[Tracker] AeroFTP 4.1.2 - Known issues, patches & updates

[axpnet]

AeroFTP 4.1.2, Rolling Tracker

Umbrella issue for the next AeroFTP point release (v4.1.2): known issues reported against v4.1.1 and the patches/updates landing on main after the v4.1.1 tag.

Status note: the current published release is v4.1.1 (release notes, its tracker is #1409, now closed); this tracker collects what lands on main for v4.1.2.

Before opening a new issue, please check the lists below. If your problem is already tracked here, just add a thumbs-up reaction or a comment with your environment (OS, version, provider) instead of filing a duplicate. We update this issue as bugs are found and fixed.

Found something that is not listed? Open a new issue and we will link it here.

What shipped in 4.1.1

See the v4.1.1 tracker (#370) and the release notes for the full 4.1.1 change set: the transparent CryptOverlayProvider decorator (AeroCrypt and rclone-crypt encrypted end to end at every provider chokepoint, fail-closed), the AeroShare anti-flood gate and public-DHT opt-out (both v4.1.0 security follow-ups closed), 7z encrypted-header create, Kilo Gateway as a native AeroAgent provider, benchmark group/all selection, Resume interrupted transfers, and the v4.1.0 feedback triage batch.

Patches & updates queued for 4.1.2

Done on main, shipping in the next release. Items appear here as they land.

