ProtonBridge v1.2.2

1.2.2 — fork maintenance

• Remove unused session-scheduler inspection/latch helper and superseded legacy import constructors; retain active scheduling and validated atomic import paths.
• Verify installed bisync-state and manual reconnect-generation bytes before reporting critical writes successful; reject stale or failed replacements.
• Preserve authenticated encrypted-backup proxy and rollback semantics when applying the stricter validated import plan.
• Keep the custom ProtonBridge application identity, attribution and Proton-focused bisync workflow.
• Maintain the exact rclone fork revision pin and signed APK/source provenance.
• Separate the application and engine fork histories; remove inherited upstream release notes
  and engine implementation changes from this application changelog.

ProtonBridge v1.2.1

1.2.1 — direct Resync, native recovery and upstream updates

• Remove bisync dry-run/preview UI, reports, approval expiry, copied preview listings
  and the mandatory preview step. Resync saves the task, confirms folders, filters,
  flags and preferred copy, then performs real transfers. Scheduled runs never
  automatically choose Resync. Normal Run keeps using the completed baseline.
• Permit native --recover and --resilient boolean flags. A failed/interrupted
  ordinary run may retry its matching saved baseline when either is enabled;
  rclone validates whether recovery is possible. Adding these operational flags
  does not change file-selection identity. Missing baselines, changed endpoints,
  filters, configuration or engine still require Resync. Neither flag guarantees
  recovery of a failed first Resync. Correct spellings are shown for typos.
• Merge 52 official rclone commits through 35a03a47e00e2cadec744f977e5fa9d851127016,
  pinned by fork merge 814954580.
  Includes bisync skipped-conflict/listing fixes, include-filter performance work,
  VFS memory/race fixes and Drive fast-list hang fixes. Retain Proton metadata,
  checksum requirements, contained companion modules and atomic listing locks.
  This is upstream development source, not a new official stable rclone release.
• Reduce repeated work: publish RC notification summaries only when displayed
  counts change; stop repeatedly logging retained failed jobs at every poll.
  Optional session checks skip empty tokens and TOTP-only configurations.
  Lock ownership, streaming lifecycle, idle shutdown and transfer refresh remain.
  No measured device battery saving is claimed.
• Reconcile upstream CloudBridge security/reliability commit f97ff8e3 with the fork:
  private validated share/download staging, loopback streaming URL capability,
  exact remote-name validation, checked missing-remote failures and fail-closed
  Keystore protection of SAF credentials. Preserve stronger existing redacted
  logging, native stream ownership and signed-build provenance protections.
• Validation: 222 app host tests, zero failures/skips, 14 release-script tests,
  lint, all four native ABI builds, debug split/universal APKs and device-test APK
  build. Engine host/race regressions, four upstream bisync scenarios and native
  trusted-listing recovery checks passed; independent integration reviews completed.
  Device tests were compiled, not executed on a physical phone.
• Base version code 210; ARM64 217. The new engine pin requires a one-time Resync
  before an older engine baseline can be used. Existing releases stay immutable.

ProtonBridge v1.2.0

1.2.0 — audited stable release

• Publish the audited ProtonBridge source as 1.2.0, a full stable release with
  the same application ID and signing certificate as the recent prereleases.
  Base version code is 200; ARM64 is 207. All split/universal codes exceed 1.1.9.
• Include the necessity-audit change from 4674c396:
  Android foreground-service refusal immediately reports user action, preserves
  the bisync baseline and suppresses failure follow-ups. Remove automatic retries
  of that permission/setup rejection. Ordinary network/charging/contention waits
  remain; no permissions, battery exemptions or platform bypasses are added.
• Retain the verified checksum snapshot, filter/editor, privacy, configuration-write,
  restore, timestamp and preview-cleanup fixes described in 1.1.8. Keep rclone pinned
  to f1d1627e2e91867b5fed5eb6bb4d4e8d094924c8 and the same baseline fingerprint policy.
  A healthy 1.1.8/1.1.9 baseline remains valid; upgrading from 1.1.7 or changing
  filters/settings may require a new preview and reviewed initialisation.
• Extend signed publication to accept stable vX.Y.Z tags as well as -rc.N tags.
  Stable releases are published without the prerelease marker and become GitHub's
  latest release. Preserve immutable tags, exact version/notes matching,
  monotonically increasing ABI codes, draft asset staging, signing checks and
  checksum/source provenance. Earlier candidates stay immutable.
• Validation before the release commit: independent review; 205 Android tests
  with no failures or skips; 14 release-script tests; lint; debug APK build
  and native engine provenance verification. The signed workflow repeats checks
  and verifies the distribution before publication.
• The stable channel is a publishing designation. The recorded fixture, host and
  build verification does not establish every live account/device scenario.
  Android permissions and background limits still require appropriate user setup.

