CD v0.4.2: reliable transfers and stable/nightly channels

Fixes relay transfers that stopped after an inherited 10-second admission deadline and incorrectly reported 90 seconds without data. Progress now stays on one terminal row, including narrow terminals.

Stable cdx and cdx-nightly install and update separately. This release includes the patched Go 1.26.10 toolchain, x/net 0.60.0, accurate updater errors, and retry-safe release publishing.

Verified 19 real Linux-box transfer cases across stable/nightly in both directions, direct and forced relay, private links and nested folders, with exact hashes and metadata. A real 60-column terminal kept 38 redraws within 59 columns and produced only six newlines. Resume, retries, device pairing/expiry, terminal and browser checks pass.

CI, security and the full automated six-platform release workflow are green. Re-running publish against this existing release also passes.

Update: cdx update. Nightly: cdx-nightly update.

Install and channel instructions: https://github.com/YashasVM/cd/blob/v0.4.2/docs/guides/release-channels.md
Source PR: #90

PowerShell and Android hardware were not exercised. Daily nightly scheduling begins after the workflow reaches the default branch.

CD v0.4.1: patched toolchain and verified transfer flows

Stabilizes the CLI release and verification pipeline.

• Rebuilt with Go 1.26.10 and golang.org/x/net 0.60.0 to address called vulnerability findings.
• Update failures retain their actual API error instead of reporting every failure as an unreachable GitHub server.
• Stable cdx and cdx-nightly remain separate; failed checksum verification preserves both installed binaries.
• Includes the relay admission deadline fix and terminal progress redraw fix from v0.4.0.

Validation: 122 JavaScript tests, Go race tests, typechecking, browser and CLI integration checks, 10 transport cases with 64 MiB payloads, deployment dry run, live stable/nightly installation and update, and a 645 MiB production relay transfer with matching hashes. PowerShell runtime testing is unavailable locally.

PR: #90

Security verification: no called vulnerabilities found, no dependency audit findings, and the full 578-commit secret scan passes. Secret-scan exceptions match only proven public test vectors and a historical source checksum; synthetic new secrets remain detectable.

CD v0.4.0: reliable transfers and stable/nightly channels

Fix the inherited 10-second relay read deadline that interrupted healthy transfers and misleadingly reported a 90-second stall. Keep terminal progress on one row and reduce captured progress output. Separate stable cdx and nightly cdx-nightly installations and updates.

Verified a complete 676649730-byte production relay transfer with matching SHA256 hashes; 122 JavaScript tests, all Go tests, and typechecking passed.

Known validation gaps: PowerShell runtime was unavailable. Existing security scanning reports Go standard-library vulnerabilities; the separate browser verification script has a stale ZIP-download assertion. Release binaries are built from the tested commit.

Source PR: #90

Update stable with cdx update. Nightly is installed separately with CD_CHANNEL=nightly. No Android APK update is included.

CD v0.4.0-beta.5: fix mid-transfer stalls

Fixes a mid-transfer flow-control deadlock in the web sender that could leave web and CLI receivers reporting no data for 90 seconds. The sender now keeps enough window capacity to cross the receiver acknowledgement threshold with uneven source chunks.

The web fix is deployed at https://cd.yash0.in. Refresh an open sender tab before retrying. CLI binaries are rebuilt from the same commit for all six supported platforms. No Android APK change is included.

Validation: 121 JavaScript tests, all Go tests, typechecking, production build and deployment dry run passed. The regression test failed before the fix and passes afterward. The production sender asset matches the built artifact and the health endpoint reports OK.

Known check failures: the browser integration script expects a ZIP download where the current app downloads extracted files; the separate security scan reports existing Go standard-library vulnerabilities. Automated release verification was canceled after reproducing the browser assertion locally; binaries were built from the tagged commit.

Source: #90

cdx nightly-20261110-796827e

Stabilizes the CLI release and verification pipeline.

