Harden SDK compatibility and lifecycle reliability

[wiresock]

Summary

• align direct wgbooster.dll profile handling with the latest WireSock SDK parser, including UTF-8 BOMs, blank routing-list tokens, strict CIDR prefixes, and the current pinned SDK revision
• harden refresh cancellation ownership, timed-out native cleanup finalization, transaction recovery bounds, X25519 peer-key validation, process path lookup, and Windows resource loading
• add focused regressions and document migration behavior and bounded-directory limits

Production-readiness findings addressed

• Medium - SDK compatibility: accepted the SDK's leading UTF-8 BOM and benign blank route tokens while continuing to reject malformed nonblank routes and incompatible UTF-16/UTF-32 encodings
• Medium - lifecycle reliability: eliminated cancellation-token disposal races and guaranteed native cleanup state is finalized even when recovery handling fails
• Medium - bounded recovery: count every profile-directory entry, including subdirectories, during catalog and transaction recovery scans
• Medium - cryptographic correctness: reject RFC 7748 all-zero X25519 shared secrets from low-order peer public keys
• Low - validation/interoperability: reject signed or non-decimal CIDR prefixes and return false for null input instead of throwing
• Low - native robustness/security: grow process-image buffers for long paths and load icon DLLs as Unicode resource-only images rather than executable modules

The elevated direct-DLL architecture remains unchanged; this does not introduce or depend on the modern service.

Verification

• full WireSockUI.Tests suite passed repeatedly; one pre-existing symbolic-link test was skipped because link creation is unavailable in this environment
• warnings-as-errors x64 solution build passed with 0 warnings and 0 errors
• dotnet format ... --verify-no-changes passed
• all 6 publish combinations passed: Release / Release UWP x AnyCPU / x64 / ARM64
• pinned and current local SDK contract checks passed with 24 exports
• upstream latest revision rechecked as a5183451c62b42abe0a5fb67be215bb5a9375603
• final branch refreshed against current origin/main; no merge conflict or stale-base delta

Migration and remaining risk

• UTF-8 BOM profiles now load; UTF-16 and UTF-32 remain unsupported
• blank items in Address, AllowedIPs, and DisallowedIPs are ignored like the SDK; malformed nonblank items still fail closed
• the 1,024-entry profile cap now includes directories as well as files
• real driver/network lifecycle smoke remains environment-specific and is delegated to the elevated wiresock-sdk CI runners

[gemini-code-assist]

Code Review

This pull request introduces several robustness improvements, bug fixes, and compatibility updates to align with the current WireSock SDK. Key changes include accepting UTF-8 BOM configurations, ignoring empty comma-separated items in routing lists, preventing exceptions on malformed IP inputs, dynamically resizing buffers for long process image paths, and improving resource loading safety. Additionally, it fixes cancellation token disposal in TaskManager, ensures native cleanup runs in frmMain, and bounds directory traversals to include subdirectories when enforcing catalog limits. No review comments were provided, so there is no additional feedback to assess.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[Copilot]

Pull request overview

This PR hardens WireSockUI’s compatibility with the current WireSock SDK contract and improves reliability around lifecycle cleanup, profile directory bounding, validation behavior, and native interop robustness.

Changes:

• Updated config parsing/validation to match SDK behavior (accept UTF-8 BOM; ignore blank routing-list tokens; stricter CIDR prefix parsing; reject malformed inputs safely).
• Hardened reliability/interop paths (timed-out cleanup finalization, cancellation ownership, X25519 all-zero shared-secret rejection, long process-image path lookup, safer Windows icon DLL loading).
• Added/updated targeted regressions, documentation, and bumped the pinned SDK revision snapshot.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
WireSockUI/Native/WireguardConfigParser.cs	Accept UTF-8 BOM while still rejecting incompatible BOMs/encodings.
WireSockUI/Native/WindowsIcons.cs	Load icon resources via LoadLibraryEx as resource-only, add bounds checks.
WireSockUI/Native/ProcessList.cs	Grow QueryFullProcessImageName buffers for long paths; make class static.
WireSockUI/Native/IPHelper.cs	Reject null/whitespace safely; strict decimal CIDR prefix parsing.
WireSockUI/Forms/TaskManager.cs	Adjust refresh cancellation ownership/disposal to reduce races.
WireSockUI/Forms/frmMain.cs	Ensure native cleanup finalization even on failure paths.
WireSockUI/Config/ProfileFileTransaction.cs	Bound scans by counting all directory entries; enumerate files safely.
WireSockUI/Config/Profile.cs	Ignore blank route tokens for specific keys; count all directory entries in catalog.
WireSockUI/Config/Curve25519.cs	Reject all-zero X25519 shared secrets from low-order peer keys.
WireSockUI.Tests/Program.cs	Add regressions for BOM handling, blank routing tokens, CIDR validation, bounded recovery, X25519 all-zero secret.
sdk-contract/SDK_REVISION	Update pinned SDK revision hash.
README.md	Document UTF-8 BOM acceptance, blank routing token behavior, and bounded directory entry semantics.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated no new comments.