[Tracker] AeroFTP 4.0.5 - Known issues, patches & updates

[axpnet]

AeroFTP 4.0.x, Rolling Tracker

Umbrella issue for AeroFTP 4.0.x: known issues for the current release (v4.0.4, release notes, published 2026-06-06) and the patches/updates already landed on main for the next patch release (v4.0.5).

Before opening a new issue, please check the lists below. If your problem is already tracked here, just add a thumbs-up reaction or a comment with your environment (OS, version, provider) instead of filing a duplicate. We update this issue as bugs are found and fixed.

Found something that is not listed? Open a new issue and we will link it here.

What shipped in 4.0.4

• Reversible restricted-filename encoding for Box, Dropbox, Jottacloud, OpenDrive ([ROADMAP] Wrappers/Overlays #272, General Thoughts #266)
• CLI interactive shell polish: u3 / 3u user-switch tokens, reorder visual diff ([ v4.0.5 Wishlist ] share your enhancement suggestions ✨ #270)
• Discover health-check toggle as icon-only button
• My Servers "Local bridge" filter chip
• Fixes: macOS Tahoe 0x0 window ([BUG] macOS 26.5 Tahoe - No window after splash screen #290), default-account welcome skip after tray Quit ([ v4.0.5 Wishlist ] share your enhancement suggestions ✨ #270), OAuth reconnect re-authorizing every time ([ v4.0.5 Wishlist ] share your enhancement suggestions ✨ #270), tray heap corruption on suspend/resume, CLI bootstrap hardening and rclone FTPS export

Patches & updates queued for 4.0.5

Done on main, shipping in the next release.