• Rebuilt with Go 1.26.10 and golang.org/x/net 0.60.0 to address called vulnerability findings.
• Update failures retain their actual API error instead of reporting every failure as an unreachable GitHub server.
• Stable cdx and cdx-nightly remain separate; failed checksum verification preserves both installed binaries.
• Includes the relay admission deadline fix and terminal progress redraw fix from v0.4.0.

Validation: 122 JavaScript tests, Go race tests, typechecking, browser and CLI integration checks, 10 transport cases with 64 MiB payloads, deployment dry run, live stable/nightly installation and update, and a 645 MiB production relay transfer with matching hashes. PowerShell runtime testing is unavailable locally.

PR: #90

Security verification: no called vulnerabilities found, no dependency audit findings, and the full 578-commit secret scan passes. Secret-scan exceptions match only proven public test vectors and a historical source checksum; synthetic new secrets remain detectable.

v0.4.0-beta.4

CD CLI v0.4.0-beta.4 and Android 0.1.8 beta.

Agents now offer paired-device delivery or a download link when handing off APKs and documents. Explicit phone requests with a single pairing send directly; multiple pairings prompt for a destination. Update your CLI and run cdx agent setup to refresh installed agent instructions.

Targeted CLI sends run in the background when stdout is captured. The returned PID and private log mean the sender started; only a verified event confirms receipt. Missing and ambiguous pairings fail before launching a sender. --wait keeps foreground behavior. A sole paired device can be addressed with --to phone even if saved under another alias.

The relay now advertises v2 support, applies the existing IPv6-prefix upgrade limit to v2, rejects noncanonical nonce encodings, and retains replay history through its 128-session cap. Already discarded historical nonces in old relay state cannot be recovered.

Removing a completed or cancelled receive from history now hides the row while retaining its transfer identity and receipt state for the 24-hour retry window, preventing renewed offers from restarting a dismissed transfer.

Android retains the beta 3 receiving/recovery fixes and advances to version code 9 so it can update the previous beta. The package remains in.yash0.cd.beta and requires Android 10+.

Validation includes 85 Android unit tests and lint, 158 JavaScript tests, Go tests and vet, TypeScript, code-security and v2 relay gates, real CLI/browser transfer checks, and zero npm audit vulnerabilities. Physical-phone validation remains outstanding.

This is a beta release. Physical Samsung long-idle/Doze receiving, real configured Firebase delivery and sustained hardware speed improvements remain unverified. The default Android build omits Firebase and is debug-signed. Production signing, distribution and migration are still required before removing beta. Creating a release does not deploy the updated Worker; its server-side fixes require a separate deployment.

CD CLI and Android beta 3

Android 0.1.7 beta and CLI v0.4.0-beta.3.

Fixed native Android standard-link and short-code receiving. The ACCEPT handshake now matches the CLI; standard transfers stay on the encrypted relay until native v1 direct replay handling is supported. Resumable v2 direct transfers remain available.

Also fixes completion-frame loss on clean socket close, Android 10–12 code lookup compatibility, receiver pause/restart recovery, queue capacity, persistent dismissal, unsupported Resume actions, file types, scanner alignment and wrapped links/commands.

Validation: 58 Android unit tests, lint and ARM64 build passed. Android 15 emulator verified private-link receiving, short-code receiving, duplicate filenames and trusted 1 MiB receiving with screen off; received SHA-256 hashes matched the originals.

Download the APK below for Android 10+ ARM64 devices, or the CLI binary for your platform. SHA-256 checksums are included.

Limitations: debug-signed Android beta; physical camera scanning, Samsung long-idle Doze, and phone-to-CLI sending were not end-to-end verified in this pass. Standard transfers require a new link after interruption. Five-digit device pairing is not included; numeric file-transfer codes are supported.

CD CLI and Android beta 2

CLI and Android beta update.

