[Tracker] AeroFTP 4.1.0 - Known issues, patches & updates

[axpnet]

AeroFTP 4.1.x, Rolling Tracker

Umbrella issue for AeroFTP 4.1.x: known issues for the current release (v4.0.9, release notes, published 2026-06-24) and the patches/updates landing on main for the next release (v4.1.0).

Before opening a new issue, please check the lists below. If your problem is already tracked here, just add a thumbs-up reaction or a comment with your environment (OS, version, provider) instead of filing a duplicate. We update this issue as bugs are found and fixed.

Found something that is not listed? Open a new issue and we will link it here.

What shipped in 4.0.9

See the v4.0.9 release notes and the previous tracker (#349).

Patches & updates queued for 4.1.0

Done on main, shipping in the next release. Items appear here as they land.

#	Type	Change	Status	Commit	Ref
1		Align splash, metainfo and the npm lockfile to 4.0.9 (the release left them at 4.0.8); this is also the user-visible welcome / splash popup that read "v4.0.8" on first launch under v4.0.9 (#367)	🟢 done	25410382	post, #367
2		In-range dependency refresh (uuid, totp-rs, webpki-roots #357); held aes-gcm rc.4 (#356, Windows), aws-lc and the tauri facade	🟢 done	2b1dd825	post
3		Run tray-less when libappindicator / ayatana-appindicator3 is missing instead of panicking at launch (Fedora Silverblue and other minimal or immutable distros)	🟢 done	515abb03	post
4		AeroAgent coding loop (foundation): a curated GUI tool set for local coding work, safe patch with automatic checkpoints, ripgrep search, structured cargo/tsc/eslint diagnostics, git read plus stage and commit, run-checks and verify, review cards; GUI-only and read-only or approval-gated, no change to transfer or file management	🟢 done	cf7ae349	post
5		Per-user server groups + favourites (CLI + GUI): groups and favourites used to live in a single global vault blob shared across every local user (they predated the multi-user partitions); they now route through each user's encrypted partition, with a best-effort one-time seed from the legacy blob so existing groups/favourites carry over	🟢 done	4afc1d97, 492b0f85	#311
6		groups -i / users -i polish (#311): labelled action bar plus Help (H/?), a Refresh (.) that clears the screen (#341), compact one-token selectors (l1/1l/d2, f for users), a header rule, count columns (Profiles, and Groups for users), and arrow + strikethrough summaries on re-index/delete so a move shows the struck old index and green new index and a delete leaves a struck tombstone, matching profiles -i	🟢 done	75c069bd, 3aec8910, 79617cc6	#311, #341
7		Windows hotplug detection in the AeroFile PLACES sidebar is slow: a freshly inserted drive can take up to ~30s to appear, because the real-time volume watcher is Linux-only (inotify) and Windows/macOS fall back to a 30s poll. A Rust-side WM_DEVICECHANGE listener emitting volumes-changed on device arrival/removal would make it instant; lighter mitigations are a refetch on window focus or a shorter poll interval. Surfaced during the #351 eject verification on real Windows hardware	🔵 idea	#351 (@EhudKirsh)
8		MTP / portable-device provider for AeroFile: surface attached MTP/WPD devices that have no drive letter (phones, cameras; the reporter's Sony Xperia is one) in PLACES, browse the object tree as a virtual path, and copy whole files to and from the device. A design appendix is written (design only, no implementation): it documents the protocol and its hard MTP/OS limits (no real mount, no random access, no delta or resume, whole-file transfers only, best-effort metadata) so they are never read as an AeroFTP shortcoming, and maps the capability onto the existing StorageProvider trait, recommending a hybrid model. Implementation is a later, separate effort	🔵 idea	#351 (@EhudKirsh)
7		aero benchmark --tui profile picker no longer flickers or shakes on scroll: the "Pick profiles to compare" view repaints in place (overwriting changed lines) instead of clearing the whole screen every frame, so the title stays put	🟢 done	4e675d63	#277
8		Filen Quick Connect: the green Save now persists an API-key deletion (it removes the key from the vault, the way "Convert to Native API" already did, so reopening no longer shows it) and cancels the bottom-right 2FA auto-login countdown so it cannot fire a stale TOTP reconnect after you save	🟢 done	de830e8d	#128, #215
9		Security hardening of the P2P / AeroShare stack: migrated the iroh family from 0.92 to 1.0 (iroh 1.0, iroh-blobs 0.103, iroh-docs 0.101, iroh-gossip 0.101), clearing the 6 Dependabot alerts the old line pinned (hickory-proto x4 plus lru x2) via hickory-proto 0.26.1 and lru 0.18.0; decentralized Mainline-DHT discovery preserved by re-wiring onto iroh 1.0's address-lookup API and the new iroh-mainline-address-lookup crate. Live 2-machine validation still owed before the release tag	🟢 done	0512071a, 41fd4397, 13368e21	post
10		-i action bar reordered safe-first (#311): the profiles/groups/users interactive action bars now lead with the read-only verbs and Help(H), with re-index(#) moved out of the front and the destructive Delete(D) last before Quit; the key letters are unchanged, so no automation breaks	🟢 done	330a3201	#311 (@EhudKirsh)
11		groups -i add/remove members (#311): new a <group> <profile...> and x <group> <profile...> verbs curate a group's membership from inside groups -i (the counterpart to profiles -i's g toggle), idempotent and multi-target. The reverse users -i direction (groups to/from a user) is still under design	🟢 done	3da0f1ed	#311 (@EhudKirsh)
12		Interactive New(N) verb (#311): create a profile, group or user from inside the -i loop (rclone n) New remote model) instead of dropping out to a separate add command. groups -i n [name] makes an empty group, users -i n [name] a new local user, and profiles -i n [query] runs a service-first catalog picker (substring-match aero catalog, numbered pick, name defaulting to the company, protocol-aware fields for the self-hosted protocols, credentials added later in the GUI Edit modal). Complete across all three loops	🟢 done	21d08c5a, 46d543b7	#311 (@EhudKirsh)
13		Provider offline-test coverage (Phase A) (#347): a deterministic, no-network regression net for the unit-only storage providers. First batch covers the already-pure seams: the Azure Blob XML listing parser (virtual directory vs file, size and Last-Modified, nested-blob filtering, current-prefix stripping, pagination marker, garbage tolerance), the Immich status-to-error mapping (the whole 5xx range, the context plus body message contract, the rate-limit label), and the shared API-error sanitizer (over-long truncation, secret redaction, empty fallback). Tests-only, no production change; 7 new unit tests. Phase B (the remaining providers, each needs a behaviour-preserving pure classify seam extracted first) is queued per-batch	🟢 done	8cfd49bc	#347
14		Provider offline-test coverage (Phase B, Group A) (#347): continues row 13 by lifting the status-to-error mapping out of the async error handlers of Koofr, Yandex Disk, Cloudinary and Uploadcare into a pure classify_<provider>_error(status, body) function, with each parse_error now a thin wrapper of identical behaviour (the StatusCode Display form is reconstructed from the status so the surfaced messages are byte-for-byte unchanged), then matrix-testing each one: body-level error codes, the HTTP-status fallback, field precedence and the sanitized-body fallback. Behaviour-preserving, 9 new unit tests. Group B (Swift, Zoho, Internxt, Drime, kDrive, Jottacloud, 4shared, GitLab, Filen) is queued per-batch	🟢 done	8ad082fc, 63a8229a, 50042907, ff8b8910	#347
15		Restore the Checks CI workflow to green: its first step is cargo fmt --all --check, which recent CLI-i commits and the Phase A test had drifted from, red-walling every push to main; a one-shot cargo fmt --all reformats the affected files (no logic change) so the fmt gate, and the vitest plus cargo-audit steps queued behind it, pass again	🟢 done	387fbced	-
16		Provider offline-test coverage (Phase B, Group B start) (#347): the inline-mapping providers, where the status logic was buried in an async method rather than a separable parse_error. GitLab: the execute status match becomes a pure classify_gitlab_error (401/403/404/429 plus the 5xx catch-all that is_server_error keys its retry on), with 429 still short-circuiting before reading the body. Filen: it has no single seam (HTTP errors go through the already-pure format_filen_error, logical errors through the per-call {status,message} envelope), so the one centralizable piece, the transient-retry class in download_filen_chunk, becomes a pure filen_status_is_retryable. Behaviour-preserving, 4 new unit tests. Remaining Group B (Swift, Zoho, Internxt, Drime, kDrive, Jottacloud, 4shared) queued per-batch	🟢 done	c841ee1d, 176ff58f	#347
17		Sigstore update verification now actually verifies (auto-updater): the in-app signature check had been stuck on its amber "verification unavailable" fallback since v3.3.2 because the old sigstore 0.13 crate could not parse GitHub's v0.3 signing bundles ("unknown bundle profile"); the bump to sigstore 0.14 adds v0.3 parsing, so it now returns a green SigstoreVerified on real releases (validated offline against the actual v4.0.9 .deb bundle). The fallback is unchanged and stays non-blocking: the artifact SHA-256 remains the primary integrity check and any sigstore error still degrades to amber, so an install never blocks; the true end-to-end is exercised on the 4.1.0 to 4.1.1 updater path. Only the verify feature is enabled (the sign path does not compile against the post-iroh-1.0 crypto graph and we never sign). Bonus: drops 3 now-moot cargo-audit ignores (sigstore 0.14 pulls tough 0.22, fixing both GHSA tough advisories; proc-macro-error2 left the graph)	🟢 done	42b12641	#358
18		Bridge setup box no longer flashes open then collapses: switching to a Filen Desktop / MEGAcmd bridge tab made the "Setup ... first" box flash open during the "Checking..." probe and then collapse once it settled to green. The box now knows synchronously whether the active mode is a bridge and starts collapsed for a bridge, expanding only on a settled non-green state, so it never flashes. Recovered from an orphaned fix branch that never landed and re-applied to main	🟢 done	1a5a913e	#215 (@EhudKirsh)
19		Bump softprops/action-gh-release 3.0.0 to 3.0.1 (Dependabot #353): a release-time-only GitHub Action, kept SHA-pinned (all 4 usages in build.yml move to 718ea10b..., verified as the dereferenced commit of the upstream v3.0.1 tag). Sibling Dependabot #356 (aes-gcm rc.4) was closed/held, a stale transitive RC bump that would have regressed sigstore back to 0.13	🟢 done	47d5cc1c	#353
20		Welcome / splash popup version is now dynamic (#367): the splash carried a hardcoded version string that the 4.0.9 release bump missed, so it read "v4.0.8" on launch under v4.0.9. Rather than just re-syncing the constant (which would drift again next release), the splash window now injects the real running crate version (env!("CARGO_PKG_VERSION"), the single source of truth bumped on every release) via an initialization script the page reads before paint, with the static text kept only as an out-of-app fallback. No IPC, no build step; the label can never drift from the published version again	🟢 done	4feb65c8	#367 (@EhudKirsh)
21		Copy/Move a server profile to another user, data loss fixed (#366): the cross-user de-dup skipped the write into the destination on a match while still deleting the source on a Move, so moving a profile whose equivalent already existed in the target destroyed the only copy. A Move now always materialises the profile in the destination first and removes the source only after; Copy still de-dups (no silent duplicate). The account picker also rendered a custom image avatar as a raw base64 string that overflowed the avatar circle; it now reuses the shared UserAvatar (image or clipped initial). The overflowing string was the avatar image, never a credential	🟢 done	d1a469fc8	post, #366 (@EhudKirsh)
22		Transfer Queue per-item bar stuck at 0% on Crypt overlays fixed (#364): a Crypt overlay upload encrypts locally, stages the ciphertext, then uploads it, and those crypt paths emitted none of the per-item transfer_events the Transfer Queue listens to, so the per-item bar never moved. Both overlays (rclone-crypt and native AeroCrypt) now emit live start/progress/complete: folder uploads drive the running file-count badge N/total and single-file uploads thread a byte-progress callback so the bar and percentage advance during the upload	🟢 done	5ca990fb1	post, #364 (@EhudKirsh)
23		CLI aero benchmark real defects fixed (#368): the shared aeroftp-bench scratch base is now removed after a run (guarded: only when this run created it and left it empty, so a pre-existing base, a concurrent run or a --test-root-prefix is never touched), the scratch tree is built with mkdir-parents so WebDAV servers that refuse nested collections (pCloud WebDAV) work, both the per-profile header and the comparison tables gained a protocol column, a best-effort public-IP snapshot flags a run as not comparable if the IP changed mid-sweep, and a multi-profile run shows [k/N] per profile plus per-operation run k/N lines; plus a Yandex region hint on Yandex endpoint errors and the report form Connection-type clarified as downstream Mbps	🟢 done	bfb6c52b2	post, #368 (@EhudKirsh)
24		OS "Extract here / to folder" for archives and vaults (Deliverable G): a right-click "AeroFile" submenu in the file manager (Nautilus first) with "Extract here" and "Extract to folder" for zip/7z/tar*/rar and the aero* containers, mirroring the standard GNOME extract pair exactly. "Extract here" makes a folder named after the archive in place (never loose files: stem, stem (2)...); "Extract to folder" picks a destination then does the same inside it. A clear archive extracts headlessly via the CLI; an encrypted one or a vault opens a dedicated minimal password window that never boots the main app (a 5 KB webview, no vault unlock or sync), with a draggable AeroFile titlebar and labels in the desktop language. Verbs only, the double-click Open of the general formats is untouched. Validated live on GNOME Nautilus 46	🟢 done	dfbe42b6c, 92cbbd256	post