Necessity audit included in 1.2.0

Reviewed every functional change in 1.1.9 and 1.1.8 against its source, regression
coverage and the earlier complete fork/companion audit. Coverage includes the
32 application fork commits through 8a052dab and 26 engine fork commits through
f1d1627e, plus the companions compared with their exact imported versions. Independent Android and
engine reviews checked the stricter requirement: correct demonstrated defects,
report setup errors clearly and do not add workarounds for platform permissions.

Removed: automatic retries after Android rejects foreground-service startup.
The reported scheduled-start rejection does not establish a transient condition;
backoff cannot grant permission or change battery settings. Repeated attempts add
wakeups without a demonstrated benefit. The audited source immediately reports
needs user action, starts no native transfer, preserves the saved baseline and
suppresses failure follow-ups. Manual retries remain the user's choice.

Change reviewed	Decision and evidence
Android rejection classification	Keep exact exception/cause classification and actionable status. An OS/setup refusal is not an rclone transfer failure. SDK 33 worker tests preserve ready-state bytes and reject unrelated permission errors separately.
Baseline readiness diagnostics	Keep clearer reasons; the approval guards are unchanged. Changed filters/flags/configuration/engine, missing initialisation or an interrupted run legitimately require review. No forced recovery or approval bypass.
Proton checksum snapshot consistency	Keep. Signed HTTP fixtures and actual bisync reproduce a hash captured before copying and changed on download open. Resolve consistent authenticated metadata before capture and reject changed snapshots. The user's live checksum cause is still unproven; a successful exclusion is not proof of that cause.
Filter/editor changes	Keep reproduced recycled-row, saved-rule parsing, dropdown-identity and draft-loss repairs, plus shared tested argument composition. Flags were already appended during all three bisync stages in 1.1.7; no imaginary blanket missing-flags defect required a special initialisation workaround.
Include selection and deletion review	Keep restrictive GUI include semantics and explicit review for older include/delete-excluded tasks. The migration prevents silently widening destination deletion. Expert filter order and literal pattern whitespace remain available.
.nomedia handling	Keep documented native semantics only: /.nomedia is root-only, **/.nomedia is nested-only, .nomedia matches at every depth. No automatic exclusion, deletion, marker rewriting or checksum bypass.
Secret redaction	Keep. Old long/unterminated JSON fixtures expose truncation leakage or Java regex stack overflow; repaired redaction tests pass.
Configuration/password writes and restore	Keep readback/durability verification and recovery admission. Failure-injection tests show suppressed failed writes and uncertain marker retirement. The app stops/reports uncertainty rather than concealing storage failures.
Newer/older conflict timestamps	Keep the scoped local override: downloads must preserve source times for the existing chronological conflict mode to compare them meaningfully. Other operations retain their policy.
Disposable preview cleanup	Keep bounded cleanup only after confirmed native exit. Tests preserve baselines/live previews and reject traversal/symlink escapes.
Removed DNS/API/service/duplicate scheduling code	Keep those removals: unused paths had no caller/operational role; Android's system DNS and the actual WorkManager scheduling path remain.
Other previously audited fork changes	Keep evidence-backed authentication, listing, integrity, process ownership, scheduling constraints, privacy and signed-build provenance protections. Rechecks found no additional justified rollback candidate.

Existing waits for a missing network, charging, quiet hours or another live native
operation remain: those are observable conditions that can change. They are
separate from retrying a rejected Android service permission. No exemption,
expedited-job conversion, exact-alarm permission or setup-dependent bypass is added.

