[Tracker] AeroFTP 4.1.1 - Known issues, patches & updates

[axpnet]

AeroFTP 4.1.1, Rolling Tracker

Umbrella issue for the next AeroFTP point release (v4.1.1): known issues reported against v4.1.0 and the patches/updates landing on main after the v4.1.0 tag.

Status note: the current published release is v4.1.0 (release notes, its tracker is #1408, now closed); this tracker collects what lands on main for v4.1.1.

Before opening a new issue, please check the lists below. If your problem is already tracked here, just add a thumbs-up reaction or a comment with your environment (OS, version, provider) instead of filing a duplicate. We update this issue as bugs are found and fixed.

Found something that is not listed? Open a new issue and we will link it here.

What shipped in 4.1.0

See the v4.1.0 tracker (#361) for the full 4.1.0 change set (AeroShare P2P Beta, AeroAgent coding loop, per-user groups/favourites, the iroh 1.0 / sigstore 0.14 security hardening, the OS extract verbs, and the pre-release security audit remediation).

Patches & updates queued for 4.1.1

Done on main, shipping in the next release. Items appear here as they land.

#	Type	Change	Status	Commit	Ref
1		AeroShare "reveal received file" now selects the file in the file manager on Linux instead of opening it in its default app. The Linux path reveals-and-selects via the D-Bus org.freedesktop.FileManager1.ShowItems method (Nautilus, Dolphin, Nemo, Caja), with the path percent-encoded into a file:// URI, and falls back to opening the parent folder on minimal distros without that service. Directories keep using xdg-open. Matches the Windows /select, and macOS -R paths	🟢	843c94c4f	-
2		The "Open Cloud Folder" tray entry is now disabled when AeroCloud is off, guarding the stale-enabled case where the menu pointed at the unrealised ~/AeroCloud default and opened a non-existent path	🟢	7cbbada32	-
3		Duplicating a saved profile now copies every stored secret, not just the main password. The copy cloned the profile object (carrying its has-stored-secret flags) but wrote only the server_<id> vault entry under the new id, dropping the per-mode credential snapshot (server_modes_<id>, where a multi-mode Filen account keeps its real password), the Filen CLI key (filen_api_key_<id>) and the AeroCrypt overlay password and salt (aerocrypt_overlay_pw_<id> / aerocrypt_overlay_salt_<id>), so the copy opened blank and could not connect. The duplicate now copies each per-profile vault key and recomputes every flag from what actually copied	🟢	566d5cc5e	-
4		An rclone-crypt overlay connection now opens at the configured Remote Path instead of the provider root. The rclone-crypt unlock moved only the FTP current dir while the post-unlock decrypted reload listed with a null path, so it fell back to the provider root (navigating into the folder by hand still decrypted correctly). The reload now anchors to the session's bound overlay scope as a plaintext-absolute path; AeroCrypt native was unaffected and a whole-root overlay keeps the previous behaviour	🟢	83dab043c	-
5		A 2FA-protected connection to an encrypted-overlay profile now unlocks the overlay after the code is entered. Without 2FA the overlay worked; with 2FA the retry re-entered through the Quick Connect path (connectToFtp), which had none of the saved-profile overlay logic, so after the code the panel landed on the encrypted root with files undecrypted and no overlay badge. The retry now runs the same overlay activation as the saved-server connect (suppress the encrypted listing, arm the unlock, anchor at the bound scope); Quick Connect and non-overlay profiles are unaffected	🟢	0f42d1c9c	-
6		7z create with encrypted header (-mhe) to hide filenames, opt-in like 7-Zip's "Encrypt file names" checkbox under the password: off keeps content-only encryption (names readable), on hides the names too and then requires the password even to list the archive. Migrated from the unmaintained sevenz-rust 0.6 to sevenz-rust2 0.21 (set_encrypt_header, the small-header and traversal-write fixes). Wired into the Compress dialog and the CLI (aeroftp compress --encrypt-names); the existing encrypted-archive password flow already opens these in the GUI browser and the standalone extract window	🟢	b9881038c	#365
7		AeroShare anti-flood gate and discovery opt-out (the two AeroShare P2P follow-ups deferred from the v4.1.0 audit, see the Security section below). Inbound knocks, actions and file offers are now gated before they reach the UI: a per-sender mute (always on), an optional friends-only allowlist (off by default to preserve first contact), and an in-memory sliding-window rate limit (default 20 signals per sender per minute, 0 disables). The long-term AFID can be kept off the public DHT via a new none discovery mode, with the mode now a persisted per-partition setting (both/dht/n0/none, all exposed in Settings), plus a destructive AFID rotation guarded by a two-step confirm. New peer_mutes + peer_settings tables, Tauri commands, an AeroSharePrivacySettings panel, a Mute-sender action on the knock prompt, 29 i18n keys across 47 locales. The pre-release audit hardening also stops every live served share before AFID rotation and applies the persisted discovery mode to outbound send/knock/action/presence endpoints	🟢	9cd2e7c43, 2ab13baac	#284
8		Kilo Gateway added as a native AeroAgent AI provider: an OpenAI-compatible gateway (api.kilo.ai/api/gateway) routing to many open and free models behind one key, including the rotating Auto Free model (kilo-auto/free, 256K context, no credits required), plus paid Anthropic, OpenAI and Mistral with a signup credit. Wired through the existing OpenAI-compatible dispatch: TypeScript type and preset, a marketplace entry (Gateway category, freemium), prompt and parameter profiles, a KiloIcon and the three provider icon switches, the Rust enum variant, and CLI parity (provider name, base URL, default model kilo-auto/free)	🟢	74cea07b4	#382
9		FTPS and other TLS connections from aeroftp-cli no longer crash on connect, and FTP error handling is hardened. The CLI never installed a rustls CryptoProvider while both aws-lc-rs and ring were in the dependency tree, so the first TLS handshake (FTPS, WebDAV over https) panicked with "could not automatically determine the process-level CryptoProvider"; this pre-dated the bump (the previous suppaftp 8.0.3 panicked identically) and is fixed by pinning aws-lc-rs once at startup. Alongside, suppaftp was bumped 8.0.3 to 10.0.0, which replaces its internal panics on malformed server responses with proper FtpError / ParseError results and closes RUSTSEC-2026-0009 (stack exhaustion via time, now 0.3.47); the two intervening majors do not touch our tokio + rustls path. Validated live on the axpbuntu lab: plain FTP and explicit FTPS put/get round-trips are byte-identical	🟢	263628069, 92950b59f	-
10		The 7z compression level now takes effect. The Compress dialog's Fast/Normal/Maximum buttons and the CLI's --level were handed to the 7z encoder but then dropped, so every 7z used the library default preset; the create path now maps the 0-9 level onto LZMA2's preset (Lzma2Options::from_level, unset defaults to 6) in both the password and the plain branch. A unit test compresses a payload with a long-range repeat at level 1 and level 9: only level 9's larger dictionary deduplicates it, so its archive is markedly smaller, proving the level reaches the encoder. The CLI help and CLI-GUIDE, which still said 7z ignored the level, are corrected	🟢	7ba2f72bf	#365
11		Crypt-overlay profiles (AeroCrypt and rclone-crypt) are now encrypted end to end through one transparent decorator, whichever part of the app touches them. An AeroSync compare/sync mismatch on a crypt profile (Ehud) revealed the overlay was applied ad hoc per command, so surfaces that resolved a provider on their own (CLI, cross-profile, agent, MCP, GUI, AeroCloud background sync, the selective-sync folder tree) bypassed it and wrote plaintext into the encrypted store or read ciphertext back. Introduced the CryptOverlayProvider decorator wired once at every provider resolver chokepoint, fail-closed (a bound-but-locked vault is refused, never downgraded to raw), retired the legacy per-command crypt layer, and shipped the transfer fixes surfaced during live-verify (Stop-abort, Resume, edit-in-place guard). The pre-release audit hardening also prevents CLI/MCP compare from decrypting an already wrapped provider twice and lets crypt-wrapped GitHub profiles use the generic encrypting write path instead of failing a GitHub downcast. Full before/after and surface coverage in the follow-up comment	🟢	eaaed9b1b, 2ab13baac	-
12		The AeroTools bottom panel (Editor, Terminal, the AeroAgent chat and its header band) now follows the Ice theme instead of rendering dark. Ice is a light (frost) theme with no .dark class, and the panels only had a light case plus a dark default, so Ice fell through to dark with unreadable header-button text. The AI Settings and Add/Edit Model modals are also now draggable by their header like the other modals	🟢	000adf2f5	#347 (@EhudKirsh)
13		Benchmark selection and feedback improvements. aero benchmark --group <NAME> (repeatable, comma-aware) benchmarks the members of a My Servers group and --all benchmarks every saved profile, so a comparison needs no manual list; a profile-type column disambiguates multi-protocol profiles in the comparison table; the many-small-files run shows a live progress bar instead of a blind wait; and a mid-run public-IP change that reverts before the sweep ends still flags the comparison as not comparable. Closes requested items 14/15/16 and Ehud's --group/--all ideas	🟢	3d44b068a	#277 (@EhudKirsh)
14		The master-password lock screen now has the window controls (minimize/maximize/close) and a top drag region, mirroring the account picker, so the window can be moved and controlled before unlocking. Clicking a line number in the text preview also now selects that whole line, and dragging across the numbers extends the selection, IDE-gutter style. Closes requested item 17	🟢	467d4ec41	#347 (@EhudKirsh)
15		v4.1.1 pre-release audit hardening. Closed the blocker-class findings found while auditing the bundle before release: crypt compare/reconcile no longer double-handles already wrapped CLI/MCP overlay providers; shaped multipart Stop now cancels begin/part/commit and aborts the provider session; AeroShare AFID rotation stops live served shares; outbound AeroShare endpoints apply persisted discovery preferences even when the receiver is off; crypt-wrapped GitHub profiles skip GitHub-only downcasts and use the generic encrypting write path; GitHub executor uploads are cancel-aware; plus Google Drive folder-only mkdir idempotence and crypt-overlay temp/path hardening	🟢	2ab13baac	#1409

