Pail v0.3.0

English

Added

• While tasks are queued or running, the taskbar button on Windows (the Dock icon on macOS) shows their combined progress.

Changed

• Each notch of the mouse wheel now scrolls smoothly over a short moment instead of jumping. Touchpad scrolling is unchanged, and with the system "reduce motion" setting on, the wheel scrolls at once.
• The website now has English and Chinese installation guides, command-line documentation and changelogs.

简体中文

新增

• 有排队或进行中的任务时，Windows 任务栏按钮（macOS 上为 Dock 图标）显示它们的合计进度。

变更

• 鼠标滚轮每滚一格，内容会在很短的时间内平滑滚过，不再一下跳到位。触控板滚动不变；系统开启"减少动态效果"时，滚轮仍直接滚到位。
• 网站新增中英文安装指南、命令行文档和更新日志。

Pail v0.2.0

English

Added

• Bilingual Open Graph and Twitter large-image metadata on the website and documentation pages, using the actual light-theme application screenshot.
• Motion: dialogs, the command palette, select popups, menus, submenus and toasts come in on a light spring from where they are anchored and leave with a short fade, without bounce. A dialog or menu that is leaving no longer takes clicks or the keyboard, and a dialog or menu that is still coming in already responds to them.
• Buttons, sidebar items and list rows fade their hover and pressed fill instead of switching it. The underline of the inspector tabs and transfer filters, the selection bar of the sidebar and the bucket settings list, and the knob of switches slide to their new place.
• The transfers panel eases open and closed when you toggle it (dragging its divider still follows the pointer at once), the inspector's content fades in when you open it, progress bars ease to each new value, counts in the status bar and the transfers panel roll their digits, and the "Saved" mark fades in and out.
• With the system's "reduce motion" setting, nothing moves or scales: only colours and opacity still fade. Resizing the window and the object table's rows and scrolling are never animated.

Changed

• Release archives contain executables, platform launch assets and the license; READMEs remain in the repository and online documentation.
• Mise pins Go and Node only. Native builds/tests and release packaging require no PowerShell. go run ./tools/release is the shared local/CI entry point, builds all six targets and verifies the archives automatically; the old PowerShell entry point is a compatibility wrapper.
• Exclude .agents/skills and designs/pail-site from repository language statistics. Refresh documentation screenshots from the current UI code and compress them using PicForge's default WebP settings.
• Overlays now share one look: dialogs, the bucket settings dialog, the command palette, select popups and toasts take their radius (6 controls, 8 popups, 10 dialogs), shadow and dark-theme outline from the design tokens instead of per-view values, and no colour is written outside theme.go any more.
• Command palette and select popups use one list row: 28 px high, with the command icon, shortcuts drawn as key caps (also Esc), and a neutral highlight that follows both the keyboard and the pointer. The current value is marked by a check and a heavier weight instead of the blue selection fill. The "Unavailable here" group and the command groups are section labels.
• The bucket settings dialog reuses the standard dialog frame; its dividers show only while the list or the form scrolls.
• Tooltips and toasts take their colours from the theme tokens, and toasts follow the overlay radius and shadow. The tooltip radius and shadow are still the library's.
• "Select all" uses a double check icon, so it cannot be mistaken for the check that marks a current choice.
• On Windows and Linux, the context menus of objects and buckets and the menus of the Upload, account and "⋯" buttons are drawn in the window in the overlay style instead of as system menus: command icons, shortcuts as key caps, a check and a heavier weight for the current choice, submenus that open on hover or with the arrow keys, and full keyboard control (arrows, Home and End, first letter, Enter, Escape). Context menus open at the pointer, or below the current row with Shift+F10 or the menu key, and stay inside the window. A click outside a menu only closes it. macOS keeps the system menus.

Fixed

• Inspector: the standard header labels (Content-Type, Cache-Control and so on) showed only an ellipsis next to the "?" icon. The label no longer takes a zero-width flex basis; it shrinks and truncates only when the panel is really too narrow, and its tooltip shows the full name.
• Resizing the window no longer lays the search box and the object table columns out by the previous frame's size, which made them lag one step behind the drag.
• Toolbar labels, the compact path bar and the object table columns now switch with a 12 px hysteresis, so dragging across a width threshold no longer makes them flicker back and forth.
• The sidebar and the inspector no longer shrink by themselves when the window gets narrower than 1100 px; they keep the width you gave them.
• The divider between panels turns a neutral grey when hovered or dragged instead of the accent blue.