Validation after removal: independent review, 205 Android tests with no failures
or skips, lint, debug APK build/engine verification and release-script tests all
passed. The engine source/pin did not change, so its already-passing backend,
bisync, companion, race and vet checks did not need repeating.

This audit is included in 1.2.0. The published 1.1.9 APK/tag remains immutable;
historical release entries below describe what those releases actually shipped.

ProtonBridge v1.1.9-rc.1

1.1.9-rc.1 — handle Android background-start restrictions safely

• Handle Android ForegroundServiceStartNotAllowedException distinctly from
  transfer errors. Scheduled tasks defer with bounded WorkManager backoff instead
  of immediately recording a failed transfer. Waiting does not send failure
  notifications or queue failure follow-ups, and the temporary notification and
  transfer admission are released. Cancellation still takes priority.
• After the retry budget is exhausted, or if a manual start is denied, report
  needs user action with Android battery/background-settings guidance. The
  rejection occurs before native work and before any bisync state transition;
  the existing baseline remains unchanged. This error does not itself require
  resync. Other permission errors and timeouts remain separate failures.
• Distinguish missing initialisation, pending preview approval, changed task/filter/
  configuration/engine fingerprints, interrupted runs and invalid saved baseline
  identities in readiness diagnostics. Keep all existing approval/recovery guards.
  Changing filters on 1.1.7 can invalidate approval independently of a scheduled
  foreground-service rejection.
• Retain the reviewed 1.1.8 fixes. A working marker exclusion does not repair the
  demonstrated listing/download checksum inconsistency, recycled filter-editor
  callbacks, long-secret redaction or configuration-write defects. No engine or
  fingerprint-policy change is introduced by this release, so a healthy 1.1.8
  baseline does not need reinitialisation merely because the app version changed.
• Regression tests inject the real Android exception through a worker foreground
  updater on API 33 and check retry history, terminal user-action reporting and
  byte-for-byte preservation of ready state. A negative permission-error fixture
  checks that unrelated errors are not retried as start restrictions. Readiness
  tests retain the same baseline guards and verify distinct diagnostics.
• Validation passed before committing: independent review, 205 Android host/unit
  tests with no failures or skips, lint, debug APKs and engine provenance. The
  signed workflow repeats host checks and verifies package,
  version codes, certificate, architectures and distribution checksums.
• Platform limit: retries cannot force Android to permit a scheduled foreground
  service. For long unattended transfers, review ProtonBridge's App info → Battery/
  background settings, or open the app and run the task. Allowing unrestricted
  background operation can use more battery. No automatic battery exemption,
  exact-alarm permission, expedited-job conversion or checksum bypass is added.

ProtonBridge v1.1.8-rc.1

1.1.8-rc.1 — consistent Proton checksums, working filters and fork cleanup

Proton revision consistency

• Pin rclone to f1d1627e.
  Resolve authenticated detailed metadata before bisync captures its listing and
  pre-copy result records. Revision history can identify the correct revision
  while supplying attributes that disagree with the subsequent detailed download
  response. Previously, opening that download could change the object checksum
  after bisync had recorded it, causing successful transfers to end with a
  checksum-listing abort, including .nomedia.
• Legacy listings select fresh canonical history identity, then use the existing
  query-free detailed revision route. Explicit advertised signed metadata must
  authenticate too; invalid metadata remains an error. Cached detailed metadata
  is bounded, keyed to the canonical revision and reverified against current keys.
  History metadata cannot seed the authoritative cache.
• Downloads verify canonical identity and known size, SHA1 and modification time
  before consuming content or changing the listed object. A changed or inconsistent
  snapshot closes the response and fails safely. Unknown fields remain unknown.
  Checksums, signatures and recovery requirements stay enabled.
• Regressions reproduce the history/detail disagreement with signed fixtures
  whose hashes are computed from actual content. A real bisync fixture reproduces
  the pre-copy/post-open mismatch and verifies corrected Path2 initialisation and
  subsequent sync with a 29-byte marker, an empty marker and unchanged companions.
  This reproduces a mechanism consistent with the reported failure; there is no
  live Proton account trace proving it is the only cause of that particular file.