#	Type	Change	Status	Commit	Issue
1		Filen + MEGAcmd file versioning (list / get / restore) + a "versioning bytes" segment in the storage-quota bar, plus a generic CLI versions group and versioning bytes in df	✅	9a6e6efd, 8924590d, 1392dcad, a7f26475, 3bc3ffeb	#270
2		CLI profiles -i reorder reprint: two-column old/new index diff with a merged arrow and colour coding	✅	c4763718, b03c646c	#270
3		Filen API key moved out of saved-profile storage into the encrypted vault	✅	5431c5fe	#230
4		Switching a saved profile's protocol keeps the ⭐ favourite and storage quota	✅	6199d24c	#215
5		Filen connect spinner no longer hangs on a saved-server row	✅	af4f3b2c	#270
6		CLI --strict / AEROFTP_STRICT safety mode	✅	fcd512a6	-
7		rclone export emits the OpenStack Swift key in plaintext	✅	9abfe263	-
8		Delete-scan toast label corrected; spurious post-update toast silenced	✅	8241e8fe	-
9		Guard the OS keyring against a disposable / master-mode vault clobbering the global vault-passphrase; new CLI keystore status / keystore repair recovery	✅	5ec47d5a	-
10		First-run credential migration is idempotent under concurrent GUI + CLI (no more default-user UNIQUE race)	✅	a7d65060	-
11		keystore status exit code distinguishes healthy-but-locked (2) from genuinely unopenable (1)	✅	897bab96	-
12		Per-user credential partitioning (MU-VAULT): each local user's profiles and secrets in their own encrypted partition, with optional cryptographic isolation between users. Data is always strongly encrypted; the access gate (OS keyring by default, optional master password, 2FA, per-user passphrase) is yours to pick per use case	✅	e5f612f5	-
13		CLI interactive shell: a refresh command (aliases clear and .) in aeroftp profiles -i. It clears the screen and reprints the table, re-reading from the vault so a profile changed in another session shows up. Empty-Enter stays inert and r (rename) is unchanged; the original view flags (--sort / --hide / --show / --breakdown) are preserved	✅	78f7ef09	#266
14		Renamed the Mount Manager to AeroMount as the Aero-family name of the component (per #270): the in-app File menu entry and dialog title across all 47 locales as an untranslated brand (matching AeroSync / AeroVault), the README "Aero family" section, and the docs site (feature page, sidebar nav, current mentions). "Mount Manager" stays usable as a descriptor; the /features/mount-manager URL is kept so links do not break, and historical changelog / roadmap entries are left as shipped	✅	aee02c74	#270
15		My Servers search no longer surfaces an OpenDrive API profile when searching "web". The profile carried a stale providerId (opendrive-webdav) from a WebDAV to native-API protocol switch, leaking "webdav" into the search blob; the search now re-derives the provider identity from the current protocol when the stored providerId's protocol is inconsistent. Genuine WebDAV profiles still match "web"	✅	69c65a04	#318
16		The encrypted rclone-format overlay is now labelled "Rclone Crypt" consistently (toolbar button, path-bar badge, toasts, help text, all 47 locales) instead of "AeroCrypt" on some surfaces and "Rclone Crypt" on others. This reserves "AeroCrypt" for AeroFTP's own future encryption overlay. Internal i18n keys are unchanged	✅	e16209f3	#272
17		CLI benchmark --file-count N --file-size S: a many-small-files axis (upload-all / list-dir / stat-all / download-all / delete-all) reporting files/sec and per-file latency, kept strictly separate from the single-file throughput sweep and never averaged into it. This is the workload where per-file overhead (handshake, signing, metadata round-trips) dominates and S3 pulls ahead of WebDAV/FTP. Two additive schema-v1 fields (file_count, files_per_second); validated live on SFTP, S3 and WebDAV profiles	✅	a3af0794	#277
18		Custom icon picker on every Quick Connect page, not just generic WebDAV/S3 profiles: preconfigured providers (Filen, OneDrive, ...) can now be given a custom icon. The picker is restricted to the custom-icons library for presets so they cannot be assigned another provider's logo. A custom override now also propagates to the AeroFile endpoint dropdown (last surface that rendered the preset logo directly), via the shared icon resolver	✅	6c8d9fe3	#270
19		Organise saved connection profiles into user-named groups on the My Servers screen (FlashFXP-style Site Manager). A group is the named generalisation of the saved-server favourites: stored in the same encrypted per-user vault, so existing profiles need no migration and the profile format is unchanged. New group button by the filter chips; each group is its own filter chip with a live count; Add to group in a server's right-click menu toggles membership or creates a new group seeded with that server; right-click a chip to rename or delete (deleting keeps the servers, it only removes the grouping). Membership carries across a profile convert or duplicate. Flat groups for this first cut; the storage model leaves room for nesting	✅	d8ed076e	#320
20		The green Create Account and amber Generate Password links no longer vanish when a provider group's tab has no preset of its own. Koofr API kept neither link and OpenDrive API never showed Create Account, because the native-API tabs carry no registry preset; the links now resolve group-wide (every mode in a group hits the same account, so the same signup / app-password page is correct for all tabs) and stay identical when switching tabs. The English / Italian label casing is aligned: "Generate password" becomes "Generate Password" to match "Create Account"	✅	9dc727bf	#215
21		Switching a saved profile between the modes of a group (Filen API / Local WebDAV / Local S3, Koofr, OpenDrive) now keeps each tab's own credentials, including the options-level secrets (TOTP secret, Filen API key, S3 keys), instead of wiping them on leaving the Native API tab. Each mode's typed values are stashed in-memory for the edit session and restored on return; a first visit keeps the original carry-over, and the stash is cleared when a different profile starts editing so secrets never leak across profiles. No on-disk storage change	✅	96e502ab	#215
22		MEGAcmd WebDAV preset: a Fetch URL button reads the bridge address by running mega-webdav / (the same idempotent call already used for the quota probe) and fills the Endpoint field, so the URL no longer has to be copied from the MEGAcmd terminal. Setup step 4 drops from "Run: webdav /" to one click; an inactive MEGAcmd session surfaces the exact mega-login hint inline	✅	44c8fdaf	#215
23		OneDrive Get credentials now opens the Azure App Registrations list blade (#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade), the page where the OneDrive Client ID and Secret are created. The old #blade/Microsoft_AAD_RegisteredApps deep link no longer resolved reliably	✅	f5759bbd	#270
24		A Docs link to docs.aeroftp.app on every Quick Connect page, standard and OAuth forms alike. A provider-id / protocol to docs-slug resolver maps the cases where they differ (googledrive to google-drive, s3 to aws-s3, fourshared to 4shared, ...); an unmapped provider falls back to the provider's own help URL and then the providers index, so a working link always renders	✅	d5e82716	#270
25		CLI tree summary now reports depth: a 0-based layer ruler line ("0 | 1 | 2") above a reworded "X directories and Y files in a depth of Z layers", where Z is the deepest layer actually reached (a shallow tree reports less than the requested cap). The --json summary gains an additive layers field	✅	629c5ab0	#270
26		The Filen Desktop local bridges (WebDAV on :1900, S3 on :1800) keep "admin" only as a placeholder hint, but connecting with the fields left empty now tries "admin" as the actual value instead of blocking with a missing-fields error. Many users connect first just to check the bridge is up before customising the credentials in both apps; an explicit value always wins. All four credential fields show the "admin" placeholder and a "leave empty to try admin" hint	✅	f47b49ba	#215
27		Opt-in to persist a profile's credentials for every protocol of one account across restarts. A new "Remember credentials for every protocol of this account" checkbox appears whenever the active provider belongs to a mode group (Filen, MEGA, OpenDrive, Koofr, ...). When on, each mode's typed credentials are written to the encrypted vault under server_modes_<id> (the server_ prefix routes them through the active user's partition, so they stay per-user isolated like the profile password) and hydrated back on edit, so switching modes never asks again even after a restart. Single-use TOTP/STS codes are stripped before persisting; unchecking deletes the stored set on the next save. Off by default. This is the on-disk piece Ehud asked for, and the MEGA/pCloud multi-tab request rides on it	✅	c4657a23, 926247f3	#215
28		A single MEGA Quick Connect page with mode chips for the three surfaces that have a real backend: API (native, E2E), WebDAV (MEGAcmd) (local bridge) and S4 (object storage, Pro). On connect to the MEGAcmd WebDAV mode AeroFTP runs mega-webdav / itself (the same idempotent call used for the quota probe) and adopts the served URL, so there is no manual step: the first-setup, switched-to, connection-issue and general-connect cases all resolve automatically. The endpoint may be left blank; the mega-webdav / wording is kept in the setup text and mode warning for MEGAcmd-familiar users, with the CLI equivalent (aeroftp --profile <name> ls) noted. A fourth "Non-WebDAV MEGAcmd" surface has no backend yet and is intentionally left out until one exists	✅	536dbb75	#215
29		The CLI tree summary layer ruler now prints a short legend, "layers (0 = top level, parent = -1):", directly above the numbers, so the 0-based depth is no longer ambiguous about whether 0 means the listed directory or its first level of children. JSON output is unchanged	✅	d7ac7ac2	#270
30		The Open as Cryptomator Vault window and the Archive browser used hardcoded dark Tailwind colours with no dark: variants, so on the Light theme the title, the Vault Password field and the close button were almost invisible. Both now follow the selected theme like the AeroVault window	✅	6cfefaba	#270
31		The AeroFile status-bar button is now a true open/close toggle: when not connected a second click returns to the connection picker instead of running the Places (sidebar) behaviour	✅	5c32f8b2	#270
32		The 4shared OAuth Get credentials link now opens reliably. It called invoke('open_url'), an unregistered command, inside a synchronous try/catch that never caught the promise rejection, so nothing opened; it now uses the shared openUrl helper, pointed at the App Registrations page that carries the create-app form (developer/docs/app/)	✅	ba5bd340	#270
33		Optional heart marker for favourite servers: a Settings > Appearance toggle swaps the ★ for a red ♥ in the My Servers cards and table and in the aeroftp-cli profiles table, help, confirmation and TUI navigator. The favoriteMarker preference lives in the shared app_settings vault key, so the CLI reads the same value the GUI writes; strings translated across all 46 locales	✅	25936eb8	#270
34		AeroVault v3 + Error Correction, Beta to stable. Reed-Solomon erasure-coded self-healing .aerocorrect sidecar, unified across the vault and AeroSync, with a standalone CLI correct subcommand and MCP tools; v3 usability polish, and the Beta/stub labels dropped. Synthesis here, full design and validation in the wrapper-stack discussion	✅	d5e77ae7f, b5db4b214, 6713b9581, 4eb31feaf, 9c36d7a7b, 02176bbaa	#276
35		AeroCrypt native encrypted overlay, dual panel and AeroCrypt Profile. Client-side encryption you own, layered on top of any backend and browsed in the same dual panel as a normal server; a per-profile AeroCrypt Profile binds it to any protocol or provider, rclone crypt stays beside it as the interop lane, and both are opt-in with no default cipher. Format hardened to AECR v3 (AES-256-GCM-SIV content, AES-256-SIV names, AES-256-KW per-file key, length binding, key-bound config MAC). Synthesis here, detail in the wrapper-stack discussion	✅	50cd5fc8d, 64bb3989f, bf7d0db95, d77afb640, 83e9769aa, 4e577e253, ce4dea8e2, a839d3feb	#272, #276
36		CLI interactive TUI, rev 1.0.3-alpha (preview). A full-screen dual-pane file manager (aeroftp tui) with a GUI-style IntroHub My Servers view, a command palette, and file-manager table stakes (sort, filter, select, view, edit), plus the inline profiles -i action menu. Ships as a discreet alpha preview, detail in discussion #311	✅	a3ee5747f, 1c63abbc8, 91427fa15, 0888f0099, e0984f8f3	#311
37		ZIP store-if-larger. Each ZIP entry is stored instead of deflated when a deflate pass would not shrink it, so packing already-compressed or incompressible data no longer inflates it; shared by the CLI and the GUI	✅	3a3fcf78c	#276
38		CLI compress / extract. Standalone local-archive subcommands for every supported format (zip, 7z, tar, tar.gz/xz/bz2; rar extract), with format, level, password and subfolder options	✅	3dd574e93	-
39		SSH advisory clearance. russh bumped 0.60.3 to 0.61.2, clearing the deferred SSH advisories	✅	4bfd2d070	-
40		Windows aftp short name + alias-toggle. The short command name and the alias toggle are now native on Windows, matching the Unix surface	✅	5d99dddc3	#273
41		CLI archive correctness. Ignore an ambient AEROFTP_ARCHIVE_PASSWORD for non-encrypted formats, and report tar archive output_bytes via the real output path	✅	243cf30ec, 9151e961a	-
42		Cryptomator vault unlock restored. A jsonwebtoken feature-flag change had broken Cryptomator unlock; restored, with the vault root prefilled	✅	6defb0190	#322
43		AeroCrypt overlay listing log. The connect-time "Directory listing of ..." line showed the raw provider path ("/") for an overlay-bound profile instead of the anchored folder; it now reflects the overlay-anchored path and the decrypted item count	✅	bf767f53f	-
44		CLI profiles TUI: safe default focus + column order. Entering profiles -i now focuses Quit(Q/0) so a stray Enter exits instead of re-indexing, and the action bar follows the table column order (re-index, Rename, Edit, Copy, Delete, Fav, List, Tree, Quit)	✅	e038027e4	#311
45		AeroCrypt overlay decrypt flash. Connecting an overlay profile no longer flashes the raw encrypted file names and the "/" path during unlock; the anchored path shows immediately and scrambling decrypting placeholders play until the decrypted names land, with a fallback to the raw view if the unlock fails	✅	ecb9a3a43	-
46		My Servers filter sidebar. The wrapping filter chip row is replaced by a collapsible vertical sidebar (search plus Quick, Protocols and Groups sections) that scales to any number of user groups; the collapse state and the left/right side are persisted	✅	d1d1aab40, ae8f87e55	#320
47		AeroFile breadcrumb dropdowns no longer clipped. Clicking the > in the AeroFile path bar now opens the sibling-directory dropdown (and the "..." overflow menu); they rendered inside the bar's overflow-hidden and were clipped to invisibility, now rendered fixed	✅	-	#270
48		Quick Connect crypt overlay UX. Collapsible Wrappers/Overlays section, renamed "Crypt (Encryption)", Rclone Crypt listed first, per-format readability hint, eye toggle on Salt, labels above Password/Salt	✅	-	#276
49		Immich sync cancel. Stop now halts an AeroSync run at the next file, and a second press (force stop) aborts the in-flight transfer	✅	-	#332
50		Remove master password (unsecuring). Removal always completes: if the OS keyring rejects the write it falls back to a local OS-permission-protected key file. Validated on Windows	✅	-	#333
51		Windows Portable profile persistence. The portable build falls back to a self-contained on-disk key when the Credential Manager is unavailable, so the vault initialises and profiles persist, including across restarts. Validated on Windows	✅	-	#334
52		Test hygiene. Removed real lab server host/credentials from ignored live tests (placeholder host/user/dir/passphrase) and fixed a clippy too_many_arguments regression that broke CI	✅	-	-
53		AeroFile rubber-band selection and click-to-deselect. Drag a selection box over the file area to multi-select in all three views (list, grid, large icons), Ctrl/Cmd/Shift extends, edge auto-scroll, and clicking empty space clears the selection.	✅	de696ee5	#270
54		AeroImage lossless or lossy labels. Each image edit is marked lossless or lossy with an accurate per-operation and per-format mapping (JPEG/GIF lossy, PNG/WebP/BMP/TIFF lossless), plus a per-format note in the Save dialog.	✅	de696ee5	#270
55		Draggable dialogs everywhere plus guarded close. Every single modal moves by dragging its header; a modal that is busy (a transfer or sync) or holds unsaved edits no longer closes on a stray click outside, it asks first.	✅	de696ee5	-
56		Local AeroSync run is cancelable. The AeroSync dialog's local mirror can be stopped mid-run from a Stop control, and the dialog guards its close while a sync is in flight.	✅	de696ee5	#332
57		Crypt overlay entries are provider-aware. The AeroCrypt and rclone-crypt overlay entries and the connection-form toggle now appear only where a transparent overlay applies, and are hidden on media-only APIs (Immich, ImageKit, Uploadcare, Cloudinary, Google Photos) and code hosting (GitHub, GitLab).	✅	e78a8eaf	-

