7z: encrypted headers are known from the encoded header, without bsdtar

85% of the 7z archives inspected have encrypted headers (-mhe). Their
encoded header lists the 7zAES coder, so the packed header stream is no
longer downloaded and bsdtar no longer runs for them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/unit/sevenzip.spec.ts

@@ -1,6 +1,7 @@
 import { test } from '@japa/runner'
 import {
   checkHeader,
+  encodedHeaderEncrypted,
   listingStart,
   parseBsdtarListing,
   parseSevenZipStart,
@@ -19,7 +20,30 @@ const PLAIN = Buffer.from(
   'base64'
 )
 
+// `7z a -pSecret -mhe=on`: an encrypted header; with -mhe=off only the file data is encrypted.
+const HEADER_ENCRYPTED = Buffer.from(
+  'N3q8ryccAARtHJcDoAAAAAAAAAA+AAAAAAAAAGqzNxflXzLifhRjmRlgXvMEO9zhcADrwDAjtLT4COwZQUsqMkFT0jGipxcTP5MNbocZW7iGLP5PCAuqfouDxAoI2Zw2AqMRF2m/XOVYRokWM4bHuH73xp1LIva5JpyAQSViuI66Jf5xxemaGnSvoC5/mHDHe6VZUxQwMmH3QuTR15+loSuNhbEU2feP1E2EdwIvHSYXdJ9jDqHe6XjW3gfh/2+NFwYQAQmAkAAHCwEAAiQG8QcBElMPIu8lRTeoM0YvSGcM+B6l/SMDAQEFXQAQAAABAAyAgoCmCgGDcQMzAAA=',
+  'base64'
+)
+const DATA_ENCRYPTED = Buffer.from(
+  'N3q8ryccAASBXGg3kQAAAAAAAAAiAAAAAAAAAO4xlWU16N8rTbvoF1dbq3eLPdZiAACBMweuD87ysgwHsMPa919FiphISvi++OI2giqcUPCAdmXzZtkqFSqP0Nr4rWaRH5dR+vNA2jJGIbDAZpbQM/ka9oh27tkqKb/+dHyx1SFHkxbLyWvd7W0qwaDHxSvW2fTpRdJSmi74crF957Qwy+P8dDF0MOYr5AGHAQHJSAAAFwYQAQmAgQAHCwEAASMDAQEFXQAQAAAMgKYKAaUZQIYAAA==',
+  'base64'
+)
+const headerOf = (archive: Buffer) => {
+  const start = parseSevenZipStart(archive)!
+  return archive.subarray(start.headerStart, start.archiveSize)
+}
+
 test.group('sevenzip', () => {
+  test('tells encrypted headers from the encoded header alone', ({ assert }) => {
+    assert.isTrue(encodedHeaderEncrypted(headerOf(HEADER_ENCRYPTED)))
+    assert.isFalse(encodedHeaderEncrypted(headerOf(DATA_ENCRYPTED)))
+    assert.isFalse(encodedHeaderEncrypted(headerOf(ENCODED)))
+    // A plain header isn't encoded: bsdtar lists it.
+    assert.isNull(encodedHeaderEncrypted(headerOf(PLAIN)))
+    assert.isNull(encodedHeaderEncrypted(headerOf(HEADER_ENCRYPTED).subarray(0, 12)))
+  })
+
   test('finds the header at the end from the signature header', ({ assert }) => {
     const start = parseSevenZipStart(ENCODED)!
     assert.deepEqual(start, { headerStart: 157, headerSize: 33, headerCrc: start.headerCrc, archiveSize: 190 })