local-file-encrypt

Local File Encryption

Help users encrypt and decrypt local files: use AES-256 strong encryption to protect sensitive documents, with all processing done locally.

Use Cases

• User says "Help me encrypt this file" or "Add a password to this contract"
• User says "Decrypt this file" or "Open the encrypted document"
• User says "Batch encrypt the files in this folder"

Dependency Installation

Automatically installed on first use:

pip install cryptography

Execution Method

Implement AES-256 encryption using the cryptography library via Python.

Encrypt File

import os
from cryptography.fernet import Fernet
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
import base64

def derive_key(password: str, salt: bytes) -> bytes:
    """From password derive encryption key."""
    kdf = PBKDF2HMAC(
        algorithm=hashes.SHA256(),
        length=32,
        salt=salt,
        iterations=480000,
    )
    return base64.urlsafe_b64encode(kdf.derive(password.encode()))

def encrypt_file(input_path: str, output_path: str, password: str):
    """Encrypt a file with password."""
    salt = os.urandom(16)
    key = derive_key(password, salt)
    f = Fernet(key)

    with open(input_path, 'rb') as file:
        data = file.read()

    encrypted = f.encrypt(data)

    with open(output_path, 'wb') as file:
        file.write(salt + encrypted)  # salt prepended

    print(f"Encrypted: {output_path} ({len(data)} -> {len(encrypted)+16} bytes)")

# Usage
encrypt_file("/path/to/secret.pdf", "/path/to/secret.pdf.enc", "user_password")

Decrypt File

def decrypt_file(input_path: str, output_path: str, password: str):
    """Decrypt a file with password."""
    with open(input_path, 'rb') as file:
        raw = file.read()

    salt = raw[:16]
    encrypted = raw[16:]
    key = derive_key(password, salt)
    f = Fernet(key)

    decrypted = f.decrypt(encrypted)

    with open(output_path, 'wb') as file:
        file.write(decrypted)

    print(f"Decrypted: {output_path} ({len(decrypted)} bytes)")

# Usage
decrypt_file("/path/to/secret.pdf.enc", "/path/to/secret.pdf", "user_password")

Batch Encryption

import os

def encrypt_directory(dir_path: str, password: str):
    """Encrypt all files in a directory."""
    encrypted_dir = dir_path + "_encrypted"
    os.makedirs(encrypted_dir, exist_ok=True)

    count = 0
    for filename in os.listdir(dir_path):
        filepath = os.path.join(dir_path, filename)
        if os.path.isfile(filepath):
            encrypt_file(filepath, os.path.join(encrypted_dir, filename + ".enc"), password)
            count += 1

    print(f"Encrypted {count} files -> {encrypted_dir}")

Security Rules

• Password provided by the user: Securely obtain the password through a HITL tool, and do not display it in plain text in the conversation
• Do not store passwords: Do not retain the password after encryption/decryption is complete
• Do not delete the original file: Keep the original file after encryption, and let the user decide whether to delete it
• Remind about the importance of the password: If the password is forgotten, the file cannot be recovered
• Verify after encryption: After encryption is complete, attempt decryption verification to ensure the encryption is correct

Output Specifications

• Confirm the file name and size before encryption
• Report after encryption: output file path, file size change
• Strongly remind the user to remember the password
• Report the number of files for batch operations