• Smaller terminal QR for cdx pair, preserving the pairing payload and saved PNG.
• Multiple paired devices with automatic device names.
• Updated Android Send, Receive and Devices screens, scanner and QR image import.
• Received files open directly on tap.

Download the Android arm64 APK below, or the CLI binary for your platform.

Validation: Go tests and Android unit tests passed; all six CLI binaries and the Android APK built successfully.

Android is a debug-signed beta for Android 10 or newer. Camera scanning and pairing have not been verified on a physical phone. Five-digit device pairing is not included. Automatic web-link opening still requires the website verification file to be served correctly.

v0.3.7

CD v0.3.7 includes the transfer performance work and supporting CLI, browser, relay, and verification changes from PR #63.

Transfer speed improvements

• Stop compressing already encrypted WebSocket records in the Worker, avoiding compression CPU work without changing encryption.
• Negotiate encrypted transfer chunks up to 768 KiB while retaining the 256 KiB base size and compatibility with older peers. Browser relay sends retain 256 KiB frames where larger frames measured worse.
• Read browser file sources in bounded 4 MiB blocks. A 64 MiB diagnostic workload needs 16 reads instead of 256. Single-file sends also skip a redundant rechunking copy; bundles retain their batching.
• Batch browser OPFS storage writes near 4 MiB and overlap decryption with one storage write at a time. Disk-write failures still propagate to the receiver.
• Decrypt exclusively owned CLI records in place and reuse ciphertext storage after synchronous TCP writes. Relay and WebRTC records retain separate ownership while queued or awaiting replay.
• Offer authenticated, encrypted TCP for same-network CLI transfers, including a reverse connection when the sender cannot accept inbound connections. Unavailable TCP falls back to WebRTC and relay. The TCP lane does not apply to browser or resumable v2 transfers.
• Calculate folder ZIP sizes from metadata instead of checksumming synthetic payloads during preparation. Adaptive browser send windows retain bounded queues and accommodate two negotiated chunks to avoid an acknowledgment deadlock.

Recorded results

These are the PR's local benchmark results on specific snapshots and workloads, not new benchmarks of the final merge. The TCP iteration's full dirty baseline was not published, so that result is a provisional historical observation and does not establish a speedup for this release. Receiver-plus-flush completion is the measured metric below. Each cited comparison uses seven trials; the report includes raw data, variation, and rejected experiments.

• Disabling WebSocket compression improved forced-relay completion by 1.86× for browser-to-browser, 2.57× for browser-to-CLI, and 1.52× for CLI-to-browser, compared with the prior CD compression setting. Direct-allowed results were mixed.
• Bounded source reads reduced browser-to-browser relay completion from 1151.2 to 1062.4 ms, and browser-to-CLI relay from 700.0 to 635.3 ms.
• The provisional TCP ciphertext-reuse experiment reported a 256 MiB RAM-output completion median change from 232.5 to 197.3 ms, an observed 1.18× improvement over prior CD. In that particular cohort, completion was 5.09× faster than the faster croc mode; readiness remained slower.
• Removing the extra single-file copy reduced browser-to-CLI relay completion by 6.8% and browser-to-browser direct-allowed by 4.6%. Browser-to-browser relay took 1.4% more time in that experiment.
• Against croc 11.5.5's official browser client, CD completion was 2.15×–4.45× faster in five of six direction/mode combinations. Browser-to-browser direct-allowed was 1.20× faster. These are same-host comparisons with preloaded pages and private relays, not public-internet measurements.

The original goal of being at least 1.5× faster than croc in every required scenario and timing metric was not achieved. The complete acceptance run verified 489 transfers but still missed readiness and several completion gates. The measured physical LAN used a 100 Mb/s link. No universal speedup is claimed, and the separate experiments above must not be multiplied together.