25		Windows USB eject now works (#351): the AeroFile PLACES eject control did nothing on Windows because eject_volume had no Windows implementation and the frontend swallowed the error. It now performs a real safe removal via the Shell.Application "Eject" verb (the tray "Safely Remove" action); since that verb is fire-and-forget, the call keeps the COM object alive and polls until the drive disappears (10s deadline) so a real failure surfaces instead of a silent false success. The misleading power glyph becomes a standard eject symbol; after a successful eject the no-media removable slot is dropped so no "Removable Disk (X:) 0 B" ghost row lingers in PLACES; and an eject failure now always raises a visible toast ("the drive is still in use") even when ambient toast notifications are off, since a clicked action must never fail silently. Six Linux-only vault_mount helpers were cfg-gated to clear non-Linux build warnings found along the way. Validated on a real Windows 11 USB pendrive: the drive ejects (native "safe to remove"), its PLACES row vanishes cleanly, a removable-with-media and C: stay untouched (no regression), and the red failure toast renders; sidebar.ejectFailed translated in 47 locales	🟢 done	bb3b488c, 484ac1c1, fca2e93a, cde3c80f, 0926ccbe, 703e0832	post, #351 (@EhudKirsh)
26		OS "Extract here / to folder" verbs on Windows (Deliverable G): extends row 24 to the Windows shell. The NSIS installer registers per-extension right-click verbs "Extract Here with AeroFTP" and "Extract to Folder with AeroFTP..." that invoke the same GUI extract intent (AeroFTP.exe --extract-here / --extract-to "%1"): the dedicated minimal window computes the never-clobber stem subfolder, prompts for a password on encrypted archives and vaults, and shows the native destination picker, never booting the main app. General formats (zip/7z/rar/tar/tgz/gz/xz/bz2) attach via SystemFileAssociations so the verb is additive and the double-click Open is untouched (decision c); the aero* ProgIDs gain the verbs next to their Open. Live Windows file-manager validation still owed before the release tag	🟢 done	2aaf37696	post
27		Filen Desktop bridges work outside the GUI + OpenDrive API host self-heals (#368): the Filen Desktop local bridges (filen-desktop-webdav, filen-desktop-s3) authenticate to a loopback server defaulting to admin/admin, but that blank-to-admin/admin fallback lived only in the GUI connect path, so the CLI, benchmark, MCP and schedulers sent empty credentials and got "Invalid credentials" (WebDAV) / "signature does not match" (S3). A shared apply_local_bridge_credential_defaults in the anti-drift profile_loader now applies the same fallback on both headless paths (one helper fixes both transports). Separately, an OpenDrive profile switched from the WebDAV preset into native API mode could keep webdav.opendrive.com and hit the WebDAV HTML auth page; the host is now normalized to dev.opendrive.com in the backend (self-heals saved profiles) and reset in the preset-less mode switch. 9 new unit tests. Fix A validated e2e on Windows (both Filen bridge presets PASS with blank creds, a custom-webdav negative control to the same bridge FAILS, isolating the providerId); Fix B unit-test covered	🟢 done	840222548	post, #368 (@EhudKirsh)
28		AeroShare is now always-on at launch (still Beta): every AeroShare surface used to be hidden behind the off-by-default aeroShareEnabled Settings flag, so the feature was undiscoverable. The Discover tile (E2E 256-bit badge), the titlebar +friend button (moved to the right of the theme toggle) and the handshake dialog are now always visible; adding a friend or sharing a folder auto-activates the feature (idempotent ensureAeroShareActivated) and lights up the richer surfaces (peer filter, friend cards, notification bell). The standing receiver is never auto-started: a one-time prompt lets you opt in or out of receiving, recorded so it shows once, both changeable from Settings. i18n 47/47	🟢 done	dfcd55cb	post
29		Windows local-STT build fix (#344): the Windows image links the static MSVC runtime (+crt-static), but whisper-rs-sys builds whisper.cpp/ggml via CMake which defaults to the dynamic runtime (/MD), so the ggml objects linked /MD against the rest of the image /MT and failed with LNK2038 (RuntimeLibrary mismatch), LNK2005 and LNK1120 (unresolved __imp_* thunks) at the gui-lib link stage. Two MSVC-only CMake env vars in .cargo/config.toml force whisper.cpp to the static release runtime (CMAKE_MSVC_RUNTIME_LIBRARY=MultiThreaded plus CMAKE_POLICY_DEFAULT_CMP0091=NEW, needed because whisper.cpp pins cmake 3.5 where the policy defaults OLD), no crate fork. Inert on Linux/macOS; +crt-static and the default local-stt feature kept	🟢 done	0cb0f1b1	post, #344
30		.aeroftp-script registered as the 5th file format + a generic archive icon: the README advertised five AeroFTP file formats but only four were OS-registered, so .aeroftp-script (it has an icon asset and sync_script.rs support) fell back to the blank-document icon. It is now registered on all OSes (tauri.conf fileAssociations, NSIS AeroFTP.Script ProgID plus MIME entry and uninstall cleanup, deb-postinst xdg-mime plus hicolor PNGs and SVG), matching the other four. A shared archive-family icon (amber box badge, distinct from the dark-red .aerozip and green .aerovault) was also added for the supported compressed formats (zip/7z/tar*/rar) as SVG, hicolor PNG, .ico and a draft .icns	🟢 done	52de7b04, bb45b024	post
31		MSI shell-integration parity with NSIS (WiX fragment): a new installer/associations.wxs (wired via bundle.windows.wix.fragmentPaths plus componentGroupRefs) brings the MSI installer to parity with hooks.nsh: the Extract Here / Extract to Folder verbs on the 8 general archive formats and the 2 aero archive ProgIDs, the 5 aero mimetype DefaultIcons, and the generic aeroftp.exe DefaultIcon fallback. All HKMU (perMachine resolves to HKLM), additive verbs only with no default-handler hijack (decision c); hooks.nsh gains the matching DefaultIcon fallback for NSIS/MSI lockstep. Verified WiX ICE-clean, MSI Registry 87 rows, live elevated install/uninstall with the .zip default unchanged	🟢 done	c33e0570	post
32		AeroShare always-on follow-up: draggable hub + status-bar receiver indicator: the AeroShare hub dialog is now draggable by its header (shared useDraggableModal, clamped in-window, buttons/inputs excluded) instead of a fixed centered modal; and a status-bar pill next to AeroCloud surfaces the standing receive loop at a glance (emerald + dot when on, neutral when off) and toggles it on click, patching the aeroShareReceiving setting the hub already acts on. The pill reframes Ehud's "put AeroShare next to AeroCloud" as a status indicator, not a fourth launcher (the +friend button, My Servers bar and Discover tile already open the hub), and only shows once AeroShare is activated	🟢 done	3fc5ebc5, 1a8da046	post, #284 (@EhudKirsh)
33		Provider offline-test coverage (Phase B, Group B complete) (#347): finishes the row-4 request by covering the remaining inline-mapping providers, behaviour-preserving throughout. Pure-seam extracts where the file held a centralizable decision: 4shared classify_fourshared_auth (the 401 OAuth-token-revoked gate), kDrive classify_kdrive_connect_auth (the 401 invalid-token / 404 unknown-drive handshake gate), Drime drime_status_is_retryable (the transient-retry class: any 5xx plus 404/408/425/429). Deterministic offline parser tests where the listing/parse logic was already pure: Jottacloud parse_folder_xml (folders plus COMPLETED files, skipping deleted and incomplete, base-path join, md5/size/mime), Zoho WorkDrive byte-amount + recursive quota-key walk, Internxt filename/size helpers. Swift is intentionally skipped: its only profile, Blomp, is inactive. 10 new unit tests; all 16 row-4 providers are now covered	🟢 done	6bd2941a, 523f0603, 2b36c30a, b20d2dbb, cb47474b, 53fc2c06	#347
34		Quick Connect connector harmonization (#215): the single-column connectors now use the same two-column Quick Connect layout as every other provider, driven by the shared renderRightColumn instead of bespoke per-form columns. The 8 OAuth clouds (Google Drive, Google Photos, Dropbox, OneDrive, Box, pCloud, Zoho WorkDrive, Yandex Disk) render the shared right column via a rightColumn render-prop, so they now expose Wrappers / Overlays: a transparent crypt overlay (rclone-crypt or AeroCrypt) is activatable on the 7 overlay-eligible OAuth backends (hidden on Google Photos, a media-only API), with the overlay binding persisted through the OAuth save path. The profile name with a clickable icon avatar moved to the top of the column, Local Path now sits above Remote Path in every form, and the "Connect to X" button is disabled once already authenticated (reconnect from My Servers). GUI-only, no backend protocol change	🟢 done	b94fdf085, ce353d791	post, #215 (@EhudKirsh)
35		"Active Sessions" sidebar filter now appears for Quick Connect re-auths (#128-C lineage): a Quick Connect connection (notably an OAuth re-auth) is form-driven, not launched from a saved card, so it carried no savedServerId and showed only in the header Active Sessions badge (which counts raw session tabs) but never in the sidebar Active Sessions filter, whose count and result are both keyed on the set of session savedServerIds (the filter narrows the saved-server grid to s => activeProfileIds.has(s.id)). connectToFtp now binds the live connection to its matching saved profile before creating the session: credential protocols (FTP/SFTP/S3/WebDAV/API) via a precise unique protocol + username + host match, OAuth (empty username, host=displayName) via a provider-unique fallback applied only when a single saved profile exists for that provider (no mislink with multiple accounts; a no-match stays unlinked as before). The badge (jump-to-sessions) and the filter (narrow the grid) keep their distinct roles; the session now lights up both	🟢 done	893236413	post, #128 (@EhudKirsh)
36		Wrappers / Overlays open by default on Quick Connect (#215, #276 lineage): the collapsible Wrappers / Overlays section on the Quick Connect page now starts expanded instead of collapsed. When closed it only hid the single Crypt enable checkbox, which you have to tick to configure anything anyway, so collapsing it by default just buried the transparent crypt overlay one click deeper. overlaysExpanded now defaults to true (and stays open when editing a saved profile, where it previously opened only if a crypt binding already existed), while the section header chevron still toggles it closed for anyone who wants the page tidy	🟢 done	156031b8	post, #215 (@EhudKirsh)
37		Per-protocol credentials survive profile export/import (#215 Caveat A): a one-account-many-protocols profile (e.g. a Koofr account saved as Native API + WebDAV) now keeps each mode's saved credentials across export/import. The per-protocol snapshots (server_modes_<id>), the persistModeCredentials opt-in and the OAuth Remote Path all round-trip, and the "has credentials" import badge reflects every secret kind (OAuth, Jottacloud, crypt-overlay and the new snapshots), not only OAuth/Jotta	🟢 done	2fc7d32c	post, #215 (@EhudKirsh)
38		Native profile export/import for the CLI (#215): aeroftp-cli profile-export / profile-import write and read an encrypted .aeroftp profile backup, byte-compatible with the GUI's My Servers Export/Import (a CLI-exported file imports in the GUI and vice versa). It reuses the GUI's exact code path, so credential collect/restore including the #215 per-protocol snapshots is shared, not duplicated; secrets are opt-in via --include-credentials. Closes the gap where a CLI-first user could only convert to/from external formats or take a full keystore backup, never back up profiles natively	🟢 done	4627dc26	post, #215 (@EhudKirsh)
39		Filen S3 empty-folder rename explains itself instead of leaking a raw 401 (#368): renaming an empty folder on Filen's local S3 bridge now returns the actionable "add a file inside the folder first, or use the native API / WebDAV bridge" message instead of the cryptic HEAD on rename source returned status 401. An empty folder is a virtual prefix with no object, so S3's copy-then-delete rename has nothing to copy; the Linux bridge already surfaced this via a 404, but the Windows bridge answers 401, which leaked the raw status. The 401/403 from a Filen S3 endpoint is now mapped to that same case, scoped to is_filen_s3_endpoint() so real files and non-empty folders are unaffected	🟢 done	3ae5e8cc	post, #368 (@EhudKirsh)
40		Pre-release security audit remediation (AeroShare, AeroAgent, per-user, CLI, extract): an adversarial multi-agent audit of the whole v4.0.9..HEAD delta surfaced 7 verified findings (2 High, 2 Medium, 3 Low); this closes 6 of them. The two High blockers both broke a containment promise: AeroShare drive-replicate wrote/deleted files at a publisher-controlled out_path.join(rel_key) with no ../absolute guard (path traversal to arbitrary write/delete, RCE via ~/.bashrc), now contained by safe_replica_path(); and coding_diagnostics executed workspace code (cargo check build.rs, tsc/eslint config) classified ReadOnly and ungated, now approval-gated (DangerLevel Medium). Plus the Medium per-user legacy-seed cross-user leak (now scoped to the single migrated owner and the global blob consumed), and 3 Low: the approval dialog now shows the command, CLI profile-import no longer overwrites skipped credentials (two-phase restore-only-added), and the extract window no longer mislabels real errors as wrong-password. The remaining Medium (knock/action flood) is deferred to 4.1.1	🟢 done	8e172771b	post
41		OpenDrive privacy gaps (#252) closed. Item privacy is now editable in Properties > Permissions for a single item or a multi-selection (Private/Public/Hidden), the right-click menu collapses to one "Permissions..." entry (which removes the old "a hidden item offers both Set Private and Set Public" bug), and the OpenDrive Quick Connect gains a per-account Default privacy for new items applied to newly created folders and uploads. New CLI verb aeroftp-cli access <path> --to private/public/hidden sets the privacy of an existing file or folder (wired into the dispatcher allowlist and agent-info). On Linux the file picker now goes through xdg-desktop-portal to avoid a WebKitGTK GtkFileChooser heap corruption. Verified end to end against a real OpenDrive account via the CLI	🟢 done	4e1086308	#252

