<String>("username") ?: ""
+                    val password = call.argument<String>("password") ?: ""
+                    val title = call.argument<String>("title") ?: "Latch"
+                    fillCredentials(username, password, title, result)
+                }
+                "cancel" -> {
+                    AutofillCallbackHolder.cancel()
+                    result.success(null)
+                    finish()
+                }
+                else -> result.notImplemented()
+            }
+        }
+    }
+
+    private fun fillCredentials(username: String, password: String, title: String, result: MethodChannel.Result) {
+        val callback = AutofillCallbackHolder.callback
+        val fields = AutofillCallbackHolder.fields
+
+        if (callback == null || fields == null) {
+            result.error("no_callback", "No fill request pending", null)
+            finish()
+            return
+        }
+
+        try {
+            val presentation = RemoteViews(packageName, R.layout.autofill_suggestion)
+            presentation.setTextViewText(R.id.autofill_title, title)
+
+            val builder = Dataset.Builder()
+            var matched = false
+
+            for (field in fields) {
+                when (field.type) {
+                    FieldType.USERNAME -> {
+                        if (username.isNotEmpty()) {
+                            builder.setValue(field.autofillId, AutofillValue.forText(username), presentation)
+                            matched = true
+                        }
+                    }
+                    FieldType.PASSWORD -> {
+                        if (password.isNotEmpty()) {
+                            builder.setValue(field.autofillId, AutofillValue.forText(password), presentation)
+                            matched = true
+                        }
+                    }
+                }
+            }
+
+            if (!matched) {
+                AutofillCallbackHolder.cancel()
+                result.success(null)
+                finish()
+                return
+            }
+
+            val response = FillResponse.Builder().addDataset(builder.build()).build()
+            callback.onSuccess(response)
+            AutofillCallbackHolder.clear()
+            result.success(null)
+            finish()
+        } catch (e: Exception) {
+            Log.e("AutofillSelection", "fill failed", e)
+            AutofillCallbackHolder.cancel()
+            result.error("fill_error", e.message, null)
+            finish()
+        }
+    }
+
+    override fun onDestroy() {
+        AutofillCallbackHolder.cancel()
+        super.onDestroy()
+    }
+}

From 2911442403d86efaa1ae8c6ad268b3e65573046f Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 18:18:05 +0800
Subject: [PATCH 08/64] Add autofill service for credential management

---
 .../com/mossapps/locker/AutofillService.kt    | 92 +++++++++++++++++++
 1 file changed, 92 insertions(+)
 create mode 100644 android/app/src/main/kotlin/com/mossapps/locker/AutofillService.kt

diff --git a/android/app/src/main/kotlin/com/mossapps/locker/AutofillService.kt b/android/app/src/main/kotlin/com/mossapps/locker/AutofillService.kt
new file mode 100644
index 0000000..f0ddfa6
--- /dev/null
+++ b/android/app/src/main/kotlin/com/mossapps/locker/AutofillService.kt
@@ -0,0 +1,92 @@
+package com.mossapps.locker
+
+import android.app.assist.AssistStructure
+import android.content.Intent
+import android.os.Build
+import android.os.CancellationSignal
+import android.service.autofill.AutofillService
+import android.service.autofill.FillCallback
+import android.service.autofill.FillRequest
+import android.service.autofill.FillResponse
+import android.service.autofill.SaveRequest
+import android.text.InputType
+import android.view.View
+import android.view.autofill.AutofillId
+import androidx.annotation.RequiresApi
+
+@RequiresApi(Build.VERSION_CODES.O)
+class AutofillService : AutofillService() {
+
+    override fun onFillRequest(request: FillRequest, cancellationSignal: CancellationSignal, callback: FillCallback) {
+        val structure = request.fillContexts.lastOrNull()?.structure
+        if (structure == null) {
+            callback.onSuccess(null)
+            return
+        }
+
+        val fields = parseFields(structure)
+        if (fields.isEmpty()) {
+            callback.onSuccess(null)
+            return
+        }
+
+        AutofillCallbackHolder.set(callback, fields)
+
+        val intent = Intent(this, AutofillSelectionActivity::class.java).apply {
+            flags = Intent.FLAG_ACTIVITY_NEW_TASK
+        }
+        startActivity(intent)
+    }
+
+    override fun onSaveRequest(request: SaveRequest, callback: android.service.autofill.SaveCallback) {
+        callback.onSuccess()
+    }
+
+    private fun parseFields(structure: AssistStructure): List<AutofillField> {
+        val fields = mutableListOf<AutofillField>()
+        val seenIds = mutableSetOf<AutofillId>()
+
+        for (i in 0 until structure.windowNodeCount) {
+            traverseNode(structure.getWindowNodeAt(i).rootViewNode, fields, seenIds)
+        }
+        return fields
+    }
+
+    private fun traverseNode(node: AssistStructure.ViewNode, fields: MutableList<AutofillField>, seenIds: MutableSet<AutofillId>) {
+        val id = node.autofillId
+        if (id != null && id !in seenIds) {
+            val type = classifyField(node)
+            if (type != null) {
+                fields.add(AutofillField(id, type))
+                seenIds.add(id)
+            }
+        }
+
+        for (i in 0 until node.childCount) {
+            traverseNode(node.getChildAt(i), fields, seenIds)
+        }
+    }
+
+    private fun classifyField(node: AssistStructure.ViewNode): FieldType? {
+        val hints = node.autofillHints
+        if (hints != null) {
+            for (hint in hints) {
+                when (hint) {
+                    View.AUTOFILL_HINT_USERNAME, View.AUTOFILL_HINT_EMAIL_ADDRESS -> return FieldType.USERNAME
+                    View.AUTOFILL_HINT_PASSWORD -> return FieldType.PASSWORD
+                }
+            }
+        }
+
+        val inputType = node.inputType
+        val variation = inputType and InputType.TYPE_MASK_VARIATION
+        when (variation) {
+            InputType.TYPE_TEXT_VARIATION_PASSWORD,
+            InputType.TYPE_TEXT_VARIATION_VISIBLE_PASSWORD,
+            InputType.TYPE_NUMBER_VARIATION_PASSWORD -> return FieldType.PASSWORD
+            InputType.TYPE_TEXT_VARIATION_EMAIL_ADDRESS -> return FieldType.USERNAME
+        }
+
+        return null
+    }
+}

From c267955162d3496ecd4b89c63ac00f711c368cad Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 18:18:11 +0800
Subject: [PATCH 09/64] Add autofill suggestion layout XML

---
 .../main/res/layout/autofill_suggestion.xml   | 23 +++++++++++++++++++
 1 file changed, 23 insertions(+)
 create mode 100644 android/app/src/main/res/layout/autofill_suggestion.xml

diff --git a/android/app/src/main/res/layout/autofill_suggestion.xml b/android/app/src/main/res/layout/autofill_suggestion.xml
new file mode 100644
index 0000000..baa8436
--- /dev/null
+++ b/android/app/src/main/res/layout/autofill_suggestion.xml
@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="utf-8"?>
+<LinearLayout xmlns:android="http://schemas.android.com/apk/res/android"
+    android:layout_width="match_parent"
+    android:layout_height="wrap_content"
+    android:orientation="horizontal"
+    android:padding="12dp"
+    android:gravity="center_vertical">
+
+    <ImageView
+        android:layout_width="24dp"
+        android:layout_height="24dp"
+        android:src="@mipmap/launcher_icon"
+        android:layout_marginEnd="12dp" />
+
+    <TextView
+        android:id="@+id/autofill_title"
+        android:layout_width="match_parent"
+        android:layout_height="wrap_content"
+        android:textSize="16sp"
+        android:textColor="#FFFFFF"
+        android:singleLine="true"
+        android:ellipsize="end" />
+</LinearLayout>

From 5bbe7a201cce14e808b1fde888a8373bda513f93 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 18:18:23 +0800
Subject: [PATCH 10/64] Add Android autofill service metadata resource

---
 android/app/src/main/res/xml/autofill_service.xml | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 android/app/src/main/res/xml/autofill_service.xml

diff --git a/android/app/src/main/res/xml/autofill_service.xml b/android/app/src/main/res/xml/autofill_service.xml
new file mode 100644
index 0000000..56f208e
--- /dev/null
+++ b/android/app/src/main/res/xml/autofill_service.xml
@@ -0,0 +1,3 @@
+<?xml version="1.0" encoding="utf-8"?>
+<autofill-service xmlns:android="http://schemas.android.com/apk/res/android"
+    android:settingsActivity="com.mossapps.locker.MainActivity" />

From 45d3763eeca7cee0e9260db270e81dcbc19aa277 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 18:18:28 +0800
Subject: [PATCH 11/64] Add PasswordEntry and PasswordContent models

Introduce core data classes for password management with JSON
serialization, copyWith methods, tag management, and encryption
metadata support.
---
 lib/models/password_entry.dart | 194 +++++++++++++++++++++++++++++++++
 1 file changed, 194 insertions(+)
 create mode 100644 lib/models/password_entry.dart

diff --git a/lib/models/password_entry.dart b/lib/models/password_entry.dart
new file mode 100644
index 0000000..9f4ed1e
--- /dev/null
+++ b/lib/models/password_entry.dart
@@ -0,0 +1,194 @@
+import 'dart:convert';
+
+import 'encryption_algorithm.dart';
+
+class PasswordContent {
+  final String username;
+  final String password;
+  final String url;
+  final String notes;
+
+  const PasswordContent({
+    this.username = '',
+    this.password = '',
+    this.url = '',
+    this.notes = '',
+  });
+
+  PasswordContent copyWith({
+    String? username,
+    String? password,
+    String? url,
+    String? notes,
+  }) {
+    return PasswordContent(
+      username: username ?? this.username,
+      password: password ?? this.password,
+      url: url ?? this.url,
+      notes: notes ?? this.notes,
+    );
+  }
+
+  Map<String, dynamic> toJson() {
+    return {
+      'username': username,
+      'password': password,
+      'url': url,
+      'notes': notes,
+    };
+  }
+
+  factory PasswordContent.fromJson(Map<String, dynamic> json) {
+    return PasswordContent(
+      username: json['username'] as String? ?? '',
+      password: json['password'] as String? ?? '',
+      url: json['url'] as String? ?? '',
+      notes: json['notes'] as String? ?? '',
+    );
+  }
+
+  String toJsonString() => jsonEncode(toJson());
+
+  factory PasswordContent.fromJsonString(String jsonString) {
+    return PasswordContent.fromJson(jsonDecode(jsonString) as Map<String, dynamic>);
+  }
+}
+
+class PasswordEntry {
+  final String id;
+  final String title;
+  final String encryptedContentPath;
+  final String iv;
+  final String keyDerivationSalt;
+  final int kdfIterations;
+  final List<String> tags;
+  final bool isFavorite;
+  final bool isEncrypted;
+  final EncryptionAlgorithm encryptionAlgorithm;
+  final DateTime createdAt;
+  final DateTime updatedAt;
+
+  const PasswordEntry({
+    required this.id,
+    required this.title,
+    required this.encryptedContentPath,
+    required this.iv,
+    required this.keyDerivationSalt,
+    this.kdfIterations = 100000,
+    this.tags = const [],
+    this.isFavorite = false,
+    this.isEncrypted = false,
+    this.encryptionAlgorithm = EncryptionAlgorithm.aes256Gcm,
+    required this.createdAt,
+    required this.updatedAt,
+  });
+
+  PasswordEntry copyWith({
+    String? id,
+    String? title,
+    String? encryptedContentPath,
+    String? iv,
+    String? keyDerivationSalt,
+    int? kdfIterations,
+    List<String>? tags,
+    bool? isFavorite,
+    bool? isEncrypted,
+    EncryptionAlgorithm? encryptionAlgorithm,
+    DateTime? createdAt,
+    DateTime? updatedAt,
+  }) {
+    return PasswordEntry(
+      id: id ?? this.id,
+      title: title ?? this.title,
+      encryptedContentPath: encryptedContentPath ?? this.encryptedContentPath,
+      iv: iv ?? this.iv,
+      keyDerivationSalt: keyDerivationSalt ?? this.keyDerivationSalt,
+      kdfIterations: kdfIterations ?? this.kdfIterations,
+      tags: tags ?? this.tags,
+      isFavorite: isFavorite ?? this.isFavorite,
+      isEncrypted: isEncrypted ?? this.isEncrypted,
+      encryptionAlgorithm: encryptionAlgorithm ?? this.encryptionAlgorithm,
+      createdAt: createdAt ?? this.createdAt,
+      updatedAt: updatedAt ?? this.updatedAt,
+    );
+  }
+
+  PasswordEntry toggleFavorite() =>
+      copyWith(isFavorite: !isFavorite, updatedAt: DateTime.now());
+
+  PasswordEntry addTag(String tag) {
+    final normalized = tag.toLowerCase().trim();
+    if (normalized.isEmpty || tags.contains(normalized)) return this;
+    return copyWith(tags: [...tags, normalized]);
+  }
+
+  PasswordEntry removeTag(String tag) {
+    final normalized = tag.toLowerCase().trim();
+    if (!tags.contains(normalized)) return this;
+    return copyWith(tags: tags.where((t) => t != normalized).toList());
+  }
+
+  bool hasTag(String tag) => tags.contains(tag.toLowerCase().trim());
+
+  Map<String, dynamic> toJson() {
+    return {
+      'id': id,
+      'title': title,
+      'encryptedContentPath': encryptedContentPath,
+      'iv': iv,
+      'keyDerivationSalt': keyDerivationSalt,
+      'kdfIterations': kdfIterations,
+      'tags': tags,
+      'isFavorite': isFavorite,
+      'isEncrypted': isEncrypted,
+      'encryptionAlgorithm': encryptionAlgorithm.name,
+      'createdAt': createdAt.toIso8601String(),
+      'updatedAt': updatedAt.toIso8601String(),
+    };
+  }
+
+  factory PasswordEntry.fromJson(Map<String, dynamic> json) {
+    return PasswordEntry(
+      id: json['id'] as String,
+      title: json['title'] as String,
+      encryptedContentPath: json['encryptedContentPath'] as String,
+      iv: json['iv'] as String,
+      keyDerivationSalt: json['keyDerivationSalt'] as String,
+      kdfIterations: json['kdfIterations'] as int? ?? 100000,
+      tags: (json['tags'] as List<dynamic>?)
+              ?.map((e) => e as String)
+              .toList() ??
+          const [],
+      isFavorite: json['isFavorite'] as bool? ?? false,
+      isEncrypted: json['isEncrypted'] as bool? ?? false,
+      encryptionAlgorithm: json['encryptionAlgorithm'] != null
+          ? EncryptionAlgorithm.values.firstWhere(
+              (e) => e.name == json['encryptionAlgorithm'],
+              orElse: () => EncryptionAlgorithm.aes256Gcm,
+            )
+          : EncryptionAlgorithm.aes256Gcm,
+      createdAt: DateTime.parse(json['createdAt'] as String),
+      updatedAt: DateTime.parse(json['updatedAt'] as String),
+    );
+  }
+
+  String toJsonString() => jsonEncode(toJson());
+
+  factory PasswordEntry.fromJsonString(String jsonString) {
+    return PasswordEntry.fromJson(jsonDecode(jsonString) as Map<String, dynamic>);
+  }
+
+  @override
+  bool operator ==(Object other) =>
+      identical(this, other) ||
+      other is PasswordEntry &&
+          runtimeType == other.runtimeType &&
+          id == other.id;
+
+  @override
+  int get hashCode => id.hashCode;
+
+  @override
+  String toString() =>
+      'PasswordEntry(id: $id, title: $title, favorite: $isFavorite)';
+}

From 3a60ab336dd126303d43bb4338846372d7f60b09 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 18:18:32 +0800
Subject: [PATCH 12/64] Add password management providers with Riverpod

---
 lib/providers/password_providers.dart | 108 ++++++++++++++++++++++++++
 1 file changed, 108 insertions(+)
 create mode 100644 lib/providers/password_providers.dart

diff --git a/lib/providers/password_providers.dart b/lib/providers/password_providers.dart
new file mode 100644
index 0000000..3815403
--- /dev/null
+++ b/lib/providers/password_providers.dart
@@ -0,0 +1,108 @@
+import 'package:flutter_riverpod/flutter_riverpod.dart';
+import 'package:flutter_riverpod/legacy.dart';
+
+import '../models/password_entry.dart';
+import '../models/encryption_algorithm.dart';
+import '../services/password_service.dart';
+import 'vault_providers.dart';
+
+final passwordServiceProvider = Provider<PasswordService>((ref) {
+  return PasswordService.instance;
+});
+
+final passwordSearchQueryProvider = StateProvider<String>((ref) => '');
+
+final selectedPasswordTagProvider = StateProvider<String?>((ref) => null);
+
+class PasswordsNotifier extends Notifier<AsyncValue<List<PasswordEntry>>> {
+  @override
+  AsyncValue<List<PasswordEntry>> build() {
+    loadPasswords();
+    return const AsyncValue.loading();
+  }
+
+  PasswordService get _service => ref.read(passwordServiceProvider);
+
+  bool get _isDecoy => ref.read(isDecoyModeProvider);
+
+  Future<void> loadPasswords() async {
+    state = const AsyncValue.loading();
+    try {
+      _service.clearCache();
+      final entries = await _service.loadPasswords(isDecoy: _isDecoy);
+      state = AsyncValue.data(entries);
+    } catch (e, st) {
+      state = AsyncValue.error(e, st);
+    }
+  }
+
+  Future<PasswordEntry> createPassword({
+    required String title,
+    required PasswordContent content,
+    List<String> tags = const [],
+    EncryptionAlgorithm encryptionAlgorithm = EncryptionAlgorithm.aes256Gcm,
+    int kdfIterations = 100000,
+    void Function(String status, {bool isEncrypting})? onProgress,
+  }) async {
+    final entry = await _service.createPassword(
+      title: title,
+      content: content,
+      tags: tags,
+      encryptionAlgorithm: encryptionAlgorithm,
+      kdfIterations: kdfIterations,
+      isDecoy: _isDecoy,
+      onProgress: onProgress,
+    );
+    await loadPasswords();
+    _refreshVault();
+    return entry;
+  }
+
+  Future<PasswordEntry> updatePassword(
+    PasswordEntry entry, {
+    String? title,
+    PasswordContent? content,
+    List<String>? tags,
+  }) async {
+    final updated = await _service.updatePassword(
+      entry,
+      title: title,
+      content: content,
+      tags: tags,
+      encryptionAlgorithm: entry.encryptionAlgorithm,
+      kdfIterations: entry.kdfIterations,
+      isDecoy: _isDecoy,
+    );
+    await loadPasswords();
+    _refreshVault();
+    return updated;
+  }
+
+  Future<void> deletePassword(PasswordEntry entry) async {
+    await _service.deletePassword(entry, isDecoy: _isDecoy);
+    await loadPasswords();
+    _refreshVault();
+  }
+
+  Future<void> deletePasswords(List<PasswordEntry> entries) async {
+    await _service.deletePasswords(entries, isDecoy: _isDecoy);
+    await loadPasswords();
+    _refreshVault();
+  }
+
+  Future<PasswordEntry> toggleFavorite(PasswordEntry entry) async {
+    final toggled =
+        await _service.toggleFavorite(entry, isDecoy: _isDecoy);
+    await loadPasswords();
+    return toggled;
+  }
+
+  void _refreshVault() {
+    ref.invalidate(vaultNotifierProvider);
+  }
+}
+
+final passwordsNotifierProvider =
+    NotifierProvider<PasswordsNotifier, AsyncValue<List<PasswordEntry>>>(() {
+  return PasswordsNotifier();
+});

From b3e80f18b8a672e93e071af33bd1641d885919b0 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 18:18:47 +0800
Subject: [PATCH 13/64] Add autofill credential selection screen

---
 lib/screens/autofill_selection_screen.dart | 430 +++++++++++++++++++++
 1 file changed, 430 insertions(+)
 create mode 100644 lib/screens/autofill_selection_screen.dart

diff --git a/lib/screens/autofill_selection_screen.dart b/lib/screens/autofill_selection_screen.dart
new file mode 100644
index 0000000..41ff42f
--- /dev/null
+++ b/lib/screens/autofill_selection_screen.dart
@@ -0,0 +1,430 @@
+import 'package:flutter/material.dart';
+import 'package:flutter/services.dart';
+import 'package:local_auth/local_auth.dart';
+import 'package:local_auth_android/local_auth_android.dart';
+import 'package:local_auth_darwin/local_auth_darwin.dart';
+
+import '../models/password_entry.dart';
+import '../services/password_service.dart';
+import '../themes/app_colors.dart';
+
+class AutofillSelectionScreen extends StatefulWidget {
+  const AutofillSelectionScreen({super.key});
+
+  @override
+  State<AutofillSelectionScreen> createState() =>
+      _AutofillSelectionScreenState();
+}
+
+class _AutofillSelectionScreenState extends State<AutofillSelectionScreen> {
+  static const MethodChannel _channel =
+      MethodChannel('com.mossapps.locker/autofill');
+
+  final LocalAuthentication _localAuth = LocalAuthentication();
+  final TextEditingController _searchController = TextEditingController();
+
+  bool _isAuthenticating = true;
+  bool _authFailed = false;
+  bool _biometricsUnavailable = false;
+  bool _isLoadingEntries = false;
+  bool _isDecrypting = false;
+  String? _error;
+
+  List<PasswordEntry> _allEntries = [];
+  List<PasswordEntry> _filteredEntries = [];
+
+  @override
+  void initState() {
+    super.initState();
+    _authenticate();
+  }
+
+  Future<void> _authenticate() async {
+    setState(() {
+      _isAuthenticating = true;
+      _authFailed = false;
+      _biometricsUnavailable = false;
+      _error = null;
+    });
+
+    try {
+      final canCheck = await _localAuth.canCheckBiometrics;
+      if (!canCheck) {
+        setState(() {
+          _biometricsUnavailable = true;
+          _isAuthenticating = false;
+        });
+        return;
+      }
+
+      final didAuth = await _localAuth.authenticate(
+        localizedReason: 'Authenticate to fill passwords',
+        biometricOnly: true,
+        authMessages: const <AuthMessages>[
+          AndroidAuthMessages(
+            signInTitle: 'Latch Autofill',
+            cancelButton: 'Cancel',
+          ),
+          IOSAuthMessages(
+            cancelButton: 'Cancel',
+          ),
+        ],
+      );
+
+      if (didAuth) {
+        await _loadEntries();
+      } else {
+        setState(() {
+          _authFailed = true;
+          _isAuthenticating = false;
+        });
+      }
+    } on PlatformException {
+      setState(() {
+        _authFailed = true;
+        _isAuthenticating = false;
+      });
+    }
+  }
+
+  Future<void> _loadEntries() async {
+    setState(() {
+      _isLoadingEntries = true;
+      _isAuthenticating = false;
+    });
+
+    try {
+      final entries = await PasswordService.instance.loadPasswords();
+      entries.sort((a, b) {
+        if (a.isFavorite != b.isFavorite) return a.isFavorite ? -1 : 1;
+        return b.updatedAt.compareTo(a.updatedAt);
+      });
+      setState(() {
+        _allEntries = entries;
+        _filteredEntries = entries;
+        _isLoadingEntries = false;
+      });
+    } catch (e) {
+      setState(() {
+        _error = 'Failed to load passwords';
+        _isLoadingEntries = false;
+      });
+    }
+  }
+
+  void _filterEntries(String query) {
+    final q = query.toLowerCase().trim();
+    setState(() {
+      _filteredEntries = q.isEmpty
+          ? _allEntries
+          : _allEntries
+              .where((e) =>
+                  e.title.toLowerCase().contains(q) ||
+                  e.tags.any((t) => t.toLowerCase().contains(q)))
+              .toList();
+    });
+  }
+
+  Future<void> _selectEntry(PasswordEntry entry) async {
+    setState(() => _isDecrypting = true);
+
+    try {
+      final content = await PasswordService.instance.decryptContent(entry);
+      await _channel.invokeMethod('fillCredentials', {
+        'username': content.username,
+        'password': content.password,
+        'title': entry.title,
+      });
+    } catch (e) {
+      setState(() {
+        _error = 'Failed to decrypt entry';
+        _isDecrypting = false;
+      });
+    }
+  }
+
+  Future<void> _cancel() async {
+    try {
+      await _channel.invokeMethod('cancel');
+    } catch (_) {}
+  }
+
+  @override
+  void dispose() {
+    _searchController.dispose();
+    super.dispose();
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    return PopScope(
+      canPop: false,
+      onPopInvokedWithResult: (didPop, _) {
+        if (!didPop) _cancel();
+      },
+      child: Scaffold(
+        backgroundColor: context.backgroundColor,
+        appBar: AppBar(
+          backgroundColor: context.backgroundColor,
+          elevation: 0,
+          leading: IconButton(
+            icon: Icon(Icons.close, color: context.textPrimary),
+            onPressed: _cancel,
+          ),
+          title: Text(
+            'Select Password',
+            style: TextStyle(
+              fontFamily: 'ProductSans',
+              fontSize: 18,
+              fontWeight: FontWeight.w600,
+              color: context.textPrimary,
+            ),
+          ),
+        ),
+        body: _buildBody(),
+      ),
+    );
+  }
+
+  Widget _buildBody() {
+    if (_isAuthenticating || _isDecrypting) {
+      return Center(
+        child: Column(
+          mainAxisSize: MainAxisSize.min,
+          children: [
+            CircularProgressIndicator(
+              valueColor: AlwaysStoppedAnimation(context.accentColor),
+            ),
+            const SizedBox(height: 16),
+            Text(
+              _isDecrypting ? 'Decrypting...' : 'Authenticating...',
+              style: TextStyle(
+                fontFamily: 'ProductSans',
+                fontSize: 14,
+                color: context.textSecondary,
+              ),
+            ),
+          ],
+        ),
+      );
+    }
+
+    if (_biometricsUnavailable) {
+      return _buildMessageState(
+        icon: Icons.fingerprint,
+        title: 'Biometrics Required',
+        subtitle: 'Set up fingerprint or face unlock to use autofill',
+        showRetry: false,
+      );
+    }
+
+    if (_authFailed) {
+      return _buildMessageState(
+        icon: Icons.lock_outline,
+        title: 'Authentication Failed',
+        subtitle: 'Tap to try again',
+        showRetry: true,
+      );
+    }
+
+    if (_error != null) {
+      return _buildMessageState(
+        icon: Icons.error_outline,
+        title: _error!,
+        subtitle: 'Tap to retry',
+        showRetry: true,
+      );
+    }
+
+    if (_isLoadingEntries) {
+      return Center(
+        child: CircularProgressIndicator(
+          valueColor: AlwaysStoppedAnimation(context.accentColor),
+        ),
+      );
+    }
+
+    if (_allEntries.isEmpty) {
+      return _buildMessageState(
+        icon: Icons.password_outlined,
+        title: 'No Passwords Saved',
+        subtitle: 'Add passwords in Latch to use autofill',
+        showRetry: false,
+      );
+    }
+
+    return Column(
+      children: [
+        _buildSearchField(),
+        Expanded(child: _buildList()),
+      ],
+    );
+  }
+
+  Widget _buildMessageState({
+    required IconData icon,
+    required String title,
+    required String subtitle,
+    required bool showRetry,
+  }) {
+    return Center(
+      child: Padding(
+        padding: const EdgeInsets.all(32),
+        child: Column(
+          mainAxisSize: MainAxisSize.min,
+          children: [
+            Icon(icon, size: 64, color: context.textTertiary),
+            const SizedBox(height: 16),
+            Text(
+              title,
+              textAlign: TextAlign.center,
+              style: TextStyle(
+                fontFamily: 'ProductSans',
+                fontSize: 18,
+                fontWeight: FontWeight.w600,
+                color: context.textPrimary,
+              ),
+            ),
+            const SizedBox(height: 8),
+            Text(
+              subtitle,
+              textAlign: TextAlign.center,
+              style: TextStyle(
+                fontFamily: 'ProductSans',
+                fontSize: 14,
+                color: context.textSecondary,
+              ),
+            ),
+            if (showRetry) ...[
+              const SizedBox(height: 24),
+              FilledButton(
+                onPressed: _authenticate,
+                style: FilledButton.styleFrom(
+                  backgroundColor: context.accentColor,
+                ),
+                child: Text(
+                  'Retry',
+                  style: TextStyle(
+                    fontFamily: 'ProductSans',
+                    color: Colors.white,
+                  ),
+                ),
+              ),
+            ],
+          ],
+        ),
+      ),
+    );
+  }
+
+  Widget _buildSearchField() {
+    return Padding(
+      padding: const EdgeInsets.fromLTRB(16, 12, 16, 8),
+      child: TextField(
+        controller: _searchController,
+        onChanged: _filterEntries,
+        style: TextStyle(
+          fontFamily: 'ProductSans',
+          fontSize: 15,
+          color: context.textPrimary,
+        ),
+        decoration: InputDecoration(
+          hintText: 'Search passwords...',
+          hintStyle: TextStyle(
+            fontFamily: 'ProductSans',
+            fontSize: 15,
+            color: context.textTertiary,
+          ),
+          prefixIcon: Icon(Icons.search, color: context.textTertiary, size: 20),
+          filled: true,
+          fillColor: context.surfaceColor,
+          isDense: true,
+          border: OutlineInputBorder(
+            borderRadius: BorderRadius.circular(12),
+            borderSide: BorderSide(color: context.borderColor),
+          ),
+          enabledBorder: OutlineInputBorder(
+            borderRadius: BorderRadius.circular(12),
+            borderSide: BorderSide(color: context.borderColor),
+          ),
+          focusedBorder: OutlineInputBorder(
+            borderRadius: BorderRadius.circular(12),
+            borderSide: BorderSide(color: context.accentColor),
+          ),
+        ),
+      ),
+    );
+  }
+
+  Widget _buildList() {
+    if (_filteredEntries.isEmpty) {
+      return Center(
+        child: Text(
+          'No matches',
+          style: TextStyle(
+            fontFamily: 'ProductSans',
+            fontSize: 14,
+            color: context.textTertiary,
+          ),
+        ),
+      );
+    }
+
+    return ListView.builder(
+      padding: const EdgeInsets.symmetric(horizontal: 16, vertical: 4),
+      itemCount: _filteredEntries.length,
+      itemBuilder: (context, index) {
+        final entry = _filteredEntries[index];
+        return _buildEntryTile(entry);
+      },
+    );
+  }
+
+  Widget _buildEntryTile(PasswordEntry entry) {
+    return Container(
+      margin: const EdgeInsets.only(bottom: 8),
+      decoration: BoxDecoration(
+        color: context.surfaceColor,
+        borderRadius: BorderRadius.circular(12),
+        border: Border.all(color: context.borderColor),
+      ),
+      child: ListTile(
+        contentPadding: const EdgeInsets.symmetric(horizontal: 16, vertical: 4),
+        leading: Icon(
+          entry.isFavorite ? Icons.star : Icons.lock_outline,
+          color: entry.isFavorite ? context.accentColor : context.textTertiary,
+          size: 22,
+        ),
+        title: Text(
+          entry.title,
+          maxLines: 1,
+          overflow: TextOverflow.ellipsis,
+          style: TextStyle(
+            fontFamily: 'ProductSans',
+            fontSize: 15,
+            fontWeight: FontWeight.w600,
+            color: context.textPrimary,
+          ),
+        ),
+        subtitle: entry.tags.isNotEmpty
+            ? Text(
+                entry.tags.join(' · '),
+                maxLines: 1,
+                overflow: TextOverflow.ellipsis,
+                style: TextStyle(
+                  fontFamily: 'ProductSans',
+                  fontSize: 12,
+                  color: context.textTertiary,
+                ),
+              )
+            : null,
+        trailing: Icon(
+          Icons.chevron_right,
+          color: context.textTertiary,
+          size: 20,
+        ),
+        onTap: () => _selectEntry(entry),
+      ),
+    );
+  }
+}

From 40d403bf3bada2ec864471a3e88bfeba4224362c Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 18:18:52 +0800
Subject: [PATCH 14/64] Add password editor screen