#	Type	Change	Status	Commit	Ref
1		aero benchmark --all-protocols alias for the existing --all flag (benchmarks every saved profile), so the intent reads clearly.	🟢 done	5a0b0fa60	#277 (@EhudKirsh)
2		Text preview: Ctrl+C now copies the selection, and gutter line drag-selection tracks both ways. The global file-manager Ctrl+C shortcut preventDefaulted the native copy so only right-click Copy worked; it now yields to an active text selection. The line-number drag stopped extending when the pointer left the narrow gutter column (worst going down); it now tracks from a window mousemove that maps the pointer Y to a line.	🟢 done	624e016f6	#347 (@EhudKirsh)
3		2FA Quick Connect layout (Filen, MEGA, Internxt): the six-digit Two-Factor Code field is now compact (six digits, centered, 000000 placeholder) on all three pages, and on Filen and MEGA the live TOTP preview (key, code, copy, timer) sits on the 2FA Secret label row instead of below the input (Internxt has no saved-secret field, so only its code field was compacted).	🟢 done	6dbe4255a, 52e048cae	#369 (@EhudKirsh)
4		Crypt overlay stuck decrypting forever after a reconnect (kDrive and other OAuth). The red Disconnect never tore down the transparent crypt overlay, unlike closeSession and switchSession, so a stale vault id survived and the next connect short-circuited the auto-unlock: the decrypted reload never ran and the overlay button was stuck. Disconnect now locks the backend keys, unwraps the provider and resets the overlay state so a reconnect starts clean.	🟢 done	f7e4b4ad4	#386 (@EhudKirsh)
5		Crypt upload "Path not found" on strict WebDAV (Koofr, OpenDrive). A PUT failed when the encrypted parent collection did not exist (for example the crypt folder was created while the overlay was off, so only its plaintext name is on the remote). The overlay now creates the encrypted parent chain and retries once on a path-missing error, mirroring rclone's implicit mkdir; gated so an auth or quota failure leaves no stray encrypted directories. This covers the upload failure; the button-vanishes case is fixed separately in row 15 (a Koofr mode-switch endpoint bug, not a crypt defect).	🟢 done	57058b9eb	#385 (@EhudKirsh)
6		Compression level presets aligned with the 7-Zip canonical levels. The Compress dialog now offers six presets (Store=0, Fastest=1, Fast=3, Normal=5, Maximum=7, Ultra=9) shared across all compressible formats; 7z and the tar.gz/tar.xz/tar.bz2 family drop Store since their codecs have no real store mode. The default level moves from 6 to 5 (7-Zip "Normal") in the dialog, in every backend fallback (zip, 7z, tar family) and in the CLI --level help, with the two new preset labels translated across all 47 locales. Verified live via CLI: each preset reaches the encoder (level 1 vs 3+ shows the window-size dedup difference) and an unset level produces a byte-identical archive to level 5.	🟢 done	e5aa6b79f	#365
7		Standalone gzip / xz / bzip2 compression for a single file, exposed as their own formats next to the tar variants (a lone file compresses to a plain .gz / .xz / .bz2 with no tar wrapper). The Compress dialog adds GZ/XZ/BZ2 cards with the 7-Zip preset levels, enabled only for a single non-folder selection (otherwise disabled with a "single file only" hint); the CLI infers the format from the extension (longest match keeps foo.tar.gz a tarball) and rejects a multi-file or folder input with a pointer to the tar variants; the new hint label is translated across all 47 locales. Compression only for now: standalone extraction stays out (the CLI rejects it, pointing at gunzip/unxz/bunzip2 or the tar variants).	🟢 done	0d2d35e12	#365
8		Full-surface security and hardening audit: 16 findings fixed (3 high, 7 medium, 6 low). High: remote-controlled path traversal in the sync_tree download engine, unbounded eager allocation from a server-declared native-rsync block count, FileLu API key leaking into surfaced errors. Medium: privileged auto-update installs now fail closed on a backend-authoritative registry of signature-verified artifacts, Azure Service SAS rebuilt to the correct 16-field layout, MEGA and OpenDrive session ids redacted from errors, native-rsync symlink varint panic guarded, shell_execute meta-character filter closed for redirection and glob, DebugPanel redaction extended to serialized secret fields. Low: vault mountpoint collision hash, component-aware update-path boundary, MCP deny-list parity, bounded peer inbound-rate map, CLI edit temp 0o600 with no-follow, constant-time SFTP serve auth. Produced by a multi-agent orchestration (fan-out finders plus adversarial refute-first verify on Opus, orchestration and the critical fixes on Fable), gated green (fmt, clippy with warnings denied, cargo test 0 failed, frontend typecheck).	🟢 done	1201bbd33	-
9		7z Advanced options: content method, dictionary size, solid block, threads. A collapsed "Advanced" section in the Compress dialog, with matching aeroftp compress flags, exposes the 7z content method (LZMA2 default, plus LZMA, PPMd, BZip2), an LZMA2 dictionary size and thread count, and a solid-block option (one pack for every file: better ratio on many small files, slower random extraction, off by default). Every method is decodable by the extractor (so an unreadable archive is never created) and word size is intentionally omitted (not exposed by the library in this version). Seven new labels translated across all 47 locales. Verified live via CLI: all four methods and the solid option create-and-extract round-trip, solid beats non-solid on many small files (10101 vs 13678 bytes), and dictionary/threads plus an AES-256 + PPMd archive round-trip.	🟢 done	f0a183079	#365
10		Standalone gzip / xz / bzip2 extraction: a lone .gz / .xz / .bz2 now extracts through the real extract path (extract_single_core), so the standalone compress lane shipped earlier (row 7) is a full round-trip and no longer create-only. The member name is the archive name minus the codec extension, and the CLI, GUI and AI extract verbs all reach it.	🟢 done	5bb7d0f32	-
11		Split / multi-volume archive parts now report a clear message. A .7z.001, .zip.001, .z01 or .r00 part gets a specific "multi-volume (split) archives are not supported: rejoin the volumes with 7-Zip/WinRAR" message in the extract probe instead of the generic "Unsupported archive type", with no extraction attempted. Real multi-part RAR (.partN.rar) is deliberately left on the normal .rar lane so it keeps working (unrar follows co-located volumes).	🟢 done	6040a8883	-
12		Tar symlink and hardlink entries extract safely. tar_unpack now handles directories, links and files separately: a link target is validated with the same in-root check as file paths, an in-root symlink is recreated (unix), and a malicious link pointing outside the destination (for example evil -> ../../../../etc/passwd) is never materialised and is surfaced in the report. Off unix the link is skipped and reported rather than silently dropped.	🟢 done	12238bce5	-
13		Open ZIP archives whose members use a non-Deflate method (BZip2, LZMA, Deflate64, Zstd, XZ): these previously failed with "unsupported compression" because the zip crate was built with deflate + aes-crypto only. The read codecs are now enabled, so such archives open and extract byte-exact; the write path is unchanged (AeroFTP still emits Store/Deflate + AES, which every native archiver opens). Full bidirectional interop with 7-Zip verified. See the follow-up comment for the interop test table and the compatibility matrix.	🟢 done	cdbe79c62	-
14		Interactive -i sections split clear from cls / . In profiles -i, groups -i and users -i, clear was an alias of the F5-style refresh (it wiped the screen AND reprinted the table), which is surprising for a command called clear. Now clear does a plain screen wipe with no reprint (the universal terminal behaviour), while cls and the single-key . keep the clear-and-reprint refresh (as does the full word refresh). r stays Rename. Verified live under a PTY across all three sections. See the follow-up comment for the test table.	🟢 done	8d7a0d2dc	#266 (@EhudKirsh)
14		AeroShare LAN (mDNS) discovery. A new lan discovery mode resolves peers over local mDNS only, publishing nothing to n0 or the public DHT, so two devices on the same subnet find each other fully offline (no internet, no relay): the firewalled or sandboxed case. mDNS is also folded into the default both mode, so LAN peers resolve instantly there too. Adds the iroh-mdns-address-lookup crate, a "LAN only (mDNS)" option in the AeroShare discoverability setting, and the discovery_lan labels across all 47 locales.	🟢 done	a23839c39	#284 (@EhudKirsh)
15		Koofr WebDAV endpoint dropped on an in-edit mode switch (404). Editing a Koofr profile and switching Native API to/from WebDAV produced a 404: the per-mode credential stash keyed on `providerId		protocol, and Koofr's preset-less native API falls back to the protocol koofrwhile its WebDAV preset's providerId is alsokoofr(the same key), so the switch stashed the API creds and instantly restored them as the WebDAV mode, leaking the bareapp.koofr.nethost over the presethttps://app.koofr.net/dav/Koofr`. Now keyed collision-free (`providerId	protocol`, normalizing a legacy native whose providerId equals its protocol); only Koofr collided. For a crypt profile this also restores the transparent overlay, which had vanished only because the connection never came up.
16		Quick Connect edit-mode consistency for preset providers. A preset endpoint now stays hidden from the main form in edit mode too (collapsed and unlock-gated in Advanced, like add mode), and a provider's WebDAV mode reads the preset's own field labels ("Email" / "App Password" for Koofr and Yandex, "Password" for OpenDrive and pCloud) instead of the generic "Username" / "Password", matching the native form. The kDrive token help text is now a direct link to the Infomaniak API tokens page (closes the #110 gap).	🟢 done	e80813eb5	#369 (@EhudKirsh)
17		DriveHQ free tier 1 to 5 GB; consistent Add Service badge order. Badges now sort S3 / WebDAV / API consistently (WebDAV in the middle for every company, so Filen matches FileLu), and DriveHQ shows its correct 5 GB free tier.	🟢 done	648b18df8	#274 (@EhudKirsh)
18		i18n: provider.modes.lockedInEdit translated in all 47 locales. The provider mode-tabs "locked in edit" hint referenced a key that existed in no locale, flooding the console with missing-translation warnings on every edit of a mode-group profile.	🟢 done	bcd76c1d2	-
19		Crypt overlay secrets carried over on Convert / Save-as-new. Converting a crypt profile to another mode (or saving it as new) minted a new profile id but left the overlay password and rclone salt under the old id, so the new profile's transparent overlay never auto-unlocked on reconnect. The secrets are now copied to the new id (a re-typed password in the form still wins). Scoped to the Convert / Save-as-new paths. Verified live on a real Koofr crypt profile: the transparent overlay auto-unlocks after a Convert.	🟢 done	3ac01e833	#385 (@EhudKirsh)
19		Add Service table view refinements. The Grid/Table view toggle is now a single "switch to" button showing only the inactive view (mirroring My Servers), and the list view is labelled Table since it is a real table. The "Custom / generic servers" strip under the table is filtered to the active tab (WebDAV shows only WebDAV, S3 only S3, Protocols FTP/SFTP, hidden in the cloud/media/developer tabs), with Azure Blob dropped from it since Azure is a first-class Object Storage row. OneDrive and Azure Blob carry the "Microsoft" company prefix so the two Microsoft services sort next to each other, like Google Drive/Google Cloud. Uploadcare free tier corrected from 3 to 1 GB.	🟢 done	3372621cc	#274 (@EhudKirsh)
20		MEGA API/CMD Quick Connect adopts the two-column layout. The API and MEGAcmd modes still rendered the legacy single-column form, while S4 and WebDAV-local already used the shared two-column layout. The narrow card squeezed the MEGA MODES tab bar (the S4 tab wrapped out of sight), and it never exposed the transparent Crypt overlay or the "Remember credentials for every protocol" toggle. API/CMD now use the same grid plus the shared right column, so the card is wide (the three mode tabs sit on one row) and Crypt (rclone-crypt and AeroCrypt) plus Remember-credentials are available. Live-verified on real MEGA: encrypted blobs written remotely, transparent clear-name round-trip locally, with both overlay kinds.	🟢 done	f3373b8b8	#369 (@EhudKirsh)
21		kDrive Quick Connect refinements, consistent provider-name casing, and digit-only 2FA / Drive-ID fields. kDrive: the Drive ID now sits above the API Token (id then secret, like S3), as a compact numeric-only field with a 1234567 placeholder, a green "Find your Drive ID" link to the kSuite page (the id shows in the address bar) and an amber "Create an API token" link to the Infomaniak token page, replacing the old help-text line. The provider name at the top-right of every Quick Connect page no longer force-uppercases single-preset connectors (Dropbox, OneDrive, Box, pCloud, Filen, kDrive, Google Drive and the rest read with proper brand casing; MEGA stays all-caps). The 2FA code fields (Filen / MEGA / Internxt) reject any non-digit via a shared handler, so a stray character can never make a TOTP silently wrong. Adds three kDrive labels across all 47 locales.	🟢 done	c8439475d	#369 (@EhudKirsh)
22		2FA code auto-submit. The six-digit 2FA code modal submits itself the moment the sixth digit lands, so entering a TOTP needs no extra click.	🟢 done	8f2b7a3b6	#369 (@EhudKirsh)
23		quick-xml bumped to 0.41 for RUSTSEC-2026-0194 and RUSTSEC-2026-0195.	🟢 done	793c0fd87	-
24		Pre-tag commit audit: PASS, six minor findings fixed. A punctual multi-reviewer audit of every commit in this cycle (archive, connection, share/CLI/catalog lanes) confirmed the security posture: no path traversal in the new extract lanes (symlink chains, hardlinks, TOCTOU covered), no secret logged or misdirected by the credential migrations, dependencies clean. Its six minor findings all fixed pre-tag: LAN discovery now disables relays entirely (true offline); the default discovery description discloses the local mDNS announce in all 47 languages; tar re-extraction overwrites existing links instead of failing EEXIST; the CLI tar extract report stays a clean path (skip notes travel separately); per-mode credential snapshots saved by earlier versions migrate to the new collision-free keys; and pasting a 2FA code with separators keeps all six digits. Plus dead-code hygiene: two orphaned introHub locale keys dropped.	🟢 done	aa289455c, f40e3b129, 35d0fce03	-

