vaultic.py

"""
Vaultic v1.0
- Cross-platform (Windows/Linux/Mac)
- Drag & Drop support
- 2FA/TOTP support
- Secure key derivation (separate verify/encrypt)
"""

import os
import sys
import json
import uuid
import base64
import secrets
import hashlib
import struct
import platform
import webbrowser
import tkinter as tk
from tkinter import filedialog, ttk
from datetime import datetime
from io import BytesIO

# Cryptography imports
from cryptography.fernet import Fernet
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
from cryptography.hazmat.primitives.ciphers.aead import AESGCM, ChaCha20Poly1305
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.backends import default_backend

# 2FA imports
import pyotp
import qrcode
from PIL import Image, ImageTk

# Drag & Drop - works in Python, may fail in .exe (tkdnd library issues)
try:
    from tkinterdnd2 import TkinterDnD, DND_FILES
    DND_AVAILABLE = True
except (ImportError, RuntimeError):
    DND_AVAILABLE = False
    TkinterDnD = None
    DND_FILES = None

# Platform detection
IS_WINDOWS = platform.system() == "Windows"
IS_MACOS = platform.system() == "Darwin"
IS_LINUX = platform.system() == "Linux"

# Dark theme colors
DARK_BG = "#1e1e1e"
DARK_BG2 = "#252526"
DARK_BG3 = "#2d2d30"
DARK_FG = "#ffffff"
DARK_FG2 = "#cccccc"
DARK_ACCENT = "#0078d4"
DARK_ACCENT_HOVER = "#1a88e0"
DARK_BORDER = "#3c3c3c"
DARK_ENTRY_BG = "#3c3c3c"
DARK_SELECT_BG = "#094771"

# Colors for message types
MSG_ERROR_COLOR = "#ff4444"
MSG_WARNING_COLOR = "#ffaa00"
MSG_INFO_COLOR = "#4ecdc4"
MSG_SUCCESS_COLOR = "#44dd44"

# Config
CONFIG_FILE = ".crypter_config"
ENCRYPTED_EXT = ".enc"  # Encrypted files (filename hidden inside)
RECOVERY_KEY_LENGTH = 32
CONFIG_VERSION = 2  # Version 2 = secure key derivation

# Encryption algorithms
ENCRYPTION_ALGORITHMS = {
    "AES-256-GCM": {"name": "AES-256-GCM", "description": "Gold standard, authenticated (Recommended)", "key_size": 32},
    "AES-256-CBC": {"name": "AES-256-CBC", "description": "Classic AES, widely compatible", "key_size": 32},
    "ChaCha20-Poly1305": {"name": "ChaCha20-Poly1305", "description": "Modern, fast on ARM devices", "key_size": 32},
    "AES-128-GCM": {"name": "AES-128-GCM", "description": "Fast, very secure", "key_size": 16},
    "Fernet": {"name": "Fernet", "description": "Simple, AES-128-CBC based", "key_size": 32},
}
DEFAULT_ALGORITHM = "AES-256-GCM"


# =============================================================================
# PLATFORM-SPECIFIC UTILITIES
# =============================================================================

def set_dark_title_bar(window):
    """Set dark title bar - Windows only."""
    if IS_WINDOWS:
        try:
            import ctypes
            window.update()
            hwnd = ctypes.windll.user32.GetParent(window.winfo_id())
            ctypes.windll.dwmapi.DwmSetWindowAttribute(
                hwnd, 20, ctypes.byref(ctypes.c_int(1)), ctypes.sizeof(ctypes.c_int(1))
            )
        except Exception:
            pass


def set_file_hidden(filepath: str, hidden: bool = True):
    """Set file as hidden - platform specific."""
    if IS_WINDOWS:
        try:
            import ctypes
            attrs = 2 if hidden else 0  # FILE_ATTRIBUTE_HIDDEN = 2
            ctypes.windll.kernel32.SetFileAttributesW(filepath, attrs)
        except Exception:
            pass
    # On Unix, files starting with . are hidden by default (config already starts with .)


def safe_remove(filepath: str, retries: int = 3, delay: float = 0.5) -> bool:
    """Safely remove a file with retries."""
    import time
    for i in range(retries):
        try:
            os.remove(filepath)
            return True
        except PermissionError:
            if i < retries - 1:
                time.sleep(delay)
            else:
                # Windows: mark for deletion on reboot
                if IS_WINDOWS:
                    try:
                        import ctypes
                        ctypes.windll.kernel32.MoveFileExW(filepath, None, 4)
                    except Exception:
                        pass
                return False
        except Exception:
            return False
    return False


# =============================================================================
# SECURE KEY DERIVATION (Version 2)
# =============================================================================

class SecureKeyDerivation:
    """
    Secure key derivation with separate keys for verification and encryption.

    SECURITY: The verify_hash is stored in config, but encryption_key is NEVER stored.
    Even if someone gets the config file, they cannot decrypt files without the password.
    """

    ITERATIONS = 100000

    @staticmethod
    def derive_verify_hash(password: str, salt: bytes) -> str:
        """Derive hash for password verification only. This IS stored in config."""
        kdf = PBKDF2HMAC(
            algorithm=hashes.SHA256(),
            length=32,
            salt=salt + b"_verify_v2",  # Different salt suffix for verify
            iterations=SecureKeyDerivation.ITERATIONS,
        )
        key = kdf.derive(password.encode())
        return base64.urlsafe_b64encode(key).decode()

    @staticmethod
    def derive_encryption_key(password: str, salt: bytes) -> bytes:
        """Derive key for encryption. This is NEVER stored anywhere."""
        kdf = PBKDF2HMAC(
            algorithm=hashes.SHA256(),
            length=32,
            salt=salt + b"_encrypt_v2",  # Different salt suffix for encryption
            iterations=SecureKeyDerivation.ITERATIONS,
        )
        return kdf.derive(password.encode())

    @staticmethod
    def verify_password(password: str, salt: bytes, stored_hash: str) -> bool:
        """Verify password against stored hash."""
        computed = SecureKeyDerivation.derive_verify_hash(password, salt)
        return secrets.compare_digest(computed, stored_hash)


# =============================================================================
# ENCRYPTION MANAGER
# =============================================================================

class EncryptionManager:
    """Manages multiple encryption algorithms."""

    @staticmethod
    def get_algorithms() -> list:
        return list(ENCRYPTION_ALGORITHMS.keys())

    @staticmethod
    def get_algorithm_info(algorithm: str) -> dict:
        return ENCRYPTION_ALGORITHMS.get(algorithm, ENCRYPTION_ALGORITHMS[DEFAULT_ALGORITHM])

    @staticmethod
    def encrypt(data: bytes, key: bytes, algorithm: str) -> bytes:
        """Encrypt data using specified algorithm."""
        if algorithm == "Fernet":
            fernet_key = base64.urlsafe_b64encode(key[:32])
            f = Fernet(fernet_key)
            return f.encrypt(data)

        elif algorithm == "AES-256-GCM":
            nonce = os.urandom(12)
            aesgcm = AESGCM(key[:32])
            ciphertext = aesgcm.encrypt(nonce, data, None)
            return nonce + ciphertext

        elif algorithm == "AES-128-GCM":
            nonce = os.urandom(12)
            aesgcm = AESGCM(key[:16])
            ciphertext = aesgcm.encrypt(nonce, data, None)
            return nonce + ciphertext

        elif algorithm == "ChaCha20-Poly1305":
            nonce = os.urandom(12)
            chacha = ChaCha20Poly1305(key[:32])
            ciphertext = chacha.encrypt(nonce, data, None)
            return nonce + ciphertext

        elif algorithm == "AES-256-CBC":
            iv = os.urandom(16)
            padding_len = 16 - (len(data) % 16)
            padded_data = data + bytes([padding_len] * padding_len)
            cipher = Cipher(algorithms.AES(key[:32]), modes.CBC(iv), backend=default_backend())
            encryptor = cipher.encryptor()
            ciphertext = encryptor.update(padded_data) + encryptor.finalize()
            return iv + ciphertext

        else:
            raise ValueError(f"Unknown algorithm: {algorithm}")

    @staticmethod
    def decrypt(data: bytes, key: bytes, algorithm: str) -> bytes:
        """Decrypt data using specified algorithm."""
        if algorithm == "Fernet":
            fernet_key = base64.urlsafe_b64encode(key[:32])
            f = Fernet(fernet_key)
            return f.decrypt(data)

        elif algorithm == "AES-256-GCM":
            nonce, ciphertext = data[:12], data[12:]
            aesgcm = AESGCM(key[:32])
            return aesgcm.decrypt(nonce, ciphertext, None)

        elif algorithm == "AES-128-GCM":
            nonce, ciphertext = data[:12], data[12:]
            aesgcm = AESGCM(key[:16])
            return aesgcm.decrypt(nonce, ciphertext, None)

        elif algorithm == "ChaCha20-Poly1305":
            nonce, ciphertext = data[:12], data[12:]
            chacha = ChaCha20Poly1305(key[:32])
            return chacha.decrypt(nonce, ciphertext, None)

        elif algorithm == "AES-256-CBC":
            iv, ciphertext = data[:16], data[16:]
            cipher = Cipher(algorithms.AES(key[:32]), modes.CBC(iv), backend=default_backend())
            decryptor = cipher.decryptor()
            padded_data = decryptor.update(ciphertext) + decryptor.finalize()
            padding_len = padded_data[-1]
            return padded_data[:-padding_len]

        else:
            raise ValueError(f"Unknown algorithm: {algorithm}")


# =============================================================================
# 2FA / TOTP MANAGER
# =============================================================================

class TOTPManager:
    """Manages TOTP 2FA authentication."""

    @staticmethod
    def generate_secret() -> str:
        """Generate a new TOTP secret."""
        return pyotp.random_base32()

    @staticmethod
    def get_totp(secret: str) -> pyotp.TOTP:
        """Get TOTP object for a secret."""
        return pyotp.TOTP(secret)

    @staticmethod
    def verify_code(secret: str, code: str) -> bool:
        """Verify a TOTP code."""
        totp = pyotp.TOTP(secret)
        return totp.verify(code, valid_window=1)  # Allow 1 interval tolerance

    @staticmethod
    def get_provisioning_uri(secret: str, email: str = "user") -> str:
        """Get provisioning URI for QR code."""
        totp = pyotp.TOTP(secret)
        return totp.provisioning_uri(name=email, issuer_name="Vaultic")

    @staticmethod
    def generate_qr_image(uri: str, size: int = 200) -> Image.Image:
        """Generate QR code image for the URI."""
        qr = qrcode.QRCode(version=1, box_size=10, border=4)
        qr.add_data(uri)
        qr.make(fit=True)
        img = qr.make_image(fill_color="black", back_color="white")
        img = img.resize((size, size), Image.Resampling.LANCZOS)
        return img

    @staticmethod
    def generate_backup_codes(count: int = 5) -> list:
        """Generate backup codes for 2FA recovery."""
        return [secrets.token_hex(4).upper() for _ in range(count)]

    @staticmethod
    def encrypt_secret(secret: str, key: bytes) -> str:
        """Encrypt TOTP secret with encryption key."""
        encrypted = EncryptionManager.encrypt(secret.encode(), key, "AES-256-GCM")
        return base64.urlsafe_b64encode(encrypted).decode()

    @staticmethod
    def decrypt_secret(encrypted_secret: str, key: bytes) -> str:
        """Decrypt TOTP secret with encryption key."""
        encrypted = base64.urlsafe_b64decode(encrypted_secret)
        decrypted = EncryptionManager.decrypt(encrypted, key, "AES-256-GCM")
        return decrypted.decode()

    @staticmethod
    def encrypt_backup_codes(codes: list, key: bytes) -> str:
        """Encrypt backup codes."""
        data = json.dumps(codes).encode()
        encrypted = EncryptionManager.encrypt(data, key, "AES-256-GCM")
        return base64.urlsafe_b64encode(encrypted).decode()

    @staticmethod
    def decrypt_backup_codes(encrypted_codes: str, key: bytes) -> list:
        """Decrypt backup codes."""
        encrypted = base64.urlsafe_b64decode(encrypted_codes)
        decrypted = EncryptionManager.decrypt(encrypted, key, "AES-256-GCM")
        return json.loads(decrypted.decode())


# =============================================================================
# CONFIG MANAGEMENT
# =============================================================================

def get_config_path(folder: str) -> str:
    return os.path.join(folder, CONFIG_FILE)


def load_config(folder: str) -> dict | None:
    config_path = get_config_path(folder)
    if os.path.exists(config_path):
        with open(config_path, "r") as f:
            return json.load(f)
    return None


def save_config(folder: str, config: dict):
    config_path = get_config_path(folder)
    try:
        # Unhide file first if it exists (Windows)
        if os.path.exists(config_path):
            set_file_hidden(config_path, False)

        with open(config_path, "w") as f:
            json.dump(config, f, indent=2)

        # Hide the config file
        set_file_hidden(config_path, True)
    except Exception:
        pass


def generate_recovery_key() -> str:
    return secrets.token_urlsafe(RECOVERY_KEY_LENGTH)


# =============================================================================
# FILE OPERATIONS
# =============================================================================

def encrypt_file(filepath: str, key: bytes, algorithm: str) -> tuple:
    """Encrypt a single file. Returns (new_path, original_size).