Security follow-ups (deferred from the v4.1.0 pre-release audit)

Verified findings from the v4.1.0 adversarial audit that were intentionally deferred (the 6 confirmed bugs were fixed in v4.1.0, see #361).

#	Area	Description	Status	Ref
1	AeroShare P2P	(Medium) Knock/action flood from strangers. Knocks and actions from any authenticated peer who knows your AFID surface UI modals / notifications with no friend-gate or rate-limit (attention-DoS, not data compromise). Fixed: per-sender mute (always on), an optional friends-only allowlist (off by default), and a sliding-window rate limit (default 20/min per sender, 0 disables), applied to knocks, actions and file offers	🟢 done (4.1.1)	9cd2e7c43, audit, #284
2	AeroShare P2P	(Info) Stable AFID published to the public DHT. The receiving endpoint publishes the long-term AFID / NodeId to the public Mainline DHT plus n0 DNS (by-design iroh discovery, not a code bug), so a stable AFID is correlatable/enumerable while receiving is on. Fixed: new none discovery mode (publishes to neither DHT nor n0), discovery mode is now a persisted per-partition setting (both/dht/n0/none), plus an opt-in destructive AFID rotation. Pre-release audit hardening also applies the persisted discovery mode to outbound identity endpoints after restart and stops live served shares before rotating the AFID	🟢 done (4.1.1)	9cd2e7c43, 2ab13baac, audit

Requested / under consideration

Community ideas captured for triage. Not committed to a release yet. Carried over from the v4.1.0 tracker.

#	Type	Request	Status	Source
1		Windows hotplug detection in the AeroFile PLACES sidebar is slow: a freshly inserted drive can take up to ~30s to appear, because the real-time volume watcher is Linux-only (inotify) and Windows/macOS fall back to a 30s poll. A Rust-side WM_DEVICECHANGE listener emitting volumes-changed on device arrival/removal would make it instant; lighter mitigations are a refetch on window focus or a shorter poll interval. Surfaced during the #351 eject verification on real Windows hardware	🔵 idea	#351 (@EhudKirsh)
2		MTP / portable-device provider for AeroFile: surface attached MTP/WPD devices that have no drive letter (phones, cameras; the reporter's Sony Xperia is one) in PLACES, browse the object tree as a virtual path, and copy whole files to and from the device. A design appendix is written (design only, no implementation): it documents the protocol and its hard MTP/OS limits (no real mount, no random access, no delta or resume, whole-file transfers only, best-effort metadata) so they are never read as an AeroFTP shortcoming, and maps the capability onto the existing StorageProvider trait, recommending a hybrid model. Implementation is a later, separate effort	🔵 idea	#351 (@EhudKirsh)
3		Eager-evaluation preview and a single-vs-multi-target placeholder for the -i selectors (prioritised by the reporter ahead of Edit(E) and the 2-letter semantics; exact behaviour to be pinned)	🔵 idea	#311 (@EhudKirsh)
4		In-section membership for users -i: a verb so users -i can add/remove groups to/from a user. The groups-side counterpart (groups -i a/x for member profiles) shipped in 4.1.0; this remaining users<->groups direction needs the data model pinned first, since groups live inside each user's partition	🔵 idea	#311 (@EhudKirsh)
5		Lossless .jpg to .jxl transcode in AeroFile: JXL re-encodes an existing JPEG losslessly and reversibly (the original JPEG bytes reconstruct exactly), for a real size win with no quality loss. Candidate framing: AeroFile as a GUI for libjxl	🔵 idea	aerovault#2 (@EhudKirsh)
6		Media handling principle for any AeroFile conversion: lossless or pass-through only, never a lossy-to-lossy re-encode (for example .mp3 to .opus is destructive and should not be done silently)	🔵 idea	aerovault#2 (@EhudKirsh)
7		Single pre-release smoke entrypoint: one command running the deterministic Rust + frontend suite and the lab-backed integration tests, clean-skipping when creds/Docker are absent, printing a pass/skip matrix, wired into the release checklist	🔵 idea	#347
8		The dedicated extract/password window (Deliverable G) could follow the system theme (light/dark) instead of always rendering light. Nice-to-have polish	🔵 idea	-
9		Register AeroFTP as an opener for compressed formats so the new archive icon shows (Deliverable G follow-up, deferred from v4.1.0): v4.1.0 shipped the yellow archive mimetype icon asset, the right-click extract verbs, and MSI<->NSIS installer parity, but NOT the shared AeroFTP.Archive ProgID + Windows Capabilities / RegisteredApplications / OpenWithProgids that make zip/7z/tar/rar actually display the icon and list AeroFTP under "Open with" and Settings > Default apps. Available-opener only, never a forced default (decision c). Needs both hooks.nsh and the WiX fragment, plus a clean-machine Explorer eyeball of the MSI icons (the v4.1.0 dev-runner check had HKCU competitors masking the render; the HKLM registry was verified correct)	🔵 planned	#1408 (Deliverable G)
10		macOS shell integration for the OS extract feature (Deliverable G macOS, deferred): Finder Sync "Extract Here / Extract to Folder" menu items mirroring the Linux Nautilus and Windows verbs, plus macOS custom document-type icons (CFBundleDocumentTypes) for the five aero formats and the generic fallback, and rebuilding the mimetype .icns multi-size (the v4.1.0 ones are single-resolution drafts). Needs a Mac to build and live-test	🔵 planned	#1408 (Deliverable G)
11		In-app "File associations" settings panel: per-format checkboxes to make AeroFTP the default opener, applied per OS: Linux via xdg-mime default (works immediately), Windows registers capabilities and opens the OS chooser (Windows 8+ blocks silent forced association, so honest copy "Windows will ask you to confirm"), macOS best-effort LSSetDefaultRoleHandlerForContentType. Cross-platform follow-up to the OS extract / icon work	🔵 idea	#1408 (Deliverable G)
12		Filen Encrypted Notes: exit Beta: take Filen Notes out of Beta. Fix the participants/add contactUUID format (currently a best-effort workaround), investigate the Filen free-plan 10-note limit ghost-note cleanup, and add a rich text editor for the rich note type	🔵 planned	-
13		Near-duplicate detection via fuzzy / perceptual hashing (ssdeep / TLSH / pHash) in AeroFile, complementing the existing byte-identical dedupe (BLAKE3, in the GUI Find Duplicates, the CLI aeroftp dedupe, and as an agent tool). Part of a broader principle: deterministic, repeatable file chores should run as ready-made native features or plugins, not through an LLM. The plugin lane (manifest plus script, no AI) is the natural home for these but is currently gated: the signed-registry client is unfinished and CLI plugin support is pending (Fase 6.4, Low). Related to the lossless jpg-to-jxl transcode already tracked above (item 5)	🔵 idea	#383 (@EhudKirsh)