---
 lib/screens/password_editor_screen.dart | 572 ++++++++++++++++++++++++
 1 file changed, 572 insertions(+)
 create mode 100644 lib/screens/password_editor_screen.dart

diff --git a/lib/screens/password_editor_screen.dart b/lib/screens/password_editor_screen.dart
new file mode 100644
index 0000000..457891e
--- /dev/null
+++ b/lib/screens/password_editor_screen.dart
@@ -0,0 +1,572 @@
+import 'package:flutter/material.dart';
+import 'package:flutter_riverpod/flutter_riverpod.dart';
+
+import '../models/password_entry.dart';
+import '../models/encryption_algorithm.dart';
+import '../providers/password_providers.dart';
+import '../themes/app_colors.dart';
+import '../utils/clipboard_util.dart';
+import '../utils/toast_utils.dart';
+import '../widgets/password_generator_sheet.dart';
+
+class PasswordEditorScreen extends ConsumerStatefulWidget {
+  final PasswordEntry? entry;
+
+  const PasswordEditorScreen({super.key, this.entry});
+
+  @override
+  ConsumerState<PasswordEditorScreen> createState() =>
+      _PasswordEditorScreenState();
+}
+
+class _PasswordEditorScreenState extends ConsumerState<PasswordEditorScreen> {
+  final TextEditingController _titleController = TextEditingController();
+  final TextEditingController _usernameController = TextEditingController();
+  final TextEditingController _passwordController = TextEditingController();
+  final TextEditingController _urlController = TextEditingController();
+  final TextEditingController _notesController = TextEditingController();
+  final TextEditingController _tagController = TextEditingController();
+
+  bool _isSaving = false;
+  bool _isLoading = false;
+  bool _obscurePassword = true;
+  bool _isFavorite = false;
+  List<String> _tags = [];
+  EncryptionAlgorithm _algorithm = EncryptionAlgorithm.aes256Gcm;
+  int _kdfIterations = 100000;
+
+  @override
+  void initState() {
+    super.initState();
+    if (widget.entry != null) {
+      _isLoading = true;
+      _titleController.text = widget.entry!.title;
+      _tags = List.from(widget.entry!.tags);
+      _isFavorite = widget.entry!.isFavorite;
+      _algorithm = widget.entry!.encryptionAlgorithm;
+      _kdfIterations = widget.entry!.kdfIterations;
+      _loadContent();
+    }
+  }
+
+  Future<void> _loadContent() async {
+    if (widget.entry == null) return;
+    try {
+      final content = await ref
+          .read(passwordServiceProvider)
+          .decryptContent(widget.entry!);
+      if (mounted) {
+        setState(() {
+          _usernameController.text = content.username;
+          _passwordController.text = content.password;
+          _urlController.text = content.url;
+          _notesController.text = content.notes;
+          _isLoading = false;
+        });
+      }
+    } catch (e) {
+      if (mounted) {
+        setState(() => _isLoading = false);
+        ToastUtils.showError('Failed to load entry');
+      }
+    }
+  }
+
+  @override
+  void dispose() {
+    _titleController.dispose();
+    _usernameController.dispose();
+    _passwordController.dispose();
+    _urlController.dispose();
+    _notesController.dispose();
+    _tagController.dispose();
+    super.dispose();
+  }
+
+  void _addTag() {
+    final tag = _tagController.text.trim().toLowerCase();
+    if (tag.isNotEmpty && !_tags.contains(tag)) {
+      setState(() {
+        _tags.add(tag);
+        _tagController.clear();
+      });
+    }
+  }
+
+  void _showGenerator() {
+    showModalBottomSheet(
+      context: context,
+      backgroundColor: context.backgroundColor,
+      isScrollControlled: true,
+      shape: const RoundedRectangleBorder(
+        borderRadius: BorderRadius.vertical(top: Radius.circular(20)),
+      ),
+      builder: (context) => PasswordGeneratorSheet(
+        onGenerate: (password) {
+          setState(() {
+            _passwordController.text = password;
+            _obscurePassword = false;
+          });
+        },
+      ),
+    );
+  }
+
+  void _copyField(String value, String label) {
+    if (value.isEmpty) {
+      ToastUtils.showInfo('$label is empty');
+      return;
+    }
+    ClipboardUtil.copyWithAutoClear(value);
+    ToastUtils.showSuccess('$label copied - clears in 20s');
+  }
+
+  Future<void> _save() async {
+    if (_titleController.text.trim().isEmpty) {
+      ToastUtils.showError('Title cannot be empty');
+      return;
+    }
+
+    setState(() => _isSaving = true);
+
+    try {
+      final content = PasswordContent(
+        username: _usernameController.text,
+        password: _passwordController.text,
+        url: _urlController.text,
+        notes: _notesController.text,
+      );
+
+      final notifier = ref.read(passwordsNotifierProvider.notifier);
+      if (widget.entry != null) {
+        await notifier.updatePassword(
+          widget.entry!,
+          title: _titleController.text.trim(),
+          content: content,
+          tags: _tags,
+        );
+        if (widget.entry!.isFavorite != _isFavorite) {
+          await notifier.toggleFavorite(widget.entry!);
+        }
+        if (mounted) ToastUtils.showSuccess('Entry updated');
+      } else {
+        await notifier.createPassword(
+          title: _titleController.text.trim(),
+          content: content,
+          tags: _tags,
+          encryptionAlgorithm: _algorithm,
+          kdfIterations: _kdfIterations,
+        );
+        if (mounted) ToastUtils.showSuccess('Entry created');
+      }
+      if (mounted) Navigator.pop(context);
+    } catch (e) {
+      if (mounted) ToastUtils.showError('Failed to save entry');
+    } finally {
+      if (mounted) setState(() => _isSaving = false);
+    }
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    final isEditing = widget.entry != null;
+
+    return Scaffold(
+      backgroundColor: context.backgroundColor,
+      appBar: AppBar(
+        backgroundColor: context.backgroundColor,
+        elevation: 0,
+        leading: IconButton(
+          icon: Icon(Icons.arrow_back, color: context.textPrimary),
+          onPressed: () => Navigator.pop(context),
+        ),
+        title: Text(
+          isEditing ? 'Edit Entry' : 'New Entry',
+          style: TextStyle(
+            fontFamily: 'ProductSans',
+            fontSize: 18,
+            fontWeight: FontWeight.w600,
+            color: context.textPrimary,
+          ),
+        ),
+        actions: [
+          IconButton(
+            icon: Icon(
+              _isFavorite ? Icons.star : Icons.star_border,
+              color: _isFavorite
+                  ? context.accentColor
+                  : context.textSecondary,
+            ),
+            onPressed: () => setState(() => _isFavorite = !_isFavorite),
+            tooltip: 'Favorite',
+          ),
+          IconButton(
+            icon: Icon(Icons.check, color: context.accentColor),
+            onPressed: _isSaving ? null : _save,
+          ),
+        ],
+      ),
+      body: Stack(
+        children: [
+          _buildForm(),
+          if (_isLoading || _isSaving) _buildLoadingOverlay(),
+        ],
+      ),
+    );
+  }
+
+  Widget _buildForm() {
+    return SingleChildScrollView(
+      padding: const EdgeInsets.symmetric(horizontal: 16, vertical: 8),
+      child: Column(
+        crossAxisAlignment: CrossAxisAlignment.start,
+        children: [
+          _buildTitleField(),
+          const SizedBox(height: 16),
+          _buildField(
+            controller: _usernameController,
+            label: 'Username',
+            icon: Icons.person_outline,
+            suffix: _usernameController.text.isNotEmpty
+                ? IconButton(
+                    icon: Icon(Icons.copy, size: 18, color: context.textTertiary),
+                    onPressed: () =>
+                        _copyField(_usernameController.text, 'Username'),
+                  )
+                : null,
+          ),
+          const SizedBox(height: 16),
+          _buildPasswordField(),
+          const SizedBox(height: 16),
+          _buildField(
+            controller: _urlController,
+            label: 'URL',
+            icon: Icons.link,
+            keyboardType: TextInputType.url,
+          ),
+          const SizedBox(height: 16),
+          _buildField(
+            controller: _notesController,
+            label: 'Notes',
+            icon: Icons.note_outlined,
+            maxLines: 3,
+          ),
+          const SizedBox(height: 16),
+          _buildTagsSection(),
+          if (!isEditing) ...[
+            const SizedBox(height: 16),
+            _buildAlgorithmSection(),
+            const SizedBox(height: 16),
+            _buildKdfSection(),
+          ],
+          const SizedBox(height: 32),
+        ],
+      ),
+    );
+  }
+
+  bool get isEditing => widget.entry != null;
+
+  Widget _buildTitleField() {
+    return TextField(
+      controller: _titleController,
+      style: TextStyle(
+        fontFamily: 'ProductSans',
+        fontSize: 22,
+        fontWeight: FontWeight.w600,
+        color: context.textPrimary,
+      ),
+      decoration: InputDecoration(
+        hintText: 'Title',
+        hintStyle: TextStyle(
+          fontFamily: 'ProductSans',
+          fontSize: 22,
+          fontWeight: FontWeight.w600,
+          color: context.textTertiary,
+        ),
+        border: InputBorder.none,
+        enabledBorder: InputBorder.none,
+        focusedBorder: InputBorder.none,
+      ),
+    );
+  }
+
+  Widget _buildField({
+    required TextEditingController controller,
+    required String label,
+    required IconData icon,
+    TextInputType? keyboardType,
+    int maxLines = 1,
+    Widget? suffix,
+  }) {
+    return TextField(
+      controller: controller,
+      keyboardType: keyboardType,
+      maxLines: maxLines,
+      style: TextStyle(
+        fontFamily: 'ProductSans',
+        fontSize: 15,
+        color: context.textPrimary,
+      ),
+      decoration: InputDecoration(
+        labelText: label,
+        labelStyle: TextStyle(
+          fontFamily: 'ProductSans',
+          fontSize: 14,
+          color: context.textTertiary,
+        ),
+        prefixIcon: Icon(icon, color: context.textTertiary, size: 20),
+        suffixIcon: suffix,
+        filled: true,
+        fillColor: context.surfaceColor,
+        border: OutlineInputBorder(
+          borderRadius: BorderRadius.circular(12),
+          borderSide: BorderSide(color: context.borderColor),
+        ),
+        enabledBorder: OutlineInputBorder(
+          borderRadius: BorderRadius.circular(12),
+          borderSide: BorderSide(color: context.borderColor),
+        ),
+        focusedBorder: OutlineInputBorder(
+          borderRadius: BorderRadius.circular(12),
+          borderSide: BorderSide(color: context.accentColor, width: 2),
+        ),
+      ),
+    );
+  }
+
+  Widget _buildPasswordField() {
+    return TextField(
+      controller: _passwordController,
+      obscureText: _obscurePassword,
+      style: TextStyle(
+        fontFamily: 'ProductSans',
+        fontSize: 15,
+        color: context.textPrimary,
+      ),
+      decoration: InputDecoration(
+        labelText: 'Password',
+        labelStyle: TextStyle(
+          fontFamily: 'ProductSans',
+          fontSize: 14,
+          color: context.textTertiary,
+        ),
+        prefixIcon:
+            Icon(Icons.lock_outline, color: context.textTertiary, size: 20),
+        suffixIcon: Row(
+          mainAxisSize: MainAxisSize.min,
+          children: [
+            IconButton(
+              icon: Icon(
+                _obscurePassword
+                    ? Icons.visibility_outlined
+                    : Icons.visibility_off_outlined,
+                size: 18,
+                color: context.textTertiary,
+              ),
+              onPressed: () =>
+                  setState(() => _obscurePassword = !_obscurePassword),
+            ),
+            IconButton(
+              icon: Icon(Icons.auto_awesome, size: 18, color: context.accentColor),
+              onPressed: _showGenerator,
+              tooltip: 'Generate',
+            ),
+            if (_passwordController.text.isNotEmpty)
+              IconButton(
+                icon: Icon(Icons.copy, size: 18, color: context.textTertiary),
+                onPressed: () =>
+                    _copyField(_passwordController.text, 'Password'),
+              ),
+          ],
+        ),
+        filled: true,
+        fillColor: context.surfaceColor,
+        border: OutlineInputBorder(
+          borderRadius: BorderRadius.circular(12),
+          borderSide: BorderSide(color: context.borderColor),
+        ),
+        enabledBorder: OutlineInputBorder(
+          borderRadius: BorderRadius.circular(12),
+          borderSide: BorderSide(color: context.borderColor),
+        ),
+        focusedBorder: OutlineInputBorder(
+          borderRadius: BorderRadius.circular(12),
+          borderSide: BorderSide(color: context.accentColor, width: 2),
+        ),
+      ),
+    );
+  }
+
+  Widget _buildTagsSection() {
+    return Column(
+      crossAxisAlignment: CrossAxisAlignment.start,
+      children: [
+        Text(
+          'Tags',
+          style: TextStyle(
+            fontFamily: 'ProductSans',
+            fontSize: 14,
+            color: context.textSecondary,
+          ),
+        ),
+        const SizedBox(height: 8),
+        if (_tags.isNotEmpty)
+          Wrap(
+            spacing: 6,
+            runSpacing: 6,
+            children: _tags.map((tag) {
+              return Chip(
+                label: Text(
+                  tag,
+                  style: TextStyle(
+                    fontFamily: 'ProductSans',
+                    fontSize: 12,
+                    color: context.accentColor,
+                  ),
+                ),
+                backgroundColor: context.accentColor.withValues(alpha: 0.12),
+                side: BorderSide.none,
+                deleteIcon: Icon(Icons.close, size: 14, color: context.textTertiary),
+                onDeleted: () => setState(() => _tags.remove(tag)),
+              );
+            }).toList(),
+          ),
+        const SizedBox(height: 8),
+        Row(
+          children: [
+            Expanded(
+              child: TextField(
+                controller: _tagController,
+                style: TextStyle(
+                  fontFamily: 'ProductSans',
+                  fontSize: 14,
+                  color: context.textPrimary,
+                ),
+                decoration: InputDecoration(
+                  hintText: 'Add tag...',
+                  hintStyle: TextStyle(
+                    fontFamily: 'ProductSans',
+                    fontSize: 14,
+                    color: context.textTertiary,
+                  ),
+                  filled: true,
+                  fillColor: context.surfaceColor,
+                  isDense: true,
+                  border: OutlineInputBorder(
+                    borderRadius: BorderRadius.circular(12),
+                    borderSide: BorderSide(color: context.borderColor),
+                  ),
+                  enabledBorder: OutlineInputBorder(
+                    borderRadius: BorderRadius.circular(12),
+                    borderSide: BorderSide(color: context.borderColor),
+                  ),
+                  focusedBorder: OutlineInputBorder(
+                    borderRadius: BorderRadius.circular(12),
+                    borderSide: BorderSide(color: context.accentColor),
+                  ),
+                ),
+                onSubmitted: (_) => _addTag(),
+              ),
+            ),
+            const SizedBox(width: 8),
+            IconButton(
+              icon: Icon(Icons.add, color: context.accentColor),
+              onPressed: _addTag,
+            ),
+          ],
+        ),
+      ],
+    );
+  }
+
+  Widget _buildAlgorithmSection() {
+    return Column(
+      crossAxisAlignment: CrossAxisAlignment.start,
+      children: [
+        Text(
+          'Encryption',
+          style: TextStyle(
+            fontFamily: 'ProductSans',
+            fontSize: 14,
+            color: context.textSecondary,
+          ),
+        ),
+        const SizedBox(height: 8),
+        Wrap(
+          spacing: 8,
+          children: EncryptionAlgorithm.values.map((alg) {
+            final selected = _algorithm == alg;
+            return ChoiceChip(
+              label: Text(alg.displayName),
+              selected: selected,
+              selectedColor: context.accentColor.withValues(alpha: 0.2),
+              labelStyle: TextStyle(
+                fontFamily: 'ProductSans',
+                fontSize: 13,
+                color: selected ? context.accentColor : context.textSecondary,
+              ),
+              side: BorderSide(
+                color: selected ? context.accentColor : context.borderColor,
+              ),
+              onSelected: (_) => setState(() => _algorithm = alg),
+            );
+          }).toList(),
+        ),
+      ],
+    );
+  }
+
+  Widget _buildKdfSection() {
+    const options = [100000, 200000, 500000];
+    const labels = ['100K', '200K', '500K'];
+
+    return Column(
+      crossAxisAlignment: CrossAxisAlignment.start,
+      children: [
+        Text(
+          'Key Derivation Iterations',
+          style: TextStyle(
+            fontFamily: 'ProductSans',
+            fontSize: 14,
+            color: context.textSecondary,
+          ),
+        ),
+        const SizedBox(height: 8),
+        Wrap(
+          spacing: 8,
+          children: List.generate(options.length, (i) {
+            final selected = _kdfIterations == options[i];
+            return ChoiceChip(
+              label: Text(labels[i]),
+              selected: selected,
+              selectedColor: context.accentColor.withValues(alpha: 0.2),
+              labelStyle: TextStyle(
+                fontFamily: 'ProductSans',
+                fontSize: 13,
+                color: selected ? context.accentColor : context.textSecondary,
+              ),
+              side: BorderSide(
+                color: selected ? context.accentColor : context.borderColor,
+              ),
+              onSelected: (_) => setState(() => _kdfIterations = options[i]),
+            );
+          }),
+        ),
+      ],
+    );
+  }
+
+  Widget _buildLoadingOverlay() {
+    return Positioned.fill(
+      child: Container(
+        color: context.backgroundColor.withValues(alpha: 0.7),
+        child: Center(
+          child: CircularProgressIndicator(
+            valueColor: AlwaysStoppedAnimation(context.accentColor),
+          ),
+        ),
+      ),
+    );
+  }
+}

From 8cfbe97bfa46a4d861af4ffd6031409063e420f5 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 18:18:57 +0800
Subject: [PATCH 15/64] Add password list screen with search, filtering, and
 multi-select

---
 lib/screens/password_list_screen.dart | 461 ++++++++++++++++++++++++++
 1 file changed, 461 insertions(+)
 create mode 100644 lib/screens/password_list_screen.dart

diff --git a/lib/screens/password_list_screen.dart b/lib/screens/password_list_screen.dart
new file mode 100644
index 0000000..cef63f5
--- /dev/null
+++ b/lib/screens/password_list_screen.dart
@@ -0,0 +1,461 @@
+import 'package:flutter/material.dart';
+import 'package:flutter_riverpod/flutter_riverpod.dart';
+import 'package:shared_preferences/shared_preferences.dart';
+
+import '../models/password_entry.dart';
+import '../providers/password_providers.dart';
+import '../themes/app_colors.dart';
+import '../utils/toast_utils.dart';
+import '../widgets/password_card.dart';
+import 'password_editor_screen.dart';
+
+class PasswordListScreen extends ConsumerStatefulWidget {
+  const PasswordListScreen({super.key});
+
+  @override
+  ConsumerState<PasswordListScreen> createState() =>
+      _PasswordListScreenState();
+}
+
+class _PasswordListScreenState extends ConsumerState<PasswordListScreen> {
+  final TextEditingController _searchController = TextEditingController();
+  final Set<String> _selectedIds = {};
+  bool _isSelectionMode = false;
+  bool _showAutofillInfo = false;
+
+  @override
+  void initState() {
+    super.initState();
+    _loadAutofillInfoState();
+  }
+
+  Future<void> _loadAutofillInfoState() async {
+    final prefs = await SharedPreferences.getInstance();
+    if (mounted) {
+      setState(() {
+        _showAutofillInfo =
+            !(prefs.getBool('autofill_info_dismissed') ?? false);
+      });
+    }
+  }
+
+  Future<void> _dismissAutofillInfo() async {
+    final prefs = await SharedPreferences.getInstance();
+    await prefs.setBool('autofill_info_dismissed', true);
+    setState(() => _showAutofillInfo = false);
+  }
+
+  @override
+  void dispose() {
+    _searchController.dispose();
+    super.dispose();
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    final searchQuery = ref.watch(passwordSearchQueryProvider);
+    final selectedTag = ref.watch(selectedPasswordTagProvider);
+    final entriesAsync = ref.watch(passwordsNotifierProvider);
+
+    return Scaffold(
+      backgroundColor: context.backgroundColor,
+      appBar: _isSelectionMode
+          ? _buildSelectionAppBar()
+          : AppBar(
+              backgroundColor: context.backgroundColor,
+              elevation: 0,
+              title: Text(
+                'Passwords',
+                style: TextStyle(
+                  fontFamily: 'ProductSans',
+                  fontSize: 20,
+                  fontWeight: FontWeight.w600,
+                  color: context.textPrimary,
+                ),
+              ),
+            ),
+      body: Column(
+        children: [
+          Padding(
+            padding: const EdgeInsets.all(16),
+            child: TextField(
+              controller: _searchController,
+              onChanged: (value) {
+                ref.read(passwordSearchQueryProvider.notifier).state = value;
+              },
+              style: TextStyle(
+                fontFamily: 'ProductSans',
+                color: context.textPrimary,
+              ),
+              decoration: InputDecoration(
+                hintText: 'Search passwords...',
+                hintStyle: TextStyle(
+                  fontFamily: 'ProductSans',
+                  color: context.textTertiary,
+                ),
+                prefixIcon: Icon(Icons.search, color: context.textTertiary),
+                filled: true,
+                fillColor: context.surfaceColor,
+                border: OutlineInputBorder(
+                  borderRadius: BorderRadius.circular(12),
+                  borderSide: BorderSide(color: context.borderColor),
+                ),
+                enabledBorder: OutlineInputBorder(
+                  borderRadius: BorderRadius.circular(12),
+                  borderSide: BorderSide(color: context.borderColor),
+                ),
+                focusedBorder: OutlineInputBorder(
+                  borderRadius: BorderRadius.circular(12),
+                  borderSide: BorderSide(color: context.accentColor),
+                ),
+              ),
+            ),
+          ),
+          if (_showAutofillInfo) _buildAutofillInfoCard(),
+          Expanded(
+            child: entriesAsync.when(
+              data: (entries) {
+                final allTags = _collectTags(entries);
+                final filtered =
+                    _filterPasswords(entries, searchQuery, selectedTag);
+                return Column(
+                  children: [
+                    if (allTags.isNotEmpty)
+                      SizedBox(
+                        height: 40,
+                        child: ListView(
+                          scrollDirection: Axis.horizontal,
+                          padding: const EdgeInsets.symmetric(horizontal: 16),
+                          children: [
+                            _buildTagChip(
+                              null,
+                              selectedTag == null,
+                              'All',
+                            ),
+                            ...allTags.map((tag) =>
+                                _buildTagChip(tag, selectedTag == tag, tag)),
+                          ],
+                        ),
+                      ),
+                    Expanded(
+                      child: filtered.isEmpty
+                          ? _buildEmptyState(searchQuery)
+                          : ListView.builder(
+                              padding: const EdgeInsets.all(16),
+                              itemCount: filtered.length,
+                              itemBuilder: (context, index) {
+                                final entry = filtered[index];
+                                final isSelected =
+                                    _selectedIds.contains(entry.id);
+                                return Padding(
+                                  padding:
+                                      const EdgeInsets.only(bottom: 10),
+                                  child: PasswordCard(
+                                    entry: entry,
+                                    isSelected: isSelected,
+                                    onTap: () {
+                                      if (_isSelectionMode) {
+                                        setState(() {
+                                          if (isSelected) {
+                                            _selectedIds.remove(entry.id);
+                                            if (_selectedIds.isEmpty) {
+                                              _isSelectionMode = false;
+                                            }
+                                          } else {
+                                            _selectedIds.add(entry.id);
+                                          }
+                                        });
+                                      } else {
+                                        Navigator.push(
+                                          context,
+                                          MaterialPageRoute(
+                                            builder: (_) =>
+                                                PasswordEditorScreen(
+                                                    entry: entry),
+                                          ),
+                                        );
+                                      }
+                                    },
+                                    onLongPress: () {
+                                      if (!_isSelectionMode) {
+                                        setState(() {
+                                          _isSelectionMode = true;
+                                          _selectedIds.add(entry.id);
+                                        });
+                                      }
+                                    },
+                                  ),
+                                );
+                              },
+                            ),
+                    ),
+                  ],
+                );
+              },
+              loading: () =>
+                  const Center(child: CircularProgressIndicator()),
+              error: (error, _) => Center(
+                child: Text(
+                  'Error loading passwords',
+                  style: TextStyle(
+                    fontFamily: 'ProductSans',
+                    color: context.textTertiary,
+                  ),
+                ),
+              ),
+            ),
+          ),
+        ],
+      ),
+      floatingActionButton: _isSelectionMode
+          ? null
+          : FloatingActionButton(
+              onPressed: () => Navigator.push(
+                context,
+                MaterialPageRoute(
+                  builder: (_) => const PasswordEditorScreen(),
+                ),
+              ),
+              backgroundColor: context.accentColor,
+              child: const Icon(Icons.add, color: Colors.white),
+            ),
+    );
+  }
+
+  Widget _buildAutofillInfoCard() {
+    return Container(
+      margin: const EdgeInsets.fromLTRB(16, 0, 16, 12),
+      padding: const EdgeInsets.all(14),
+      decoration: BoxDecoration(
+        color: context.accentColor.withValues(alpha: 0.08),
+        borderRadius: BorderRadius.circular(12),
+        border: Border.all(
+          color: context.accentColor.withValues(alpha: 0.25),
+        ),
+      ),
+      child: Row(
+        crossAxisAlignment: CrossAxisAlignment.start,
+        children: [
+          Icon(Icons.auto_awesome, color: context.accentColor, size: 20),
+          const SizedBox(width: 10),
+          Expanded(
+            child: Column(
+              crossAxisAlignment: CrossAxisAlignment.start,
+              mainAxisSize: MainAxisSize.min,
+              children: [
+                Text(
+                  'Autofill is available',
+                  style: TextStyle(
+                    fontFamily: 'ProductSans',
+                    fontSize: 14,
+                    fontWeight: FontWeight.w600,
+                    color: context.accentColor,
+                  ),
+                ),
+                const SizedBox(height: 6),
+                Text(
+                  'Enable in Android Settings to fill logins in any app:\n'
+                  'Settings → Passwords & accounts → Autofill service → Latch',
+                  style: TextStyle(
+                    fontFamily: 'ProductSans',
+                    fontSize: 12,
+                    color: context.textSecondary,
+                    height: 1.4,
+                  ),
+                ),
+              ],
+            ),
+          ),
+          GestureDetector(
+            onTap: _dismissAutofillInfo,
+            child: Padding(
+              padding: const EdgeInsets.only(left: 8),
+              child:
+                  Icon(Icons.close, size: 16, color: context.textTertiary),
+            ),
+          ),
+        ],
+      ),
+    );
+  }
+
+  PreferredSizeWidget _buildSelectionAppBar() {
+    return AppBar(
+      backgroundColor: context.backgroundColor,
+      elevation: 0,
+      leading: IconButton(
+        icon: Icon(Icons.close, color: context.textPrimary),
+        onPressed: () {
+          setState(() {
+            _isSelectionMode = false;
+            _selectedIds.clear();
+          });
+        },
+      ),
+      title: Text(
+        '${_selectedIds.length} selected',
+        style: TextStyle(
+          fontFamily: 'ProductSans',
+          fontSize: 18,
+          fontWeight: FontWeight.w600,
+          color: context.textPrimary,
+        ),
+      ),
+      actions: [
+        IconButton(
+          icon: Icon(Icons.delete_outline, color: AppColors.error),
+          onPressed: _showDeleteConfirmation,
+        ),
+      ],
+    );
+  }
+
+  Widget _buildTagChip(String? tag, bool isSelected, String label) {
+    return Padding(
+      padding: const EdgeInsets.only(right: 8),
+      child: FilterChip(
+        label: Text(
+          label,
+          style: TextStyle(
+            fontFamily: 'ProductSans',
+            fontSize: 12,
+            color: isSelected
+                ? Colors.white
+                : context.textSecondary,
+          ),
+        ),
+        selected: isSelected,
+        onSelected: (_) {
+          ref.read(selectedPasswordTagProvider.notifier).state = tag;
+        },
+        selectedColor: context.accentColor,
+        backgroundColor: context.surfaceColor,
+        side: BorderSide(
+          color: isSelected ? context.accentColor : context.borderColor,
+        ),
+        visualDensity: VisualDensity.compact,
+      ),
+    );
+  }
+
+  Widget _buildEmptyState(String searchQuery) {
+    return Center(
+      child: Column(
+        mainAxisAlignment: MainAxisAlignment.center,
+        children: [
+          Icon(
+            Icons.lock_outline,
+            size: 64,
+            color: context.textTertiary,
+          ),
+          const SizedBox(height: 16),
+          Text(
+            searchQuery.isNotEmpty
+                ? 'No passwords found'
+                : 'No passwords yet',
+            style: TextStyle(
+              fontFamily: 'ProductSans',
+              fontSize: 16,
+              color: context.textTertiary,
+            ),
+          ),
+        ],
+      ),
+    );
+  }
+
+  List<String> _collectTags(List<PasswordEntry> entries) {
+    final tags = <String>{};
+    for (final entry in entries) {
+      tags.addAll(entry.tags);
+    }
+    return tags.toList()..sort();
+  }
+
+  List<PasswordEntry> _filterPasswords(
+    List<PasswordEntry> entries,
+    String searchQuery,
+    String? selectedTag,
+  ) {
+    var filtered = entries;
+    if (selectedTag != null) {
+      filtered = filtered.where((e) => e.hasTag(selectedTag)).toList();
+    }
+    if (searchQuery.isNotEmpty) {
+      final query = searchQuery.toLowerCase();
+      filtered = filtered
+          .where((e) =>
+              e.title.toLowerCase().contains(query) ||
+              e.tags.any((t) => t.contains(query)))
+          .toList();
+    }
+    filtered.sort((a, b) {
+      if (a.isFavorite && !b.isFavorite) return -1;
+      if (!a.isFavorite && b.isFavorite) return 1;
+      return b.updatedAt.compareTo(a.updatedAt);
+    });
+    return filtered;
+  }
+
+  Future<void> _showDeleteConfirmation() async {
+    final confirmed = await showDialog<bool>(
+      context: context,
+      builder: (context) => AlertDialog(
+        backgroundColor: context.surfaceColor,
+        title: Text(
+          'Delete Passwords',
+          style: TextStyle(
+            fontFamily: 'ProductSans',
+            fontWeight: FontWeight.w600,
+            color: context.textPrimary,
+          ),
+        ),
+        content: Text(
+          'Delete ${_selectedIds.length} entry(s)? This cannot be undone.',
+          style: TextStyle(
+            fontFamily: 'ProductSans',
+            color: context.textSecondary,
+          ),
+        ),
+        actions: [
+          TextButton(
+            onPressed: () => Navigator.pop(context, false),
+            child: Text(
+              'Cancel',
+              style: TextStyle(
+                fontFamily: 'ProductSans',
+                color: context.textSecondary,
+              ),
+            ),
+          ),
+          TextButton(
+            onPressed: () => Navigator.pop(context, true),
+            child: Text(
+              'Delete',
+              style: TextStyle(
+                fontFamily: 'ProductSans',
+                color: AppColors.error,
+              ),
+            ),
+          ),
+        ],
+      ),
+    );
+
+    if (confirmed == true && mounted) {
+      final entriesAsync = ref.read(passwordsNotifierProvider);
+      entriesAsync.whenData((entries) async {
+        final toDelete =
+            entries.where((e) => _selectedIds.contains(e.id)).toList();
+        await ref.read(passwordsNotifierProvider.notifier).deletePasswords(toDelete);
+        if (mounted) {
+          setState(() {
+            _isSelectionMode = false;
+            _selectedIds.clear();
+          });
+          ToastUtils.showSuccess('Passwords deleted');
+        }
+      });
+    }
+  }
+}

From 18d4f018008ce8f13855412ad8471cf86385b47c Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 18:19:05 +0800
Subject: [PATCH 16/64] Add password service with encryption and vault
 integration

---
 lib/services/password_service.dart | 307 +++++++++++++++++++++++++++++
 1 file changed, 307 insertions(+)
 create mode 100644 lib/services/password_service.dart

diff --git a/lib/services/password_service.dart b/lib/services/password_service.dart
new file mode 100644
index 0000000..dfbc6c3
--- /dev/null
+++ b/lib/services/password_service.dart
@@ -0,0 +1,307 @@
+import 'dart:convert';
+import 'dart:io';
+import 'dart:typed_data';
+
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+import 'package:path_provider/path_provider.dart';
+import 'package:uuid/uuid.dart';
+
+import '../models/password_entry.dart';
+import '../models/encryption_algorithm.dart';
+import 'encryption_service.dart';
+import 'vault_service.dart';
+
+class PasswordService {
+  PasswordService._();
+  static final PasswordService instance = PasswordService._();
+
+  final FlutterSecureStorage _secureStorage = const FlutterSecureStorage();
+  final EncryptionService _encryptionService = EncryptionService.instance;
+
+  static const String _indexKey = 'locker_passwords_index';
+  static const String _dirName = 'passwords';
+  static const int _defaultKdfIterations = 100000;
+
+  List<PasswordEntry>? _cachedEntries;
+
+  Future<String> _getDir({bool isDecoy = false}) async {
+    final appDir = await getApplicationDocumentsDirectory();
+    final baseDir = isDecoy ? '.locker_decoy' : '.locker_vault';
+    return '${appDir.path}/$baseDir/$_dirName';
+  }
+
+  Future<void> _ensureDir({bool isDecoy = false}) async {
+    final dir = Directory(await _getDir(isDecoy: isDecoy));
+    if (!await dir.exists()) {
+      await dir.create(recursive: true);
+    }
+  }
+
+  Future<List<PasswordEntry>> loadPasswords({bool isDecoy = false}) async {
+    if (_cachedEntries != null) return _cachedEntries!;
+    final json = await _secureStorage.read(key: _indexKey);
+    if (json == null || json.isEmpty) {
+      _cachedEntries = [];
+      return _cachedEntries!;
+    }
+    try {
+      final List<dynamic> decoded = jsonDecode(json) as List<dynamic>;
+      _cachedEntries = decoded
+          .map((e) => PasswordEntry.fromJson(e as Map<String, dynamic>))
+          .toList();
+    } catch (_) {
+      _cachedEntries = [];
+    }
+    return _cachedEntries!;
+  }
+
+  Future<void> _save() async {
+    if (_cachedEntries == null) return;
+    final json =
+        jsonEncode(_cachedEntries!.map((e) => e.toJson()).toList());
+    await _secureStorage.write(key: _indexKey, value: json);
+  }
+
+  Future<Uint8List> _deriveKey(
+    PasswordEntry entry, {
+    bool isDecoy = false,
+  }) async {
+    final masterKey =
+        await _encryptionService.getMasterKey(isDecoy: isDecoy);
+    final salt = base64Decode(entry.keyDerivationSalt);
+    return _encryptionService.deriveFileKeyAsync(
+        masterKey, salt, entry.kdfIterations);
+  }
+
+  Future<PasswordEntry> createPassword({
+    required String title,
+    required PasswordContent content,
+    List<String> tags = const [],
+    EncryptionAlgorithm encryptionAlgorithm = EncryptionAlgorithm.aes256Gcm,
+    int kdfIterations = _defaultKdfIterations,
+    bool isDecoy = false,
+    void Function(String status, {bool isEncrypting})? onProgress,
+  }) async {
+    onProgress?.call('Preparing...', isEncrypting: false);
+    await _ensureDir(isDecoy: isDecoy);
+    await loadPasswords(isDecoy: isDecoy);
+
+    final id = const Uuid().v4();
+    final now = DateTime.now();
+    final dir = await _getDir(isDecoy: isDecoy);
+
+    onProgress?.call('Encrypting...', isEncrypting: true);
+    final filePath = '$dir/$id.enc';
+    final masterKey =
+        await _encryptionService.getMasterKey(isDecoy: isDecoy);
+    final saltBytes = _encryptionService.generateFileSalt();
+    final derivedKey = await _encryptionService.deriveFileKeyAsync(
+      masterKey,
+      saltBytes,
+      kdfIterations,
+    );
+
+    final data =
+        Uint8List.fromList(utf8.encode(content.toJsonString()));
+    final result = encryptionAlgorithm == EncryptionAlgorithm.aes256Gcm
+        ? await _encryptionService.encryptBytesStreamedGcm(
+            data,
+            filePath,
+            isDecoy: isDecoy,
+            derivedKey: derivedKey,
+          )
+        : await _encryptionService.encryptBytesStreamed(
+            data,
+            filePath,
+            isDecoy: isDecoy,
+            derivedKey: derivedKey,
+          );
+
+    if (!result.success) {
+      throw Exception('Failed to encrypt password entry');
+    }
+
+    onProgress?.call('Registering in vault...', isEncrypting: false);
+    final entry = PasswordEntry(
+      id: id,
+      title: title,
+      encryptedContentPath: result.encryptedPath!,
+      iv: result.iv!,
+      keyDerivationSalt: base64Encode(saltBytes),
+      kdfIterations: kdfIterations,
+      tags: tags,
+      isEncrypted: true,
+      encryptionAlgorithm: encryptionAlgorithm,
+      createdAt: now,
+      updatedAt: now,
+    );
+
+    _cachedEntries!.insert(0, entry);
+    await _save();
+
+    await VaultService.instance.registerPasswordEntry(
+      passwordId: entry.id,
+      title: entry.title,
+      encryptedContentPath: entry.encryptedContentPath,
+      tags: entry.tags,
+      isEncrypted: true,
+      encryptionAlgorithm: encryptionAlgorithm,
+      kdfIterations: kdfIterations,
+      isDecoy: isDecoy,
+    );
+
+    return entry;
+  }
+
+  Future<PasswordContent> decryptContent(
+    PasswordEntry entry, {
+    bool isDecoy = false,
+  }) async {
+    final derivedKey = await _deriveKey(entry, isDecoy: isDecoy);
+
+    final result = entry.encryptionAlgorithm == EncryptionAlgorithm.aes256Gcm
+        ? await _encryptionService.decryptStreamedFileToMemoryGcm(
+            entry.encryptedContentPath,
+            entry.iv,
+            isDecoy: isDecoy,
+            derivedKey: derivedKey,
+          )
+        : await _encryptionService.decryptStreamedFileToMemory(
+            entry.encryptedContentPath,
+            entry.iv,
+            isDecoy: isDecoy,
+            derivedKey: derivedKey,
+          );
+
+    if (!result.success || result.data == null) {
+      throw Exception('Failed to decrypt: ${result.error}');
+    }
+
+    return PasswordContent.fromJsonString(utf8.decode(result.data!));
+  }
+
+  Future<PasswordEntry> updatePassword(
+    PasswordEntry entry, {
+    String? title,
+    PasswordContent? content,
+    List<String>? tags,
+    EncryptionAlgorithm encryptionAlgorithm = EncryptionAlgorithm.aes256Gcm,
+    int kdfIterations = _defaultKdfIterations,
+    bool isDecoy = false,
+  }) async {
+    await loadPasswords(isDecoy: isDecoy);
+
+    var updated = entry.copyWith(
+      title: title,
+      tags: tags,
+      encryptionAlgorithm: encryptionAlgorithm,
+      updatedAt: DateTime.now(),
+    );
+
+    if (content != null) {
+      final masterKey =
+          await _encryptionService.getMasterKey(isDecoy: isDecoy);
+      final salt = _encryptionService.generateFileSalt();
+      final derivedKey = await _encryptionService.deriveFileKeyAsync(
+        masterKey,
+        salt,
+        kdfIterations,
+      );
+
+      final data =
+          Uint8List.fromList(utf8.encode(content.toJsonString()));
+      final result = updated.encryptionAlgorithm == EncryptionAlgorithm.aes256Gcm
+          ? await _encryptionService.encryptBytesStreamedGcm(
+              data,
+              entry.encryptedContentPath,
+              isDecoy: isDecoy,
+              derivedKey: derivedKey,
+            )
+          : await _encryptionService.encryptBytesStreamed(
+              data,
+              entry.encryptedContentPath,
+              isDecoy: isDecoy,
+              derivedKey: derivedKey,
+            );
+
+      if (!result.success) {
+        throw Exception('Failed to re-encrypt password entry');
+      }
+
+      updated = updated.copyWith(
+        encryptedContentPath: result.encryptedPath,
+        iv: result.iv,
+        keyDerivationSalt: base64Encode(salt),
+        kdfIterations: kdfIterations,
+      );
+    }
+
+    final index = _cachedEntries!.indexWhere((e) => e.id == entry.id);
+    if (index != -1) {
+      _cachedEntries![index] = updated;
+      await _save();
+
+      await VaultService.instance.registerPasswordEntry(
+        passwordId: updated.id,
+        title: updated.title,
+        encryptedContentPath: updated.encryptedContentPath,
+        tags: updated.tags,
+        isEncrypted: true,
+        encryptionAlgorithm: updated.encryptionAlgorithm,
+        kdfIterations: updated.kdfIterations,
+        isDecoy: isDecoy,
+      );
+    }
+
+    return updated;
+  }
+
+  Future<void> deletePassword(PasswordEntry entry,
+      {bool isDecoy = false}) async {
+    await loadPasswords(isDecoy: isDecoy);
+    await _encryptionService.secureDelete(entry.encryptedContentPath);
+    _cachedEntries!.removeWhere((e) => e.id == entry.id);
+    await _save();
+    await VaultService.instance.removePasswordEntry(entry.id, isDecoy: isDecoy);
+  }
+
+  Future<void> deletePasswords(List<PasswordEntry> entries,
+      {bool isDecoy = false}) async {
+    await loadPasswords(isDecoy: isDecoy);
+    for (final entry in entries) {
+      await _encryptionService.secureDelete(entry.encryptedContentPath);
+    }
+    final ids = entries.map((e) => e.id).toSet();
+    _cachedEntries!.removeWhere((e) => ids.contains(e.id));
+    await _save();
+    for (final entry in entries) {
+      await VaultService.instance.removePasswordEntry(entry.id, isDecoy: isDecoy);
+    }
+  }
+
+  Future<PasswordEntry> toggleFavorite(PasswordEntry entry,
+      {bool isDecoy = false}) async {
+    await loadPasswords(isDecoy: isDecoy);
+    final toggled = entry.toggleFavorite();
+    final index = _cachedEntries!.indexWhere((e) => e.id == entry.id);
+    if (index != -1) {
+      _cachedEntries![index] = toggled;
+      await _save();
+    }
+    return toggled;
+  }
+
+  List<PasswordEntry> searchPasswords(String query) {
+    if (_cachedEntries == null) return [];
+    final lower = query.toLowerCase();
+    return _cachedEntries!
+        .where((e) =>
+            e.title.toLowerCase().contains(lower) ||
+            e.tags.any((t) => t.contains(lower)))
+        .toList();
+  }
+
+  void clearCache() {
+    _cachedEntries = null;
+  }
+}