Requested / under consideration

Community ideas captured for triage. Not committed to a release yet. Carried over from the v4.1.1 tracker.

#	Type	Request	Status	Source
1		Windows hotplug detection in the AeroFile PLACES sidebar is slow: a freshly inserted drive can take up to ~30s to appear, because the real-time volume watcher is Linux-only (inotify) and Windows/macOS fall back to a 30s poll. A Rust-side WM_DEVICECHANGE listener emitting volumes-changed on device arrival/removal would make it instant; lighter mitigations are a refetch on window focus or a shorter poll interval. Surfaced during the #351 eject verification on real Windows hardware	🔵 idea	#351 (@EhudKirsh)
2		MTP / portable-device provider for AeroFile: surface attached MTP/WPD devices that have no drive letter (phones, cameras; the reporter's Sony Xperia is one) in PLACES, browse the object tree as a virtual path, and copy whole files to and from the device. A design appendix is written (design only, no implementation): it documents the protocol and its hard MTP/OS limits (no real mount, no random access, no delta or resume, whole-file transfers only, best-effort metadata) so they are never read as an AeroFTP shortcoming, and maps the capability onto the existing StorageProvider trait, recommending a hybrid model. Implementation is a later, separate effort	🔵 idea	#351 (@EhudKirsh)
3		Eager-evaluation preview and a single-vs-multi-target placeholder for the -i selectors (prioritised by the reporter ahead of Edit(E) and the 2-letter semantics; exact behaviour to be pinned)	🔵 idea	#311 (@EhudKirsh)
4		In-section membership for users -i: a verb so users -i can add/remove groups to/from a user. The groups-side counterpart (groups -i a/x for member profiles) shipped in 4.1.0; this remaining users<->groups direction needs the data model pinned first, since groups live inside each user's partition	🔵 idea	#311 (@EhudKirsh)
5		Lossless .jpg to .jxl transcode in AeroFile: JXL re-encodes an existing JPEG losslessly and reversibly (the original JPEG bytes reconstruct exactly), for a real size win with no quality loss. Candidate framing: AeroFile as a GUI for libjxl	🔵 idea	aerovault#2 (@EhudKirsh)
6		Media handling principle for any AeroFile conversion: lossless or pass-through only, never a lossy-to-lossy re-encode (for example .mp3 to .opus is destructive and should not be done silently)	🔵 idea	aerovault#2 (@EhudKirsh)
7		Single pre-release smoke entrypoint: one command running the deterministic Rust + frontend suite and the lab-backed integration tests, clean-skipping when creds/Docker are absent, printing a pass/skip matrix, wired into the release checklist	🔵 idea	#347
8		The dedicated extract/password window (Deliverable G) could follow the system theme (light/dark) instead of always rendering light. Nice-to-have polish	🔵 idea	-
9		Register AeroFTP as an opener for compressed formats so the new archive icon shows (Deliverable G follow-up, deferred from v4.1.0): v4.1.0 shipped the yellow archive mimetype icon asset, the right-click extract verbs, and MSI<->NSIS installer parity, but NOT the shared AeroFTP.Archive ProgID + Windows Capabilities / RegisteredApplications / OpenWithProgids that make zip/7z/tar/rar actually display the icon and list AeroFTP under "Open with" and Settings > Default apps. Available-opener only, never a forced default (decision c). Needs both hooks.nsh and the WiX fragment, plus a clean-machine Explorer eyeball of the MSI icons (the v4.1.0 dev-runner check had HKCU competitors masking the render; the HKLM registry was verified correct)	🔵 planned	#1408 (Deliverable G)
10		macOS shell integration for the OS extract feature (Deliverable G macOS, deferred): Finder Sync "Extract Here / Extract to Folder" menu items mirroring the Linux Nautilus and Windows verbs, plus macOS custom document-type icons (CFBundleDocumentTypes) for the five aero formats and the generic fallback, and rebuilding the mimetype .icns multi-size (the v4.1.0 ones are single-resolution drafts). Needs a Mac to build and live-test	🔵 planned	#1408 (Deliverable G)
11		In-app "File associations" settings panel: per-format checkboxes to make AeroFTP the default opener, applied per OS: Linux via xdg-mime default (works immediately), Windows registers capabilities and opens the OS chooser (Windows 8+ blocks silent forced association, so honest copy "Windows will ask you to confirm"), macOS best-effort LSSetDefaultRoleHandlerForContentType. Cross-platform follow-up to the OS extract / icon work	🔵 idea	#1408 (Deliverable G)
12		Filen Encrypted Notes: exit Beta: take Filen Notes out of Beta. Fix the participants/add contactUUID format (currently a best-effort workaround), investigate the Filen free-plan 10-note limit ghost-note cleanup, and add a rich text editor for the rich note type	🔵 planned	-
13		Near-duplicate detection via fuzzy / perceptual hashing (ssdeep / TLSH / pHash) in AeroFile, complementing the existing byte-identical dedupe (BLAKE3, in the GUI Find Duplicates, the CLI aeroftp dedupe, and as an agent tool). Part of a broader principle: deterministic, repeatable file chores should run as ready-made native features or plugins, not through an LLM. The plugin lane (manifest plus script, no AI) is the natural home for these but is currently gated: the signed-registry client is unfinished and CLI plugin support is pending (Fase 6.4, Low). Related to the lossless jpg-to-jxl transcode already tracked above (item 5)	🔵 idea	#383 (@EhudKirsh)
14		Transfer Queue can show a completed check on a failed transfer when several queue items share the same filename (for example repeated retries of the same file): the transfer-event to queue-item correlation falls back to path/filename matching (findTrackedEntry in useTransferEvents.ts), so a complete event from one attempt can tick a different same-name item, including a failed one. Surfaced live on 2026-07-05 while reproducing the delta transport-drop bug (whose data-path fix shipped in v4.1.2, removing this bug's main trigger). Fix direction: disambiguate the correlation (transfer_id-first, never complete an item in error state, tie-break same-name items by queue order/state). Needs a controlled repro before touching the queue state machine	🔵 planned	-
15		PRIORITY follow-up: Linux tray heap corruption from an off-main-thread GTK mutation. A GDBus worker thread aborts with malloc(): unaligned fastbin chunk detected while deserializing a D-Bus message: the classic GLib heap-corruption signature. The corruptor is the async app_ready command mutating the tray off the main thread; the GDBus worker is only the victim tripping over the poisoned fastbin. Pre-existing (NOT a v4.1.2 regression), reproduced live on 2026-07-05 with a full backtrace; it can leave the whole app in a corrupted state (cascading transfer failures until restart). A fix patch already exists (marshal every GTK/tray mutation through AppHandle::run_on_main_thread), pending retrieval and commit. First item for the next cycle	🔵 planned	-

Known issues found after release

Reported against v4.1.1. Fixed items ship in v4.1.2; reporters close after confirming in the release.