Known issues found after release

Reported against v4.1.0. Fixed items ship in v4.1.1; reporters close after confirming in the release.

#	Area	Description	Status	Linked issue
1	Filen S3 (rename)	Renaming a folder whose name contains an emoji or other non-ASCII characters on Filen's S3 bridge fails with 401 The signature does not match. The folder-rename copy path listed child keys without decoding Filen's already percent-encoded keys, then encoded them again, so the signed x-amz-copy-source header was double-encoded and no longer matched the SigV4 signature. Fixed on main (324cd4bf6): decode Filen keys once in the key listing, mirroring the normal directory listing. The same fix covers recursive delete and copy-verification of unicode-named keys	🟢 fixed	#368 (@EhudKirsh)
2	Benchmark (OpenDrive API)	OpenDrive API uploads fail during aero benchmark with Incorrect chunk offset: uploaded=0, chunk_offset=5242880. The multipart parts were dispatched in parallel, but OpenDrive's chunked upload is strictly sequential: the server tracks the bytes received so far and rejects any chunk whose offset is not the next contiguous one. Fixed on main (324cd4bf6): OpenDrive multipart is sent as a single in-order stream. Pre-release audit hardening (2ab13baac) added the explicit DAG serial-part regression and cancel/abort safety for shaped multipart uploads	🟢 fixed	#368 (@EhudKirsh)
3	Benchmark (cleanup)	The aeroftp-bench scratch folder is left behind empty on Google Drive, MEGA and kDrive after a benchmark, while the other providers clean it up. The parent-folder removal was gated on preconditions these three break: non-idempotent mkdir on Drive and kDrive, the --test-root-prefix guard, and MEGA's soft-delete lag. Fixed on main (324cd4bf6): best-effort emptiness-guarded parent removal plus idempotent mkdir on Drive and kDrive. Pre-release audit hardening (2ab13baac) also makes Google Drive mkdir treat an existing item as success only when it is actually a folder	🟢 fixed	#368 (@EhudKirsh)
4	AeroFile (eject, Windows)	Ejecting a USB drive briefly flashes a console window on Windows. The eject helper spawned PowerShell without the no-window creation flag. Fixed on main (324cd4bf6): a shared no-window spawn helper, applied to eject and generalized to the rclone-import and scheduled-task spawns that share the same gap	🟢 fixed	#351 (@EhudKirsh)
5	AeroFile (eject, stale entry)	A just-ejected drive can linger in Other Locations for a few seconds, and ejecting it again shows an error. The sidebar re-read the OS mount table, which still reported the drive briefly after a successful eject. Fixed on main (324cd4bf6): optimistically drop the ejected device from the list on success, then reconcile shortly after	🟢 fixed	#351 (@EhudKirsh)
6	CLI benchmark TUI	The aero benchmark --tui profile picker flickers in split-screen when the footer help row wraps to a second line. The footer sits on the last screen row, so terminal auto-wrap scrolled the whole view on every keypress; the earlier fix (4e675d63b) only covered the non-wrapping fullscreen case. Fixed on main (324cd4bf6): disable line-wrap for the picker	🟢 fixed	#277 (@EhudKirsh)
7	AeroFile (text preview theme)	The text-file preview stayed dark on the Light and Ice themes. Added a scoped light-theme override so the preview follows the theme (toolbar, gutter, code, markdown). Fixed on main (e2d612a45), verified in the Light theme	🟢 fixed	#347 (@EhudKirsh)
8	AeroAgent (model modal theme)	The Add/Edit custom-model modal (and the "Available Models" modal) in AI Settings stayed dark on the Light and Ice themes, because they render outside the panel's themed scope. Fixed on main (e2d612a45) by bringing them into the AI-settings theme scope	🟢 fixed	#347 (@EhudKirsh)
9	AeroFile (preview scrollbar)	The text-preview scrollbar was too thin to grab. Widened it from 6px to 14px, scoped to the preview so the rest of the app keeps its slim bars. Fixed on main (e2d612a45)	🟢 fixed	#347 (@EhudKirsh)
10	Crypt overlay (OAuth)	The crypt overlay activated but never decrypted on OAuth cloud profiles (pCloud, Dropbox, OneDrive, Box, Google Drive). Turning on an AeroCrypt overlay on an empty cloud folder probes for its config file via exists(.aeroftp-crypt.json); pCloud reported that missing file with its "Directory does not exist" code (2005) mapped to a generic server error instead of not-found, so the overlay could not bootstrap and fell back to the raw encrypted view. Fix: map pCloud 2005/2010 to NotFound; audit and harden the same not-found mapping across the other cloud backends (kdrive and drime map a 404 to not-found, azure narrowed to 404/410, filelu verified safe). The OAuth connection-form connect now binds the profile id so the overlay also arms with 2+ accounts on one provider, and profile export/import now round-trips the BYO OAuth app client_id and secret. Fixed on main (d1e0bef90), verified live on real pCloud (encrypt/decrypt round-trip plus lock/unlock toggle)	🟢 fixed	#347 (@EhudKirsh)

_{Status legend: 🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released}

Affected platforms

• Windows
• macOS
• Linux

---

Maintained by the AeroFTP team. Current release v4.1.0 (#361), next v4.1.1. Patches accumulated here; each release line still gets its own tracker.

[axpnet]

Two post-4.1.0 Linux UX fixes on main

Post-4.1.0 follow-up, fixed on main, shipping in v4.1.1. Two small correctness fixes found and fixed in-house, queued as items 1 and 2 above.