From 71172151c37052afde21b416deca061687466b64 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 18:19:10 +0800
Subject: [PATCH 17/64] Add clipboard utility with auto-clear functionality

---
 lib/utils/clipboard_util.dart | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100644 lib/utils/clipboard_util.dart

diff --git a/lib/utils/clipboard_util.dart b/lib/utils/clipboard_util.dart
new file mode 100644
index 0000000..ce62e47
--- /dev/null
+++ b/lib/utils/clipboard_util.dart
@@ -0,0 +1,31 @@
+import 'dart:async';
+
+import 'package:flutter/services.dart';
+
+class ClipboardUtil {
+  ClipboardUtil._();
+
+  static Timer? _clearTimer;
+  static String? _lastCopied;
+
+  static Future<void> copyWithAutoClear(
+    String text, {
+    int seconds = 20,
+  }) async {
+    _clearTimer?.cancel();
+    _lastCopied = text;
+    await Clipboard.setData(ClipboardData(text: text));
+    _clearTimer = Timer(Duration(seconds: seconds), () async {
+      final current = await Clipboard.getData('text/plain');
+      if (current?.text == _lastCopied) {
+        await Clipboard.setData(const ClipboardData(text: ''));
+      }
+      _lastCopied = null;
+    });
+  }
+
+  static void cancelClear() {
+    _clearTimer?.cancel();
+    _lastCopied = null;
+  }
+}

From ce69e172f668372d0348d1cf514ce1f2337a3b9d Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 18:19:15 +0800
Subject: [PATCH 18/64] Add password entry card widget

---
 lib/widgets/password_card.dart | 125 +++++++++++++++++++++++++++++++++
 1 file changed, 125 insertions(+)
 create mode 100644 lib/widgets/password_card.dart

diff --git a/lib/widgets/password_card.dart b/lib/widgets/password_card.dart
new file mode 100644
index 0000000..25b6e56
--- /dev/null
+++ b/lib/widgets/password_card.dart
@@ -0,0 +1,125 @@
+import 'package:flutter/material.dart';
+
+import '../models/password_entry.dart';
+import '../themes/app_colors.dart';
+
+class PasswordCard extends StatelessWidget {
+  final PasswordEntry entry;
+  final VoidCallback? onTap;
+  final VoidCallback? onLongPress;
+  final bool isSelected;
+
+  const PasswordCard({
+    super.key,
+    required this.entry,
+    this.onTap,
+    this.onLongPress,
+    this.isSelected = false,
+  });
+
+  @override
+  Widget build(BuildContext context) {
+    return GestureDetector(
+      onTap: onTap,
+      onLongPress: onLongPress,
+      child: Container(
+        decoration: BoxDecoration(
+          color: isSelected
+              ? context.accentColor.withValues(alpha: 0.15)
+              : context.surfaceColor,
+          borderRadius: BorderRadius.circular(12),
+          border: Border.all(
+            color: isSelected ? context.accentColor : context.borderColor,
+            width: isSelected ? 2 : 1,
+          ),
+        ),
+        child: Padding(
+          padding: const EdgeInsets.all(14),
+          child: Column(
+            crossAxisAlignment: CrossAxisAlignment.start,
+            children: [
+              Row(
+                children: [
+                  Icon(
+                    Icons.lock_outline,
+                    size: 16,
+                    color: context.textTertiary,
+                  ),
+                  const SizedBox(width: 6),
+                  if (entry.isFavorite)
+                    Padding(
+                      padding: const EdgeInsets.only(right: 6),
+                      child: Icon(
+                        Icons.star,
+                        size: 14,
+                        color: context.accentColor,
+                      ),
+                    ),
+                  Expanded(
+                    child: Text(
+                      entry.title,
+                      style: TextStyle(
+                        fontFamily: 'ProductSans',
+                        fontSize: 15,
+                        fontWeight: FontWeight.w600,
+                        color: context.textPrimary,
+                      ),
+                      maxLines: 1,
+                      overflow: TextOverflow.ellipsis,
+                    ),
+                  ),
+                ],
+              ),
+              if (entry.tags.isNotEmpty) ...[
+                const SizedBox(height: 8),
+                Wrap(
+                  spacing: 4,
+                  runSpacing: 4,
+                  children: entry.tags.take(3).map((t) {
+                    return Container(
+                      padding: const EdgeInsets.symmetric(
+                        horizontal: 8,
+                        vertical: 2,
+                      ),
+                      decoration: BoxDecoration(
+                        color: context.accentColor.withValues(alpha: 0.12),
+                        borderRadius: BorderRadius.circular(6),
+                      ),
+                      child: Text(
+                        t,
+                        style: TextStyle(
+                          fontFamily: 'ProductSans',
+                          fontSize: 10,
+                          color: context.accentColor,
+                        ),
+                      ),
+                    );
+                  }).toList(),
+                ),
+              ],
+              const SizedBox(height: 8),
+              Text(
+                _formatDate(entry.updatedAt),
+                style: TextStyle(
+                  fontFamily: 'ProductSans',
+                  fontSize: 12,
+                  color: context.textTertiary,
+                ),
+              ),
+            ],
+          ),
+        ),
+      ),
+    );
+  }
+
+  String _formatDate(DateTime date) {
+    final now = DateTime.now();
+    final diff = now.difference(date);
+    if (diff.inMinutes < 1) return 'Just now';
+    if (diff.inHours < 1) return '${diff.inMinutes}m ago';
+    if (diff.inDays < 1) return '${diff.inHours}h ago';
+    if (diff.inDays < 7) return '${diff.inDays}d ago';
+    return '${date.day}/${date.month}/${date.year}';
+  }
+}

From 1c766fe1c81185e069898f62520831b9c17181f8 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 18:19:20 +0800
Subject: [PATCH 19/64] Add password generator sheet widget

---
 lib/widgets/password_generator_sheet.dart | 316 ++++++++++++++++++++++
 1 file changed, 316 insertions(+)
 create mode 100644 lib/widgets/password_generator_sheet.dart

diff --git a/lib/widgets/password_generator_sheet.dart b/lib/widgets/password_generator_sheet.dart
new file mode 100644
index 0000000..6634a40
--- /dev/null
+++ b/lib/widgets/password_generator_sheet.dart
@@ -0,0 +1,316 @@
+import 'dart:math';
+
+import 'package:flutter/material.dart';
+
+import '../themes/app_colors.dart';
+
+class PasswordGeneratorSheet extends StatefulWidget {
+  final void Function(String password) onGenerate;
+
+  const PasswordGeneratorSheet({
+    super.key,
+    required this.onGenerate,
+  });
+
+  @override
+  State<PasswordGeneratorSheet> createState() => _PasswordGeneratorSheetState();
+}
+
+class _PasswordGeneratorSheetState extends State<PasswordGeneratorSheet> {
+  double _length = 20;
+  bool _useUpper = true;
+  bool _useLower = true;
+  bool _useDigits = true;
+  bool _useSymbols = true;
+  bool _excludeAmbiguous = true;
+  String _generated = '';
+
+  static const String _upper = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
+  static const String _lower = 'abcdefghijklmnopqrstuvwxyz';
+  static const String _digits = '0123456789';
+  static const String _symbols = '!@#\$%^&*()-_=+[]{}|;:,.<>?';
+  static const String _ambiguous = 'Il1O0o';
+
+  String get _charset {
+    final chars = StringBuffer();
+    if (_useUpper) chars.write(_upper);
+    if (_useLower) chars.write(_lower);
+    if (_useDigits) chars.write(_digits);
+    if (_useSymbols) chars.write(_symbols);
+    var result = chars.toString();
+    if (_excludeAmbiguous) {
+      result = result.split('').where((c) => !_ambiguous.contains(c)).join();
+    }
+    return result;
+  }
+
+  void _generate() {
+    final charset = _charset;
+    if (charset.isEmpty) {
+      setState(() => _generated = '');
+      return;
+    }
+    final random = Random.secure();
+    final values =
+        List<int>.generate(_length.round(), (_) => random.nextInt(charset.length));
+    setState(() {
+      _generated = String.fromCharCodes(
+        values.map((i) => charset.codeUnitAt(i)),
+      );
+    });
+  }
+
+  String get _strengthLabel {
+    final len = _generated.length;
+    if (len == 0) return '';
+    final pool = _charset.length;
+    final entropy = len * (log(pool) / log(2));
+    if (entropy < 40) return 'Weak';
+    if (entropy < 60) return 'Fair';
+    if (entropy < 80) return 'Strong';
+    return 'Very Strong';
+  }
+
+  Color get _strengthColor {
+    final len = _generated.length;
+    if (len == 0) return Colors.grey;
+    final pool = _charset.length;
+    final entropy = len * (log(pool) / log(2));
+    if (entropy < 40) return AppColors.darkError;
+    if (entropy < 60) return AppColors.darkWarning;
+    if (entropy < 80) return AppColors.darkSuccess;
+    return AppColors.darkSuccess;
+  }
+
+  @override
+  void initState() {
+    super.initState();
+    _generate();
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    return Padding(
+      padding: EdgeInsets.only(
+        left: 20,
+        right: 20,
+        bottom: MediaQuery.of(context).viewInsets.bottom + 20,
+        top: 20,
+      ),
+      child: Column(
+        mainAxisSize: MainAxisSize.min,
+        crossAxisAlignment: CrossAxisAlignment.start,
+        children: [
+          Text(
+            'Password Generator',
+            style: TextStyle(
+              fontFamily: 'ProductSans',
+              fontSize: 18,
+              fontWeight: FontWeight.bold,
+              color: context.textPrimary,
+            ),
+          ),
+          const SizedBox(height: 16),
+          _buildPreview(),
+          const SizedBox(height: 16),
+          _buildLengthSlider(),
+          const SizedBox(height: 12),
+          _buildToggleRow('Uppercase (A-Z)', _useUpper, (v) {
+            setState(() => _useUpper = v);
+            _generate();
+          }),
+          _buildToggleRow('Lowercase (a-z)', _useLower, (v) {
+            setState(() => _useLower = v);
+            _generate();
+          }),
+          _buildToggleRow('Digits (0-9)', _useDigits, (v) {
+            setState(() => _useDigits = v);
+            _generate();
+          }),
+          _buildToggleRow('Symbols (!@#...)', _useSymbols, (v) {
+            setState(() => _useSymbols = v);
+            _generate();
+          }),
+          _buildToggleRow('Exclude ambiguous (Il1O0o)',
+              _excludeAmbiguous, (v) {
+            setState(() => _excludeAmbiguous = v);
+            _generate();
+          }),
+          const SizedBox(height: 20),
+          Row(
+            children: [
+              Expanded(
+                child: OutlinedButton.icon(
+                  onPressed: _generate,
+                  icon: const Icon(Icons.refresh),
+                  label: const Text('Regenerate'),
+                  style: OutlinedButton.styleFrom(
+                    foregroundColor: context.accentColor,
+                    side: BorderSide(color: context.borderColor),
+                    padding: const EdgeInsets.symmetric(vertical: 14),
+                    shape: RoundedRectangleBorder(
+                      borderRadius: BorderRadius.circular(12),
+                    ),
+                  ),
+                ),
+              ),
+              const SizedBox(width: 12),
+              Expanded(
+                child: FilledButton.icon(
+                  onPressed: _generated.isEmpty
+                      ? null
+                      : () {
+                          widget.onGenerate(_generated);
+                          Navigator.pop(context);
+                        },
+                  icon: const Icon(Icons.check),
+                  label: const Text('Use'),
+                  style: FilledButton.styleFrom(
+                    backgroundColor: context.accentColor,
+                    padding: const EdgeInsets.symmetric(vertical: 14),
+                    shape: RoundedRectangleBorder(
+                      borderRadius: BorderRadius.circular(12),
+                    ),
+                  ),
+                ),
+              ),
+            ],
+          ),
+        ],
+      ),
+    );
+  }
+
+  Widget _buildPreview() {
+    return Container(
+      width: double.infinity,
+      padding: const EdgeInsets.all(16),
+      decoration: BoxDecoration(
+        color: context.surfaceColor,
+        borderRadius: BorderRadius.circular(12),
+        border: Border.all(color: context.borderColor),
+      ),
+      child: Column(
+        crossAxisAlignment: CrossAxisAlignment.start,
+        children: [
+          Text(
+            _generated.isEmpty ? 'Select at least one charset' : _generated,
+            style: TextStyle(
+              fontFamily: 'ProductSans',
+              fontSize: 16,
+              fontWeight: FontWeight.w600,
+              color: _generated.isEmpty
+                  ? context.textTertiary
+                  : context.textPrimary,
+            ),
+          ),
+          if (_generated.isNotEmpty) ...[
+            const SizedBox(height: 8),
+            Row(
+              children: [
+                Text(
+                  _strengthLabel,
+                  style: TextStyle(
+                    fontFamily: 'ProductSans',
+                    fontSize: 12,
+                    fontWeight: FontWeight.w600,
+                    color: _strengthColor,
+                  ),
+                ),
+                const SizedBox(width: 8),
+                Expanded(
+                  child: ClipRRect(
+                    borderRadius: BorderRadius.circular(4),
+                    child: LinearProgressIndicator(
+                      value: _strengthProgress,
+                      backgroundColor: context.borderColor,
+                      valueColor: AlwaysStoppedAnimation(_strengthColor),
+                      minHeight: 4,
+                    ),
+                  ),
+                ),
+              ],
+            ),
+          ],
+        ],
+      ),
+    );
+  }
+
+  double get _strengthProgress {
+    final len = _generated.length;
+    if (len == 0) return 0;
+    final pool = _charset.length;
+    final entropy = len * (log(pool) / log(2));
+    return (entropy / 120).clamp(0.0, 1.0);
+  }
+
+  Widget _buildLengthSlider() {
+    return Column(
+      crossAxisAlignment: CrossAxisAlignment.start,
+      children: [
+        Row(
+          mainAxisAlignment: MainAxisAlignment.spaceBetween,
+          children: [
+            Text(
+              'Length',
+              style: TextStyle(
+                fontFamily: 'ProductSans',
+                fontSize: 14,
+                color: context.textSecondary,
+              ),
+            ),
+            Text(
+              '${_length.round()}',
+              style: TextStyle(
+                fontFamily: 'ProductSans',
+                fontSize: 14,
+                fontWeight: FontWeight.bold,
+                color: context.accentColor,
+              ),
+            ),
+          ],
+        ),
+        Slider(
+          value: _length,
+          min: 8,
+          max: 64,
+          divisions: 56,
+          activeColor: context.accentColor,
+          onChanged: (v) {
+            setState(() => _length = v);
+            _generate();
+          },
+        ),
+      ],
+    );
+  }
+
+  Widget _buildToggleRow(
+    String label,
+    bool value,
+    ValueChanged<bool> onChanged,
+  ) {
+    return Padding(
+      padding: const EdgeInsets.symmetric(vertical: 2),
+      child: Row(
+        mainAxisAlignment: MainAxisAlignment.spaceBetween,
+        children: [
+          Text(
+            label,
+            style: TextStyle(
+              fontFamily: 'ProductSans',
+              fontSize: 14,
+              color: context.textSecondary,
+            ),
+          ),
+          Switch(
+            value: value,
+            onChanged: onChanged,
+            activeThumbColor: context.accentColor,
+          ),
+        ],
+      ),
+    );
+  }
+}

From 9d7001993925c6420e2974d109d5361462d25b57 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 18:19:25 +0800
Subject: [PATCH 20/64] Add AutofillApp entry point widget

---
 lib/autofill_app.dart | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)
 create mode 100644 lib/autofill_app.dart

diff --git a/lib/autofill_app.dart b/lib/autofill_app.dart
new file mode 100644
index 0000000..f77a517
--- /dev/null
+++ b/lib/autofill_app.dart
@@ -0,0 +1,18 @@
+import 'package:flutter/material.dart';
+import 'models/accent_color.dart';
+import 'screens/autofill_selection_screen.dart';
+import 'themes/app_theme.dart';
+
+class AutofillApp extends StatelessWidget {
+  const AutofillApp({super.key});
+
+  @override
+  Widget build(BuildContext context) {
+    return MaterialApp(
+      title: 'Latch',
+      debugShowCheckedModeBanner: false,
+      theme: AppTheme.getDarkTheme(AccentColors.blue),
+      home: const AutofillSelectionScreen(),
+    );
+  }
+}

From a386a3d367f6c937fdba605c0c36bbdd05b93f23 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 18:27:41 +0800
Subject: [PATCH 21/64] Remove dot and row wrapper from Active status indicator

---
 lib/screens/change_security_screen.dart | 16 +---------------
 1 file changed, 1 insertion(+), 15 deletions(-)

diff --git a/lib/screens/change_security_screen.dart b/lib/screens/change_security_screen.dart
index 38516c1..3f987b2 100644
--- a/lib/screens/change_security_screen.dart
+++ b/lib/screens/change_security_screen.dart
@@ -348,19 +348,7 @@ class _ChangeSecurityScreenState extends State<ChangeSecurityScreen> {
                   color: AppColors.darkSuccess.withValues(alpha: 0.15),
                   borderRadius: BorderRadius.circular(20),
                 ),
-                child: Row(
-                  mainAxisSize: MainAxisSize.min,
-                  children: [
-                    Container(
-                      width: 6,
-                      height: 6,
-                      decoration: BoxDecoration(
-                        color: AppColors.darkSuccess,
-                        shape: BoxShape.circle,
-                      ),
-                    ),
-                    const SizedBox(width: 6),
-                    Text(
+                child: Text(
                       'Active',
                       style: TextStyle(
                         fontSize: 12,
@@ -369,8 +357,6 @@ class _ChangeSecurityScreenState extends State<ChangeSecurityScreen> {
                         color: AppColors.darkSuccess,
                       ),
                     ),
-                  ],
-                ),
               ),
             ],
           ),

From 5ba2cdee543daa83d9e7006b6f30045dfa1807f8 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 21:29:44 +0800
Subject: [PATCH 22/64] Disable app backup and add network security config

---
 android/app/src/main/AndroidManifest.xml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/android/app/src/main/AndroidManifest.xml b/android/app/src/main/AndroidManifest.xml
index 123a573..c91c0b7 100644
--- a/android/app/src/main/AndroidManifest.xml
+++ b/android/app/src/main/AndroidManifest.xml
@@ -29,7 +29,10 @@
         android:label="Latch"
         android:name="${applicationName}"
         android:icon="@mipmap/launcher_icon"
-        android:requestLegacyExternalStorage="true">
+        android:requestLegacyExternalStorage="true"
+        android:allowBackup="false"
+        android:dataExtractionRules="@xml/data_extraction_rules"
+        android:networkSecurityConfig="@xml/network_security_config">
 
         <activity
             android:name=".MainActivity"

From fe33d186139b33910858a14782e1cbab8e9f4ca1 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 21:29:50 +0800
Subject: [PATCH 23/64] Remove TODO comment and enable ProGuard minification
 for release builds

---
 android/app/build.gradle | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/android/app/build.gradle b/android/app/build.gradle
index 4d407ad..80469ca 100644
--- a/android/app/build.gradle
+++ b/android/app/build.gradle
@@ -47,7 +47,6 @@ android {
     }
 
     defaultConfig {
-        // TODO: Specify your own unique Application ID (https://developer.android.com/studio/build/application-id.html).
         applicationId = "com.mossapps.locker"
         // You can update the following values to match your application needs.
         // For more information, see: https://docs.flutter.dev/deployment/android#reviewing-the-gradle-build-configuration.
@@ -69,6 +68,9 @@ android {
     buildTypes {
         release {
             signingConfig = signingConfigs.release
+            minifyEnabled true
+            shrinkResources true
+            proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
         }
     }
 }

From f9f0059610e79ebd3c1a6f6ba5fa41fcf7aba1bd Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 21:29:58 +0800
Subject: [PATCH 24/64] Remove compression usage example file

---
 lib/examples/compression_usage_example.dart | 262 --------------------
 1 file changed, 262 deletions(-)
 delete mode 100644 lib/examples/compression_usage_example.dart

diff --git a/lib/examples/compression_usage_example.dart b/lib/examples/compression_usage_example.dart
deleted file mode 100644
index 36008bb..0000000
--- a/lib/examples/compression_usage_example.dart
+++ /dev/null
@@ -1,262 +0,0 @@
-import 'package:flutter/material.dart';
-import '../services/media_compression_service.dart';
-import '../utils/compression_helper.dart';
-import '../widgets/compression_options_dialog.dart';
-
-/// Example showing how to use compression features
-class CompressionUsageExample extends StatefulWidget {
-  const CompressionUsageExample({super.key});
-
-  @override
-  State<CompressionUsageExample> createState() => _CompressionUsageExampleState();
-}
-
-class _CompressionUsageExampleState extends State<CompressionUsageExample> {
-  String _statusMessage = '';
-  double _compressionProgress = 0.0;
-
-  @override
-  Widget build(BuildContext context) {
-    return Scaffold(
-      appBar: AppBar(
-        title: Text('Compression Examples'),
-      ),
-      body: Padding(
-        padding: EdgeInsets.all(16),
-        child: Column(
-          crossAxisAlignment: CrossAxisAlignment.stretch,
-          children: [
-            Text(
-              'Media Compression Options',
-              style: Theme.of(context).textTheme.headlineSmall,
-            ),
-            SizedBox(height: 16),
-            
-            // Status message
-            if (_statusMessage.isNotEmpty)
-              Card(
-                child: Padding(
-                  padding: EdgeInsets.all(12),
-                  child: Text(_statusMessage),
-                ),
-              ),
-            
-            // Progress indicator
-            if (_compressionProgress > 0)
-              LinearProgressIndicator(value: _compressionProgress),
-            
-            SizedBox(height: 24),
-            
-            // Example buttons
-            ElevatedButton(
-              onPressed: _exampleCompressImage,
-              child: Text('Example: Compress Image'),
-            ),
-            SizedBox(height: 8),
-            ElevatedButton(
-              onPressed: _exampleCompressVideo,
-              child: Text('Example: Compress Video'),
-            ),
-            SizedBox(height: 8),
-            ElevatedButton(
-              onPressed: _exampleShowCompressionDialog,
-              child: Text('Example: Show Compression Dialog'),
-            ),
-            SizedBox(height: 24),
-            
-            // Usage instructions
-            Expanded(
-              child: SingleChildScrollView(
-                child: Card(
-                  child: Padding(
-                    padding: EdgeInsets.all(16),
-                    child: Column(
-                      crossAxisAlignment: CrossAxisAlignment.start,
-                      children: [
-                        Text(
-                          'Usage Instructions',
-                          style: TextStyle(
-                            fontSize: 18,
-                            fontWeight: FontWeight.bold,
-                          ),
-                        ),
-                        SizedBox(height: 12),
-                        _buildUsageSection(),
-                      ],
-                    ),
-                  ),
-                ),
-              ),
-            ),
-          ],
-        ),
-      ),
-    );
-  }
-
-  Widget _buildUsageSection() {
-    return Column(
-      crossAxisAlignment: CrossAxisAlignment.start,
-      children: [
-        Text(
-          '1. Basic Image Compression:',
-          style: TextStyle(fontWeight: FontWeight.bold),
-        ),
-        SizedBox(height: 4),
-        Text(
-          '''
-final result = await MediaCompressionService.instance.compressImage(
-  sourcePath: '/path/to/image.jpg',
-  quality: 70,  // 0-100
-  maxWidth: 1920,
-  maxHeight: 1920,
-);
-
-if (result != null) {
-  print('Compressed: \${result.formattedOriginalSize} → \${result.formattedCompressedSize}');
-  print('Saved: \${result.formattedRatio}');
-  // Use result.compressedPath
-}
-''',
-          style: TextStyle(fontFamily: 'monospace', fontSize: 12),
-        ),
-        SizedBox(height: 16),
-        
-        Text(
-          '2. Basic Video Compression:',
-          style: TextStyle(fontWeight: FontWeight.bold),
-        ),
-        SizedBox(height: 4),
-        Text(
-          '''
-final result = await MediaCompressionService.instance.compressVideo(
-  sourcePath: '/path/to/video.mp4',
-  quality: VideoQuality.DefaultQuality,
-  onProgress: (progress) {
-    print('Progress: \${progress.toStringAsFixed(1)}%');
-  },
-);
-
-if (result != null) {
-  print('Compressed: \${result.formattedOriginalSize} → \${result.formattedCompressedSize}');
-  // Use result.compressedPath
-}
-''',
-          style: TextStyle(fontFamily: 'monospace', fontSize: 12),
-        ),
-        SizedBox(height: 16),
-        
-        Text(
-          '3. Using Compression Dialog:',
-          style: TextStyle(fontWeight: FontWeight.bold),
-        ),
-        SizedBox(height: 4),
-        Text(
-          '''
-// Show dialog to user
-final option = await CompressionHelper.showCompressionDialog(
-  context,
-  isVideo: false,
-);
-
-if (option != null) {
-  // Compress based on user selection
-  final compressedPath = await CompressionHelper.compressImageIfNeeded(
-    sourcePath: imagePath,
-    option: option,
-    onStatusUpdate: (message) => print(message),
-  );
-  
-  // Use compressedPath for import
-}
-''',
-          style: TextStyle(fontFamily: 'monospace', fontSize: 12),
-        ),
-        SizedBox(height: 16),
-        
-        Text(
-          '4. Batch Compression:',
-          style: TextStyle(fontWeight: FontWeight.bold),
-        ),
-        SizedBox(height: 4),
-        Text(
-          '''
-final compressedPaths = await CompressionHelper.compressImagesIfNeeded(
-  sourcePaths: ['/path/1.jpg', '/path/2.jpg'],
-  option: CompressionOption.medium,
-  onProgress: (current, total) {
-    print('Compressing \$current/\$total');
-  },
-);
-''',
-          style: TextStyle(fontFamily: 'monospace', fontSize: 12),
-        ),
-        SizedBox(height: 16),
-        
-        Text(
-          'Quality Levels:',
-          style: TextStyle(fontWeight: FontWeight.bold),
-        ),
-        SizedBox(height: 4),
-        Text('• None: Original quality (100%)'),
-        Text('• Low: High quality (85%)'),
-        Text('• Medium: Balanced (70%)'),
-        Text('• High: Maximum compression (50%)'),
-      ],
-    );
-  }
-
-  Future<void> _exampleCompressImage() async {
-    setState(() {
-      _statusMessage = 'This would compress an image file...';
-      _compressionProgress = 0.0;
-    });
-
-    // In real usage, you would have an actual image path
-    // final result = await MediaCompressionService.instance.compressImage(
-    //   sourcePath: imagePath,
-    //   quality: 70,
-    // );
-    
-    await Future.delayed(Duration(seconds: 2));
-    
-    setState(() {
-      _statusMessage = 'Example: Image compressed from 5.2 MB → 1.8 MB (65% saved)';
-      _compressionProgress = 1.0;
-    });
-  }
-
-  Future<void> _exampleCompressVideo() async {
-    setState(() {
-      _statusMessage = 'This would compress a video file...';
-      _compressionProgress = 0.0;
-    });
-
-    // Simulate progress
-    for (int i = 0; i <= 100; i += 10) {
-      await Future.delayed(Duration(milliseconds: 200));
-      setState(() {
-        _compressionProgress = i / 100;
-        _statusMessage = 'Compressing video: ${i}%';
-      });
-    }
-    
-    setState(() {
-      _statusMessage = 'Example: Video compressed from 45.3 MB → 12.7 MB (72% saved)';
-    });
-  }
-
-  Future<void> _exampleShowCompressionDialog() async {
-    final option = await CompressionHelper.showCompressionDialog(
-      context,
-      isVideo: false,
-    );
-
-    if (option != null) {
-      setState(() {
-        _statusMessage = 'Selected: ${option.name} (Quality: ${option.imageQuality}%)';
-        _compressionProgress = 0.0;
-      });
-    }
-  }
-}

From 41b1063eaa3878804dc048f8f03f3fb87d75a793 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 21:30:03 +0800
Subject: [PATCH 25/64] Remove redundant file existence checks in album covers

---
 lib/screens/albums_screen.dart | 77 +++++++++++++---------------------
 1 file changed, 28 insertions(+), 49 deletions(-)

diff --git a/lib/screens/albums_screen.dart b/lib/screens/albums_screen.dart
index 5d954ac..b50094a 100644
--- a/lib/screens/albums_screen.dart
+++ b/lib/screens/albums_screen.dart
@@ -234,22 +234,14 @@ class _AlbumsScreenState extends ConsumerState<AlbumsScreen> {
             final file = snapshot.data!;
             if (file.isImage) {
               final imageFile = File(file.vaultPath);
-              return FutureBuilder<bool>(
-                future: imageFile.exists(),
-                builder: (context, existsSnapshot) {
-                  if (existsSnapshot.data != true) {
-                    return _buildPlaceholderCover(album);
-                  }
-                  return Image.file(
-                    imageFile,
-                    fit: BoxFit.cover,
-                    width: double.infinity,
-                    height: double.infinity,
-                    cacheWidth: 400,
-                    filterQuality: FilterQuality.low,
-                    errorBuilder: (_, __, ___) => _buildPlaceholderCover(album),
-                  );
-                },
+              return Image.file(
+                imageFile,
+                fit: BoxFit.cover,
+                width: double.infinity,
+                height: double.infinity,
+                cacheWidth: 400,
+                filterQuality: FilterQuality.low,
+                errorBuilder: (_, __, ___) => _buildPlaceholderCover(album),
               );
             }
           }
@@ -267,22 +259,14 @@ class _AlbumsScreenState extends ConsumerState<AlbumsScreen> {
             final imageFiles = snapshot.data!.where((f) => f.isImage).toList();
             if (imageFiles.isNotEmpty) {
               final imageFile = File(imageFiles.first.vaultPath);
-              return FutureBuilder<bool>(
-                future: imageFile.exists(),
-                builder: (context, existsSnapshot) {
-                  if (existsSnapshot.data != true) {
-                    return _buildPlaceholderCover(album);
-                  }
-                  return Image.file(
-                    imageFile,
-                    fit: BoxFit.cover,
-                    width: double.infinity,
-                    height: double.infinity,
-                    cacheWidth: 400,
-                    filterQuality: FilterQuality.low,
-                    errorBuilder: (_, __, ___) => _buildPlaceholderCover(album),
-                  );
-                },
+              return Image.file(
+                imageFile,
+                fit: BoxFit.cover,
+                width: double.infinity,
+                height: double.infinity,
+                cacheWidth: 400,
+                filterQuality: FilterQuality.low,
+                errorBuilder: (_, __, ___) => _buildPlaceholderCover(album),
               );
             }
           }
@@ -650,7 +634,10 @@ class _AlbumsScreenState extends ConsumerState<AlbumsScreen> {
           ),
         ],
       ),
-    );
+    ).whenComplete(() {
+      nameController.dispose();
+      descController.dispose();
+    });
   }
 
   void _showRenameAlbumDialog(Album album) {
@@ -727,7 +714,7 @@ class _AlbumsScreenState extends ConsumerState<AlbumsScreen> {
           ),
         ],
       ),
-    );
+    ).whenComplete(nameController.dispose);
   }
 
   void _showDeleteAlbumDialog(Album album) {
@@ -1030,21 +1017,13 @@ class _ChangeCoverSheetState extends ConsumerState<_ChangeCoverSheet> {
             child: ClipRRect(
               borderRadius: BorderRadius.circular(isSelected ? 5 : 8),
               child: file.isImage
-                  ? FutureBuilder<bool>(
-                      future: File(file.vaultPath).exists(),
-                      builder: (context, snapshot) {
-                        if (snapshot.data != true) {
-                          return _buildPlaceholder();
-                        }
-                        return Image.file(
-                          File(file.vaultPath),
-                          fit: BoxFit.cover,
-                          cacheWidth: 200,
-                          filterQuality: FilterQuality.low,
-                          errorBuilder: (_, __, ___) => _buildPlaceholder(),
-                        );
-                      },
-                    )
+                    ? Image.file(
+                        File(file.vaultPath),
+                        fit: BoxFit.cover,
+                        cacheWidth: 200,
+                        filterQuality: FilterQuality.low,
+                        errorBuilder: (_, __, ___) => _buildPlaceholder(),
+                      )
                   : _buildVideoPlaceholder(),
             ),
           ),

From bc267ebd0676322e82072afac9944e77f2244219 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 21:30:10 +0800
Subject: [PATCH 26/64] Check biometric availability before authenticating in
 autofill

Add biometric check before proceeding with local authentication
on the autofill selection screen. If biometrics are not enabled,
show a message indicating they are unavailable. After successful
biometric authentication, attempt to unlock the master key and
display an error if it fails.
---
 lib/screens/autofill_selection_screen.dart | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/lib/screens/autofill_selection_screen.dart b/lib/screens/autofill_selection_screen.dart
index 41ff42f..05be88e 100644
--- a/lib/screens/autofill_selection_screen.dart
+++ b/lib/screens/autofill_selection_screen.dart
@@ -5,6 +5,8 @@ import 'package:local_auth_android/local_auth_android.dart';
 import 'package:local_auth_darwin/local_auth_darwin.dart';
 
 import '../models/password_entry.dart';
+import '../services/auth_service.dart';
+import '../services/encryption_service.dart';
 import '../services/password_service.dart';
 import '../themes/app_colors.dart';
 