简体中文

新增

• 网站与文档页面增加双语 Open Graph 和 Twitter 大图元信息，使用真实的浅色应用截图。
• 动效：对话框、命令面板、下拉选项、菜单、子菜单和 Toast 以轻微的弹簧效果从锚点一侧进入，离开时短暂淡出，不带弹性。正在离开的对话框或菜单不再拦截点击和键盘，仍在进入的对话框或菜单已经可以操作。
• 按钮、侧栏项和列表行的悬停、按下填充改为淡变，不再瞬间切换。检查器标签与传输筛选的下划线、侧栏与存储桶设置列表的选中指示条、开关的圆钮会滑到新位置。
• 用按钮切换传输面板时，面板平滑展开和折叠（拖动分隔条时仍立即跟随指针）；打开检查器时内容淡入；进度条平滑过渡到新进度；状态栏与传输面板中的计数逐位滚动；"已保存"提示淡入淡出。
• 系统开启"减少动态效果"时，任何元素都不再移动或缩放，只保留颜色与透明度的淡变。调整窗口大小、对象表的行与滚动始终没有动画。

变更

• 发行包只包含可执行文件、平台启动资源与许可证；README 保留在仓库与在线文档中。
• Mise 只固定 Go 和 Node。原生构建、测试与发行打包均不需要 PowerShell。go run ./tools/release 是本地与 CI 共用的入口，构建六个目标并自动验包；旧 PowerShell 入口只保留为兼容包装。
• 从仓库语言统计中排除 .agents/skills 与 designs/pail-site。基于当前 UI 源码重新生成文档截图，并使用 PicForge 默认 WebP 参数压缩。
• 浮层统一为一套外观：对话框、存储桶设置对话框、命令面板、下拉选项和 Toast 的圆角（控件 6、弹出层 8、对话框 10）、阴影与暗色描边都取自设计 token，不再各视图自定；theme.go 之外也不再出现颜色字面量。
• 命令面板与下拉选项共用同一种列表行：高 28 px，显示命令图标，快捷键（以及 Esc）画成键帽，高亮用中性色，键盘与鼠标共用同一种外观。当前值用对勾加粗体标示，不再用蓝色选中填充。"此处不可用"分组与各命令分组都是分组标签。
• 存储桶设置对话框复用标准对话框外框；只有列表或表单可滚动时才显示分隔线。
• Tooltip 与 Toast 的颜色取自主题 token，Toast 的圆角与阴影遵循浮层规范；Tooltip 的圆角与阴影仍由库决定。
• "全选"改用双对勾图标，避免与表示当前选项的对勾混淆。
• Windows 与 Linux 上，对象和存储桶的右键菜单，以及上传、账户、"⋯"按钮的菜单改为在窗口内按浮层规范绘制，不再使用系统菜单：显示命令图标，快捷键画成键帽，当前选项用对勾加粗体标示；子菜单在鼠标停留或按方向键时打开；完整支持键盘（方向键、Home 与 End、首字母、Enter、Esc）。右键菜单在指针处打开，按 Shift+F10 或菜单键时在当前行下方打开，并始终留在窗口内。在菜单外单击只关闭菜单。macOS 继续使用系统菜单。

修复

• 检查器：标准 header 标签（Content-Type、Cache-Control 等）在"?"图标旁只显示省略号。标签不再使用 0 宽的 flex 基准；只有面板确实太窄时才收缩并截断，悬停提示显示完整名称。
• 调整窗口大小时，搜索框和对象表的列不再按上一帧的尺寸布局，不会再落后拖动一步。
• 工具栏文字、紧凑路径栏和对象表的列现在带 12 px 回滞，拖动越过宽度阈值时不再来回闪烁。
• 窗口宽度小于 1100 px 时，侧栏和检查器不再自行缩窄，保持设置的宽度。
• 面板之间的分隔条悬停或拖动时改为中性灰，不再是强调蓝色。

Pail v0.1.0

English

First release of Pail. Verification per feature is recorded in docs/status.md.

Added

• Desktop app (pail-desktop, Go + mygo, Windows, Linux and macOS): sidebar with account switcher and bucket list, breadcrumbs, virtualised sortable multi-select object table with automatic paging, search, flat view, inspector, transfer panel, status bar, command palette (Ctrl/⌘+K), context menus and shortcuts, light and dark themes, English and 简体中文, --demo mode on an in-memory S3 server.

• Accounts: any number of AWS and S3-compatible accounts (custom endpoint, region, path-style, access keys, AWS profile, default chain, anonymous, AssumeRole); connection test; per-account checksum mode.

• Browsing and preview: bucket and folder navigation, JSON, CSV, XML, text, image and hex preview, copy key, URI, URL and presigned URL.

• Transfers: upload and download of files, folders, versions and whole buckets with drag and drop; separate upload, download and other queues with configurable limits, cancel and retry; five conflict policies; multipart transfers; create-only conditional writes with a fallback for providers that lack them; downloads published atomically after verification.