Area	Description	Status	Commit
AeroShare (Linux)	The inbox "reveal file" action ran a plain xdg-open on the file, which OPENS it in the default app instead of revealing it. It now reveals-and-selects the file in the file manager via the D-Bus org.freedesktop.FileManager1.ShowItems method (Nautilus, Dolphin, Nemo, Caja), with the path percent-encoded into a file:// URI, falling back to opening the parent folder on minimal distros without that service. Directories keep using xdg-open. Brings Linux in line with the Windows /select, and macOS -R paths	🟢 fixed	843c94c4f
AeroCloud tray	The "Open Cloud Folder" tray entry is now disabled when AeroCloud is not configured, guarding the stale-enabled case where it would point at the unrealised ~/AeroCloud default and open a non-existent path	🟢 fixed	7cbbada32

Verified green: cargo fmt, clippy --all-features --tests and --bin aeroftp-cli with -D warnings, the full cargo test suite (exit 0), vitest 378/378, tsc typecheck, and i18n validate (0 missing, 0 needs-translation).

[axpnet]

Profile duplication and encrypted-overlay connect fixes (Filen / rclone-crypt / AeroCrypt)

Post-4.1.0 follow-up, fixed on main, shipping in v4.1.1. Three issues surfaced during live testing of the latest release: a profile copy that dropped its secrets, and two encrypted-overlay connect paths that did not open at the configured Remote Path (one of them with the overlay never activating under 2FA).

Area	Description	Status	Commit
Profile copy	Duplicating a saved profile cloned the object (carrying its has-stored-secret flags) but wrote only the server_<id> vault entry under the new id, dropping every other per-profile secret: the per-mode credential snapshot (server_modes_<id>, where a multi-mode Filen account keeps its real password), the Filen CLI key (filen_api_key_<id>) and the AeroCrypt overlay password and salt. The copy advertised stored secrets that never existed under the new id, so it opened blank and could not connect. The duplicate now copies each per-profile vault key and recomputes every flag from what actually copied.	🟢 fixed	566d5cc5e
rclone-crypt Remote Path	An rclone-crypt overlay connection opened on the provider root instead of the configured Remote Path (navigating into the folder by hand still decrypted). The rclone-crypt unlock moves only the FTP current dir, not the provider current dir (AeroCrypt's read_config cd's the provider and stays), and the post-unlock decrypted reload listed with a null path. The reload now anchors to the session's bound overlay scope as a plaintext-absolute path. AeroCrypt native is unchanged; a whole-root overlay keeps the previous null-path behaviour.	🟢 fixed	83dab043c
2FA + overlay activation	A 2FA-protected connection to an encrypted-overlay profile landed on the encrypted root with the overlay never unlocked: files stayed encrypted and no badge appeared, while the same profile without 2FA worked. The 2FA retry (and the saved-secret auto-retry) re-enter through the Quick Connect path connectToFtp, which had none of the saved-profile overlay logic. That path now runs the same overlay activation as the saved-server connect (suppress the encrypted listing, arm the decryption owner, set the deferred unlock that anchors at the bound scope). Quick Connect and non-overlay profiles are unaffected.	🟢 fixed	0f42d1c9c

Verified green: TypeScript typecheck (tsc --noEmit) clean, frontend unit suite 378/378 passing, i18n validate clean (0 errors, 0 missing, 0 NEEDS TRANSLATION across 47 locales). No Rust changes.

[axpnet]

7z encrypted header (-mhe): hide filenames, opt-in like 7-Zip

Post-4.1.0 follow-up, shipped on main, going out in v4.1.1 (#365). This closes the last 7z encryption gap: creating an archive that also hides the file names, not just their contents.

Until now a password-protected 7z encrypted only the content stream and left the filenames readable in the cleartext header. That was a limit of the unmaintained sevenz-rust 0.6. The fix migrates the whole 7z path to sevenz-rust2 0.21 and adds header (filename) encryption as an opt-in, exactly like 7-Zip's "Encrypt file names" checkbox that sits under the password.

Area	Description	Status	Commit
Create (-mhe)	compress_7z gained an encrypt_header flag threaded through the impl and the core. Off (default) keeps the classic behaviour: contents encrypted, names readable. On hides the names too, and the password is then required even to list the archive. Only applied when a password is set.	🟢 fixed	b9881038c
Dependency	Migrated from the unmaintained sevenz-rust 0.6 to sevenz-rust2 0.21 (ArchiveWriter / ArchiveReader API, set_encrypt_header). Picks up the 0.20.1 small-header encryption fix and the 0.21.1 extraction traversal-write hardening (on top of the existing per-entry path checks).	🟢 fixed	b9881038c
GUI form	The Compress dialog shows an "Encrypt file names" checkbox for 7z once a password is entered, mirroring 7-Zip. Cleared automatically when the format is not 7z or the password is empty.	🟢 fixed	b9881038c
CLI parity	aeroftp compress --encrypt-names exposes the same option (7z only, requires --password).	🟢 fixed	b9881038c
Read paths	extract, list, the encryption probe and the archive browser all move to the new ArchiveReader. The existing encrypted-archive password flow already opens -mhe archives end to end in both the GUI browser and the standalone extract window: is_7z_encrypted reports them locked, so the password prompt gates listing.	🟢 fixed	b9881038c

A unit test proves the filename never appears in the raw archive bytes (header truly encrypted) and that the password roundtrips. i18n: the new strings are translated across all 47 locales.

Verified green: cargo fmt, cargo clippy --all-features --tests --bin aeroftp-cli -- -D warnings, the affected unit test, TypeScript typecheck, the frontend suite (378/378), and i18n validate (0 missing, 0 NEEDS TRANSLATION across 47 locales).

[axpnet]

AeroShare anti-flood gate and discovery opt-out

The two AeroShare P2P follow-ups deferred from the v4.1.0 pre-release audit, fixed on main, shipping in v4.1.1 (#284, audit).

Both were intentionally deferred from the v4.1.0 audit (the 6 confirmed bugs shipped in v4.1.0). The first was a Medium attention-DoS, the second an Info-level privacy hardening idea. Both are now closed.

#	Area	What changed and why	Status	Commit
1	Anti-flood (Medium)	Inbound knocks, actions and file offers from any cryptographically authenticated peer used to surface a modal or notification with no friend-gate or rate-limit. The receive loop now applies a per-partition gate before emitting: a per-sender mute (always on), an optional friends-only allowlist (off by default to preserve first contact), and an in-memory sliding-window rate limit (default 20 signals per sender per minute, 0 disables). The gate fails open on a vault read error, since it is a DoS mitigation, not an authorization boundary (every sender is already authenticated by iroh)	🟢 fixed	9cd2e7c43
2	Discovery opt-out (Info)	The receiving endpoint published the long-term AFID to the public Mainline DHT and n0 DNS with no way to opt out. A new DiscoveryMode::None publishes to neither, and the discovery mode is now a persisted per-partition setting (both, dht, n0, none) read by the endpoint builder, with the AEROFTP_PEER_DISCOVERY env var keeping precedence. All four modes are exposed so each user picks reachability versus privacy. Plus a destructive AFID rotation (mint a fresh identity, restart the receiver under it) guarded by a two-step confirm	🟢 fixed	9cd2e7c43

Surfaces: new peer_mutes and peer_settings tables (public material, no DEK), Tauri commands (peer_contact_mute/unmute, peer_mutes_list, peer_settings_get/set, peer_identity_rotate), an AeroSharePrivacySettings panel (friends-only, rate limit, discovery, muted list, rotation), and a Mute-sender action on the knock prompt. Defaults are suggested, everything is changeable in Settings.

Verified green: cargo fmt, clippy lib and --bin aeroftp-cli (--all-features --tests -D warnings), the peer and user_partitions test suites plus 3 new unit tests (mute, settings, contact allowlist), tsc --noEmit clean, and i18n:validate at 0 [NEEDS TRANSLATION] across all 47 locales (29 new keys).

[axpnet]

Kilo Gateway is now a native AeroAgent AI provider

New feature on main, shipping in v4.1.1 (#382).

AeroAgent already speaks to 24 providers; this adds Kilo (Kilo Gateway) as a 25th, native option. Kilo Gateway is an OpenAI-compatible endpoint that routes to many open and free models behind a single key, including a rotating Auto Free model with no credits required, so it is another genuinely free way to try AeroAgent next to Ollama, Cerebras, Groq and Gemini.

Area	Description	Status	Ref
Provider registry	kilo type and preset (api.kilo.ai/api/gateway), marketplace entry in the Gateway category (freemium), prompt and parameter profiles, a KiloIcon, and the three provider icon switches	🟢 done	74cea07b4
Backend	Rust AIProviderType::Kilo variant, routed through the existing OpenAI-compatible dispatch (/chat/completions), no new request logic	🟢 done	74cea07b4
CLI parity	--provider kilo resolves the base URL and the default model (kilo-auto/free, the no-credits Auto Free route)	🟢 done	74cea07b4

Verified green: cargo fmt, tsc --noEmit, npm run i18n:validate (46 locales, 0 needs-translation), cargo clippy --all-features --tests (lib and --bin aeroftp-cli), cargo test --all-features (0 failed), plus CI green on Linux, Windows and macOS (x64 and aarch64).

[axpnet]

CLI FTPS no longer crashes on connect, and suppaftp is bumped to 10.0.0

Post-4.1.0 follow-up, fixed on main, shipping in v4.1.1. Two related things landed: a pre-existing TLS crash in aeroftp-cli is fixed, and the suppaftp FTP library is bumped two majors. The crash was independent of the bump (the previous suppaftp 8.0.3 reproduced it identically), but both touch the FTP/FTPS path so they ship together.

Area	Description	Status	Ref
CLI TLS handshake	aws-lc-rs and ring both end up in the dependency tree, so rustls could not auto-select a process-default CryptoProvider and panicked on the first TLS handshake (FTPS, WebDAV over https). Nothing in the binary installed one. Fixed by pinning aws-lc-rs once at CLI startup	🟢 fixed	92950b59f
suppaftp 8.0.3 to 10.0.0	The bump replaces suppaftp's internal panics on malformed server responses with proper FtpError / ParseError results, and pulls time 0.3.47 to close RUSTSEC-2026-0009 (stack exhaustion). Drop-in: our tokio + tokio-rustls-aws-lc-rs + deprecated features are unchanged and the v9/v10 breaking changes (async-std to smol; tcp_stream returning FtpResult) do not touch APIs we call	🟢 fixed	263628069

Validated live against the axpbuntu lab (ftp.lab.axpdev.it):

Protocol	connect / ls / put / get / rm	Round-trip
FTP plain	all OK	byte-identical (sha256 0cac6b0a…)
FTPS explicit (AUTH TLS)	all OK	byte-identical (sha256 0cac6b0a…)

Known follow-up (not yet fixed): the GUI entrypoint likely shares the same CryptoProvider gap (no install_default anywhere in src/, and iroh / AeroShare pulls ring into the GUI binary too), so FTPS / HTTPS may panic there as well. To verify at runtime and, if confirmed, move the provider install into the shared lib so every entrypoint is covered. Targeted before the v4.1.1 release.

Verified green: cargo fmt --all --check, cargo clippy --all-targets --features aerorsync -D warnings, the 10 FTP provider unit tests, plus the live FTP + FTPS round-trips above.

[axpnet]

The 7z compression level now actually takes effect

Post-4.1.0 follow-up, fixed on main, shipping in v4.1.1 (#365, Format Coverage). First item of the archive-formats expansion (Tier 1).

The Compress dialog showed Fast / Normal / Maximum buttons for 7z and the CLI accepted --level, but the 7z create path received the level and dropped it, always building the LZMA2 content method at the library default preset. So every 7z archive came out the same size regardless of the chosen level. This is the bug, not a missing feature: the controls existed and did nothing.

Area	Description	Status	Ref
7z create	The 0-9 level now maps onto LZMA2's preset via Lzma2Options::from_level, used as the content method in both the password (AES) and the plain branch. Unset defaults to 6 (7-Zip's "Normal"); the value is clamped to the valid range	🟢 fixed	7ba2f72bf
Docs	The CLI --level help and docs/CLI-GUIDE.md no longer claim 7z ignores the level; both now state it maps onto the LZMA2 preset	🟢 fixed	7ba2f72bf

Proof	Result
compression_level_changes_archive_size unit test	Compresses a 1.5 MiB incompressible block repeated once. Level 1 (1 MiB window) cannot see across the gap; level 9 (64 MiB window) deduplicates it, so its archive is markedly smaller. The test asserts a clear margin, so it fails loudly if the level ever stops reaching the encoder

Verified green: cargo fmt, cargo clippy --all-features --tests --bin aeroftp-cli -D warnings, cargo test (sevenz suite 2/2), tsc --noEmit, npm run i18n:validate (0 NEEDS TRANSLATION, 47 locales), vitest (378/378).

[axpnet]

Triage of the v4.1.0 feedback (@EhudKirsh): six bugs fixed on main, queued for 4.1.1

Thanks for the detailed v4.1.0 reports across #368, #351, #277 and #347. We ran a full triage with a wide-scope audit (root-causing each report and checking whether the same flaw reaches areas the reports did not touch). The six confirmed bugs are now fixed on main in 324cd4bf6 and ship in v4.1.1; the later pre-release audit hardening in 2ab13baac tightened the OpenDrive/multipart and Google Drive cleanup-adjacent paths further. Four enhancement ideas remain captured for triage.

Bugs fixed on main (v4.1.1)

Area	Description	Status	Ref
Filen S3 (rename)	Renaming a folder with an emoji or non-ASCII name on Filen's S3 bridge returned 401 The signature does not match. The folder-copy path listed child keys without decoding Filen's already percent-encoded keys, then encoded them again, so the signed x-amz-copy-source was double-encoded and broke SigV4. Fixed: decode Filen keys once in the key listing (mirrors the normal directory listing), covering rename, recursive delete and copy-verification of unicode-named keys	🟢 fixed	324cd4bf6, #368
Benchmark (OpenDrive API)	OpenDrive API uploads failed in the benchmark with Incorrect chunk offset: uploaded=0, chunk_offset=5242880. The parts were sent in parallel, but OpenDrive's chunked upload is strictly sequential. Fixed: send OpenDrive multipart as a single in-order stream; pre-release audit added an explicit DAG regression for single-slot upload-part chaining and made shaped multipart cancellation abort-safe	🟢 fixed	324cd4bf6, 2ab13baac, #368
Benchmark (cleanup)	The aeroftp-bench folder was left behind empty on Google Drive, MEGA and kDrive. The parent removal was gated on preconditions these three break (non-idempotent mkdir on Drive and kDrive, the --test-root-prefix guard, MEGA soft-delete lag). Fixed: best-effort emptiness-guarded parent removal plus idempotent mkdir on Drive and kDrive; pre-release audit tightened Google Drive mkdir so an existing same-named file is not mistaken for an existing folder	🟢 fixed	324cd4bf6, 2ab13baac, #368
AeroFile (eject, Windows)	Ejecting a USB drive briefly flashed a console window. The eject helper spawned PowerShell without the no-window flag. Fixed: a shared no-window spawn helper applied to eject, rclone-import and scheduled-task spawns	🟢 fixed	324cd4bf6, #351
AeroFile (eject, stale entry)	A just-ejected drive lingered in Other Locations for a few seconds and re-ejecting it errored, because the sidebar re-read the OS mount table while it still reported the drive. Fixed: drop the ejected device from the list on success, then reconcile shortly after	🟢 fixed	324cd4bf6, #351
CLI benchmark TUI	The aero benchmark --tui picker flickered in split-screen when the footer help row wrapped to a second line. Fixed: line-wrap is disabled in the picker so a wrapped footer cannot scroll the view	🟢 fixed	324cd4bf6, #277