Filters, flags and initialisation

• Saved GUI patterns accept conventional signed lines and CRLF, remove accidental
  surrounding spaces/quotes and reject blank, malformed or control-character
  patterns. Task flags accept --exclude /.nomedia, quoted values and --exclude=….
  All flags and saved filters are composed through the same builder for Save and
  preview, Review and initialise, and normal runs. Non-filter tuning flags
  remain present in all three stages.
• Basic exclusions take priority over basic includes; includes now restrict the
  selection with an implicit final exclusion. Pure expert --filter rules retain
  their order and pattern whitespace. Mixing a filter reset with saved/basic
  restrictions is rejected. One-way tasks using the old unrestricted include
  behavior with Delete excluded files must review and save that setting before
  running, preventing a silently wider deletion scope.
• Recycled filter rows detach old callbacks so editing one row cannot change another.
  Preserve unfinished filter edits across recreation; use one dropdown snapshot
  for displayed names and saved IDs, and reset empty filter lists correctly.
• Editor help explains root /.nomedia versus all-depth .nomedia patterns.
  Excluding a marker leaves it untouched and does not omit adjacent deck/media
  files; do not exclude entire Anki media folders. Native-engine tests check both
  pattern depths, nested included files, all three stages and retained source markers.
• Bump the baseline fingerprint policy: repeat preview and review initialisation
  for existing tasks. Initialisation is a real --resync; review what may be
  overwritten, especially when preferring Proton/Path2. No automatic exclusion,
  deletion, checksum bypass or resync is introduced.

Audit repairs and removed code

• Redact diagnostic secrets before bounding lines; handle long or unterminated
  JSON secret values without recursive regex stack overflow or truncated leaks.
• Verify installed configuration and wrapped-password bytes after atomic writes,
  synchronize files and directory entries, and retain rollback state on uncertain
  restore-marker retirement. A double failure also blocks native preparation in
  the current process until forced recovery. A committed restore remains successful
  if only obsolete-journal cleanup fails. These barriers cannot guarantee recovery
  after every physical storage failure or a process restart with no writable marker.
• Preserve downloaded timestamps for newer/older conflict policies with a narrowly
  scoped local-backend override; other operations retain existing timestamp behavior.
• Retire disposable preview files only after confirmed native exit, with exact UUID
  paths, flat-file bounds and symlink checks. Persistent baselines are never removed.
• Remove unused revision API shim, obsolete global pure-Go DNS override and app DNS
  formatter, unused Android scheduling service lifecycle/manifest registration, and
  redundant post-restore scheduling reconciliation. Retain the actual scheduling
  adapter, WorkManager dispatcher and useful Internxt authentication/retry changes.

Scope of the complete fork review

• Reviewed all 30 prior application fork commits against direct upstream
  ece92754:
  374 rename-aware file entries covering production Java/Kotlin, resources, host and
  device tests, workflows, build scripts, branding and documentation. Rename-only
  changes were separated from functional changes; all added production classes
  have actual callers. The existing chronological commit ledger below remains the
  detailed history.
• Reviewed all 25 prior rclone fork commits against
  4f19e9cd:
  259 file entries including core listing guards, bisync/backend changes, Internxt
  authentication, native builds and test/workflow changes. Compared every local
  runtime delta of the Proton companions against their exact imported revisions:
  bridge 6f7fc6530d4a77d33d08e36464e018600ae4b93d and API
  9dcca00ba1dc779a8958c9d4988b79ce2f9f3233.
• Retained useful bisync approval/recovery, battery-aware scheduling, process
  exclusion, encrypted credentials/configuration, backup recovery, private RC
  access, Proton concurrency/cache limits, signed-release provenance and attribution.
  No speculative cryptographic-format rewrite or broad removal of useful safety
  mechanisms resulted from the review. Disposable fixtures validate local behavior;
  device battery drain and live-account behavior still need installed-app testing.
• Validation completed before the application commit: independent code review;
  engine/companion regressions, race checks and vet; 201 Android host/unit tests
  with no failures or skips, including real local-engine filter/config tests;
  lint; all four native ABI builds and APK engine/provenance checks. The signed
  publication workflow additionally verifies package, increasing version codes
  and the existing signing certificate before publishing.

