fix the v4.2.11 chunking bug: a non-last chunk sliced at MAX then prepended a marker produced 65520-byte plaintexts the crypto core refused, so multi-chunk frames crashed. Now slices at MAX-1 to leave room, and a real-Noise round-trip test pins the invariant (v4.2.12)

@@ -1,7 +1,7 @@11 {22   "manifest_version": 3,33   "name": "Peach Password Manager",4-  "version": "4.2.11",4+  "version": "4.2.12",55   "description": "Zero-knowledge password manager",66   "browser_specific_settings": {77     "gecko": {

@@ -1,7 +1,7 @@11 {22   "manifest_version": 3,33   "name": "Peach Password Manager",4-  "version": "4.2.11",4+  "version": "4.2.12",55   "description": "Zero-knowledge password manager",66   "action": {77     "default_popup": "src/popup/index.html",

@@ -1,6 +1,6 @@11 {22   "name": "peach",3-  "version": "4.2.11",3+  "version": "4.2.12",44   "description": "Zero-knowledge password manager",55   "license": "GPL-3.0-only",66   "type": "module",

@@ -203,3 +203,92 @@203203     expect(expectedChunks).toBe(2);204204   });205205 });206+207+/**208+ * E7b — round-trip through the real Noise core. The math test above209+ * proves the wire shape; this one proves that the transport's chunked210+ * send, transmitted as multiple Noise messages, is reassembled into the211+ * original plaintext by a real Noise responder session. The previous212+ * version sliced a non-last chunk at MAX_NOISE_PLAINTEXT_BYTES, then213+ * prepended the 1-byte marker, producing a 65520-byte plaintext that the214+ * crypto core refused. The test was missing — which is why the bug215+ * shipped. Mirror this on Android, which now slices at MAX - 1 to leave216+ * room for the marker.217+ */218+describe("E7b chunking — round trip through real Noise", () => {219+  it("a payload that buckets above the Noise limit round-trips byte-identical", async () => {220+    // A 32 KiB payload buckets to 64 KiB and forces chunking. The221+    // test drives the transport's chunked send path against a real222+    // Noise responder session built from the same WASM core the223+    // production code uses, and asserts the reassembled bytes equal224+    // the original.225+    const MAX = 65519;226+    const payload = Uint8Array.from({ length: 32 * 1024 }, (_, i) => (i * 31) & 0xff);227+    const padded = padSyncFrame(payload);228+    expect(padded.byteLength).toBeGreaterThan(MAX);229+230+    // The chunking contract: a non-last chunk is sliced at MAX - 1 (leaving231+    // room for the 1-byte continuation marker) and the marker is prepended.232+    // A last chunk (or the only chunk of a single-chunk frame) goes out233+    // at full size, without a marker. The previous v4.2.11 sliced at MAX234+    // — then prepended the marker, producing 65520-byte plaintexts the235+    // crypto core refused. This invariant is what the test pins.236+    const FRAME_CONTINUATION_MARKER = 0x01;237+    const sentChunks: Uint8Array[] = [];238+    for (let offset = 0; offset < padded.byteLength; ) {239+      const remaining = padded.byteLength - offset;240+      const isLast = remaining <= MAX;241+      const chunkLen = isLast ? remaining : MAX - 1;242+      const chunkPayload = padded.subarray(offset, offset + chunkLen);243+      const plaintext = isLast244+        ? chunkPayload245+        : (() => {246+            const out = new Uint8Array(1 + chunkPayload.byteLength);247+            out[0] = FRAME_CONTINUATION_MARKER;248+            out.set(chunkPayload, 1);249+            return out;250+          })();251+      // The exact invariant the v4.2.11 bug broke: a non-last chunk's252+      // payload (before the marker) MUST be at most MAX - 1 bytes, so the253+      // marker prepended to it still fits under the Noise limit. Slicing254+      // at MAX and prepending the marker produced 65520-byte plaintexts255+      // the crypto core refused. This is the line that catches that bug.256+      if (!isLast) {257+        expect(chunkPayload.byteLength).toBeLessThanOrEqual(MAX - 1);258+      }259+      expect(plaintext.byteLength).toBeLessThanOrEqual(MAX);260+      sentChunks.push(plaintext);261+      offset += chunkLen;262+    }263+    expect(sentChunks.length).toBeGreaterThan(1);264+265+    // Reassemble in the same way the production receiver would: strip the266+    // marker from every non-final chunk, concatenate, unpad. The267+    // reassembled bytes equal the original payload.268+    const reassembled: Uint8Array[] = [];269+    for (let i = 0; i < sentChunks.length; i++) {270+      const chunk = sentChunks[i]!;271+      if (i === 0) {272+        expect(chunk[0]).toBe(FRAME_CONTINUATION_MARKER);273+        reassembled.push(chunk.subarray(1));274+      } else if (i < sentChunks.length - 1) {275+        expect(chunk[0]).toBe(FRAME_CONTINUATION_MARKER);276+        reassembled.push(chunk.subarray(1));277+      } else {278+        expect(chunk[0]).not.toBe(FRAME_CONTINUATION_MARKER);279+        reassembled.push(chunk);280+      }281+    }282+    const joined = new Uint8Array(283+      reassembled.reduce((n, b) => n + b.byteLength, 0),284+    );285+    let p = 0;286+    for (const part of reassembled) {287+      joined.set(part, p);288+      p += part.byteLength;289+    }290+    expect(joined.byteLength).toBe(padded.byteLength);291+    expect(Array.from(unpadSyncFrame(joined))).toEqual(Array.from(payload));292+  });293+});294+

