Fix panic when receiving with --stdout and invalid secret

[Copilot]

When receiving with --stdout and an invalid CROC_SECRET, the program panics with index out of range [0] instead of returning an error gracefully.

Changes

• src/croc/croc.go: Add bounds check before accessing FilesToTransfer[c.FilesToTransferCurrentNum] in stdout cleanup path
• src/croc/croc_test.go: Add test case TestReceiverStdoutWithInvalidSecret to verify graceful error handling

Details

The stdout cleanup code at line 1178 assumed FilesToTransfer was populated, but when authentication fails early in the transfer, the array remains empty:

// Before: panics when FilesToTransfer is empty
if c.Options.Stdout && !c.Options.IsSender {
    pathToFile := path.Join(
        c.FilesToTransfer[c.FilesToTransferCurrentNum].FolderRemote,  // panic here
        ...
    )
}

// After: checks bounds before access
if c.Options.Stdout && !c.Options.IsSender && 
   len(c.FilesToTransfer) > 0 && 
   c.FilesToTransferCurrentNum < len(c.FilesToTransfer) {
    // safe to access
}

With this fix, invalid secrets now return: room (secure channel) not ready, maybe peer disconnected

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• 239.255.255.250
• croc.schollz.com
  • Triggering command: ./croc --version (dns block)
  • Triggering command: /tmp/go-build2651178820/b001/croc.test -test.testlogfile=/tmp/go-build2651178820/b001/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)
  • Triggering command: /tmp/go-build3825911463/b001/croc.test -test.testlogfile=/tmp/go-build3825911463/b001/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)
• croc6.schollz.com
  • Triggering command: ./croc --version (dns block)
  • Triggering command: /tmp/go-build2651178820/b001/croc.test -test.testlogfile=/tmp/go-build2651178820/b001/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)
  • Triggering command: /tmp/go-build3825911463/b001/croc.test -test.testlogfile=/tmp/go-build3825911463/b001/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)
• doesntexistok.com
  • Triggering command: /tmp/go-build2651178820/b001/croc.test -test.testlogfile=/tmp/go-build2651178820/b001/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)
  • Triggering command: /tmp/go-build227569924/b001/croc.test -test.testlogfile=/tmp/go-build227569924/b001/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)
  • Triggering command: /tmp/go-build77411867/b001/croc.test -test.testlogfile=/tmp/go-build77411867/b001/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true -test.run=TestReceiverStdoutWithInvalidSecret|TestCrocLocal|TestCrocError (dns block)
• example.com
  • Triggering command: /tmp/go-build1733538028/b286/models.test -test.testlogfile=/tmp/go-build1733538028/b286/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)
• ipv4.icanhazip.com
  • Triggering command: /tmp/go-build1733538028/b292/utils.test -test.testlogfile=/tmp/go-build1733538028/b292/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)
  • Triggering command: /tmp/go-build3215944763/b001/utils.test -test.testlogfile=/tmp/go-build3215944763/b001/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)
• this-hostname-should-definitely-not-exist-98765
  • Triggering command: /tmp/go-build1733538028/b286/models.test -test.testlogfile=/tmp/go-build1733538028/b286/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)
• this-hostname-should-not-exist-12345
  • Triggering command: /tmp/go-build1733538028/b286/models.test -test.testlogfile=/tmp/go-build1733538028/b286/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[Bug]: Panic when receiving with --stdout and invalid CROC_SECRET</issue_title>
<issue_description>### What happened?

Panic when receiving with --stdout and invalid CROC_SECRET

What did you expect to happen?

The program should handle invalid secrets gracefully and exit with an appropriate error message.

Steps to reproduce

1. Run croc receiver with --stdout flag and an invalid secret:

   CROC_SECRET=asdbajhdad ./croc --stdout

2. The program panics instead of handling the error gracefully

croc version

v10.2.7

Operating System

Linux

OS Version

Debian 13

Relevant log output

$ CROC_SECRET=asdbajhdad ./croc
securing channel...room (secure channel) not ready, maybe peer disconnected
$ CROC_SECRET=asdbajhdad ./croc --stdout 
securing channel...panic: runtime error: index out of range [0] with length 0

goroutine 38 [running]:
github.com/schollz/croc/v10/src/croc.(*Client).transfer(0xc00030a008)
	/home/runner/work/croc/croc/src/croc/croc.go:1180 +0x8d1
github.com/schollz/croc/v10/src/croc.(*Client).Receive(0xc00030a008)
	/home/runner/work/croc/croc/src/croc/croc.go:1102 +0x1432
github.com/schollz/croc/v10/src/cli.receive(0xc0001312c0)
	/home/runner/work/croc/croc/src/cli/cli.go:709 +0xd69
github.com/schollz/croc/v10/src/cli.Run.func1(0xc0001312c0)
	/home/runner/work/croc/croc/src/cli/cli.go:206 +0x505
github.com/schollz/cli/v2.(*App).RunContext(0xc00012c600, {0xa705f8, 0xe5eb40}, {0xc00010e080, 0x2, 0x2})
	/home/runner/go/pkg/mod/github.com/schollz/cli/v2@v2.2.1/app.go:315 +0x90d
github.com/schollz/cli/v2.(*App).Run(...)
	/home/runner/go/pkg/mod/github.com/schollz/cli/v2@v2.2.1/app.go:217
github.com/schollz/croc/v10/src/cli.Run()
	/home/runner/work/croc/croc/src/cli/cli.go:209 +0x15e5
main.main.func1()
	/home/runner/work/croc/croc/main.go:40 +0x13
created by main.main in goroutine 1
	/home/runner/work/croc/croc/main.go:39 +0x71

Additional context

No response</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes [Bug]: Panic when receiving with --stdout and invalid CROC_SECRET #992

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.