How to Use IronZIP with Google Antigravity

/plan CaseDocs is an ASP.NET Core MVC project that targets .NET 9.
Add the case document download that docs/case-download-rules.md describes.

The download works like this:

- A user opens /Cases/{id}, ticks documents and types a password.
- The user receives an AES-256 encrypted ZIP that the server builds with IronZIP.
- The NuGet package is IronZIP version 2026.10.2, and its namespace is IronZip.

Program.cs reads IRONZIP_LICENSE_KEY and assigns it once to IronZip.License.LicenseKey.
Confirm only that the variable exists and how many characters it holds.
Never print, log or write its value.

The Implementation Plan must state these answers:

- the entry name each document receives inside the archive
- the path the archive is saved to before the response, and when that file is deleted
- how the saved archive is compared with the ticked documents

Stop once dotnet build succeeds, and tell me the build result.

/plan CaseDocs is an ASP.NET Core MVC project that targets .NET 9.
Add the case document download that docs/case-download-rules.md describes.

The download works like this:

- A user opens /Cases/{id}, ticks documents and types a password.
- The user receives an AES-256 encrypted ZIP that the server builds with IronZIP.
- The NuGet package is IronZIP version 2026.10.2, and its namespace is IronZip.

Program.cs reads IRONZIP_LICENSE_KEY and assigns it once to IronZip.License.LicenseKey.
Confirm only that the variable exists and how many characters it holds.
Never print, log or write its value.

The Implementation Plan must state these answers:

- the entry name each document receives inside the archive
- the path the archive is saved to before the response, and when that file is deleted
- how the saved archive is compared with the ticked documents

Stop once dotnet build succeeds, and tell me the build result.

/browser Start CaseDocs in the background with dotnet run --launch-profile http.
That profile listens on http://localhost:5065.

For each row of TestData/expected.csv, do this:

1. Open /Cases/<case> and leave every checkbox as the page sets it.
2. Type the row's password and press Download.
3. Capture a screenshot of what follows.
4. When the answer is a file, take its name and size from the download or the response headers.

In the Walkthrough and in your reply, give one line per row with these parts:

- the case
- the documents the page listed, against the documents column
- the expected outcome
- what actually happened, as the file name and size or the message shown
- a PASS or FAIL verdict

For any failing row, cite the server log entry or error page text responsible.
Do that before you edit any code.
After every fix, restart the app and go through all six rows again.
Stop the app when you are done.

/browser Start CaseDocs in the background with dotnet run --launch-profile http.
That profile listens on http://localhost:5065.

For each row of TestData/expected.csv, do this:

1. Open /Cases/<case> and leave every checkbox as the page sets it.
2. Type the row's password and press Download.
3. Capture a screenshot of what follows.
4. When the answer is a file, take its name and size from the download or the response headers.

In the Walkthrough and in your reply, give one line per row with these parts:

- the case
- the documents the page listed, against the documents column
- the expected outcome
- what actually happened, as the file name and size or the message shown
- a PASS or FAIL verdict

For any failing row, cite the server log entry or error page text responsible.
Do that before you edit any code.
After every fix, restart the app and go through all six rows again.
Stop the app when you are done.

Which IronZIP version does CaseDocs.csproj reference? Quote its PackageReference line.
Then show the line in Program.cs that assigns the license key.
Add either line if it is missing.

IRONZIP_LICENSE_KEY is the only allowed source of that key.
Search these files for an IronZip.LicenseKey entry or a key value, and remove any you find:

- appsettings.json
- appsettings.Development.json
- Properties/launchSettings.json

When the variable is missing at startup, the app logs a single warning.
That warning mentions IRONZIP_LICENSE_KEY and contains no value.
Add it only if it is absent, and leave every other file alone.
Tell me what you found and what you changed.

Which IronZIP version does CaseDocs.csproj reference? Quote its PackageReference line.
Then show the line in Program.cs that assigns the license key.
Add either line if it is missing.

IRONZIP_LICENSE_KEY is the only allowed source of that key.
Search these files for an IronZip.LicenseKey entry or a key value, and remove any you find:

- appsettings.json
- appsettings.Development.json
- Properties/launchSettings.json

When the variable is missing at startup, the app logs a single warning.
That warning mentions IRONZIP_LICENSE_KEY and contains no value.
Add it only if it is absent, and leave every other file alone.
Tell me what you found and what you changed.

/plan Draft the Implementation Plan for this change, and wait for review before you edit anything.
Move every IronZIP call out of the controller into Services/CaseArchiveBuilder.cs.
Register it in DI as a singleton.
Given the case folder, the ticked relative paths and the password, it returns the ZIP bytes.

The service works in this order:

1. It copies each document into a new folder under the system temp path.
2. Each copy gets the entry name from the rules.
3. It adds those copies and saves the archive beside that folder.
4. It extracts that archive with the same password into a second folder.
5. It compares the SHA-256 of every extracted file with its source.
6. On any difference, it throws with the document's entry name.