#	Area	Description	Status	Linked issue

_{Status legend: 🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released}

Affected platforms

• Windows
• macOS
• Linux

---

Maintained by the AeroFTP team. Current release v4.1.1 (#370), next v4.1.2. Patches accumulated here; each release line still gets its own tracker.

[axpnet]

Post-4.1.1 batch: crypt overlay reconnect and WebDAV upload, text preview copy/selection, 2FA layout, benchmark alias

Post-4.1.1 follow-up, fixed on main, shipping in v4.1.2 (reported by @EhudKirsh across #385, #386, #347, #369, #277).

Five items landed together, two of them the deeper crypt-overlay reports on OAuth and WebDAV.

Area	Description	Status	Ref
Crypt overlay (reconnect)	The red Disconnect never tore down the transparent crypt overlay (AeroCrypt / rclone-crypt), unlike closeSession and switchSession. The stale frontend vault id and reload refs survived the disconnect, so the next connect short-circuited the auto-unlock: the decrypted reload never ran, "decrypting" stayed on forever and the overlay button was stuck. Disconnect now locks the backend keys, unwraps the provider and resets the overlay state and refs so a reconnect starts clean	🟢 fixed	f7e4b4ad4
Crypt upload (strict WebDAV)	Koofr and OpenDrive returned "Path not found" on an upload PUT when the encrypted parent collection did not exist (for example the crypt folder was created while the overlay was off). The overlay now creates the encrypted parent chain and retries once on a path-missing error, mirroring rclone's implicit mkdir, gated so an auth or quota failure leaves no stray encrypted directories	🟢 fixed	57058b9eb
Text preview (copy + gutter)	Ctrl+C did nothing in the file preview (only right-click Copy worked): the global file-manager Ctrl+C shortcut preventDefaulted the native copy. It now yields to an active text selection. The gutter line drag-selection also stopped extending when the pointer left the narrow column (worst going down); it now tracks from a window mousemove mapping the pointer Y to a line, so it follows both ways	🟢 fixed	624e016f6
2FA Quick Connect (Filen, MEGA)	The six-digit Two-Factor Code field is now compact (six digits, centered, 000000 placeholder) and the live TOTP preview (key, code, copy, timer) sits on the 2FA Secret label row instead of below the input	🟢 fixed	6dbe4255a
CLI benchmark	Added a --all-protocols alias for aero benchmark --all (benchmarks every saved profile) so the intent reads clearly	🟢 done	5a0b0fa60

Still open from the same reports, both needing a live provider repro before a fix: the RCLONE CRYPT button vanishing after a protocol switch and reconnect (#385), and cd into decrypted folders failing on OAuth (#347).

Verified green: cargo fmt, cargo clippy --all-features --tests -D warnings (lib and aeroftp-cli), the Rust test suite, tsc typecheck, and npm run i18n:validate (47 locales, 0 needs-translation).

[axpnet]

Compression level presets aligned with the 7-Zip canonical levels

Landed on main, shipping in v4.1.2 (#365, Format Coverage track).

The Compress dialog used to offer three or four preset buttons (Fast/Normal/Maximum, plus Store for zip) mapped to 1/6/9. It now exposes the six canonical 7-Zip presets, so what you pick in AeroFTP matches what 7-Zip would do at the same name: Store=0, Fastest=1, Fast=3, Normal=5, Maximum=7, Ultra=9. The default moves from 6 to 5, which is 7-Zip's actual "Normal".

Area	Description	Status	Ref
GUI	Six shared preset buttons for every compressible format; 7z and the tar.gz/tar.xz/tar.bz2 family drop Store (their codecs have no real store mode); the preset row wraps so six buttons fit the dialog	🟢 done	e5aa6b79f
Backend	Default compression level is now 5 (7-Zip Normal) in every fallback: zip, 7z, tar.gz, tar.xz, tar.bz2	🟢 done	e5aa6b79f
CLI	compress --level help documents the preset mapping (1 Fastest, 3 Fast, 5 Normal, 7 Maximum, 9 Ultra) and the new default; CLI guide updated	🟢 done	e5aa6b79f
i18n	New fastest / ultra labels translated across all 47 locales	🟢 done	e5aa6b79f
Tests	Level unit test extended: an unset level must produce a byte-identical archive to explicit level 5	🟢 done	e5aa6b79f

Live CLI check on a 3 MiB payload built to defeat small windows (a 1.5 MiB pseudo-random block repeated twice) plus a text file:

Run	Output size	Meaning
-l 1 (Fastest)	3150349 B	1 MiB window cannot dedup the repeat
-l 3 (Fast)	1578535 B	long-range dedup kicks in
-l 5 (Normal)	1599061 B
-l 9 (Ultra)	1582741 B
no -l (default)	1599061 B	byte-identical to level 5
-l 0 zip (Store)	3994832 B	stored uncompressed (input 3994618 B)

Extraction roundtrip verified: md5 of the extracted files matches the sources for 7z level 9, 7z default and tar.xz level 9.

Verified green: cargo fmt, clippy -D warnings (lib+tests+CLI), full cargo test (targeted: compression_level_changes_archive_size, password_7z_encrypts_header_and_roundtrips), tsc, i18n:validate 47 locales 0 NEEDS, vitest 378/378.

[axpnet]

Standalone gzip / xz / bzip2 compression (single file)

Post-4.1.1 follow-up, done on main, shipping in v4.1.2 (#365, Format Coverage).

AeroFTP already compressed with gzip, xz and bzip2, but only wrapped inside a tar (tar.gz / tar.xz / tar.bz2). This exposes the three codecs as standalone formats too, so a single file compresses to a plain .gz / .xz / .bz2 with no tar layer, exactly like gzip file on the command line. They are single-stream codecs (one member, no directory structure), so they are offered only for a lone non-folder file.