_{Housekeeping not listed above: internal docs/dev no longer published, roadmap history refresh, RUSTSEC-2026-0173 advisory triage (build-time only), flaky test hardening.}

Examples

#2 - profiles -i reorder (moving Profile2 from #2 to #4; old indices red and struck, new ones green, the moved row struck in white):

     #  Name
    ──────────────
     1  Profile1
┌───2̶ ̶ ̶P̶r̶o̶f̶i̶l̶e̶2̶
│   3̶2  Profile3
│   4̶3  Profile4
└─>  4  Profile2
     5  Profile5

#1 - Filen file versioning (CLI):

# list previous versions, newest first
aeroftp versions list "report.xlsx" --profile Filen
# restore the file to a previous version
aeroftp versions restore "report.xlsx" <version-id> --profile Filen

#6 - strict safety mode (CLI):

# refuse safety-relaxing flags, globally via env
AEROFTP_STRICT=1 aeroftp sync ./local "remote:/path" --profile S3
# or per command
aeroftp --strict rm "remote:/path" --profile S3

Known issues found after release

None reported yet. This list will be updated as reports come in.

#	Area	Description	Status	Linked issue
-	-	-	-	-

_{Status legend: 🔴 confirmed · 🟡 investigating · 🟢 done / fixed (pending release) · ✅ released}

Affected platforms

• Windows
• macOS
• Linux

---

Maintained by the AeroFTP team. Released as v4.0.5. Patches accumulated here; each major release still gets its own tracker.

[axpnet]

Post-4.0.4 follow-up, fixed on main, pending v4.0.5:

Area	Description	Status	Ref
Filen / GUI	Connect spinner on a saved-server row could hang past connect/disconnect and block quick reconnect (Filen E2E v2). The filen_get_auth_version badge enrichment was awaited inside the connect handler and queued behind the initial listing on the provider lock; now fired detached. GUI-only, timing-dependent (not reproducible locally on Linux).	🟢 fixed	af4f3b2c (discussion #270)
Filen / security	CLI API key was persisted in ProviderOptions / saved-profile storage instead of the secure vault. Moved to the vault (filen_api_key_<id> + hasStoredFilenApiKey flag) with a one-time migration, mirroring the password pattern. CLI unaffected (env-var based).	🟢 fixed	5431c5fe (#230, closed)

Both verified green (typecheck, 249 vitest, full cargo test, production build). Real-cloud Filen round-trip still to be checked once v4.0.5 builds.

[axpnet]

Post-4.0.4 follow-up, fixed on main, pending v4.0.5:

Area	Description	Status	Ref
Profiles / GUI + CLI	Switching a saved profile's protocol (convert or duplicate, e.g. OpenDrive WebDAV to API) deletes and recreates the profile, which previously dropped the ⭐ favourite and the storage quota stats. The new profile now carries over lastQuota and the favourite flag (convert moves the star to the new id; duplicate keeps it on both), in both the GUI (favoriteServers.ts util as single source of truth, handleConvertMode / handleSaveAsNew) and the CLI (duplicate_or_convert_mode_in_vault). The 10s Undo also restores favourites. Addresses #215 comment.	🟢 fixed	6199d24c (#215)

Verified green (typecheck, cargo check/cargo test aeroftp-cli 215 passed, 249 vitest).

[axpnet]

Known issue (post-release): Blomp exposed in production + service unavailable

#	Area	Description	Status	Linked issue
1	Providers / Blomp	Blomp (OpenStack Swift) is reachable in production via the new "Add Service" list view and opens a working connection form, although it is gated to dev-only in the protocol grid (stable: false). The Blomp service itself is currently unreachable: auth succeeds but the Swift storage proxy returns 403. Decision: keep it with a "not stable" disclaimer (rclone ships it too).	🟡 investigating	this issue

_{Status legend: 🔴 confirmed · 🟡 investigating · 🟢 fixed (pending release) · ✅ released}

Details & plan (v4.0.5)

The dev-only gate lives only in the protocol grid (ProtocolSelector, stable: false). The new SSOT-generated "Add Service" list view (4.0.4) lists Blomp without that gate, and clicking the row opens the connection form, so Blomp is effectively exposed in production.

Blomp uses the OpenStack Swift backend, the same integration rclone uses for Blomp. The service is broken upstream: authentication works, but the Swift storage proxy returns 403 on every container/account request.