Both folders are removed in a finally block.
The controller keeps the password, selection and path checks.
Afterward, repeat the /browser pass over TestData/expected.csv and report each row.

/plan Draft the Implementation Plan for this change, and wait for review before you edit anything.
Move every IronZIP call out of the controller into Services/CaseArchiveBuilder.cs.
Register it in DI as a singleton.
Given the case folder, the ticked relative paths and the password, it returns the ZIP bytes.

The service works in this order:

1. It copies each document into a new folder under the system temp path.
2. Each copy gets the entry name from the rules.
3. It adds those copies and saves the archive beside that folder.
4. It extracts that archive with the same password into a second folder.
5. It compares the SHA-256 of every extracted file with its source.
6. On any difference, it throws with the document's entry name.

Both folders are removed in a finally block.
The controller keeps the password, selection and path checks.
Afterward, repeat the /browser pass over TestData/expected.csv and report each row.

using System.Security.Cryptography;
using IronZip;
using IronZip.Enum;

public sealed class CaseArchiveBuilder
{
    public byte[] Build(string caseFolder, IReadOnlyList<string> relativePaths, string password)
    {
        var work = Path.Combine(Path.GetTempPath(), "case-" + Guid.NewGuid().ToString("N"));
        var staged = Path.Combine(work, "staged");
        var check = Path.Combine(work, "check");
        Directory.CreateDirectory(staged);
        try
        {
            var sources = new Dictionary<string, string>();
            foreach (var relativePath in relativePaths)
            {
                var entryName = relativePath.Replace('/', '_');
                var source = Path.Combine(caseFolder, relativePath);
                File.Copy(source, Path.Combine(staged, entryName));
                sources.Add(entryName, source);
            }

            var zipPath = Path.Combine(work, "case.zip");
            using (var archive = new IronZipArchive())
            {
                archive.Encrypt(password, EncryptionMethods.AES256);
                foreach (var entryName in sources.Keys)
                    archive.Add(Path.Combine(staged, entryName));
                archive.SaveAs(zipPath);
            }

            IronZipArchive.ExtractArchiveToDirectory(zipPath, check, password);
            if (Directory.GetFiles(check).Length != sources.Count)
                throw new InvalidOperationException("The archive does not hold one entry per document.");
            foreach (var (entryName, source) in sources)
            {
                var extracted = Path.Combine(check, entryName);
                if (!File.Exists(extracted) ||
                    !SHA256.HashData(File.ReadAllBytes(extracted)).SequenceEqual(SHA256.HashData(File.ReadAllBytes(source))))
                    throw new InvalidOperationException($"{entryName} did not come back from the archive intact.");
            }
            return File.ReadAllBytes(zipPath);
        }
        finally
        {
            Directory.Delete(work, recursive: true);
        }
    }
}

using System.Security.Cryptography;
using IronZip;
using IronZip.Enum;

public sealed class CaseArchiveBuilder
{
    public byte[] Build(string caseFolder, IReadOnlyList<string> relativePaths, string password)
    {
        var work = Path.Combine(Path.GetTempPath(), "case-" + Guid.NewGuid().ToString("N"));
        var staged = Path.Combine(work, "staged");
        var check = Path.Combine(work, "check");
        Directory.CreateDirectory(staged);
        try
        {
            var sources = new Dictionary<string, string>();
            foreach (var relativePath in relativePaths)
            {
                var entryName = relativePath.Replace('/', '_');
                var source = Path.Combine(caseFolder, relativePath);
                File.Copy(source, Path.Combine(staged, entryName));
                sources.Add(entryName, source);
            }

            var zipPath = Path.Combine(work, "case.zip");
            using (var archive = new IronZipArchive())
            {
                archive.Encrypt(password, EncryptionMethods.AES256);
                foreach (var entryName in sources.Keys)
                    archive.Add(Path.Combine(staged, entryName));
                archive.SaveAs(zipPath);
            }

            IronZipArchive.ExtractArchiveToDirectory(zipPath, check, password);
            if (Directory.GetFiles(check).Length != sources.Count)
                throw new InvalidOperationException("The archive does not hold one entry per document.");
            foreach (var (entryName, source) in sources)
            {
                var extracted = Path.Combine(check, entryName);
                if (!File.Exists(extracted) ||
                    !SHA256.HashData(File.ReadAllBytes(extracted)).SequenceEqual(SHA256.HashData(File.ReadAllBytes(source))))
                    throw new InvalidOperationException($"{entryName} did not come back from the archive intact.");
            }
            return File.ReadAllBytes(zipPath);
        }
        finally
        {
            Directory.Delete(work, recursive: true);
        }
    }
}

/goal Every archive the download page produces matches TestData/manifest.csv.