Area	Description	Status	Ref
Backend	New compress_single command plus compress_single_impl / compress_single_core, reusing the flate2 / xz2 / bzip2 encoders with byte-true progress and an atomic temp file. Rejects folders and anything that is not a single file.	🟢 done	0d2d35e12
GUI	Compress dialog gains GZ / XZ / BZ2 cards on a 3x3 grid with the 7-Zip preset levels. Their cards are enabled only for a single non-folder selection and are otherwise disabled with a "single file only" hint.	🟢 done	0d2d35e12
CLI	aeroftp compress accepts gz / xz / bz2 (with gzip / bzip2 aliases), inferring the format from the output extension. Longest match keeps foo.tar.gz a tarball, and a multi-file or folder input is rejected with a pointer to the tar variants.	🟢 done	0d2d35e12
i18n	New compress.singleFileOnly label translated across all 47 locales.	🟢 done	0d2d35e12
Scope	Compression only. Standalone extraction is not exposed yet (a single stream has nothing to browse in the archive viewer); the CLI rejects it with a pointer to gunzip / unxz / bunzip2 or the tar variants. Tracked as a follow-up.	🔵 planned	-

Verified green: cargo fmt, cargo clippy --all-targets --all-features -D warnings, cargo test (full suite, exit 0), tsc --noEmit, vitest 378/378, i18n:validate 0 NEEDS across 47 locales. Unit tests: standalone_gz_xz_bz2_roundtrip and standalone_rejects_directory (lib), infer_from_path_standalone_and_longest_match (CLI). The live CLI battery is deferred to the end of the Advanced-options work and will be run cumulatively.

[axpnet]

Full-surface security and hardening audit: 16 findings fixed

Pending release follow-up, fixed on branch fix/fable-audit-full (commit 2854e6127, rebased on main and gated green), pending merge and shipping in v4.1.2.

I ran a whole-app security, correctness and hardening pass over the entire code surface (backend Rust and frontend). It produced 16 confirmed findings, all fixed on the branch above and put through the full green gate. Two raw findings were rejected as unreachable after verification (a legacy plaintext FTP path that no TLS profile can actually reach, and a Google API key redaction gap that cannot fire because the key travels in a header, never a URL). No credentials, hosts or infrastructure details appear here.

High severity

Area	Fix	Status	Commit
Sync engine	Reject remote-controlled traversing paths in the sync_tree scan (both the BFS and the flat fast-path), plus a defense-in-depth guard at the download write sink, so a malicious or man-in-the-middle directory listing can no longer write outside the chosen local sync root.	🟢 fixed	2854e6127
Native rsync	Cap the eager buffer reservation driven by a server-declared signature block count, and reject implausible counts, removing a memory-exhaustion primitive where a tiny frame could force a multi-gigabyte allocation.	🟢 fixed	2854e6127
FileLu	Redact the FileLu API key from every surfaced error string at the source, so a transient network error can no longer print the key into a user-visible toast.	🟢 fixed	2854e6127

Medium severity

Area	Fix	Status	Commit
Auto-update	The privileged install commands now fail closed against a backend-authoritative registry of just-verified artifacts (path plus digest match), and pass the verified digest to the privileged helper, so an install can only ever run against bytes the app itself signature-verified.	🟢 fixed	2854e6127
Azure	Rebuild the Azure Service SAS string-to-sign to the correct 16-field 2024-11-04 layout, so Shared Key share links validate instead of returning 403.	🟢 fixed	2854e6127
MEGA, OpenDrive	Redact the live MEGA session id and the OpenDrive session id from surfaced error text (both query and path forms).	🟢 fixed	2854e6127
Native rsync	Guard the symlink-target length field against negative values and harden the slice bounds with a checked add, removing a remote panic on a crafted file-list entry.	🟢 fixed	2854e6127
Agent tools	Close the shell_execute meta-character filter for redirection and glob operators, and de-anchor the destructive-command patterns so equivalent forms are caught.	🟢 fixed	2854e6127
Debug bundle	Extend the diagnostic redaction to serialized JSON and key-value secret fields, so a credential inside an object can no longer pass through into the shareable bundle.	🟢 fixed	2854e6127

Low severity

Area	Fix	Status	Commit
Vault mount	Collision-free FUSE mountpoint via a key hash suffix, so two vaults can never share a mount.	🟢 fixed	2854e6127
Auto-update	Component-aware path containment in the update-path check (a sibling like tmproot no longer passes a tmp allow-entry).	🟢 fixed	2854e6127
MCP	Bring the MCP download deny-list to parity with the agent file-tool deny-list (adds kube, gcloud, docker, vault-token).	🟢 fixed	2854e6127
Peer transfer	Bound the per-sender inbound-rate map to the trailing window, closing a slow remote memory-growth path.	🟢 fixed	2854e6127
CLI	Create the edit scratch file 0o600 with no-follow, and compare SFTP serve credentials in constant time.	🟢 fixed	2854e6127

Methodology: multi-agent orchestration

I wanted this pass to be broad and skeptical rather than a single linear read, so I ran it as a model orchestration.

Discovery was a fan-out over 15 code surfaces (vault and crypto, OAuth and token handling, the cloud and XML providers, FTP and SFTP transport, the sync and transfer engine, the native rsync wire protocol, the Tauri IPC command surface, the agent and MCP tool boundary, the peer transfer layer, the CLI, and the frontend security surface). One finder agent per surface, each with a tight file scope and a surface-specific threat lens.

Every finding then went through an adversarial per-surface verifier whose job was to refute it against the actual code, not to confirm it: default to skepticism, construct the concrete failure or reject the finding, and correct the severity (finders inflate). Only findings that survived that refute-first pass were kept, which is how 18 raw findings became 16 confirmed and 2 rejected. The finder and verifier stages ran on Opus 4.8.

Fixing was orchestrated too. I kept the three most delicate fixes for myself on Fable 5 (the sync path traversal, the signature-verified install gating, and the Azure SAS layout), and delegated the rest to a second parallel fix-workflow, grouped so each agent owned a disjoint set of files and no two agents could ever touch the same file. I reviewed every returned diff centrally and put the whole set through one green gate.

Verified green: cargo fmt, cargo clippy with all features across lib, bins and tests with warnings denied, cargo test (2474 plus 425 plus the smaller suites, 0 failed, including new tests for the path-traversal guard and the negative-length varint), and the frontend TypeScript typecheck. The DebugPanel redaction was also checked functionally against real credential-bearing inputs.

[axpnet]

7z Advanced options: method, dictionary, solid block, threads

Post-4.1.1 follow-up, done on main, shipping in v4.1.2 (#365, Format Coverage).

7z compression now exposes 7-Zip's advanced encoder controls, in a collapsed "Advanced" section of the Compress dialog and as flags on aeroftp compress. Defaults are unchanged (LZMA2, non-solid), so nothing shifts unless you open the section. The guiding rule: only offer what the extractor can read back, so every method below round-trips.

