v2.1.0 — AGPLv3 + gold-standard hardening

Schroedinger Sync v2.1.0 — AGPLv3 relicense + a full gold-standard hardening pass.

Export your own claude.ai conversations, project knowledge docs, and memory to local Markdown. Windows, single Go binary, DPAPI + real-Chrome (CDP), no telemetry, sends data nowhere but your disk.

🔑 License

Relicensed MIT → AGPLv3 — still free and open, permanently. Strong copyleft: any derivative (including a hosted/network version) must stay open source. For a tool whose whole value is "you can trust it because you can read it", that guarantee matters.

🔒 Security

• Toolchain pinned to go 1.26.5, clearing GO-2026-5856 (a reachable Encrypted Client Hello privacy leak in crypto/tls).
• Filename hardening: every API-sourced path component is stripped to [0-9A-Za-z-], so a tampered response can never escape the output folder via ...

🛠️ Fixed

• No more silent data loss — extractText now preserves unknown conversation block types (extended-thinking, images, future types) instead of dropping them.
• Fatal/tray exits flush the secret-redactor and tear down any open Chrome first — no lost diagnostics, no orphaned browser window.
• Mutex around all system-tray calls (closes a Win32 icon-handle use-after-free).
• decryptValue strips the 32-byte app-bound prefix for v20 cookies only.
• cleanValue trim order; sentinel rate-limit error; write-error logging; unknown-subcommand usage.

✅ Verified

go build · vet · test (coverage 5% → 21%, new unit suite) · staticcheck 0 · gosec 0 · govulncheck clean · gofmt.

Download schroedinger-sync.exe below. Run it yourself (it reads your own cookies — the credential step stays in your hand). See SECURITY.md for the full threat model.