Enhancement ideas captured

Area	Description	Status	Ref
Benchmark progress	A live percentage and progress bars instead of the k/N counter (most useful for the many-small-files run)	🔵 idea	#368
Benchmark columns	A profile-type column before Protocol (for example MEGAcmd WebDAV, S3Drive S3, pCloudDrive OAuth)	🔵 idea	#368
Benchmark network note	Surface a mid-run network or IP change (currently only start-versus-end is compared)	🔵 idea	#368
AeroFile preview	Click a line number in the text preview to select the line, drag to extend (IDE-style gutter)	🔵 idea	#347

Already available

The many-small-files benchmark you asked about is already implemented: aero benchmark --file-count N --file-size SIZE runs an upload/list/stat/download/delete sweep over many files and reports files-per-second. Give it a try and let us know if it matches what you had in mind.

The tracker body and the dedicated fix comments now carry the fixed status. We will still re-check the provider-specific paths on the v4.1.1 build with real accounts / Windows hardware before closing the reporter-side confirmations.

[axpnet]

CryptOverlayProvider: one transparent-encryption decorator every remote surface routes through

Post-4.1.0 follow-up, fixed on main (merge eaaed9b1b), shipping in v4.1.1. Seed report: an AeroSync compare/sync mismatch on a crypt-overlay profile (Ehud).

Chasing that one mismatch revealed a structural problem: the crypt overlay (native AeroCrypt and interop rclone-crypt) was applied ad hoc, one command at a time, so any surface that resolved a provider for the profile on its own bypassed it. Those surfaces wrote plaintext into the encrypted store (silent corruption) or read back ciphertext (garbled results). The fix is architectural: a single CryptOverlayProvider decorator wired once at every provider resolver chokepoint. Each caller keeps speaking plaintext while the wire stays fully encrypted, and it is fail-closed: a bound profile whose vault is locked is refused, never downgraded to the raw provider.

Before / after (the gaps closed)

#	Surface	Before (gap)	After	Where
1	CLI get/put/sync/dedupe/edit/hashsum/mount	raw: plaintext written / ciphertext read	wrapped at the create_and_connect chokepoint	Phase 1
2	Cross-profile transfer (crypt <-> non-crypt)	raw on each side	each side wrapped independently	Phase 2
3	Agent transfer_one / transfer_tree	raw	wrapped via create_temp_provider	Phase 2
4	MCP backend (list/read/upload/rename/touch…)	raw	wrapped at ConnectionPool::get_provider	Phase 2
5	GUI browse/transfer/rename/mkdir/AeroSync/preview/edit	crypt applied ad hoc per command	on-demand wrap of the live session	Phase 3
6	GUI write (upload/mkdir/delete/rename/server-copy)	no guard: plaintext if overlay inactive	guard_no_raw_crypt_write fail-closed	Phase 3/4
7	GUI editor save-back (save_remote_file)	no guard	guard added	4d3dc40
8	AeroCloud background sync	raw: a scheduled sync read ciphertext / wrote plaintext	wrapped fail-closed before the cd	9802c81
9	Selective-sync folder tree	raw: showed ciphertext dir names, excluded_folders never matched	wrapped after connect	9802c81
10	CLI agent connect (create_and_connect_for_agent)	raw: agent server_exec on a crypt profile bypassed	wrapped via wrap_connected_provider_for_profile	9802c81
11	Sync compare, deferred-size overlay (legacy AeroCrypt v1/v2)	compare_size compared plaintext vs ciphertext length: churn every cycle	reports_exact_size() drops the size check for deferred-size overlays	8454766

Rows 1-7 landed in earlier phases; rows 8-11 close the Phase 4 completeness-critic sweep this cycle. Proven not-a-gap (covered or n/a): archive compress/extract (local only), touch (wrapped backend), benchmark (wrapped, writes ciphertext), EC sidecar (CLI wrapped; background sync does not emit it), versioning trash/.bak (local archiving), thumbnails (disabled fail-safe), DAG multipart (decorator forces a single encrypted stream), OAuth connect (not crypt-bindable).

Fail-closed regression tests (T4.3)

Area	Description	Status	Ref
Locked vault	A crypt-bound profile whose config exists but whose password is wrong is refused at the wrap factory (config MAC verify), never handed back raw	🟢 fixed	8454766ae
Never-raw	A bound profile with the right password resolves to the decorator, never the raw inner (both kinds), on top of the existing never-plaintext end-to-end / guard tests	🟢 fixed	8454766ae

Verified green: fmt, clippy (lib+tests and --bin aeroftp-cli, -D warnings), cargo test --lib 2467 passed / 0 failed, typecheck, i18n 46 locales 0 NEEDS, vitest 168 passed. CLI live: both overlay kinds decrypt names (rclone-crypt + AeroCrypt); the agent connect path (create_and_connect_for_agent) connects both kinds fail-closed-clean on the lab; the raw twin profile stays fully ciphertext. The full GUI live battery (background sync + selective-sync tree on both kinds, plus the remaining Phase 3.5 items) is queued for the owner and not yet run.

[axpnet]

v4.1.0 feedback fixes landed on main (shipping in v4.1.1)

Follow-up to the triage comment above: the six confirmed bugs from @EhudKirsh's v4.1.0 feedback are now fixed on main, together with three theme/UX quick wins from the wishlist. All ship in v4.1.1.