Area	Description	Status	Ref
Content method	Choose LZMA2 (default), LZMA, PPMd or BZip2. All four are decodable by the extractor (checked against the library's decoder ids), so no archive is created that AeroFTP cannot reopen.	🟢 done	f0a183079
Dictionary + threads	LZMA2 dictionary size (1 to 64 MiB presets, or bytes on the CLI) and a compression thread count for multi-threaded LZMA2. Applies to LZMA2 only; hidden for the other methods.	🟢 done	f0a183079
Solid block	Pack every file into one stream: better ratio on many small files, slower random extraction. Off by default. The solid path shares one byte-true progress counter across the entry readers.	🟢 done	f0a183079
CLI parity	--method, --dictionary, --threads, --solid on aeroftp compress, ignored for the non-7z formats.	🟢 done	f0a183079
Word size	Intentionally not offered: the library does not expose it publicly in this version, so a dead control was avoided rather than shipped.	🔵 n/a	-

Live proof (CLI, cumulative with the standalone gz/xz/bz2 work):

Live check	Result
Each method create + extract	LZMA2, LZMA, PPMd, BZip2 all round-trip byte-for-byte
Solid ratio on many small files	solid 10101 B vs non-solid 13678 B, and round-trips
Dictionary 16 MiB + 2 threads	round-trips
AES-256 password + PPMd	round-trips
Unknown method	rejected

Verified green: cargo fmt, cargo clippy --all-targets --all-features -D warnings, cargo test (full suite, exit 0), tsc --noEmit, vitest 378/378, i18n:validate 0 NEEDS across 47 locales. Unit tests: every_method_and_solid_roundtrips and unknown_method_is_rejected.

[axpnet]

CI follow-up: security-regression aligned to the hardened rm denylist

The full-surface audit (item 8) tightened the DENIED_COMMAND_PATTERNS rm rule in ai_tools.rs from /\s*$ to /\*?(\s|$) (it now also catches rm -rf /*), but the security:regression suite still asserted the old literal, so the check failed and left Build AeroFTP red on all platforms. The suite now matches the shipped pattern.

Test-only, no security behavior change. Gate green afterwards (security:regression, Build AeroFTP, Delta Sync).

🟢 done a2796fcb8

[axpnet]

Archive-format read completeness: create-vs-open asymmetry closed

Post-4.1.1 follow-up, fixed on main, shipping in v4.1.2.

Final step of the staged compressor integration: every advertised archive format now has full read + write with no create-vs-open gap. Four focused commits landed on main; this comment details the last and largest (ZIP non-Deflate reading) with the interoperability tests and the compatibility matrix.

Area	Change	Status	Commit
Extract / standalone	A lone .gz / .xz / .bz2 now extracts through the real extract path, closing the round-trip with the standalone compress lane	🟢 done	5bb7d0f32
Extract / multi-volume	Split parts (.7z.001, .zip.001, .z01, .r00) report a clear "rejoin the volumes" message instead of the generic error, no extraction attempted	🟢 done	6040a8883
Extract / tar safety	Tar symlink and hardlink entries extract safely: in-root links recreated, out-of-root targets never materialised and reported	🟢 done	12238bce5
Open / ZIP methods	ZIP members using BZip2 / LZMA / Deflate64 / Zstd / XZ now open and extract byte-exact	🟢 done	cdbe79c62

ZIP non-Deflate: interoperability proof (aeroftp-cli + 7-Zip 23.01)

Both directions verified end-to-end on an 11.6 KB payload (sha256 bda3b244...b2932).

Direction A, AeroFTP writes and 7-Zip opens:

AeroFTP writes	zip method	7-Zip result	extracted == source
compress out.zip	Deflate	Everything is Ok	YES
compress --level 0 out.zip	Store	Everything is Ok	YES

Direction B, 7-Zip writes a non-Deflate method and AeroFTP extracts:

7-Zip writes (-mm=)	zip method	aeroftp-cli extract
Deflate64	Deflate64 (9)	byte-exact OK
BZip2	BZip2 (12)	byte-exact OK
LZMA	LZMA (14)	byte-exact OK

ZIP compression-method compatibility matrix (v4.1.2)

Method (id)	AeroFTP writes	AeroFTP reads	Interop proof
Store (0)	YES (--level 0)	YES	AeroFTP -> 7-Zip
Deflate (8)	YES (default)	YES	AeroFTP -> 7-Zip
Deflate64 (9)	no	YES (new)	7-Zip -> AeroFTP + fixture test
BZip2 (12)	no	YES (new)	7-Zip -> AeroFTP + round-trip test
LZMA (14)	no	YES (new)	Python/7-Zip -> AeroFTP + fixture test
Zstd (93)	no	YES (new)	round-trip test
XZ (95)	no	YES (new)	round-trip test
AES-256	YES	YES	existing
PPMd (98)	no	no	known limit, see below

"AeroFTP writes" = what the app emits by default (Store/Deflate + optional AES-256). The new codecs are read-only additions; nothing about what AeroFTP produces changes, so archives it writes stay universally openable.

Known limit: PPMd-in-zip (method 98) stays unread. Enabling it pulls an extra codec crate and PPMd inside a .zip is rare (a 7-Zip advanced option, never a default). It can be added later in a focused commit if a real PPMd .zip needs it.

Five open-only regression tests guard this (zip_compression_method_tests in src-tauri/src/lib.rs): BZip2 / Zstd / XZ via in-test round-trip, LZMA and Deflate64 via committed fixtures from external archivers (Python zipfile.ZIP_LZMA and 7-Zip -mm=Deflate64, the two methods the crate's writer cannot emit).

Verified green (local, before push): cargo fmt, cargo clippy --lib --bins --all-features -- -D warnings, cargo test --lib zip_compression_method_tests (5 passed), npx tsc --noEmit, npx vitest run (41 files, 380 passed), npm run i18n:validate (46/46 locales clean, 0 [NEEDS TRANSLATION]). Backend-only, no new UI string.

CI on cdbe79c62 (all-platform build with the new C deps bzip2-sys/zstd-sys) is in flight at post time; per the release process the tracker records the push and any red is fixed in a follow-up.

[axpnet]

2FA Quick Connect: Internxt code field now matches Filen and MEGA

Post-4.1.1 follow-up, fixed on main, shipping in v4.1.2 (#369, requested by @EhudKirsh).

Completes the #369 layout pass (row 3). When the Filen and MEGA Two-Factor Code fields were compacted, the Internxt Quick Connect form was left with the old full-width field and the "optional" placeholder, so the three 2FA pages did not match. Internxt now uses the same compact six-glyph field, keeping its own blue accent. Internxt has no saved-secret field, so the live TOTP preview reposition (Filen and MEGA only) does not apply there.

Area	Description	Status	Ref
Internxt Quick Connect	Two-Factor Code input compacted to a six-glyph centered mono field with a 000000 placeholder, matching Filen and MEGA	🟢 fixed	52e048cae

Verified green: typecheck (tsc --noEmit), i18n validation (46 locales, 0 errors), unit suite (vitest, 380 passed), security regression (5/5), production frontend build.

[axpnet]

AeroShare LAN (mDNS) discovery: fully offline same-subnet transfers

Post-4.1.1 update, done on main, shipping in v4.1.2 (#284, from @EhudKirsh's LAN-only feedback on the AeroShare RFC).

AeroShare discovery so far used n0 DNS or the Mainline DHT, both of which need the internet to bootstrap, so a fully offline, firewalled, same-subnet transfer could not find the other device. This adds a local mDNS path.