@@ -48,6 +50,16 @@ class _AutofillSelectionScreenState extends State<AutofillSelectionScreen> {
     });
 
     try {
+      final authService = AuthService();
+      final isBiometricEnabled = await authService.isBiometricEnabled();
+      if (!isBiometricEnabled) {
+        setState(() {
+          _biometricsUnavailable = true;
+          _isAuthenticating = false;
+        });
+        return;
+      }
+
       final canCheck = await _localAuth.canCheckBiometrics;
       if (!canCheck) {
         setState(() {
@@ -72,6 +84,15 @@ class _AutofillSelectionScreenState extends State<AutofillSelectionScreen> {
       );
 
       if (didAuth) {
+        try {
+          await EncryptionService.instance.unlockMasterKeyWithBiometric();
+        } catch (e) {
+          setState(() {
+            _error = 'Unable to unlock vault';
+            _isAuthenticating = false;
+          });
+          return;
+        }
         await _loadEntries();
       } else {
         setState(() {

From ee7c364163132169c9ea99b0079a9e8d423d230e Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 21:30:17 +0800
Subject: [PATCH 27/64] Re-wrap encryption key after password/PIN change

---
 lib/screens/change_security_screen.dart | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/screens/change_security_screen.dart b/lib/screens/change_security_screen.dart
index 3f987b2..5c03929 100644
--- a/lib/screens/change_security_screen.dart
+++ b/lib/screens/change_security_screen.dart
@@ -3,6 +3,7 @@ import 'package:flutter/material.dart';
 import 'package:flutter/services.dart';
 import '../themes/app_colors.dart';
 import '../services/auth_service.dart';
+import '../services/encryption_service.dart';
 import '../utils/toast_utils.dart';
 import '../widgets/adaptive_logo.dart';
 import 'gallery_vault_screen.dart';
@@ -565,6 +566,8 @@ class _ChangePasswordScreenState extends State<ChangePasswordScreen> {
         // Update auth method to password
         if (success) {
           await _authService.setAuthMethod('password');
+          await EncryptionService.instance.reWrapKey(_newPasswordController.text);
+          await EncryptionService.instance.removeBiometricKwk();
         }
       } else {
         success = await _authService.switchFromPINToPassword(
@@ -1188,6 +1191,8 @@ class _ChangePINScreenState extends State<ChangePINScreen> {
         // Update auth method to PIN
         if (success) {
           await _authService.setAuthMethod('pin');
+          await EncryptionService.instance.reWrapKey(_newPINController.text);
+          await EncryptionService.instance.removeBiometricKwk();
         }
       } else {
         success = await _authService.switchFromPasswordToPIN(

From 4340e54072d1fba5413ae06ef8405ddefcfc53cb Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 21:30:40 +0800
Subject: [PATCH 28/64] Update KDF iteration options

---
 lib/screens/encryption_settings_screen.dart | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/screens/encryption_settings_screen.dart b/lib/screens/encryption_settings_screen.dart
index 8d78a10..96987c9 100644
--- a/lib/screens/encryption_settings_screen.dart
+++ b/lib/screens/encryption_settings_screen.dart
@@ -16,7 +16,7 @@ class EncryptionSettingsScreen extends ConsumerStatefulWidget {
 
 class _EncryptionSettingsScreenState
     extends ConsumerState<EncryptionSettingsScreen> {
-  static const List<int> _kdfIterationOptions = [100000, 200000, 500000];
+  static const List<int> _kdfIterationOptions = [100000, 300000, 600000, 1000000];
 
   @override
   Widget build(BuildContext context) {

From d5fc540e367c2e038d05391f96faaeaf63edc119 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 21:31:07 +0800
Subject: [PATCH 29/64] Remove redundant file existence check in thumbnail
 builder

---
 lib/screens/folder_detail_screen.dart | 24 ++++++++----------------
 1 file changed, 8 insertions(+), 16 deletions(-)

diff --git a/lib/screens/folder_detail_screen.dart b/lib/screens/folder_detail_screen.dart
index 65a7ad3..72267d1 100644
--- a/lib/screens/folder_detail_screen.dart
+++ b/lib/screens/folder_detail_screen.dart
@@ -525,20 +525,12 @@ class _FolderDetailScreenState extends ConsumerState<FolderDetailScreen> {
   Widget _buildFileThumbnail(VaultedFile file) {
     if (file.isImage) {
       final imageFile = File(file.vaultPath);
-      return FutureBuilder<bool>(
-        future: imageFile.exists(),
-        builder: (context, snapshot) {
-          if (snapshot.data != true) {
-            return _buildFilePlaceholder(file);
-          }
-          return Image.file(
-            imageFile,
-            fit: BoxFit.cover,
-            cacheWidth: 200,
-            filterQuality: FilterQuality.low,
-            errorBuilder: (_, __, ___) => _buildFilePlaceholder(file),
-          );
-        },
+      return Image.file(
+        imageFile,
+        fit: BoxFit.cover,
+        cacheWidth: 200,
+        filterQuality: FilterQuality.low,
+        errorBuilder: (_, __, ___) => _buildFilePlaceholder(file),
       );
     }
     return _buildFilePlaceholder(file);
@@ -1053,7 +1045,7 @@ class _FolderDetailScreenState extends ConsumerState<FolderDetailScreen> {
           ),
         ],
       ),
-    );
+    ).whenComplete(nameController.dispose);
   }
 
   void _showSubfolderOptions(VaultFolder subfolder) {
@@ -1195,7 +1187,7 @@ class _FolderDetailScreenState extends ConsumerState<FolderDetailScreen> {
           ),
         ],
       ),
-    );
+    ).whenComplete(nameController.dispose);
   }
 
   void _showDeleteSubfolderDialog(VaultFolder subfolder) {

From 979a965ed526ef84457b8e0fc84ee2c8d25fd2a3 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 21:31:12 +0800
Subject: [PATCH 30/64] Remove redundant file existence check in folder cover
 image

Also dispose of text controllers in folder dialogs after completion
---
 lib/screens/folders_screen.dart | 31 +++++++++++++------------------
 1 file changed, 13 insertions(+), 18 deletions(-)

diff --git a/lib/screens/folders_screen.dart b/lib/screens/folders_screen.dart
index 71ef7e7..8c54db1 100644
--- a/lib/screens/folders_screen.dart
+++ b/lib/screens/folders_screen.dart
@@ -230,22 +230,14 @@ class _FoldersScreenState extends ConsumerState<FoldersScreen> {
             final file = snapshot.data!;
             if (file.isImage) {
               final imageFile = File(file.vaultPath);
-              return FutureBuilder<bool>(
-                future: imageFile.exists(),
-                builder: (context, existsSnapshot) {
-                  if (existsSnapshot.data != true) {
-                    return _buildPlaceholderCover();
-                  }
-                  return Image.file(
-                    imageFile,
-                    fit: BoxFit.cover,
-                    width: double.infinity,
-                    height: double.infinity,
-                    cacheWidth: 400,
-                    filterQuality: FilterQuality.low,
-                    errorBuilder: (_, __, ___) => _buildPlaceholderCover(),
-                  );
-                },
+              return Image.file(
+                imageFile,
+                fit: BoxFit.cover,
+                width: double.infinity,
+                height: double.infinity,
+                cacheWidth: 400,
+                filterQuality: FilterQuality.low,
+                errorBuilder: (_, __, ___) => _buildPlaceholderCover(),
               );
             }
           }
@@ -627,7 +619,10 @@ class _FoldersScreenState extends ConsumerState<FoldersScreen> {
           ),
         ],
       ),
-    );
+    ).whenComplete(() {
+      nameController.dispose();
+      descController.dispose();
+    });
   }
 
   void _showCreateSubfolderDialog(VaultFolder parentFolder) {
@@ -708,7 +703,7 @@ class _FoldersScreenState extends ConsumerState<FoldersScreen> {
           ),
         ],
       ),
-    );
+    ).whenComplete(nameController.dispose);
   }
 
   void _showDeleteFolderDialog(VaultFolder folder) {

From c75ee8f8810edd3d237efeeee82df4ac05069260 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 21:31:17 +0800
Subject: [PATCH 31/64] Add tooltips, fix image loading, and improve lifecycle
 safety

- Add tooltips to icon buttons for accessibility
- Remove redundant FutureBuilder from image loading
- Add mounted checks before setState calls in async callbacks
- Dispose tag and pin controllers after dialog completion
---
 lib/screens/gallery_vault_screen.dart | 71 +++++++++++++--------------
 1 file changed, 34 insertions(+), 37 deletions(-)

diff --git a/lib/screens/gallery_vault_screen.dart b/lib/screens/gallery_vault_screen.dart
index 2d09e91..f544808 100644
--- a/lib/screens/gallery_vault_screen.dart
+++ b/lib/screens/gallery_vault_screen.dart
@@ -160,6 +160,7 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
         backgroundColor: context.accentColor,
         leading: IconButton(
           icon: const Icon(Icons.close, color: Colors.white),
+          tooltip: 'Exit selection',
           onPressed: _exitSelectionMode,
         ),
         title: Text(
@@ -206,6 +207,7 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
             _isSearching ? Icons.close : Icons.search,
             color: context.textPrimary,
           ),
+          tooltip: _isSearching ? 'Close search' : 'Search',
           onPressed: () {
             setState(() {
               _isSearching = !_isSearching;
@@ -218,9 +220,11 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
         ),
         IconButton(
           icon: Icon(Icons.sort, color: context.textPrimary),
+          tooltip: 'Sort',
           onPressed: _showSortOptions,
         ),
         PopupMenuButton<String>(
+          tooltip: 'More options',
           icon: Icon(Icons.more_vert, color: context.textPrimary),
           onSelected: (value) {
             switch (value) {
@@ -909,34 +913,21 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
     if (file.isImage) {
       final imageFile = File(file.vaultPath);
 
-      // Use FutureBuilder to check file existence first
-      return FutureBuilder<bool>(
-        future: imageFile.exists(),
-        builder: (context, snapshot) {
-          if (snapshot.data != true) {
-            return _buildPlaceholder(file);
+      return Image.file(
+        imageFile,
+        fit: BoxFit.cover,
+        cacheWidth: 300,
+        filterQuality: FilterQuality.low,
+        gaplessPlayback: true,
+        frameBuilder: (context, child, frame, wasSynchronouslyLoaded) {
+          if (wasSynchronouslyLoaded || frame != null) {
+            return child;
           }
-
-          // Use Image.file with defensive error handling
-          return Image.file(
-            imageFile,
-            fit: BoxFit.cover,
-            cacheWidth: 300, // Limit resolution for performance
-            filterQuality: FilterQuality.low,
-            gaplessPlayback: true,
-            frameBuilder: (context, child, frame, wasSynchronouslyLoaded) {
-              if (wasSynchronouslyLoaded || frame != null) {
-                return child;
-              }
-              // Show placeholder while loading
-              return const _ImageLoadingPlaceholder();
-            },
-            errorBuilder: (context, error, stackTrace) {
-              // Log error for debugging but show placeholder gracefully
-              debugPrint('Error loading image: ${file.originalName} - $error');
-              return _buildPlaceholder(file);
-            },
-          );
+          return const _ImageLoadingPlaceholder();
+        },
+        errorBuilder: (context, error, stackTrace) {
+          debugPrint('Error loading image: ${file.originalName} - $error');
+          return _buildPlaceholder(file);
         },
       );
     }
@@ -2366,6 +2357,7 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
                                 color: AppColors.lightTextSecondary),
                             suffixIcon: IconButton(
                               icon: Icon(Icons.add, color: context.accentColor),
+                              tooltip: 'Add tag',
                               onPressed: () async {
                                 final tag = tagController.text.trim();
                                 if (tag.isEmpty) return;
@@ -2530,7 +2522,7 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
           );
         },
       ),
-    );
+    ).whenComplete(tagController.dispose);
   }
 
   Future<void> _toggleFavoriteSelected(Set<String> selectedFiles) async {
@@ -2988,7 +2980,7 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
           ),
         ],
       ),
-    );
+    ).whenComplete(pinController.dispose);
   }
 
   // Import methods
@@ -3391,7 +3383,7 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
       deleteOriginal: true,
     );
 
-    setState(() => _isImporting = false);
+    if (mounted) setState(() => _isImporting = false);
 
     if (result.success && result.importedCount > 0) {
       ToastUtils.showSuccess('Photo captured and hidden');
@@ -3421,7 +3413,7 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
       deleteOriginal: true,
     );
 
-    setState(() => _isImporting = false);
+    if (mounted) setState(() => _isImporting = false);
 
     if (result.success && result.importedCount > 0) {
       ToastUtils.showSuccess('Video recorded and hidden');
@@ -3450,7 +3442,7 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
       deleteOriginal: true,
     );
 
-    setState(() => _isImporting = false);
+    if (mounted) setState(() => _isImporting = false);
 
     if (result.success && result.importedCount > 0) {
       ToastUtils.showSuccess('Audio recorded and hidden');
@@ -3535,6 +3527,7 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
         return confirmed ?? false;
       },
       onProgress: (current, total) {
+        if (!mounted) return;
         setState(() {
           _importProgress = current;
           _importTotal = total;
@@ -3545,7 +3538,7 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
       },
     );
 
-    setState(() => _isImporting = false);
+    if (mounted) setState(() => _isImporting = false);
 
     if (result.success && result.importedCount > 0) {
       final msgBuilder =
@@ -3631,6 +3624,7 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
       deleteOriginals: true,
       perFileEncryption: perFileEncryption,
       onProgress: (current, total) {
+        if (!mounted) return;
         setState(() {
           _importProgress = current;
           _importTotal = total;
@@ -3638,7 +3632,7 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
       },
     );
 
-    setState(() => _isImporting = false);
+    if (mounted) setState(() => _isImporting = false);
 
     if (result.success && result.importedCount > 0) {
       final msg = result.deletedOriginals
@@ -3717,6 +3711,7 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
       deleteOriginals: true,
       perFileEncryption: perFileEncryption,
       onProgress: (current, total) {
+        if (!mounted) return;
         setState(() {
           _importProgress = current;
           _importTotal = total;
@@ -3724,7 +3719,7 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
       },
     );
 
-    setState(() => _isImporting = false);
+    if (mounted) setState(() => _isImporting = false);
 
     if (importResult.success && importResult.importedCount > 0) {
       final msg = importResult.deletedOriginals
@@ -3763,6 +3758,7 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
         recursive: true,
         deleteOriginals: false,
         onProgress: (current, total) {
+          if (!mounted) return;
           setState(() {
             _importProgress = current;
             _importTotal = total;
@@ -3770,7 +3766,7 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
         },
       );
 
-      setState(() => _isImporting = false);
+      if (mounted) setState(() => _isImporting = false);
 
       if (result.success && result.filesImported > 0) {
         ToastUtils.showSuccess(result.message ??
@@ -3783,7 +3779,7 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
         ToastUtils.showInfo('No files found in folder');
       }
     } catch (e) {
-      setState(() => _isImporting = false);
+      if (mounted) setState(() => _isImporting = false);
       ToastUtils.showError('Failed to import folder: $e');
     }
   }
@@ -4198,6 +4194,7 @@ class _FolderImportPickerScreenState extends State<_FolderImportPickerScreen> {
         leading: _pathStack.isNotEmpty
             ? IconButton(
                 icon: const Icon(Icons.arrow_back),
+                tooltip: 'Back',
                 onPressed: _goBack,
                 color: context.textPrimary,
               )

From 6d9972afc01587cd004d861e52b75d3f1506c234 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 21:31:25 +0800
Subject: [PATCH 32/64] Add tooltips to media viewer buttons

---
 lib/screens/media_viewer_screen.dart | 99 +++++++++++++++-------------
 1 file changed, 55 insertions(+), 44 deletions(-)

diff --git a/lib/screens/media_viewer_screen.dart b/lib/screens/media_viewer_screen.dart
index 160db2d..5ead9b7 100644
--- a/lib/screens/media_viewer_screen.dart
+++ b/lib/screens/media_viewer_screen.dart
@@ -840,13 +840,17 @@ class _MediaViewerScreenState extends ConsumerState<MediaViewerScreen> {
                           ),
                         ),
                         const SizedBox(width: 8),
-                        GestureDetector(
-                          onTap: () => setState(() => _isSlideshow = false),
-                          child: const Icon(
+                        IconButton(
+                          icon: const Icon(
                             Icons.close,
                             color: Colors.white,
                             size: 18,
                           ),
+                          onPressed: () => setState(() => _isSlideshow = false),
+                          tooltip: 'Close slideshow',
+                          padding: EdgeInsets.zero,
+                          constraints: const BoxConstraints(
+                              minWidth: 36, minHeight: 36),
                         ),
                       ],
                     ),
@@ -899,20 +903,12 @@ class _MediaViewerScreenState extends ConsumerState<MediaViewerScreen> {
             minScale: PhotoViewComputedScale.contained,
             maxScale: PhotoViewComputedScale.covered * 3,
             heroAttributes: PhotoViewHeroAttributes(tag: file.id),
-            child: FutureBuilder<bool>(
-              future: File(file.vaultPath).exists(),
-              builder: (context, snapshot) {
-                if (snapshot.data != true) {
-                  return _buildImageErrorPlaceholder(file);
-                }
-                return Image.file(
-                  File(file.vaultPath),
-                  fit: BoxFit.contain,
-                  errorBuilder: (context, error, stackTrace) {
-                    debugPrint('Error decoding image file: $error');
-                    return _buildImageErrorPlaceholder(file);
-                  },
-                );
+            child: Image.file(
+              File(file.vaultPath),
+              fit: BoxFit.contain,
+              errorBuilder: (context, error, stackTrace) {
+                debugPrint('Error decoding image file: $error');
+                return _buildImageErrorPlaceholder(file);
               },
             ),
           ),
@@ -1039,6 +1035,7 @@ class _MediaViewerScreenState extends ConsumerState<MediaViewerScreen> {
                     IconButton(
                       icon: const Icon(Icons.replay_10, size: 36),
                       color: Colors.white,
+                      tooltip: 'Back 10 seconds',
                       onPressed: _skipBackward,
                     ),
                     IconButton(
@@ -1047,11 +1044,13 @@ class _MediaViewerScreenState extends ConsumerState<MediaViewerScreen> {
                         size: 48,
                         color: Colors.white,
                       ),
+                      tooltip: _isVideoPlaying ? 'Pause' : 'Play',
                       onPressed: _toggleVideoPlayback,
                     ),
                     IconButton(
                       icon: const Icon(Icons.forward_10, size: 36),
                       color: Colors.white,
+                      tooltip: 'Forward 10 seconds',
                       onPressed: _skipForward,
                     ),
                   ],
@@ -1127,6 +1126,7 @@ class _MediaViewerScreenState extends ConsumerState<MediaViewerScreen> {
           children: [
             IconButton(
               icon: const Icon(Icons.arrow_back, color: Colors.white),
+              tooltip: 'Back',
               onPressed: () => Navigator.pop(context),
             ),
             Expanded(
@@ -1160,6 +1160,7 @@ class _MediaViewerScreenState extends ConsumerState<MediaViewerScreen> {
                 file.isFavorite ? Icons.favorite : Icons.favorite_border,
                 color: file.isFavorite ? Colors.red : Colors.white,
               ),
+              tooltip: 'Favorite',
               onPressed: _toggleFavorite,
             ),
             if (file.isVideo)
@@ -1168,10 +1169,12 @@ class _MediaViewerScreenState extends ConsumerState<MediaViewerScreen> {
                   _isLooping ? Icons.repeat_one : Icons.repeat,
                   color: _isLooping ? AppColors.accent : Colors.white,
                 ),
+                tooltip: 'Loop',
                 onPressed: _toggleLooping,
               ),
             IconButton(
               icon: const Icon(Icons.info_outline, color: Colors.white),
+              tooltip: 'File info',
               onPressed: _showFileInfo,
             ),
           ],
@@ -1265,39 +1268,42 @@ class _MediaViewerScreenState extends ConsumerState<MediaViewerScreen> {
               Row(
                 mainAxisAlignment: MainAxisAlignment.spaceEvenly,
                 children: [
-                  IconButton(
-                    icon: Icon(
-                      _isMuted ? Icons.volume_off : Icons.volume_up,
-                      color: Colors.white,
-                    ),
-                    onPressed: () {
+                   IconButton(
+                     icon: Icon(
+                       _isMuted ? Icons.volume_off : Icons.volume_up,
+                       color: Colors.white,
+                     ),
+                     tooltip: _isMuted ? 'Unmute' : 'Mute',
+                     onPressed: () {
                       setState(() {
                         _isMuted = !_isMuted;
                         _videoController?.setVolume(_isMuted ? 0.0 : 1.0);
                       });
                     },
                   ),
-                  IconButton(
-                    icon: Icon(
-                      _isVideoPlaying
-                          ? Icons.pause_circle_filled
-                          : Icons.play_circle_filled,
-                      color: Colors.white,
-                      size: 48,
-                    ),
-                    onPressed: _toggleVideoPlayback,
-                  ),
-                  IconButton(
-                    icon: Text(
-                      '${_playbackSpeed}x',
-                      style: const TextStyle(
-                        color: Colors.white,
-                        fontWeight: FontWeight.bold,
-                        fontSize: 14,
-                        fontFamily: 'ProductSans',
-                      ),
-                    ),
-                    onPressed: () {
+                   IconButton(
+                     icon: Icon(
+                       _isVideoPlaying
+                           ? Icons.pause_circle_filled
+                           : Icons.play_circle_filled,
+                       color: Colors.white,
+                       size: 48,
+                     ),
+                     tooltip: _isVideoPlaying ? 'Pause' : 'Play',
+                     onPressed: _toggleVideoPlayback,
+                   ),
+                   IconButton(
+                     icon: Text(
+                       '${_playbackSpeed}x',
+                       style: const TextStyle(
+                         color: Colors.white,
+                         fontWeight: FontWeight.bold,
+                         fontSize: 14,
+                         fontFamily: 'ProductSans',
+                       ),
+                     ),
+                     tooltip: 'Playback speed',
+                     onPressed: () {
                       setState(() {
                         if (_playbackSpeed == 1.0) {
                           _playbackSpeed = 1.5;
@@ -1354,6 +1360,7 @@ class _MediaViewerScreenState extends ConsumerState<MediaViewerScreen> {
                   // Previous
                   IconButton(
                     icon: const Icon(Icons.skip_previous, color: Colors.white),
+                    tooltip: 'Previous',
                     onPressed: _currentIndex > 0
                         ? () => _pageController.previousPage(
                               duration: const Duration(milliseconds: 300),
@@ -1368,21 +1375,25 @@ class _MediaViewerScreenState extends ConsumerState<MediaViewerScreen> {
                         _isSlideshow ? Icons.stop : Icons.slideshow,
                         color: Colors.white,
                       ),
+                      tooltip: 'Slideshow',
                       onPressed: _showSlideshowSettings,
                     ),
                   // Share/Export
                   IconButton(
                     icon: const Icon(Icons.share, color: Colors.white),
+                    tooltip: 'Share',
                     onPressed: () => _showExportOptions(file),
                   ),
                   // Delete
                   IconButton(
                     icon: const Icon(Icons.delete_outline, color: Colors.white),
+                    tooltip: 'Delete',
                     onPressed: () => _confirmDelete(file),
                   ),
                   // Next
                   IconButton(
                     icon: const Icon(Icons.skip_next, color: Colors.white),
+                    tooltip: 'Next',
                     onPressed: _currentIndex < widget.files.length - 1
                         ? () => _pageController.nextPage(
                               duration: const Duration(milliseconds: 300),

From 8a31b59076aacc4b0cc4246850798d2cc9b5da48 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 21:35:31 +0800
Subject: [PATCH 33/64] Replace GestureDetector with IconButton and fix folder
 selection logic

---
 lib/screens/note_editor_screen.dart | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/lib/screens/note_editor_screen.dart b/lib/screens/note_editor_screen.dart
index b9f8109..8cfe993 100644
--- a/lib/screens/note_editor_screen.dart
+++ b/lib/screens/note_editor_screen.dart
@@ -182,10 +182,14 @@ class _NoteEditorScreenState extends ConsumerState<NoteEditorScreen> {
                           ),
                         ),
                       ),
-                      GestureDetector(
-                        onTap: () => setState(() => _folderId = null),
-                        child: Icon(Icons.close,
+                      IconButton(
+                        icon: Icon(Icons.close,
                             size: 14, color: context.textTertiary),
+                        onPressed: () => setState(() => _folderId = null),
+                        tooltip: 'Clear folder',
+                        padding: EdgeInsets.zero,
+                        constraints: const BoxConstraints(
+                            minWidth: 36, minHeight: 36),
                       ),
                     ],
                   ),
@@ -372,7 +376,7 @@ class _NoteEditorScreenState extends ConsumerState<NoteEditorScreen> {
                     color: context.textPrimary,
                   ),
                 ),
-                onTap: () => Navigator.pop(context, null),
+                onTap: () => Navigator.pop(context, ''),
               ),
               ...folders.map((folder) => ListTile(
                     leading: Icon(Icons.folder, color: context.accentColor),
@@ -392,10 +396,8 @@ class _NoteEditorScreenState extends ConsumerState<NoteEditorScreen> {
       },
     );
 
-    if (selected != null || selected == null) {
-      setState(() {
-        _folderId = selected;
-      });
+    if (selected != null) {
+      setState(() => _folderId = selected.isEmpty ? null : selected);
     }
   }
 }

From 89debd7ff100977c705adc2ae32a43fe4daae038 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 21:35:35 +0800
Subject: [PATCH 34/64] Dispose controllers after showing add note dialog

---
 lib/screens/note_list_screen.dart | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/screens/note_list_screen.dart b/lib/screens/note_list_screen.dart
index 6551671..a8cb6e4 100644
--- a/lib/screens/note_list_screen.dart
+++ b/lib/screens/note_list_screen.dart
@@ -704,7 +704,10 @@ class _NoteListScreenState extends ConsumerState<NoteListScreen> {
           },
         );
       },
-    );
+    ).whenComplete(() {
+      titleController.dispose();
+      contentController.dispose();
+    });
   }
 
   Future<void> _showDeleteConfirmation() async {

From 2f52eadf25f56ae2e7e9472f1886b127c5f64421 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 21:35:42 +0800
Subject: [PATCH 35/64] Add autofill hints and tooltips to password editor form

---
 lib/screens/password_editor_screen.dart | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/lib/screens/password_editor_screen.dart b/lib/screens/password_editor_screen.dart
index 457891e..c2cba9d 100644
--- a/lib/screens/password_editor_screen.dart
+++ b/lib/screens/password_editor_screen.dart
@@ -203,6 +203,7 @@ class _PasswordEditorScreenState extends ConsumerState<PasswordEditorScreen> {
           IconButton(
             icon: Icon(Icons.check, color: context.accentColor),
             onPressed: _isSaving ? null : _save,
+            tooltip: 'Save',
           ),
         ],
       ),
@@ -216,7 +217,8 @@ class _PasswordEditorScreenState extends ConsumerState<PasswordEditorScreen> {
   }
 
   Widget _buildForm() {
-    return SingleChildScrollView(
+    return AutofillGroup(
+      child: SingleChildScrollView(
       padding: const EdgeInsets.symmetric(horizontal: 16, vertical: 8),
       child: Column(
         crossAxisAlignment: CrossAxisAlignment.start,
@@ -227,11 +229,13 @@ class _PasswordEditorScreenState extends ConsumerState<PasswordEditorScreen> {
             controller: _usernameController,
             label: 'Username',
             icon: Icons.person_outline,
+            autofillHints: const [AutofillHints.username],
             suffix: _usernameController.text.isNotEmpty
                 ? IconButton(
                     icon: Icon(Icons.copy, size: 18, color: context.textTertiary),
                     onPressed: () =>
                         _copyField(_usernameController.text, 'Username'),
+                    tooltip: 'Copy username',
                   )
                 : null,
           ),
@@ -243,6 +247,7 @@ class _PasswordEditorScreenState extends ConsumerState<PasswordEditorScreen> {
             label: 'URL',
             icon: Icons.link,
             keyboardType: TextInputType.url,
+            autofillHints: const [AutofillHints.url],
           ),
           const SizedBox(height: 16),
           _buildField(
@@ -262,6 +267,7 @@ class _PasswordEditorScreenState extends ConsumerState<PasswordEditorScreen> {
           const SizedBox(height: 32),
         ],
       ),
+      ),
     );
   }
 
@@ -298,11 +304,13 @@ class _PasswordEditorScreenState extends ConsumerState<PasswordEditorScreen> {
     TextInputType? keyboardType,
     int maxLines = 1,
     Widget? suffix,
+    Iterable<String>? autofillHints,
   }) {
     return TextField(
       controller: controller,
       keyboardType: keyboardType,
       maxLines: maxLines,
+      autofillHints: autofillHints,
       style: TextStyle(
         fontFamily: 'ProductSans',
         fontSize: 15,
@@ -339,6 +347,8 @@ class _PasswordEditorScreenState extends ConsumerState<PasswordEditorScreen> {
     return TextField(
       controller: _passwordController,
       obscureText: _obscurePassword,
+      keyboardType: TextInputType.visiblePassword,
+      autofillHints: [isEditing ? AutofillHints.password : AutofillHints.newPassword],
       style: TextStyle(
         fontFamily: 'ProductSans',
         fontSize: 15,

From 19aed750e794a1b4c7e631ee15b7296bf3fbffca Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 21:35:50 +0800
Subject: [PATCH 36/64] Replace GestureDetector with IconButton for autofill
 dismiss

---
 lib/screens/password_list_screen.dart | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/lib/screens/password_list_screen.dart b/lib/screens/password_list_screen.dart
index cef63f5..e09748c 100644
--- a/lib/screens/password_list_screen.dart
+++ b/lib/screens/password_list_screen.dart
@@ -266,13 +266,12 @@ class _PasswordListScreenState extends ConsumerState<PasswordListScreen> {
               ],
             ),
           ),
-          GestureDetector(
-            onTap: _dismissAutofillInfo,
-            child: Padding(
-              padding: const EdgeInsets.only(left: 8),
-              child:
-                  Icon(Icons.close, size: 16, color: context.textTertiary),
-            ),
+          IconButton(
+            icon: Icon(Icons.close, size: 16, color: context.textTertiary),
+            onPressed: _dismissAutofillInfo,
+            tooltip: 'Dismiss',
+            padding: EdgeInsets.zero,
+            constraints: const BoxConstraints(minWidth: 36, minHeight: 36),
           ),
         ],
       ),

From 874ebb2fd2bd47e3c20d13170f9f3a616a9f08dd Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 21:35:55 +0800
Subject: [PATCH 37/64] Add tooltips to song player screen buttons

---
 lib/screens/song_player_screen.dart | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/screens/song_player_screen.dart b/lib/screens/song_player_screen.dart
index 3e2c7ab..ec362a8 100644
--- a/lib/screens/song_player_screen.dart
+++ b/lib/screens/song_player_screen.dart
@@ -306,12 +306,14 @@ class _SongPlayerScreenState extends ConsumerState<SongPlayerScreen>
         actions: [
           IconButton(
             onPressed: _toggleFavorite,
+            tooltip: 'Favorite',
             icon: Icon(
               widget.file.isFavorite ? Icons.favorite : Icons.favorite_border,
               color: widget.file.isFavorite ? Colors.red : context.textPrimary,
             ),
           ),
           PopupMenuButton<String>(
+            tooltip: 'More options',
             icon: Icon(Icons.more_vert, color: context.textPrimary),
             onSelected: (value) {
               switch (value) {
@@ -483,6 +485,7 @@ class _SongPlayerScreenState extends ConsumerState<SongPlayerScreen>
                               ? () =>
                                   _seek(position - const Duration(seconds: 10))
                               : () => _seek(Duration.zero),
+                          tooltip: 'Back 10 seconds',
                           icon: Icon(
                             Icons.replay_10,
                             color: context.textPrimary,
@@ -503,6 +506,7 @@ class _SongPlayerScreenState extends ConsumerState<SongPlayerScreen>
                                     processingState == ProcessingState.buffering
                                 ? null
                                 : _togglePlayback,
+                            tooltip: isPlaying ? 'Pause' : 'Play',
                             icon: Icon(
                               isPlaying ? Icons.pause : Icons.play_arrow,
                               color: Colors.white,
@@ -516,6 +520,7 @@ class _SongPlayerScreenState extends ConsumerState<SongPlayerScreen>
                               ? () =>
                                   _seek(position + const Duration(seconds: 10))
                               : null,
+                          tooltip: 'Forward 10 seconds',
                           icon: Icon(
                             Icons.forward_10,
                             color: context.textPrimary,

From 8c6ecc842bfc144e736d30f6d317021c411385e2 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 21:36:00 +0800
Subject: [PATCH 38/64] Remove redundant file existence check in image
 thumbnail

---
 lib/screens/tags_screen.dart | 22 +++++++---------------
 1 file changed, 7 insertions(+), 15 deletions(-)

diff --git a/lib/screens/tags_screen.dart b/lib/screens/tags_screen.dart
index 3a2fb89..3a99f9a 100644
--- a/lib/screens/tags_screen.dart
+++ b/lib/screens/tags_screen.dart
@@ -491,20 +491,12 @@ class _TagsScreenState extends ConsumerState<TagsScreen> {
   Widget _buildFileThumbnail(VaultedFile file) {
     if (file.isImage) {
       final imageFile = File(file.vaultPath);
-      return FutureBuilder<bool>(
-        future: imageFile.exists(),
-        builder: (context, snapshot) {
-          if (snapshot.data != true) {
-            return _buildPlaceholder(file);
-          }
-          return Image.file(
-            imageFile,
-            fit: BoxFit.cover,
-            cacheWidth: 300,
-            filterQuality: FilterQuality.low,
-            errorBuilder: (_, __, ___) => _buildPlaceholder(file),
-          );
-        },
+      return Image.file(
+        imageFile,
+        fit: BoxFit.cover,
+        cacheWidth: 300,
+        filterQuality: FilterQuality.low,
+        errorBuilder: (_, __, ___) => _buildPlaceholder(file),
       );
     }
 
@@ -998,7 +990,7 @@ class _TagsScreenState extends ConsumerState<TagsScreen> {
           ],
         ),
       ),
-    );
+    ).whenComplete(nameController.dispose);
   }
 
   void _showTagOptions(TagInfo tag) {

From b828ce489c9823216f79d5383d67f8161e8348e7 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 21:36:06 +0800
Subject: [PATCH 39/64] Unlock master key during vault authentication

---
 lib/screens/unlock_screen.dart | 37 +++++++++++++++++++++++++++++++---
 1 file changed, 34 insertions(+), 3 deletions(-)

diff --git a/lib/screens/unlock_screen.dart b/lib/screens/unlock_screen.dart
index 2d8a41d..8d4d2e3 100644
--- a/lib/screens/unlock_screen.dart
+++ b/lib/screens/unlock_screen.dart
@@ -4,6 +4,7 @@ import 'package:flutter/material.dart';
 import '../themes/app_colors.dart';
 import '../services/auth_service.dart';
 import '../services/decoy_service.dart';
+import '../services/encryption_service.dart';
 import '../widgets/adaptive_logo.dart';
 import '../widgets/pin_input_widget.dart';
 import 'gallery_vault_screen.dart';
@@ -124,6 +125,13 @@ class _UnlockScreenState extends State<UnlockScreen> {
     final result = await _decoyService.checkIfDecoyCredential(credential);
     if (!result.isDecoy) return false;
 
