Harden direct SDK integration and production readiness

[wiresock]

Summary

• keep WireSockUI on the direct wgbooster.dll SDK architecture while updating handle creation/release, network-lock, error-sentinel, and DLL-loading behavior for the current SDK
• serialize native tunnel operations and harden connect timeout, disconnect, shutdown, dropped-handle retry, unexpected-stop, and manual Kill Switch recovery state transitions
• move privileged profiles/runtime data to hardened ProgramData storage, quarantine legacy profiles for explicit review, and reject reparse points, unsafe hard links, mutable SDK paths, and unowned autorun definitions
• align parsing and validation with the current SDK, including last-section-wins behavior and Amnezia 2.0 H1-H4 ranges, S1-S4 limits, J fields, Id, Ip, and Ib
• add bounded redacted diagnostics, stronger toast/COM cleanup, settings rollback, pinned CI/release actions, signed release packaging, SBOM/checksums/attestations, tests, and migration documentation

Verification

• focused harness: 86 scenarios completed locally (85 passed; the file-symlink case was skipped because this Windows session cannot create that link type; equivalent hard-link and handle-based cleanup tests passed)
• dotnet build for x64 Release and Release UWP: 0 warnings, 0 errors
• dotnet publish for AnyCPU, x64, and ARM64, in both Release and Release UWP
• dotnet format WireSockUI.sln whitespace --verify-no-changes --no-restore
• workflow YAML syntax validation
• direct and transitive NuGet vulnerability audit: no known vulnerable packages
• git diff --check

Compatibility and migration

• this PR intentionally does not integrate with the newer Secure Connect service API; WireSockUI continues to use the SDK/minimal installation and wgbooster.dll directly
• WireSockUI remains administrator-only, matching Secure Connect v3 driver-interface requirements
• legacy per-user profiles are staged under ProgramData and require explicit review before promotion

Remaining runtime validation

Actual driver and wgbooster.dll operation still requires validation on a Windows machine with the current SDK/minimal installation and matching architecture.

[gemini-code-assist]

Code Review

This pull request introduces significant security and robustness enhancements to WireSockUI, including a secure file system layer (SecureFileSystem) to prevent reparse-point exploits, a quarantined legacy profile migration workflow, a secure rolling trace listener with credential redaction, and a TunnelSessionCoordinator to manage state transitions. The review feedback highlights two important issues: first, SecureFileSystem.OpenDirectoryChain may throw an unhandled IOException on systems with folder redirection (e.g., redirected AppData), which should be caught gracefully to prevent application failures; second, calling Marshal.FinalReleaseComObject within a finalizer is a dangerous anti-pattern in .NET and should be restricted to explicit disposal.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[Copilot]

Pull request overview

This PR hardens WireSockUI’s direct wgbooster.dll SDK integration and production posture by serializing native operations, tightening handle lifecycle management/recovery behaviors, and moving privileged runtime data (profiles/diagnostics/migration state) into secured ProgramData storage with stronger filesystem and autorun validation.

Changes:

• Refactors native tunnel handle creation/release and adds dropped-handle quarantine + serialized native operations.
• Introduces hardened filesystem primitives, secure rolling diagnostics (with redaction), and quarantined legacy-profile staging/review.
• Tightens UI/session coordination around timeouts, unexpected stops, recovery mode, and Kill Switch reset behavior; updates CI/release workflows and documentation.

Reviewed changes

Copilot reviewed 26 out of 29 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
WireSockUI/WireSockManager.cs	Serializes native calls; updates handle lifecycle and dropped-handle quarantine.
WireSockUI/Properties/Resources.resx	Adds/updates user-facing strings for new states/diagnostics.
WireSockUI/Program.cs	Adds secure diagnostics init, unhandled exception handlers, legacy profile staging.
WireSockUI/Notifications/Notifications.cs	Hardens toast icon handling; improves activation behavior and logging.
WireSockUI/Native/WireguardConfigParser.cs	Aligns parsing with SDK “last section wins” semantics.
WireSockUI/Native/WireguardBoosterExports.cs	Updates exports for new handle APIs; tightens log decoding bounds.
WireSockUI/Native/WindowsApplicationContext.cs	Hardens shortcut creation/cleanup with secure filesystem handling.
WireSockUI/Native/ShellLink.cs	Hardens COM cleanup and HRESULT handling; seals disposal pattern.
WireSockUI/Native/SecureFileSystem.cs	New: handle-based path validation and secure delete/ACL operations.
WireSockUI/Native/ProcessList.cs	Minor interop marshaling formatting change.
WireSockUI/Native/IWireSockNativeApi.cs	Updates native API interface for create/release handle split.
WireSockUI/Native/CommonControlExtensions.cs	Minor interop marshaling formatting change.
WireSockUI/Global.cs	Adds ProgramData-backed diagnostics/migration folders and secure ACL application via handles.
WireSockUI/Forms/TunnelSessionCoordinator.cs	New: coordinates tunnel generations, recovery, cleanup, and operation gating.
WireSockUI/Forms/TaskManager.cs	Preserves executable match names for process-based rules; fixes identity disposal.
WireSockUI/Forms/frmSettings.cs	Hardens autorun task/shortcut ownership checks and adds rollback logic.
WireSockUI/Forms/frmMain.cs	Adds indeterminate/recovery flows, unexpected stop handling, and legacy-profile review UI.
WireSockUI/Forms/frmEdit.cs	Supports editing quarantined legacy profiles from alternate source paths.
WireSockUI/Extensions/TimeExtensions.cs	Adds handshake-age formatting for missing handshake sentinel.
WireSockUI/Diagnostics/SecureRollingTraceListener.cs	New: bounded, ACL-hardened, redacted rolling diagnostics.
WireSockUI/Config/PersistedSettingTransaction.cs	New: transactional persisted-setting update helper with rollback.
WireSockUI/Config/LegacyProfileMigrationService.cs	New: stages legacy profiles into quarantine for explicit review.
WireSockUI/Config/Curve25519.cs	Formatting/indentation correction in core loop.
WireSockUI.Tests/Program.cs	Adds/updates tests for new hardening, migration, logging, and native lifecycle behaviors.
sign/sign-update-release.ps1	Removes legacy manual signing/upload script.
README.md	Updates migration, recovery, diagnostics, and release documentation.
.github/workflows/main.yml	Pins actions; adds signing/SBOM/checksums/attestations and improved release publishing.
.github/workflows/ci.yml	Pins actions; adds restore/format verification; stabilizes test invocation.
.editorconfig	Adds baseline formatting rules for repo.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 26 out of 29 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 26 out of 29 changed files in this pull request and generated no new comments.