Area	Description	Status	Ref
AeroShare / transport	New lan discovery mode: resolves peers over local mDNS only, nothing published to n0 or the public DHT, so two devices on the same network find each other with no internet and no relay (the firewalled / sandboxed case). Built on iroh 1.0's iroh-mdns-address-lookup crate, whose builder implements AddressLookupBuilder and plugs into Builder::address_lookup exactly like the DHT backend.	🟢 done	a23839c39
AeroShare / default	mDNS is also folded into the default both mode (now n0 + DHT + mDNS), so same-subnet peers resolve instantly for default users too, additively and with strictly less exposure than both already had.	🟢 done	a23839c39
UI + i18n	A "LAN only (mDNS)" option in the AeroShare discoverability setting, plus discovery_lan / discovery_lan_desc translated across all 47 locales.	🟢 done	a23839c39

Verified green: cargo fmt, clippy with warnings denied (--all-targets -D warnings), cargo check -p aeroftp-peer-l0 (confirms the mDNS backend wires in), the peer-l0 test set, frontend typecheck, i18n:validate 46/46 locales clean (0 placeholders), and the 380-test frontend unit suite.

[axpnet]

Interactive -i: clear is now a plain wipe, cls / . refresh

Post-4.1.1 follow-up, fixed on main, shipping in v4.1.2 (#266, requested by @EhudKirsh).

In the interactive sections (profiles -i, groups -i, users -i) we had shipped clear as an alias of the F5-style refresh, so it wiped the screen AND reprinted the table from the vault. That is surprising for a command called clear. Split per your request: clear is now a plain screen wipe with no reprint (what every terminal clear does), while cls and the single-key . keep the clear-and-reprint refresh. The full word refresh still reprints too, and r stays Rename (legacy from rclone config).

Area	Description	Status	Ref
clear vocabulary	Removed from the refresh set; now a plain screen wipe (section_is_clear), no table reprint	🟢 fixed	8d7a0d2dc
cls / . / refresh	Clear the screen and reprint the table (reload from vault): the F5 refresh	🟢 fixed	8d7a0d2dc
groups -i / users -i	These reprint the table every iteration, so a new SectionPending::PlainClear suppresses the one reprint after a plain clear	🟢 fixed	8d7a0d2dc
Help + action bars	The h help and the compact action lines in all three sections now list cls / . / refresh and clear separately	🟢 fixed	8d7a0d2dc

Verified live by driving each section through a real PTY (the -i loop needs a TTY) and counting how many times the table is rendered per command: a refresh renders it twice (the view once, plus the reprint), a plain clear renders it once (no reprint).

Section	cls	.	refresh	clear
profiles -i	reprint (2x)	reprint (2x)	reprint (2x)	plain wipe (1x)
groups -i	reprint (2x)	reprint (2x)	reprint (2x)	plain wipe (1x)
users -i	reprint (2x)	reprint (2x)	reprint (2x)	plain wipe (1x)

cls is also no longer reported as an unrecognized command (0 occurrences in the PTY run), and the h help renders the new split lines in every section.

Verified green: cargo fmt --check (clean), cargo clippy --bin aeroftp-cli -- -D warnings (0 warnings), cargo test --bin aeroftp-cli (426 passed, 0 failed, including the updated shared-vocabulary predicate test), plus the live PTY run above.

[axpnet]

Koofr WebDAV endpoint dropped on an in-edit mode switch (404), plus Quick Connect consistency

Post-4.1.1 follow-up, fixed on main, shipping in v4.1.2 (#385, #369, #274, reported by @EhudKirsh).

Editing a saved Koofr profile and switching Native API to/from WebDAV produced a 404 (and, for a crypt profile, the overlay button vanished, because the connection never came up). The per-mode credential stash keyed on providerId || protocol, and Koofr's preset-less native API falls back to the protocol koofr while its WebDAV preset's providerId is also koofr: the same key. The switch stashed the API creds and instantly restored them as the WebDAV mode, so the reconnect hit the bare app.koofr.net host instead of the preset https://app.koofr.net/dav/Koofr. Verified live on a real Koofr account: correct endpoint, connection OK.

Area	Description	Status	Ref
Mode switch	Per-mode stash now keyed collision-free (providerId|protocol, normalizing a legacy native whose providerId equals its protocol). Only Koofr collided; every other mode group was already distinct.	🟢 fixed	e80813eb5
Edit consistency	A preset endpoint stays hidden from the main form in edit mode too (collapsed, unlock-gated, in Advanced, like add mode), reinforcing the managed endpoint while keeping it overridable.	🟢 fixed	e80813eb5
Labels	The WebDAV mode reads the preset's own field labels ("Email" / "App Password" for Koofr and Yandex, "Password" for OpenDrive and pCloud) instead of generic "Username" / "Password", matching the native form.	🟢 fixed	e80813eb5
kDrive	Token help text is now a direct link to the Infomaniak API tokens page (closes the #110 gap).	🟢 fixed	e80813eb5
Catalog	DriveHQ free tier corrected 1 to 5 GB; Add Service badges sort S3 / WebDAV / API consistently.	🟢 fixed	648b18df8
i18n	provider.modes.lockedInEdit translated in all 47 locales (was a missing key flooding the console on every mode-group edit).	🟢 fixed	bcd76c1d2

Verified green: frontend typecheck (tsc, 0 errors), i18n:validate (47 locales, 0 missing, 0 warnings, 0 placeholders), and a live round trip on a real Koofr account (endpoint, connection, labels, Advanced).

[axpnet]

Add Service table view: single Grid/Table toggle, context-aware generic strip, Microsoft naming, Uploadcare fix

Post-4.1.1 follow-up, done on main, shipping in v4.1.2 (#274, reported by @EhudKirsh).

A second batch of Add Service table refinements from the #274 thread, on top of the badge-order / DriveHQ fix already logged (row 17).

Area	Description	Status	Ref
View toggle	The Grid/Table control is now a single "switch to" button showing only the inactive view, mirroring the My Servers page instead of two side-by-side buttons. The list view is labelled Table (tooltip "Table view"), since it is a real table.	🟢 fixed	3372621cc
Generic servers strip	The "Custom / generic servers" strip under the table is filtered to the active tab: WebDAV shows only WebDAV, S3 only S3, Protocols FTP/SFTP, All shows all; it is hidden entirely in the cloud / media / developer tabs. Azure Blob is dropped from the strip since Azure is a first-class Object Storage provider with its own row.	🟢 fixed	3372621cc
Provider naming	OneDrive and Azure Blob now carry the "Microsoft" company prefix, so the two Microsoft services sort next to each other when ordering by Provider, the same way Google Drive / Google Cloud already do.	🟢 fixed	3372621cc
Free-tier data	Uploadcare free tier corrected from 3 GB to 1 GB (per uploadcare.com/pricing).	🟢 fixed	3372621cc

Kept as-is on purpose: the category icon + name header at the top-left of the table. It is the "you are here" indicator for the category picked in the left menu, and its row also hosts the view toggle and health controls, so removing the label would not reclaim any vertical space for the search bar.