• Object management: copy, move and rename (same and cross bucket); bulk delete with per-item results; edit headers, metadata, tags, ACL, storage class and server-side encryption (SSE-S3, SSE-KMS, SSE-C), verified afterwards; MIME type table.

• Versions: list versions and delete markers, restore a version or deleted keys, download and permanently delete several versions.

• Buckets: create, delete and empty; copy, move or download a whole bucket; 14 bucket settings as forms or JSON; list and abort incomplete multipart uploads.

• Sync jobs: upload, download and mirror with preview, three compare modes and exclude globs; execution re-checks each previewed action; local deletions go to the OS trash.

• Upload rules: headers, storage class, encryption and compression (GZIP, ZIP, AES-256 ZIP with levels); decoding on download.

• CDN domain per account (base URL or {bucket}/{key} template, optional bucket list), presigned URL dialog, CloudFront distributions and invalidations (AWS accounts).

• Command line (pail): accounts, buckets, ls, cp, mv, rm, mb, rb, presign, url, versions, restore, sync, vault status; JSON output and stable exit codes; shares accounts and sync jobs with the app. See docs/cli.md.

• Security: secrets in the OS keychain or an optional encrypted vault (Argon2id, XChaCha20-Poly1305) with idle auto-lock; opt-in redacted diagnostic log; every destructive or bulk action shows its scope and asks for confirmation.

• Compatibility with openS3: an existing openS3 configuration folder and keychain entries are migrated automatically; older vaults and opens3-* object metadata are still read.

• Tooling: internal/s3test in-memory S3 server; MinIO integration suite (scripts/test-integration.ps1); prefix-scoped external-endpoint suite (scripts/test-external.ps1, PAIL_EXT_*); release script with archives for Windows, Linux and macOS (amd64, arm64) and SHA256SUMS; icon generator (go run ./tools/genicons).

• CI and releases: Forgejo-first master and tag mirroring; six native test targets, race, isolated MinIO, vulnerability checks and CodeQL; exact-commit release gates; versioned archive and executable names; tool versions pinned by mise. Woodpecker website deployment targets netcup-vps500 with atomic activation and two retained releases; live deployment acceptance is separate.

Security

• The website's Goldmark dependency is pinned to v1.7.17, fixing GO-2026-5320.
• Secrets are never written to configuration files; they live in the OS keychain or the encrypted vault.
• Logs redact URL query strings, Authorization headers, signatures and known secret values.
• Custom endpoints default to the "when required" checksum mode; a request whose outcome is unknown is never replayed.

Known limitations

• Not tested against real AWS (STS AssumeRole and CloudFront only on httptest). Real servers tested: MinIO (two releases) and a self-hosted VersityGW behind Cloudflare.
• Interactive GUI acceptance on macOS and ARM64 is outstanding. CI requires native tests and executable version checks for all six targets; this is separate from manual desktop validation. The macOS app has no developer signature and is not notarized.
• Behind Cloudflare, gzip-encoded objects are decompressed by the proxy, so their downloads are refused (sizes do not match); nothing wrong is written.
• Not verified: versioning on VersityGW (disabled there); SSE-S3, SSE-KMS and SSE-C success paths; objects larger than 5 GiB through in-place rewrites; local mirror deletion into the real OS trash.
• size_time sync can miss same-size edits; checksum sync repeats transfers for objects without pail-sha256 metadata.
• A write-only account under the rename conflict policy cannot detect a replay-induced 412; case-colliding key numbering is not remembered across scans.
• Hand-typed ZIP passwords and SSE-C keys are redacted from logs only by label or field name.
• Task titles from the application layer and the command line are not localized.
• Right-click popups were not visually reviewed; the object list header cannot match the design spec exactly (mygo limitation).

简体中文

Pail 的首个版本。各功能的验证情况记录在 docs/status.md。

新增

• 桌面应用（pail-desktop，Go + mygo，支持 Windows、Linux 和 macOS）：带账户切换器和存储桶列表的侧栏、面包屑、虚拟化的可排序多选对象表（自动分页）、搜索、平铺视图、检查器、传输面板、状态栏、命令面板（Ctrl/⌘+K）、右键菜单和快捷键、亮色与暗色主题、English 与 简体中文，以及基于内存 S3 服务的 --demo 模式。

• 账户：账户数量不限，支持 AWS 与 S3 兼容服务（自定义端点、区域、路径样式、访问密钥、AWS profile、默认凭据链、匿名、AssumeRole）；连接测试；按账户设置校验和模式。