    Format: [4 bytes filename_len][filename UTF-8][file_data] -> encrypted
    Saved as: <uuid>.enc (filename completely hidden)
    """
    filename = os.path.basename(filepath)
    filename_bytes = filename.encode('utf-8')

    with open(filepath, "rb") as f:
        data = f.read()
    original_size = len(data)

    # Pack: filename length (4 bytes) + filename + file data
    payload = struct.pack('<I', len(filename_bytes)) + filename_bytes + data
    encrypted = EncryptionManager.encrypt(payload, key, algorithm)

    # Random filename to hide original name
    folder = os.path.dirname(filepath)
    encrypted_path = os.path.join(folder, f"{uuid.uuid4().hex}{ENCRYPTED_EXT}")

    with open(encrypted_path, "wb") as f:
        f.write(encrypted)
    safe_remove(filepath)
    return encrypted_path, original_size


def decrypt_file(filepath: str, key: bytes, algorithm: str) -> dict:
    """Decrypt a single file. Returns file info dict."""
    with open(filepath, "rb") as f:
        encrypted = f.read()

    decrypted = EncryptionManager.decrypt(encrypted, key, algorithm)

    # Unpack: filename length (4 bytes) + filename + file data
    filename_len = struct.unpack('<I', decrypted[:4])[0]
    filename = decrypted[4:4+filename_len].decode('utf-8')
    data = decrypted[4+filename_len:]

    folder = os.path.dirname(filepath)
    original_path = os.path.join(folder, filename)

    with open(original_path, "wb") as f:
        f.write(data)
    safe_remove(filepath)

    stat = os.stat(original_path)
    return {
        "path": original_path,
        "name": filename,
        "size": len(data),
        "modified": datetime.fromtimestamp(stat.st_mtime),
        "created": datetime.fromtimestamp(stat.st_ctime),
    }


def get_files_to_encrypt(folder: str) -> list:
    files = []
    for root, _, filenames in os.walk(folder):
        for filename in filenames:
            if filename == CONFIG_FILE:
                continue
            filepath = os.path.join(root, filename)
            if not filepath.endswith(ENCRYPTED_EXT):
                files.append(filepath)
    return files


def get_files_to_decrypt(folder: str) -> list:
    files = []
    for root, _, filenames in os.walk(folder):
        for filename in filenames:
            filepath = os.path.join(root, filename)
            if filepath.endswith(ENCRYPTED_EXT):
                files.append(filepath)
    return files


def format_size(size_bytes: int) -> str:
    if size_bytes < 1024:
        return f"{size_bytes} B"
    elif size_bytes < 1024 * 1024:
        return f"{size_bytes / 1024:.2f} KB"
    elif size_bytes < 1024 * 1024 * 1024:
        return f"{size_bytes / (1024 * 1024):.2f} MB"
    else:
        return f"{size_bytes / (1024 * 1024 * 1024):.2f} GB"


def get_file_type(filename: str) -> str:
    ext = os.path.splitext(filename)[1].lower()
    types = {
        ".txt": "Text", ".pdf": "PDF", ".doc": "Word", ".docx": "Word",
        ".xls": "Excel", ".xlsx": "Excel", ".jpg": "Image", ".jpeg": "Image",
        ".png": "Image", ".gif": "Image", ".mp3": "Audio", ".wav": "Audio",
        ".mp4": "Video", ".avi": "Video", ".mkv": "Video", ".zip": "Archive",
        ".rar": "Archive", ".7z": "Archive", ".py": "Python", ".js": "JavaScript",
        ".html": "HTML", ".css": "CSS", ".json": "JSON", ".xml": "XML",
    }
    return types.get(ext, ext[1:].upper() if ext else "Unknown")


def get_file_extension(filename: str) -> str:
    ext = os.path.splitext(filename)[1]
    return ext if ext else "-"


def analyze_password_strength(password: str) -> tuple:
    """Analyze password strength. Returns (score 0-100, text, color)."""
    if not password:
        return 0, "", DARK_FG2

    score = 0
    length = len(password)

    if length >= 8: score += 20
    if length >= 12: score += 15
    if length >= 16: score += 10

    has_lower = any(c.islower() for c in password)
    has_upper = any(c.isupper() for c in password)
    has_digit = any(c.isdigit() for c in password)
    has_special = any(c in "!@#$%^&*()_+-=[]{}|;':\",./<>?`~" for c in password)

    if has_lower: score += 10
    if has_upper: score += 15
    if has_digit: score += 15
    if has_special: score += 20

    variety = sum([has_lower, has_upper, has_digit, has_special])
    if variety >= 3: score += 10
    if variety == 4: score += 10

    common = ['123', 'abc', 'qwerty', 'password', 'admin', '111', 'aaa']
    for p in common:
        if p in password.lower():
            score -= 15

    if len(set(password)) < len(password) / 2:
        score -= 10

    score = max(0, min(100, score))

    if score < 20: return score, f"Very Weak ({score}%)", "#ff4444"
    elif score < 40: return score, f"Weak ({score}%)", "#ff8844"
    elif score < 60: return score, f"Fair ({score}%)", "#ffaa00"
    elif score < 80: return score, f"Strong ({score}%)", "#88cc44"
    else: return score, f"Very Strong ({score}%)", "#44dd44"


# =============================================================================
# DARK MESSAGE BOX
# =============================================================================

class DarkMessageBox:
    """Custom dark mode message box centered on parent."""

    @staticmethod
    def _show(parent, title, message, msg_type="info", buttons=None):
        if buttons is None:
            buttons = [("OK", True)]

        colors = {
            "error": MSG_ERROR_COLOR, "warning": MSG_WARNING_COLOR,
            "info": MSG_INFO_COLOR, "success": MSG_SUCCESS_COLOR, "question": DARK_ACCENT
        }
        accent_color = colors.get(msg_type, DARK_FG)

        dialog = tk.Toplevel(parent)
        dialog.title(title)
        dialog.configure(bg=DARK_BG)
        dialog.resizable(False, False)
        dialog.transient(parent)
        dialog.grab_set()
        set_dark_title_bar(dialog)

        frame = tk.Frame(dialog, bg=DARK_BG, padx=25, pady=20)
        frame.pack(fill=tk.BOTH, expand=True)

        tk.Label(frame, text=title, font=("Segoe UI", 12, "bold"),
                 bg=DARK_BG, fg=accent_color).pack(anchor=tk.W, pady=(0, 10))

        tk.Label(frame, text=message, font=("Segoe UI", 10),
                 bg=DARK_BG, fg=DARK_FG, justify=tk.LEFT, wraplength=350).pack(anchor=tk.W, pady=(0, 20))

        btn_frame = tk.Frame(frame, bg=DARK_BG)
        btn_frame.pack(fill=tk.X)

        result = [None]

        def make_command(val):
            def cmd():
                result[0] = val
                dialog.destroy()
            return cmd

        for i, (text, value) in enumerate(buttons):
            btn = tk.Button(btn_frame, text=text, command=make_command(value),
                           font=("Segoe UI", 10), width=14,
                           bg=DARK_BG3, fg=DARK_FG, activebackground=DARK_ACCENT,
                           activeforeground=DARK_FG, relief=tk.FLAT, cursor="hand2")
            btn.pack(side=tk.LEFT, expand=True, padx=5)
            if i == 0:
                btn.focus_set()

        dialog.bind("<Return>", lambda e: make_command(buttons[0][1])())
        dialog.bind("<Escape>", lambda e: dialog.destroy())

        dialog.update_idletasks()
        w = max(400, dialog.winfo_reqwidth())
        h = dialog.winfo_reqheight()
        dialog.geometry(f"{w}x{h}")

        px, py = parent.winfo_rootx(), parent.winfo_rooty()
        pw, ph = parent.winfo_width(), parent.winfo_height()
        x, y = px + (pw - w) // 2, py + (ph - h) // 2
        dialog.geometry(f"+{x}+{y}")

        parent.wait_window(dialog)
        return result[0]

    @staticmethod
    def showerror(parent, title, message):
        return DarkMessageBox._show(parent, title, message, "error")

    @staticmethod
    def showwarning(parent, title, message):
        return DarkMessageBox._show(parent, title, message, "warning")

    @staticmethod
    def showinfo(parent, title, message):
        return DarkMessageBox._show(parent, title, message, "info")

    @staticmethod
    def showsuccess(parent, title, message):
        return DarkMessageBox._show(parent, title, message, "success")

    @staticmethod
    def askyesno(parent, title, message):
        return DarkMessageBox._show(parent, title, message, "question",
                                     buttons=[("Yes", True), ("No", False)])

    @staticmethod
    def ask3way(parent, title, message, btn1, btn2, btn3):
        """Three-button dialog. Returns button text or None if closed."""
        return DarkMessageBox._show(parent, title, message, "question",
                                     buttons=[(btn1, btn1), (btn2, btn2), (btn3, btn3)])


# =============================================================================
# THEME SETUP
# =============================================================================

def setup_dark_theme(root):
    """Set up complete dark theme for the application."""
    root.configure(bg=DARK_BG)

    root.option_add("*Background", DARK_BG)
    root.option_add("*Foreground", DARK_FG)
    root.option_add("*highlightBackground", DARK_BG)
    root.option_add("*highlightColor", DARK_BG)
    root.option_add("*selectBackground", DARK_SELECT_BG)
    root.option_add("*selectForeground", DARK_FG)

    style = ttk.Style(root)
    style.theme_use('clam')

    style.configure(".", background=DARK_BG, foreground=DARK_FG,
        fieldbackground=DARK_ENTRY_BG, troughcolor=DARK_BG2,
        bordercolor=DARK_BORDER, lightcolor=DARK_BG3, darkcolor=DARK_BG, focuscolor=DARK_ACCENT)

    style.configure("TFrame", background=DARK_BG)
    style.configure("TLabel", background=DARK_BG, foreground=DARK_FG)
    style.configure("TLabelframe", background=DARK_BG, foreground=DARK_FG, bordercolor=DARK_BORDER)
    style.configure("TLabelframe.Label", background=DARK_BG, foreground=DARK_FG)

    style.configure("TEntry", fieldbackground=DARK_ENTRY_BG, foreground=DARK_FG,
        insertcolor=DARK_FG, bordercolor=DARK_BORDER)
    style.map("TEntry", fieldbackground=[("focus", DARK_BG3), ("disabled", DARK_BG2)],
        foreground=[("disabled", DARK_FG2)])

    style.configure("TButton", background=DARK_BG3, foreground=DARK_FG,
        bordercolor=DARK_BORDER, padding=(10, 5))
    style.map("TButton", background=[("active", DARK_ACCENT), ("pressed", DARK_ACCENT_HOVER)],
        foreground=[("active", DARK_FG)])

    style.configure("TCheckbutton", background=DARK_BG, foreground=DARK_FG)
    style.map("TCheckbutton", background=[("active", DARK_BG)], foreground=[("active", DARK_FG)])

    style.configure("TRadiobutton", background=DARK_BG, foreground=DARK_FG)
    style.map("TRadiobutton", background=[("active", DARK_BG)], foreground=[("active", DARK_FG)])

    style.configure("TCombobox", fieldbackground=DARK_ENTRY_BG, background=DARK_BG3,
        foreground=DARK_FG, arrowcolor=DARK_FG, bordercolor=DARK_BORDER)
    style.map("TCombobox", fieldbackground=[("readonly", DARK_ENTRY_BG)],
        foreground=[("readonly", DARK_FG)], background=[("readonly", DARK_BG3)])

    style.configure("TScrollbar", background=DARK_BG3, troughcolor=DARK_BG2,
        bordercolor=DARK_BG, arrowcolor=DARK_FG)
    style.map("TScrollbar", background=[("active", DARK_ACCENT)])

    style.configure("Treeview", background=DARK_BG2, foreground=DARK_FG,
        fieldbackground=DARK_BG2, bordercolor=DARK_BORDER)
    style.configure("Treeview.Heading", background=DARK_BG3, foreground=DARK_FG, bordercolor=DARK_BORDER)
    style.map("Treeview", background=[("selected", DARK_SELECT_BG)], foreground=[("selected", DARK_FG)])
    style.map("Treeview.Heading", background=[("active", DARK_ACCENT)])

    style.configure("TSeparator", background=DARK_BORDER)

    set_dark_title_bar(root)
    return style


def apply_dark_to_dialog(dialog):
    """Apply dark theme to a dialog window."""
    dialog.configure(bg=DARK_BG)
    set_dark_title_bar(dialog)


def center_dialog(dialog, parent):
    """Center dialog on parent window without flicker."""
    dialog.withdraw()  # Hide first
    dialog.update_idletasks()
    x = parent.winfo_x() + (parent.winfo_width() - dialog.winfo_width()) // 2
    y = parent.winfo_y() + (parent.winfo_height() - dialog.winfo_height()) // 2
    dialog.geometry(f"+{x}+{y}")
    dialog.deiconify()  # Show centered