Full benchmark report and raw evidence

Other changes included

• Resumable v2 transfers with authenticated session binding, retained verified progress, bounded session history, and waiting/paired leases. CLI and browser support are included.
• Paired-device CLI commands and supporting device discovery, encrypted transport, and optional Firebase wake-up infrastructure. Android remains a development preview; this release does not include an APK or claim Android performance improvements. New device and resume endpoints require the matching Worker.
• QR output with cdx send --json --qr <fresh-png-path>, stable transfer identifiers, opt-in progress, structured failure/retry information, and request IDs for safely repeating background sends.
• Shared file-sharing skill generation, transfer-route diagnostics, benchmark comparisons with croc, and checks of real browser/CLI, relay, WebRTC upgrade, resume, retry, and device behavior.
• Retain main's receive-directory confinement, exclusive random staging files, overwrite protections, bounded bundle extraction, filename-collision handling, code-directory authorization/rate limits, cancellation, and ICE candidate fixes.
• Close the remaining review findings: bound browser ZIP directories to 8 MiB and 10,000 entries before allocating, validate safe integer offsets, serialize resumable admission, and make raw WebSocket diagnostic timeouts interrupt stalled sends. Larger bundle directories fall back to offering the ZIP.
• Retain a 32 MiB browser ordering buffer so delayed relay records can coexist with the CLI's 24 MiB striped send window. Browser send queues keep their separate 16 MiB cap.
• Keep benchmark proxy destinations fixed even for crafted request URLs, check resumable offsets before signed conversion, and bound record allocation arithmetic before adding lengths.
• Accept -- in cdx wait and cdx status so transfer identifiers beginning with a dash can be passed safely.
• Restore multi-file integration coverage, adjust storage tests for the larger batches, and update development dependencies to remove the reported npm vulnerabilities.

Validation and availability

The review includes JavaScript tests, Go tests and race checks, TypeScript, npm/Go vulnerability scans, history secret scanning, real browser/CLI transfers, and Worker deployment dry runs. All ten 64 MiB transport cases verify exact SHA-256 payloads, including forced relay, slow receivers, and relay-to-WebRTC upgrade.

The release provides cdx binaries for Linux, macOS, and Windows on amd64 and arm64, plus SHA-256 checksums. Run cdx update to update an existing installation. Publishing these binaries does not deploy the production website or Worker; browser/relay changes need a separate deployment.

CD Android + cdx pairing beta 1

Android and terminal beta for PR #60.

• Fix the missing private-transfer server support behind Android's send error.
• Keep QR scanning in portrait, with a dark scanner, flashlight control and camera permission recovery. UI work was completed with Claude Haiku and corrected/reviewed with Claude Opus.
• Add cdx pair and paired-device sending, with a beta notice every time pairing runs.
• Android receives website/CLI short codes and private links. Its private v2 links work in the website and CLI beta. Fix browser download cancellation caused by deleting the backing file too early.

Download CD-Android-0.1.1-beta.1-arm64.apk for an ARM64 Android 10+ phone. It installs as CD Beta alongside earlier CD/Preview installations, with fresh pairings and history. This testing APK is debug-signed.

Install the matching CLI beta:

curl -fsSL https://cd.yash0.in/install.sh | CDX_VERSION=v0.4.0-beta.1 sh
cdx pair

This is a prerelease. Stable installs and cdx update still select the stable version. Keep the Android app open for paired transfers. Background push wake-up is not configured. Legacy v1 transfers need a new link after interruption; legacy multi-file sends arrive as ZIP archives on Android. Private v2 transfers support resume.

Validation: 55 Android JVM tests and lint passed; ARM64 APK built. Go suites, 84 JavaScript tests, TypeScript, relay security checks, CLI restart/tamper tests, browser private/pasted/QR/resume tests and hosted staging and production v1/v2/pairing tests passed. Emulation was stopped at the user's request; physical-device camera and native transfer verification await install feedback.

Production server version: f759bf5e-be03-480f-9b2d-3fd848f72da3. SHA-256 hashes are in checksums.txt.