• 浏览与预览：存储桶和文件夹导航，JSON、CSV、XML、文本、图片和十六进制预览，复制对象键、URI、URL 和预签名 URL。

• 传输：上传和下载文件、文件夹、版本与整个存储桶，支持拖放；上传、下载、其他三类独立队列，并发上限可配置，可取消和重试；五种冲突策略；分片传输；仅创建的条件写入，对不支持它的服务商提供回退方案；下载在校验后以原子方式发布。

• 对象管理：复制、移动和重命名（同一存储桶内及跨存储桶）；批量删除并给出逐项结果；编辑 headers、元数据、标签、ACL、存储类别和服务端加密（SSE-S3、SSE-KMS、SSE-C），事后复核；MIME 类型表。

• 版本：列出版本和删除标记，恢复某个版本或已删除的键，下载并永久删除多个版本。

• 存储桶：创建、删除和清空；复制、移动或下载整个存储桶；14 项存储桶设置，可用表单或 JSON 编辑；列出并中止未完成的分片上传。

• 同步作业：上传、下载和镜像，带预览、三种比较方式和排除 glob；执行时逐项复核已预览的动作；本地删除进入系统回收站。

• 上传规则：headers、存储类别、加密和压缩（GZIP、ZIP、带压缩级别的 AES-256 ZIP）；下载时解码。

• 每个账户的 CDN 域名（基础 URL 或 {bucket}/{key} 模板，可选存储桶列表）、预签名 URL 对话框、CloudFront distribution 与失效（AWS 账户）。

• 命令行（pail）：accounts、buckets、ls、cp、mv、rm、mb、rb、presign、url、versions、restore、sync、vault status；JSON 输出和稳定的退出码；与应用共用账户和同步作业。见 docs/cli.zh-CN.md。

• 安全：机密保存在系统钥匙串或可选的加密保险库（Argon2id、XChaCha20-Poly1305）中，支持空闲自动锁定；需主动开启的脱敏诊断日志；每个破坏性或批量操作都会显示范围并要求确认。

• 与 openS3 的兼容：已有的 openS3 配置文件夹和钥匙串条目会自动迁移；仍可读取旧版保险库和 opens3-* 对象元数据。

• 工具链：internal/s3test 内存 S3 服务；MinIO 集成测试套件（scripts/test-integration.ps1）；限定前缀的外部端点测试套件（scripts/test-external.ps1，PAIL_EXT_*）；发布脚本，生成 Windows、Linux 和 macOS（amd64、arm64）压缩包及 SHA256SUMS；图标生成器（go run ./tools/genicons）。

• CI 与发布：Forgejo 优先的 master 与 tag 镜像；六个原生测试目标、race、隔离 MinIO、漏洞检查与 CodeQL；精确提交发布门禁；压缩包和程序使用带版本的名称；mise 锁定工具版本。Woodpecker 网站部署指定 netcup-vps500，原子切换并保留两版；线上部署验收单独进行。

安全

• 网站的 Goldmark 依赖锁定为 v1.7.17，修复 GO-2026-5320。
• 机密绝不写入配置文件；它们保存在系统钥匙串或加密保险库中。
• 日志会对 URL 查询串、Authorization 头、签名和已知的机密值脱敏。
• 自定义端点默认使用"仅在需要时"校验和模式；结果未知的请求绝不重放。

已知限制

• 未在真实 AWS 上测试（STS AssumeRole 和 CloudFront 只在 httptest 上测试）。已测试的真实服务端：MinIO（两个版本）和 Cloudflare 后面的自建 VersityGW。
• macOS 与 ARM64 的人工 GUI 验收仍待完成。CI 要求六个目标的原生测试和版本检查通过，这与人工桌面验证分开记录。macOS 应用没有开发者签名，也没有公证。
• 在 Cloudflare 后面，gzip 编码的对象会被代理解压，因此它们的下载会被拒绝（大小不一致）；不会写入任何错误内容。
• 未验证：VersityGW 上的版本控制（该服务上已禁用）；SSE-S3、SSE-KMS 和 SSE-C 的成功路径；通过就地重写处理大于 5 GiB 的对象；本地镜像删除进入真实的系统回收站。
• size_time 同步可能漏掉大小相同的修改；对没有 pail-sha256 元数据的对象，校验和同步会重复传输。
• 在重命名冲突策略下，只写账户无法检测因重放而产生的 412；大小写冲突的键的编号在多次扫描之间不会被记住。
• 手动输入的 ZIP 密码和 SSE-C 密钥只能按标签或字段名从日志中脱敏。
• 来自应用层和命令行的任务标题未本地化。
• 右键弹出菜单未做视觉评审；对象列表表头无法与设计规范完全一致（mygo 的限制）。