Requested / under consideration

Community ideas captured for triage. Not committed to a release yet.

#	Type	Request	Status	Source
1		Eager-evaluation preview and a single-vs-multi-target placeholder for the -i selectors (prioritised by the reporter ahead of Edit(E) and the 2-letter semantics; exact behaviour to be pinned)	🔵 idea	#311 (@EhudKirsh)
2		Lossless .jpg to .jxl transcode in AeroFile: JXL re-encodes an existing JPEG losslessly and reversibly (the original JPEG bytes reconstruct exactly), for a real size win with no quality loss. Candidate framing: AeroFile as a GUI for libjxl	🔵 idea	aerovault#2 (@EhudKirsh)
3		Media handling principle for any AeroFile conversion: lossless or pass-through only, never a lossy-to-lossy re-encode (for example .mp3 to .opus is destructive and should not be done silently)	🔵 idea	aerovault#2 (@EhudKirsh)
4		Systematic deterministic (offline) parser + HTTP-status-to-error tests for the unit-only storage providers (Azure Blob, Swift, Koofr, Yandex Disk, kDrive, Zoho, Jottacloud, Internxt, 4shared, Drime, GitHub, GitLab, Immich, Uploadcare, Cloudinary, Filen). COMPLETE across all 16: Phase A 8cfd49bca (Azure listing parser, Immich status mapping, shared sanitizer), Phase B Group A 8ad082fce..ff8b8910e (Koofr, Yandex Disk, Cloudinary, Uploadcare via extracted pure classify seams), Phase B Group B c841ee1d1, 176ff58fa (GitLab, Filen) then 6bd2941a..53fc2c06 (4shared, kDrive, Jottacloud, Zoho, Internxt, Drime). GitHub was already covered. Swift is intentionally skipped (its only profile, Blomp, is inactive). See queued rows 13, 14, 16, 33	🟢 done	#347
5		Single pre-release smoke entrypoint: one command running the deterministic Rust + frontend suite and the lab-backed integration tests, clean-skipping when creds/Docker are absent, printing a pass/skip matrix, wired into the release checklist	🔵 idea	#347
6		In-section membership for users -i: a verb so users -i can add/remove groups to/from a user. The groups-side counterpart (groups -i a/x for member profiles) shipped in 4.1.0; this remaining users<->groups direction needs the data model pinned first, since groups live inside each user's partition	🔵 idea	#311 (@EhudKirsh)
7		The dedicated extract/password window (Deliverable G) could follow the system theme (light/dark) instead of always rendering light. Nice-to-have polish	🔵 idea	-

Known issues found after release

Reported against v4.0.9. Fixed items ship in v4.1.0; reporters close after confirming in the release.

#	Area	Description	Status	Linked issue
1	UI / about	The welcome / splash popup on first launch showed v4.0.8 while running v4.0.9 (the release bump missed the hardcoded splash version label). Re-synced on main in 25410382 and then fixed at the root in 4feb65c8 (the label is now dynamic, so it can never drift again), see queued rows 1 and 20; shipping in v4.1.0	🟢 done	#367 (@EhudKirsh)
2	AeroShare / Linux	On Linux the AeroShare inbox "reveal file" action ran a plain xdg-open on the file, which OPENS it in the default app instead of revealing it in the file manager (unlike the Windows /select, and macOS -R paths that select it). Present in the v4.1.0 AeroShare feature. Fix is ready on branch fix/aeroshare-linux-reveal-file (reveal via D-Bus org.freedesktop.FileManager1.ShowItems with a parent-folder fallback for minimal distros), gates green (fmt, clippy -D warnings, cargo test 2394, tsc), but NOT yet merged to main. Queued for v4.1.1.	🔵 planned	internal (AeroShare live-test F1)

_{Status legend: 🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released}

Affected platforms

• Windows
• macOS
• Linux

---

Maintained by the AeroFTP team. Current release v4.0.9, next v4.1.0. Patches accumulated here; each release line still gets its own tracker.

[axpnet]

Release hygiene: 4.0.9 version consistency + 4.1.0 dependency refresh

Post-4.0.9 maintenance, done on main, shipping in v4.1.0.

cargo audit is clean (no advisories), so the dependency pass is stay-current hygiene rather than a security fix. The 4.0.9 release also left three version files behind, now realigned with the published tag.

Area	Description	Status	Ref
Release / version	The splash screen label, the AppStream metainfo.xml release list (missing the 4.0.9 entry) and the npm lockfile were still at 4.0.8 after the 4.0.9 bump; all three realigned with the published v4.0.9 tag.	🟢 fixed	25410382b
Build / deps	In-range refresh of the Rust transitive tree plus uuid 1.23.4, totp-rs 5.7.2 and webpki-roots 1.0.8 (Dependabot #357).	🟢 fixed	2b1dd8255

Held back on purpose: aes-gcm stays at 0.11.0-rc.3 (rc.4 / #356 breaks the Windows build, and it is pulled by the russh SSH stack, not the vault core); aws-lc-rs / aws-lc-sys are frozen (C/asm crypto provider, validated only by the cross-platform CI); the tauri facade stays pinned at =2.11.0 (the 2.11.1 is_local_url change rejects the Linux production webview origin), with only the internal tauri-* crates advancing to the matching 2.11.3 set. Dependabot triage: #357 applied (closable), #356 held (Windows), #358 held (sigstore 0.14 does not compile). Larger majors (suppaftp 9, keyring 4, rusqlite 0.40, notify-debouncer-full 0.7, the RustCrypto next-gen line) are out of semver range and need dedicated branches.

Verified green: cargo check --all-targets, clippy --all-targets, cargo fmt --check, cargo audit (0 advisories).

[axpnet]

AppImage launches on minimal / immutable distros without libappindicator

Post-4.0.9 fix, done on main, shipping in v4.1.0 (reported by @redpay on Fedora Silverblue 44, #362).