Area	Description	Status	Ref
Filen S3 (rename/delete)	Emoji / non-ASCII names on Filen's S3 bridge no longer 401: keys from the listing are decoded once so the SigV4 copy-source is not double-encoded (also fixes recursive delete and copy-verify of unicode names)	🟢 fixed	324cd4bf6
Benchmark (OpenDrive API)	OpenDrive upload no longer fails with "Incorrect chunk offset": its chunked upload is sent strictly sequentially (fan-out 1)	🟢 fixed	324cd4bf6
Benchmark (cleanup)	The aeroftp-bench folder is now removed on Google Drive, MEGA and kDrive (best-effort, emptiness-guarded, never a --test-root-prefix path), plus idempotent mkdir on Drive and kDrive	🟢 fixed	324cd4bf6
AeroFile eject (Windows)	Eject no longer flashes a console window: a shared no-window spawn helper, also applied to rclone import and the schtasks autostart spawns	🟢 fixed	324cd4bf6
AeroFile eject (stale)	A just-ejected drive is dropped from Other Locations immediately so a re-eject cannot error, with a delayed reconcile	🟢 fixed	324cd4bf6
CLI benchmark --tui	Footer no longer flickers in split-screen: line-wrap is disabled in the picker so a wrapped help row cannot scroll the view	🟢 fixed	324cd4bf6
AeroFile text preview (theme)	The preview now follows the Light and Ice themes instead of staying dark	🟢 fixed	e2d612a45
AeroAgent model modal (theme)	The Add/Edit model modal and the "Available Models" modal now follow the Light and Ice themes	🟢 fixed	e2d612a45
AeroFile preview scrollbar	Widened from 6px to 14px, scoped to the preview	🟢 fixed	e2d612a45

Verified green on the bug batch (324cd4bf6): cargo check --all-targets, clippy -D warnings, cargo fmt --check, tsc --noEmit, i18n:validate (0 missing), and the unit test suite (2467 passing, including a new S3 unicode-key regression test). The theme quick wins (e2d612a45) are typecheck green and the Light theme was verified in a dev run.

Still to confirm on the released build before these are closeable: the live-cloud paths (OpenDrive API upload, Filen S3 emoji rename, and the Google Drive / MEGA / kDrive cleanup) on real accounts, and the Windows-only eject and console-flash behaviour on real Windows. We will re-check on v4.1.1; reporters, please confirm there.

[axpnet]

Crypt overlay now unlocks and decrypts on OAuth cloud profiles

Post-4.1.0 follow-up, fixed on main, shipping in v4.1.1 (#347, reported by @EhudKirsh).

The crypt overlay was offered on OAuth profiles but activating it landed on the raw, still-encrypted view: the overlay "could not be unlocked". The root cause was provider-specific, not the overlay engine. Turning on an AeroCrypt overlay on an empty cloud folder probes for its config file (exists(.aeroftp-crypt.json)), and pCloud reported that missing file with its "Directory does not exist" status (code 2005) mapped to a generic server error instead of not-found, so the probe errored before the bootstrap step could create the config. Fixed, then audited across every cloud backend and verified live on a real pCloud account.

Area	Description	Status	Ref
pCloud not-found mapping	Result codes 2005 "Directory does not exist" and 2010 "Invalid path" now map to NotFound alongside 2009, so exists() returns a clean negative for a missing file in an existing folder and the AeroCrypt overlay bootstraps its config	🟢 fixed	d1e0bef90
Provider audit (same class)	kdrive and drime map a 404 folder-listing to NotFound; azure's inverse over-broad mapping (any non-success to NotFound) narrowed to 404/410 so a 403/500 on an existing blob surfaces as a real error; filelu verified already safe	🟢 fixed	d1e0bef90
OAuth form-connect	Connecting from the connection form now binds the profile id, so the overlay auto-unlocks even with two or more accounts on the same provider (previously only the saved-card connect had the id)	🟢 fixed	d1e0bef90
Profile export/import	The BYO OAuth app client_id and secret now travel with a profile export, so an imported OAuth profile reconnects without re-entering the app credentials (the keystore export already carried them)	🟢 fixed	d1e0bef90

Live proof (real pCloud, EU)	Result
Activate AeroCrypt on empty /aeroftp-overlay-crypt/aerocrypt	.aeroftp-crypt.json bootstrapped, Crypt overlay applied to live provider
Upload a file through the overlay	stored encrypted on pCloud, shown decrypted in the panel
Lock / unlock toggle	locked shows the ciphertext name + config, unlocked shows the plaintext name

Verified green: cargo fmt, cargo clippy (lib and --bin aeroftp-cli) with -D warnings, cargo test --lib (2468 pass), tsc typecheck, i18n:validate (0 missing, 47 locales), vitest (378 pass), plus the live pCloud round-trip above.

[axpnet]

Ice theme, benchmark selection, and pre-unlock / preview polish

Post-4.1.0 batch, fixed on main, shipping in v4.1.1. Follow-ups from the theme thread (#347) and the community-benchmark thread (#277), reported by @EhudKirsh, plus two owner-reported items. Closes requested items 14, 15, 16 and 17.

Area	Description	Status	Ref
AeroTools Ice theme	The bottom panel (Editor, Terminal, AeroAgent chat and its header band) rendered dark under Ice, with unreadable header buttons: Ice is a light theme with no .dark class and the panels only had a light case plus a dark default. Added an ice case across DevToolsV2, AIChat and AIChatHeader	🟢 fixed	000adf2f5
Draggable AI modals	AI Settings and the Add/Edit Model modal are now draggable by their header, consistent with the other modals	🟢 fixed	000adf2f5
Benchmark --group / --all	aero benchmark --group <NAME> (repeatable, comma-aware) runs the members of a My Servers group; --all runs every saved profile, so a comparison needs no manual --compare list	🟢 fixed	3d44b068a
Benchmark table + feedback	A profile-type column disambiguates multi-protocol profiles; the many-small-files run shows a live progress bar (pos, percent, ETA) instead of a blind wait; a mid-run public-IP change that reverts before the sweep ends still flags the comparison as not comparable	🟢 fixed	3d44b068a
Master-password window controls	The lock screen renders above the titlebar and had no minimize/maximize/close and no drag: added the shared WindowControls and a top drag region, mirroring the account picker	🟢 fixed	467d4ec41
Text-preview gutter selection	Clicking a line number selects the whole line and dragging across the numbers extends the selection, IDE-gutter style	🟢 fixed	467d4ec41

Verified green: cargo fmt, cargo clippy (lib and --bin aeroftp-cli) with -D warnings, cargo test --lib, tsc typecheck, i18n:validate (0 missing), vitest (378 pass). The benchmark --group/--all wiring is verified by the CLI help and the empty-group error path; a live multi-profile group run is a release-time check.

[axpnet]

v4.1.1 pre-release audit hardening landed on main

Pre-release audit follow-up, fixed on main (2ab13baac), shipping in v4.1.1. While validating the v4.1.0 feedback batch and the wider v4.1.1 release bundle, we found and fixed several blocker/high-risk edges that were not part of the original reporter list but sit on the same release surface.

Area	Description	Status	Ref
Crypt compare / reconcile	CLI check / reconcile and MCP check_tree no longer try to unlock/decrypt a crypt profile after the provider resolver has already wrapped it. The overlay decorator already lists plaintext names/sizes; the compare path now detects that and skips the second normalization pass, avoiding false empty-tree / wrong-key / drift reports	🟢 fixed	2ab13baac
Shaped multipart Stop	UploadPart nodes now honor the same cancellation token as single upload/download nodes. Stop can win during multipart begin, part upload, part file-read, or complete; failures trigger the existing best-effort provider abort, so a stopped S3 / OpenDrive / Google Drive shaped multipart upload cannot keep going to a remote commit	🟢 fixed	2ab13baac
AeroShare identity rotation	Rotating the AFID now stops every live served share before minting the new identity. The UI warning ("old share links / served drives stop working") now matches the runtime: old tickets are not left serving until manual Stop or app exit	🟢 fixed	2ab13baac
AeroShare discovery opt-out	Outbound send/knock/action/presence paths now apply the active persisted discovery mode before creating a fresh identity endpoint, even when the receiver is off after restart. A saved none opt-out is therefore honored outside the receive loop too	🟢 fixed	2ab13baac
Crypt-wrapped GitHub profiles	Generic GUI uploads/mkdir/delete and executor uploads no longer enter GitHub-only downcast paths when the live provider is a CryptOverlayProvider over GitHub. They use the overlay's generic encrypting methods instead of failing before encryption	🟢 fixed	2ab13baac
GitHub executor cancellation	The GitHub-special upload branch in the provider executor now races the cancel token like the generic path, so batch/sync Stop does not continue into a GitHub commit after cancellation	🟢 fixed	2ab13baac
Benchmark / Google Drive hardening	Google Drive idempotent mkdir now treats an existing name as success only when the existing item is a folder, so a same-named file cannot block benchmark folder creation with a misleading AlreadyExists path	🟢 fixed	2ab13baac
Crypt overlay polish	Failed inner downloads now clean up temporary ciphertext files, and rclone-crypt filename_encryption=off display paths decode the file leaf with the right file-vs-directory suffix semantics	🟢 fixed	2ab13baac

Verification

Green locally before push:

• cargo check --manifest-path src-tauri/Cargo.toml --all-targets
• cargo clippy --manifest-path src-tauri/Cargo.toml --all-targets -- -D warnings
• cargo fmt --manifest-path src-tauri/Cargo.toml --check
• git diff --check
• npm run typecheck
• npm run i18n:validate (46 locales, 0 errors / 0 warnings)
• Regression tests: Filen S3 unicode key decode, OpenDrive multipart hints, single-slot upload-part chaining, multipart cancel+abort, crypt compare normalization, crypt overlay provider suite, AeroShare stop-all-shares, benchmark remote roots, mkdir ladder, and Google Drive folder-only mkdir idempotence.

Release-time smoke still useful on real services/hardware: Filen S3 emoji rename, OpenDrive API benchmark upload, Google Drive / MEGA / kDrive cleanup, and the Windows USB eject UI behaviour.

[axpnet]

v4.1.0 feedback bug batch: fixed details and verification

Follow-up to the original triage block, fixed on main (324cd4bf6) with pre-release hardening in 2ab13baac, shipping in v4.1.1. This comment expands the six confirmed reporter bugs so the tracker has the fixed status, the root cause, and the exact verification surface in one place.

Area	Root cause	Fix	Verification / note
Filen S3 unicode rename/delete	Filen's S3 bridge returns already percent-encoded keys in listings. The folder-copy path treated those bytes as raw, encoded them again, and signed a double-encoded x-amz-copy-source, producing SigV4 401 The signature does not match for emoji / non-ASCII folders	Decode Filen listed keys once before the S3 copy/delete/verification paths consume them, matching normal directory listing behaviour	Unit regression filen_decode_listed_key_prevents_double_encode passes. Real Filen S3 emoji rename remains a release-time live smoke
OpenDrive benchmark upload	The OpenDrive API chunk endpoint is offset-strict and sequential. The benchmark went through shaped multipart fan-out, so later chunks could arrive before offset 0 had committed	OpenDrive advertises multipart with one in-order stream; the DAG builder chains upload parts when chunk slots are 1	opendrive_transfer_hints_advertise_multipart_with_md5 and shaped_upload_with_single_chunk_slot_chains_upload_parts pass. 2ab13baac also makes shaped multipart Stop cancel/abort-safe
Benchmark cleanup	Google Drive / kDrive mkdir was not idempotent, MEGA can lag through soft-delete, and the parent cleanup was blocked by guards that were correct individually but too strict together	Cleanup now best-effort removes the empty aeroftp-bench parent when safe; --test-root-prefix paths are preserved; Drive/kDrive mkdir is idempotent	benchmark_remote_roots and mkdir_ladder pass. 2ab13baac tightens Google Drive mkdir so an existing same-named file is not treated as an existing folder
Windows eject console flash	The eject helper spawned PowerShell without the Windows no-window creation flag. Audit found the same gap in rclone import and scheduled-task spawns	Shared hidden/no-window spawn helper applied to eject, rclone import, and scheduled-task helpers	Code audit found no remaining direct PowerShell/schtasks/rclone spawns outside the helper. Needs real Windows release smoke
Ejected drive stale sidebar entry	After successful eject, the OS mount table can still report the drive briefly. The sidebar immediately re-read the table and left a stale entry, allowing a second eject to fail	On successful eject, remove the device from the UI list immediately and reconcile shortly after	Behaviour is deterministic in UI code; real-device timing still belongs in Windows/Linux smoke
Benchmark TUI footer flicker	In split-screen, the footer help row could wrap on the terminal's last row; terminal auto-wrap scrolled the alternate-screen view on each keypress	Disable line-wrap while the benchmark profile picker is active and restore it on exit	Code path verified; visual smoke recommended in a narrow terminal

Audit hardening found while validating the batch

Area	Additional hardening	Status	Ref
Shaped multipart cancel	Stop now races multipart begin, part upload, part file-read and complete, and aborts the provider session on cancellation	🟢 fixed	2ab13baac
Crypt compare / reconcile	Already-wrapped crypt overlay providers are not decrypted/normalized a second time in CLI/MCP compare	🟢 fixed	2ab13baac
AeroShare rotation/discovery	AFID rotation stops live served shares, and outbound identity endpoints apply persisted discovery mode even with the receiver off	🟢 fixed	2ab13baac
GitHub + crypt overlay	Generic crypt-wrapped GitHub writes skip GitHub-only downcasts and use the overlay's encrypting methods; GitHub executor upload is cancel-aware	🟢 fixed	2ab13baac

Verification

Green after the final audit commit and push:

• cargo check --manifest-path src-tauri/Cargo.toml --all-targets
• cargo clippy --manifest-path src-tauri/Cargo.toml --all-targets -- -D warnings
• cargo fmt --manifest-path src-tauri/Cargo.toml --check
• git diff --check
• npm run typecheck
• npm run i18n:validate
• Focused regressions: Filen unicode key decode, OpenDrive hints, single-slot upload-part chaining, multipart cancel+abort, crypt compare, crypt overlay provider suite, AeroShare stop-all-shares, benchmark remote roots, mkdir ladder.

[axpnet]

✅ Released: AeroFTP v4.1.1

v4.1.1 is published: release notes. All platforms green (Linux, Windows, macOS), Sigstore-signed, on the Snap Store (stable) and AUR.

Everything queued on this tracker shipped:

• Transparent crypt overlays end to end through one CryptOverlayProvider decorator, wired fail-closed at every provider chokepoint (CLI, cross-profile, AeroAgent, MCP, GUI, AeroCloud background sync, the selective-sync tree), so no surface can bypass the overlay.
• AeroShare P2P privacy: an anti-flood gate (per-sender mute, an optional friends-only allowlist, a sliding-window rate limit) and a public-DHT opt-out (a new none discovery mode with a guarded AFID rotation). Both v4.1.0 security follow-ups are now closed.
• 7z encrypted-header create (-mhe) to hide filenames, and the 7z compression level now takes effect.
• Kilo Gateway as a native AeroAgent provider, benchmark group/all selection, Resume interrupted transfers, and AeroSync receipt totals plus JSON export.
• The v4.1.0 feedback triage batch: Filen S3 unicode rename, OpenDrive upload, benchmark cleanup, the CLI FTPS TLS crash, profile duplicate/import secret handling, the Ice/Light theme fixes, the master-password window controls, the folder-picker crash and more.

Thanks @EhudKirsh for the detailed v4.1.0 feedback that drove most of this release.

Closing this tracker. The next one is #384 (AeroFTP 4.1.2), which carries over the still-open "Requested / under consideration" items.