Verification (reproducible, valid test account):

Client	Auth	Container list	403 source
AeroFTP (GUI)	OK	403 Forbidden	Blomp swift proxy
curl raw, Keystone v2 (tenantName=storage)	200 + token	403 Forbidden	swiftproxy.acs.ai.net:8080
rclone v1.74.3 (type=swift, auth_version=2, tenant=storage)	200 + token	403 Forbidden	swiftproxy.acs.ai.net:8080

The Keystone token is valid (role BlompCustomer, tenant "Blomp Main storage"); the object-store endpoint http://swiftproxy.acs.ai.net:8080/v1/AUTH_<id> returns 403. This is a server-side storage-proxy failure on Blomp's side, reproduced identically by AeroFTP, raw curl and rclone with valid credentials. Blomp's own support forums have multiple unresolved "rclone can't connect / operation forbidden" threads.

Action items for v4.0.5:

• Add a "Not stable - service currently unavailable (Blomp API issue)" disclaimer/badge on Blomp in the Add Service list and the connection form.
• Replace the generic "check credentials" connect error with a clear, actionable message ("Blomp service currently unavailable, issue on Blomp's side").
• Reconcile the visibility gap: the list view should honour stable (intentional choice: keep visible but flagged, not silently re-hidden).
• Track the upstream fix; if Blomp does not restore their Swift API, revisit disabling the provider entirely.

[axpnet]

Bug (post-release, fixed): rclone export wrote OpenStack Swift key obscured

#	Area	Description	Status	Linked issue
2	Export / rclone (Swift)	Exporting an OpenStack Swift profile (Blomp, OVH, Rackspace) to rclone.conf wrote the key field obscured. rclone's swift backend does not treat key as a password field (IsPassword = false), so it sent the obscured string verbatim as the password and authentication failed with HTTP 401. Fixed: swift key is now emitted in plaintext (same as S3 secret_access_key and Azure key).	🟢 fixed (pending release, v4.0.5)	this issue

_{Status legend: 🔴 confirmed · 🟡 investigating · 🟢 fixed (pending release) · ✅ released}

Details & fix (v4.0.5)

export_rclone is the shared writer used by both aeroftp-cli export rclone and the GUI bridge, so the issue affected every Swift export from either path. The exported config authenticated fine inside AeroFTP (it uses the decrypted password directly) but failed in rclone because the key was obscured.

Audited all exported secret fields against rclone config providers (IsPassword metadata):

• obscure (correct): ftp/ftps pass, sftp pass + key_file_pass, webdav pass, mega pass, koofr password, opendrive password
• plaintext (correct): s3 secret_access_key, azureblob key, swift key

Swift was the only mismatch. Fix verified by a round-trip unit test (test_export_rclone_swift_key_is_plaintext) and empirically: with a plaintext key, rclone authenticates (HTTP 200) and reaches Blomp's storage proxy (which then returns the upstream 403 from item #1).

Fixed on main in commit 9abfe263 (fix(rclone-export): emit OpenStack Swift key in plaintext), shipping in v4.0.5.

[axpnet]

Feature (post-release, implemented): file versioning (Filen + B2) and quota versioning-bytes, GUI and CLI

#	Area	Description	Status	Linked issue
3	Providers / versioning	File versioning implemented for Filen, surfaced in the GUI versions panel and a new aeroftp-cli versions list/get/restore command group (generic across providers). Filen and Backblaze B2 are now ticked for versioning in Help > Providers. MEGAcmd is intentionally left unticked (see Details).	🟢 fixed (pending release, v4.0.5)	#270 (c.17207680)
4	My Servers / quota bar	File-versioning byte size (the last line of mega-df) is drawn as a distinct fuchsia segment above the usage bar on the My Servers card, and is exposed in CLI df / about as versioningBytes.	🟢 fixed (pending release, v4.0.5)	#270 (c.17207733)

_{Status legend: 🔴 confirmed · 🟡 investigating · 🟢 fixed (pending release) · ✅ released}

Requested by @EhudKirsh in #270 (comments c.17207680 and c.17207733). Thanks for the detailed reports and the mega-df / mega-ls --versions pointers.

Details (v4.0.5)

Versioning is generic. A provider implements four trait methods and both the GUI versions panel and the new CLI versions group light up at once. Filen now implements them against POST /v3/file/versions and POST /v3/file/version/restore (shapes verified against filen-sdk-ts); each version's per-file key is decrypted from its own encrypted metadata and chunks are pulled from egest, so an old version downloads independently of the current file.

New CLI surface (parity with the GUI). GUI and CLI are separate command paths, so the same capability is now scriptable:

aeroftp-cli versions list    <remote>                       # newest first
aeroftp-cli versions get     <remote> <version-id> <local>  # download one version
aeroftp-cli versions restore <remote> <version-id>          # make it current

Supports --profile, --json, directory destinations for get, and exit codes 7 (provider has no versioning), 5 (missing arg), 2 (not found). The quota versioning-bytes also surface in df / about (versioningBytes).

Confirmed live, end to end. Filen and Backblaze B2 native (list, get old version, restore, with byte-verified contents); Google Drive and Koofr versions list; MEGA (MEGAcmd) df / about report versioningBytes (30 MB) matching raw mega-df.

MEGAcmd. It lists and sizes versions (mega-ls --versions, mega-df) but as of MEGAcmd 2.5.0 has no per-file restore or version-download command (only deleteversions), so its cell stays unticked until it does. The column means "works end to end in AeroFTP", not "the provider keeps the data".

Quota bar. mega-df's Total size taken up by file versions line was previously parsed and discarded; it is now captured (StorageInfo.versioningBytes), persisted with the cached quota, and rendered above the My Servers usage bar (GUI) and in df / about (CLI).

Fixed on main in 9a6e6efd (GUI) and 1392dcad (CLI), shipping in v4.0.5.

[axpnet]

Update on #1 (partial fix, pending v4.0.5): unstable-provider disclaimer shipped

The first action item from the Blomp known-issue above is done: a non-dismissible warning banner now renders at the top of the connection form whenever the selected provider is flagged stable: false.

#	Area	Description	Status	Linked issue
1a	Providers / unstable disclaimer	New UnstableProviderNotice component (red AlertTriangle, role="alert", always visible since it is a security note). It is generic, so it covers every stable: false provider, not just Blomp: digitalocean-spaces, oracle-cloud, s3drive, nextcloud, blomp. Wired into the connection form, resolving the provider via selectedProvider / providerId / the swift to blomp fallback. New connection.unstableTitle and connection.unstableBody (with {provider}) translated across all 46 languages.	🟢 fixed (pending release, v4.0.5)	this issue

_{Status legend: 🔴 confirmed · 🟡 investigating · 🟢 fixed (pending release) · ✅ released}

Still open on #1 (the rest of the action list):

• Replace the generic "check credentials" connect error with a clear "Blomp service currently unavailable" message.
• Reconcile the visibility gap so the Add Service list honours stable.
• Track the upstream Blomp Swift fix (the storage proxy still returns 403).

Landed on main in 24cf3374, shipping in v4.0.5.