ProtonBridge v1.1.7-rc.1

1.1.7-rc.1 — fix Proton preview revision lookup

• Pin the rclone engine to b8c5405e.
  Fix the new preview request introduced in 1.1.6 that could return Proton HTTP
  422 / Code 2501 before any transfer. Resolve legacy file metadata through the
  existing revision-history route without requesting a block range or block URLs.
• Refresh the unique active revision for every legacy listing, even when the
  folder listing advertises a stale revision ID or authenticated metadata is
  already cached. Only reuse signed metadata under the freshly selected revision
  identity; verify signatures against current keys. Never use an old Link.XAttr
  checksum or conceal an actual history/permission error with cached data.
• Retain the verified revision identity in listed file objects. Downloads check
  that identity against fresh history and stop if it changed, before fetching
  content. Preserve exact detailed-response identity checks, unknown metadata
  semantics, bounded request concurrency and signed-metadata cache limits.
• Regression coverage includes the reported rejected request, empty files,
  revision A changing to B with a stale hint and warm cache, history errors,
  invalid signed attributes and snapshot changes before download. Host engine/
  backend/bisync regressions use disposable fixtures and race checks. Android
  artifacts are built and verified separately; live-account acceptance still
  depends on retrying the installed update.
• After updating, repeat Save and preview, then review and initialise the
  failed task if recovery is required. Initialisation performs a real resync and
  can copy/overwrite files according to the selected winner; check the preview.
  No checksum bypass, automatic resync or exclusion of .nomedia is introduced.

ProtonBridge v1.1.6-rc.1

1.1.6-rc.1 — authoritative Proton revision checksums and recovery reports

• Pin the rclone engine to 8627faf6.
  Legacy Proton listings omit active-revision attributes and may expose an older
  checksum in Link.XAttr. Resolve the listed revision's own authenticated metadata
  rather than comparing that older checksum against downloaded content. Explicit
  revision attributes, when present, remain authoritative and must verify.
• Fetch only a minimal revision metadata page with block URLs disabled. Coalesce
  duplicate requests, limit concurrent metadata fetches to four, and reuse signed
  metadata by share/link/revision identity within an 8 MiB payload budget and
  2048-entry cap. No names, directory inventory or active IDs are reused: each
  listing is fresh, and metadata cache hits reverify against current keys.
  Downloads and successful signed commits seed reuse for post-transfer listings.
• Use the fetched revision's signer; reject changed advertised revision IDs,
  mismatched responses and missing/ambiguous active identity. Invalid preferred
  metadata never falls back to older link attributes or a valid cache entry.
• Remove terminal colour escape codes before redacting/displaying diagnostics.
  Checksum-listing aborts retain failure status and explain verification uncertainty,
  comparing the two copies and repeating preview/review/initialisation. No automatic
  force, resync, exclusion or checksum bypass is added.
• Signed legacy-API fixtures reproduce the reported pair of differing checksums
  and cover listing → download metadata → relisting → changed revision → upload
  commit → relisting. Tests cover current-key revalidation, corrupt preferred
  attributes, identity failures, cache bounds, cancellation and concurrent reads.
  Backend/bisync, companion auth/crypto/block, race and static checks passed before
  pushing the completed engine fix. Local SHA1 fixtures initialise differing
  29-byte .nomedia files successfully without mutating files during preview.

The first release build was cancelled after a repeated Anki failure exposed
the legacy wire-shape gap. This candidate contains the
completed fix. The actual account response/device is unavailable, so signed
protocol regression coverage does not constitute live-account acceptance. Files
changing during sync can still correctly stop reconciliation; keep Anki closed
when synchronising its database. No full listing-to-download snapshot binding or
silent repair is claimed. Engine changes require fresh preview and explicit approval.

Protocol reference: Proton SDK legacy revision endpoint and metadata schema.