+    try {
+      await EncryptionService.instance.unlockMasterKey(credential, isDecoy: true);
+    } catch (e) {
+      debugPrint('Decoy key unlock failed: $e');
+      return false;
+    }
+
     await _openVault(isDecoy: true);
     return true;
   }
@@ -159,7 +167,14 @@ class _UnlockScreenState extends State<UnlockScreen> {
     final isValid = await _authService.verifyPIN(pin);
 
     if (isValid && mounted) {
-      await _openVault(isDecoy: false);
+      try {
+        await EncryptionService.instance.unlockMasterKey(pin);
+        await _openVault(isDecoy: false);
+      } catch (e) {
+        debugPrint('Master key unlock failed: $e');
+        await _handleFailedUnlock('Incorrect PIN.');
+        _pinController.clear();
+      }
     } else if (mounted) {
       await _handleFailedUnlock('Incorrect PIN.');
       _pinController.clear();
@@ -204,7 +219,14 @@ class _UnlockScreenState extends State<UnlockScreen> {
     final isValid = await _authService.verifyPassword(password);
 
     if (isValid && mounted) {
-      await _openVault(isDecoy: false);
+      try {
+        await EncryptionService.instance.unlockMasterKey(password);
+        await _openVault(isDecoy: false);
+      } catch (e) {
+        debugPrint('Master key unlock failed: $e');
+        await _handleFailedUnlock('Incorrect password.');
+        _passwordController.clear();
+      }
     } else if (mounted) {
       await _handleFailedUnlock('Incorrect password.');
       _passwordController.clear();
@@ -231,7 +253,16 @@ class _UnlockScreenState extends State<UnlockScreen> {
     final result = await _authService.performBiometricAuthentication();
 
     if (result.isSuccess && mounted) {
-      await _openVault(isDecoy: false);
+      try {
+        await EncryptionService.instance.unlockMasterKeyWithBiometric();
+        await _openVault(isDecoy: false);
+      } catch (e) {
+        debugPrint('Biometric key unlock failed: $e');
+        setState(() {
+          _errorMessage = 'Unable to unlock vault. Please use your backup credential.';
+          _isAuthenticating = false;
+        });
+      }
     } else if (mounted) {
       if (countFailure && result.shouldCountAsFailedUnlock) {
         await _handleFailedUnlock('Biometric authentication failed.');

From 36264d000d702a4eb89565ff72c90b7aace97cf2 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 21:36:14 +0800
Subject: [PATCH 40/64] Integrate EncryptionService into authentication flows

Add EncryptionService dependency to AuthService, setting pending
credentials during creation and verification of passwords, PINs, and
biometric setup. Update credential change operations to re-wrap keys
and remove biometric keys. Extract backup credential clearing into a
private helper method and increase KDF iterations from 100k to 600k.
Add lockout check during credential verification.
---
 lib/services/auth_service.dart | 50 ++++++++++++++++++++++++++--------
 1 file changed, 39 insertions(+), 11 deletions(-)

diff --git a/lib/services/auth_service.dart b/lib/services/auth_service.dart
index 75667ab..8c82888 100644
--- a/lib/services/auth_service.dart
+++ b/lib/services/auth_service.dart
@@ -10,6 +10,7 @@ import 'package:local_auth_darwin/local_auth_darwin.dart';
 import '../utils/pbkdf2_isolate.dart';
 import 'auto_kill_service.dart';
 import 'decoy_service.dart';
+import 'encryption_service.dart';
 import 'vault_service.dart';
 
 /// Authentication service that handles password and biometric authentication
@@ -63,6 +64,7 @@ class AuthService {
       await _createHashedCredential(password, _passwordSaltKey, _passwordHashKey, _passwordIterationsKey);
       await _storage.write(key: _firstTimeKey, value: 'false');
       await _storage.write(key: _authMethodKey, value: 'password');
+      EncryptionService.instance.setPendingCredential(password);
 
       return true;
     } catch (e) {
@@ -80,6 +82,7 @@ class AuthService {
       await _createHashedCredential(pin, _pinSaltKey, _pinHashKey, _pinIterationsKey);
       await _storage.write(key: _firstTimeKey, value: 'false');
       await _storage.write(key: _authMethodKey, value: 'pin');
+      EncryptionService.instance.setPendingCredential(pin);
 
       return true;
     } catch (e) {
@@ -89,12 +92,18 @@ class AuthService {
 
   /// Verify the provided PIN against stored hash
   Future<bool> verifyPIN(String pin) async {
-    if (await _verifyCredential(pin, _pinHashKey, _pinSaltKey, _pinIterationsKey)) return true;
+    if (await _verifyCredential(pin, _pinHashKey, _pinSaltKey, _pinIterationsKey)) {
+      EncryptionService.instance.setPendingCredential(pin);
+      return true;
+    }
     return _verifyCredential(pin, _backupPinHashKey, _backupPinSaltKey, _backupPinIterationsKey);
   }
 
   Future<bool> verifyPassword(String password) async {
-    if (await _verifyCredential(password, _passwordHashKey, _passwordSaltKey, _passwordIterationsKey)) return true;
+    if (await _verifyCredential(password, _passwordHashKey, _passwordSaltKey, _passwordIterationsKey)) {
+      EncryptionService.instance.setPendingCredential(password);
+      return true;
+    }
     return _verifyCredential(password, _backupPasswordHashKey, _backupPasswordSaltKey, _backupPasswordIterationsKey);
   }
 
@@ -311,6 +320,7 @@ class AuthService {
 
         await _storage.write(key: _firstTimeKey, value: 'false');
         await _storage.write(key: _authMethodKey, value: 'biometric');
+        await EncryptionService.instance.setupBiometricKwk();
         debugPrint('[AuthService] Biometric setup complete');
         return true;
       }
@@ -378,6 +388,9 @@ class AuthService {
       await _createHashedCredential(newPassword, _passwordSaltKey, _passwordHashKey, _passwordIterationsKey);
       await _storage.write(key: _authMethodKey, value: 'password');
       await _storage.write(key: _biometricsEnabledKey, value: 'false');
+      await _clearBackupCredentials();
+      await EncryptionService.instance.reWrapKey(newPassword);
+      await EncryptionService.instance.removeBiometricKwk();
 
       return true;
     } catch (e) {
@@ -398,6 +411,9 @@ class AuthService {
       await _createHashedCredential(newPIN, _pinSaltKey, _pinHashKey, _pinIterationsKey);
       await _storage.write(key: _authMethodKey, value: 'pin');
       await _storage.write(key: _biometricsEnabledKey, value: 'false');
+      await _clearBackupCredentials();
+      await EncryptionService.instance.reWrapKey(newPIN);
+      await EncryptionService.instance.removeBiometricKwk();
 
       return true;
     } catch (e) {
@@ -417,6 +433,9 @@ class AuthService {
       await _createHashedCredential(newPassword, _passwordSaltKey, _passwordHashKey, _passwordIterationsKey);
       await _storage.write(key: _authMethodKey, value: 'password');
       await _storage.write(key: _biometricsEnabledKey, value: 'false');
+      await _clearBackupCredentials();
+      await EncryptionService.instance.reWrapKey(newPassword);
+      await EncryptionService.instance.removeBiometricKwk();
 
       return true;
     } catch (e) {
@@ -438,6 +457,9 @@ class AuthService {
       await _createHashedCredential(newPIN, _pinSaltKey, _pinHashKey, _pinIterationsKey);
       await _storage.write(key: _authMethodKey, value: 'pin');
       await _storage.write(key: _biometricsEnabledKey, value: 'false');
+      await _clearBackupCredentials();
+      await EncryptionService.instance.reWrapKey(newPIN);
+      await EncryptionService.instance.removeBiometricKwk();
 
       return true;
     } catch (e) {
@@ -452,25 +474,28 @@ class AuthService {
       await _storage.delete(key: _pinHashKey);
       await _storage.delete(key: _passwordSaltKey);
       await _storage.delete(key: _pinSaltKey);
-      await _storage.delete(key: _backupPasswordHashKey);
-      await _storage.delete(key: _backupPinHashKey);
-      await _storage.delete(key: _backupPasswordSaltKey);
-      await _storage.delete(key: _backupPinSaltKey);
-      await _storage.delete(key: _passwordIterationsKey);
-      await _storage.delete(key: _pinIterationsKey);
-      await _storage.delete(key: _backupPasswordIterationsKey);
-      await _storage.delete(key: _backupPinIterationsKey);
+      await _clearBackupCredentials();
       await _storage.delete(key: _hashVersionKey);
       await _storage.delete(key: _firstTimeKey);
       await _storage.delete(key: _biometricsEnabledKey);
       await _storage.delete(key: _authMethodKey);
       await resetUnlockAttempts();
+      await EncryptionService.instance.removeBiometricKwk();
       return true;
     } catch (e) {
       return false;
     }
   }
 
+  Future<void> _clearBackupCredentials() async {
+    await _storage.delete(key: _backupPasswordHashKey);
+    await _storage.delete(key: _backupPinHashKey);
+    await _storage.delete(key: _backupPasswordSaltKey);
+    await _storage.delete(key: _backupPinSaltKey);
+    await _storage.delete(key: _backupPasswordIterationsKey);
+    await _storage.delete(key: _backupPinIterationsKey);
+  }
+
   /// Get the current unlock protection state.
   Future<UnlockSecurityState> getUnlockSecurityState() async {
     final settings = await _vaultService.getSettings();
@@ -543,7 +568,7 @@ class AuthService {
     );
   }
 
-  static const int _defaultKdfIterations = 100000;
+  static const int _defaultKdfIterations = 600000;
   static const int _saltSize = 32;
 
   Future<int> _getCurrentKdfIterations() async {
@@ -576,6 +601,9 @@ class AuthService {
 
   Future<bool> _verifyCredential(String credential, String hashKey, String saltKey, String iterationsKey) async {
     try {
+      final state = await getUnlockSecurityState();
+      if (state.isLockedOut) return false;
+
       final storedHash = await _storage.read(key: hashKey);
       final storedSalt = await _storage.read(key: saltKey);
 

From cf9fecf72c97e84b787ef843c5575f6fa2a95045 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 21:37:11 +0800
Subject: [PATCH 41/64] Store pending credential and increase KDF iterations

Update PIN validation to require exactly 6 digits and integrate
pending credential flow with EncryptionService for both decoy PIN
and password operations. Increase default KDF iterations from
100000 to 600000. Clean up additional decoy key storage entries
when resetting decoy data.
---
 lib/services/decoy_service.dart | 23 ++++++++++++++++++-----
 1 file changed, 18 insertions(+), 5 deletions(-)

diff --git a/lib/services/decoy_service.dart b/lib/services/decoy_service.dart
index 217ad28..3c925f7 100644
--- a/lib/services/decoy_service.dart
+++ b/lib/services/decoy_service.dart
@@ -5,6 +5,7 @@ import 'package:flutter/foundation.dart';
 import 'package:flutter_secure_storage/flutter_secure_storage.dart';
 import '../utils/pbkdf2_isolate.dart';
 import '../models/vaulted_file.dart';
+import 'encryption_service.dart';
 import 'vault_service.dart';
 
 /// Service for managing decoy mode functionality
@@ -115,12 +116,14 @@ class DecoyService {
     }
   }
 
-  /// Set decoy PIN
+  /// Set decoy PIN (6 digits, matching main PIN requirement)
   Future<bool> setDecoyPin(String pin) async {
     try {
-      if (pin.isEmpty || pin.length < 4) return false;
+      if (pin.isEmpty || pin.length != 6) return false;
+      if (!RegExp(r'^[0-9]{6}$').hasMatch(pin)) return false;
 
       await _createHashedCredential(pin, _decoyPinSaltKey, _decoyPinKey, _decoyPinIterationsKey);
+      EncryptionService.instance.setPendingCredential(pin, isDecoy: true);
 
       _cachedSettings = (_cachedSettings ?? const DecoySettings()).copyWith(
         hasPinSet: true,
@@ -140,6 +143,7 @@ class DecoyService {
       if (password.isEmpty) return false;
 
       await _createHashedCredential(password, _decoyPasswordSaltKey, _decoyPasswordKey, _decoyPasswordIterationsKey);
+      EncryptionService.instance.setPendingCredential(password, isDecoy: true);
 
       _cachedSettings = (_cachedSettings ?? const DecoySettings()).copyWith(
         hasPasswordSet: true,
@@ -155,12 +159,16 @@ class DecoyService {
 
   /// Verify decoy PIN
   Future<bool> verifyDecoyPin(String pin) async {
-    return _verifyCredential(pin, _decoyPinKey, _decoyPinSaltKey, _decoyPinIterationsKey);
+    final result = await _verifyCredential(pin, _decoyPinKey, _decoyPinSaltKey, _decoyPinIterationsKey);
+    if (result) EncryptionService.instance.setPendingCredential(pin, isDecoy: true);
+    return result;
   }
 
   /// Verify decoy password
   Future<bool> verifyDecoyPassword(String password) async {
-    return _verifyCredential(password, _decoyPasswordKey, _decoyPasswordSaltKey, _decoyPasswordIterationsKey);
+    final result = await _verifyCredential(password, _decoyPasswordKey, _decoyPasswordSaltKey, _decoyPasswordIterationsKey);
+    if (result) EncryptionService.instance.setPendingCredential(password, isDecoy: true);
+    return result;
   }
 
   /// Check if input is decoy credential
@@ -235,7 +243,7 @@ class DecoyService {
     await _saveSettings();
   }
 
-  static const int _defaultKdfIterations = 100000;
+  static const int _defaultKdfIterations = 600000;
 
   Future<int> _getCurrentKdfIterations() async {
     final settings = await _vaultService.getSettings();
@@ -342,6 +350,11 @@ class DecoyService {
       await _storage.delete(key: _decoyPasswordSaltKey);
       await _storage.delete(key: _decoyPinIterationsKey);
       await _storage.delete(key: _decoyPasswordIterationsKey);
+      await _storage.delete(key: 'vault_decoy_key_version');
+      await _storage.delete(key: 'vault_decoy_key_wrapped');
+      await _storage.delete(key: 'vault_decoy_kwk_salt');
+      await _storage.delete(key: 'vault_decoy_kwk_iv');
+      await _storage.delete(key: 'vault_decoy_key');
       _cachedSettings = (_cachedSettings ?? const DecoySettings()).copyWith(
         hasPinSet: false,
         hasPasswordSet: false,

From ca51787daf881c6437c97b5163c49fb7d6c5348c Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 21:37:16 +0800
Subject: [PATCH 42/64] Implement key wrapping and biometric unlock for master
 keys

---
 lib/services/encryption_service.dart | 309 +++++++++++++++++++++++----
 1 file changed, 268 insertions(+), 41 deletions(-)

diff --git a/lib/services/encryption_service.dart b/lib/services/encryption_service.dart
index 627fe81..9277746 100644
--- a/lib/services/encryption_service.dart
+++ b/lib/services/encryption_service.dart
@@ -7,6 +7,7 @@ import 'package:flutter/foundation.dart';
 import 'package:flutter_secure_storage/flutter_secure_storage.dart';
 import 'package:pointycastle/export.dart';
 import '../models/encryption_algorithm.dart';
+import '../utils/argon2_isolate.dart';
 import 'crypto_isolate_pool.dart';
 
 const int _streamChunkSize = 1024 * 1024;
@@ -34,16 +35,37 @@ class EncryptionService {
 
   static const String _masterKeyKey = 'vault_master_key';
   static const String _decoyKeyKey = 'vault_decoy_key';
+
+  // H1: Key wrapping storage keys (real vault)
+  static const String _keyVersionKey = 'vault_key_version';
+  static const String _wrappedKeyKey = 'vault_master_key_wrapped';
+  static const String _kwkSaltKey = 'vault_kwk_salt';
+  static const String _kwkIvKey = 'vault_kwk_iv';
+  static const String _biometricKwkKey = 'vault_biometric_kwk';
+  static const String _biometricWrappedKeyKey = 'vault_master_key_wrapped_biometric';
+  static const String _biometricIvKey = 'vault_biometric_iv';
+
+  // H1: Key wrapping storage keys (decoy vault)
+  static const String _decoyKeyVersionKey = 'vault_decoy_key_version';
+  static const String _decoyWrappedKeyKey = 'vault_decoy_key_wrapped';
+  static const String _decoyKwkSaltKey = 'vault_decoy_kwk_salt';
+  static const String _decoyKwkIvKey = 'vault_decoy_kwk_iv';
+
   static const int _keySize = 32; // 256 bits
   static const int _ivSize = 16; // 128 bits
 
   Uint8List? _cachedMasterKey;
   Uint8List? _cachedDecoyKey;
+  String? _pendingCredential;
+  String? _pendingDecoyCredential;
 
   CryptoIsolatePool? _pool;
 
   Future<void> initialize() async {
-    await _ensureMasterKey();
+    final version = await _storage.read(key: _keyVersionKey);
+    if (version == null) {
+      await _ensureMasterKey();
+    }
     _pool = CryptoIsolatePool();
     await _pool!.initialize();
     await _checkKeyRotationRecovery();
@@ -54,10 +76,209 @@ class EncryptionService {
     _pool = null;
   }
 
+  /// Set pending credential for key unlocking (called by AuthService after verify/create)
+  void setPendingCredential(String credential, {bool isDecoy = false}) {
+    if (isDecoy) {
+      _pendingDecoyCredential = credential;
+    } else {
+      _pendingCredential = credential;
+    }
+  }
+
+  /// Unlock master key using user credential (PIN/password).
+  /// Handles first-time key creation, legacy migration, and normal unwrap.
+  Future<Uint8List> unlockMasterKey(String credential, {bool isDecoy = false}) async {
+    final cached = isDecoy ? _cachedDecoyKey : _cachedMasterKey;
+    if (cached != null) return cached;
+
+    final versionKey = isDecoy ? _decoyKeyVersionKey : _keyVersionKey;
+    final rawKeyKey = isDecoy ? _decoyKeyKey : _masterKeyKey;
+    final wrappedKeyKey = isDecoy ? _decoyWrappedKeyKey : _wrappedKeyKey;
+    final saltKey = isDecoy ? _decoyKwkSaltKey : _kwkSaltKey;
+    final ivKey = isDecoy ? _decoyKwkIvKey : _kwkIvKey;
+
+    final version = await _storage.read(key: versionKey);
+
+    if (version == '1') {
+      final wrappedKeyB64 = await _storage.read(key: wrappedKeyKey);
+      final saltB64 = await _storage.read(key: saltKey);
+      final ivB64 = await _storage.read(key: ivKey);
+
+      if (wrappedKeyB64 == null || saltB64 == null || ivB64 == null) {
+        throw StateError('Wrapped key data incomplete');
+      }
+
+      final kwk = await computeArgon2idHash(credential, base64Decode(saltB64));
+      final masterKey = _unwrapKey(base64Decode(wrappedKeyB64), kwk, base64Decode(ivB64));
+
+      if (isDecoy) {
+        _cachedDecoyKey = masterKey;
+      } else {
+        _cachedMasterKey = masterKey;
+      }
+      return masterKey;
+    }
+
+    // Legacy: read raw key, wrap with credential, delete raw (transparent migration)
+    final rawKeyB64 = await _storage.read(key: rawKeyKey);
+    if (rawKeyB64 != null) {
+      final masterKey = base64Decode(rawKeyB64);
+      await _wrapAndStoreKey(masterKey, credential, isDecoy: isDecoy);
+      await _storage.delete(key: rawKeyKey);
+      await _storage.write(key: versionKey, value: '1');
+
+      if (isDecoy) {
+        _cachedDecoyKey = masterKey;
+      } else {
+        _cachedMasterKey = masterKey;
+      }
+      debugPrint('[Encryption] Migrated ${isDecoy ? 'decoy' : 'master'} key to wrapped form');
+      return masterKey;
+    }
+
+    // First-time: generate new key, wrap, store
+    final masterKey = _generateRandomBytes(_keySize);
+    await _wrapAndStoreKey(masterKey, credential, isDecoy: isDecoy);
+    await _storage.write(key: versionKey, value: '1');
+
+    if (isDecoy) {
+      _cachedDecoyKey = masterKey;
+    } else {
+      _cachedMasterKey = masterKey;
+    }
+    return masterKey;
+  }
+
+  /// Unlock master key using biometric KWK (stored in secure storage).
+  Future<Uint8List> unlockMasterKeyWithBiometric({bool isDecoy = false}) async {
+    if (isDecoy) throw StateError('Decoy biometric unlock not supported');
+    if (_cachedMasterKey != null) return _cachedMasterKey!;
+
+    final version = await _storage.read(key: _keyVersionKey);
+
+    if (version == '1') {
+      final biometricKwkB64 = await _storage.read(key: _biometricKwkKey);
+      final wrappedKeyB64 = await _storage.read(key: _biometricWrappedKeyKey);
+      final ivB64 = await _storage.read(key: _biometricIvKey);
+
+      if (biometricKwkB64 == null || wrappedKeyB64 == null || ivB64 == null) {
+        throw StateError('Biometric key data incomplete');
+      }
+
+      final masterKey = _unwrapKey(
+        base64Decode(wrappedKeyB64),
+        base64Decode(biometricKwkB64),
+        base64Decode(ivB64),
+      );
+      _cachedMasterKey = masterKey;
+      return masterKey;
+    }
+
+    // Legacy: read raw key, create biometric wrapping, migrate
+    final rawKeyB64 = await _storage.read(key: _masterKeyKey);
+    if (rawKeyB64 != null) {
+      final masterKey = base64Decode(rawKeyB64);
+      await _setupBiometricKwkForKey(masterKey);
+      await _storage.delete(key: _masterKeyKey);
+      await _storage.write(key: _keyVersionKey, value: '1');
+      _cachedMasterKey = masterKey;
+      debugPrint('[Encryption] Migrated master key to wrapped form (biometric)');
+      return masterKey;
+    }
+
+    throw StateError('No master key found for biometric unlock');
+  }
+
+  /// Re-wrap the master key with a new credential (called on password/PIN change).
+  Future<void> reWrapKey(String newCredential, {bool isDecoy = false}) async {
+    final masterKey = isDecoy ? _cachedDecoyKey : _cachedMasterKey;
+    if (masterKey == null) throw StateError('Master key not unlocked');
+
+    await _wrapAndStoreKey(masterKey, newCredential, isDecoy: isDecoy);
+  }
+
+  /// Set up biometric KWK for the current master key (called when enabling biometric).
+  Future<void> setupBiometricKwk() async {
+    if (_cachedMasterKey == null) {
+      final version = await _storage.read(key: _keyVersionKey);
+      if (version == null) {
+        _cachedMasterKey = _generateRandomBytes(_keySize);
+        await _storage.write(key: _masterKeyKey, value: base64Encode(_cachedMasterKey!));
+      } else {
+        throw StateError('Master key not unlocked. Call unlockMasterKey first.');
+      }
+    }
+
+    await _setupBiometricKwkForKey(_cachedMasterKey!);
+
+    final version = await _storage.read(key: _keyVersionKey);
+    if (version == null) {
+      await _storage.write(key: _keyVersionKey, value: '1');
+      await _storage.delete(key: _masterKeyKey);
+    }
+  }
+
+  /// Remove biometric KWK (called when disabling biometric).
+  Future<void> removeBiometricKwk() async {
+    await _storage.delete(key: _biometricKwkKey);
+    await _storage.delete(key: _biometricWrappedKeyKey);
+    await _storage.delete(key: _biometricIvKey);
+  }
+
+  /// Check if biometric KWK is set up.
+  Future<bool> hasBiometricKwk() async {
+    final kwk = await _storage.read(key: _biometricKwkKey);
+    return kwk != null;
+  }
+
+  Future<void> _wrapAndStoreKey(
+    Uint8List masterKey,
+    String credential, {
+    required bool isDecoy,
+  }) async {
+    final salt = _generateRandomBytes(32);
+    final iv = generateIV();
+    final kwk = await computeArgon2idHash(credential, salt);
+    final wrappedKey = _wrapKey(masterKey, kwk, iv);
+
+    final wrappedKeyKey = isDecoy ? _decoyWrappedKeyKey : _wrappedKeyKey;
+    final saltKey = isDecoy ? _decoyKwkSaltKey : _kwkSaltKey;
+    final ivKey = isDecoy ? _decoyKwkIvKey : _kwkIvKey;
+
+    await _storage.write(key: wrappedKeyKey, value: base64Encode(wrappedKey));
+    await _storage.write(key: saltKey, value: base64Encode(salt));
+    await _storage.write(key: ivKey, value: base64Encode(iv));
+  }
+
+  Future<void> _setupBiometricKwkForKey(Uint8List masterKey) async {
+    final biometricKwk = _generateRandomBytes(_keySize);
+    final iv = generateIV();
+    final wrappedKey = _wrapKey(masterKey, biometricKwk, iv);
+
+    await _storage.write(key: _biometricKwkKey, value: base64Encode(biometricKwk));
+    await _storage.write(key: _biometricWrappedKeyKey, value: base64Encode(wrappedKey));
+    await _storage.write(key: _biometricIvKey, value: base64Encode(iv));
+  }
+
+  Uint8List _wrapKey(Uint8List masterKey, Uint8List kwk, Uint8List iv) {
+    final cipher = _getGcmCipher(kwk, iv, true);
+    return cipher.process(masterKey);
+  }
+
+  Uint8List _unwrapKey(Uint8List wrappedKey, Uint8List kwk, Uint8List iv) {
+    final cipher = _getGcmCipher(kwk, iv, false);
+    return cipher.process(wrappedKey);
+  }
+
   /// Ensure master key exists, create if not
   Future<Uint8List> _ensureMasterKey() async {
     if (_cachedMasterKey != null) return _cachedMasterKey!;
 
+    final version = await _storage.read(key: _keyVersionKey);
+    if (version == '1') {
+      throw StateError('Master key is wrapped. Call unlockMasterKey first.');
+    }
+
     try {
       final storedKey = await _storage.read(key: _masterKeyKey);
       if (storedKey != null) {
@@ -68,10 +289,15 @@ class EncryptionService {
       debugPrint('Error reading master key: $e');
     }
 
-    // Generate new master key
     _cachedMasterKey = _generateRandomBytes(_keySize);
-    await _storage.write(
-        key: _masterKeyKey, value: base64Encode(_cachedMasterKey!));
+    if (_pendingCredential != null) {
+      await _wrapAndStoreKey(_cachedMasterKey!, _pendingCredential!, isDecoy: false);
+      await _storage.write(key: _keyVersionKey, value: '1');
+      _pendingCredential = null;
+    } else {
+      await _storage.write(
+          key: _masterKeyKey, value: base64Encode(_cachedMasterKey!));
+    }
     return _cachedMasterKey!;
   }
 
@@ -83,6 +309,11 @@ class EncryptionService {
   Future<Uint8List> _ensureDecoyKey() async {
     if (_cachedDecoyKey != null) return _cachedDecoyKey!;
 
+    final version = await _storage.read(key: _decoyKeyVersionKey);
+    if (version == '1') {
+      throw StateError('Decoy key is wrapped. Call unlockMasterKey(isDecoy: true) first.');
+    }
+
     try {
       final storedKey = await _storage.read(key: _decoyKeyKey);
       if (storedKey != null) {
@@ -93,10 +324,15 @@ class EncryptionService {
       debugPrint('Error reading decoy key: $e');
     }
 
-    // Generate new decoy key
     _cachedDecoyKey = _generateRandomBytes(_keySize);
-    await _storage.write(
-        key: _decoyKeyKey, value: base64Encode(_cachedDecoyKey!));
+    if (_pendingDecoyCredential != null) {
+      await _wrapAndStoreKey(_cachedDecoyKey!, _pendingDecoyCredential!, isDecoy: true);
+      await _storage.write(key: _decoyKeyVersionKey, value: '1');
+      _pendingDecoyCredential = null;
+    } else {
+      await _storage.write(
+          key: _decoyKeyKey, value: base64Encode(_cachedDecoyKey!));
+    }
     return _cachedDecoyKey!;
   }
 
@@ -210,11 +446,10 @@ class EncryptionService {
 
       // Validate input data length for CBC mode
       if (encryptedData.length % 16 != 0) {
-        debugPrint(
-            'Decryption error: Invalid data length ${encryptedData.length} (not multiple of 16)');
-        // Try CTR mode as fallback - maybe file was incorrectly detected
-        debugPrint('[Encryption] Attempting CTR fallback...');
-        return await _tryCtrFallback(encryptedData, ivBase64, isDecoy);
+        return DecryptionResult(
+          success: false,
+          error: 'Invalid data length ${encryptedData.length} (not multiple of 16). File may be corrupted.',
+        );
       }
 
       final cipher = _getCipher(key, iv, false);
@@ -233,35 +468,6 @@ class EncryptionService {
     }
   }
 
-  /// CTR fallback when CBC fails
-  Future<DecryptionResult> _tryCtrFallback(
-    Uint8List encryptedData,
-    String ivBase64,
-    bool isDecoy,
-  ) async {
-    try {
-      final key = isDecoy ? await _ensureDecoyKey() : await _ensureMasterKey();
-      final iv = base64Decode(ivBase64);
-
-      final ctr = CTRStreamCipher(AESEngine())
-        ..init(false, ParametersWithIV<KeyParameter>(KeyParameter(key), iv));
-
-      final decrypted = ctr.process(encryptedData);
-
-      debugPrint('[Encryption] CTR fallback succeeded!');
-      return DecryptionResult(
-        success: true,
-        data: decrypted,
-      );
-    } catch (e) {
-      debugPrint('[Encryption] CTR fallback failed: $e');
-      return DecryptionResult(
-        success: false,
-        error: 'Decryption failed: $e',
-      );
-    }
-  }
-
   /// Encrypt a file using chunked streaming (memory-efficient for large files)
   /// Processes file in chunks to avoid loading entire file into memory
   /// Uses CTR mode for streaming (CBC requires full blocks, not suitable for streaming)
@@ -1621,6 +1827,11 @@ class EncryptionService {
   /// Check if encryption is enabled
   Future<bool> hasEncryptionKey() async {
     try {
+      final version = await _storage.read(key: _keyVersionKey);
+      if (version == '1') {
+        final wrappedKey = await _storage.read(key: _wrappedKeyKey);
+        return wrappedKey != null;
+      }
       final key = await _storage.read(key: _masterKeyKey);
       return key != null;
     } catch (e) {
@@ -1631,10 +1842,26 @@ class EncryptionService {
   Future<void> resetKeys() async {
     _cachedMasterKey = null;
     _cachedDecoyKey = null;
+    _pendingCredential = null;
+    _pendingDecoyCredential = null;
+
     await _storage.delete(key: _masterKeyKey);
     await _storage.delete(key: _decoyKeyKey);
     await _storage.delete(key: _oldMasterKeyKey);
     await _storage.delete(key: _rotationJournalKey);
+
+    await _storage.delete(key: _keyVersionKey);
+    await _storage.delete(key: _wrappedKeyKey);
+    await _storage.delete(key: _kwkSaltKey);
+    await _storage.delete(key: _kwkIvKey);
+    await _storage.delete(key: _biometricKwkKey);
+    await _storage.delete(key: _biometricWrappedKeyKey);
+    await _storage.delete(key: _biometricIvKey);
+
+    await _storage.delete(key: _decoyKeyVersionKey);
+    await _storage.delete(key: _decoyWrappedKeyKey);
+    await _storage.delete(key: _decoyKwkSaltKey);
+    await _storage.delete(key: _decoyKwkIvKey);
   }
 }
 

From da190e49dc89d45035f5967ea79ed89ceb9caf93 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 21:37:26 +0800
Subject: [PATCH 43/64] Remove deprecated compression services

The old `MediaCompressionService` relied on deprecated packages
and the `ImprovedCompressionService` has been superseded by the
new video compressor implementation using FFmpeg isolates.
---
 .../improved_compression_service.dart         | 374 ------------------
 lib/services/media_compression_service.dart   | 274 -------------
 2 files changed, 648 deletions(-)
 delete mode 100644 lib/services/improved_compression_service.dart
 delete mode 100644 lib/services/media_compression_service.dart