[axpnet]

Bugs (post-release, fixed): delete-scan toast labelled "Downloading" + spurious "Update completed" toast

#	Area	Description	Status	Linked issue
5	Transfers / toast	Deleting a folder showed Downloading: <folder> in the scanning toast while the subtitle correctly read "Scanning folder for deletion...". The backend uses two delete-scan direction conventions (recursive FTP delete emits remote, the generic provider delete emits delete); the frontend scanning handler only mapped remote to the delete operation, so the generic-provider path fell through to download. Both now map to the delete op, and delete was added to the TransferEvent.direction type (the backend already sent it).	🟢 fixed (pending release, v4.0.5)	this issue
6	Updater / toast	The green "Update completed successfully" toast re-appeared on unrelated restarts ("ogni tanto, senza motivo"). It fired on the mere presence of last-update.json and cleared the marker only after showing the toast (best-effort, can lose a render race or silently fail), so a marker left from a real past update kept re-firing. Now the marker is consumed first (cleared before any early return), the effect is guarded by a useRef so it runs once per session, and a freshness check skips markers older than 10 minutes (a real post-update relaunch lands within seconds).	🟢 fixed (pending release, v4.0.5)	this issue

_{Status legend: 🔴 confirmed · 🟡 investigating · 🟢 fixed (pending release) · ✅ released}

Details & fix (v4.0.5)

#5, delete-scan toast direction. Folder deletes emit a scanning transfer_event to drive the ScanningToast. The toast picks its label (Deleting / Uploading / Downloading) from the event's direction. Two backend paths disagree on the value:

• delete_directory recursive FTP delete (lib.rs) emits direction: "remote"
• the generic provider delete_dir scan (provider_commands.rs) emits direction: "delete"

The scanning handler in useTransferEvents.ts only treated remote as a delete, so the generic-provider delete fell through its ternary to download and the toast read Downloading: <folder>. The subtitle ("Scanning folder for deletion...") was always correct because it comes from the event message. Fix: map both delete and remote to the delete operation, and add delete to the TransferEvent.direction union in types.ts (runtime already produced it).

#6, spurious post-update toast. last-update.json is written only by a genuine update install (deb/rpm/appimage/Windows), then the app restarts and a post-restart effect reads it, shows the success toast, and clears it. Two weaknesses let it re-fire:

• the clear ran after the toast and is best-effort (let _ = remove_file), and the effect's deps (t / toast / activityLog) can change identity, so a failed/raced clear or a re-run could surface the toast again on a later launch;
• there was no version or freshness check, so a marker that survived once kept confirming the same long-finished update.

Fix (frontend only): consume the marker first (clear before any early return), guard with a useRef so the body runs at most once per session, and ignore markers whose timestamp is more than 10 minutes old, a real post-update relaunch happens within seconds.

Both fixed on main in commit 8241e8fe (fix(ui): correct delete-scan toast label and silence spurious post-update toast), shipping in v4.0.5. Verified green: typecheck, 253 vitest, production build.

[axpnet]

Security (post-release, fixed): guard the OS keyring on disposable vaults + CLI keystore status / keystore repair

#	Area	Description	Status	Linked issue
7	Vault / keyring	first_run_init unconditionally wrote the random vault passphrase to the OS-global keyring account (com.aeroftp.AeroFTP / vault-passphrase), which is not scoped to XDG_CONFIG_HOME. Creating an isolated or disposable vault under a separate config dir therefore overwrote the real vault's keyring entry, leaving the real zero-password vault unopenable (vault.db intact, only the keyring secret clobbered). The keyring is now guarded so disposable / master-mode vaults never touch it, and a new keystore status / keystore repair CLI pair inspects and recovers the keyring secret from a backup.	🟢 fixed (pending release, v4.0.5)	this issue

_{Status legend: 🔴 confirmed · 🟡 investigating · 🟢 fixed (pending release) · ✅ released}

Details & fix (v4.0.5)

The OS keyring entry is keyed only by service/account (com.aeroftp.AeroFTP / vault-passphrase), independent of which config directory the vault lives in. A zero-password ("auto-keyring") vault stores its random passphrase only in that keyring entry, so any second vault that ran a fresh first-run init under a different XDG_CONFIG_HOME (a disposable CLI vault, an isolated test vault) silently overwrote the secret and left the real vault permanently unopenable, even though vault.db was byte-intact.

Guard. init() now bootstraps in master mode (no keyring write) whenever AEROFTP_MASTER_PASSWORD is set on a fresh vault, so disposable / master-mode vaults never touch the OS keyring.

Recovery tooling (CLI).

aeroftp keystore status            # report on-disk key mode + whether the vault opens right now
aeroftp keystore repair --input <backup.aeroftp-keystore>   # snapshot, reset, re-init, import to recover

status is a read-only health probe (CredentialStore::health()) that detects a lost or overwritten keyring entry; repair snapshots the current vault.db / vault.key, resets for a clean first-run, then imports a .aeroftp-keystore backup, and is reversible (the pre-reset snapshot is kept).

Validated cross-device. Verified on a second machine (Linux 0) over the NAS campaign: keyring-guard test 3/3 PASS (disposable master-mode vault leaves the real keyring fingerprint unchanged before/after, real vault still opens), status reports the correct states read-only, repair recovers from a backup and is reversible. Windows accepted.

Fixed on main in commit 5ec47d5a (merge 98dcf3ec, fix(vault): guard OS keyring on disposable vaults + add CLI keystore status/repair), shipping in v4.0.5.

[axpnet]

Fixes (post-release, fixed): first-run migration race + keystore status exit code

#	Area	Description	Status	Linked issue
8	Vault / multi-user	First-run credential migration checked the schema version before opening its transaction, so two processes hitting the same vault at once (GUI + CLI) both passed the check and both tried to insert the default user, and the loser failed with Create default user: UNIQUE constraint failed: users.name_canonical. Pre-existing (affects v4.0.4). The migration now takes the write lock up-front (IMMEDIATE + busy_timeout) and re-checks the schema version inside the transaction, returning already-migrated instead of racing on the insert.	🟢 fixed (pending release, v4.0.5)	this issue
9	CLI / keystore	keystore status returned exit 1 for any master-mode vault, conflating "healthy but locked" (just needs a password) with "broken / unopenable". It now exits 0 (unlockable now), 2 (healthy but locked: master mode, password not supplied), or 1 (genuinely unopenable, e.g. lost/overwritten keyring), and consults AEROFTP_MASTER_PASSWORD when present to verify a real unlock.	🟢 fixed (pending release, v4.0.5)	this issue

_{Status legend: 🔴 confirmed · 🟡 investigating · 🟢 fixed (pending release) · ✅ released}

Details & fix (v4.0.5)

#8, first-run migration race. migrate_legacy_payloads (the per-user partitioning first-run) read the schema version before BEGIN, a check-then-act window: with the GUI and a CLI invocation opening the same vault concurrently, both saw "not yet migrated", both started a transaction, and the loser hit UNIQUE constraint failed: users.name_canonical on the default-user insert. Fix: acquire the write lock up-front via transaction_with_behavior(IMMEDIATE) + a 5s busy_timeout so the two runs serialize, and re-check the schema version inside the transaction: if a concurrent process already completed the migration, return already_migrated instead of inserting. Regression test asserts a second connection on a shared on-disk DB reports already_migrated with exactly one default user.

#9, keystore status exit code. A static health probe cannot open a master-mode vault, so the previous code reported every master vault as unlockable: false and exited 1, indistinguishable from a genuinely broken vault. VaultHealth now carries a needs_password flag; in master mode the probe consults AEROFTP_MASTER_PASSWORD when present and actually verifies it. Exit codes: 0 unlockable now, 2 healthy but locked (supply a password), 1 unopenable (recover the vault). Verified end to end: absent → 1, master-no-password → 2, master-correct-password → 0, master-wrong-password → 2.

Fixed on main in a7d65060 (migration race) and 897bab96 (keystore status exit code), shipping in v4.0.5.

[axpnet]

Feature (post-release, implemented): per-user credential partitioning (MU-VAULT)

#	Area	Description	Status	Linked issue
10	Accounts / vault	Each local AeroFTP user's saved server profiles and their secrets (passwords, OAuth tokens, API keys) now live in that user's own encrypted partition, with optional cryptographic isolation between users for the multi-user setups that want it.	🟢 fixed (pending release, v4.0.5)	-

_{Status legend: 🔴 confirmed · 🟡 investigating · 🟢 fixed (pending release) · ✅ released}

Details (v4.0.5)

Your credentials are always strongly encrypted at rest (AES-256-GCM, with Argon2id wherever a human secret is involved). What you pick is the access gate, and that is a personal choice driven entirely by how you use the app:

• Just you, zero friction (default): no app password at all. Your data is encrypted on disk and unlocked through the OS keyring tied to your login. Ideal for a single-user machine.
• You, several accounts you want to keep separate: create two AeroFTP users. You are the only one opening them, so a master password is enough if you also want to gate access to the app itself.
• A shared, trusted device (family): one user each for your partner, kids, and so on, and by choice no passwords, because there are no secrets between you and the machine is already protected at the OS level. Perfectly fine.
• True separation between users on a shared device: set a per-user account passphrase. That user's partition is sealed with Argon2id(passphrase), independent of the vault key, so nobody else on the device can open it.
• Maximum: master password plus per-user passphrases, and you can even add TOTP 2FA on top of the master password.

The headline: AeroFTP now supports cryptographic isolation between users for the cases that need it (managing accounts for different web agencies, separating client projects, a shared workstation), while the zero-password default stays exactly as protected as it always was. Not setting a password is a normal, valid choice, not a weaker mode: the at-rest encryption is identical either way.

During this release the per-user partitions are populated alongside the existing vault, which stays the source of truth, so the rollout is safe and reversible.

Shipped on main in the e5f612f5 merge, v4.0.5.

[axpnet]

Feature (post-release, implemented): CLI profiles -i refresh command

#	Area	Description	Status	Linked issue
13	CLI / profiles	A refresh command (aliases clear and .) in aeroftp profiles -i clears the screen and reprints the table, re-reading from the vault so a profile changed in another session shows up. Empty-Enter stays inert and r (rename) is unchanged; the original view flags (--sort / --hide / --show / --breakdown) are preserved.	🟢 implemented (pending release, v4.0.5)	#266

_{Status legend: 🔴 confirmed · 🟡 investigating · 🟢 fixed (pending release) · ✅ released}

Details (v4.0.5)

aeroftp profiles -i reprints the option list on a bare Enter but never the table, so there was no quick way to redraw it after a profile changed. The new refresh command (with clear and a single-key . as aliases) clears the screen and re-runs the binary's own profiles view with the original display flags, which re-reads the vault, so a profile edited in another session shows up immediately. Two deliberate calls from the reporter's note: a bare empty Enter still does nothing, because wiping the terminal on an accidental keystroke is intrusive, and r keeps being Rename rather than being repurposed. A unit test covers the view-flag reconstruction.

Implemented on main in 78f7ef09, v4.0.5.

[axpnet]

Docs (post-release, done): rename the Mount Manager to AeroMount

#	Area	Description	Status	Linked issue
14	Naming / docs	The Mount Manager is now named AeroMount as its Aero-family name, in the app (File menu entry and dialog title, all 47 locales) and across the documentation (README "Aero family" section and the docs site). "Mount Manager" stays usable as a descriptor.	🟢 done (pending release, v4.0.5)	#270

_{Status legend: 🔴 confirmed · 🟡 investigating · 🟢 fixed (pending release) · ✅ released}

Details (v4.0.5)

Per the wishlist proposal in #270, AeroMount becomes the Aero-family name for the Mount Manager, matching AeroSync and AeroVault. The in-app File menu entry and the dialog title now read AeroMount across all 47 locales as an untranslated brand name, the README "Aero family" section introduces it ("AeroMount, the Mount Manager of AeroFTP"), and the documentation site follows: the feature page, the sidebar nav label, and the current-state mentions in the CLI, MEGAcmd and encryption pages. "Mount Manager" stays usable as a descriptor, the /features/mount-manager URL is kept so existing links do not break, and historical changelog and roadmap entries that record what shipped under the former name are left untouched on purpose.

Done on main in aee02c74 (app + README) and on the docs site, v4.0.5.

[axpnet]

Fix (post-release, fixed): My Servers search for "web" surfaced an OpenDrive API profile

#	Area	Description	Status	Linked issue
15	My Servers / search	Searching "web" surfaced an OpenDrive API profile that has no "web" in its name or host, because it carried a stale providerId (opendrive-webdav) from a WebDAV to native-API protocol switch, which leaked "webdav" into the search blob. The search now re-derives the provider identity from the current protocol when the stored providerId's protocol is inconsistent.	🟢 fixed (pending release, v4.0.5)	#318

_{Status legend: 🔴 confirmed · 🟡 investigating · 🟢 fixed (pending release) · ✅ released}

Details & fix (v4.0.5)

Searching "web" in My Servers surfaced an OpenDrive API profile whose name and host contain no "web". The profile was carrying a stale providerId of opendrive-webdav, left behind from when it was a WebDAV profile (the only OpenDrive preset in the registry is the WebDAV one). The My Servers search builds its text from the profile fields plus the provider identity, so the slug opendrive-webdav and its display name "OpenDrive (WebDAV)" leaked "webdav" into the blob and matched "web". Koofr was unaffected because its identity is just "Koofr". Fix: when a profile's stored providerId resolves to a provider whose protocol no longer matches the profile's protocol, the search treats it as stale and re-derives the identity from the current protocol, so "web" no longer matches an API profile. Genuine WebDAV profiles keep their protocol-consistent identity and still match "web" as before. Typecheck and the 253-test unit suite are green.

Fixed on main in 69c65a04, v4.0.5.

[axpnet]

Fix (post-release, fixed): consistent "Rclone Crypt" overlay naming (reserves "AeroCrypt")

#	Area	Description	Status	Linked issue
16	Naming / crypto overlay	The encrypted overlay that mounts a cloud drive in the dual panel implements the public rclone crypt format, but the UI named it inconsistently: the context menu and unlock dialog already said "Rclone Crypt" while the toolbar button, path-bar badge and toasts said "AeroCrypt". It is now "Rclone Crypt" everywhere, which reserves "AeroCrypt" for AeroFTP's own future encryption overlay.	🟢 fixed (pending release, v4.0.5)	#272

_{Status legend: 🔴 confirmed · 🟡 investigating · 🟢 fixed (pending release) · ✅ released}

Details & fix (v4.0.5)

The overlay uses the public rclone crypt format (unlock with the same password you would use in rclone), so calling it "AeroCrypt" on some surfaces while the context menu and the unlock component already called it "Rclone Crypt" was confusing. Following the naming proposal in discussion #272 ("embrace the standard, then improve"), the toolbar button title and aria-label, the path-bar badge, the success and error toasts, and the four affected display strings (aerocrypt.title, aerocrypt.intro.p2/p3, toolbar.aerocryptOverlayActive) across all 47 locales now read "Rclone Crypt". The name "AeroCrypt" is freed for AeroFTP's own future encryption overlay (nonce-misuse resistance, Argon2id, BLAKE3, AES-256, ChaCha20). Internal i18n keys (aerocrypt.*) are left unchanged, and the AeroVault references in the help text are intact. Typecheck, i18n validation and the unit suite are green.

Fixed on main in e16209f3, v4.0.5.

[axpnet]

Update: many-small-files benchmark axis (#17, a3af0794)

Landed on main for 4.0.5. This comes straight out of discussion #277, where @EhudKirsh pointed out that the place S3 shines over WebDAV and FTP is many small files — where per-file overhead (connection handshake, request signing, metadata round-trips) dominates rather than raw bandwidth. The benchmark didn't measure that. Now it does.