On Linux the system tray goes through libappindicator-sys, which panics (it expects, it does not return a recoverable error) when it cannot dlopen ayatana-appindicator3 / appindicator3. Fedora Silverblue does not ship that library and the AppImage does not bundle it, so the process aborted right after the splash instead of starting.

Area	Description	Status	Ref
Tray / Linux	The library is probed with dlopen before the tray is built; when no candidate soname loads, tray creation is skipped with a warning and the app runs tray-less instead of panicking at launch. The builder is split from .build() so the panic-prone call is gated behind the probe.	🟢 fixed	515abb033
Tray / close	When no tray exists, close-to-tray is bypassed so closing the window quits instead of hiding it with no tray to bring it back.	🟢 fixed	f8db17eda

On these systems the window and every feature work; only the tray icon is absent. Installing libayatana-appindicator3 (layered or in a toolbox) restores it automatically, but it is no longer required to launch.

Verified green: cargo check, clippy, cargo fmt --check. The dlopen probe behaviour was checked directly (all four appindicator sonames resolve where present, a missing name returns null so the tray is skipped). End-to-end confirmation on Silverblue is owed to the reporter once the 4.1.0 AppImage ships.

[axpnet]

AeroAgent coding loop (foundation)

Landed on main, shipping in v4.1.0 (PR #363).

AeroAgent gains a curated set of tools for local coding work: an edit, verify, review, commit loop. Everything is GUI-only and either read-only or approval-gated, so it does not change how transfers or file management behave. A user who never asks the agent to code sees no difference. This is the first power-set of a broader plan; AeroAgent stays AeroFTP's file-first agent.

Area	Description	Status	Commit
Context	Reads project rules (AGENTS.md, CLAUDE.md, .cursorrules, copilot-instructions), resolves @file/@folder mentions, builds a coding-workspace context with a dedicated prompt profile	🟢 done	cf7ae349
Safe edit	apply_patch validates a diff as a dry run then applies after an automatic checkpoint; a checkpoint store and restore allow a rollback	🟢 done	cf7ae349
Inspect	coding_search (ripgrep, structured file/line/column matches), coding_diagnostics (structured cargo/tsc/eslint), git status/diff/log/show	🟢 done	6833a8cd, ed587e3b
Verify	run_checks (curated build/test/lint/typecheck allowlist) and verify (ordered multi-check pass)	🟢 done	cf7ae349
Review and commit	review cards for patch, diagnostics, search, git and verify results, plus git stage and commit	🟢 done	cf7ae349
Internals	the tool schema enums and their validation derive from the curated check and diagnostics catalogs (single source of truth), guarded by a drift test	🟢 done	6f279ef6

Verified green: cargo fmt --check, cargo clippy --all-targets -D warnings, the full Rust test suite, tsc, vitest (37 files / 352 tests), i18n:validate (47 locales), and the full PR CI (Linux, Windows and macOS builds, SFTP fixtures plus live, Socket, Snyk).

Not promoted on the README or public channels for now. Anyone interested is welcome to reach out and I will gladly answer.

[axpnet]

Per-user groups/favourites + groups/users interactive polish, plus two Filen/TUI fixes

Landed on main, shipping in v4.1.0 (from a triage of #311, #341, #277, #128 + #215, reported by @EhudKirsh).

The triage surfaced a structural gap (server groups and favourites were a single global blob shared by every local user) and a batch of groups -i / users -i polish, plus two concrete bugs in the Filen flow and the benchmark TUI. All of it is on main.

Area	Description	Status	Ref
Per-user state	Server groups and favourites moved from a shared global vault blob to each user's encrypted partition (best-effort one-time seed from the legacy blob); the dead aeroftp-favorite-servers localStorage export key was dropped	🟢 fixed	4afc1d97, 492b0f85
groups -i / users -i	Labelled action bar + Help (H/?), screen-clearing Refresh (.), compact one-token selectors, header rule, Profiles/Groups count columns, and arrow + strikethrough summaries on re-index and delete (parity with profiles -i)	🟢 fixed	75c069bd, 3aec8910, 79617cc6
benchmark --tui	The "Pick profiles to compare" picker repaints in place instead of clearing the screen each frame, so the title no longer flickers and the list no longer shakes on scroll	🟢 fixed	4e675d63
Filen Quick Connect	Green Save now persists an API-key deletion (removes it from the vault like Convert to Native API) and cancels the 2FA auto-login countdown popup	🟢 fixed	de830e8d

Verified green: cargo test --bin aeroftp-cli (410 tests), cargo clippy --bin aeroftp-cli -- -D warnings, tsc --noEmit, and i18n:validate (46 locales, 0 placeholders).

[axpnet]

iroh 0.92 to 1.0 migration: the 6 Dependabot alerts cleared

Queued for v4.1.0, done on main. The user-to-user P2P drive (AeroShare) links the isolated aeroftp-peer-l0 crate as a normal dependency, so iroh's transitive graph ships in the binary. The iroh 0.92 line pinned six transitive security advisories that no targeted bump could clear; moving the whole family to the 1.0 line resolves cleanly with the app's russh 0.61.2 and drops every vulnerable crate.

Area	Description	Status	Ref
iroh family	Bumped iroh 0.92 to 1.0.0, iroh-blobs 0.94 to 0.103, iroh-docs 0.92 to 0.101, iroh-gossip 0.92 to 0.101	🟢 done	0512071a
hickory-proto (x4)	GHSA-3v94-mw7p-v465 (NSEC3 loop) and GHSA-q2qq-hmj6-3wpp (O(n^2) encode) cleared: iroh 1.0 resolves to hickory-proto 0.26.1, which carries both fixes	🟢 fixed	0512071a
lru (x2)	GHSA-rhfx-m35p-ff5j (IterMut unsound) cleared: iroh-relay 1.0 uses lru 0.18.0 (patched); the residual lru 0.7.8 is unaffected (< 0.9.0); the vulnerable 0.13.0 and the pkarr crate are gone	🟢 fixed	0512071a
DHT discovery	The removed discovery-pkarr-dht cargo feature re-wired onto iroh 1.0's Builder::address_lookup API plus the new iroh-mainline-address-lookup crate; n0 DNS still works, so decentralized discovery is preserved	🟢 done	0512071a
peer-l0 API port	iroh 1.0 renames/moves: NodeId to EndpointId, builder presets, remote_id(), conn.alpn(), BlobsProtocol, conn-type via remote_info. The app facade needed no change	🟢 done	41fd4397
audit.toml	Removed the 3 now-moot ignores (RUSTSEC-2026-0118 / -0119 / -0002); only the 2 unmaintained-class advisories remain (atomic-polyfill, paste), kept ignored	🟢 done	13368e21

Still owed before the release tag: the AeroShare 2-machine live matrix on iroh 1.0 (cross-network, 5G), since the P2P transport runs on this engine.

Verified green: peer-l0 cargo check plus cargo test 14/14 plus clippy -D warnings; app cargo check --all-targets plus cargo test (2374 passed) plus clippy -D warnings plus cargo fmt; cargo audit exit 0 with the three ignores removed; frontend tsc plus vitest (363) plus i18n (46 locales).

[axpnet]

-i action bar reordered safe-first + groups -i add/remove members

Landed on main, shipping in v4.1.0 (from #311, reported by @EhudKirsh). These are rows 2 and 8 of the "Requested / under consideration" list, now built and moved up to the queued table.

Area	Description	Status	Ref
-i action bar	The profiles / groups / users interactive action bars are reordered safe-first: Help(H) leads, the read-only verbs follow, re-index(#) moves out of the front and the destructive Delete(D) sits last before Quit. The key letters are unchanged, so existing muscle memory and scripts keep working	🟢 fixed	330a3201
groups -i membership	New a <group> <profile...> and x <group> <profile...> verbs add/remove member profiles to/from a group from inside groups -i (the counterpart to profiles -i's g toggle). Group by index or name, profiles by the same selectors as profiles -i (index, name, id, substring), multi-target and idempotent. The reverse users -i direction (groups to/from a user) stays under design while the data model is pinned	🟢 fixed	3da0f1ed

Verified green: cargo test --bin aeroftp-cli (411 tests), cargo clippy --bin aeroftp-cli -- -D warnings, plus a live pseudo-tty check of every action bar and the a/x add/already-in/remove/not-in/unknown-group paths.

[axpnet]

Interactive New(N) verb: create entries from inside the -i loops

Post-4.0.9 follow-up, done on main, shipping in v4.1.0 (#311, requested by @EhudKirsh in discussioncomment-17425719 / 17439071).

The rclone-config n) New remote model is now complete on all three interactive loops: you can create an entry from inside profiles -i / groups -i / users -i instead of dropping out to a separate add command, on the shared -i engine. Phase A (groups/users) and Phase B (the catalog-driven profile creator) both landed on main.

Area	Description	Status	Ref
groups -i	n [name] creates a new empty group (members added afterwards via a/x here or g in profiles -i); inline name or prompt, empty/duplicate name rejected	🟢 done	21d08c5ae
users -i	n [name] creates a new local user, prompting for the name and an optional account passphrase; clean "already exists" message before the passphrase prompt	🟢 done	21d08c5ae
profiles -i	n [query] runs a service-first catalog picker: substring-match aero catalog (company, method, protocol, provider id), numbered pick (a single match skips it), name defaulting to the company with a duplicate rejected, then protocol-aware fields	🟢 done	46d543b77
Profile fields	Self-hosted protocols (ftp/ftps/sftp/webdav/webdavs/s3/swift) prompt host/port/username/remote-path (all optional, blank to defer); OAuth/API clouds record just the name. Credentials are added later in the GUI Edit modal, the same contract as profile-add	🟢 done	46d543b77
Action bars	New(N) joins each -i action bar in the mutators block (after the read-only and cross-navigation verbs), with the hint lines and help text updated; key letters unchanged so no automation breaks	🟢 done	21d08c5ae, 46d543b77

The persist core was factored out of cmd_profile_add into a shared persist_new_profile_entry, so the n handler and the profile-add subcommand build and save the identical entry shape.

Verified green: cargo test --bin aeroftp-cli (413 tests, +4 across both phases) and cargo clippy --bin aeroftp-cli -- -D warnings, plus a live pseudo-tty walkthrough of every n flow (no-match, multi-match with abort, cloud create, self-hosted create with the field prompts). The --tui menu parity is tracked separately.

[axpnet]

Provider offline-test coverage, Phase A (Azure, Immich, shared sanitizer)

Wishlist follow-up, done on main, shipping in v4.1.0 (#347, requested by @EhudKirsh).

First slice of the "deterministic offline parser plus status-to-error tests for the unit-only providers" item. This batch covers the seams that are already pure functions, so it is tests-only with zero production change. The remaining providers need a small behaviour-preserving refactor first (extract a pure classify_<provider>_error(status, body) from the async response handler), so they are queued as Phase B, one reviewable commit per provider.

