SERVICE #02 • IN-VAULT MANAGEMENT

Virtual Filesystem & Live Editing

⏱️ 5 min read 🔒 Zero-Export In-Memory Overlay 📝 Live Markdown / Text Editor

Traditional file lockers force users into an insecure workflow: decrypt the entire vault to disk, edit files with local software, re-zip, and re-encrypt—leaving unencrypted data remnants across system caches and swap space. ZevSafe's Decrypted Virtual Filesystem (VFS) eliminates this risk by keeping modifications entirely inside an ephemeral browser memory overlay with Direct .zev Re-encryption.

🟢 Simple User Guide

Managing Files Inside an Open Vault

STEP 01

Create Encrypted Notes Instantly

Click "+ New Note" in the Vault Explorer toolbar. Type your thoughts, passwords, or recovery codes in plain text or Markdown. The note is formatted automatically and saved inside the open vault session in RAM.

STEP 02

Edit, Rename, or Delete Files

Click any .txt or .md file to open the live editor. Make edits and press "Save Changes". Use the file menu to rename paths or delete obsolete documents. Your changes appear instantly in the folder tree.

STEP 03

Direct Re-encryption (Save Vault)

Whenever modifications are pending, a glowing "Re-encrypt Vault" button appears. Click it to stream-compress and generate a brand-new updated .zev file with one click. No plaintext files ever touch your hard drive!

🛡️
True Zero-Export Privacy: Unsaved changes exist exclusively in volatile browser RAM. If you close the browser tab or hit "Lock Vault", memory is instantly wiped clean.

Built-in Safe Markdown & Text Viewer

The in-vault Markdown engine supports syntax highlighting, bullet checklists, tables, blockquotes, and headings while strictly stripping active scripts to prevent Cross-Site Scripting (XSS).

HTML DOM Sanitization Invariant 
// All in-vault markdown rendering escapes raw HTML:
function escapeHtml(str) {
    return str
        .replace(/&/g, "&")
        .replace(/</g, "&lt;")
        .replace(/>/g, "&gt;")
        .replace(/"/g, "&quot;")
        .replace(/'/g, "&#039;");
}
🔵 Technical Specification

Decrypted Session Overlay Architecture

When a vault is unlocked, ZevSafe constructs an ephemeral activeSession state. Rather than copying multi-gigabyte archives into memory, the engine maintains three lightweight overlay structures:

Overlay Structure Type Role & Semantic Behavior
activeSession.overlayFiles Map<string, Uint8Array> Stores new notes or edited file buffers keyed by normalized virtual relative path. Takes precedence over base vault chunks.
activeSession.deletedPaths Set<string> Tombstones removed files. Filtered out of catalog views and omitted from re-encryption.
activeSession.renamedPaths Map<string, string> Maps original path → new path, updating folder trees dynamically without re-writing existing chunk payloads.
Catalog Virtual Resolution 
// Resolves the effective file entry taking the overlay into account:
function getEffectiveFile(path) {
    if (activeSession.deletedPaths.has(path)) return null;
    
    if (activeSession.overlayFiles.has(path)) {
        const data = activeSession.overlayFiles.get(path);
        return { path, size: data.byteLength, isOverlay: true, data };
    }
    
    const baseEntry = activeSession.manifest.files.find(f => f.path === path);
    return baseEntry ? { ...baseEntry, isOverlay: false } : null;
}

Direct Re-encryption Pipeline

When triggering re-encryption, the browser worker streams unchanged base files from their original chunk spans alongside newly edited overlay buffers into a fresh ZV3 container:

  1. Salt & IV Refresh: A new 32-byte CSPRNG salt and 7-byte base IV are generated; keys are never reused.
  2. Streaming Re-packing: Worker compresses files using deflate-raw and partitions into 4 MB chunks.
  3. Fresh Manifest Trailer: New JSON manifest with updated CRC32 checksums and offsets is encrypted at the tail.
  4. Instant Swap: The new container becomes the active vault session.

Security Invariants

Invariant Threat Prevented Guarantee
Zero Disk Footprint Forensic disk recovery of unencrypted files Edited files only ever exist in volatile memory until encrypted.
Key Refresh Invariant Two-time pad (nonce reuse) vulnerability Re-encryption always generates fresh master salts and IVs.
Path Traversal Defense Malicious zip-slip or directory traversal (../) Path normalization strictly rejects relative or absolute parent directory jumps.