Verified green: tsc --noEmit typecheck clean, full frontend suite 380 tests / 41 files passing, i18n:validate 0 errors across 47 locales (reused the existing translated introHub.viewGrid / introHub.viewList keys, no new strings). Docs providers table (README + docs/PROVIDERS.md) and src-tauri/src/cli_catalog.json regenerated from the catalog SSOT.

[axpnet]

MEGA API/CMD Quick Connect now uses the two-column layout (Crypt overlay included)

Post-4.1.1 follow-up, fixed on main, shipping in v4.1.2 (#369, from @EhudKirsh's Quick Connect redesign thread).

MEGA grew its modes over time: CMD first, then API, then S4 and the local WebDAV bridge. The tabbed form was built while every Quick Connect page was single-column, so API and CMD kept that legacy layout while the newer S4 and WebDAV-local modes already used the shared two-column form. The result was three gaps on API/CMD only, all with one root cause (the single-column branch never called the shared right column), all fixed together.

Area	Description	Status	Ref
MEGA MODES tab bar	The narrow single-column card squeezed the mode bar, so the S4 tab wrapped to a second line and was barely visible. MEGA now joins the two-column protocols, so the card is wide and the three tabs (API / WebDAV / S4) sit on one row.	🟢 fixed	f3373b8b8
Layout parity	API and CMD now use the same grid grid-cols-2 container as every other provider: credentials and the connection-backend selector on the left, the shared right column on the right.	🟢 fixed	f3373b8b8
Crypt overlay	The transparent Crypt overlay (Wrappers / Overlays) was never shown on API/CMD, so it had never been usable there. It is now available, alongside the "Remember credentials for every protocol" toggle.	🟢 fixed	f3373b8b8

Behaviour preserved: edit-mode Save stays blocked while a fresh one-time TOTP is typed, the MEGA red accent and the MEGA name / remote-path placeholders and E2E note carry over, and the MEGA-specific "Remember session" and "logout on disconnect" boxes stay in the left column. The edit-mode footer now matches the standard Cancel / Save-as-new / Save used by S4, WebDAV-local and all other providers.

Live test on real MEGA	Result
API + AeroCrypt overlay	encrypted blobs written remotely, transparent clear-name round-trip locally
API + rclone-crypt overlay	encrypted blobs written remotely, transparent clear-name round-trip locally
Mode switching API / CMD / WebDAV / S4	layout and tabs correct in every mode

Verified green: typecheck (tsc, 0 errors), the test suite (parity + doc-tests, all passing), i18n 47 locales clean (no new keys), and live on a real MEGA account.

[axpnet]

kDrive Quick Connect refinements, consistent name casing, and digit-only 2FA / Drive-ID fields

Post-4.1.1 follow-up, fixed on main, shipping in v4.1.2 (#369, from @EhudKirsh's Quick Connect redesign thread).

Three related Quick Connect refinements from the thread, all shipped together.

Area	Description	Status	Ref
kDrive form	The Drive ID now sits above the API Token (id then secret, like S3), as a compact numeric-only field with a 1234567 placeholder. A green "Find your Drive ID" link opens the kSuite page where the 7-digit id shows in the address bar, and an amber "Create an API token" link opens the Infomaniak token page, replacing the old help-text line.	🟢 fixed	c8439475d
Provider name casing	The provider name at the top-right of every Quick Connect page no longer force-uppercases single-preset connectors. Dropbox, OneDrive, Box, pCloud, Filen, kDrive, Google Drive and the rest read with proper brand casing via a name map. MEGA stays all-caps, its real style.	🟢 fixed	c8439475d
Digit-only fields	The 2FA code fields on Filen, MEGA and Internxt strip any non-digit as you type, via a shared handler, so a stray character can never make a TOTP silently wrong.	🟢 fixed	c8439475d

Adds kdriveFindDriveId, kdriveFindDriveIdHint and kdriveCreateToken across all 47 locales.

Verified green: typecheck (tsc, 0 errors), the test suite passing, i18n 47 locales clean, and confirmed visually in the running app across the kDrive, Google Drive, Internxt and MEGA Quick Connect pages.

[axpnet]

Pre-tag commit audit: PASS, six minor findings fixed before the tag

Pre-release quality gate for v4.1.2, fixed on main. A punctual multi-reviewer audit re-read every commit of this cycle across three lanes (archive, connection / Quick Connect, share / CLI / catalog), adversarially and against the actual code.

Confirmed clean: no path traversal in the new extract lanes (symlink chains, hardlinks and validate-before-create ordering all covered), no secret logged or misdirected by the credential migrations, MEGA two-column reuses the single shared crypt-overlay path, dependencies clean (one new MIT crate, no RUSTSEC).

Area	Finding	Fix	Ref
AeroShare	lan discovery promised "no internet and no relay" but the endpoint still registered with the n0 relays when online	Relays fully disabled in lan mode (direct same-subnet connections), taking precedence over custom relay URLs	35d0fce03
AeroShare	The default both mode now announces over local mDNS but the setting description still said only "n0 + public DHT"	Label and description disclose the mDNS announce honestly, translated across all 47 locales	35d0fce03
Archive	tar_unpack appended skip notes to the returned destination, so the CLI walked a multi-line non-path and reported 0 extracted bytes	Destination and skip notes now travel as separate values, the report stays a clean path	aa289455c
Archive	Re-extracting the same tar died EEXIST at the first symlink (links, unlike files, were never overwritten)	Pre-existing file or link removed first, matching File::create truncate semantics	aa289455c
Connection	Per-mode credential snapshots saved by earlier versions used the pre-rekey keys, restoring blank after the collision-free rekey	Legacy entries re-keyed at hydrate, dead secret entries dropped	f40e3b129
Connection	Pasting a 2FA code with separators (for example "123 456") silently lost the sixth digit (maxLength truncates before the change event)	Six-digit clamp moved into the shared handler	f40e3b129

Hygiene in the same pass: the two orphaned introHub locale keys left by the Add Service refactor removed from all 47 locales.

Verified green after the fixes: cargo fmt, clippy -D warnings (lib + CLI), full cargo test (2490 + 426, 0 failed), tsc, vitest 380/380, i18n:validate 47 locales 0 needs-translation.

[axpnet]

✅ Released: AeroFTP v4.1.2

v4.1.2 is published: release notes, all platforms green (Linux, Windows, macOS x64/aarch64), artifacts sigstore-signed, Snap on stable, AUR bumped.

What shipped (24 tracked rows, full detail in the table above and the release notes): complete archive format coverage (standalone gz/xz/bz2 round-trip, 7z Advanced options, ZIP non-Deflate read methods, safe tar links, multi-volume detection, 7-Zip canonical presets), the full-surface security audit (16 findings fixed) plus a pre-tag commit audit (PASS, 6 minor findings fixed before the tag), AeroShare LAN (mDNS) discovery with relays fully disabled in lan mode, the Quick Connect consistency pass, the crypt overlay fixes reported against v4.1.1, and a delta transport-drop classic fallback found and fixed hours before the tag.

Thanks @EhudKirsh for the reports and verifications throughout the cycle.

This tracker is now closed; the next one is #1411.

---

A release is also a moment. This one was cut from a natural park by the sea, because the primary rule of a free app is that building it must stay fun: