[CodingDiego]

The audit round before 1.0.0. It fixes what five read-throughs of the whole program, a live round on Windows 11 and a last review of this change found, and it makes the sidebar's Favorites behave like Explorer's.

What changes for a user

• Sidebar. Favorites lists the folders pinned to Home first, each marked with a pin, then the frequent folders. Quick Access's recent files are no longer listed (a .zip among them has the shell's folder flag and showed up as a stale row). Right-click gives Unpin from Home, Pin to Home and Remove from Home.
• Win+E. With rexplorer registered, Win+E opened Windows Explorer on Windows 11 build 26300. The desktop helper now takes Win+E itself.
• Uninstall. --uninstall asks first (not with --quiet) and removes only rexplorer's own empty folders.
• Crash recovery. A tab that was still loading when rexplorer crashed opens Home, so a folder that crashes it is not opened again. Sign-out saves the session and the window placement.
• Archives. Thumbnails of pictures in a .rar are limited to 256 MB of extracted data per folder view, and a solid archive gets none.
• Icon. A flat orange crab with a white R of its own shape.

Security

SECURITY.md lists every finding under 2026-11-14. The main ones:

• A file list dropped by another program is parsed with bounds and a count limit.
• A private window message is accepted only while this thread is sending that message to that window.
• Windows Terminal arguments escape ; and refuse quotes and control characters.
• The elevated restart names its exe explicitly, and --desktop-icons never stays elevated.
• After an Explorer switch such as /select,, later - options are read as paths. A program that starts explorer.exe /select,<path> without quotes could otherwise be made to pass --uninstall --quiet by a file named that way.
• Every GitHub Action is pinned to a commit. The release build job cannot write to the repository; a separate publish job attests the files' build provenance.

Tests

• The helper that answers the shell's copy conflict dialog also answers Windows' older dialog, which appeared in one run and left it waiting for a person. A new test forces that dialog.
• The tests that drive the shell's own UI (folder tree, context menus, file operations) run one at a time, and a tree test dispatches its pending messages before it destroys the control (Reliability: one core test run in 60 died inside Windows' DUI70.dll #94).
• scripts/smoke.ps1 answers the new uninstall question. scripts/soak.ps1 no longer deletes its own keep file (Reliability: Soak test #29).

Verified on this tree

• RUSTFLAGS='-D warnings' cargo build --release --locked --all-targets: passed.
• cargo test --release --locked, three runs: app 282, core 272, data operations 12, no failures.
• cargo clippy --workspace --all-targets --locked -- -D warnings: passed.
• scripts\smoke.ps1 -Hosted: 0 failed, 8 skipped (the checks that need real input or the user's own shell state).
• scripts\ftp-check.ps1 and scripts\budgets.ps1: passed.
• The core test binary 200 times in a row: 200 passed, no crash (Reliability: one core test run in 60 died inside Windows' DUI70.dll #94). The original crash was never traced.
• A security review of the whole diff against a 15-point checklist: one low finding (the /select, one above), fixed here.

Live round on the final build (2026-11-14)

Real input was sent only to a test window on a scratch profile, while it was in front and under the pointer.

• scripts\smoke.ps1 -UserState, the real-input checks (Win-key hotkey, pin and unpin through the sidebar menu, a drag inside the list, the share sheet, the /select, and /e, forms, hand-off): 8 passed, 0 failed.
• Win+E with the desktop helper running: a Home tab opened in the test window, Windows Explorer opened nothing, Start stayed closed (1 of 1).
• Drags from Home: a tile and a recent-file row each showed their icon under the pointer; five drags, each cancelled with Esc, moved nothing.
• One drag of a scratch file onto a WhatsApp chat: WhatsApp showed its attachment preview with the file. The preview was discarded and nothing was sent (File list: dragging an item out of the list never starts a drag #75).
• --desktop-icons ran for the first time. It showed eight profile folders the desktop never shows (Downloads, Documents, the user's folder, a linked phone); fixed here with a test. It follows a file appearing and going in about 1.5 s.

Not verified

• With rexplorer registered on a real profile, Win+E has not been pressed again after the fix: that needs this build installed.
• The shortcut arrow after a real display scale change (a Windows setting).
• The desktop icons view's menu, rename, delete and drops.
• The Quick Access verbs behind Pin to Home and Remove from Home were read from the shell, and Unpin was clicked; Pin on a frequent folder and Remove were not clicked.

Refs #18, #20, #29, #33, #54, #65, #68, #71, #94.