# =============================================================================
# DIALOG CLASSES
# =============================================================================

class CreateFolderDialog:
    """Dialog for creating a new folder with path input."""

    def __init__(self, parent):
        self.result = None
        self.parent = parent

        self.dialog = tk.Toplevel(parent)
        self.dialog.title("Create New Folder")
        self.dialog.geometry("550x235")
        self.dialog.resizable(False, False)
        self.dialog.transient(parent)
        self.dialog.grab_set()
        apply_dark_to_dialog(self.dialog)

        frame = ttk.Frame(self.dialog, padding="20")
        frame.pack(fill=tk.BOTH, expand=True)

        ttk.Label(frame, text="Create New Protected Folder", font=("Segoe UI", 12, "bold")).pack(anchor=tk.W, pady=(0, 15))
        ttk.Label(frame, text="Folder Path:").pack(anchor=tk.W)

        path_frame = ttk.Frame(frame)
        path_frame.pack(fill=tk.X, pady=(5, 15))

        self.path_var = tk.StringVar()
        self.path_entry = ttk.Entry(path_frame, textvariable=self.path_var, font=("Consolas", 9))
        self.path_entry.pack(side=tk.LEFT, fill=tk.X, expand=True, padx=(0, 10))
        self.path_entry.focus()

        ttk.Button(path_frame, text="Browse...", command=self.browse, width=12).pack(side=tk.RIGHT)

        ttk.Label(frame, text="Enter full path or browse to select location, then add folder name",
                  font=("Segoe UI", 9), foreground=DARK_FG2).pack(anchor=tk.W, pady=(0, 15))

        btn_frame = ttk.Frame(frame)
        btn_frame.pack(fill=tk.X, pady=(10, 0))

        ttk.Button(btn_frame, text="Create", command=self.ok, width=15).pack(side=tk.LEFT, expand=True, padx=(0, 5))
        ttk.Button(btn_frame, text="Cancel", command=self.cancel, width=15).pack(side=tk.LEFT, expand=True, padx=(5, 0))

        self.dialog.bind("<Return>", lambda e: self.ok())
        self.dialog.bind("<Escape>", lambda e: self.cancel())

        center_dialog(self.dialog, parent)
        parent.wait_window(self.dialog)

    def browse(self):
        folder = filedialog.askdirectory(title="Select parent location", parent=self.dialog)
        if folder:
            self.path_var.set(folder + "/NewFolder")
            self.path_entry.focus()
            self.path_entry.selection_range(len(folder) + 1, len(folder) + 10)

    def ok(self):
        path = self.path_var.get().strip()
        if not path:
            DarkMessageBox.showerror(self.dialog, "Error", "Please enter a folder path")
            return
        path = os.path.normpath(path)
        if os.path.exists(path):
            DarkMessageBox.showerror(self.dialog, "Error", "This folder already exists!")
            return
        self.result = {"path": path}
        self.dialog.destroy()

    def cancel(self):
        self.dialog.destroy()


class FirstLockDialog:
    """Dialog shown when locking a folder for the first time."""

    def __init__(self, parent, folder, file_count):
        self.result = None

        self.dialog = tk.Toplevel(parent)
        self.dialog.title("Setup Encryption")
        self.dialog.geometry("500x600")
        self.dialog.resizable(False, False)
        self.dialog.transient(parent)
        self.dialog.grab_set()
        apply_dark_to_dialog(self.dialog)

        frame = ttk.Frame(self.dialog, padding="20")
        frame.pack(fill=tk.BOTH, expand=True)

        ttk.Label(frame, text="Setup Folder Protection", font=("Segoe UI", 14, "bold")).pack(anchor=tk.W, pady=(0, 5))
        ttk.Label(frame, text=f"Folder: {os.path.basename(folder)}", font=("Segoe UI", 9)).pack(anchor=tk.W)
        ttk.Label(frame, text=f"Files to encrypt: {file_count}", font=("Segoe UI", 9, "bold"),
                  foreground=DARK_ACCENT).pack(anchor=tk.W, pady=(0, 15))

        # Encryption selection
        ttk.Label(frame, text="Select Encryption Algorithm:", font=("Segoe UI", 10, "bold")).pack(anchor=tk.W, pady=(0, 5))
        self.encryption_var = tk.StringVar(value=DEFAULT_ALGORITHM)

        for algo in EncryptionManager.get_algorithms():
            info = EncryptionManager.get_algorithm_info(algo)
            rb_frame = ttk.Frame(frame)
            rb_frame.pack(fill=tk.X, pady=2)
            ttk.Radiobutton(rb_frame, text=algo, variable=self.encryption_var, value=algo).pack(side=tk.LEFT)
            ttk.Label(rb_frame, text=f"- {info['description']}", font=("Segoe UI", 9),
                      foreground=DARK_FG2).pack(side=tk.LEFT, padx=(10, 0))

        ttk.Separator(frame, orient=tk.HORIZONTAL).pack(fill=tk.X, pady=15)

        # Password
        ttk.Label(frame, text="Password:", font=("Segoe UI", 10, "bold")).pack(anchor=tk.W)
        self.password_var = tk.StringVar()
        self.password_entry = ttk.Entry(frame, show="*", width=40, textvariable=self.password_var)
        self.password_entry.pack(fill=tk.X, pady=(5, 5))

        # Password strength indicator
        strength_frame = ttk.Frame(frame)
        strength_frame.pack(fill=tk.X, pady=(0, 10))
        ttk.Label(strength_frame, text="Strength:", font=("Segoe UI", 9)).pack(side=tk.LEFT)
        self.strength_label = tk.Label(strength_frame, text="", font=("Segoe UI", 9, "bold"), bg=DARK_BG, fg=DARK_FG2)
        self.strength_label.pack(side=tk.LEFT, padx=(5, 0))
        self.password_var.trace_add("write", self.update_strength)

        ttk.Label(frame, text="Confirm Password:").pack(anchor=tk.W)
        self.confirm_entry = ttk.Entry(frame, show="*", width=40)
        self.confirm_entry.pack(fill=tk.X, pady=(5, 5))

        # Show password toggle
        self.show_password_var = tk.BooleanVar(value=False)
        ttk.Checkbutton(frame, text="Show", variable=self.show_password_var,
                        command=self.toggle_password).pack(anchor=tk.W, pady=(0, 10))

        ttk.Label(frame, text="Password Hint (optional - stored in plaintext!):").pack(anchor=tk.W)
        self.hint_entry = ttk.Entry(frame, width=40)
        self.hint_entry.pack(fill=tk.X, pady=(5, 10))

        # 2FA Option
        self.enable_2fa_var = tk.BooleanVar(value=False)
        ttk.Checkbutton(frame, text="Enable 2FA (Two-Factor Authentication)",
                        variable=self.enable_2fa_var).pack(anchor=tk.W, pady=(5, 15))

        # Buttons
        btn_frame = ttk.Frame(frame)
        btn_frame.pack(fill=tk.X)

        ttk.Button(btn_frame, text="Setup & Lock", command=self.ok, width=15).pack(side=tk.LEFT, expand=True, padx=(0, 5))
        ttk.Button(btn_frame, text="Cancel", command=self.cancel, width=15).pack(side=tk.LEFT, expand=True, padx=(5, 0))

        self.password_entry.focus()
        self.dialog.bind("<Return>", lambda e: self.ok())
        self.dialog.bind("<Escape>", lambda e: self.cancel())

        center_dialog(self.dialog, parent)
        parent.wait_window(self.dialog)

    def update_strength(self, *args):
        password = self.password_var.get()
        score, text, color = analyze_password_strength(password)
        self.strength_label.config(text=text, fg=color)

    def toggle_password(self):
        show = "" if self.show_password_var.get() else "*"
        self.password_entry.config(show=show)
        self.confirm_entry.config(show=show)

    def ok(self):
        password = self.password_entry.get()
        confirm = self.confirm_entry.get()

        if not password:
            DarkMessageBox.showerror(self.dialog, "Error", "Password cannot be empty")
            return
        if len(password) < 6:
            DarkMessageBox.showerror(self.dialog, "Error", "Password must be at least 6 characters")
            return
        if password != confirm:
            DarkMessageBox.showerror(self.dialog, "Error", "Passwords do not match")
            return

        self.result = {
            "password": password,
            "encryption": self.encryption_var.get(),
            "hint": self.hint_entry.get().strip(),
            "enable_2fa": self.enable_2fa_var.get()
        }
        self.dialog.destroy()

    def cancel(self):
        self.dialog.destroy()


class ChangePasswordDialog:
    """Dialog for changing password."""

    def __init__(self, parent, folder, verify_func):
        self.result = None
        self.folder = folder
        self.verify_func = verify_func

        self.dialog = tk.Toplevel(parent)
        self.dialog.title("Change Password")
        self.dialog.geometry("450x350")
        self.dialog.resizable(False, False)
        self.dialog.transient(parent)
        self.dialog.grab_set()
        apply_dark_to_dialog(self.dialog)

        frame = ttk.Frame(self.dialog, padding="20")
        frame.pack(fill=tk.BOTH, expand=True)

        ttk.Label(frame, text="Change Password", font=("Segoe UI", 12, "bold")).pack(anchor=tk.W, pady=(0, 15))

        ttk.Label(frame, text="Current Password:").pack(anchor=tk.W)
        self.current_entry = ttk.Entry(frame, show="*", width=40)
        self.current_entry.pack(fill=tk.X, pady=(5, 10))
        self.current_entry.focus()

        ttk.Label(frame, text="New Password:").pack(anchor=tk.W)
        self.new_entry = ttk.Entry(frame, show="*", width=40)
        self.new_entry.pack(fill=tk.X, pady=(5, 10))

        ttk.Label(frame, text="Confirm New Password:").pack(anchor=tk.W)
        self.confirm_entry = ttk.Entry(frame, show="*", width=40)
        self.confirm_entry.pack(fill=tk.X, pady=(5, 10))

        ttk.Label(frame, text="New Password Hint (optional - stored in plaintext!):").pack(anchor=tk.W)
        self.hint_entry = ttk.Entry(frame, width=40)
        self.hint_entry.pack(fill=tk.X, pady=(5, 15))

        btn_frame = ttk.Frame(frame)
        btn_frame.pack(fill=tk.X)

        ttk.Button(btn_frame, text="Change", command=self.ok, width=15).pack(side=tk.LEFT, expand=True, padx=(0, 5))
        ttk.Button(btn_frame, text="Cancel", command=self.cancel, width=15).pack(side=tk.LEFT, expand=True, padx=(5, 0))

        self.dialog.bind("<Return>", lambda e: self.ok())
        self.dialog.bind("<Escape>", lambda e: self.cancel())

        center_dialog(self.dialog, parent)
        parent.wait_window(self.dialog)

    def ok(self):
        current = self.current_entry.get()
        new_pwd = self.new_entry.get()
        confirm = self.confirm_entry.get()

        is_valid, _ = self.verify_func(self.folder, current)
        if not is_valid:
            DarkMessageBox.showerror(self.dialog, "Error", "Current password is incorrect")
            return
        if not new_pwd:
            DarkMessageBox.showerror(self.dialog, "Error", "New password cannot be empty")
            return
        if len(new_pwd) < 6:
            DarkMessageBox.showerror(self.dialog, "Error", "Password must be at least 6 characters")
            return
        if new_pwd != confirm:
            DarkMessageBox.showerror(self.dialog, "Error", "New passwords do not match")
            return

        self.result = {"password": new_pwd, "hint": self.hint_entry.get().strip()}
        self.dialog.destroy()

    def cancel(self):
        self.dialog.destroy()


class ChangeEncryptionDialog:
    """Dialog for changing encryption algorithm."""

    def __init__(self, parent, current_algorithm):
        self.result = None

        self.dialog = tk.Toplevel(parent)
        self.dialog.title("Change Encryption")
        self.dialog.geometry("500x380")
        self.dialog.resizable(False, False)
        self.dialog.transient(parent)
        self.dialog.grab_set()
        apply_dark_to_dialog(self.dialog)

        frame = ttk.Frame(self.dialog, padding="20")
        frame.pack(fill=tk.BOTH, expand=True)

        ttk.Label(frame, text="Change Encryption Algorithm", font=("Segoe UI", 12, "bold")).pack(anchor=tk.W, pady=(0, 5))
        ttk.Label(frame, text=f"Current: {current_algorithm}", font=("Segoe UI", 9),
                  foreground=DARK_FG2).pack(anchor=tk.W, pady=(0, 15))

        ttk.Label(frame, text="Select New Encryption:", font=("Segoe UI", 10, "bold")).pack(anchor=tk.W, pady=(0, 10))
        self.encryption_var = tk.StringVar(value=current_algorithm)

        for algo in EncryptionManager.get_algorithms():
            info = EncryptionManager.get_algorithm_info(algo)
            rb_frame = ttk.Frame(frame)
            rb_frame.pack(fill=tk.X, pady=3)
            ttk.Radiobutton(rb_frame, text=algo, variable=self.encryption_var, value=algo).pack(side=tk.LEFT)
            ttk.Label(rb_frame, text=f"- {info['description']}", font=("Segoe UI", 9),
                      foreground=DARK_FG2).pack(side=tk.LEFT, padx=(10, 0))

        ttk.Label(frame, text="Note: This only affects future encryptions.\nAlready encrypted files keep their original algorithm.",
                  font=("Segoe UI", 9), foreground="#ffaa00").pack(anchor=tk.W, pady=(20, 15))

        btn_frame = ttk.Frame(frame)
        btn_frame.pack(fill=tk.X)

        ttk.Button(btn_frame, text="Change", command=self.ok, width=15).pack(side=tk.LEFT, expand=True, padx=(0, 5))
        ttk.Button(btn_frame, text="Cancel", command=self.cancel, width=15).pack(side=tk.LEFT, expand=True, padx=(5, 0))

        self.dialog.bind("<Return>", lambda e: self.ok())
        self.dialog.bind("<Escape>", lambda e: self.cancel())

        center_dialog(self.dialog, parent)
        parent.wait_window(self.dialog)

    def ok(self):
        self.result = {"encryption": self.encryption_var.get()}
        self.dialog.destroy()

    def cancel(self):
        self.dialog.destroy()


class RecoveryDialog:
    """Dialog for password recovery using recovery key."""

    def __init__(self, parent, folder, verify_func, current_algorithm):
        self.result = None
        self.folder = folder
        self.verify_func = verify_func

        self.dialog = tk.Toplevel(parent)
        self.dialog.title("Password Recovery")
        self.dialog.geometry("500x390")
        self.dialog.resizable(False, False)
        self.dialog.transient(parent)
        self.dialog.grab_set()
        apply_dark_to_dialog(self.dialog)

        frame = ttk.Frame(self.dialog, padding="20")
        frame.pack(fill=tk.BOTH, expand=True)

        ttk.Label(frame, text="Password Recovery", font=("Segoe UI", 12, "bold")).pack(anchor=tk.W)
        ttk.Label(frame, text="Enter your recovery key to reset your password", font=("Segoe UI", 9)).pack(anchor=tk.W, pady=(0, 15))

        ttk.Label(frame, text="Recovery Key:").pack(anchor=tk.W)
        self.recovery_entry = ttk.Entry(frame, width=60, font=("Consolas", 9))
        self.recovery_entry.pack(fill=tk.X, pady=(5, 15))
        self.recovery_entry.focus()

        ttk.Separator(frame, orient=tk.HORIZONTAL).pack(fill=tk.X, pady=10)

        ttk.Label(frame, text="New Password:").pack(anchor=tk.W)
        self.new_entry = ttk.Entry(frame, show="*", width=40)
        self.new_entry.pack(fill=tk.X, pady=(5, 10))

        ttk.Label(frame, text="Confirm New Password:").pack(anchor=tk.W)
        self.confirm_entry = ttk.Entry(frame, show="*", width=40)
        self.confirm_entry.pack(fill=tk.X, pady=(5, 10))

        ttk.Label(frame, text="Password Hint (optional - stored in plaintext!):").pack(anchor=tk.W)
        self.hint_entry = ttk.Entry(frame, width=40)
        self.hint_entry.pack(fill=tk.X, pady=(5, 15))

        btn_frame = ttk.Frame(frame)
        btn_frame.pack(fill=tk.X)

        ttk.Button(btn_frame, text="Reset Password", command=self.ok, width=15).pack(side=tk.LEFT, expand=True, padx=(0, 5))
        ttk.Button(btn_frame, text="Cancel", command=self.cancel, width=15).pack(side=tk.LEFT, expand=True, padx=(5, 0))

        self.dialog.bind("<Return>", lambda e: self.ok())
        self.dialog.bind("<Escape>", lambda e: self.cancel())

        center_dialog(self.dialog, parent)
        parent.wait_window(self.dialog)

    def ok(self):
        recovery_key = self.recovery_entry.get().strip()
        new_pwd = self.new_entry.get()
        confirm = self.confirm_entry.get()

        if not self.verify_func(self.folder, recovery_key):
            DarkMessageBox.showerror(self.dialog, "Error", "Invalid recovery key")
            return
        if not new_pwd:
            DarkMessageBox.showerror(self.dialog, "Error", "New password cannot be empty")
            return
        if len(new_pwd) < 6:
            DarkMessageBox.showerror(self.dialog, "Error", "Password must be at least 6 characters")
            return
        if new_pwd != confirm:
            DarkMessageBox.showerror(self.dialog, "Error", "Passwords do not match")
            return

        self.result = {"password": new_pwd, "hint": self.hint_entry.get().strip()}
        self.dialog.destroy()

    def cancel(self):
        self.dialog.destroy()


class RecoveryKeyDialog:
    """Dialog to display recovery key that user must save."""

    def __init__(self, parent, recovery_key, backup_codes=None):
        self.dialog = tk.Toplevel(parent)
        self.dialog.title("Save Your Recovery Key")
        self.dialog.geometry("550x480" if backup_codes else "550x400")
        self.dialog.resizable(False, False)
        self.dialog.transient(parent)
        self.dialog.grab_set()
        apply_dark_to_dialog(self.dialog)

        frame = ttk.Frame(self.dialog, padding="20")
        frame.pack(fill=tk.BOTH, expand=True)

        ttk.Label(frame, text="SAVE THIS RECOVERY KEY!", font=("Segoe UI", 14, "bold"), foreground="#ff6b6b").pack(pady=(0, 10))

        warning_text = "This is your ONLY way to recover your password if you forget it.\nStore it somewhere safe (password manager, printed paper, etc.)\nThis key will NOT be shown again!"
        ttk.Label(frame, text=warning_text, font=("Segoe UI", 9), justify=tk.CENTER).pack(pady=(0, 20))

        key_frame = ttk.Frame(frame)
        key_frame.pack(fill=tk.X, pady=10)

        self.key_var = tk.StringVar(value=recovery_key)
        key_entry = ttk.Entry(key_frame, textvariable=self.key_var, state="readonly", font=("Consolas", 11), justify=tk.CENTER)
        key_entry.pack(fill=tk.X, pady=5)

        ttk.Button(key_frame, text="Copy to Clipboard", command=lambda: self.copy_key(parent, recovery_key)).pack(pady=10)

        # Show 2FA backup codes if provided
        if backup_codes:
            self.backup_codes = backup_codes
            ttk.Separator(frame, orient=tk.HORIZONTAL).pack(fill=tk.X, pady=10)
            ttk.Label(frame, text="2FA Backup Codes (save these too!):", font=("Segoe UI", 10, "bold"),
                      foreground="#ffaa00").pack(anchor=tk.W)

            codes_frame = ttk.Frame(frame)
            codes_frame.pack(fill=tk.X, pady=5)

            codes_text = "  ".join(backup_codes)
            self.codes_var = tk.StringVar(value=codes_text)
            codes_entry = ttk.Entry(codes_frame, textvariable=self.codes_var, state="readonly",
                                    font=("Consolas", 10), justify=tk.CENTER)
            codes_entry.pack(fill=tk.X, pady=5)

            ttk.Button(codes_frame, text="Copy Backup Codes",
                       command=lambda: self.copy_codes(parent, codes_text)).pack(pady=5)

        confirm_text = "I have saved my recovery key" + (" and backup codes" if backup_codes else "")
        self.confirmed = tk.BooleanVar(value=False)
        ttk.Checkbutton(frame, text=confirm_text, variable=self.confirmed, command=self.check_confirm).pack(pady=10)

        self.ok_btn = ttk.Button(frame, text="OK", command=self.dialog.destroy, state=tk.DISABLED, width=20)
        self.ok_btn.pack(pady=10)

        center_dialog(self.dialog, parent)
        parent.wait_window(self.dialog)

    def copy_key(self, parent, key):
        parent.clipboard_clear()
        parent.clipboard_append(key)
        DarkMessageBox.showinfo(self.dialog, "Copied", "Recovery key copied to clipboard!")

    def copy_codes(self, parent, codes):
        parent.clipboard_clear()
        parent.clipboard_append(codes)
        DarkMessageBox.showinfo(self.dialog, "Copied", "Backup codes copied to clipboard!")

    def check_confirm(self):
        self.ok_btn.config(state=tk.NORMAL if self.confirmed.get() else tk.DISABLED)


class BackupCodesDialog:
    """Dialog for showing 2FA backup codes with copy functionality."""

    def __init__(self, parent, backup_codes):
        self.dialog = tk.Toplevel(parent)
        self.dialog.title("2FA Backup Codes")
        self.dialog.geometry("500x400")
        self.dialog.resizable(False, False)
        self.dialog.transient(parent)
        self.dialog.grab_set()
        apply_dark_to_dialog(self.dialog)

        frame = ttk.Frame(self.dialog, padding="20")
        frame.pack(fill=tk.BOTH, expand=True)

        ttk.Label(frame, text="2FA Successfully Enabled!", font=("Segoe UI", 14, "bold"),
                  foreground="#44dd44").pack(pady=(0, 10))

        ttk.Label(frame, text="SAVE YOUR BACKUP CODES!", font=("Segoe UI", 12, "bold"),
                  foreground="#ff6b6b").pack(pady=(0, 10))

        warning_text = "Use these codes if you lose access to your authenticator app.\nEach code can only be used once. Store them safely!"
        ttk.Label(frame, text=warning_text, font=("Segoe UI", 9), justify=tk.CENTER).pack(pady=(0, 15))

        codes_frame = ttk.Frame(frame)
        codes_frame.pack(fill=tk.X, pady=10)

        codes_text = "  ".join(backup_codes)
        self.codes_var = tk.StringVar(value=codes_text)
        codes_entry = ttk.Entry(codes_frame, textvariable=self.codes_var, state="readonly",
                                font=("Consolas", 11), justify=tk.CENTER)
        codes_entry.pack(fill=tk.X, pady=5)

        ttk.Button(codes_frame, text="Copy to Clipboard",
                   command=lambda: self.copy_codes(parent, codes_text)).pack(pady=10)

        self.confirmed = tk.BooleanVar(value=False)
        ttk.Checkbutton(frame, text="I have saved my backup codes",
                        variable=self.confirmed, command=self.check_confirm).pack(pady=10)

        self.ok_btn = ttk.Button(frame, text="OK", command=self.dialog.destroy, state=tk.DISABLED)
        self.ok_btn.pack(pady=15, ipadx=40, ipady=5)

        center_dialog(self.dialog, parent)
        parent.wait_window(self.dialog)

    def copy_codes(self, parent, codes):
        parent.clipboard_clear()
        parent.clipboard_append(codes)
        DarkMessageBox.showinfo(self.dialog, "Copied", "Backup codes copied to clipboard!")

    def check_confirm(self):
        self.ok_btn.config(state=tk.NORMAL if self.confirmed.get() else tk.DISABLED)


class Setup2FADialog:
    """Dialog for setting up 2FA with QR code."""

    def __init__(self, parent, folder_name):
        self.result = None
        self.secret = TOTPManager.generate_secret()

        self.dialog = tk.Toplevel(parent)
        self.dialog.title("Setup Two-Factor Authentication")
        self.dialog.geometry("500x560")
        self.dialog.resizable(False, False)
        self.dialog.transient(parent)
        self.dialog.grab_set()
        apply_dark_to_dialog(self.dialog)

        frame = ttk.Frame(self.dialog, padding="20")
        frame.pack(fill=tk.BOTH, expand=True)

        ttk.Label(frame, text="Setup 2FA", font=("Segoe UI", 14, "bold")).pack(anchor=tk.W, pady=(0, 5))
        ttk.Label(frame, text="Scan this QR code with your authenticator app\n(Google Authenticator, Authy, etc.)",
                  font=("Segoe UI", 9)).pack(anchor=tk.W, pady=(0, 15))