Area	Description	Status	Ref
Azure Blob	parse_blob_list XML listing parser locked: virtual directory vs file, size and Last-Modified, nested-blob filtering, current-prefix stripping, NextMarker present and absent, and a garbage body that yields no items and never panics	🟢 done	8cfd49bca
Immich	map_api_error status mapping locked across the whole 5xx range (502, 503, 599, not just 500), with the caller context plus sanitized body carried into the message and the 429 rate-limit label	🟢 done	8cfd49bca
Shared sanitizer	sanitize_api_error locked: over-long first-line truncation with an ellipsis, first-line-only plus API-key redaction, and an empty body falling back to a stable placeholder	🟢 done	8cfd49bca
Scope discipline	Held at genuine gaps: GitHub classify_api_error already has full coverage and the Azure rate-limit and error-format helpers were already tested, so no padding tests were added	🟢 done	8cfd49bca

Verified green: cargo test --lib = 2381 passed, 0 failed, 10 ignored; cargo clippy --lib --tests -- -D warnings clean. 7 new unit tests, all inside the existing #[cfg(test)] modules (diff: 3 files, +176 / -0). The provider tests live in the ftp_client_gui_lib crate, so the gate is --lib, not --bin aeroftp-cli.

[axpnet]

Provider offline tests Phase B Group A, plus a CI fmt-gate fix

Post-4.0.9 follow-up, done on main, shipping in v4.1.0 (#347). Continues the row 13 Phase A work and clears a CI red that had been riding along on recent pushes.

Phase A covered the providers whose error mapping was already a pure function. Phase B does the ones where it was trapped inside an async handler: for each, the status-to-error logic is lifted into a pure classify_<provider>_error(status, body) -> ProviderError, and the async parse_error becomes a thin wrapper. The point is behaviour preservation, no observable change, only a testable seam, so the messages stay byte-for-byte identical (where the original formatted a StatusCode, the pure function reconstructs its Display form from the status code). Group A (the four providers that already had a separable parse_error) is done; Group B is queued per-batch.

Area	Description	Status	Ref
Koofr	classify_koofr_error extracted; body-level Koofr error code drives the variant, HTTP status forms the fallback message. 3 tests: code to variant, missing code/message defaults, sanitized-body fallback	🟢 done	8ad082fce
Yandex Disk	classify_yandex_error extracted; the body error string maps first (Unauthorized, NotFound, AlreadyExists, PointsToRoot, QuotaExhausted), HTTP status second. 2 tests: body codes, status fallback	🟢 done	63a8229a7
Cloudinary	classify_cloudinary_error extracted; error.message becomes the text, status selects the variant (401/403 fold to auth, other 4xx to InvalidConfig, 5xx to ServerError). 2 tests: status matrix, sanitized-body fallback	🟢 done	500429073
Uploadcare	classify_uploadcare_error extracted; text taken from detail/error/message in that order, status selects the variant. 2 tests: field precedence + status matrix, sanitized-body fallback	🟢 done	ff8b8910e

Area	Description	Status	Ref
CI: Checks workflow	The Checks job runs cargo fmt --all --check as its first step; formatting drift from recent -i commits and the Phase A test was failing it on every push to main. A one-shot cargo fmt --all (no logic change) restores the fmt gate, so the vitest and cargo-audit steps queued behind it run again	🟢 done	387fbced7

Verified green: cargo fmt --all --check clean, cargo test --lib 2390 passed, cargo clippy --lib --tests -- -D warnings clean, npm run test:unit (vitest) 363 passed, cargo audit clean (exit 0); the Checks run on the last push is success.

[axpnet]

Provider offline tests Phase B, Group B start (GitLab, Filen)

Post-4.0.9 follow-up, done on main, shipping in v4.1.0 (#347). Group B is the harder half: providers whose status logic lives inside an async method, not a separable parse_error, so each needs a behaviour-preserving seam lifted out before it can be tested offline. Filen was prioritised; GitLab came first as the cleanest single seam.

Area	Description	Status	Ref
GitLab	execute's inline status match lifted into a pure classify_gitlab_error(status, body). 401/403/404 plus the 429 rate-limit short-circuit (still returned before the body is read) and the 5xx catch-all whose API error (5..) shape execute_with_retry's is_server_error gate relies on to retry once. 2 tests	🟢 done	c841ee1d1
Filen	No single seam: HTTP failures already route through the pure, tested format_filen_error, and logical errors through the per-call {status, message} JSON envelope. The one centralizable decision, the transient-retry class in download_filen_chunk (5xx plus 408/429 retry, every other 4xx authoritative), is lifted into a pure filen_status_is_retryable. 2 tests (the retry boundary matrix and the base format_filen_error composition)	🟢 done	176ff58fa

Each async handler keeps identical behaviour: the extraction adds a testable seam, it does not change what callers see. The rest of Group B (Swift, Zoho, Internxt, Drime, kDrive, Jottacloud, 4shared) is queued per-batch.

Verified green: cargo fmt --all --check clean, cargo test --lib 2394 passed, cargo clippy --lib --tests -- -D warnings clean. Both commits are on main.

[axpnet]

Sigstore update verification now actually verifies (auto-updater)

Post-4.0.9 follow-up, done on main, shipping in v4.1.0 (was Dependabot #358, now closed).

The in-app auto-updater has carried a Sigstore signature check since v3.3.0, but it had been stuck on its amber "verification unavailable" fallback since v3.3.2: GitHub Actions / cosign attach a v0.3 signing bundle to our releases, and the sigstore 0.13 crate only knew the v0.1 / v0.2 bundle formats, so every check failed with "unknown bundle profile" and degraded to non-blocking. The bump to sigstore 0.14 adds v0.3 bundle parsing, so the check now returns a green SigstoreVerified on real release artifacts. The fallback is unchanged and stays non-blocking by design.

Area	Description	Status	Ref
Auto-updater	sigstore 0.13 -> 0.14: adds application/vnd.dev.sigstore.bundle.v0.3+json parsing, the format our CI signs with. verify_sigstore_bundle now reaches SigstoreVerified instead of always degrading to amber	🟢 done	42b126413
Fallback (unchanged)	Still non-blocking: the artifact SHA-256 stays the primary integrity check and any Sigstore error degrades to amber so an install never blocks. The real in-app end-to-end is exercised on the 4.1.0 to 4.1.1 update path	🟢 done	42b126413
Build hygiene	Only the verify feature is enabled (was bundle = sign + verify): the sign path does not compile against the post-iroh-1.0 crypto graph (a hybrid-array inference ambiguity in sigstore 0.14's sign.rs) and we never sign, only verify	🟢 done	42b126413
Security	Removed 3 now-moot cargo-audit ignores: the two tough advisories GHSA-4v58-8p28-2rq3 + GHSA-8m7c-8m39-rv4x (sigstore 0.14 pulls tough 0.22, where both are fixed) and RUSTSEC-2026-0173 proc-macro-error2 (it left the graph via oci-spec 0.9). RSA Marvin Path A kept	🟢 done	42b126413

Proof: pointed the verifier at the real published v4.0.9 .deb bundle offline and it returned SigstoreVerified against our workflow identity and the Rekor transparency log.

Verified green: cargo fmt --all --check, cargo clippy --all-targets -D warnings, cargo test (2394 lib tests, 0 failed), cargo audit (exit 0).

[axpnet]

Bridge "Setup ... first" box no longer flashes open then collapses

Post-4.0.x follow-up, fixed on main, shipping in v4.1.0 (#215, reported by @EhudKirsh).

Switching to a Filen Desktop or MEGAcmd bridge tab made the amber "Setup ... first" box flash open during the "Checking..." probe and then collapse the moment the probe settled to green. The fix existed on a branch that never landed; I recovered it, confirmed it was not superseded by any other patch (the file on main was byte-identical to the pre-fix version, absent on origin/main too, and nothing in the CHANGELOG, #215 or this tracker), and re-applied it.

Area	Description	Status	Ref
CollapsibleSetupBox	New pure setupBoxDefaultOpen(isBridge, bridgeState): a bridge box starts collapsed and expands only on a settled non-green state, so it never flashes open on green	🟢 fixed	1a5a913e
ConnectionScreen	Computes isBridgeMode synchronously from the active mode, so the box knows at mount instead of waiting for an effect	🟢 fixed	1a5a913e
BridgeStatusBanner	Reports the settled state only (undefined while the first probe is in flight) and resets on unmount, so a stale state never leaks to the next tab	🟢 fixed	1a5a913e

Verified green: cherry-pick applied clean (3-way, no conflicts), npx tsc --noEmit exit 0, vitest 367/367 (the new CollapsibleSetupBox.test.ts adds 4 covering setupBoxDefaultOpen), i18n:validate 46/46. No Rust touched. The CI Checks workflow on 1a5a913e7 completed green.

Bundled with a release-plumbing bump: softprops/action-gh-release 3.0.0 to 3.0.1 (Dependabot #353, SHA pin advanced to 718ea10b... after verifying it against the upstream v3.0.1 tag). The sibling Dependabot #356 (aes-gcm rc.4) was closed: a stale transitive pre-release bump that would have regressed sigstore back to 0.13.

[axpnet]

Splash version label is now dynamic (root-cause fix for #367)

Queued for v4.1.0 (#367, reported by @EhudKirsh).

The 4.0.9 welcome / splash popup read v4.0.8 because the version was a hardcoded string the release bump missed. Row 1 re-synced the constant; this closes the underlying cause so it cannot drift on any future release.

Area	Description	Status	Ref
UI / about	Splash window injects the real running crate version (env!("CARGO_PKG_VERSION"), single source of truth, bumped every release) through an initialization script the page reads before paint; static text kept only as an out-of-app fallback. No IPC, no build step	🟢 done	4feb65c8

Verified green: cargo fmt --all --check, cargo clippy --all-targets -D warnings.

[axpnet]

Copy / Move a server profile to another user: data loss fixed, avatar overflow fixed

Post-4.0.9 follow-up, fixed on main, shipping in v4.1.0 (#366, reported by @EhudKirsh).

Two defects, both real.

Area	Description	Status	Ref
Data loss on Move	The cross-user de-dup skipped the write into the destination on a match while still deleting the source, so moving a profile whose equivalent already existed in the target removed the only copy. A Move now always writes the profile into the destination first and removes the source only after; a failed write aborts before any deletion. Copy still de-dups and reports the skip clearly	🟢 fixed	d1a469fc8
Avatar overflow	The account picker rendered the avatar field as plain text, so a custom image avatar (a long base64 string) spilled over the avatar circle. The picker now reuses the shared avatar component (image or clipped initial). The string was the avatar image, never a password or key	🟢 fixed	d1a469fc8

Verified green: cargo fmt clean; cargo test --lib relocate 8 passed 0 failed (including the new regression relocate_move_materialises_even_when_target_has_equivalent); cargo clippy --bin aeroftp-cli --all-features --tests -- -D warnings exit 0; frontend tsc --noEmit clean. Live: reproduced the old data loss on a pre-fix binary (Move of a dedup-equivalent returned already_present, inserted absent, source deleted), then on the fixed binary the same Move returned already_present: true AND inserted: true with a real new id and the destination kept the materialised profile (no data loss), while Copy of a dedup-equivalent still de-dups (inserted: false, destination count unchanged). Run against the real vault with two local users via the profile-move-user / profile-copy-user paths (the same backend the GUI calls); test profiles removed afterwards.

[axpnet]

Transfer Queue per-item bar on Crypt overlays: now advances

Post-4.0.9 follow-up, fixed on main, shipping in v4.1.0 (#364, reported by @EhudKirsh).

