fix: hardening fixes from full-codebase review

docs/IMPLEMENTATION.md

@@ -159,7 +159,10 @@ def load_config() -> AppConfig: ...
     """Load QSettings + DPAPI. Unknown keys get field defaults."""
 
 def save_config(cfg: AppConfig) -> None: ...
-    """Persist to QSettings + DPAPI. api_key fields go through DPAPI."""
+    """Persist to QSettings + DPAPI. api_key and custom-header fields go through DPAPI."""
+
+def has_plaintext_secrets() -> bool: ...
+    """True if any secret field still sits as plaintext in settings.ini."""
 
 def reset_config() -> AppConfig: ...
     """Fresh AppConfig with all defaults. Does not write disk."""
@@ -282,7 +285,7 @@ class RecordingSnackbar(QWidget):
 
 ```python
 class PasswordField(QLineEdit):
-    """Password line edit that reveals text only while focused."""
+    """Masked line edit with an explicit trailing show/hide toggle action."""
 
 class SettingsDialog(QDialog):
     def __init__(
@@ -477,5 +480,5 @@ Do not proceed to Phase 2 until review passes.
 - No modules beyond the 11 listed. No new dependencies.
 - Do not implement packaging (PyInstaller), code signing, or cross-platform hotkey backends.
 - Autostart registration is implemented in `startup.py`.
-- All paths: `%LOCALAPPDATA%/Screamer/`. API keys: DPAPI. Plain settings: QSettings (IniFormat).
+- All paths: `%LOCALAPPDATA%/Screamer/`. API keys + custom headers: DPAPI. Plain settings: QSettings (IniFormat).
 - If a Phase 2 bug forces a Phase 1 API change, document it in the review checkpoint and get re-approval.

src/config.py

@@ -6,6 +6,7 @@
 import logging
 import os
 import platform
+import sys
 from dataclasses import dataclass, field, fields
 from logging.handlers import RotatingFileHandler
 from urllib.parse import urlsplit
@@ -304,12 +305,17 @@ def llm_fallback_provider(self) -> FallbackProviderConfig:
         )
 
 
-# Fields that contain secret API keys and must go through DPAPI.
+# Fields that contain secrets and must go through DPAPI: API keys, plus custom
+# headers (which routinely carry tokens such as X-Api-Key).
 _SECRET_FIELDS = frozenset({
     "stt_api_key",
     "stt_fallback_api_key",
     "llm_api_key",
     "llm_fallback_api_key",
+    "stt_custom_headers",
+    "stt_fallback_custom_headers",
+    "llm_custom_headers",
+    "llm_fallback_custom_headers",
 })
 
 # DPAPI entropy string bound to this application.
@@ -482,12 +488,25 @@ def save_config(cfg: AppConfig) -> None:
     settings = _get_qsettings()
     for f in fields(AppConfig):
         if f.name in _SECRET_FIELDS:
+            # Purge any plaintext value an older version left in the ini, so it
+            # cannot shadow the DPAPI-stored value on the next load.
+            settings.remove(f.name)
             continue
         settings.setValue(f.name, getattr(cfg, f.name))
     settings.sync()
     _save_secrets(cfg)
 
 
+def has_plaintext_secrets() -> bool:
+    """True if any secret field still sits as plaintext in settings.ini.
+
+    Older versions wrote custom headers to the ini; save_config purges them,
+    but the purge only happens on save — callers use this to force one.
+    """
+    settings = _get_qsettings()
+    return any(settings.contains(name) for name in _SECRET_FIELDS)
+
+
 def reset_config() -> AppConfig:
     """Fresh AppConfig with all defaults. Does not write disk."""
     return AppConfig()
@@ -560,15 +579,23 @@ def validate_config(cfg: AppConfig) -> list[ConfigValidationIssue]:
     return issues
 
 
+def _env_path() -> str:
+    """Locate .env: next to the executable when frozen, else at cwd (dev runs)."""
+    if getattr(sys, "frozen", False):
+        return os.path.join(os.path.dirname(sys.executable), ".env")
+    return os.path.join(os.getcwd(), ".env")
+
+
 def import_from_env(cfg: AppConfig) -> AppConfig:
-    """Read .env at cwd; backfill ONLY empty str fields. No-op if no .env file."""
+    """Read .env (exe dir when frozen, else cwd); backfill ONLY empty str fields.
+    No-op if no .env file."""
     try:
         from dotenv import dotenv_values
     except ImportError:
         log.debug("python-dotenv not installed; skipping .env import")
         return cfg
 
-    env_path = os.path.join(os.getcwd(), ".env")
+    env_path = _env_path()
     if not os.path.exists(env_path):
         return cfg
 

src/injector.py

@@ -19,6 +19,12 @@
 }
 
 
+def _utf16_units(value: str) -> list[str]:
+    """Split *value* into UTF-16 code units (surrogate pairs become two units)."""
+    encoded = value.encode("utf-16-le", errors="surrogatepass")
+    return [chr(int.from_bytes(encoded[i : i + 2], "little")) for i in range(0, len(encoded), 2)]
+
+
 def type_text(text: str, post_key: str | None = None) -> None:
     """Type *text* into the active window via Win32 SendInput.
 
@@ -90,14 +96,6 @@ def _raise_sendinput_failed(detail: str) -> None:
             detail = f"{detail} (WinError {err})"
         raise ScreamerError(AppError.INJECTION_FAILED, detail)
 
-    def _send_unicode(char: str, key_up: bool = False) -> None:
-        inp = INPUT()
-        inp.type = INPUT_KEYBOARD
-        inp.ki.wScan = ord(char)
-        inp.ki.dwFlags = KEYEVENTF_UNICODE | (KEYEVENTF_KEYUP if key_up else 0)
-        if user32.SendInput(1, ctypes.byref(inp), ctypes.sizeof(INPUT)) != 1:
-            _raise_sendinput_failed(f"SendInput failed for U+{ord(char):04X}")
-
     def _send_vk(vk: int, key_up: bool = False) -> None:
         inp = INPUT()
         inp.type = INPUT_KEYBOARD
@@ -106,16 +104,30 @@ def _send_vk(vk: int, key_up: bool = False) -> None:
         if user32.SendInput(1, ctypes.byref(inp), ctypes.sizeof(INPUT)) != 1:
             _raise_sendinput_failed(f"SendInput failed for VK 0x{vk:02X}")
 
-    def _utf16_units(value: str) -> list[str]:
-        encoded = value.encode("utf-16-le", errors="surrogatepass")
-        return [chr(int.from_bytes(encoded[i : i + 2], "little")) for i in range(0, len(encoded), 2)]
-
     try:
         with log_duration(log, f"Text injection ({len(text)} chars)"):
             log.info("Typing %d characters", len(text))
-            for ch in _utf16_units(text):
-                _send_unicode(ch)
-                _send_unicode(ch, key_up=True)
+            # One batched SendInput call: atomic with respect to concurrent
+            # user input and far fewer syscalls than per-character sends.
+            units = _utf16_units(text)
+            if units:
+                count = 2 * len(units)
+                batch = (INPUT * count)()
+                for i, unit in enumerate(units):
+                    code = ord(unit)
+                    down = batch[2 * i]
+                    down.type = INPUT_KEYBOARD
+                    down.ki.wScan = code
+                    down.ki.dwFlags = KEYEVENTF_UNICODE
+                    up = batch[2 * i + 1]
+                    up.type = INPUT_KEYBOARD
+                    up.ki.wScan = code
+                    up.ki.dwFlags = KEYEVENTF_UNICODE | KEYEVENTF_KEYUP
+                sent = user32.SendInput(count, batch, ctypes.sizeof(INPUT))
+                # Partial injection (sent < count) means a prefix of the text
+                # was already typed; there is no rollback — surface the counts.
+                if sent != count:
+                    _raise_sendinput_failed(f"SendInput injected {sent}/{count} events")
 
             # Post-type key with 0.05s delay.
             if post_key and post_key != "none":

src/main.py

@@ -7,6 +7,7 @@
 
 from __future__ import annotations
 
+import copy
 import logging
 import threading
 from typing import Any
@@ -29,6 +30,7 @@
     POST_KEY_OPTIONS,
     AppConfig,
     Hotkey,
+    has_plaintext_secrets,
     import_from_env,
     load_config,
     save_config,
@@ -116,8 +118,12 @@ def __init__(self, startup_mode: bool = False) -> None:
         super().__init__()
 
         self._config = load_config()
-        self._config = import_from_env(self._config)
-        save_config(self._config)
+        imported = import_from_env(copy.deepcopy(self._config))
+        if imported != self._config or has_plaintext_secrets():
+            # Save when .env added values, or to purge plaintext secrets an
+            # older version left in settings.ini (save_config removes them).
+            self._config = imported
+            save_config(self._config)
 
         self._recorder = AudioRecorder()
         self._bridge = SignalBridge()
@@ -325,8 +331,20 @@ def _finalize_recording(self) -> None:
         self._worker.succeeded.connect(self._on_worker_succeeded)
         self._worker.failed.connect(self._on_worker_failed)
         self._worker.cancelled.connect(self._on_worker_cancelled)
+        # Result slots run first (queued in emission order), then the QThread
+        # object frees itself — otherwise one worker leaks per dictation.
+        self._worker.finished.connect(self._worker.deleteLater)
         self._worker.start()
 
+    def _cancel_recording(self) -> None:
+        """Stop and discard the in-flight recording without processing it."""
+        self._recording = False
+        try:
+            self._recorder.stop()
+        except ScreamerError:
+            pass
+        self._apply_state(TrayState.IDLE)
+
     # ------------------------------------------------------------------
     # Hotkey callbacks (called from hotkey thread via SignalBridge → Qt main)
     # ------------------------------------------------------------------
@@ -409,8 +427,14 @@ def _on_error(self, code: AppError, detail: str | None = None) -> None:
 
     def _toggle_enabled(self, checked: bool) -> None:
         self._enabled = checked
-        if not checked and self._recording:
-            self._finalize_recording()
+        if not checked:
+            if self._recording:
+                # Disabling means "stop"; don't transcribe and type the leftovers.
+                self._cancel_recording()
+            elif self._worker is not None:
+                # Mid-processing: don't type into the focused window after the
+                # user disabled us. The worker checks this before each step.
+                self._cancel_event.set()
         log.info("Screamer %s", "enabled" if checked else "disabled")
 
     def _set_recording_mode(self, mode: str, rebuild_menu: bool = True) -> None:

src/rewrite.py

@@ -23,7 +23,7 @@ def rewrite(text: str, config: AppConfig) -> PipelineResult:
             return PipelineResult(text=text)
 
         system_prompt = config.llm_system_prompt or ""
-        language = getattr(config, "stt_language", "")
+        language = config.stt_language
         if language:
             system_prompt += f"\nThe speech language is {language}."
 
@@ -132,7 +132,7 @@ def _call_llm(
 def _groq_completion_cap(user_text: str) -> int:
     estimated_input_tokens = max(1, len(user_text) // 4)
     cap = int(estimated_input_tokens * 1.5) + 32
-    return max(128, min(1024, cap))
+    return max(128, min(4096, cap))
 
 
 # ---------------------------------------------------------------------------