        # Generate and display QR code
        uri = TOTPManager.get_provisioning_uri(self.secret, folder_name)
        qr_img = TOTPManager.generate_qr_image(uri, 180)
        self.qr_photo = ImageTk.PhotoImage(qr_img)

        qr_frame = tk.Frame(frame, bg="white", padx=10, pady=10)
        qr_frame.pack(pady=10)
        tk.Label(qr_frame, image=self.qr_photo, bg="white").pack()

        # Manual entry option
        ttk.Label(frame, text="Or enter this code manually:", font=("Segoe UI", 9)).pack(anchor=tk.W, pady=(10, 5))
        secret_frame = ttk.Frame(frame)
        secret_frame.pack(fill=tk.X)

        secret_var = tk.StringVar(value=self.secret)
        ttk.Entry(secret_frame, textvariable=secret_var, state="readonly", font=("Consolas", 10), width=40).pack(side=tk.LEFT)
        ttk.Button(secret_frame, text="Copy", width=8,
                   command=lambda: (parent.clipboard_clear(), parent.clipboard_append(self.secret))).pack(side=tk.LEFT, padx=5)

        ttk.Separator(frame, orient=tk.HORIZONTAL).pack(fill=tk.X, pady=15)

        # Verification
        ttk.Label(frame, text="Enter the 6-digit code from your app to verify:", font=("Segoe UI", 10, "bold")).pack(anchor=tk.W)
        self.code_entry = ttk.Entry(frame, font=("Consolas", 16), width=10, justify=tk.CENTER)
        self.code_entry.pack(pady=10)
        self.code_entry.focus()

        btn_frame = ttk.Frame(frame)
        btn_frame.pack(fill=tk.X, pady=(10, 0))

        ttk.Button(btn_frame, text="Verify & Enable", command=self.ok, width=15).pack(side=tk.LEFT, expand=True, padx=(0, 5))
        ttk.Button(btn_frame, text="Cancel", command=self.cancel, width=15).pack(side=tk.LEFT, expand=True, padx=(5, 0))

        self.dialog.bind("<Return>", lambda e: self.ok())
        self.dialog.bind("<Escape>", lambda e: self.cancel())

        center_dialog(self.dialog, parent)
        parent.wait_window(self.dialog)

    def ok(self):
        code = self.code_entry.get().strip()
        if not code or len(code) != 6 or not code.isdigit():
            DarkMessageBox.showerror(self.dialog, "Error", "Please enter a valid 6-digit code")
            return

        if not TOTPManager.verify_code(self.secret, code):
            DarkMessageBox.showerror(self.dialog, "Error", "Invalid code. Please try again.")
            return

        # Generate backup codes
        backup_codes = TOTPManager.generate_backup_codes()

        self.result = {
            "secret": self.secret,
            "backup_codes": backup_codes
        }
        self.dialog.destroy()

    def cancel(self):
        self.dialog.destroy()


class Verify2FADialog:
    """Dialog for entering 2FA code during unlock."""

    def __init__(self, parent, allow_backup=True):
        self.result = None
        self.allow_backup = allow_backup

        self.dialog = tk.Toplevel(parent)
        self.dialog.title("Two-Factor Authentication")
        self.dialog.geometry("525x225" if allow_backup else "525x205")
        self.dialog.resizable(False, False)
        self.dialog.transient(parent)
        self.dialog.grab_set()
        apply_dark_to_dialog(self.dialog)

        frame = ttk.Frame(self.dialog, padding="20")
        frame.pack(fill=tk.BOTH, expand=True)

        ttk.Label(frame, text="Two-Factor Authentication", font=("Segoe UI", 14, "bold")).pack(anchor=tk.W, pady=(0, 10))

        if allow_backup:
            # Mode selection
            self.mode_var = tk.StringVar(value="totp")
            mode_frame = ttk.Frame(frame)
            mode_frame.pack(fill=tk.X, pady=(0, 10))
            ttk.Radiobutton(mode_frame, text="Authenticator Code", variable=self.mode_var,
                            value="totp", command=self.toggle_mode).pack(side=tk.LEFT, padx=(0, 20))
            ttk.Radiobutton(mode_frame, text="Backup Code", variable=self.mode_var,
                            value="backup", command=self.toggle_mode).pack(side=tk.LEFT)

        # TOTP entry frame
        self.totp_frame = ttk.Frame(frame)
        self.totp_frame.pack(fill=tk.X, pady=5)
        ttk.Label(self.totp_frame, text="6-digit code:", font=("Segoe UI", 9)).pack(anchor=tk.W)
        self.totp_entry = ttk.Entry(self.totp_frame, font=("Consolas", 16), justify=tk.CENTER)
        self.totp_entry.pack(fill=tk.X, pady=5)
        self.totp_entry.focus()

        if allow_backup:
            # Backup codes entry frame (hidden by default)
            self.backup_frame = ttk.Frame(frame)
            ttk.Label(self.backup_frame, text="Enter one backup code (paste all to auto-fill):",
                      font=("Segoe UI", 9)).pack(anchor=tk.W)

            codes_frame = ttk.Frame(self.backup_frame)
            codes_frame.pack(fill=tk.X, pady=5)

            self.backup_entries = []
            for i in range(5):
                entry = ttk.Entry(codes_frame, font=("Consolas", 11), width=10, justify=tk.CENTER)
                entry.pack(side=tk.LEFT, padx=2)
                entry.bind("<KeyRelease>", lambda e, idx=i: self.on_backup_key(e, idx))
                self.backup_entries.append(entry)

        btn_frame = ttk.Frame(frame)
        btn_frame.pack(fill=tk.X, pady=(15, 0))

        ttk.Button(btn_frame, text="Verify", command=self.ok, width=15).pack(side=tk.LEFT, expand=True, padx=(0, 5))
        ttk.Button(btn_frame, text="Cancel", command=self.cancel, width=15).pack(side=tk.LEFT, expand=True, padx=(5, 0))

        self.dialog.bind("<Return>", lambda e: self.ok())
        self.dialog.bind("<Escape>", lambda e: self.cancel())

        center_dialog(self.dialog, parent)
        parent.wait_window(self.dialog)

    def toggle_mode(self):
        if self.mode_var.get() == "totp":
            self.backup_frame.pack_forget()
            self.totp_frame.pack(fill=tk.X, pady=5)
            self.totp_entry.focus()
        else:
            self.totp_frame.pack_forget()
            self.backup_frame.pack(fill=tk.X, pady=5)
            self.backup_entries[0].focus()

    def on_backup_key(self, event, idx):
        """Handle paste/typing in backup code fields - auto-split if multiple codes pasted."""
        entry = self.backup_entries[idx]
        text = entry.get().strip().upper().replace(" ", "").replace("-", "")

        # Check if multiple codes were pasted (longer than 8 chars)
        if len(text) > 8:
            # Split into 8-char chunks
            codes = [text[i:i+8] for i in range(0, len(text), 8)]
            for i, code in enumerate(codes[:5]):
                self.backup_entries[i].delete(0, tk.END)
                self.backup_entries[i].insert(0, code)
            # Focus last filled or next empty
            focus_idx = min(len(codes), 4)
            self.backup_entries[focus_idx].focus()

    def ok(self):
        if self.allow_backup and self.mode_var.get() == "backup":
            # Get first non-empty backup code
            for entry in self.backup_entries:
                code = entry.get().strip().upper().replace(" ", "")
                if code:
                    self.result = {"code": code}
                    self.dialog.destroy()
                    return
            DarkMessageBox.showerror(self.dialog, "Error", "Please enter a backup code")
        else:
            code = self.totp_entry.get().strip().upper()
            if not code:
                DarkMessageBox.showerror(self.dialog, "Error", "Please enter a code")
                return
            self.result = {"code": code}
            self.dialog.destroy()

    def cancel(self):
        self.dialog.destroy()


class UnlockReportDialog:
    """Dialog showing detailed unlock report."""

    def __init__(self, parent, data):
        self.dialog = tk.Toplevel(parent)
        self.dialog.title("Unlock Complete - File Report")
        self.dialog.geometry("700x550")
        self.dialog.minsize(600, 450)
        self.dialog.transient(parent)
        apply_dark_to_dialog(self.dialog)

        frame = ttk.Frame(self.dialog, padding="15")
        frame.pack(fill=tk.BOTH, expand=True)

        header_frame = ttk.Frame(frame)
        header_frame.pack(fill=tk.X, pady=(0, 15))

        ttk.Label(header_frame, text="Folder Unlocked Successfully!", font=("Segoe UI", 14, "bold"),
                  foreground="#4ecdc4").pack(side=tk.LEFT)
        ttk.Label(header_frame, text=data["algorithm"], font=("Segoe UI", 10, "bold")).pack(side=tk.RIGHT)

        ttk.Label(frame, text=data["folder"], font=("Consolas", 9)).pack(anchor=tk.W, pady=(0, 15))

        stats_frame = ttk.LabelFrame(frame, text="Statistics", padding="10")
        stats_frame.pack(fill=tk.X, pady=(0, 10))

        stats_grid = ttk.Frame(stats_frame)
        stats_grid.pack(fill=tk.X)

        # Left column: Total Files, Total Size, Average Size
        # Right column: Smallest, Largest
        left_stats = [
            ("Total Files:", str(data["total_files"])),
            ("Total Size:", format_size(data["total_size"])),
            ("Average Size:", format_size(data["avg_size"])),
        ]

        right_stats = []
        if data.get("smallest"):
            right_stats.append(("Smallest:", f"{data['smallest']['name']} ({format_size(data['smallest']['size'])})"))
        if data.get("largest"):
            right_stats.append(("Largest:", f"{data['largest']['name']} ({format_size(data['largest']['size'])})"))

        for i, (label, value) in enumerate(left_stats):
            ttk.Label(stats_grid, text=label, font=("Segoe UI", 9)).grid(row=i, column=0, sticky=tk.W, padx=(0, 5), pady=2)
            ttk.Label(stats_grid, text=value, font=("Segoe UI", 9, "bold")).grid(row=i, column=1, sticky=tk.W, padx=(0, 40), pady=2)

        for i, (label, value) in enumerate(right_stats):
            ttk.Label(stats_grid, text=label, font=("Segoe UI", 9)).grid(row=i, column=2, sticky=tk.W, padx=(0, 5), pady=2)
            ttk.Label(stats_grid, text=value, font=("Segoe UI", 9, "bold")).grid(row=i, column=3, sticky=tk.W, padx=(0, 20), pady=2)

        # File types
        if data.get("types"):
            types_frame = ttk.LabelFrame(frame, text="File Types", padding="10")
            types_frame.pack(fill=tk.X, pady=(0, 10))
            types_text = ", ".join([f"{t}: {c}" for t, c in sorted(data["types"].items(), key=lambda x: -x[1])])
            ttk.Label(types_frame, text=types_text, wraplength=650).pack(anchor=tk.W)

        # File list
        list_frame = ttk.LabelFrame(frame, text="Decrypted Files", padding="10")
        list_frame.pack(fill=tk.BOTH, expand=True, pady=(0, 10))
        list_frame.grid_rowconfigure(0, weight=1)
        list_frame.grid_columnconfigure(0, weight=1)

        columns = ("name", "type", "size", "modified")
        tree = ttk.Treeview(list_frame, columns=columns, show="headings", height=8)

        tree.heading("name", text="File Name", anchor=tk.W)
        tree.heading("type", text="Type", anchor=tk.W)
        tree.heading("size", text="Size", anchor=tk.E)
        tree.heading("modified", text="Modified", anchor=tk.W)

        tree.column("name", width=250)
        tree.column("type", width=80)
        tree.column("size", width=80, anchor=tk.E)
        tree.column("modified", width=150)

        scrollbar = ttk.Scrollbar(list_frame, orient=tk.VERTICAL, command=tree.yview)
        tree.configure(yscrollcommand=scrollbar.set)

        tree.grid(row=0, column=0, sticky="nsew")
        scrollbar.grid(row=0, column=1, sticky="ns")

        for f in sorted(data.get("files", []), key=lambda x: x["name"].lower()):
            tree.insert("", tk.END, values=(
                f["name"],
                get_file_type(f["name"]),
                format_size(f["size"]),
                f["modified"].strftime("%Y-%m-%d %H:%M:%S")
            ))

        ttk.Button(frame, text="Close", command=self.dialog.destroy, width=15).pack(pady=(10, 0))
        center_dialog(self.dialog, parent)


# =============================================================================
# MAIN APPLICATION
# =============================================================================

class VaulticApp:
    def __init__(self, root):
        self.root = root
        self.root.title("Vaultic Folder Crypter Pro")
        self.root.geometry("950x800")
        self.root.minsize(900, 800)

        self.selected_folder = tk.StringVar()
        self.password_var = tk.StringVar()
        self.status_var = tk.StringVar(value="Select a folder to begin")
        self.show_password = tk.BooleanVar(value=False)
        self.current_algorithm = tk.StringVar(value=DEFAULT_ALGORITHM)

        # Track unlocked folder state
        self.unlocked_folder = None

        self.create_widgets()
        self.setup_drag_drop()

        # Handle window close
        self.root.protocol("WM_DELETE_WINDOW", self.on_close)

    def create_widgets(self):
        main_frame = ttk.Frame(self.root, padding="15")
        main_frame.pack(fill=tk.BOTH, expand=True)

        # Header
        header_frame = tk.Frame(main_frame, bg=DARK_BG)
        header_frame.pack(fill=tk.X, pady=(0, 15))

        tk.Label(header_frame, text="Vaultic Folder Crypter Pro", font=("Segoe UI", 20, "bold"),
                 bg=DARK_BG, fg=DARK_FG).pack(side=tk.LEFT)

        self.encryption_badge = tk.Label(header_frame, text="", font=("Segoe UI", 10),
                                          bg=DARK_BG, fg=DARK_FG)
        self.encryption_badge.pack(side=tk.RIGHT, anchor=tk.S)

        # Folder selection
        folder_frame = ttk.LabelFrame(main_frame, text="Protected Folder (Drag & Drop supported)", padding="10")
        folder_frame.pack(fill=tk.X, pady=(0, 10))

        folder_inner = ttk.Frame(folder_frame)
        folder_inner.pack(fill=tk.X)

        self.folder_entry = ttk.Entry(folder_inner, textvariable=self.selected_folder, state="readonly", font=("Consolas", 9))
        self.folder_entry.pack(side=tk.LEFT, fill=tk.X, expand=True, padx=(0, 10))

        ttk.Button(folder_inner, text="Create New", command=self.create_folder, width=14).pack(side=tk.RIGHT, padx=(5, 0))
        ttk.Button(folder_inner, text="Browse", command=self.browse_folder, width=14).pack(side=tk.RIGHT)

        status_inner = ttk.Frame(folder_frame)
        status_inner.pack(fill=tk.X, pady=(5, 0))

        self.folder_status_var = tk.StringVar(value="")
        self.folder_status_label = ttk.Label(status_inner, textvariable=self.folder_status_var, font=("Segoe UI", 9))
        self.folder_status_label.pack(side=tk.LEFT)

        self.encryption_status_var = tk.StringVar(value="")
        self.encryption_status_label = ttk.Label(status_inner, textvariable=self.encryption_status_var, font=("Segoe UI", 9, "bold"))
        self.encryption_status_label.pack(side=tk.RIGHT)

        # Password section
        password_frame = ttk.LabelFrame(main_frame, text="Password", padding="10")
        password_frame.pack(fill=tk.X, pady=(0, 10))

        pwd_inner = ttk.Frame(password_frame)
        pwd_inner.pack(fill=tk.X)

        self.password_entry = ttk.Entry(pwd_inner, textvariable=self.password_var, show="*", font=("Consolas", 10))
        self.password_entry.pack(side=tk.LEFT, fill=tk.X, expand=True, padx=(0, 10))

        self.show_pwd_btn = ttk.Checkbutton(pwd_inner, text="Show", variable=self.show_password, command=self.toggle_password)
        self.show_pwd_btn.pack(side=tk.RIGHT)

        strength_frame = ttk.Frame(password_frame)
        strength_frame.pack(fill=tk.X, pady=(5, 0))

        ttk.Label(strength_frame, text="Strength:", font=("Segoe UI", 9)).pack(side=tk.LEFT)
        self.strength_label = tk.Label(strength_frame, text="", font=("Segoe UI", 9, "bold"), bg=DARK_BG, fg=DARK_FG2)
        self.strength_label.pack(side=tk.LEFT, padx=(5, 0))

        self.password_var.trace_add("write", self.update_password_strength)

        self.hint_var = tk.StringVar(value="")
        self.hint_label = ttk.Label(password_frame, textvariable=self.hint_var, font=("Segoe UI", 9))
        self.hint_label.pack(anchor=tk.W, pady=(5, 0))

        # Action buttons - consistent 4px spacing everywhere
        action_frame = ttk.Frame(main_frame)
        action_frame.pack(fill=tk.X, pady=(0, 4))

        primary_frame = ttk.Frame(action_frame)
        primary_frame.pack(fill=tk.X)

        ttk.Button(primary_frame, text="Lock Folder", command=self.lock_folder, width=20).pack(side=tk.LEFT, expand=True, fill=tk.X, padx=(0, 2))
        ttk.Button(primary_frame, text="Unlock Folder", command=self.unlock_folder, width=20).pack(side=tk.LEFT, expand=True, fill=tk.X, padx=(2, 0))

        secondary_frame = ttk.Frame(action_frame)
        secondary_frame.pack(fill=tk.X, pady=(4, 0))

        ttk.Button(secondary_frame, text="Change Password", command=self.change_password, width=14).pack(side=tk.LEFT, expand=True, fill=tk.X, padx=(0, 2))
        ttk.Button(secondary_frame, text="Change Encryption", command=self.change_encryption, width=14).pack(side=tk.LEFT, expand=True, fill=tk.X, padx=(2, 2))
        ttk.Button(secondary_frame, text="Forgot Password", command=self.forgot_password, width=14).pack(side=tk.LEFT, expand=True, fill=tk.X, padx=(2, 0))

        # 2FA button row
        twofa_frame = ttk.Frame(action_frame)
        twofa_frame.pack(fill=tk.X, pady=(4, 0))

        ttk.Button(twofa_frame, text="Setup 2FA", command=self.setup_2fa, width=14).pack(side=tk.LEFT, expand=True, fill=tk.X, padx=(0, 2))
        ttk.Button(twofa_frame, text="Disable 2FA", command=self.disable_2fa, width=14).pack(side=tk.LEFT, expand=True, fill=tk.X, padx=(2, 0))

        # File info section
        info_frame = ttk.LabelFrame(main_frame, text="File Information", padding="10")
        info_frame.pack(fill=tk.BOTH, expand=True, pady=(4, 10))

        self.stats_frame = ttk.Frame(info_frame)
        self.stats_frame.pack(fill=tk.X, pady=(0, 10))

        self.stats_labels = {}
        stats = [("Files:", "total_files"), ("Size:", "total_size"), ("Avg:", "avg_size"), ("Largest:", "largest"), ("Smallest:", "smallest")]

        for i, (text, key) in enumerate(stats):
            ttk.Label(self.stats_frame, text=text, font=("Segoe UI", 9)).grid(row=0, column=i*2, sticky=tk.W, padx=(10 if i > 0 else 0, 2))
            self.stats_labels[key] = ttk.Label(self.stats_frame, text="-", font=("Segoe UI", 9, "bold"))
            self.stats_labels[key].grid(row=0, column=i*2+1, sticky=tk.W, padx=(0, 10))

        tree_frame = ttk.Frame(info_frame)
        tree_frame.pack(fill=tk.BOTH, expand=True)
        tree_frame.grid_rowconfigure(0, weight=1)
        tree_frame.grid_columnconfigure(0, weight=1)

        columns = ("name", "ext", "type", "size", "status", "modified", "created")
        self.file_tree = ttk.Treeview(tree_frame, columns=columns, show="headings", height=10)

        self.file_tree.heading("name", text="File Name")
        self.file_tree.heading("ext", text="Ext")
        self.file_tree.heading("type", text="Type")
        self.file_tree.heading("size", text="Size")
        self.file_tree.heading("status", text="Status")
        self.file_tree.heading("modified", text="Modified")
        self.file_tree.heading("created", text="Created")

        self.file_tree.column("name", width=200, minwidth=150, stretch=True)
        self.file_tree.column("ext", width=60, minwidth=50, stretch=False)
        self.file_tree.column("type", width=80, minwidth=60, stretch=False)
        self.file_tree.column("size", width=90, minwidth=70, stretch=False)
        self.file_tree.column("status", width=90, minwidth=70, stretch=False)
        self.file_tree.column("modified", width=140, minwidth=120, stretch=False)
        self.file_tree.column("created", width=140, minwidth=120, stretch=False)

        scrollbar_y = ttk.Scrollbar(tree_frame, orient=tk.VERTICAL, command=self.file_tree.yview)
        self.file_tree.configure(yscrollcommand=scrollbar_y.set)

        self.file_tree.grid(row=0, column=0, sticky="nsew")
        scrollbar_y.grid(row=0, column=1, sticky="ns")

        # Status bar
        status_frame = ttk.Frame(main_frame)
        status_frame.pack(fill=tk.X)

        self.status_label = ttk.Label(status_frame, textvariable=self.status_var, font=("Segoe UI", 9))
        self.status_label.pack(side=tk.LEFT)

        # Footer right side
        footer_frame = ttk.Frame(status_frame)
        footer_frame.pack(side=tk.RIGHT)

        ttk.Label(footer_frame, text="v1  |  ", font=("Segoe UI", 9)).pack(side=tk.LEFT)

        # GitHub link
        github_link = tk.Label(footer_frame, text="GitHub", font=("Segoe UI", 9, "underline"),
                               fg="#6ea8fe", bg=DARK_BG, cursor="hand2")
        github_link.pack(side=tk.LEFT)
        github_link.bind("<Button-1>", lambda e: webbrowser.open("https://github.com/kingchenc/vaultic"))

        ttk.Label(footer_frame, text="  |  made with ", font=("Segoe UI", 9)).pack(side=tk.LEFT)
        tk.Label(footer_frame, text="♥", font=("Segoe UI", 9), fg="#ff6b6b", bg=DARK_BG).pack(side=tk.LEFT)
        ttk.Label(footer_frame, text=" by kingchenc", font=("Segoe UI", 9)).pack(side=tk.LEFT)

    def setup_drag_drop(self):
        """Setup drag and drop on entire window if available."""
        if DND_AVAILABLE and hasattr(self.root, 'drop_target_register'):
            try:
                self.root.drop_target_register(DND_FILES)  # type: ignore
                self.root.dnd_bind('<<Drop>>', self.on_drop)  # type: ignore
            except Exception:
                pass

    def on_close(self):
        """Handle window close with unlock warning."""
        if self.unlocked_folder:
            encrypted_files = get_files_to_decrypt(self.unlocked_folder)
            if not encrypted_files:  # Folder is currently unlocked
                result = DarkMessageBox.ask3way(
                    self.root,
                    "Folder Still Unlocked",
                    f"The folder '{os.path.basename(self.unlocked_folder)}' is still unlocked.\n\n"
                    "Would you like to lock it before closing?",
                    "Lock First", "Close Anyway", "Cancel"
                )

                if result == "Lock First":
                    password = self.password_var.get()
                    if password:
                        self.lock_folder()
                        # Check if lock was successful
                        encrypted_files = get_files_to_decrypt(self.unlocked_folder)
                        if encrypted_files:
                            self.root.destroy()
                    else:
                        DarkMessageBox.showwarning(self.root, "Warning",
                            "Enter password and click Lock Folder manually.")
                    return
                elif result == "Close Anyway":
                    self.root.destroy()
                # Cancel - do nothing
                return

        self.root.destroy()

    def on_drop(self, event):
        """Handle dropped folder."""
        path = event.data
        # Clean up path (remove braces on Windows)
        if path.startswith('{') and path.endswith('}'):
            path = path[1:-1]
        path = path.strip()

        if not os.path.isdir(path):
            DarkMessageBox.showerror(self.root, "Error", "Please drop a folder, not a file")
            return

        # If a folder is already loaded, ask for confirmation
        current = self.selected_folder.get()
        if current and current != path:
            result = DarkMessageBox.askyesno(
                self.root,
                "Switch Folder",
                f"Currently loaded: {os.path.basename(current)}\n\n"
                f"Switch to: {os.path.basename(path)}?"
            )
            if not result:
                return

        self.handle_folder_change(path)

    def handle_folder_change(self, new_folder: str):
        """Handle folder change with unlock warning."""
        # Check if current folder is unlocked
        if self.unlocked_folder and self.unlocked_folder != new_folder:
            encrypted_files = get_files_to_decrypt(self.unlocked_folder)
            if not encrypted_files:  # Folder is currently unlocked
                result = DarkMessageBox.ask3way(
                    self.root,
                    "Folder Still Unlocked",
                    f"The folder '{os.path.basename(self.unlocked_folder)}' is still unlocked.\n\nWould you like to lock it first?",
                    "Lock First", "Ignore", "Cancel"
                )

                if result == "Lock First":
                    # Try to lock with stored password
                    password = self.password_var.get()
                    if password:
                        old_folder = self.selected_folder.get()
                        self.selected_folder.set(self.unlocked_folder)
                        self.lock_folder()
                        self.selected_folder.set(old_folder)
                    else:
                        DarkMessageBox.showwarning(self.root, "Warning", "Enter password and click Lock Folder manually")
                        return
                elif result == "Cancel" or result is None:
                    return
                # "Ignore" continues to new folder

        self.selected_folder.set(new_folder)
        self.update_folder_status(new_folder)

    def toggle_password(self):
        self.password_entry.config(show="" if self.show_password.get() else "*")

    def update_password_strength(self, *args):
        password = self.password_var.get()
        score, text, color = analyze_password_strength(password)
        self.strength_label.config(text=text, fg=color)

    def browse_folder(self):
        folder = filedialog.askdirectory()
        if folder:
            self.handle_folder_change(folder)

    def create_folder(self):
        dialog = CreateFolderDialog(self.root)
        if dialog.result:
            new_folder = dialog.result["path"]
            try:
                os.makedirs(new_folder, exist_ok=False)
                self.handle_folder_change(new_folder)
                self.status_var.set(f"Created new folder: {os.path.basename(new_folder)}")
                DarkMessageBox.showinfo(self.root, "Success", f"Folder created!\n\n{new_folder}\n\nNow use 'Lock Folder' to encrypt files.")
            except FileExistsError:
                DarkMessageBox.showerror(self.root, "Error", "A folder with this name already exists!")
            except Exception as e:
                DarkMessageBox.showerror(self.root, "Error", f"Failed to create folder: {str(e)}")

    def update_folder_status(self, folder: str):
        config = load_config(folder)
        all_files = get_files_to_encrypt(folder)
        encrypted_files = get_files_to_decrypt(folder)

        if config:
            algorithm = config.get("encryption", "Fernet")
            self.current_algorithm.set(algorithm)

            # Build status with 2FA indicator
            has_2fa = config.get("totp_enabled", False)
            twofa_text = " + 2FA" if has_2fa else ""

            self.encryption_status_var.set(f"Encryption: {algorithm}{twofa_text}")
            self.encryption_badge.config(text=algorithm)

            if encrypted_files and not all_files:
                status = f"LOCKED - {len(encrypted_files)} file(s)"
                self.unlocked_folder = None
            elif all_files and not encrypted_files:
                status = f"UNLOCKED - {len(all_files)} file(s)"
                self.unlocked_folder = folder
            else:
                status = f"MIXED - {len(all_files)} unlocked, {len(encrypted_files)} locked"
                self.unlocked_folder = folder if all_files else None

            if config.get("hint"):
                self.hint_var.set(f"Hint: {config['hint']}")
            else:
                self.hint_var.set("")

            self.status_var.set("Ready - Enter password to lock/unlock")
        else:
            status = f"NEW FOLDER - {len(all_files)} file(s) - Set password first"
            self.hint_var.set("")
            self.encryption_status_var.set(f"Will use: {self.current_algorithm.get()}")
            self.encryption_badge.config(text=self.current_algorithm.get())
            self.status_var.set("Set a password to protect this folder")
            self.unlocked_folder = None

        self.folder_status_var.set(status)
        self.display_folder_files(folder)

    def display_folder_files(self, folder: str):
        for item in self.file_tree.get_children():
            self.file_tree.delete(item)

        for key in self.stats_labels:
            self.stats_labels[key].config(text="-")

        files = []
        encrypted_count = 0
        for root, _, filenames in os.walk(folder):
            for filename in filenames:
                if filename == CONFIG_FILE:
                    continue
                filepath = os.path.join(root, filename)
                try:
                    stat = os.stat(filepath)
                    is_encrypted = filepath.endswith(ENCRYPTED_EXT)

                    if is_encrypted:
                        encrypted_count += 1
                        display_name = f"[Encrypted #{encrypted_count}]"
                        ext = "-"
                        file_type = "Encrypted"
                    else:
                        display_name = filename
                        ext = get_file_extension(filename)
                        file_type = get_file_type(filename)

                    files.append({
                        "name": display_name,
                        "ext": ext,
                        "type": file_type,
                        "size": stat.st_size,
                        "status": "Locked" if is_encrypted else "Unlocked",
                        "modified": datetime.fromtimestamp(stat.st_mtime),
                        "created": datetime.fromtimestamp(stat.st_ctime),
                    })
                except Exception:
                    continue

        if not files:
            return

        files.sort(key=lambda x: x["name"].lower())

        for f in files:
            self.file_tree.insert("", tk.END, values=(
                f["name"], f["ext"], f["type"], format_size(f["size"]), f["status"],
                f["modified"].strftime("%Y-%m-%d %H:%M"), f["created"].strftime("%Y-%m-%d %H:%M")
            ))

        sizes = [f["size"] for f in files]
        total_size = sum(sizes)

        self.stats_labels["total_files"].config(text=str(len(files)))
        self.stats_labels["total_size"].config(text=format_size(total_size))
        self.stats_labels["avg_size"].config(text=format_size(total_size // len(files)))
        self.stats_labels["largest"].config(text=format_size(max(sizes)))
        self.stats_labels["smallest"].config(text=format_size(min(sizes)))

    def validate_inputs(self) -> bool:
        if not self.selected_folder.get():
            DarkMessageBox.showerror(self.root, "Error", "Please select a folder first")
            return False
        if not self.password_var.get():
            DarkMessageBox.showerror(self.root, "Error", "Please enter a password")
            return False
        return True

    def verify_password(self, folder: str, password: str) -> tuple:
        """Verify password. Returns (is_valid, salt)."""
        config = load_config(folder)
        if not config:
            return False, None

        salt = base64.urlsafe_b64decode(config["salt"])
        stored_hash = config["password_hash"]
        config_version = config.get("version", 1)

        if config_version >= 2:
            is_valid = SecureKeyDerivation.verify_password(password, salt, stored_hash)
        else:
            # Legacy v1 verification (for backwards compatibility)
            from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
            kdf = PBKDF2HMAC(algorithm=hashes.SHA256(), length=32, salt=salt, iterations=100000)
            computed = base64.urlsafe_b64encode(kdf.derive(password.encode())).decode()
            is_valid = secrets.compare_digest(computed, stored_hash)

        return is_valid, salt

    def verify_recovery_key(self, folder: str, recovery_key: str) -> bool:
        config = load_config(folder)
        if not config or "recovery_key_hash" not in config:
            return False

        salt = base64.urlsafe_b64decode(config["salt"])
        stored_hash = config["recovery_key_hash"]
        config_version = config.get("version", 1)

        if config_version >= 2:
            return SecureKeyDerivation.verify_password(recovery_key, salt, stored_hash)
        else:
            from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
            kdf = PBKDF2HMAC(algorithm=hashes.SHA256(), length=32, salt=salt, iterations=100000)
            computed = base64.urlsafe_b64encode(kdf.derive(recovery_key.encode())).decode()
            return secrets.compare_digest(computed, stored_hash)

    def verify_2fa(self, folder: str, key: bytes) -> bool:
        """Verify 2FA if enabled. Returns True if verified or not required."""
        config = load_config(folder)
        if not config or not config.get("totp_enabled"):
            return True

        dialog = Verify2FADialog(self.root)
        if not dialog.result:
            return False

        code = dialog.result["code"]

        # Try TOTP code first
        try:
            totp_secret = TOTPManager.decrypt_secret(config["totp_secret"], key)
            if TOTPManager.verify_code(totp_secret, code):
                return True
        except Exception:
            pass

        # Try backup code
        try:
            backup_codes = TOTPManager.decrypt_backup_codes(config["totp_backup_codes"], key)
            if code in backup_codes:
                # Remove used backup code
                backup_codes.remove(code)
                config["totp_backup_codes"] = TOTPManager.encrypt_backup_codes(backup_codes, key)
                save_config(folder, config)
                DarkMessageBox.showinfo(self.root, "Backup Code Used",
                    f"Backup code accepted.\n\n{len(backup_codes)} backup codes remaining.")
                return True
        except Exception:
            pass

        DarkMessageBox.showerror(self.root, "Error", "Invalid 2FA code")
        return False

    def change_password(self):
        if not self.selected_folder.get():
            DarkMessageBox.showerror(self.root, "Error", "Please select a folder first")
            return

        folder = self.selected_folder.get()
        config = load_config(folder)

        if not config:
            DarkMessageBox.showerror(self.root, "Error", "No password set for this folder.\nUse 'Lock Folder' to set up protection first.")
            return

        # Check if folder has locked files - must unlock first
        encrypted_files = get_files_to_decrypt(folder)
        if encrypted_files:
            DarkMessageBox.showerror(self.root, "Error",
                "Cannot change password while files are locked.\n\n"
                "Please unlock the folder first, then change password.")
            return

        dialog = ChangePasswordDialog(self.root, folder, self.verify_password)
        if dialog.result:
            salt = os.urandom(16)
            password_hash = SecureKeyDerivation.derive_verify_hash(dialog.result["password"], salt)
            encryption_key = SecureKeyDerivation.derive_encryption_key(dialog.result["password"], salt)

            recovery_key = generate_recovery_key()
            recovery_key_hash = SecureKeyDerivation.derive_verify_hash(recovery_key, salt)

            config["version"] = CONFIG_VERSION
            config["salt"] = base64.urlsafe_b64encode(salt).decode()
            config["password_hash"] = password_hash
            config["recovery_key_hash"] = recovery_key_hash
            config["hint"] = dialog.result.get("hint", config.get("hint", ""))
            config["modified"] = datetime.now().isoformat()

            # Re-encrypt 2FA secrets if enabled
            if config.get("totp_enabled") and config.get("totp_secret"):
                # Need old key to decrypt, then re-encrypt with new key
                # Since we changed password, 2FA is disabled
                config["totp_enabled"] = False
                config.pop("totp_secret", None)
                config.pop("totp_backup_codes", None)
                DarkMessageBox.showwarning(self.root, "2FA Disabled",
                    "2FA has been disabled due to password change.\nPlease set up 2FA again if needed.")

            save_config(folder, config)
            RecoveryKeyDialog(self.root, recovery_key)

            self.update_folder_status(folder)
            self.status_var.set("Password changed successfully!")

    def change_encryption(self):
        if not self.selected_folder.get():
            DarkMessageBox.showerror(self.root, "Error", "Please select a folder first")
            return

        folder = self.selected_folder.get()
        config = load_config(folder)

        if not config:
            DarkMessageBox.showerror(self.root, "Error", "No password set for this folder.\nUse 'Lock Folder' first.")
            return

        current_algorithm = config.get("encryption", "Fernet")
        dialog = ChangeEncryptionDialog(self.root, current_algorithm)
        if dialog.result:
            new_algorithm = dialog.result["encryption"]
            if new_algorithm != current_algorithm:
                config["encryption"] = new_algorithm
                config["modified"] = datetime.now().isoformat()
                save_config(folder, config)

                self.current_algorithm.set(new_algorithm)
                self.update_folder_status(folder)
                self.status_var.set(f"Encryption changed to {new_algorithm}!")
            else:
                self.status_var.set("Encryption unchanged.")

    def forgot_password(self):
        if not self.selected_folder.get():
            DarkMessageBox.showerror(self.root, "Error", "Please select a folder first")
            return

        folder = self.selected_folder.get()
        config = load_config(folder)

        if not config:
            DarkMessageBox.showerror(self.root, "Error", "No password set for this folder.")
            return

        # Check if folder has locked files - must unlock first
        encrypted_files = get_files_to_decrypt(folder)
        if encrypted_files:
            DarkMessageBox.showerror(self.root, "Error",
                "Cannot reset password while files are locked.\n\n"
                "The encryption key is derived from your password.\n"
                "Without the original password, locked files cannot be recovered.\n\n"
                "If you remember your password, unlock first, then change it.")
            return

        if "recovery_key_hash" not in config:
            DarkMessageBox.showerror(self.root, "Error",
                "No recovery key was set for this folder.\n\nUnfortunately, without the recovery key or password,\nyour files cannot be recovered.")
            return

        current_algorithm = config.get("encryption", "Fernet")
        dialog = RecoveryDialog(self.root, folder, self.verify_recovery_key, current_algorithm)
        if dialog.result:
            salt = os.urandom(16)
            password_hash = SecureKeyDerivation.derive_verify_hash(dialog.result["password"], salt)

            recovery_key = generate_recovery_key()
            recovery_key_hash = SecureKeyDerivation.derive_verify_hash(recovery_key, salt)

            config["version"] = CONFIG_VERSION
            config["salt"] = base64.urlsafe_b64encode(salt).decode()
            config["password_hash"] = password_hash
            config["recovery_key_hash"] = recovery_key_hash
            config["hint"] = dialog.result.get("hint", "")
            config["recovered"] = datetime.now().isoformat()

            # Disable 2FA on recovery
            config["totp_enabled"] = False
            config.pop("totp_secret", None)
            config.pop("totp_backup_codes", None)

            save_config(folder, config)
            RecoveryKeyDialog(self.root, recovery_key)

            self.update_folder_status(folder)
            self.status_var.set("Password reset successfully!")

    def setup_2fa(self):
        if not self.selected_folder.get():
            DarkMessageBox.showerror(self.root, "Error", "Please select a folder first")
            return

        folder = self.selected_folder.get()
        config = load_config(folder)

        if not config:
            DarkMessageBox.showerror(self.root, "Error", "Set a password first before enabling 2FA")
            return

        # Must be unlocked to setup 2FA
        encrypted_files = get_files_to_decrypt(folder)
        if encrypted_files:
            DarkMessageBox.showerror(self.root, "Error",
                "Cannot setup 2FA while files are locked.\n\n"
                "Please unlock the folder first.")
            return

        if config.get("totp_enabled"):
            DarkMessageBox.showinfo(self.root, "Info", "2FA is already enabled for this folder")
            return

        # Verify password first
        password = self.password_var.get()
        if not password:
            DarkMessageBox.showerror(self.root, "Error", "Enter your password first")
            return

        is_valid, salt = self.verify_password(folder, password)
        if not is_valid:
            DarkMessageBox.showerror(self.root, "Error", "Incorrect password")
            return

        dialog = Setup2FADialog(self.root, os.path.basename(folder))
        if dialog.result:
            config_version = config.get("version", 1)
            if config_version >= 2:
                encryption_key = SecureKeyDerivation.derive_encryption_key(password, salt)
            else:
                # Legacy key derivation
                kdf = PBKDF2HMAC(algorithm=hashes.SHA256(), length=32, salt=salt, iterations=100000)
                encryption_key = kdf.derive(password.encode())

            config["totp_enabled"] = True
            config["totp_secret"] = TOTPManager.encrypt_secret(dialog.result["secret"], encryption_key)
            backup_codes = dialog.result["backup_codes"]
            config["totp_backup_codes"] = TOTPManager.encrypt_backup_codes(backup_codes, encryption_key)
            config["modified"] = datetime.now().isoformat()

            save_config(folder, config)

            # Show backup codes dialog with copy & confirm
            BackupCodesDialog(self.root, backup_codes)

            self.update_folder_status(folder)

    def disable_2fa(self):
        if not self.selected_folder.get():
            DarkMessageBox.showerror(self.root, "Error", "Please select a folder first")
            return

        folder = self.selected_folder.get()
        config = load_config(folder)

        if not config:
            DarkMessageBox.showerror(self.root, "Error", "No configuration for this folder")
            return

        if not config.get("totp_enabled"):
            DarkMessageBox.showinfo(self.root, "Info", "2FA is not enabled for this folder")
            return

        # Verify password
        password = self.password_var.get()
        if not password:
            DarkMessageBox.showerror(self.root, "Error", "Enter your password first")
            return

        is_valid, salt = self.verify_password(folder, password)
        if not is_valid:
            DarkMessageBox.showerror(self.root, "Error", "Incorrect password")
            return

        # Get encryption key for 2FA verification
        config_version = config.get("version", 1)
        if config_version >= 2:
            encryption_key = SecureKeyDerivation.derive_encryption_key(password, salt)
        else:
            kdf = PBKDF2HMAC(algorithm=hashes.SHA256(), length=32, salt=salt, iterations=100000)
            encryption_key = kdf.derive(password.encode())

        # Verify 2FA before disabling
        if not self.verify_2fa(folder, encryption_key):
            return

        if DarkMessageBox.askyesno(self.root, "Disable 2FA", "Are you sure you want to disable Two-Factor Authentication?"):
            config["totp_enabled"] = False
            config.pop("totp_secret", None)
            config.pop("totp_backup_codes", None)
            config["modified"] = datetime.now().isoformat()

            save_config(folder, config)
            DarkMessageBox.showsuccess(self.root, "Success", "2FA has been disabled")
            self.update_folder_status(folder)

    def lock_folder(self):
        if not self.selected_folder.get():
            DarkMessageBox.showerror(self.root, "Error", "Please select a folder first")
            return

        folder = self.selected_folder.get()
        config = load_config(folder)
        files = get_files_to_encrypt(folder)

        if not config:
            dialog = FirstLockDialog(self.root, folder, len(files))
            if not dialog.result:
                return

            password = dialog.result["password"]
            algorithm = dialog.result["encryption"]
            hint = dialog.result.get("hint", "")
            enable_2fa = dialog.result.get("enable_2fa", False)

            salt = os.urandom(16)
            password_hash = SecureKeyDerivation.derive_verify_hash(password, salt)
            encryption_key = SecureKeyDerivation.derive_encryption_key(password, salt)

            recovery_key = generate_recovery_key()
            recovery_key_hash = SecureKeyDerivation.derive_verify_hash(recovery_key, salt)

            config = {
                "version": CONFIG_VERSION,
                "salt": base64.urlsafe_b64encode(salt).decode(),
                "password_hash": password_hash,
                "recovery_key_hash": recovery_key_hash,
                "encryption": algorithm,
                "hint": hint,
                "created": datetime.now().isoformat(),
                "totp_enabled": False,
            }

            backup_codes = None

            if enable_2fa:
                twofa_dialog = Setup2FADialog(self.root, os.path.basename(folder))
                if twofa_dialog.result:
                    config["totp_enabled"] = True
                    config["totp_secret"] = TOTPManager.encrypt_secret(twofa_dialog.result["secret"], encryption_key)
                    backup_codes = twofa_dialog.result["backup_codes"]
                    config["totp_backup_codes"] = TOTPManager.encrypt_backup_codes(backup_codes, encryption_key)

            save_config(folder, config)
            RecoveryKeyDialog(self.root, recovery_key, backup_codes)

            self.current_algorithm.set(algorithm)

            if not files:
                self.update_folder_status(folder)
                self.status_var.set("Folder protection configured!")
                DarkMessageBox.showsuccess(self.root, "Success",
                    f"Folder protection configured!\n\nEncryption: {algorithm}\n\nNo files to encrypt yet.")
                return

            key = encryption_key
        else:
            algorithm = config.get("encryption", "Fernet")

            password = self.password_var.get()
            if not password:
                DarkMessageBox.showerror(self.root, "Error", "Please enter your password")
                return

            is_valid, salt = self.verify_password(folder, password)
            if not is_valid:
                DarkMessageBox.showerror(self.root, "Error", "Incorrect password")
                return

            if not files:
                DarkMessageBox.showinfo(self.root, "Info",
                    f"Folder is protected with {algorithm}.\n\nNo unencrypted files to lock.")
                return

            if not DarkMessageBox.askyesno(self.root, "Confirm Lock",
                f"This will encrypt {len(files)} file(s) using {algorithm}.\n\nContinue?"):
                return

            config_version = config.get("version", 1)
            if config_version >= 2:
                key = SecureKeyDerivation.derive_encryption_key(password, salt)
            else:
                kdf = PBKDF2HMAC(algorithm=hashes.SHA256(), length=32, salt=salt, iterations=100000)
                key = kdf.derive(password.encode())

        self.status_var.set("Encrypting files...")
        self.root.update()

        encrypted_count = 0
        total_size = 0
        errors = []

        for i, filepath in enumerate(files):
            self.status_var.set(f"Encrypting... ({i+1}/{len(files)})")
            self.root.update()
            try:
                _, size = encrypt_file(filepath, key, algorithm)
                total_size += size
                encrypted_count += 1
            except Exception as e:
                errors.append(f"{os.path.basename(filepath)}: {str(e)}")

        config["last_locked"] = datetime.now().isoformat()
        # Don't store file count/size - info leak, can be calculated from files
        save_config(folder, config)

        self.unlocked_folder = None
        self.update_folder_status(folder)

        if encrypted_count == len(files):
            self.status_var.set(f"Locked! {encrypted_count} file(s) encrypted ({format_size(total_size)})")
            DarkMessageBox.showsuccess(self.root, "Success",
                f"Folder locked!\n\n{encrypted_count} file(s) encrypted\nTotal size: {format_size(total_size)}\nAlgorithm: {algorithm}")
        elif encrypted_count > 0:
            self.status_var.set(f"Partially locked: {encrypted_count}/{len(files)} files")
            DarkMessageBox.showwarning(self.root, "Partial Success",
                f"{encrypted_count}/{len(files)} file(s) encrypted.\n\nFailed:\n" + "\n".join(errors[:5]))
        else:
            self.status_var.set("Encryption failed")
            DarkMessageBox.showerror(self.root, "Error", "Encryption failed:\n" + "\n".join(errors[:5]))

    def unlock_folder(self):
        if not self.validate_inputs():
            return

        folder = self.selected_folder.get()
        password = self.password_var.get()

        config = load_config(folder)
        if not config:
            DarkMessageBox.showerror(self.root, "Error", "This folder has no encryption config")
            return

        is_valid, salt = self.verify_password(folder, password)
        if not is_valid:
            DarkMessageBox.showerror(self.root, "Error", "Incorrect password")
            return

        files = get_files_to_decrypt(folder)
        if not files:
            DarkMessageBox.showinfo(self.root, "Info", "No encrypted files in this folder")
            return

        algorithm = config.get("encryption", "Fernet")
        config_version = config.get("version", 1)

        if config_version >= 2:
            key = SecureKeyDerivation.derive_encryption_key(password, salt)
        else:
            kdf = PBKDF2HMAC(algorithm=hashes.SHA256(), length=32, salt=salt, iterations=100000)
            key = kdf.derive(password.encode())

        # Verify 2FA
        if not self.verify_2fa(folder, key):
            return

        self.status_var.set("Decrypting files...")
        self.root.update()

        decrypted_files = []
        decrypted_count = 0
        errors = []

        for i, filepath in enumerate(files):
            self.status_var.set(f"Decrypting... ({i+1}/{len(files)})")
            self.root.update()
            try:
                file_info = decrypt_file(filepath, key, algorithm)
                decrypted_files.append(file_info)
                decrypted_count += 1
            except Exception as e:
                errors.append(f"{os.path.basename(filepath)}: {str(e)}")

        config["last_unlocked"] = datetime.now().isoformat()
        save_config(folder, config)

        self.unlocked_folder = folder
        self.update_folder_status(folder)

        if decrypted_count == len(files):
            self.show_unlock_report(decrypted_files, folder, algorithm)
        elif decrypted_count > 0:
            self.status_var.set(f"Partially unlocked: {decrypted_count}/{len(files)} files")
            DarkMessageBox.showwarning(self.root, "Partial Success",
                f"{decrypted_count}/{len(files)} file(s) decrypted.\n\nFailed:\n" + "\n".join(errors[:5]))
        else:
            self.status_var.set("Decryption failed")
            DarkMessageBox.showerror(self.root, "Error",
                "Decryption failed:\n" + "\n".join(errors[:3]) + "\n\nWrong password?")

    def show_unlock_report(self, files: list, folder: str, algorithm: str):
        total_size = sum(f["size"] for f in files)
        avg_size = total_size // len(files) if files else 0
        largest = max(files, key=lambda x: x["size"]) if files else None
        smallest = min(files, key=lambda x: x["size"]) if files else None

        types = {}
        for f in files:
            ftype = get_file_type(f["name"])
            types[ftype] = types.get(ftype, 0) + 1

        UnlockReportDialog(self.root, {
            "folder": folder, "files": files, "total_files": len(files),
            "total_size": total_size, "avg_size": avg_size,
            "largest": largest, "smallest": smallest, "types": types, "algorithm": algorithm,
        })

        self.status_var.set(f"Unlocked! {len(files)} file(s) decrypted ({format_size(total_size)})")


# =============================================================================
# MAIN ENTRY POINT
# =============================================================================

def main():
    global DND_AVAILABLE

    # Try DnD-enabled window, fall back to standard if it fails
    if DND_AVAILABLE:
        try:
            root = TkinterDnD.Tk()
        except RuntimeError:
            # tkdnd library not found (common in .exe builds)
            DND_AVAILABLE = False
            root = tk.Tk()
    else:
        root = tk.Tk()

    setup_dark_theme(root)
    app = VaulticApp(root)
    root.mainloop()


if __name__ == "__main__":
    main()