diff --git a/lib/services/improved_compression_service.dart b/lib/services/improved_compression_service.dart
deleted file mode 100644
index 65248f1..0000000
--- a/lib/services/improved_compression_service.dart
+++ /dev/null
@@ -1,374 +0,0 @@
-import 'dart:async';
-import 'dart:convert';
-import 'dart:io';
-import 'dart:isolate';
-import 'package:flutter/foundation.dart';
-import 'package:path_provider/path_provider.dart';
-
-/// Improved compression service with isolate support, progress tracking, and cancellation
-class ImprovedCompressionService {
-  ImprovedCompressionService._();
-  static final ImprovedCompressionService instance = ImprovedCompressionService._();
-
-  final Map<String, CompressionTask> _activeTasks = {};
-
-  /// Compress video with progress tracking and cancellation support
-  Future<CompressionResult?> compressVideo({
-    required String sourcePath,
-    required String taskId,
-    VideoCompressionQuality quality = VideoCompressionQuality.medium,
-    Function(double progress)? onProgress,
-  }) async {
-    try {
-      final sourceFile = File(sourcePath);
-      if (!await sourceFile.exists()) {
-        debugPrint('[ImprovedCompression] Source file does not exist: $sourcePath');
-        return null;
-      }
-
-      final originalSize = await sourceFile.length();
-      
-      // Skip compression for very small files (< 5MB)
-      if (originalSize < 5 * 1024 * 1024) {
-        debugPrint('[ImprovedCompression] File too small to compress, skipping');
-        return CompressionResult(
-          compressedPath: sourcePath,
-          originalSize: originalSize,
-          compressedSize: originalSize,
-          compressionRatio: 0,
-          skipped: true,
-        );
-      }
-
-      final tempDir = await getTemporaryDirectory();
-      final outputPath = '${tempDir.path}/compressed_${DateTime.now().millisecondsSinceEpoch}.mp4';
-
-      // Create receive port for isolate communication
-      final receivePort = ReceivePort();
-      final completer = Completer<CompressionResult?>();
-
-      // Create task for tracking
-      final task = CompressionTask(
-        taskId: taskId,
-        sourcePath: sourcePath,
-        outputPath: outputPath,
-        receivePort: receivePort,
-        completer: completer,
-      );
-      _activeTasks[taskId] = task;
-
-      // Spawn isolate
-      final isolate = await Isolate.spawn(
-        _videoCompressionIsolate,
-        _VideoCompressionParams(
-          sourcePath: sourcePath,
-          outputPath: outputPath,
-          quality: quality,
-          sendPort: receivePort.sendPort,
-        ),
-      );
-
-      task.isolate = isolate;
-
-      // Listen to isolate messages
-      receivePort.listen((message) {
-        if (message is Map<String, dynamic>) {
-          if (message['type'] == 'progress') {
-            final progress = message['progress'] as double;
-            onProgress?.call(progress);
-          } else if (message['type'] == 'complete') {
-            final result = CompressionResult(
-              compressedPath: message['outputPath'] as String,
-              originalSize: message['originalSize'] as int,
-              compressedSize: message['compressedSize'] as int,
-              compressionRatio: message['compressionRatio'] as double,
-            );
-            completer.complete(result);
-            _cleanupTask(taskId);
-          } else if (message['type'] == 'error') {
-            completer.completeError(message['error'] as String);
-            _cleanupTask(taskId);
-          } else if (message['type'] == 'cancelled') {
-            completer.complete(null);
-            _cleanupTask(taskId);
-          }
-        }
-      });
-
-      return await completer.future;
-    } catch (e) {
-      debugPrint('[ImprovedCompression] Error compressing video: $e');
-      _cleanupTask(taskId);
-      return null;
-    }
-  }
-
-  /// Cancel compression and rollback changes
-  Future<bool> cancelCompression(String taskId) async {
-    final task = _activeTasks[taskId];
-    if (task == null) {
-      debugPrint('[ImprovedCompression] Task not found: $taskId');
-      return false;
-    }
-
-    try {
-      debugPrint('[ImprovedCompression] Cancelling task: $taskId');
-      
-      // Kill the isolate
-      task.isolate?.kill(priority: Isolate.immediate);
-      
-      // Delete partial output file
-      final outputFile = File(task.outputPath);
-      if (await outputFile.exists()) {
-        await outputFile.delete();
-        debugPrint('[ImprovedCompression] Deleted partial output: ${task.outputPath}');
-      }
-
-      // Complete with null to indicate cancellation
-      if (!task.completer.isCompleted) {
-        task.completer.complete(null);
-      }
-
-      _cleanupTask(taskId);
-      return true;
-    } catch (e) {
-      debugPrint('[ImprovedCompression] Error cancelling task: $e');
-      return false;
-    }
-  }
-
-  /// Cleanup task resources
-  void _cleanupTask(String taskId) {
-    final task = _activeTasks.remove(taskId);
-    if (task != null) {
-      task.receivePort.close();
-      task.isolate?.kill(priority: Isolate.immediate);
-    }
-  }
-
-  /// Check if FFmpeg is available
-  Future<bool> isFFmpegAvailable() async {
-    try {
-      final result = await Process.run('ffmpeg', ['-version']);
-      return result.exitCode == 0;
-    } catch (e) {
-      return false;
-    }
-  }
-
-  /// Get all active compression tasks
-  List<String> getActiveTasks() {
-    return _activeTasks.keys.toList();
-  }
-}
-
-/// Isolate function for video compression
-void _videoCompressionIsolate(_VideoCompressionParams params) async {
-  Process? process;
-  
-  try {
-    final sourceFile = File(params.sourcePath);
-    final originalSize = await sourceFile.length();
-
-    // Get video duration for progress calculation
-    final durationResult = await Process.run('ffprobe', [
-      '-v',
-      'error',
-      '-show_entries',
-      'format=duration',
-      '-of',
-      'default=noprint_wrappers=1:nokey=1',
-      params.sourcePath,
-    ]);
-
-    double? totalDuration;
-    if (durationResult.exitCode == 0) {
-      totalDuration = double.tryParse(durationResult.stdout.toString().trim());
-    }
-
-    // Build FFmpeg command based on quality
-    final args = _buildFFmpegArgs(params.sourcePath, params.outputPath, params.quality);
-
-    // Start FFmpeg process
-    process = await Process.start('ffmpeg', args);
-
-    // Monitor stderr for progress
-    final stderrSubscription = process.stderr
-        .transform(utf8.decoder)
-        .transform(const LineSplitter())
-        .listen((line) {
-      // Parse FFmpeg progress: "frame= 123 fps=30 time=00:00:04.10"
-      if (totalDuration != null && line.contains('time=')) {
-        final timeMatch = RegExp(r'time=(\d+):(\d+):(\d+\.\d+)').firstMatch(line);
-        if (timeMatch != null) {
-          final hours = int.parse(timeMatch.group(1)!);
-          final minutes = int.parse(timeMatch.group(2)!);
-          final seconds = double.parse(timeMatch.group(3)!);
-          final currentTime = hours * 3600 + minutes * 60 + seconds;
-          final progress = (currentTime / totalDuration).clamp(0.0, 1.0);
-          
-          params.sendPort.send({
-            'type': 'progress',
-            'progress': progress,
-          });
-        }
-      }
-    });
-
-    final exitCode = await process.exitCode;
-    await stderrSubscription.cancel();
-
-    if (exitCode == 0) {
-      final outputFile = File(params.outputPath);
-      if (await outputFile.exists()) {
-        final compressedSize = await outputFile.length();
-        final compressionRatio = ((originalSize - compressedSize) / originalSize * 100);
-
-        params.sendPort.send({
-          'type': 'complete',
-          'outputPath': params.outputPath,
-          'originalSize': originalSize,
-          'compressedSize': compressedSize,
-          'compressionRatio': compressionRatio,
-        });
-      } else {
-        params.sendPort.send({
-          'type': 'error',
-          'error': 'Output file not created',
-        });
-      }
-    } else {
-      params.sendPort.send({
-        'type': 'error',
-        'error': 'FFmpeg exited with code $exitCode',
-      });
-    }
-  } catch (e) {
-    // Check if it was a cancellation
-    if (e.toString().contains('killed') || e.toString().contains('cancelled')) {
-      params.sendPort.send({'type': 'cancelled'});
-    } else {
-      params.sendPort.send({
-        'type': 'error',
-        'error': e.toString(),
-      });
-    }
-  } finally {
-    process?.kill();
-  }
-}
-
-/// Build FFmpeg arguments based on quality
-List<String> _buildFFmpegArgs(String input, String output, VideoCompressionQuality quality) {
-  final baseArgs = ['-i', input];
-  
-  switch (quality) {
-    case VideoCompressionQuality.high:
-      return [
-        ...baseArgs,
-        '-vcodec', 'libx264',
-        '-preset', 'medium',
-        '-crf', '18',
-        '-acodec', 'aac',
-        '-b:a', '192k',
-        '-movflags', '+faststart',
-        '-y',
-        output,
-      ];
-    case VideoCompressionQuality.medium:
-      return [
-        ...baseArgs,
-        '-vcodec', 'libx264',
-        '-preset', 'fast',
-        '-crf', '23',
-        '-acodec', 'aac',
-        '-b:a', '128k',
-        '-movflags', '+faststart',
-        '-y',
-        output,
-      ];
-    case VideoCompressionQuality.low:
-      return [
-        ...baseArgs,
-        '-vcodec', 'libx264',
-        '-preset', 'veryfast',
-        '-crf', '28',
-        '-acodec', 'aac',
-        '-b:a', '96k',
-        '-movflags', '+faststart',
-        '-y',
-        output,
-      ];
-  }
-}
-
-/// Compression task tracking
-class CompressionTask {
-  final String taskId;
-  final String sourcePath;
-  final String outputPath;
-  final ReceivePort receivePort;
-  final Completer<CompressionResult?> completer;
-  Isolate? isolate;
-
-  CompressionTask({
-    required this.taskId,
-    required this.sourcePath,
-    required this.outputPath,
-    required this.receivePort,
-    required this.completer,
-    this.isolate,
-  });
-}
-
-/// Parameters for video compression isolate
-class _VideoCompressionParams {
-  final String sourcePath;
-  final String outputPath;
-  final VideoCompressionQuality quality;
-  final SendPort sendPort;
-
-  const _VideoCompressionParams({
-    required this.sourcePath,
-    required this.outputPath,
-    required this.quality,
-    required this.sendPort,
-  });
-}
-
-/// Video compression quality levels
-enum VideoCompressionQuality {
-  high,   // CRF 18, slower but better quality
-  medium, // CRF 23, balanced
-  low,    // CRF 28, faster but lower quality
-}
-
-/// Result of compression operation
-class CompressionResult {
-  final String compressedPath;
-  final int originalSize;
-  final int compressedSize;
-  final double compressionRatio;
-  final bool skipped;
-
-  CompressionResult({
-    required this.compressedPath,
-    required this.originalSize,
-    required this.compressedSize,
-    required this.compressionRatio,
-    this.skipped = false,
-  });
-
-  String get formattedOriginalSize => _formatBytes(originalSize);
-  String get formattedCompressedSize => _formatBytes(compressedSize);
-  String get formattedRatio => '${compressionRatio.toStringAsFixed(1)}%';
-
-  static String _formatBytes(int bytes) {
-    if (bytes < 1024) return '$bytes B';
-    if (bytes < 1024 * 1024) return '${(bytes / 1024).toStringAsFixed(1)} KB';
-    if (bytes < 1024 * 1024 * 1024) {
-      return '${(bytes / (1024 * 1024)).toStringAsFixed(1)} MB';
-    }
-    return '${(bytes / (1024 * 1024 * 1024)).toStringAsFixed(1)} GB';
-  }
-}
diff --git a/lib/services/media_compression_service.dart b/lib/services/media_compression_service.dart
deleted file mode 100644
index c9872e5..0000000
--- a/lib/services/media_compression_service.dart
+++ /dev/null
@@ -1,274 +0,0 @@
-import 'dart:io';
-import 'package:flutter/foundation.dart';
-import 'package:flutter_image_compress/flutter_image_compress.dart';
-import 'package:image/image.dart' as img;
-import 'package:path_provider/path_provider.dart';
-import 'package:video_compress/video_compress.dart';
-
-/// Service for compressing photos and videos
-class MediaCompressionService {
-  MediaCompressionService._();
-  static final MediaCompressionService instance = MediaCompressionService._();
-
-  /// Compression quality levels
-  static const int qualityHigh = 85;
-  static const int qualityMedium = 70;
-  static const int qualityLow = 50;
-
-  /// Video compression quality levels
-  static const VideoQuality videoQualityHigh = VideoQuality.HighestQuality;
-  static const VideoQuality videoQualityMedium = VideoQuality.DefaultQuality;
-  static const VideoQuality videoQualityLow = VideoQuality.LowQuality;
-
-  /// Compress an image file
-  /// Returns the path to the compressed file, or null if compression failed
-  Future<CompressionResult?> compressImage({
-    required String sourcePath,
-    int quality = qualityMedium,
-    int? maxWidth,
-    int? maxHeight,
-    bool keepExif = true,
-  }) async {
-    try {
-      debugPrint('[Compression] Compressing image: $sourcePath');
-      
-      final sourceFile = File(sourcePath);
-      if (!await sourceFile.exists()) {
-        debugPrint('[Compression] Source file does not exist');
-        return null;
-      }
-
-      final originalSize = await sourceFile.length();
-      
-      // Create temp directory for compressed file
-      final tempDir = await getTemporaryDirectory();
-      final fileName = sourcePath.split('/').last;
-      final targetPath = '${tempDir.path}/compressed_$fileName';
-
-      // Compress using flutter_image_compress
-      final result = await FlutterImageCompress.compressAndGetFile(
-        sourcePath,
-        targetPath,
-        quality: quality,
-        minWidth: maxWidth ?? 1920,
-        minHeight: maxHeight ?? 1920,
-        keepExif: keepExif,
-      );
-
-      if (result == null) {
-        debugPrint('[Compression] Image compression failed');
-        return null;
-      }
-
-      final compressedSize = await result.length();
-      final compressionRatio = ((originalSize - compressedSize) / originalSize * 100);
-
-      debugPrint('[Compression] Image compressed: ${_formatBytes(originalSize)} → ${_formatBytes(compressedSize)} (${compressionRatio.toStringAsFixed(1)}% reduction)');
-
-      return CompressionResult(
-        compressedPath: result.path,
-        originalSize: originalSize,
-        compressedSize: compressedSize,
-        compressionRatio: compressionRatio,
-      );
-    } catch (e) {
-      debugPrint('[Compression] Error compressing image: $e');
-      return null;
-    }
-  }
-
-  /// Compress an image with custom dimensions
-  Future<CompressionResult?> compressImageWithDimensions({
-    required String sourcePath,
-    required int targetWidth,
-    required int targetHeight,
-    int quality = qualityMedium,
-  }) async {
-    try {
-      debugPrint('[Compression] Compressing image with dimensions: ${targetWidth}x$targetHeight');
-      
-      final sourceFile = File(sourcePath);
-      if (!await sourceFile.exists()) {
-        return null;
-      }
-
-      final originalSize = await sourceFile.length();
-      
-      // Read and decode image
-      final bytes = await sourceFile.readAsBytes();
-      final image = img.decodeImage(bytes);
-      
-      if (image == null) {
-        debugPrint('[Compression] Failed to decode image');
-        return null;
-      }
-
-      // Resize image maintaining aspect ratio
-      final resized = img.copyResize(
-        image,
-        width: targetWidth,
-        height: targetHeight,
-        interpolation: img.Interpolation.linear,
-      );
-
-      // Encode with quality
-      final List<int> compressed;
-      final ext = sourcePath.split('.').last.toLowerCase();
-      
-      if (ext == 'png') {
-        compressed = img.encodePng(resized, level: 6);
-      } else {
-        compressed = img.encodeJpg(resized, quality: quality);
-      }
-
-      // Save to temp file
-      final tempDir = await getTemporaryDirectory();
-      final fileName = sourcePath.split('/').last;
-      final targetPath = '${tempDir.path}/resized_$fileName';
-      final targetFile = File(targetPath);
-      await targetFile.writeAsBytes(compressed);
-
-      final compressedSize = compressed.length;
-      final compressionRatio = ((originalSize - compressedSize) / originalSize * 100);
-
-      debugPrint('[Compression] Image resized and compressed: ${_formatBytes(originalSize)} → ${_formatBytes(compressedSize)}');
-
-      return CompressionResult(
-        compressedPath: targetPath,
-        originalSize: originalSize,
-        compressedSize: compressedSize,
-        compressionRatio: compressionRatio,
-      );
-    } catch (e) {
-      debugPrint('[Compression] Error compressing image with dimensions: $e');
-      return null;
-    }
-  }
-
-  /// Compress a video file
-  /// Returns the path to the compressed file, or null if compression failed
-  Future<CompressionResult?> compressVideo({
-    required String sourcePath,
-    VideoQuality quality = videoQualityMedium,
-    bool deleteOrigin = false,
-    Function(double progress)? onProgress,
-  }) async {
-    try {
-      debugPrint('[Compression] Compressing video: $sourcePath');
-      
-      final sourceFile = File(sourcePath);
-      if (!await sourceFile.exists()) {
-        debugPrint('[Compression] Source file does not exist');
-        return null;
-      }
-
-      final originalSize = await sourceFile.length();
-
-      // Subscribe to compression progress
-      VideoCompress.compressProgress$.subscribe((progress) {
-        onProgress?.call(progress);
-      });
-
-      // Compress video
-      final info = await VideoCompress.compressVideo(
-        sourcePath,
-        quality: quality,
-        deleteOrigin: deleteOrigin,
-        includeAudio: true,
-      );
-
-      if (info == null || info.file == null) {
-        debugPrint('[Compression] Video compression failed');
-        return null;
-      }
-
-      final compressedSize = await info.file!.length();
-      final compressionRatio = ((originalSize - compressedSize) / originalSize * 100);
-
-      debugPrint('[Compression] Video compressed: ${_formatBytes(originalSize)} → ${_formatBytes(compressedSize)} (${compressionRatio.toStringAsFixed(1)}% reduction)');
-
-      return CompressionResult(
-        compressedPath: info.file!.path,
-        originalSize: originalSize,
-        compressedSize: compressedSize,
-        compressionRatio: compressionRatio,
-        duration: info.duration,
-      );
-    } catch (e) {
-      debugPrint('[Compression] Error compressing video: $e');
-      return null;
-    }
-  }
-
-  /// Get video thumbnail
-  Future<File?> getVideoThumbnail({
-    required String videoPath,
-    int quality = 50,
-  }) async {
-    try {
-      final thumbnail = await VideoCompress.getFileThumbnail(
-        videoPath,
-        quality: quality,
-      );
-      return thumbnail;
-    } catch (e) {
-      debugPrint('[Compression] Error getting video thumbnail: $e');
-      return null;
-    }
-  }
-
-  /// Cancel ongoing video compression
-  Future<void> cancelVideoCompression() async {
-    try {
-      await VideoCompress.cancelCompression();
-    } catch (e) {
-      debugPrint('[Compression] Error canceling compression: $e');
-    }
-  }
-
-  /// Delete all cached compressed files
-  Future<void> clearCache() async {
-    try {
-      await VideoCompress.deleteAllCache();
-      debugPrint('[Compression] Cache cleared');
-    } catch (e) {
-      debugPrint('[Compression] Error clearing cache: $e');
-    }
-  }
-
-  /// Format bytes to human-readable string
-  String _formatBytes(int bytes) {
-    if (bytes < 1024) return '$bytes B';
-    if (bytes < 1024 * 1024) return '${(bytes / 1024).toStringAsFixed(1)} KB';
-    if (bytes < 1024 * 1024 * 1024) return '${(bytes / (1024 * 1024)).toStringAsFixed(1)} MB';
-    return '${(bytes / (1024 * 1024 * 1024)).toStringAsFixed(1)} GB';
-  }
-}
-
-/// Result of a compression operation
-class CompressionResult {
-  final String compressedPath;
-  final int originalSize;
-  final int compressedSize;
-  final double compressionRatio;
-  final double? duration;
-
-  CompressionResult({
-    required this.compressedPath,
-    required this.originalSize,
-    required this.compressedSize,
-    required this.compressionRatio,
-    this.duration,
-  });
-
-  String get formattedOriginalSize => _formatBytes(originalSize);
-  String get formattedCompressedSize => _formatBytes(compressedSize);
-  String get formattedRatio => '${compressionRatio.toStringAsFixed(1)}%';
-
-  static String _formatBytes(int bytes) {
-    if (bytes < 1024) return '$bytes B';
-    if (bytes < 1024 * 1024) return '${(bytes / 1024).toStringAsFixed(1)} KB';
-    if (bytes < 1024 * 1024 * 1024) return '${(bytes / (1024 * 1024)).toStringAsFixed(1)} MB';
-    return '${(bytes / (1024 * 1024 * 1024)).toStringAsFixed(1)} GB';
-  }
-}

From 3fbee5b80985441f55523acc057c69eb300b1ee5 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 21:37:32 +0800
Subject: [PATCH 44/64] Replace hardcoded SDK version with device_info_plus

---
 lib/services/permission_service.dart | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/lib/services/permission_service.dart b/lib/services/permission_service.dart
index f018376..cfc0d93 100644
--- a/lib/services/permission_service.dart
+++ b/lib/services/permission_service.dart
@@ -1,4 +1,5 @@
 import 'dart:io';
+import 'package:device_info_plus/device_info_plus.dart';
 import 'package:flutter/foundation.dart';
 import 'package:permission_handler/permission_handler.dart';
 import 'auto_kill_service.dart';
@@ -315,13 +316,11 @@ class PermissionService {
     if (!Platform.isAndroid) return 0;
 
     try {
-      // Use ProcessInfo or default to a safe version
-      // In a real app, you'd use device_info_plus
-      // For now, we'll default to 33 (Android 13) which is common
-      return 33;
+      final deviceInfo = await DeviceInfoPlugin().androidInfo;
+      return deviceInfo.version.sdkInt;
     } catch (e) {
       debugPrint('Error getting Android SDK version: $e');
-      return 33; // Default to Android 13
+      return 0;
     }
   }
 }

From eabd51dae9afebef5cfbfc5a965dbc9309e4fd87 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 21:37:44 +0800
Subject: [PATCH 45/64] Update default encryption algorithm to AES-256-GCM and
 KDF iterations to 600000

---
 lib/services/vault_service.dart | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/lib/services/vault_service.dart b/lib/services/vault_service.dart
index db281a9..8bd3164 100644
--- a/lib/services/vault_service.dart
+++ b/lib/services/vault_service.dart
@@ -2583,8 +2583,8 @@ class VaultSettings {
 
   const VaultSettings({
     this.encryptionEnabled = false,
-    this.encryptionAlgorithm = EncryptionAlgorithm.aes256Ctr,
-    this.kdfIterations = 100000,
+    this.encryptionAlgorithm = EncryptionAlgorithm.aes256Gcm,
+    this.kdfIterations = 600000,
     this.secureDelete = true,
     this.screenshotProtectionEnabled = false,
     this.autoKillDelaySeconds = 0,
@@ -2680,10 +2680,10 @@ class VaultSettings {
     return VaultSettings(
       encryptionEnabled: json['encryptionEnabled'] as bool? ?? false,
       encryptionAlgorithm: EncryptionAlgorithm.values.firstWhere(
-        (a) => a.name == (json['encryptionAlgorithm'] as String? ?? 'aes256Ctr'),
-        orElse: () => EncryptionAlgorithm.aes256Ctr,
+        (a) => a.name == (json['encryptionAlgorithm'] as String? ?? 'aes256Gcm'),
+        orElse: () => EncryptionAlgorithm.aes256Gcm,
       ),
-      kdfIterations: json['kdfIterations'] as int? ?? 100000,
+      kdfIterations: json['kdfIterations'] as int? ?? 600000,
       secureDelete: json['secureDelete'] as bool? ?? true,
       screenshotProtectionEnabled:
           json['screenshotProtectionEnabled'] as bool? ?? false,

From 91829d88ff592ac2c3c912e172ee24e4af7509e0 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 21:38:01 +0800
Subject: [PATCH 46/64] Remove unused compression helper utility

---
 lib/utils/compression_helper.dart | 188 ------------------------------
 1 file changed, 188 deletions(-)
 delete mode 100644 lib/utils/compression_helper.dart

diff --git a/lib/utils/compression_helper.dart b/lib/utils/compression_helper.dart
deleted file mode 100644
index 6eef6cc..0000000
--- a/lib/utils/compression_helper.dart
+++ /dev/null
@@ -1,188 +0,0 @@
-import 'dart:io';
-import 'package:flutter/material.dart';
-import 'package:video_compress/video_compress.dart';
-import '../services/media_compression_service.dart';
-import '../widgets/compression_options_dialog.dart';
-
-/// Helper class for handling media compression in import flows
-class CompressionHelper {
-  /// Show compression options dialog and return selected option
-  static Future<CompressionOption?> showCompressionDialog(
-    BuildContext context, {
-    required bool isVideo,
-  }) async {
-    return await showDialog<CompressionOption>(
-      context: context,
-      builder: (context) => CompressionOptionsDialog(isVideo: isVideo),
-    );
-  }
-
-  /// Compress image file based on selected option
-  static Future<String?> compressImageIfNeeded({
-    required String sourcePath,
-    required CompressionOption option,
-    Function(String message)? onStatusUpdate,
-  }) async {
-    if (option == CompressionOption.none) {
-      return sourcePath;
-    }
-
-    onStatusUpdate?.call('Compressing image...');
-
-    final result = await MediaCompressionService.instance.compressImage(
-      sourcePath: sourcePath,
-      quality: option.imageQuality,
-    );
-
-    if (result != null) {
-      onStatusUpdate?.call(
-        'Compressed: ${result.formattedOriginalSize} → ${result.formattedCompressedSize} (${result.formattedRatio} saved)',
-      );
-      return result.compressedPath;
-    }
-
-    return sourcePath;
-  }
-
-  /// Compress video file based on selected option
-  static Future<String?> compressVideoIfNeeded({
-    required String sourcePath,
-    required CompressionOption option,
-    Function(String message)? onStatusUpdate,
-    Function(double progress)? onProgress,
-  }) async {
-    if (option == CompressionOption.none) {
-      return sourcePath;
-    }
-
-    onStatusUpdate?.call('Compressing video...');
-
-    VideoQuality quality;
-    switch (option) {
-      case CompressionOption.low:
-        quality = VideoQuality.HighestQuality;
-        break;
-      case CompressionOption.medium:
-        quality = VideoQuality.DefaultQuality;
-        break;
-      case CompressionOption.high:
-        quality = VideoQuality.LowQuality;
-        break;
-      default:
-        quality = VideoQuality.DefaultQuality;
-    }
-
-    final result = await MediaCompressionService.instance.compressVideo(
-      sourcePath: sourcePath,
-      quality: quality,
-      onProgress: onProgress,
-    );
-
-    if (result != null) {
-      onStatusUpdate?.call(
-        'Compressed: ${result.formattedOriginalSize} → ${result.formattedCompressedSize} (${result.formattedRatio} saved)',
-      );
-      return result.compressedPath;
-    }
-
-    return sourcePath;
-  }
-
-  /// Compress multiple images
-  static Future<List<String>> compressImagesIfNeeded({
-    required List<String> sourcePaths,
-    required CompressionOption option,
-    Function(int current, int total)? onProgress,
-    Function(String message)? onStatusUpdate,
-  }) async {
-    if (option == CompressionOption.none) {
-      return sourcePaths;
-    }
-
-    final compressedPaths = <String>[];
-    
-    for (int i = 0; i < sourcePaths.length; i++) {
-      onStatusUpdate?.call('Compressing image ${i + 1}/${sourcePaths.length}...');
-      onProgress?.call(i + 1, sourcePaths.length);
-
-      final compressed = await compressImageIfNeeded(
-        sourcePath: sourcePaths[i],
-        option: option,
-      );
-
-      compressedPaths.add(compressed ?? sourcePaths[i]);
-    }
-
-    return compressedPaths;
-  }
-
-  /// Compress multiple videos
-  static Future<List<String>> compressVideosIfNeeded({
-    required List<String> sourcePaths,
-    required CompressionOption option,
-    Function(int current, int total)? onProgress,
-    Function(String message)? onStatusUpdate,
-  }) async {
-    if (option == CompressionOption.none) {
-      return sourcePaths;
-    }
-
-    final compressedPaths = <String>[];
-    
-    for (int i = 0; i < sourcePaths.length; i++) {
-      onStatusUpdate?.call('Compressing video ${i + 1}/${sourcePaths.length}...');
-
-      final compressed = await compressVideoIfNeeded(
-        sourcePath: sourcePaths[i],
-        option: option,
-        onProgress: (progress) {
-          onProgress?.call(i, sourcePaths.length);
-        },
-      );
-
-      compressedPaths.add(compressed ?? sourcePaths[i]);
-    }
-
-    return compressedPaths;
-  }
-
-  /// Show compression progress dialog
-  static Future<T?> showCompressionProgress<T>({
-    required BuildContext context,
-    required Future<T> Function() operation,
-    String title = 'Compressing...',
-  }) async {
-    return await showDialog<T>(
-      context: context,
-      barrierDismissible: false,
-      builder: (context) => WillPopScope(
-        onWillPop: () async => false,
-        child: AlertDialog(
-          title: Text(title),
-          content: Column(
-            mainAxisSize: MainAxisSize.min,
-            children: [
-              CircularProgressIndicator(),
-              SizedBox(height: 16),
-              Text('Please wait...'),
-            ],
-          ),
-        ),
-      ),
-    );
-  }
-
-  /// Clean up temporary compressed files
-  static Future<void> cleanupTempFiles(List<String> paths) async {
-    for (final path in paths) {
-      try {
-        final file = File(path);
-        if (await file.exists() && path.contains('compressed_')) {
-          await file.delete();
-        }
-      } catch (e) {
-        debugPrint('[CompressionHelper] Error deleting temp file: $e');
-      }
-    }
-  }
-}

From 65c8a45f496b05e27941b8affea75e5750374005 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 21:49:11 +0800
Subject: [PATCH 47/64] Increase PBKDF2 iterations to 600000

---
 lib/utils/pbkdf2_isolate.dart | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/utils/pbkdf2_isolate.dart b/lib/utils/pbkdf2_isolate.dart
index a36fbf2..d1ef233 100644
--- a/lib/utils/pbkdf2_isolate.dart
+++ b/lib/utils/pbkdf2_isolate.dart
@@ -21,7 +21,7 @@ String _computePbkdf2(_Pbkdf2Args args) {
 Future<String> computePbkdf2Hash(
   String credential,
   Uint8List salt, {
-  int iterations = 100000,
+  int iterations = 600000,
   int keyLength = 32,
 }) {
   return compute(

From 47cc7976be632c052530434827a6f06aedee45ac Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 21:49:17 +0800
Subject: [PATCH 48/64] Store update subscription to cancel on dispose

---
 lib/main.dart | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/lib/main.dart b/lib/main.dart
index cd045d5..3d8a48d 100644
--- a/lib/main.dart
+++ b/lib/main.dart
@@ -1,3 +1,5 @@
+import 'dart:async';
+
 import 'package:flutter/material.dart';
 import 'package:flutter/services.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
@@ -73,6 +75,7 @@ class _AppInitializerState extends ConsumerState<AppInitializer> {
   final AuthService _authService = AuthService();
   bool _isLoading = true;
   bool _isFirstTime = true;
+  StreamSubscription<AppUpdateInfo?>? _updateSub;
 
   @override
   void initState() {
@@ -80,7 +83,7 @@ class _AppInitializerState extends ConsumerState<AppInitializer> {
     _checkAuthStatus();
 
     final updateService = ref.read(updateServiceProvider);
-    updateService.onUpdateCheck.listen((info) {
+    _updateSub = updateService.onUpdateCheck.listen((info) {
       if (info != null &&
           info.updateAvailability == UpdateAvailability.updateAvailable) {
         _showUpdateDialog();
@@ -88,6 +91,12 @@ class _AppInitializerState extends ConsumerState<AppInitializer> {
     });
   }
 
+  @override
+  void dispose() {
+    _updateSub?.cancel();
+    super.dispose();
+  }
+
   void _showUpdateDialog() {
     final context = navigatorKey.currentContext;
     if (context == null) return;

From 6534329e93a29ec9fe873d6a9c7ee5de1e06e1ad Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 21:49:21 +0800
Subject: [PATCH 49/64] Remove default Flutter widget test

---
 test/widget_test.dart | 28 ----------------------------
 1 file changed, 28 deletions(-)
 delete mode 100644 test/widget_test.dart

diff --git a/test/widget_test.dart b/test/widget_test.dart
deleted file mode 100644
index 9322cd7..0000000
--- a/test/widget_test.dart
+++ /dev/null
@@ -1,28 +0,0 @@
-// This is a basic Flutter widget test.
-//
-// To perform an interaction with a widget in your test, use the WidgetTester
-// utility in the flutter_test package. For example, you can send tap and scroll
-// gestures. You can also use WidgetTester to find child widgets in the widget
-// tree, read text, and verify that the values of widget properties are correct.
-
-import 'package:flutter/material.dart';
-import 'package:flutter_test/flutter_test.dart';
-
-void main() {
-  testWidgets('Counter increments smoke test', (WidgetTester tester) async {
-    // Build our app and trigger a frame.
-    // await tester.pumpWidget(const MyApp());
-
-    // Verify that our counter starts at 0.
-    expect(find.text('0'), findsOneWidget);
-    expect(find.text('1'), findsNothing);
-
-    // Tap the '+' icon and trigger a frame.
-    await tester.tap(find.byIcon(Icons.add));
-    await tester.pump();
-
-    // Verify that our counter has incremented.
-    expect(find.text('0'), findsNothing);
-    expect(find.text('1'), findsOneWidget);
-  });
-}

From 817f20aa073cd1b4c7920652ee59a59160ca1063 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 21:49:27 +0800
Subject: [PATCH 50/64] Replace `cupertino_icons` and `encrypt` with
 `device_info_plus`

- Remove example files from analysis
- Enable `avoid_print` lint rule
---
 analysis_options.yaml | 20 +++++---------------
 pubspec.lock          | 40 ++++++++++++++++++++--------------------
 pubspec.yaml          |  3 +--
 3 files changed, 26 insertions(+), 37 deletions(-)

diff --git a/analysis_options.yaml b/analysis_options.yaml
index 0d29021..0ba2ecd 100644
--- a/analysis_options.yaml
+++ b/analysis_options.yaml
@@ -9,20 +9,10 @@
 # packages, and plugins designed to encourage good coding practices.
 include: package:flutter_lints/flutter.yaml
 
+analyzer:
+  exclude:
+    - "lib/examples/**"
+
 linter:
-  # The lint rules applied to this project can be customized in the
-  # section below to disable rules from the `package:flutter_lints/flutter.yaml`
-  # included above or to enable additional rules. A list of all available lints
-  # and their documentation is published at https://dart.dev/lints.
-  #
-  # Instead of disabling a lint rule for the entire project in the
-  # section below, it can also be suppressed for a single line of code
-  # or a specific dart file by using the `// ignore: name_of_lint` and
-  # `// ignore_for_file: name_of_lint` syntax on the line or in the file
-  # producing the lint.
   rules:
-    # avoid_print: false  # Uncomment to disable the `avoid_print` rule
-    # prefer_single_quotes: true  # Uncomment to enable the `prefer_single_quotes` rule
-
-# Additional information about this file can be found at
-# https://dart.dev/guides/language/analysis-options
+    avoid_print: true
diff --git a/pubspec.lock b/pubspec.lock
index 5b17c0b..a0cbf21 100644
--- a/pubspec.lock
+++ b/pubspec.lock
@@ -33,14 +33,6 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "2.7.0"
-  asn1lib:
-    dependency: transitive
-    description:
-      name: asn1lib
-      sha256: "9a8f69025044eb466b9b60ef3bc3ac99b4dc6c158ae9c56d25eeccf5bc56d024"
-      url: "https://pub.dev"
-    source: hosted
-    version: "1.6.5"
   async:
     dependency: transitive
     description:
@@ -217,14 +209,6 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "1.0.2"
-  cupertino_icons:
-    dependency: "direct main"
-    description:
-      name: cupertino_icons
-      sha256: "41e005c33bd814be4d3096aff55b1908d419fde52ca656c8c47719ec745873cd"
-      url: "https://pub.dev"
-    source: hosted
-    version: "1.0.9"
   dbus:
     dependency: transitive
     description:
@@ -233,14 +217,22 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "0.7.12"
-  encrypt:
+  device_info_plus:
     dependency: "direct main"
     description:
-      name: encrypt
-      sha256: "62d9aa4670cc2a8798bab89b39fc71b6dfbacf615de6cf5001fb39f7e4a996a2"
+      name: device_info_plus
+      sha256: "98f28b42168cc509abc92f88518882fd58061ea372d7999aecc424345c7bff6a"
       url: "https://pub.dev"
     source: hosted
-    version: "5.0.3"
+    version: "11.5.0"
+  device_info_plus_platform_interface:
+    dependency: transitive
+    description:
+      name: device_info_plus_platform_interface
+      sha256: e1ea89119e34903dca74b883d0dd78eb762814f97fb6c76f35e9ff74d261a18f
+      url: "https://pub.dev"
+    source: hosted
+    version: "7.0.3"
   fake_async:
     dependency: transitive
     description:
@@ -1525,6 +1517,14 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "5.15.0"
+  win32_registry:
+    dependency: transitive
+    description:
+      name: win32_registry
+      sha256: "6f1b564492d0147b330dd794fee8f512cec4977957f310f9951b5f9d83618dae"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.1.0"
   xdg_directories:
     dependency: transitive
     description:
diff --git a/pubspec.yaml b/pubspec.yaml
index 32c0fe0..3f7c4fa 100644
--- a/pubspec.yaml
+++ b/pubspec.yaml
@@ -29,8 +29,7 @@ dependencies:
   archive: ^4.0.7
   camera: ^0.12.0
   crypto: ^3.0.7
-  cupertino_icons: ^1.0.6
-  encrypt: ^5.0.3
+  device_info_plus: ^11.3.0
   file_picker: ^11.0.1
   flutter:
     sdk: flutter

From 509e8d9061af241149aa45f9b20ce065352d2928 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 21:50:06 +0800
Subject: [PATCH 51/64] Add CI workflow for versionF branch

---
 .github/workflows/ci.yml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)
 create mode 100644 .github/workflows/ci.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..4891bf0
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,18 @@
+name: CI
+on:
+  push:
+    branches: [versionF]
+  pull_request:
+    branches: [versionF]
+
+jobs:
+  analyze-and-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: subosito/flutter-action@v2
+        with:
+          channel: stable
+      - run: flutter pub get
+      - run: flutter analyze
+      - run: flutter test

From a2e2c0314f8d65d4dbd9ac131a2a7c79611907fd Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 21:50:15 +0800
Subject: [PATCH 52/64] Add Android data extraction and network security config
 files

Both configurations disable cloud backup and device transfer, and
enforce
HTTPS-only network traffic on Android.
---
 .../src/main/res/xml/data_extraction_rules.xml    | 15 +++++++++++++++
 .../src/main/res/xml/network_security_config.xml  |  8 ++++++++
 2 files changed, 23 insertions(+)
 create mode 100644 android/app/src/main/res/xml/data_extraction_rules.xml
 create mode 100644 android/app/src/main/res/xml/network_security_config.xml

diff --git a/android/app/src/main/res/xml/data_extraction_rules.xml b/android/app/src/main/res/xml/data_extraction_rules.xml
new file mode 100644
index 0000000..81adda5
--- /dev/null
+++ b/android/app/src/main/res/xml/data_extraction_rules.xml
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="utf-8"?>
+<data-extraction-rules>
+    <cloud-backup>
+        <exclude domain="sharedpref" />
+        <exclude domain="file" />
+        <exclude domain="database" />
+        <exclude domain="root" />
+    </cloud-backup>
+    <device-transfer>
+        <exclude domain="sharedpref" />
+        <exclude domain="file" />
+        <exclude domain="database" />
+        <exclude domain="root" />
+    </device-transfer>
+</data-extraction-rules>
diff --git a/android/app/src/main/res/xml/network_security_config.xml b/android/app/src/main/res/xml/network_security_config.xml
new file mode 100644
index 0000000..683208f
--- /dev/null
+++ b/android/app/src/main/res/xml/network_security_config.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <base-config cleartextTrafficPermitted="false">
+        <trust-anchors>
+            <certificates src="system" />
+        </trust-anchors>
+    </base-config>
+</network-security-config>

From 03ef152b3a847913ce46c9bfd5a49cbaeca16bf7 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 21:50:24 +0800
Subject: [PATCH 53/64] Add ProGuard rules for Flutter, crypto, and autofill
 service

---
 android/app/proguard-rules.pro | 12 ++++++++++++
 1 file changed, 12 insertions(+)
 create mode 100644 android/app/proguard-rules.pro

diff --git a/android/app/proguard-rules.pro b/android/app/proguard-rules.pro
new file mode 100644
index 0000000..a1c74b5
--- /dev/null
+++ b/android/app/proguard-rules.pro
@@ -0,0 +1,12 @@
+# Flutter
+-keep class io.flutter.** { *; }
+-keep class io.flutter.plugins.** { *; }
+-dontwarn io.flutter.embedding.**
+
+# pointycastle (crypto)
+-keep class org.bouncycastle.** { *; }
+-dontwarn org.bouncycastle.**
+
+# Autofill service
+-keep class com.mossapps.locker.AutofillService { *; }
+-keep class com.mossapps.locker.AutofillSelectionActivity { *; }

From 095948267e75ce7fcff7fb4e26935cac93f08651 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 21:50:34 +0800
Subject: [PATCH 54/64] Add isolated Argon2id hash computation using compute()

---
 lib/utils/argon2_isolate.dart | 56 +++++++++++++++++++++++++++++++++++
 1 file changed, 56 insertions(+)
 create mode 100644 lib/utils/argon2_isolate.dart

diff --git a/lib/utils/argon2_isolate.dart b/lib/utils/argon2_isolate.dart
new file mode 100644
index 0000000..de7e1d4
--- /dev/null
+++ b/lib/utils/argon2_isolate.dart
@@ -0,0 +1,56 @@
+import 'dart:convert';
+
+import 'package:flutter/foundation.dart';
+import 'package:pointycastle/export.dart';
+
+class _Argon2Args {
+  final String credential;
+  final Uint8List salt;
+  final int iterations;
+  final int memoryPowerOf2;
+  final int lanes;
+  final int keyLength;
+  const _Argon2Args(
+    this.credential,
+    this.salt,
+    this.iterations,
+    this.memoryPowerOf2,
+    this.lanes,
+    this.keyLength,
+  );
+}
+
+Uint8List _computeArgon2id(_Argon2Args args) {
+  final params = Argon2Parameters(
+    Argon2Parameters.ARGON2_id,
+    args.salt,
+    desiredKeyLength: args.keyLength,
+    iterations: args.iterations,
+    memoryPowerOf2: args.memoryPowerOf2,
+    lanes: args.lanes,
+    version: Argon2Parameters.ARGON2_VERSION_13,
+  );
+  final generator = Argon2BytesGenerator()..init(params);
+  return generator.process(Uint8List.fromList(utf8.encode(args.credential)));
+}
+
+Future<Uint8List> computeArgon2idHash(
+  String credential,
+  Uint8List salt, {
+  int iterations = 3,
+  int memoryPowerOf2 = 14,
+  int lanes = 1,
+  int keyLength = 32,
+}) {
+  return compute(
+    _computeArgon2id,
+    _Argon2Args(
+      credential,
+      salt,
+      iterations,
+      memoryPowerOf2,
+      lanes,
+      keyLength,
+    ),
+  );
+}

From 528c43c47718838165b4a507f5f25e40fc10f64d Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 21:51:03 +0800
Subject: [PATCH 55/64] Add unit tests for AES-256-GCM and CTR encryption
 round-trips

---
 test/encryption_service_test.dart | 85 +++++++++++++++++++++++++++++++
 1 file changed, 85 insertions(+)
 create mode 100644 test/encryption_service_test.dart

diff --git a/test/encryption_service_test.dart b/test/encryption_service_test.dart
new file mode 100644
index 0000000..f7b2a58
--- /dev/null
+++ b/test/encryption_service_test.dart
@@ -0,0 +1,85 @@
+import 'dart:convert';
+import 'dart:io';
+import 'dart:typed_data';
+
+import 'package:flutter_test/flutter_test.dart';
+import 'package:locker/services/encryption_service.dart';
+import 'package:pointycastle/export.dart';
+
+void main() {
+  final key = Uint8List.fromList(List.generate(32, (i) => i));
+  final iv = Uint8List.fromList(List.generate(16, (i) => i + 100));
+  final plaintext = Uint8List.fromList(
+      utf8.encode('Latch vault test plaintext — round trip!'));
+
+  group('AES-256-GCM round-trip', () {
+    test('encrypt then decryptDataGcm returns original', () async {
+      final gcm = GCMBlockCipher(AESEngine())
+        ..init(true, AEADParameters(KeyParameter(key), 128, iv, Uint8List(0)));
+      final encrypted = gcm.process(plaintext);
+
+      final result = await EncryptionService.instance.decryptDataGcm(
+        encrypted,
+        base64Encode(iv),
+        customKey: key,
+      );
+
+      expect(result.success, true);
+      expect(result.data, plaintext);
+    });
+
+    test('tampered ciphertext fails GCM authentication', () async {
+      final gcm = GCMBlockCipher(AESEngine())
+        ..init(true, AEADParameters(KeyParameter(key), 128, iv, Uint8List(0)));
+      final encrypted = gcm.process(plaintext);
+
+      encrypted[0] ^= 0xFF;
+
+      final result = await EncryptionService.instance.decryptDataGcm(
+        encrypted,
+        base64Encode(iv),
+        customKey: key,
+      );
+
+      expect(result.success, false);
+    });
+
+    test('file-based GCM round-trip (encryptBytesStreamedGcm → decryptStreamedFileToMemoryGcm)',
+        () async {
+      final tmpDir = await Directory.systemTemp.createTemp('latch_gcm_test');
+      final encPath = '${tmpDir.path}/test.enc';
+
+      final encResult = await EncryptionService.instance
+          .encryptBytesStreamedGcm(plaintext, encPath, derivedKey: key);
+
+      expect(encResult.success, true);
+      expect(encResult.iv, isNotNull);
+
+      final decResult = await EncryptionService.instance
+          .decryptStreamedFileToMemoryGcm(
+        encPath,
+        encResult.iv!,
+        derivedKey: key,
+      );
+
+      expect(decResult.success, true);
+      expect(decResult.data, plaintext);
+
+      await tmpDir.delete(recursive: true);
+    });
+  });
+
+  group('AES-256-CTR round-trip', () {
+    test('encrypt then decrypt returns original', () {
+      final ctr = CTRStreamCipher(AESEngine())
+        ..init(true, ParametersWithIV(KeyParameter(key), iv));
+      final encrypted = ctr.process(plaintext);
+
+      final decCtr = CTRStreamCipher(AESEngine())
+        ..init(false, ParametersWithIV(KeyParameter(key), iv));
+      final decrypted = decCtr.process(encrypted);
+
+      expect(decrypted, plaintext);
+    });
+  });
+}

From 29dd18bd1c6fb5b2f9c350f64523f20345c69ff9 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 21:51:08 +0800
Subject: [PATCH 56/64] Add tests for Argon2id KWK derivation and AES-256-GCM
 key wrapping

---
 test/h1_key_wrapping_test.dart | 163 +++++++++++++++++++++++++++++++++
 1 file changed, 163 insertions(+)
 create mode 100644 test/h1_key_wrapping_test.dart

diff --git a/test/h1_key_wrapping_test.dart b/test/h1_key_wrapping_test.dart
new file mode 100644
index 0000000..d9b3135
--- /dev/null
+++ b/test/h1_key_wrapping_test.dart
@@ -0,0 +1,163 @@
+import 'dart:convert';
+import 'dart:typed_data';
+
+import 'package:flutter_test/flutter_test.dart';
+import 'package:pointycastle/export.dart';
+
+import 'package:locker/utils/argon2_isolate.dart';
+
+void main() {
+  group('Argon2id KWK derivation', () {
+    test('is deterministic — same credential + salt → same KWK', () async {
+      final salt = Uint8List.fromList(List.generate(32, (i) => i));
+      final kwk1 = await computeArgon2idHash(
+        'testPassword123',
+        salt,
+        iterations: 1,
+        memoryPowerOf2: 10,
+      );
+      final kwk2 = await computeArgon2idHash(
+        'testPassword123',
+        salt,
+        iterations: 1,
+        memoryPowerOf2: 10,
+      );
+      expect(base64Encode(kwk1), equals(base64Encode(kwk2)));
+    });
+
+    test('different credentials produce different KWKs', () async {
+      final salt = Uint8List.fromList(List.generate(32, (i) => i));
+      final kwk1 = await computeArgon2idHash(
+        'password1',
+        salt,
+        iterations: 1,
+        memoryPowerOf2: 10,
+      );
+      final kwk2 = await computeArgon2idHash(
+        'password2',
+        salt,
+        iterations: 1,
+        memoryPowerOf2: 10,
+      );
+      expect(base64Encode(kwk1), isNot(equals(base64Encode(kwk2))));
+    });
+
+    test('different salts produce different KWKs', () async {
+      final salt1 = Uint8List.fromList(List.generate(32, (i) => i));
+      final salt2 = Uint8List.fromList(List.generate(32, (i) => i + 100));
+      final kwk1 = await computeArgon2idHash(
+        'samePassword',
+        salt1,
+        iterations: 1,
+        memoryPowerOf2: 10,
+      );
+      final kwk2 = await computeArgon2idHash(
+        'samePassword',
+        salt2,
+        iterations: 1,
+        memoryPowerOf2: 10,
+      );
+      expect(base64Encode(kwk1), isNot(equals(base64Encode(kwk2))));
+    });
+
+    test('produces 32-byte key', () async {
+      final salt = Uint8List.fromList(List.generate(32, (i) => i));
+      final kwk = await computeArgon2idHash(
+        'test',
+        salt,
+        iterations: 1,
+        memoryPowerOf2: 10,
+      );
+      expect(kwk.length, equals(32));
+    });
+  });
+
+  group('Key wrap/unwrap (AES-256-GCM)', () {
+    Uint8List wrapKey(Uint8List masterKey, Uint8List kwk, Uint8List iv) {
+      final cipher = GCMBlockCipher(AESEngine());
+      cipher.init(
+        true,
+        AEADParameters(KeyParameter(kwk), 128, iv, Uint8List(0)),
+      );
+      return cipher.process(masterKey);
+    }
+
+    Uint8List unwrapKey(Uint8List wrappedKey, Uint8List kwk, Uint8List iv) {
+      final cipher = GCMBlockCipher(AESEngine());
+      cipher.init(
+        false,
+        AEADParameters(KeyParameter(kwk), 128, iv, Uint8List(0)),
+      );
+      return cipher.process(wrappedKey);
+    }
+
+    test('wrap then unwrap returns original master key', () async {
+      final masterKey = Uint8List.fromList(
+        List.generate(32, (i) => i * 7 + 3),
+      );
+      final salt = Uint8List.fromList(List.generate(32, (i) => i));
+      final kwk = await computeArgon2idHash(
+        'mySecretPassword',
+        salt,
+        iterations: 1,
+        memoryPowerOf2: 10,
+      );
+      final iv = Uint8List.fromList(List.generate(16, (i) => i + 50));
+
+      final wrappedKey = wrapKey(masterKey, kwk, iv);
+      final unwrappedKey = unwrapKey(wrappedKey, kwk, iv);
+
+      expect(base64Encode(unwrappedKey), equals(base64Encode(masterKey)));
+    });
+
+    test('unwrap with wrong KWK fails (GCM authentication)', () async {
+      final masterKey = Uint8List.fromList(
+        List.generate(32, (i) => i * 7 + 3),
+      );
+      final salt = Uint8List.fromList(List.generate(32, (i) => i));
+      final kwkCorrect = await computeArgon2idHash(
+        'correctPassword',
+        salt,
+        iterations: 1,
+        memoryPowerOf2: 10,
+      );
+      final kwkWrong = await computeArgon2idHash(
+        'wrongPassword',
+        salt,
+        iterations: 1,
+        memoryPowerOf2: 10,
+      );
+      final iv = Uint8List.fromList(List.generate(16, (i) => i + 50));
+
+      final wrappedKey = wrapKey(masterKey, kwkCorrect, iv);
+
+      expect(
+        () => unwrapKey(wrappedKey, kwkWrong, iv),
+        throwsA(isA<Object>()),
+      );
+    });
+
+    test('unwrap with tampered wrapped key fails', () async {
+      final masterKey = Uint8List.fromList(
+        List.generate(32, (i) => i * 7 + 3),
+      );
+      final salt = Uint8List.fromList(List.generate(32, (i) => i));
+      final kwk = await computeArgon2idHash(
+        'password',
+        salt,
+        iterations: 1,
+        memoryPowerOf2: 10,
+      );
+      final iv = Uint8List.fromList(List.generate(16, (i) => i + 50));
+
+      final wrappedKey = wrapKey(masterKey, kwk, iv);
+      final tamperedKey = Uint8List.fromList(wrappedKey);
+      tamperedKey[0] ^= 0xFF;
+
+      expect(
+        () => unwrapKey(tamperedKey, kwk, iv),
+        throwsA(isA<Object>()),
+      );
+    });
+  });
+}

From d71085fd890e02d9cf996d470993256214aae160 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 21:51:14 +0800
Subject: [PATCH 57/64] Add PBKDF2 isolate test suite

---
 test/pbkdf2_isolate_test.dart | 82 +++++++++++++++++++++++++++++++++++
 1 file changed, 82 insertions(+)
 create mode 100644 test/pbkdf2_isolate_test.dart

diff --git a/test/pbkdf2_isolate_test.dart b/test/pbkdf2_isolate_test.dart
new file mode 100644
index 0000000..284bdf0
--- /dev/null
+++ b/test/pbkdf2_isolate_test.dart
@@ -0,0 +1,82 @@
+import 'dart:convert';
+import 'dart:typed_data';
+
+import 'package:flutter_test/flutter_test.dart';
+import 'package:locker/utils/pbkdf2_isolate.dart';
+import 'package:pointycastle/export.dart';
+
+void main() {
+  group('PBKDF2-HMAC-SHA256', () {
+    test('computePbkdf2Hash is deterministic', () async {
+      final salt = Uint8List.fromList(List.generate(16, (i) => i));
+
+      final hash1 = await computePbkdf2Hash(
+        'password123',
+        salt,
+        iterations: 10000,
+      );
+      final hash2 = await computePbkdf2Hash(
+        'password123',
+        salt,
+        iterations: 10000,
+      );
+
+      expect(hash1, hash2);
+    });
+
+    test('different passwords produce different hashes', () async {
+      final salt = Uint8List.fromList(List.generate(16, (i) => i));
+
+      final hash1 = await computePbkdf2Hash(
+        'password123',
+        salt,
+        iterations: 10000,
+      );
+      final hash2 = await computePbkdf2Hash(
+        'password456',
+        salt,
+        iterations: 10000,
+      );
+
+      expect(hash1, isNot(hash2));
+    });
+
+    test('different salts produce different hashes', () async {
+      final salt1 = Uint8List.fromList(List.generate(16, (i) => i));
+      final salt2 = Uint8List.fromList(List.generate(16, (i) => i + 1));
+
+      final hash1 = await computePbkdf2Hash(
+        'password123',
+        salt1,
+        iterations: 10000,
+      );
+      final hash2 = await computePbkdf2Hash(
+        'password123',
+        salt2,
+        iterations: 10000,
+      );
+
+      expect(hash1, isNot(hash2));
+    });
+
+    test('matches direct pointycastle computation', () async {
+      final salt = Uint8List.fromList(utf8.encode('saltsaltsaltsalt'));
+      const password = 'testPassword';
+      const iterations = 10000;
+
+      final isolateHash = await computePbkdf2Hash(
+        password,
+        salt,
+        iterations: iterations,
+      );
+
+      final pbkdf2 = PBKDF2KeyDerivator(HMac(SHA256Digest(), 64))
+        ..init(Pbkdf2Parameters(salt, iterations, 32));
+      final directHash = base64Encode(
+        pbkdf2.process(Uint8List.fromList(utf8.encode(password))),
+      );
+
+      expect(isolateHash, directHash);
+    });
+  });
+}

From bd3ea0d5b13d6d6f603b3c82e80bd4f5dd868515 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 22:37:05 +0800
Subject: [PATCH 58/64] Refactor toast system and unify path utilities

- Replace fluttertoast with SnackBar using global navigator key
- Move download directory resolution to shared PathUtils class
- Consolidate file type icon/color helpers into FileTypeColors
- Remove now-unused allFilesProvider in favor of vaultNotifierProvider
- Add secure_compare utility for auth and decoy services
- Fix password validation to use AuthService constraints
- Adjust iOS keychain accessibility setting
---
 lib/main.dart                                 |  3 +-
 lib/providers/explorer_providers.dart         |  4 +-
 lib/providers/vault_providers.dart            |  9 +-
 lib/screens/album_detail_screen.dart          | 12 +--
 lib/screens/change_security_screen.dart       |  6 +-
 lib/screens/document_picker_screen.dart       |  7 +-
 lib/screens/document_viewer_screen.dart       | 12 +--
 lib/screens/favorites_screen.dart             | 12 +--
 lib/screens/folder_detail_screen.dart         | 26 +-----
 lib/screens/gallery_vault_screen.dart         | 11 +--
 lib/screens/local_backup_screen.dart          | 10 +-
 lib/screens/media_viewer_screen.dart          | 12 +--
 lib/screens/password_setup_screen.dart        |  5 +-
 .../re_encrypt_file_picker_screen.dart        |  6 +-
 lib/screens/song_player_screen.dart           | 12 +--
 lib/screens/tags_screen.dart                  | 39 +-------
 lib/screens/vault_explorer_screen.dart        | 13 +--
 lib/services/auth_service.dart                | 54 +++++++++--
 lib/services/decoy_service.dart               | 11 ++-
 lib/services/encryption_service.dart          | 54 ++++++-----
 lib/services/file_import_service.dart         |  9 +-
 lib/services/password_service.dart            |  2 +-
 lib/services/vault_service.dart               |  2 +-
 lib/themes/app_colors.dart                    | 49 ++++++++++
 lib/utils/toast_utils.dart                    | 91 +++++++------------
 lib/widgets/explorer_file_grid.dart           | 12 +--
 pubspec.lock                                  |  8 --
 pubspec.yaml                                  |  1 -
 28 files changed, 216 insertions(+), 276 deletions(-)

diff --git a/lib/main.dart b/lib/main.dart
index 3d8a48d..fd1df91 100644
--- a/lib/main.dart
+++ b/lib/main.dart
@@ -16,10 +16,9 @@ import 'screens/auth_method_selection_screen.dart';
 import 'screens/unlock_screen.dart';
 import 'autofill_app.dart';
 import 'utils/frame_rate_optimizer.dart';
+import 'utils/navigator_key.dart';
 import 'utils/performance_config.dart';
 
-final GlobalKey<NavigatorState> navigatorKey = GlobalKey<NavigatorState>();
-
 Future<void> main() async {
   WidgetsFlutterBinding.ensureInitialized();
 
diff --git a/lib/providers/explorer_providers.dart b/lib/providers/explorer_providers.dart
index 51a0953..74677e5 100644
--- a/lib/providers/explorer_providers.dart
+++ b/lib/providers/explorer_providers.dart
@@ -36,7 +36,9 @@ final explorerFileTypeFilterProvider = StateProvider<VaultedFileType?>((ref) {
 
 /// Provider for unfiled files (files that do not belong to any folder)
 final unfiledFilesProvider = FutureProvider<List<VaultedFile>>((ref) async {
-  final allFiles = await ref.watch(allFilesProvider.future);
+  final vaultService = ref.watch(vaultServiceProvider);
+  final isDecoy = ref.watch(isDecoyModeProvider);
+  final allFiles = await vaultService.getAllFiles(isDecoy: isDecoy);
   return allFiles.where((file) => file.folderId == null).toList();
 });
 
diff --git a/lib/providers/vault_providers.dart b/lib/providers/vault_providers.dart
index 656cfd7..248063f 100644
--- a/lib/providers/vault_providers.dart
+++ b/lib/providers/vault_providers.dart
@@ -71,13 +71,6 @@ final fileTypeFilterProvider = StateProvider<VaultedFileType?>((ref) {
 
 // ========== ASYNC PROVIDERS ==========
 
-/// Provider for all vaulted files
-final allFilesProvider = FutureProvider<List<VaultedFile>>((ref) async {
-  final vaultService = ref.watch(vaultServiceProvider);
-  final isDecoy = ref.watch(isDecoyModeProvider);
-  return await vaultService.getAllFiles(isDecoy: isDecoy);
-});
-
 /// Provider for sorted and filtered files
 final filteredFilesProvider = FutureProvider<List<VaultedFile>>((ref) async {
   final vaultService = ref.watch(vaultServiceProvider);
@@ -546,7 +539,7 @@ class ReEncryptNotifier extends Notifier<ReEncryptProgress> {
       }
 
       ref.invalidate(vaultSettingsProvider);
-      ref.invalidate(allFilesProvider);
+      ref.invalidate(vaultNotifierProvider);
       return result;
     } catch (e) {
       state = ReEncryptProgress(error: e.toString());
diff --git a/lib/screens/album_detail_screen.dart b/lib/screens/album_detail_screen.dart
index 25b8405..175b7c9 100644
--- a/lib/screens/album_detail_screen.dart
+++ b/lib/screens/album_detail_screen.dart
@@ -2,7 +2,7 @@ import 'dart:io';
 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:open_filex/open_filex.dart';
-import 'package:path_provider/path_provider.dart';
+import '../utils/path_utils.dart';
 import '../models/album.dart';
 import '../models/vaulted_file.dart';
 import '../providers/vault_providers.dart';
@@ -642,15 +642,7 @@ class _AlbumDetailScreenState extends ConsumerState<AlbumDetailScreen> {
         ),
       );
 
-      Directory? downloadsDir;
-      if (Platform.isAndroid) {
-        downloadsDir = Directory('/storage/emulated/0/Download');
-        if (!await downloadsDir.exists()) {
-          downloadsDir = await getExternalStorageDirectory();
-        }
-      } else {
-        downloadsDir = await getDownloadsDirectory();
-      }
+      final downloadsDir = await PathUtils.getDownloadsDirectory();
 
       if (downloadsDir == null) {
         if (mounted) Navigator.pop(context);
diff --git a/lib/screens/change_security_screen.dart b/lib/screens/change_security_screen.dart
index 5c03929..f8e433e 100644
--- a/lib/screens/change_security_screen.dart
+++ b/lib/screens/change_security_screen.dart
@@ -525,9 +525,11 @@ class _ChangePasswordScreenState extends State<ChangePasswordScreen> {
         _errorMessage = null;
       });
     } else if (_step == 1) {
-      if (_newPasswordController.text.isEmpty) {
+      if (_newPasswordController.text.length <
+          AuthService.minPasswordLength) {
         setState(() {
-          _errorMessage = 'Please enter a new password';
+          _errorMessage =
+              'Use at least ${AuthService.minPasswordLength} characters';
         });
         return;
       }
diff --git a/lib/screens/document_picker_screen.dart b/lib/screens/document_picker_screen.dart
index ec06d83..8e6ec61 100644
--- a/lib/screens/document_picker_screen.dart
+++ b/lib/screens/document_picker_screen.dart
@@ -1,6 +1,7 @@
 import 'dart:io';
 import 'package:flutter/material.dart';
 import 'package:path_provider/path_provider.dart';
+import '../utils/path_utils.dart';
 import 'package:mime/mime.dart';
 import '../models/vaulted_file.dart';
 import '../themes/app_colors.dart';
@@ -239,11 +240,7 @@ class _DocumentPickerScreenState extends State<DocumentPickerScreen> {
         }
 
         // Also check common locations
-        final commonPaths = [
-          '/storage/emulated/0/Download',
-          '/storage/emulated/0/Documents',
-          '/storage/emulated/0/DCIM',
-        ];
+        final commonPaths = PathUtils.androidSourceRoots;
 
         for (final path in commonPaths) {
           final dir = Directory(path);
diff --git a/lib/screens/document_viewer_screen.dart b/lib/screens/document_viewer_screen.dart
index a321d73..e1ad5af 100644
--- a/lib/screens/document_viewer_screen.dart
+++ b/lib/screens/document_viewer_screen.dart
@@ -3,7 +3,7 @@ import 'dart:typed_data';
 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:open_filex/open_filex.dart';
-import 'package:path_provider/path_provider.dart';
+import '../utils/path_utils.dart';
 import 'package:pdfrx/pdfrx.dart';
 import '../models/vaulted_file.dart';
 import '../providers/vault_providers.dart';
@@ -293,15 +293,7 @@ class _DocumentViewerScreenState extends ConsumerState<DocumentViewerScreen> {
         ),
       );
 
-      Directory? downloadsDir;
-      if (Platform.isAndroid) {
-        downloadsDir = Directory('/storage/emulated/0/Download');
-        if (!await downloadsDir.exists()) {
-          downloadsDir = await getExternalStorageDirectory();
-        }
-      } else {
-        downloadsDir = await getDownloadsDirectory();
-      }
+      final downloadsDir = await PathUtils.getDownloadsDirectory();
 
       if (downloadsDir == null) {
         if (mounted) Navigator.pop(context);
diff --git a/lib/screens/favorites_screen.dart b/lib/screens/favorites_screen.dart
index 18025df..113863f 100644
--- a/lib/screens/favorites_screen.dart
+++ b/lib/screens/favorites_screen.dart
@@ -2,7 +2,7 @@ import 'dart:io';
 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:open_filex/open_filex.dart';
-import 'package:path_provider/path_provider.dart';
+import '../utils/path_utils.dart';
 import '../models/vaulted_file.dart';
 import '../models/album.dart';
 import '../providers/vault_providers.dart';
@@ -674,15 +674,7 @@ class _FavoritesScreenState extends ConsumerState<FavoritesScreen> {
         ),
       );
 
-      Directory? downloadsDir;
-      if (Platform.isAndroid) {
-        downloadsDir = Directory('/storage/emulated/0/Download');
-        if (!await downloadsDir.exists()) {
-          downloadsDir = await getExternalStorageDirectory();
-        }
-      } else {
-        downloadsDir = await getDownloadsDirectory();
-      }
+      final downloadsDir = await PathUtils.getDownloadsDirectory();
 
       if (downloadsDir == null) {
         if (mounted) Navigator.pop(context);
diff --git a/lib/screens/folder_detail_screen.dart b/lib/screens/folder_detail_screen.dart
index 72267d1..681b6f8 100644
--- a/lib/screens/folder_detail_screen.dart
+++ b/lib/screens/folder_detail_screen.dart
@@ -537,30 +537,8 @@ class _FolderDetailScreenState extends ConsumerState<FolderDetailScreen> {
   }
 
   Widget _buildFilePlaceholder(VaultedFile file) {
-    IconData icon;
-    Color color;
-    switch (file.type) {
-      case VaultedFileType.image:
-        icon = Icons.image;
-        color = context.accentColor;
-        break;
-      case VaultedFileType.video:
-        icon = Icons.videocam;
-        color = Colors.red;
-        break;
-      case VaultedFileType.song:
-        icon = Icons.music_note;
-        color = Colors.purple;
-        break;
-      case VaultedFileType.document:
-        icon = Icons.description;
-        color = Colors.green;
-        break;
-      case VaultedFileType.other:
-        icon = Icons.insert_drive_file;
-        color = Colors.grey;
-        break;
-    }
+    final color = FileTypeColors.colorForType(file.type, accent: context.accentColor);
+    final icon = FileTypeColors.iconForType(file.type);
     return Container(
       color: color.withValues(alpha: 0.1),
       child: Column(
diff --git a/lib/screens/gallery_vault_screen.dart b/lib/screens/gallery_vault_screen.dart
index f544808..1c040f4 100644
--- a/lib/screens/gallery_vault_screen.dart
+++ b/lib/screens/gallery_vault_screen.dart
@@ -8,6 +8,7 @@ import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:flutter_svg/flutter_svg.dart';
 import 'package:open_filex/open_filex.dart';
 import 'package:path_provider/path_provider.dart';
+import '../utils/path_utils.dart';
 import '../models/encryption_algorithm.dart';
 import '../models/vaulted_file.dart';
 import '../models/album.dart';
@@ -1393,15 +1394,7 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
       );
 
       // Get the Downloads directory
-      Directory? downloadsDir;
-      if (Platform.isAndroid) {
-        downloadsDir = Directory('/storage/emulated/0/Download');
-        if (!await downloadsDir.exists()) {
-          downloadsDir = await getExternalStorageDirectory();
-        }
-      } else {
-        downloadsDir = await getDownloadsDirectory();
-      }
+      final downloadsDir = await PathUtils.getDownloadsDirectory();
 
       if (downloadsDir == null) {
         if (mounted) Navigator.pop(context);
diff --git a/lib/screens/local_backup_screen.dart b/lib/screens/local_backup_screen.dart
index 9a5ac07..52bc44d 100644
--- a/lib/screens/local_backup_screen.dart
+++ b/lib/screens/local_backup_screen.dart
@@ -1,7 +1,7 @@
-import 'dart:io';
 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:path_provider/path_provider.dart';
+import '../utils/path_utils.dart';
 import '../models/vaulted_file.dart';
 import '../services/backup_service.dart';
 import '../themes/app_colors.dart';
@@ -35,13 +35,7 @@ class _LocalBackupScreenState extends ConsumerState<LocalBackupScreen> {
         SaveLocation(
           name: 'Downloads',
           resolvePath: () async {
-            if (Platform.isAndroid) {
-              final d = Directory('/storage/emulated/0/Download');
-              if (await d.exists()) return d.path;
-              final ext = await getExternalStorageDirectory();
-              return ext?.path;
-            }
-            final d = await getDownloadsDirectory();
+            final d = await PathUtils.getDownloadsDirectory();
             return d?.path;
           },
         ),
diff --git a/lib/screens/media_viewer_screen.dart b/lib/screens/media_viewer_screen.dart
index 5ead9b7..c855949 100644
--- a/lib/screens/media_viewer_screen.dart
+++ b/lib/screens/media_viewer_screen.dart
@@ -4,7 +4,7 @@ import 'package:flutter/material.dart';
 import 'package:flutter/services.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:open_filex/open_filex.dart';
-import 'package:path_provider/path_provider.dart';
+import '../utils/path_utils.dart';
 import 'package:photo_view/photo_view.dart';
 import 'package:photo_view/photo_view_gallery.dart';
 import 'package:video_player/video_player.dart';
@@ -704,15 +704,7 @@ class _MediaViewerScreenState extends ConsumerState<MediaViewerScreen> {
         ),
       );
 
-      Directory? downloadsDir;
-      if (Platform.isAndroid) {
-        downloadsDir = Directory('/storage/emulated/0/Download');
-        if (!await downloadsDir.exists()) {
-          downloadsDir = await getExternalStorageDirectory();
-        }
-      } else {
-        downloadsDir = await getDownloadsDirectory();
-      }
+      final downloadsDir = await PathUtils.getDownloadsDirectory();
 
       if (downloadsDir == null) {
         if (mounted) Navigator.pop(context);
diff --git a/lib/screens/password_setup_screen.dart b/lib/screens/password_setup_screen.dart
index 4a4ee59..ba602ec 100644
--- a/lib/screens/password_setup_screen.dart
+++ b/lib/screens/password_setup_screen.dart
@@ -33,9 +33,10 @@ class _PasswordSetupScreenState extends State<PasswordSetupScreen> {
   Future<void> _handleContinue() async {
     final password = _passwordController.text;
 
-    if (password.isEmpty) {
+    final strength = AuthService.validatePasswordStrength(password);
+    if (strength.isBlocking) {
       setState(() {
-        _errorMessage = 'Please enter a password';
+        _errorMessage = strength.label;
       });
       return;
     }
diff --git a/lib/screens/re_encrypt_file_picker_screen.dart b/lib/screens/re_encrypt_file_picker_screen.dart
index f308a0d..9e1a5fa 100644
--- a/lib/screens/re_encrypt_file_picker_screen.dart
+++ b/lib/screens/re_encrypt_file_picker_screen.dart
@@ -55,7 +55,7 @@ class _ReEncryptFilePickerScreenState
 
   @override
   Widget build(BuildContext context) {
-    final filesAsync = ref.watch(allFilesProvider);
+    final filesAsync = ref.watch(vaultNotifierProvider);
     final reEncryptProgress = ref.watch(reEncryptProvider);
 
     return Scaffold(
@@ -334,7 +334,7 @@ class _ReEncryptFilePickerScreenState
   }
 
   Future<void> _startReEncrypt() async {
-    final encryptedFiles = _encryptedFiles(ref.read(allFilesProvider));
+    final encryptedFiles = _encryptedFiles(ref.read(vaultNotifierProvider));
     final largeFiles = encryptedFiles
         .where((f) => _selectedIds.contains(f.id) && f.fileSize > _largeFileThresholdBytes)
         .toList();
@@ -435,7 +435,7 @@ class _ReEncryptFilePickerScreenState
           ),
         ),
       );
-      ref.invalidate(allFilesProvider);
+      ref.invalidate(vaultNotifierProvider);
     }
   }
 }
diff --git a/lib/screens/song_player_screen.dart b/lib/screens/song_player_screen.dart
index ec362a8..89794f9 100644
--- a/lib/screens/song_player_screen.dart
+++ b/lib/screens/song_player_screen.dart
@@ -5,7 +5,7 @@ import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:flutter/services.dart';
 import 'package:just_audio/just_audio.dart';
 import 'package:open_filex/open_filex.dart';
-import 'package:path_provider/path_provider.dart';
+import '../utils/path_utils.dart';
 
 import '../models/vaulted_file.dart';
 import '../services/flick_integration_service.dart';
@@ -175,15 +175,7 @@ class _SongPlayerScreenState extends ConsumerState<SongPlayerScreen>
         ),
       );
 
-      Directory? downloadsDir;
-      if (Platform.isAndroid) {
-        downloadsDir = Directory('/storage/emulated/0/Download');
-        if (!await downloadsDir.exists()) {
-          downloadsDir = await getExternalStorageDirectory();
-        }
-      } else {
-        downloadsDir = await getDownloadsDirectory();
-      }
+      final downloadsDir = await PathUtils.getDownloadsDirectory();
 
       if (downloadsDir == null) {
         if (mounted) Navigator.pop(context);
diff --git a/lib/screens/tags_screen.dart b/lib/screens/tags_screen.dart
index 3a99f9a..a6828c2 100644
--- a/lib/screens/tags_screen.dart
+++ b/lib/screens/tags_screen.dart
@@ -3,7 +3,7 @@ import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:locker/models/album.dart';
 import 'package:open_filex/open_filex.dart';
-import 'package:path_provider/path_provider.dart';
+import '../utils/path_utils.dart';
 import '../models/vaulted_file.dart';
 import '../providers/vault_providers.dart';
 import '../services/auto_kill_service.dart';
@@ -517,31 +517,8 @@ class _TagsScreenState extends ConsumerState<TagsScreen> {
   }
 
   Widget _buildPlaceholder(VaultedFile file) {
-    IconData icon;
-    Color color;
-
-    switch (file.type) {
-      case VaultedFileType.image:
-        icon = Icons.image;
-        color = context.accentColor;
-        break;
-      case VaultedFileType.video:
-        icon = Icons.videocam;
-        color = Colors.red;
-        break;
-      case VaultedFileType.song:
-        icon = Icons.music_note;
-        color = Colors.purple;
-        break;
-      case VaultedFileType.document:
-        icon = Icons.description;
-        color = Colors.orange;
-        break;
-      case VaultedFileType.other:
-        icon = Icons.insert_drive_file;
-        color = Colors.grey;
-        break;
-    }
+    final color = FileTypeColors.colorForType(file.type, accent: context.accentColor);
+    final icon = FileTypeColors.iconForType(file.type);
 
     return Container(
       color: color.withValues(alpha: 0.1),
@@ -786,15 +763,7 @@ class _TagsScreenState extends ConsumerState<TagsScreen> {
         ),
       );
 
-      Directory? downloadsDir;
-      if (Platform.isAndroid) {
-        downloadsDir = Directory('/storage/emulated/0/Download');
-        if (!await downloadsDir.exists()) {
-          downloadsDir = await getExternalStorageDirectory();
-        }
-      } else {
-        downloadsDir = await getDownloadsDirectory();
-      }
+      final downloadsDir = await PathUtils.getDownloadsDirectory();
 
       if (downloadsDir == null) {
         if (mounted) Navigator.pop(context);
diff --git a/lib/screens/vault_explorer_screen.dart b/lib/screens/vault_explorer_screen.dart
index f9244ba..11a28aa 100644
--- a/lib/screens/vault_explorer_screen.dart
+++ b/lib/screens/vault_explorer_screen.dart
@@ -1,8 +1,7 @@
-import 'dart:io';
 import 'package:flutter/material.dart';
 import 'package:flutter/services.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
-import 'package:path_provider/path_provider.dart';
+import '../utils/path_utils.dart';
 import '../models/album.dart';
 import '../models/vault_folder.dart';
 import '../models/vaulted_file.dart';
@@ -290,15 +289,7 @@ class _VaultExplorerScreenState extends ConsumerState<VaultExplorerScreen> {
 
   Future<void> _exportFileToDownloads(VaultedFile file) async {
     try {
-      Directory? downloadsDir;
-      if (Platform.isAndroid) {
-        downloadsDir = Directory('/storage/emulated/0/Download');
-        if (!await downloadsDir.exists()) {
-          downloadsDir = await getExternalStorageDirectory();
-        }
-      } else {
-        downloadsDir = await getDownloadsDirectory();
-      }
+      final downloadsDir = await PathUtils.getDownloadsDirectory();
 
       if (downloadsDir == null) {
         ToastUtils.showError('Could not access Downloads folder');
diff --git a/lib/services/auth_service.dart b/lib/services/auth_service.dart
index 8c82888..04ecd13 100644
--- a/lib/services/auth_service.dart
+++ b/lib/services/auth_service.dart
@@ -8,6 +8,7 @@ import 'package:local_auth/local_auth.dart';
 import 'package:local_auth_android/local_auth_android.dart';
 import 'package:local_auth_darwin/local_auth_darwin.dart';
 import '../utils/pbkdf2_isolate.dart';
+import '../utils/secure_compare.dart';
 import 'auto_kill_service.dart';
 import 'decoy_service.dart';
 import 'encryption_service.dart';
@@ -17,7 +18,7 @@ import 'vault_service.dart';
 class AuthService {
   static const _storage = FlutterSecureStorage(
     aOptions: AndroidOptions(),
-    iOptions: IOSOptions(accessibility: KeychainAccessibility.first_unlock),
+    iOptions: IOSOptions(accessibility: KeychainAccessibility.unlocked_this_device),
   );
 
   static const String _passwordHashKey = 'user_password_hash';
@@ -59,7 +60,7 @@ class AuthService {
   /// Create and store the user's password
   Future<bool> createPassword(String password) async {
     try {
-      if (password.isEmpty) return false;
+      if (password.length < minPasswordLength) return false;
 
       await _createHashedCredential(password, _passwordSaltKey, _passwordHashKey, _passwordIterationsKey);
       await _storage.write(key: _firstTimeKey, value: 'false');
@@ -380,7 +381,7 @@ class AuthService {
   Future<bool> changePassword(
       String currentPassword, String newPassword) async {
     try {
-      if (currentPassword.isEmpty || newPassword.isEmpty) return false;
+      if (currentPassword.isEmpty || newPassword.length < minPasswordLength) return false;
 
       final isVerified = await verifyPassword(currentPassword);
       if (!isVerified) return false;
@@ -425,7 +426,7 @@ class AuthService {
   Future<bool> switchFromPINToPassword(
       String currentPIN, String newPassword) async {
     try {
-      if (currentPIN.isEmpty || newPassword.isEmpty) return false;
+      if (currentPIN.isEmpty || newPassword.length < minPasswordLength) return false;
 
       final isVerified = await verifyPIN(currentPIN);
       if (!isVerified) return false;
@@ -571,6 +572,23 @@ class AuthService {
   static const int _defaultKdfIterations = 600000;
   static const int _saltSize = 32;
 
+  /// Minimum password length enforced at every entry point (setup, change).
+  static const int minPasswordLength = 8;
+
+  /// Classify a password's strength. Length is a hard floor; composition only
+  /// informs the warning level (NIST 800-63B: length over forced composition).
+  static PasswordStrength validatePasswordStrength(String password) {
+    if (password.length < minPasswordLength) return PasswordStrength.tooShort;
+    var classes = 0;
+    if (RegExp(r'[a-z]').hasMatch(password)) classes++;
+    if (RegExp(r'[A-Z]').hasMatch(password)) classes++;
+    if (RegExp(r'[0-9]').hasMatch(password)) classes++;
+    if (RegExp(r'[^a-zA-Z0-9]').hasMatch(password)) classes++;
+    // A long passphrase is fine even with one class; only flag short+mono.
+    if (password.length < 12 && classes < 2) return PasswordStrength.weak;
+    return PasswordStrength.acceptable;
+  }
+
   Future<int> _getCurrentKdfIterations() async {
     final settings = await _vaultService.getSettings();
     return settings.kdfIterations;
@@ -611,7 +629,11 @@ class AuthService {
 
       if (storedSalt == null) {
         final legacyHash = _hashCredentialLegacy(credential);
-        if (legacyHash == storedHash) {
+        // Pad the legacy path with dummy KDF work so verify time does not
+        // reveal that this is a legacy (plain SHA-256) account.
+        await computePbkdf2Hash(
+            credential, _generateSalt(), iterations: _defaultKdfIterations);
+        if (constantTimeEquals(legacyHash, storedHash)) {
           final salt = _generateSalt();
           final iterations = await _getCurrentKdfIterations();
           final newHash = await computePbkdf2Hash(credential, salt, iterations: iterations);
@@ -630,7 +652,7 @@ class AuthService {
 
       final salt = base64Decode(storedSalt);
       final computedHash = await computePbkdf2Hash(credential, salt, iterations: storedIterations);
-      if (computedHash != storedHash) return false;
+      if (!constantTimeEquals(computedHash, storedHash)) return false;
 
       final currentIterations = await _getCurrentKdfIterations();
       if (currentIterations != storedIterations) {
@@ -751,6 +773,26 @@ enum BiometricAuthenticationStatus {
   unavailable,
 }
 
+/// Strength classification for a candidate password.
+enum PasswordStrength {
+  tooShort,
+  weak,
+  acceptable;
+
+  bool get isBlocking => this == tooShort;
+
+  String get label {
+    switch (this) {
+      case PasswordStrength.tooShort:
+        return 'Use at least $AuthService.minPasswordLength characters';
+      case PasswordStrength.weak:
+        return 'Weak — add length or a mix of letters, numbers, symbols';
+      case PasswordStrength.acceptable:
+        return 'Acceptable';
+    }
+  }
+}
+
 class BiometricAuthenticationResult {
   final BiometricAuthenticationStatus status;
 
diff --git a/lib/services/decoy_service.dart b/lib/services/decoy_service.dart
index 3c925f7..0fa6d47 100644
--- a/lib/services/decoy_service.dart
+++ b/lib/services/decoy_service.dart
@@ -4,6 +4,7 @@ import 'package:crypto/crypto.dart';
 import 'package:flutter/foundation.dart';
 import 'package:flutter_secure_storage/flutter_secure_storage.dart';
 import '../utils/pbkdf2_isolate.dart';
+import '../utils/secure_compare.dart';
 import '../models/vaulted_file.dart';
 import 'encryption_service.dart';
 import 'vault_service.dart';
@@ -16,7 +17,7 @@ class DecoyService {
 
   static const _storage = FlutterSecureStorage(
     aOptions: AndroidOptions(),
-    iOptions: IOSOptions(accessibility: KeychainAccessibility.first_unlock),
+    iOptions: IOSOptions(accessibility: KeychainAccessibility.unlocked_this_device),
   );
 
   static const String _decoyEnabledKey = 'decoy_mode_enabled';
@@ -282,7 +283,11 @@ class DecoyService {
 
       if (storedSalt == null) {
         final legacyHash = _hashCredentialLegacy(credential);
-        if (legacyHash == storedHash) {
+        // Pad the legacy path with dummy KDF work so verify time does not
+        // reveal that this is a legacy (plain SHA-256) account.
+        await computePbkdf2Hash(
+            credential, _generateSalt(), iterations: _defaultKdfIterations);
+        if (constantTimeEquals(legacyHash, storedHash)) {
           final salt = _generateSalt();
           final iterations = await _getCurrentKdfIterations();
           final newHash = await computePbkdf2Hash(credential, salt, iterations: iterations);
@@ -301,7 +306,7 @@ class DecoyService {
 
       final salt = base64Decode(storedSalt);
       final computedHash = await computePbkdf2Hash(credential, salt, iterations: storedIterations);
-      if (computedHash != storedHash) return false;
+      if (!constantTimeEquals(computedHash, storedHash)) return false;
 
       final currentIterations = await _getCurrentKdfIterations();
       if (currentIterations != storedIterations) {
diff --git a/lib/services/encryption_service.dart b/lib/services/encryption_service.dart
index 9277746..91a60f6 100644
--- a/lib/services/encryption_service.dart
+++ b/lib/services/encryption_service.dart
@@ -5,6 +5,7 @@ import 'dart:math';
 import 'package:crypto/crypto.dart';
 import 'package:flutter/foundation.dart';
 import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+import 'package:path_provider/path_provider.dart';
 import 'package:pointycastle/export.dart';
 import '../models/encryption_algorithm.dart';
 import '../utils/argon2_isolate.dart';
@@ -30,7 +31,7 @@ class EncryptionService {
   // migrateOnAlgorithmChange ensures existing data is automatically migrated
   static const _storage = FlutterSecureStorage(
     aOptions: AndroidOptions(),
-    iOptions: IOSOptions(accessibility: KeychainAccessibility.first_unlock),
+    iOptions: IOSOptions(accessibility: KeychainAccessibility.unlocked_this_device),
   );
 
   static const String _masterKeyKey = 'vault_master_key';
@@ -463,7 +464,7 @@ class EncryptionService {
       debugPrint('Decryption error: $e');
       return DecryptionResult(
         success: false,
-        error: 'Decryption failed: $e',
+        error: 'Decryption failed.',
       );
     }
   }
@@ -539,7 +540,7 @@ class EncryptionService {
       debugPrint('File streaming encryption error: $e');
       return FileEncryptionResult(
         success: false,
-        error: 'File streaming encryption failed: $e',
+        error: 'File streaming encryption failed.',
       );
     }
   }
@@ -597,7 +598,7 @@ class EncryptionService {
       debugPrint('Bytes streaming encryption error: $e');
       return FileEncryptionResult(
         success: false,
-        error: 'Bytes streaming encryption failed: $e',
+        error: 'Bytes streaming encryption failed.',
       );
     }
   }
@@ -649,7 +650,7 @@ class EncryptionService {
       debugPrint('Bytes GCM streaming encryption error: $e');
       return FileEncryptionResult(
         success: false,
-        error: 'Bytes GCM streaming encryption failed: $e',
+        error: 'Bytes GCM streaming encryption failed.',
       );
     }
   }
@@ -782,7 +783,7 @@ class EncryptionService {
       debugPrint('File decryption error: $e');
       return FileDecryptionResult(
         success: false,
-        error: 'File decryption failed: $e',
+        error: 'File decryption failed.',
       );
     }
   }
@@ -948,7 +949,7 @@ class EncryptionService {
       debugPrint('File streaming decryption error: $e');
       return FileDecryptionResult(
         success: false,
-        error: 'File streaming decryption failed: $e',
+        error: 'File streaming decryption failed.',
       );
     }
   }
@@ -1073,7 +1074,7 @@ class EncryptionService {
       debugPrint('Streamed file decryption to memory error: $e');
       return DecryptionResult(
         success: false,
-        error: 'File decryption failed: $e',
+        error: 'File decryption failed.',
       );
     }
   }
@@ -1118,7 +1119,7 @@ class EncryptionService {
       debugPrint('GCM Decryption error: $e');
       return DecryptionResult(
         success: false,
-        error: 'GCM Decryption failed: $e',
+        error: 'GCM Decryption failed.',
       );
     }
   }
@@ -1203,7 +1204,7 @@ class EncryptionService {
       debugPrint('GCM File decryption error: $e');
       return FileDecryptionResult(
         success: false,
-        error: 'GCM File decryption failed: $e',
+        error: 'GCM File decryption failed.',
       );
     }
   }
@@ -1282,7 +1283,7 @@ class EncryptionService {
       debugPrint('GCM v2 streaming encryption error: $e');
       return FileEncryptionResult(
         success: false,
-        error: 'GCM streaming encryption failed: $e',
+        error: 'GCM streaming encryption failed.',
       );
     }
   }
@@ -1357,7 +1358,7 @@ class EncryptionService {
       debugPrint('GCM streamed decryption error: $e');
       return DecryptionResult(
         success: false,
-        error: 'GCM decryption failed: $e',
+        error: 'GCM decryption failed.',
       );
     }
   }
@@ -1410,7 +1411,7 @@ class EncryptionService {
       debugPrint('Isolate pool encryption error: $e');
       return FileEncryptionResult(
         success: false,
-        error: 'Isolate encryption failed: $e',
+        error: 'Isolate encryption failed.',
       );
     }
   }
@@ -1462,7 +1463,7 @@ class EncryptionService {
       debugPrint('Isolate pool decryption error: $e');
       return FileDecryptionResult(
         success: false,
-        error: 'Isolate decryption failed: $e',
+        error: 'Isolate decryption failed.',
       );
     }
   }
@@ -1547,6 +1548,16 @@ class EncryptionService {
     }
   }
 
+  /// App-private temp dir for plaintext intermediates (never system temp).
+  /// ponytail: keeps decrypted rotation/re-encryption scratch off the shared
+  /// system temp; callers still secureDelete the plaintext file on cleanup.
+  Future<Directory> _createAppPrivateTemp(String prefix) async {
+    final docs = await getApplicationDocumentsDirectory();
+    final root = Directory('${docs.path}/.locker_temp');
+    await root.create(recursive: true);
+    return root.createTemp(prefix);
+  }
+
   Future<String> reEncryptFile(
     String filePath,
     String oldIvBase64, {
@@ -1559,7 +1570,7 @@ class EncryptionService {
     final isLegacyCbc = (format == 0 || format == 3);
 
     final key = await _resolveKey(isDecoy: isDecoy, derivedKey: oldDerivedKey);
-    final tempDir = await Directory.systemTemp.createTemp('lkr_reencrypt_');
+    final tempDir = await _createAppPrivateTemp('lkr_reencrypt_');
     final tempDecPath = '${tempDir.path}/decrypted';
 
     try {
@@ -1601,6 +1612,7 @@ class EncryptionService {
 
       return encResult.ivBase64!;
     } finally {
+      try { await secureDelete(tempDecPath); } catch (_) {}
       try { await tempDir.delete(recursive: true); } catch (_) {}
     }
   }
@@ -1649,7 +1661,7 @@ class EncryptionService {
       final doneSet = (journal['done'] as List).cast<String>().toSet();
       final ivs = (journal['ivs'] as Map<String, dynamic>).cast<String, String>();
 
-      final tempDir = await Directory.systemTemp.createTemp('lkr_rot_recovery_');
+      final tempDir = await _createAppPrivateTemp('lkr_rot_recovery_');
       try {
         for (final path in files) {
           if (doneSet.contains(path)) continue;
@@ -1693,7 +1705,7 @@ class EncryptionService {
           );
           await encJob.future;
 
-          try { await File(tempDecPath).delete(); } catch (_) {}
+          try { await secureDelete(tempDecPath); } catch (_) {}
         }
       } finally {
         try { await tempDir.delete(recursive: true); } catch (_) {}
@@ -1743,7 +1755,7 @@ class EncryptionService {
       };
       await _storage.write(key: _rotationJournalKey, value: jsonEncode(journal));
 
-      final tempDir = await Directory.systemTemp.createTemp('lkr_rotate_');
+      final tempDir = await _createAppPrivateTemp('lkr_rotate_');
       try {
         for (int i = 0; i < encryptedFilePaths.length; i++) {
           onProgress?.call(i + 1, encryptedFilePaths.length);
@@ -1782,7 +1794,7 @@ class EncryptionService {
             } catch (e) {
               return KeyRotationResult(
                 success: false,
-                error: 'Failed to decrypt file at index $i: $e',
+                error: 'Failed to decrypt file at index $i.',
                 processedCount: i,
               );
             }
@@ -1798,7 +1810,7 @@ class EncryptionService {
           final encResult = await encJob.future;
           newIvs.add(encResult.ivBase64!);
 
-          try { await File(tempDecPath).delete(); } catch (_) {}
+          try { await secureDelete(tempDecPath); } catch (_) {}
 
           journal['done'] = encryptedFilePaths.sublist(0, i + 1);
           await _storage.write(key: _rotationJournalKey, value: jsonEncode(journal));
@@ -1819,7 +1831,7 @@ class EncryptionService {
       debugPrint('Key rotation error: $e');
       return KeyRotationResult(
         success: false,
-        error: 'Key rotation failed: $e',
+        error: 'Key rotation failed.',
       );
     }
   }
diff --git a/lib/services/file_import_service.dart b/lib/services/file_import_service.dart
index 4305e1c..5435c47 100644
--- a/lib/services/file_import_service.dart
+++ b/lib/services/file_import_service.dart
@@ -4,6 +4,7 @@ import 'package:file_picker/file_picker.dart';
 import 'package:image_picker/image_picker.dart';
 import 'package:mime/mime.dart';
 import 'package:path_provider/path_provider.dart';
+import '../utils/path_utils.dart';
 import 'package:photo_manager/photo_manager.dart';
 import '../models/encryption_algorithm.dart';
 import '../models/vaulted_file.dart';
@@ -1612,13 +1613,7 @@ class FileImportService {
   /// Try to get the original path from a cached/picked file path
   Future<String?> _getOriginalPath(String cachedPath, String fileName) async {
     // Common locations to check
-    final possibleDirs = [
-      '/storage/emulated/0/Download',
-      '/storage/emulated/0/Documents',
-      '/storage/emulated/0/DCIM',
-      '/sdcard/Download',
-      '/sdcard/Documents',
-    ];
+    final possibleDirs = PathUtils.androidSourceRoots;
 
     for (final dir in possibleDirs) {
       final possiblePath = '$dir/$fileName';
diff --git a/lib/services/password_service.dart b/lib/services/password_service.dart
index dfbc6c3..984d374 100644
--- a/lib/services/password_service.dart
+++ b/lib/services/password_service.dart
@@ -174,7 +174,7 @@ class PasswordService {
           );
 
     if (!result.success || result.data == null) {
-      throw Exception('Failed to decrypt: ${result.error}');
+      throw Exception('Failed to decrypt password entry');
     }
 
     return PasswordContent.fromJsonString(utf8.decode(result.data!));
diff --git a/lib/services/vault_service.dart b/lib/services/vault_service.dart
index 8bd3164..5d5df93 100644
--- a/lib/services/vault_service.dart
+++ b/lib/services/vault_service.dart
@@ -63,7 +63,7 @@ class VaultService {
 
   static const _storage = FlutterSecureStorage(
     aOptions: AndroidOptions(),
-    iOptions: IOSOptions(accessibility: KeychainAccessibility.first_unlock),
+    iOptions: IOSOptions(accessibility: KeychainAccessibility.unlocked_this_device),
   );
 
   static const String _vaultIndexKey = 'vault_file_index';
diff --git a/lib/themes/app_colors.dart b/lib/themes/app_colors.dart
index 91d54f0..360967b 100644
--- a/lib/themes/app_colors.dart
+++ b/lib/themes/app_colors.dart
@@ -1,4 +1,5 @@
 import 'package:flutter/material.dart';
+import '../models/vaulted_file.dart';
 
 /// App Color Palette
 /// Contains all color definitions used throughout the Latch app
@@ -377,3 +378,51 @@ extension AppColorsExtension on BuildContext {
   /// Glass highlight color
   Color get glassHighlight => AppColors.glassHighlight;
 }
+
+/// Single source of truth for per-file-type colors/icons and status colors.
+/// Resolves the document green/orange divergence (now consistently orange).
+class FileTypeColors {
+  FileTypeColors._();
+
+  static const Color imageAccentFallback = Color(0xFF1976D2);
+  static const Color video = Colors.red;
+  static const Color song = Colors.purple;
+  static const Color document = Colors.orange;
+  static const Color other = Colors.grey;
+
+  /// Favorite/amber used for the star indicator across screens.
+  static const Color favorite = Colors.amber;
+
+  /// Color for a vaulted file type. Pass the theme accent for images, which
+  /// follow the dynamic accent color rather than a fixed value.
+  static Color colorForType(VaultedFileType type, {Color? accent}) {
+    switch (type) {
+      case VaultedFileType.image:
+        return accent ?? imageAccentFallback;
+      case VaultedFileType.video:
+        return video;
+      case VaultedFileType.song:
+        return song;
+      case VaultedFileType.document:
+        return document;
+      case VaultedFileType.other:
+        return other;
+    }
+  }
+
+  /// Icon for a vaulted file type.
+  static IconData iconForType(VaultedFileType type) {
+    switch (type) {
+      case VaultedFileType.image:
+        return Icons.image;
+      case VaultedFileType.video:
+        return Icons.videocam;
+      case VaultedFileType.song:
+        return Icons.music_note;
+      case VaultedFileType.document:
+        return Icons.description;
+      case VaultedFileType.other:
+        return Icons.insert_drive_file;
+    }
+  }
+}
diff --git a/lib/utils/toast_utils.dart b/lib/utils/toast_utils.dart
index 51c3186..0ef4d20 100644
--- a/lib/utils/toast_utils.dart
+++ b/lib/utils/toast_utils.dart
@@ -1,68 +1,43 @@
 import 'package:flutter/material.dart';
 import 'package:locker/themes/app_colors.dart';
-import 'package:fluttertoast/fluttertoast.dart';
+import 'navigator_key.dart';
 
 class ToastUtils {
-  static const Color _toastBg = AppColors.primaryBackground;
-  static const Color _lightText = AppColors.primaryText;
-
-  static void showToast(String message) {
-    Fluttertoast.showToast(
-      msg: message,
-      toastLength: Toast.LENGTH_SHORT,
-      gravity: ToastGravity.BOTTOM,
-      timeInSecForIosWeb: 1,
-      backgroundColor: _toastBg,
-      textColor: _lightText,
-      fontSize: 16,
-    );
+  static void _show(
+    String message, {
+    Color? backgroundColor,
+    Duration duration = const Duration(seconds: 2),
+  }) {
+    final context = navigatorKey.currentContext;
+    if (context == null) return;
+    final messenger = ScaffoldMessenger.maybeOf(context);
+    if (messenger == null) return;
+    messenger
+      ..clearSnackBars()
+      ..showSnackBar(
+        SnackBar(
+          content: Text(message),
+          backgroundColor: backgroundColor,
+          behavior: SnackBarBehavior.floating,
+          duration: duration,
+        ),
+      );
   }
 
-  static void showSuccess(String message) {
-    Fluttertoast.showToast(
-      msg: message,
-      toastLength: Toast.LENGTH_SHORT,
-      gravity: ToastGravity.BOTTOM,
-      timeInSecForIosWeb: 2,
-      backgroundColor: AppColors.success,
-      textColor: Colors.white,
-      fontSize: 16,
-    );
-  }
+  static void showToast(String message) => _show(message);
 
-  static void showError(String message) {
-    Fluttertoast.showToast(
-      msg: message,
-      toastLength: Toast.LENGTH_LONG,
-      gravity: ToastGravity.BOTTOM,
-      timeInSecForIosWeb: 3,
-      backgroundColor: AppColors.error,
-      textColor: Colors.white,
-      fontSize: 16,
-    );
-  }
+  static void showSuccess(String message) =>
+      _show(message, backgroundColor: AppColors.success);
 
-  static void showInfo(String message) {
-    Fluttertoast.showToast(
-      msg: message,
-      toastLength: Toast.LENGTH_SHORT,
-      gravity: ToastGravity.BOTTOM,
-      timeInSecForIosWeb: 2,
-      backgroundColor: AppColors.info,
-      textColor: Colors.white,
-      fontSize: 16,
-    );
-  }
+  static void showError(String message) => _show(
+        message,
+        backgroundColor: AppColors.error,
+        duration: const Duration(seconds: 3),
+      );
 
-  static void showWarning(String message) {
-    Fluttertoast.showToast(
-      msg: message,
-      toastLength: Toast.LENGTH_SHORT,
-      gravity: ToastGravity.BOTTOM,
-      timeInSecForIosWeb: 2,
-      backgroundColor: AppColors.warning,
-      textColor: Colors.white,
-      fontSize: 16,
-    );
-  }
+  static void showInfo(String message) =>
+      _show(message, backgroundColor: AppColors.info);
+
+  static void showWarning(String message) =>
+      _show(message, backgroundColor: AppColors.warning);
 }
diff --git a/lib/widgets/explorer_file_grid.dart b/lib/widgets/explorer_file_grid.dart
index d15b619..3a4e337 100644
--- a/lib/widgets/explorer_file_grid.dart
+++ b/lib/widgets/explorer_file_grid.dart
@@ -3,7 +3,7 @@ import 'package:flutter/material.dart';
 import 'package:flutter/services.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:open_filex/open_filex.dart';
-import 'package:path_provider/path_provider.dart';
+import '../utils/path_utils.dart';
 import '../models/vault_folder.dart';
 import '../models/vaulted_file.dart';
 import '../providers/vault_providers.dart';
@@ -811,15 +811,7 @@ class ExplorerFileGrid extends ConsumerWidget {
         ),
       );
 
-      Directory? downloadsDir;
-      if (Platform.isAndroid) {
-        downloadsDir = Directory('/storage/emulated/0/Download');
-        if (!await downloadsDir.exists()) {
-          downloadsDir = await getExternalStorageDirectory();
-        }
-      } else {
-        downloadsDir = await getDownloadsDirectory();
-      }
+      final downloadsDir = await PathUtils.getDownloadsDirectory();
 
       if (downloadsDir == null) {
         if (ctx.mounted) Navigator.pop(ctx);
diff --git a/pubspec.lock b/pubspec.lock
index a0cbf21..d7104ef 100644
--- a/pubspec.lock
+++ b/pubspec.lock
@@ -472,14 +472,6 @@ packages:
     description: flutter
     source: sdk
     version: "0.0.0"
-  fluttertoast:
-    dependency: "direct main"
-    description:
-      name: fluttertoast
-      sha256: "144ddd74d49c865eba47abe31cbc746c7b311c82d6c32e571fd73c4264b740e2"
-      url: "https://pub.dev"
-    source: hosted
-    version: "9.0.0"
   frontend_server_client:
     dependency: transitive
     description:
diff --git a/pubspec.yaml b/pubspec.yaml
index 3f7c4fa..80a2a22 100644
--- a/pubspec.yaml
+++ b/pubspec.yaml
@@ -39,7 +39,6 @@ dependencies:
   flutter_riverpod: ^3.0.3
   flutter_secure_storage: ^10.0.0
   flutter_svg: ^2.0.10
-  fluttertoast: ^9.0.0
   image: ^4.8.0
   image_picker: ^1.2.1
   just_audio: ^0.10.5

From fadeb981abf69f395651e145e4d8b105a908cfc2 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 22:37:15 +0800
Subject: [PATCH 59/64] Add global navigator key

---
 lib/utils/navigator_key.dart | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 lib/utils/navigator_key.dart

diff --git a/lib/utils/navigator_key.dart b/lib/utils/navigator_key.dart
new file mode 100644
index 0000000..5691d87
--- /dev/null
+++ b/lib/utils/navigator_key.dart
@@ -0,0 +1,3 @@
+import 'package:flutter/material.dart';
+
+final GlobalKey<NavigatorState> navigatorKey = GlobalKey<NavigatorState>();

From 16df3a2c73a635086e3e31540b4e78fd6a71414e Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 22:37:19 +0800
Subject: [PATCH 60/64] Add centralized Android path resolution utility

---
 lib/utils/path_utils.dart | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 lib/utils/path_utils.dart

diff --git a/lib/utils/path_utils.dart b/lib/utils/path_utils.dart
new file mode 100644
index 0000000..206d8c3
--- /dev/null
+++ b/lib/utils/path_utils.dart
@@ -0,0 +1,36 @@
+import 'dart:io';
+import 'package:path_provider/path_provider.dart' as pp;
+
+/// Centralized Android/public-storage path resolution.
+///
+/// Absolute Android paths don't exist on all OEM ROMs and bypass scoped
+/// storage on Android 11+. Everything routes through here so the fallback
+/// logic lives in one place.
+class PathUtils {
+  PathUtils._();
+
+  /// Public primary external storage root on Android (may not exist on all
+  /// ROMs / scoped-storage builds).
+  static const String androidStorageRoot = '/storage/emulated/0';
+
+  /// Resolve a writable Downloads directory.
+  /// On Android tries the canonical public Downloads path first, falling back
+  /// to the scoped external-storage dir if absent.
+  static Future<Directory?> getDownloadsDirectory() async {
+    if (Platform.isAndroid) {
+      final primary = Directory('$androidStorageRoot/Download');
+      if (await primary.exists()) return primary;
+      return pp.getExternalStorageDirectory();
+    }
+    return pp.getDownloadsDirectory();
+  }
+
+  /// Common Android document/media source roots to seed a picker.
+  static const List<String> androidSourceRoots = [
+    '$androidStorageRoot/Download',
+    '$androidStorageRoot/Documents',
+    '$androidStorageRoot/DCIM',
+    '/sdcard/Download',
+    '/sdcard/Documents',
+  ];
+}

From 43a6d0eee93d0febc736a72ebe2401e564423ee4 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 22:37:24 +0800
Subject: [PATCH 61/64] Add constant-time string comparison utility

---
 lib/utils/secure_compare.dart | 14 ++++++++++++++
 1 file changed, 14 insertions(+)
 create mode 100644 lib/utils/secure_compare.dart

diff --git a/lib/utils/secure_compare.dart b/lib/utils/secure_compare.dart
new file mode 100644
index 0000000..f89a6e9
--- /dev/null
+++ b/lib/utils/secure_compare.dart
@@ -0,0 +1,14 @@
+/// Constant-time equality for secret-derived hash strings.
+///
+/// ponytail: lengths are still observable (unavoidable for variable-length
+/// strings), but per-character comparison never short-circuits on mismatch.
+bool constantTimeEquals(String a, String b) {
+  final aLen = a.length;
+  final bLen = b.length;
+  var diff = aLen ^ bLen;
+  final min = aLen < bLen ? aLen : bLen;
+  for (var i = 0; i < min; i++) {
+    diff |= a.codeUnitAt(i) ^ b.codeUnitAt(i);
+  }
+  return diff == 0;
+}

From e54ef21f56bf2dd98fe19b4c980901e1f136eb98 Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 22:37:28 +0800
Subject: [PATCH 62/64] Add unit tests for crypto hygiene and password strength
 checks

---
 test/crypto_hygiene_test.dart | 45 +++++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)
 create mode 100644 test/crypto_hygiene_test.dart

diff --git a/test/crypto_hygiene_test.dart b/test/crypto_hygiene_test.dart
new file mode 100644
index 0000000..85e8776
--- /dev/null
+++ b/test/crypto_hygiene_test.dart
@@ -0,0 +1,45 @@
+import 'package:flutter_test/flutter_test.dart';
+import 'package:locker/services/auth_service.dart';
+import 'package:locker/utils/secure_compare.dart';
+
+void main() {
+  group('constantTimeEquals', () {
+    test('equal strings match', () {
+      expect(constantTimeEquals('abc123', 'abc123'), isTrue);
+    });
+
+    test('different strings do not match', () {
+      expect(constantTimeEquals('abc123', 'abc124'), isFalse);
+    });
+
+    test('different lengths do not match', () {
+      expect(constantTimeEquals('abc', 'abcd'), isFalse);
+    });
+
+    test('empty strings match', () {
+      expect(constantTimeEquals('', ''), isTrue);
+    });
+  });
+
+  group('AuthService.validatePasswordStrength', () {
+    test('rejects below minimum length', () {
+      expect(AuthService.validatePasswordStrength('Ab1!'),
+          PasswordStrength.tooShort);
+    });
+
+    test('flags short single-class as weak', () {
+      expect(AuthService.validatePasswordStrength('abcdefgh'),
+          PasswordStrength.weak);
+    });
+
+    test('accepts short multi-class', () {
+      expect(AuthService.validatePasswordStrength('Abcd1234'),
+          PasswordStrength.acceptable);
+    });
+
+    test('accepts long single-class passphrase', () {
+      expect(AuthService.validatePasswordStrength('longpassphraseonly'),
+          PasswordStrength.acceptable);
+    });
+  });
+}

From 393c1a5049a24ec8cd572e9f1a90ce2ee255533f Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 22:50:10 +0800
Subject: [PATCH 63/64] Add password vault integration to gallery screen

---
 lib/screens/gallery_vault_screen.dart | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/lib/screens/gallery_vault_screen.dart b/lib/screens/gallery_vault_screen.dart
index 1c040f4..0e03f4d 100644
--- a/lib/screens/gallery_vault_screen.dart
+++ b/lib/screens/gallery_vault_screen.dart
@@ -35,7 +35,9 @@ import 'camera_screen.dart';
 import 'audio_recorder_screen.dart';
 import 'vault_settings_screen.dart';
 import 'note_editor_screen.dart';
+import 'password_editor_screen.dart';
 import '../providers/note_providers.dart';
+import '../providers/password_providers.dart';
 import '../widgets/operation_progress_sheet.dart';
 import '../widgets/media_hold_action_sheet.dart';
 import '../widgets/media_multi_select_action_sheet.dart';
@@ -1148,6 +1150,7 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
       currentFiles: filesAsync.value ?? [],
       onUnsupported: () => _showFileOptionsSheet(file),
       onOpenNote: (noteId) => _openNoteFromVault(noteId),
+      onOpenPassword: (passwordId) => _openPasswordFromVault(passwordId),
     );
   }
 
@@ -1166,6 +1169,21 @@ class _GalleryVaultScreenState extends ConsumerState<GalleryVaultScreen>
     });
   }
 
+  void _openPasswordFromVault(String passwordId) {
+    final passwordsAsync = ref.read(passwordsNotifierProvider);
+    passwordsAsync.whenData((passwords) {
+      final entry = passwords.where((p) => p.id == passwordId).firstOrNull;
+      if (entry != null && mounted) {
+        Navigator.push(
+          context,
+          MaterialPageRoute(
+            builder: (_) => PasswordEditorScreen(entry: entry),
+          ),
+        );
+      }
+    });
+  }
+
   /// Show options for files that don't have a preview
   void _showFileOptionsSheet(VaultedFile file) {
     showModalBottomSheet(

From f24e4cedb230edfb001ae3286918e72b1c3c76ae Mon Sep 17 00:00:00 2001
From: ultraelectronica <fyketonel@gmail.com>
Date: Sat, 20 Jun 2026 22:50:14 +0800
Subject: [PATCH 64/64] Add onOpenPassword callback to FileOpenService

---
 lib/services/file_open_service.dart | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/lib/services/file_open_service.dart b/lib/services/file_open_service.dart
index fe843c2..e529072 100644
--- a/lib/services/file_open_service.dart
+++ b/lib/services/file_open_service.dart
@@ -26,6 +26,7 @@ class FileOpenService {
   /// used to build the swipeable gallery context for images and videos.
   /// [onUnsupported] is called when the file has no built-in viewer.
   /// [onOpenNote] is called when the vault entry represents a note.
+  /// [onOpenPassword] is called when the vault entry represents a password.
   static Future<void> open(
     BuildContext context,
     WidgetRef ref,
@@ -33,6 +34,7 @@ class FileOpenService {
     required List<VaultedFile> currentFiles,
     VoidCallback? onUnsupported,
     ValueChanged<String>? onOpenNote,
+    ValueChanged<String>? onOpenPassword,
   }) async {
     if (_isOpening) return;
     if (!context.mounted) return;
@@ -97,6 +99,17 @@ class FileOpenService {
         return;
       }
 
+      final passwordId = file.metadata?['passwordId'] as String?;
+      if (passwordId != null) {
+        hideOverlay();
+        if (onOpenPassword != null) {
+          onOpenPassword(passwordId);
+        } else {
+          onUnsupported?.call();
+        }
+        return;
+      }
+
       final vaultService = ref.read(vaultServiceProvider);
       final needsDecryption = file.isEncrypted && file.encryptionIv != null;