ProtonBridge v1.1.5-rc.1

1.1.5-rc.1 — consistent branding and consolidated documentation

• Update the README to describe ProtonBridge throughout, with current download
  names, package/activity identity, build toolchain, bisync controls and attribution.
• Update repository documentation pages, privacy text, contributor instructions
  and issue-template links to this fork. Remove upstream download/store claims.
• Consolidate the added guides, audit/roadmap files and release notes into this
  document. Historical details remain available through immutable Git history.
• Signed releases now extract their notes from the matching version section here;
  missing, empty or duplicate sections stop release validation.
• Retain the existing app identity, signing certificate, engine pin and runtime
  behaviour. This update contains documentation and release tooling changes.

ProtonBridge v1.1.4-rc.1

ProtonBridge 1.1.4-rc.1 — simpler flags and complete reference

Updates the existing ProtonBridge package with the same signing certificate;
base versionCode 140. The reviewed rclone engine pin is unchanged.

• Type one custom flag per line: --flag, --flag value or --flag=value.
  String values, spaces and Unicode are supported; quotes are not required.
  Each line becomes one argument, without invoking a shell.
• --conflict-resolve newer now works: modtime comparison is added alongside
  mandatory size/checksum checks. The engine's other resolution modes are also
  supported, and numbered conflict copies preserve losing content.
• Removed Build a flag, performance presets and View rclone command. Existing
  saved flags and transfer counts are preserved.
• The remaining rclone flag reference lists bisync and all global/backend flags,
  with explanations/defaults from the exact bundled engine and searchable complete
  entries. It is a local reference, not a sync or account connection. Some engine
  options belong in app controls/remote configuration and remain protected.

After changing flags, save and review a fresh preview before initialisation.
Task approval fingerprints include the conflict policy. Modification-time-based
resolution requires both endpoints to support modification times; rclone warns
and falls back to preserving conflicts when an endpoint cannot support it.

Parser/argument tests and a real 20-file local native bisync fixture verify newer
wins on both sides and older content survives in conflict copies with checksums
and safety checks enabled. No live-account or device acceptance test was run.

Full changelog

Exact-source validation passed all 180 current app tests (no failures/skips),
seven release-version tests, lint, APK assembly and instrumentation compilation.
Independent review passed. Tests for the removed preset feature were removed;
new parser, conflict argument and approval-fingerprint regressions were added.

ProtonBridge v1.1.3-rc.1

ProtonBridge 1.1.3-rc.1 — battery and privacy optimizations

Same application ID io.github.rareities.protonbridge and fork signing
certificate as 1.1.2-rc.1; base versionCode 130. No configuration migration or
automatic baseline reset is performed. The reviewed rclone engine stays pinned
to de1b01ca4ca02488ef2942ea6f2f00c0a35dc08e.

• Remove forced high-performance Wi-Fi locks and duplicate worker CPU locks;
  keep foreground WorkManager ownership and service/RC locks for active work.
• Replace ten-per-second exit inspection with a blocking exit waiter and timed
  cancellation/deadline checks. Reduce native stats and progress updates to
  five seconds, quiet heartbeat to fifteen seconds and RC polling to three.
• Make battery exemption optional; new idle scheduling defaults defer wakeups.
  Existing saved schedule/permission choices are preserved.
• Bound/cancel optional health probes and local config reads, drain both pipes,
  avoid false reconnect alarms from quota/permission errors and private logging.
• Fix thumbnail-server pipe draining/cancellation. Harden local Markdown against
  embedded network loads, JavaScript, file/content access and custom schemes;
  clean up its executor with the host activity.
• Require battery not low for optional update checks and confirm foreground
  service startup before native file transfers begin.

Bisync approval, checksum/cryptographic verification, actual-exit leases and
baseline recovery remain intact. Existing Android Unrestricted battery mode
cannot be changed by the app: choose Optimized in Android settings and turn off
allow-while-idle scheduling if delayed starts are acceptable.

No device battery or live-Proton performance measurement was performed; there
is no claimed percentage saving. Progress/RC status updates may appear a few
seconds later while completion and cancellation remain explicit.

Full changelog ·
Audit and measurement guidance

Local exact-source validation passed all 181 app tests (no failures/skips),
seven release-version tests, lint, APK assembly and instrumentation compilation.
Independent review passed, including cancellation/ownership and privacy checks.