FileKeySource rejected any key file whose mode had group or other bits,
but Windows has no such bits: Stat reports every writable file as 0666.
On the Windows builds release.yml ships, the key file therefore never
loaded, not even one written 0600, and only XUI_NODE_TOKEN_KEY could
supply a key. The mode check now applies off Windows only, the stance
the DB permission tests already take; there the file's NTFS ACL guards
it, and env-vars.mdx says so in all four locales.
The load test is split so the half that must hold everywhere, an
owner-only file loading, also runs on Windows, and the rejection half
asserts the exact error instead of any error.
* fix(nodetoken): make the corrupt-ciphertext test corrupt deterministically
The test replaced the last two characters of the base64 body with "AA", which
can decode to the very same bytes: the body is RawURLEncoding of a 31-byte
blob, so the final character carries only 2 significant bits and the decoded
value is unchanged whenever the tag's last byte is 0x00. Measured over 50000
encryptions, 170 of those edits corrupted nothing — about one run in three
hundred fails for a reason that has nothing to do with the codec.
Flipping a bit of the decoded blob always changes the ciphertext, so the test
now pins the fallback behavior instead of the encoder's tail padding.
* style(nodetoken): trim the helper comment to the two-line limit
CLAUDE.md caps a committed Go comment block at two lines; the why fits.
* feat(pia): add login-and-add WireGuard outbounds (#2)
* fix(pia): keep PIA outbounds identifiable after the editor strips hostname
The outbound editor drops piaHostname, so last-segment matching failed for hyphenated servers. Identify rows by the computed tag, re-encrypt stored tokens onto the active key, skip unusable catalog rows, and always release the catalog refresh latch.
MHSanaei