Create a console project at tools/ArchiveAudit that meets these conditions:

- It references IronZIP 2026.10.2.
- The web project's compile items exclude it.
- Its startup copies IRONZIP_LICENSE_KEY into IronZip.License.LicenseKey.

Start CaseDocs with dotnet run --launch-profile http before the first post.
Stop it once the audit passes.

For each expected.csv row with the outcome zip, the audit does this:

1. Post that case page's form with every document ticked and the row's password.
2. Store the response as audit-output/<case>.zip.
3. Extract it with IronZipArchive.ExtractArchiveToDirectory and the password.
4. Confirm that the entry names and SHA-256 values equal that case's manifest rows.

Confirm too that extraction with a wrong password throws.
Keep fixing the app and rerunning the audit until all four archives pass.
Then put the results table in the Walkthrough and in your reply.

/goal Every archive the download page produces matches TestData/manifest.csv.

Create a console project at tools/ArchiveAudit that meets these conditions:

- It references IronZIP 2026.10.2.
- The web project's compile items exclude it.
- Its startup copies IRONZIP_LICENSE_KEY into IronZip.License.LicenseKey.

Start CaseDocs with dotnet run --launch-profile http before the first post.
Stop it once the audit passes.

For each expected.csv row with the outcome zip, the audit does this:

1. Post that case page's form with every document ticked and the row's password.
2. Store the response as audit-output/<case>.zip.
3. Extract it with IronZipArchive.ExtractArchiveToDirectory and the password.
4. Confirm that the entry names and SHA-256 values equal that case's manifest rows.

Confirm too that extraction with a wrong password throws.
Keep fixing the app and rerunning the audit until all four archives pass.
Then put the results table in the Walkthrough and in your reply.

/learn Turn what this session established about case downloads into a rule.
Write it at .agents/rules/case-archives.md.
Start the file with YAML frontmatter that sets trigger: model_decision.
Add a description saying the rule applies to work on case downloads or IronZIP archives.

The rule covers these points:

- how entry names are formed, and why
- how the saved archive is verified
- which temporary folders each request creates, and when they are deleted
- the messages for a short password and an empty selection
- that no change to the download is finished until two checks succeed

Those two checks are the expected.csv browser pass and the tools/ArchiveAudit run.
Record only what this session verified, and list anything unproven as open.

/learn Turn what this session established about case downloads into a rule.
Write it at .agents/rules/case-archives.md.
Start the file with YAML frontmatter that sets trigger: model_decision.
Add a description saying the rule applies to work on case downloads or IronZIP archives.

The rule covers these points:

- how entry names are formed, and why
- how the saved archive is verified
- which temporary folders each request creates, and when they are deleted
- the messages for a short password and an empty selection
- that no change to the download is finished until two checks succeed

Those two checks are the expected.csv browser pass and the tools/ArchiveAudit run.
Record only what this session verified, and list anything unproven as open.

Split this work between Agent A and Agent B.

Agent A creates CaseDocs.Tests, an xUnit project that references IronZIP 2026.10.2.
Keep it outside the web project's build.
The tests work like this:

- They start the app with WebApplicationFactory<Program>.
- They post the download form for every expected.csv row and assert the outcome.
- For zip rows, they extract the response with IronZIP into a temporary folder.
- They compare the names and SHA-256 values with manifest.csv.
- One test shows that a path outside the case folder gets a 400 response.
- They assert on extracted files, never on archive bytes.

Agent B starts once Agent A's suite passes:

1. Start the app with dotnet run --launch-profile http (http://localhost:5065).
2. Use /browser to download C-1002 and C-1003 from their case pages, and record each session.
3. Read each file's name and size from what the browser receives or from the response headers.
4. Stop the app.
5. Add the two recordings and one screenshot per finished page to the Walkthrough.

If there is no Walkthrough, save them under audit-output/ instead.
List them with those names and sizes in your reply.
If Agent A's suite does not pass, report the failing tests instead.

Split this work between Agent A and Agent B.

Agent A creates CaseDocs.Tests, an xUnit project that references IronZIP 2026.10.2.
Keep it outside the web project's build.
The tests work like this:

- They start the app with WebApplicationFactory<Program>.
- They post the download form for every expected.csv row and assert the outcome.
- For zip rows, they extract the response with IronZIP into a temporary folder.
- They compare the names and SHA-256 values with manifest.csv.
- One test shows that a path outside the case folder gets a 400 response.
- They assert on extracted files, never on archive bytes.

Agent B starts once Agent A's suite passes:

1. Start the app with dotnet run --launch-profile http (http://localhost:5065).
2. Use /browser to download C-1002 and C-1003 from their case pages, and record each session.
3. Read each file's name and size from what the browser receives or from the response headers.
4. Stop the app.
5. Add the two recordings and one screenshot per finished page to the Walkthrough.

If there is no Walkthrough, save them under audit-output/ instead.
List them with those names and sizes in your reply.
If Agent A's suite does not pass, report the failing tests instead.