It's a separate axis of the existing benchmark command, triggered by --file-count:

aeroftp-cli benchmark --profile "<server>" --file-count 1000 --file-size 64K

Five dedicated ops — upload-all, list-dir, stat-all, download-all, delete-all — each reporting files/sec and a per-file latency distribution (p50 = mean per-file time) alongside the raw Mbps for the transfer ops. The single-file size sweep is untouched and the two axes are never averaged together; mixing "100 small files" with "one big file" would hide exactly the effect being measured.

Report stays schema v1: the two new fields (file_count, files_per_second) are additive and absent on single-file rows, so existing consumers keep working. The aggregate payload (file-count x file-size) is capped at 5 GiB; per-file content is randomized so content-dedup backends can't fake a high files/sec.

Validated live on saved profiles across SFTP, S3 (Backblaze B2, Storj) and WebDAV (Koofr) — the per-file gap shows cleanly on the metadata ops (e.g. stat-all ~21-22 files/s on S3 vs ~10 on WebDAV). Docs in COMMUNITY-BENCHMARK.md and the CLI guide. GUI Speed Test wiring is the next step, once the report shape is confirmed in #277.

[axpnet]

Update: custom icon picker on every Quick Connect page (#18, 6c8d9fe3)

Landed on main for 4.0.5, from discussion #270 (@EhudKirsh). The custom-icon picker used to be hidden whenever a provider shipped a built-in logo, so preconfigured providers (Filen, OneDrive, Google Drive, ...) could not be given a custom icon at all. Now:

• The picker shows on every Quick Connect page. The preview renders the preset logo as the current icon; clearing a custom icon reverts to it.
• For preconfigured providers the picker is restricted to the custom-icons library only (the "Shipped" catalog of other providers' logos is hidden) — Filen never needs OneDrive's icon and vice versa. Generic FTP/SFTP/WebDAV/S3 keep the full library.
• Because a preset's logo is rendered on many surfaces, a custom override has to win on all of them. The one surface that still rendered the preset logo directly — the AeroFile endpoint dropdown (PanelEndpointSelector) — now routes through the shared getServerIcon resolver (custom > favicon > preset > letter), the same chain SavedServers / ServerCard / SessionTabs / MountManager already use. No new i18n keys.

Typecheck clean, i18n 46/46. Ehud co-authored.

[axpnet]

Update: group saved connection profiles (#19, d8ed076e)

Landed on main for 4.0.5, from discussion #320 (@timint), a FlashFXP-style Site Manager grouping request.

AeroFTP already kept saved-server favourites (the star) as a per-user list in the encrypted vault, surfaced as a filter chip. A group is the named generalisation of that: a named favourites list. So this ships with no change to the profile format and no migration, and the whole credential/vault layer is untouched (the group membership lives in its own vault entry, config_server_groups, not on the profile).

What you get on the My Servers screen:

• New group button next to the filter chips, like FlashFXP's New Group.
• Each group is its own filter chip with a live member count; selecting it shows only that group's servers and is mutually exclusive with the protocol/favourites chips.
• Add to group in a server's right-click menu: a submenu that toggles membership per group, plus New group... to create one seeded with that server.
• Right-click a group chip to rename or delete it. Deleting a group keeps the servers, it only removes the grouping.
• Membership is stored per user and carries across a profile convert or duplicate (same path the favourite star already uses).

Scope of this first cut: flat groups (one level), single group selection in the UI. The storage model already allows multi-membership and leaves room for nested sub-folders if there is demand.

Gates: typecheck clean, 259 unit tests (including new coverage for the group store), i18n 47/47 with zero pending translations. No Rust changes.

[axpnet]

🟢 Update: provider-group connection polish (#20, #21, #22, from #215)

Three follow-ups to #215 landed on main for 4.0.5, all from @EhudKirsh's latest notes there.

#20, account links across mode tabs (9dc727bf). The green Create Account and amber Generate Password links were tied to the active tab's own registry preset, so the preset-less native tabs lost them: Koofr API showed neither and OpenDrive API never showed Create Account. They now resolve group-wide, and because every surface in a group reaches the same account the same signup and app-password pages are correct for all tabs, so the links stay visible and identical when you switch tabs. Label casing is aligned too, "Generate password" becomes "Generate Password" to match "Create Account".

#21, per-tab credential retention (96e502ab). Switching a saved profile between the modes of a group (Filen API, Local WebDAV, Local S3, also Koofr and OpenDrive) used to carry only username and password and reset the rest, wiping the API key and 2FA/TOTP secret the moment you left the Native API tab. Each tab's own credentials, including the options-level secrets, are now stashed in memory for the edit session and restored on return. A first visit keeps the original carry-over, and the stash is cleared when a different profile starts editing so nothing leaks across profiles. No on-disk change.

#22, MEGAcmd WebDAV endpoint auto-fetch (44c8fdaf). A Fetch URL button next to the Endpoint field runs mega-webdav / for you, the same idempotent call already used for the quota stats, and fills the address. Setup step 4 drops from "Run: webdav /" to one click. If MEGAcmd has no active session the button shows the exact mega-login hint inline.

Gates green: typecheck, clippy (lib plus CLI, with tests), Rust unit tests (20/20 on the MEGAcmd module, 4 new), i18n 46/46. Ehud co-authored.

[axpnet]

🟢 Update: Quick Connect docs links and CLI tree depth (#23, #24, #25, from #270)

Three more from @EhudKirsh's wishlist landed on main for 4.0.5.

#23, OneDrive Get credentials URL (f5759bbd). The link now opens the Azure App Registrations list blade (#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade), which lands straight on the page where the OneDrive Client ID and Secret are created. The old #blade/ deep link had stopped resolving reliably.

#24, Docs link on every Quick Connect page (d5e82716). Both the standard form and the OAuth form now carry a Docs link to docs.aeroftp.app. The slug is not always the in-app id, so a small resolver maps the differences (googledrive to google-drive, s3 to aws-s3, fourshared to 4shared, and so on); anything unmapped falls back to the provider's own help URL, then the providers index, so the link always works.

#25, CLI tree depth (629c5ab0). tree used to end with "X directories, Y files" with no hint of how deep it went. It now prints a 0-based layer ruler ("0 | 1 | 2") above "X directories and Y files in a depth of Z layers", where Z is the deepest layer actually reached, so a shallow tree reports less than the requested cap. The --json summary gains an additive layers field.

Gates green: typecheck, clippy (CLI bin, with tests), fmt, i18n 46/46. Ehud co-authored.

[axpnet]

🟢 Queued for 4.0.5, rows 26-29 (all #215 / #270 follow-ups):

26: Filen Desktop bridges fall back to admin when the credential fields are left empty, placeholders kept (the best-of-both-worlds Ehud asked for).
27: opt-in persistence of a profile's credentials for every protocol of one account, encrypted per-user, the MEGA/pCloud multi-tab request rides on this.
28: one MEGA Quick Connect page (API, WebDAV MEGAcmd, S4) with AeroFTP running mega-webdav / itself on connect, no manual step.
29: a legend on the tree layer ruler so 0-based depth reads unambiguously.

The Quick Connect two-column layout split stays open, waiting on Ehud's sketch.

[axpnet]

🟢 Update: four more from @EhudKirsh's wishlist (#30, #31, #32, #33, from #270)

Four follow-ups from discussion #270 (@EhudKirsh) landed on main for 4.0.5.