A Crypt overlay upload encrypts locally, stages the ciphertext, then uploads it, and those crypt paths did not emit the per-item transfer_events the Transfer Queue listens to. The overall queue advanced (items start and finish) but the per-item bar never got byte or file updates and stayed at 0 percent.

Area	Description	Status	Ref
Folder uploads	Both overlays now emit folder progress (running file count), so the bar fills 0 to 100 as each encrypted file lands and the N/total badge updates. The folder transfer_id carries folder so the frontend routes it through the folder-progress path	🟢 fixed	5ca990fb1
Single-file uploads	Both overlays thread a byte-progress callback so the bar and percentage move during the upload; the file transfer_id omits folder and total_files so it routes through the per-file byte path	🟢 fixed	5ca990fb1

Covers rclone-crypt and native AeroCrypt, file and folder.

Verified green: cargo fmt clean; full cargo clippy --all-targets --all-features -- -D warnings exit 0; frontend tsc --noEmit clean; the app builds, links and boots with the change. The emitted transfer_event payload matches the proven normal-upload contract (same TransferEvent / TransferProgress shape, routed by the folder substring and total_files presence the frontend already keys on). The one residual check is a hand-driven drag-and-drop of a folder and a single large file onto a connected rclone-crypt and AeroCrypt remote on a desktop session, watching the per-item bar fill, plus a plain non-crypt folder for no-regression.

[axpnet]

Windows USB eject now actually ejects

Post-4.0.9 follow-up, fixed on main, shipping in v4.1.0 (#351, reported by @EhudKirsh).

On Windows the AeroFile PLACES eject control did nothing: eject_volume had no Windows implementation (it returned an error) and the frontend swallowed that error silently. It now performs a real safe removal through the Shell.Application "Eject" verb, the same action as the tray "Safely Remove Hardware and Eject Media".

Area	Description	Status	Ref
Backend	New eject_volume_windows: validates the drive letter strictly, then runs the Shell.Application "Eject" verb via PowerShell (no new dependency, mirrors the Linux/macOS shell-out arms)	🟢 fixed	bb3b488c
Backend	The "Eject" verb is fire-and-forget: the one-shot call returned success while the drive stayed put (silent false positive). The call now keeps the COM object alive and polls until the drive disappears (10s deadline), mapping the outcome to an exit code so a genuine failure surfaces as an error with a "the drive is still in use" message	🟢 fixed	fca2e93a
Frontend	The misleading lucide power glyph is replaced with a standard eject symbol (triangle over a bar); eject failures now raise a visible error toast instead of dead silence. sidebar.ejectFailed added and translated in 47 locales	🟢 fixed	484ac1c1
Build	Six Linux-only vault_mount helpers (the ephemeral FUSE mount path) were dead on Windows/macOS, emitting unused-import and dead-code warnings; each is now cfg-gated to its Linux caller, with sanitize kept under test so its unit test still builds everywhere	🟢 fixed	cde3c80f
Backend	After a successful eject the drive letter lingered with no media as a "Removable Disk (X:) 0 B" ghost row; list_mounted_volumes_windows now drops removable/optical slots that have no media, so the post-eject re-enumeration clears the row	🟢 fixed	0926ccbe
Frontend	An eject failure raised its toast through the shared toast bus, which dropped every event when the user had toast notifications turned off, so a failed eject could go silent; a clicked action is now marked important and always surfaces, while ambient toasts still honour the setting	🟢 fixed	703e0832

Verified on real Windows 11 by the Windows peer: the code compiles and links, and on a real USB pendrive the eject performs the native safe-removal, the PLACES row vanishes cleanly with no 0 B ghost, a removable-with-media and the system drive stay untouched (no regression), and the red failure toast renders on a genuinely busy drive.

Verified green: cargo fmt --all --check, cargo clippy --all-features --tests -- -D warnings, CLI clippy, cargo test (2400 passed, 0 failed), npx tsc --noEmit, npm run build, npm run i18n:validate (47 locales, 0 placeholders), and the full Checks + Build AeroFTP (including the Windows build) CI runs on main.

A separate, non-blocking follow-up was noted on the way: on Windows a freshly inserted drive can take up to ~30s to appear in PLACES (the real-time volume watcher is Linux-only inotify; Windows/macOS fall back to a 30s poll). The fix would be a Rust-side WM_DEVICECHANGE listener emitting volumes-changed. Tracked separately.

[axpnet]

OS "Extract here / Extract to folder" right-click verbs on Windows (Deliverable G)

Deliverable G follow-up, on main, shipping in v4.1.0 (builds on row 24, the Linux Nautilus pair).

Extends the OS extract integration to the Windows shell. The NSIS installer now registers per-extension right-click verbs, "Extract Here with AeroFTP" and "Extract to Folder with AeroFTP...", that invoke the same cross-platform GUI extract intent already shipping on main. The dedicated extract window computes the never-clobber stem subfolder, prompts for a password on encrypted archives and vaults, and shows the native destination picker for "to folder"; it never boots the main app. Verbs only: the double-click Open of the general archive formats is left untouched (owner decision c).

Area	Description	Status	Ref
Installer / NSIS	Two helper macros (AeroFTPWriteExtractVerbs / AeroFTPDeleteExtractVerbs) write and remove shell\AeroFTPExtractHere\command and shell\AeroFTPExtractToFolder\command under each class base key, commanding AeroFTP.exe --extract-here "%1" / --extract-to "%1"	🟢 done	2aaf37696
File types	General formats (.zip .7z .rar .tar .tgz .gz .xz .bz2) attach via SystemFileAssociations\.<ext> so the verb is additive and never hijacks the default Open; the .tar.gz/.tar.xz/.tar.bz2 tarballs register under their last component, the only handle Explorer keys on. The aero* archive ProgIDs (AeroFTP.AeroVault, AeroFTP.AeroZip) gain the verbs next to their existing Open	🟢 done	2aaf37696
Uninstall	The PREUNINSTALL block removes only our two verb subkeys per type, never the shared parent SystemFileAssociations\.<ext> key	🟢 done	2aaf37696

Validation: this is an installer-only NSIS fragment, so the cargo and frontend gates do not apply (it is not compiled by cargo or vite); the hooks compile inside the Windows NSIS bundle on CI. The Linux gate state from rows 13-24 is unchanged. Live file-manager validation on a real Windows box (right-click a clear archive, an encrypted archive, and a vault) is still owed before the release tag.

[axpnet]

Filen Desktop bridges work outside the GUI + OpenDrive API host self-heals (#368 follow-up)

Post-v4.0.9 follow-up, fixed on main, shipping in v4.1.0 (#368, reported by @EhudKirsh). Two AeroFTP-side root causes behind the Filen WebDAV / Filen S3 benchmark failures and a separate OpenDrive host footgun.

The Filen Desktop local bridges (filen-desktop-webdav, filen-desktop-s3) authenticate to a loopback server whose credentials default to admin/admin. That blank-to-admin/admin fallback lived only in the GUI connect path; the saved profile keeps the fields blank, so every non-GUI surface (CLI, benchmark, MCP, schedulers) sent empty credentials and got "Invalid credentials" (WebDAV) or "signature does not match" (S3). Separately, switching an OpenDrive profile from the WebDAV preset into the native API mode could keep webdav.opendrive.com, so API calls hit the WebDAV HTML auth page instead of the JSON API.

Area	Description	Status	Ref
Filen bridges (headless parity)	New shared apply_local_bridge_credential_defaults in profile_loader (the anti-drift module) fills blank to admin/admin for both bridge ids, called from the CLI profile_to_provider_config and the MCP create_provider_from_vault before building the ProviderConfig. One helper fixes both transports (WebDAV reads user/pass directly, S3 maps them to access_key/secret). Explicit values win; the GUI fallback is unchanged	🟢 done	840222548
OpenDrive API host	OpenDriveConfig::from_provider_config normalizes an empty, WebDAV-frontend, or bare opendrive.com host to dev.opendrive.com (warns on auto-correct), so already-saved bad profiles self-heal across CLI/MCP/GUI; the ConnectionScreen preset-less branch also resets the host to the canonical native default so the wrong host is never carried	🟢 done	840222548

Test	Result
cargo test --lib --all-features	ok, 2406 passed, 0 failed (+5 new profile_loader credential-default cases, +4 new opendrive host-normalization cases)
cargo test --bin aeroftp-cli	ok, 417 passed, 0 failed
clippy lib + --bin aeroftp-cli --tests -D warnings	clean
typecheck / i18n / vitest	clean / 0 [NEEDS TRANSLATION], 47 locales / 376 passed

Verified green: fmt, clippy -D warnings (lib + bin with tests), cargo test (lib 2406, bin 417), typecheck, i18n 47 locales (0 needs-translation), vitest 376. CI Checks green on main. Live aero benchmark e2e on a real Windows box (the two Filen bridges on default creds, and an OpenDrive native connect from a previously-WebDAV profile) is still owed before the release tag.

[axpnet]

#368 Filen bridge fix validated end-to-end on Windows

Follow-up to the fix comment above: Fix A is now confirmed end-to-end on a real Windows runner against a live Filen Desktop bridge (admin/admin), binary built from main @ 840222548. aero benchmark quick (10 MB, self-signed local cert):

Profile	providerId	Creds	Result
Filen Desktop WebDAV	filen-desktop-webdav	blank	PASS (up 15.25 / down 30.54 Mbps, exit 0)
Filen Desktop S3	filen-desktop-s3	blank	PASS (up 7.93 / down 26.70 Mbps, exit 0)
custom WebDAV to same bridge	custom-webdav	blank	FAIL "Invalid credentials" (exit 6, negative control)

The only difference between PASS and the negative control is the providerId, the exact key the helper gates on, so the headless admin/admin fallback is confirmed working for both bridges and not leaking to other providers. Pre-fix, all three rows failed with the same auth error.

Fix B (OpenDrive host normalization) was not run e2e (no OpenDrive account on the runner); it stays covered by the 4 normalize_opendrive_api_host unit tests plus static analysis. The reply to the reporter is posted on #368.

[axpnet]

AeroShare always-on, Windows local-STT build fix, the 5th file format and MSI shell-integration parity

Patches landed on main, shipping in v4.1.0 (tracker #1408). Four workstreams that went in together with the AeroShare always-on merge.

Area	Description	Status	Ref
AeroShare / discoverability	AeroShare is now always-on at launch (still Beta). Every surface used to be hidden behind the off-by-default aeroShareEnabled Settings flag, so the feature was undiscoverable. The Discover tile (E2E 256-bit badge), the titlebar +friend button (moved to the right of the theme toggle) and the handshake dialog are always visible now; adding a friend or sharing a folder auto-activates the feature (idempotent ensureAeroShareActivated) and lights up the richer surfaces (peer filter, friend cards, notification bell). The standing receiver is never auto-started: a one-time prompt lets you opt in or out of receiving, recorded so it shows once, both changeable from Settings	🟢 done	dfcd55cb
Build / Windows local-STT	The Windows image links the static MSVC runtime (+crt-static), but whisper-rs-sys builds whisper.cpp/ggml via CMake which defaults to the dynamic runtime (/MD), so the ggml objects linked /MD against the rest of the image /MT and failed with LNK2038 (RuntimeLibrary mismatch), LNK2005 and LNK1120 (unresolved __imp_* thunks) at the gui-lib link stage. Two MSVC-only CMake env vars in .cargo/config.toml force whisper.cpp to the static release runtime (CMAKE_MSVC_RUNTIME_LIBRARY=MultiThreaded plus CMAKE_POLICY_DEFAULT_CMP0091=NEW, needed because whisper.cpp pins cmake 3.5 where the policy defaults OLD), no crate fork. Inert on Linux/macOS; +crt-static and the default local-stt feature kept	🟢 done	0cb0f1b1, #344
File formats / associations	The README advertised five AeroFTP file formats but only four were OS-registered, so .aeroftp-script (it has an icon asset and sync_script.rs support) fell back to the blank-document icon. It is now registered on all OSes (tauri.conf fileAssociations, NSIS AeroFTP.Script ProgID plus MIME entry and uninstall cleanup, deb-postinst xdg-mime plus hicolor PNGs and SVG), matching the other four. A shared archive-family icon (amber box badge, distinct from the dark-red .aerozip and green .aerovault) was also added for the supported compressed formats (zip/7z/tar*/rar) as SVG, hicolor PNG, .ico and a draft .icns	🟢 done	52de7b04, bb45b024
Installer / MSI parity	A new installer/associations.wxs (wired via bundle.windows.wix.fragmentPaths plus componentGroupRefs) brings the MSI installer to parity with hooks.nsh: the Extract Here / Extract to Folder verbs on the 8 general archive formats and the 2 aero archive ProgIDs, the 5 aero mimetype DefaultIcons, and the generic aeroftp.exe DefaultIcon fallback. All HKMU (perMachine resolves to HKLM), additive verbs only with no default-handler hijack (decision c); hooks.nsh gains the matching DefaultIcon fallback for NSIS/MSI lockstep	🟢 done	c33e0570

Verified: each claim re-checked against the source on main (whisper .cargo/config.toml env vars present with +crt-static intact; MSI fragmentPaths + AeroFTPShellIntegration componentGroup wired and associations.wxs HKMU/perMachine; fileAssociations now lists all 5 formats; AeroShare Discover tile, titlebar +friend and dialog host all rendered unconditionally, the receiver gated behind the one-time opt-in, the 4 aeroShare.activate.* keys translated in all 47 locales). The MSI parity was additionally live-validated on Windows (WiX ICE-clean, MSI Registry 87 rows, elevated install/uninstall with the .zip default unchanged). CI on 579ecb846: Checks and Aerorsync green; the multi-platform Build AeroFTP (deb/NSIS/MSI/dmg) was still running at post time.

[axpnet]

AeroShare always-on follow-up: draggable hub dialog + a status-bar receiver indicator

Patches landed on main, shipping in v4.1.0 (tracker #1408). Two UX follow-ups on the always-on AeroShare (row 28).

Area	Description	Status	Ref
AeroShare / hub dialog	The AeroShare hub opened as a fixed centered modal that could not be moved, so it covered the Discover grid behind it with no way to nudge it aside. It is now draggable by its title header (reusing the shared useDraggableModal hook, the same pattern as the other modals): the panel translates within the window clamped to a 12px margin, and buttons/inputs/the close X never start a drag	🟢 done	3fc5ebc5
AeroShare / status bar	The standing receive loop's state lived only in Settings and the one-time activation prompt, with no at-a-glance view or quick toggle. A status-bar pill next to AeroCloud now mirrors the AeroCloud pattern: emerald with a steady dot when the receiver is on, neutral when off, and a click flips it (it patches the aeroShareReceiving setting that the hub already acts on, so there is no duplicate loop). It is reframed from Ehud's "put AeroShare next to AeroCloud" suggestion as a status indicator rather than a fourth launcher, since the +friend titlebar button, the My Servers button bar and the Discover tile already open the hub. Shown only once AeroShare is activated	🟢 done	1a8da046, #284 (@EhudKirsh)

Verified green: tsc --noEmit, i18n validate (47/47 locales, no new keys), vitest 376/376.

[axpnet]

Provider offline-test coverage: Phase B Group B complete (#347 row 4 closed)

Post-4.0.9 follow-up, done on main, shipping in v4.1.0 (#347).

This finishes the row-4 request: a deterministic, no-network regression net across every unit-only storage provider. Group B held the providers whose status/parse logic was inline in an async method rather than a separable parse_error. For each, the honest behaviour-preserving move was either to lift the one genuinely centralizable pure decision into a tested function, or, where the listing/parse logic was already pure, to add deterministic parser tests directly. No surfaced message changed.

Area	Description	Status	Ref
4shared	classify_fourshared_auth(status) extracted from check_auth_status (401 = OAuth token revoked/invalid, all else passes); the tracing::warn! stays in the caller	🟢 done	6bd2941a
kDrive	classify_kdrive_connect_auth(status, drive_id) extracted from the connect handshake (401 invalid token, 404 unknown drive with the id embedded; other statuses defer to the body-bearing path)	🟢 done	523f0603
Drime	drime_status_is_retryable(status) extracted from the list/find retry loop (any 5xx plus the transient 4xx set 404/408/425/429)	🟢 done	53fc2c06
Jottacloud	offline tests for the already-pure parse_folder_xml: live folders vs deleted, COMPLETED files vs incomplete/trashed, base-path join, size/mime/md5, garbage tolerance	🟢 done	2b36c30a
Zoho WorkDrive	offline tests for the pure quota chain parse_byte_amount / parse_byte_amount_value / find_byte_amount_by_keys (unit + comma + spaced/glued, JSON value shapes, recursive key walk)	🟢 done	b20d2dbb
Internxt	offline tests for the pure naming/size helpers extract_size, get_filename (plainName to name to "unnamed" with type extension), split_name_ext	🟢 done	cb47474b

Swift is intentionally skipped: its only profile, Blomp, is inactive, so a parser net for it has no value today. With this batch all 16 row-4 providers are covered (Phase A: Azure, Immich, sanitizer; Phase B Group A: Koofr, Yandex Disk, Cloudinary, Uploadcare; Phase B Group B: GitLab, Filen, then the six above; GitHub was already covered). Row 4 is now done.

Verified green: cargo fmt --all -- --check clean, cargo clippy --lib --tests -- -D warnings clean, and cargo test --lib = 2418 passed, 0 failed, 10 ignored (the 10 new tests included). One reviewable commit per provider.

[axpnet]

Quick Connect connectors aligned to one two-column layout (#215)

Post-4.0.9 follow-up, done on main, shipping in v4.1.0 (#215, reported by @EhudKirsh).

The Quick Connect (Add Service) pages were born at different times, so some connectors were single-column and others two-column. They now share one layout: the same right column (profile name + icon, Local/Remote Path, Wrappers/Overlays) is used everywhere, including the OAuth cloud pages, which previously had no overlay option at all.

Area	Description	Status	Ref
Layout	The single-column connectors render the shared renderRightColumn via a rightColumn render-prop instead of bespoke per-form columns. The 8 OAuth clouds (Google Drive, Google Photos, Dropbox, OneDrive, Box, pCloud, Zoho WorkDrive, Yandex Disk) join the two-column forms and the wide card	🟢 done	b94fdf085, ce353d791
Overlays on OAuth	OAuth pages now expose Wrappers / Overlays: a transparent crypt overlay (rclone-crypt or AeroCrypt) is activatable on the 7 overlay-eligible OAuth backends, hidden on Google Photos (media-only API, no arbitrary file CRUD). The overlay binding persists through the OAuth save path	🟢 done	ce353d791
Field order	Local Path now sits above Remote Path in every form: a local folder is set in almost every case, the remote path is optional for most providers (writable root)	🟢 done	ce353d791
Icon + name	The profile name with a clickable Google-Docs-style icon avatar moved to the top of the column	🟢 done	b94fdf085
Active state	The "Connect to X" button is disabled once already authenticated (reconnect from My Servers), re-enabling after logout	🟢 done	ce353d791

GUI-only, no backend protocol change. The layout is still independent profile records under the hood, each individually exportable.

Verified green: npm run build (tsc + vite), i18n:validate 0 placeholders across 47 locales. No Rust touched.

[axpnet]

"Active Sessions" sidebar filter now appears for Quick Connect re-auths

Post-4.0.9 follow-up, fixed on main, shipping in v4.1.0 (#128 lineage, the #128-C contextual filter).

A Quick Connect connection (notably an OAuth re-auth) is driven by the form, not launched from a saved card, so it carried no savedServerId. Such a session showed in the header Active Sessions badge (a jump-to-sessions shortcut that counts raw session tabs) but never in the sidebar Active Sessions filter, whose count and result are both keyed on the set of session savedServerIds: the filter narrows the saved-server grid to s => activeProfileIds.has(s.id), so a session with no saved id has no card to show. The two were never meant to share a source (a counter that jumps vs. a filter that narrows the grid); the gap was that a re-authed session was not bound to its saved card.

Area	Description	Status	Ref
My Servers / Quick Connect	connectToFtp now binds a Quick Connect connection to its matching saved profile before creating the session, so the session carries the right savedServerId and lights up both the badge and the grid filter	🟢 fixed	893236413
Matching (credentials)	FTP/SFTP/S3/WebDAV/API: precise unique match on protocol + username + host via the existing resolveLiveProfile guard (no match leaves it unlinked, as before)	🟢 fixed	893236413
Matching (OAuth)	OAuth saved profiles carry an empty username and host = displayName, so the credential match cannot bind them: a provider-unique fallback links the session only when a single saved profile exists for that provider, so multiple accounts of the same provider are never mislinked	🟢 fixed	893236413

The badge (jump-to-sessions) and the filter (narrow the grid) keep their distinct roles; the re-authed session now appears in both.

Verified green: typecheck (tsc --noEmit), i18n:validate (47 locales, 0 missing), vitest 376/376. Frontend-only change, no backend or i18n string touched.

[axpnet]

Wrappers / Overlays opens by default on the Quick Connect page

Quick Connect polish, done on main, shipping in v4.1.0 (#215, #276 lineage, requested by @EhudKirsh).

The collapsible Wrappers / Overlays section on the Quick Connect page started collapsed, so reaching the transparent crypt overlay meant an extra click into a nested section. When closed it only hides a single enable checkbox, and you have to tick that checkbox to configure anything anyway, so collapsing it by default just buried the option one level down for no payoff. It now opens by default while staying collapsible, so anyone who wants the page tidy can still close it.

Area	Description	Status	Ref
Quick Connect / UI	overlaysExpanded now defaults to true for new profiles, and stays expanded when editing a saved profile (previously it opened only when a crypt binding already existed). The section header and chevron still toggle it closed	🟢 done	156031b8

Verified green: npm run build (TSX only, no new i18n strings).

[axpnet]

#215 export/import: per-protocol credentials survive, and the CLI can back up profiles natively

Post-4.0.9 follow-up, done on main, shipping in v4.1.0 (#215, reported by @EhudKirsh).