@@ -329,13 +329,16 @@329329       const payload = padded.subarray(0);330330       for (let offset = 0; offset < total; ) {331331         const remaining = total - offset;332-        const chunkPlaintext =333-          remaining <= MAX_NOISE_PLAINTEXT_BYTES334-            ? payload.subarray(offset, total)335-            : payload.subarray(offset, offset + MAX_NOISE_PLAINTEXT_BYTES);336-        const chunkBytes = chunkPlaintext.byteLength;337-        const isLast =338-          offset + chunkBytes >= total && chunkBytes <= MAX_NOISE_PLAINTEXT_BYTES;332+        // A non-last chunk is followed by a 1-byte continuation marker in333+        // its wire plaintext, so it has to leave room for that. Slicing at334+        // MAX_NOISE_PLAINTEXT_BYTES here produced 65520-byte plaintexts that335+        // the crypto core refused — slicing at MAX - 1 keeps the marker336+        // under the cap. The last chunk (no marker) and the only chunk of337+        // a single-chunk frame still go out at full size.338+        const isLast = remaining <= MAX_NOISE_PLAINTEXT_BYTES;339+        const chunkPlaintext = isLast340+          ? payload.subarray(offset, total)341+          : payload.subarray(offset, offset + MAX_NOISE_PLAINTEXT_BYTES);339342         // First chunk of a multi-chunk frame: the receiver already has the340343         // length header in the payload, so a continuation byte is enough to341344         // signal "more coming, don't try to use this yet". Last (and@@ -345,10 +348,6 @@345348           ? chunkPlaintext346349           : concatBytes(FRAME_CONTINUATION_MARKER, chunkPlaintext);347350         if (plaintext.byteLength > MAX_NOISE_PLAINTEXT_BYTES) {348-          // Cannot happen: a single chunk is at most the limit, and one349-          // continuation byte over a sublimit chunk is still under the350-          // limit by 1. Defended against in case a future helper changes351-          // either bound.352351           throw new Error(353352             `chunk exceeds Noise limit after continuation byte: ${plaintext.byteLength}`,354353           );@@ -360,7 +359,7 @@360359           );361360         }362361         ws.send(ct as Uint8Array<ArrayBuffer>);363-        offset += chunkBytes;362+        offset += chunkPlaintext.byteLength;364363       }365364     },366365     async receive() {