#	Area	Description	Status	Commit
30	UI / theming	The Open as Cryptomator Vault window (and its sibling Archive browser) used hardcoded dark Tailwind colours with no dark: variants, so on the Light theme the title, the Vault Password field and the close button were almost invisible. Both now follow the selected theme like the AeroVault window.	🟢 fixed (pending release, v4.0.5)	6cfefaba
31	UI / AeroFile	The AeroFile status-bar button is now a true open/close toggle. When not connected, a second click ran toggleSidebar() (the Places behaviour) instead of closing AeroFile; it now returns to the connection picker, so the button opens and closes AeroFile as expected.	🟢 fixed (pending release, v4.0.5)	5c32f8b2
32	4shared / OAuth	The 4shared OAuth Get credentials link now opens reliably. It called invoke('open_url'), a command that is not registered, inside a synchronous try/catch that never catches the promise rejection, so the link never opened. It now uses the shared openUrl helper, pointed at the App Registrations page that actually carries the create-app form (developer/docs/app/).	🟢 fixed (pending release, v4.0.5)	ba5bd340
33	Favourites / GUI + CLI	Optional heart marker for favourite servers. A Settings → Appearance toggle swaps the ★ for a red ♥ in the My Servers cards and table and in the aeroftp-cli profiles table, help, confirmation and TUI navigator.	🟢 implemented (pending release, v4.0.5)	25936eb8

_{Status legend: 🔴 confirmed · 🟡 investigating · 🟢 fixed (pending release) · ✅ released}

Details

#30, Cryptomator / Archive windows (6cfefaba). The two modal windows shipped only dark greys (bg-gray-800, the bg-gray-900 password field, text-gray-400 labels) with no light counterpart, so switching the app to Light left them dark and hard to read. Every surface now carries a bg-white dark:bg-gray-800-style pair and tracks the theme, matching AeroVault.

#31, AeroFile toggle (5c32f8b2). handleToggleAeroFile's not-connected branch called toggleSidebar(), which toggles the Places sidebar rather than AeroFile itself. It now setShowConnectionScreen(true), so the button is a real open/close toggle in every state (when connected it already toggled the remote panel back).

#32, 4shared Get credentials (ba5bd340). The docs/app/ URL was already the right page (the one with the create-app form); the bug was the open mechanism. The button is the only place that used invoke('open_url') (not a registered command) with a synchronous catch that cannot intercept a promise rejection, so the fallback never fired and nothing opened. Now it uses the shared openUrl helper, and the Settings → Providers 4shared link is aligned to the same page.

#33, heart marker (25936eb8). A global favoriteMarker ('star' | 'heart') preference lives in the shared app_settings vault key, so the CLI reads the same value the GUI writes (via a new load_favorite_marker() helper) with no separate config. A new useFavoriteMarker hook mirrors useCardLayout; the GUI renders a red filled heart in the My Servers cards and table, and the CLI shows ♥ in the profiles table, the f help line, the favourite confirmation and the raw-mode TUI. New strings translated across all 46 locales.

Gates green: typecheck, cargo check + cargo fmt --check (CLI bin), vitest, i18n 46/46. Ehud co-authored each commit.

[axpnet]

🟢 Update: the three headline features for 4.0.5 (#34, #35, #36)

The big-ticket items now queued for 4.0.5, kept short here with links to the design discussions for the full story.

#	Area	Description	Status	Commit
34	AeroVault / EC	AeroVault v3 + Error Correction graduate from Beta to stable. A Reed-Solomon erasure-coded, self-healing .aerocorrect sidecar protects vault containers and AeroSync transfers against bit-rot, with a standalone CLI correct group and MCP tools; the Beta/stub labels are gone. Full design and stress validation in discussion #276.	🟢 done (pending release, v4.0.5)	b5db4b214, 6713b9581, 4eb31feaf
35	AeroCrypt / overlay	AeroCrypt native encrypted overlay, now first-class in the dual panel, with per-profile AeroCrypt Profiles. Encryption you own on top of any protocol or provider, browsed exactly like a normal server, so any cloud becomes a zero-knowledge target and a natively encrypted one gets a second independent layer. rclone crypt stays beside it as the interop lane, both opt-in with no default cipher. The format is hardened to AECR v3 (length binding + key-bound config MAC). Detail and the pre-release audit in discussion #276.	🟢 done (pending release, v4.0.5)	83e9769aa, 4e577e253, a839d3feb
36	CLI / TUI	Interactive CLI TUI, rev 1.0.3-alpha. A full-screen dual-pane file manager (aeroftp tui) with a My Servers IntroHub, a command palette and file-manager table stakes, plus the inline profiles -i action menu. A discreet alpha preview that rides along with 4.0.5. Detail in discussion #311.	🟢 done (pending release, v4.0.5)	a3ee5747f, 91427fa15, e0984f8f3

[axpnet]

🟢 Update: archives, SSH and Windows (#37 to #42)

The rest of what landed on main for 4.0.5 beyond the three headline features above.

#	Area	Description	Status	Commit
37	Archives	ZIP store-if-larger. A ZIP entry is stored, not deflated, when deflate would not shrink it, so packing already-compressed or incompressible data never inflates it (CLI + GUI).	🟢 done (pending release, v4.0.5)	3a3fcf78c
38	CLI / archives	compress / extract subcommands for every archive format (zip, 7z, tar, tar.gz/xz/bz2; rar extract) with format, level, password and subfolder options.	🟢 done (pending release, v4.0.5)	3dd574e93
39	Security / SSH	russh 0.60.3 to 0.61.2, clearing the deferred SSH advisories.	🟢 done (pending release, v4.0.5)	4bfd2d070
40	Windows	Native aftp short command name and alias-toggle on Windows, matching the Unix surface (#273).	🟢 done (pending release, v4.0.5)	5d99dddc3
41	CLI / archives	Archive correctness. Ignore an ambient AEROFTP_ARCHIVE_PASSWORD for non-encrypted formats; tar archives report output_bytes via the real path.	🟢 done (pending release, v4.0.5)	243cf30ec, 9151e961a
42	Fix / Cryptomator	Cryptomator vault unlock restored. A jsonwebtoken feature-flag change had broken unlock; restored, with the vault root prefilled.	🟢 done (pending release, v4.0.5)	6defb0190

[axpnet]

🟢 Latest on main for 4.0.5 (rows 43 to 46).
AeroCrypt overlay: the activity-log listing line now shows the overlay-anchored path, and connecting an overlay profile no longer flashes the raw encrypted names or the "/" path during unlock (scrambling decrypting placeholders play until the real names land, with a fallback to the raw view if the unlock fails).
CLI profiles TUI (#311): entering the selector focuses Quit by default so a stray Enter exits instead of re-indexing, and the actions follow the table column order, per @EhudKirsh.
My Servers: the filter chips that wrapped once protocol filters and user groups grew are replaced by a collapsible sidebar (search plus Quick, Protocols and Groups) with a persisted left/right toggle.

[axpnet]

🟢 Replies posted for this batch (announced with the upcoming 4.0.5 release).
#270 AeroFile breadcrumb sibling dropdown, fixed: #270 (reply in thread)
#322 Cryptomator decrypt in AeroFile: #322 (comment)
#332 Immich sync cancel: #332 (comment)
#333 Unsecuring (remove master password): #333 (comment)
#334 Windows Portable profiles: #334 (comment)

[axpnet]

✅ Released as v4.0.5.

Every item in the table above shipped in v4.0.5, now published on all channels. The two pillars are the native AeroCrypt encrypted overlay (with the AECR v3 pre-release hardening) and AeroVault v4 error correction, alongside the interactive CLI, server groups, file versioning, the Quick Connect improvements, the AeroFile and modal UX polish, and the Windows and cross-platform fixes from @rockaut and @EhudKirsh.

Per the tracker convention, 4.0.x patches accumulated here; the next major line gets its own tracker. Known issues found in 4.0.5 will be logged in the section below as reports come in.

Thanks to everyone who reported, tested and suggested.