Two backend pieces for the Quick Connect redesign landed. First, Caveat A: a profile that holds one online account across several protocol modes (e.g. a Koofr account saved as Native API + WebDAV) now keeps each mode's saved credentials when the profile is exported and re-imported. Before, export/import dropped them, so every per-protocol login had to be re-entered on the new device. Second, the GUI's native profile backup finally has a CLI equivalent.

Area	Description	Status	Ref
Quick Connect / Export-Import	Per-protocol credential snapshots (server_modes_<id>), the persistModeCredentials opt-in and the OAuth Remote Path now round-trip through profile export/import. The "has credentials" import badge also reflects every secret kind (OAuth, Jottacloud, crypt-overlay and the new snapshots), not only OAuth/Jotta	🟢 fixed	2fc7d32c
CLI	New aeroftp-cli profile-export / profile-import: native, password-encrypted .aeroftp profile backup, byte-compatible with My Servers > Export/Import (a CLI-exported file imports in the GUI and vice versa). Reuses the GUI's exact code path, so the credential collect/restore including the snapshots above is not duplicated; secrets are opt-in via --include-credentials	🟢 done	4627dc26

Verified green: cargo fmt, clippy --all-targets --all-features -D warnings (0 warnings), cargo test --lib (2419 passed), npm run build, i18n (0 needing translation). Plus a live round-trip with the real aeroftp-cli binary across two isolated vaults (profiles and a saved credential survive; a credentialed re-export confirms it), and a vault-glue check proving the server_modes snapshot restores through the shared core.

[axpnet]

Filen S3 empty-folder rename now explains itself instead of leaking a raw 401

Post-4.0.9 follow-up, fixed on main, shipping in v4.1.0 (#368, reported by @EhudKirsh).

S3 has no native folder rename, so AeroFTP emulates it as copy-then-delete of the underlying objects. An empty folder on Filen's local S3 bridge is a virtual prefix with no marker key, so there is nothing to copy and the rename cannot succeed server-side. AeroFTP already detected this and returned an actionable message, but only when the bridge answered the probe with 404 (as the Linux bridge does). On the Windows bridge the same probe answers 401, which slipped through as the cryptic HEAD on rename source returned status 401.

Area	Description	Status	Ref
Providers / S3	A 401/403 from a Filen S3 endpoint on the empty-folder rename probe now maps to the same actionable message as 404 ("add a file inside the folder first, or use the native API / WebDAV bridge"), instead of leaking the raw HTTP status. Renaming real files and non-empty folders is unaffected (they answer 200 and proceed); the guard is scoped to is_filen_s3_endpoint() so other S3 backends keep the raw status	🟢 fixed	3ae5e8cc

Verified green: cargo check, cargo clippy (no warnings), cargo test --lib providers::s3 (44 tests). The 401 arm reproduces only on the Windows Filen bridge (the Linux bridge returns 404), so the live confirmation on that path is owed on the released v4.1.0 build and will be checked together with the reporter.

[axpnet]

Pre-release security audit remediation (AeroShare, AeroAgent, per-user, CLI, extract)

Post-4.0.9 follow-up, fixed on main, shipping in v4.1.0. An adversarial multi-agent security and correctness audit of the whole v4.0.9..HEAD delta (the 4.1.0 feature set) surfaced 7 verified findings: 2 High, 2 Medium, 3 Low. This commit closes 6 of them, the two High blockers, the Medium cross-user leak, and all 3 Low. One Medium (knock/action flood from strangers) needs a mute / rate-limit UX and is tracked for 4.1.1.

The two High findings both broke a containment promise: AeroShare drive replication could write or delete outside the chosen folder, and the AeroAgent diagnostics tool could execute workspace code with no approval. Both are closed.

Area	Description	Status	Ref
AeroShare P2P	(High) Drive-replicate path traversal. run_docs_replicate wrote and deleted files at out_path.join(rel_key) with rel_key taken verbatim from the publisher-controlled manifest, so a malicious or phished-into-accepting capability could escape the chosen replica folder (arbitrary write/delete, RCE via ~/.bashrc/autostart). New safe_replica_path() rejects empty, absolute, rooted and .. keys, applied to the initial write, the live-converge write and the deletion path (+unit tests)	🟢 fixed	8e172771b
AeroAgent	(High) coding_diagnostics executed code without approval. It ran cargo check (build.rs / proc-macros), tsc and eslint (project JS config) inside an LLM-chosen workspace yet was classified ReadOnly and not approval-gated, unlike the byte-identical commands under run-checks/verify. Now added to the approval gate, DangerLevel ReadOnly to Medium, docs corrected (+regression tests)	🟢 fixed	8e172771b
Per-user partitions	(Medium) Cross-user legacy seed leak. The one-time seed from the legacy GLOBAL vault blob copied the original user's groups/favourites into any newly-created account that read first. New seedActiveSettingFromLegacyGlobal() seeds only for the single migrated owner, then consumes (deletes) the global blob	🟢 fixed	8e172771b
AeroAgent	(Low) Approval dialog hid the command. The run-checks / verify / diagnostics approval prompt showed only the workspace, not which command (e.g. npm-build runs an arbitrary script). It now surfaces check/filter/source/checks	🟢 fixed	8e172771b
CLI export/import	(Low) profile-import clobbered "skipped" credentials. The shared core restored every secret before the caller deduped, so a profile reported as "skipped (already present)" had its vault credential silently overwritten. New import_server_profiles_core_filtered(restore_only) + two-phase CLI (preview, then restore only the newly added ids)	🟢 fixed	8e172771b
Extract verbs	(Low) Every encrypted-archive error read "wrong password". A real failure (disk full, unwritable destination) was relabelled wrong-password and looped on the prompt. New isWrongPasswordError() routes only password-shaped errors back to the prompt; real failures surface their message (+tests)	🟢 fixed	8e172771b
AeroShare P2P	(Medium, deferred) Knock/action flood from strangers. Knocks and actions from any authenticated peer who knows your AFID pop UI / notifications with no friend-gate or rate-limit (attention-DoS, no data compromise). Deferred to 4.1.1: needs a per-sender mute + setting	🔵 planned	#284

Verified green: cargo check --workspace --all-targets, cargo clippy --workspace --all-targets -D warnings (plus the separate peer-l0 crate), the Rust tests for the touched modules (peer-l0 replica_path, profile_export, ai_tools approval), tsc --noEmit, and the full vitest suite (378 tests).

[axpnet]

OpenDrive privacy: editable Permissions, per-account default, and a CLI verb (#252)

Post-4.0.9 follow-up, fixed on main, shipping in v4.1.0 (#252, reported by @EhudKirsh).

The original OpenDrive privacy bug from #252 was fixed back in v4.0.1; this closes the two follow-ups that were kept open: a cleaner, editable privacy surface, and a per-account default for new items. A CLI counterpart was added so the same control exists outside the GUI.

Area	Description	Status	Ref
GUI: Permissions tab	OpenDrive privacy is editable in Properties > Permissions (Private/Public/Hidden) for a single item and for a multi-selection ("Apply to N items"), reusing the existing three-level command	🟢 fixed	4e1086308
GUI: context menu	The standalone Set as Private / Set as Public / Privacy... / Make all private entries collapse into one "Permissions..." entry, which removes the "a hidden item shows both" bug by construction	🟢 fixed	4e1086308
GUI: default privacy	A per-account Default privacy for new items selector on the OpenDrive Quick Connect, applied to mkdir and to uploaded files; backward compatible (unset keeps the previous behaviour)	🟢 fixed	4e1086308
CLI	New aeroftp-cli access <path> --to private/public/hidden sets the privacy of an existing file or folder, the CLI counterpart of Properties > Permissions; synced into the dispatcher allowlist and agent-info	🟢 fixed	4e1086308
Linux	File pickers routed through xdg-desktop-portal to avoid a WebKitGTK GtkFileChooser GLib heap corruption ("malloc(): unaligned fastbin chunk detected")	🟢 fixed	4e1086308

Verified end to end against a real OpenDrive account via the CLI: mkdir, put and the new access verb at all three privacy levels, confirmed by ls -l. i18n: 5 new keys translated across all 47 locales (i18n:validate green).

[axpnet]

✅ Released as v4.1.0.

Everything queued in the table above shipped in v4.1.0, now published (release notes). The headline is AeroShare, a Beta preview of direct, end-to-end-encrypted device-to-device transfer with no server in the middle: send a file or a folder straight to another person over a peer-to-peer channel (iroh 1.0 with Mainline-DHT discovery and federated relays), always-on at launch with a Discover tile, a titlebar +friend button, a draggable hub and a status-bar receiver indicator (#284, @EhudKirsh).

Alongside it:

• AeroAgent coding loop (foundation): a curated, GUI-only and approval-gated tool set for local development (ripgrep search, structured cargo/tsc/eslint diagnostics, git read plus stage and commit, run-checks and verify, safe patch with automatic checkpoints, review cards), with no change to the transfer or file-management tools.
• Security hardening: the P2P stack migrated from iroh 0.92 to 1.0 (clearing 6 Dependabot alerts), the in-app sigstore update verification verifies for real again (sigstore 0.14 parses GitHub's v0.3 bundles), and a pre-release adversarial security audit of the whole v4.0.9..HEAD delta closed 6 of 7 verified findings (2 High path-traversal/ungated-exec blockers, the per-user legacy-seed leak, 3 Low); the remaining Medium knock/action flood is deferred to v4.1.1 (#1409).
• Per-user server groups and favourites (#311): groups and favourites moved out of the single global blob into each user's encrypted partition, with the default user promoted to a real is_default DB column; plus the interactive CLI New(N) verb, groups -i member add/remove, the safe-first action bars, and native profile-export / profile-import (#215).
• OpenDrive privacy gaps closed (#252): item privacy is editable in Properties > Permissions for a single item or a multi-selection (Private/Public/Hidden), the OpenDrive Quick Connect gains a per-account Default privacy for new items, and a new CLI verb aeroftp-cli access <path> --to private/public/hidden sets the privacy of an existing file or folder (plus --access on put / mkdir).
• aero benchmark real defects fixed (#368): guarded scratch-base cleanup, mkdir-parents scratch tree, a protocol column, a public-IP fairness snapshot, [k/N] progress and a Yandex region hint; the Filen Desktop bridges work headless (CLI/benchmark/MCP/schedulers), the OpenDrive native host self-heals to dev.opendrive.com, and an empty-folder rename on a Filen S3 bridge now explains itself instead of leaking a raw 401.
• OS "Extract here / to folder" verbs for archives and vaults on Nautilus and the Windows shell (NSIS + MSI parity), Windows USB eject (#351), .aeroftp-script registered as the 5th OS file format, Quick Connect connector harmonization, and the Transfer Queue per-item bar advancing on Crypt overlays (#364). 47 languages translated.

Per the tracker convention, 4.1.0 patches accumulated here; the next line gets its own tracker. The next release is v4.1.1, tracked in #1409. Known issues found in 4.1.0 will be logged there as reports come in; reporters close their own issues after confirming the fix in the release.

Thanks to @EhudKirsh and everyone who reported, tested and suggested.