[Tracker] AeroFTP 4.1.4 - Known issues, patches & updates

[axpnet]

AeroFTP 4.1.4, Rolling Tracker

Umbrella issue for the next AeroFTP point release (v4.1.4): known issues reported against v4.1.3 and the patches/updates landing on main after the v4.1.3 tag.

Status note: the current release line is v4.1.3 (release notes, its tracker is #1411, now closed); this tracker collects what lands on main for v4.1.4.

Before opening a new issue, please check the lists below. If your problem is already tracked here, just add a thumbs-up reaction or a comment with your environment (OS, version, provider) instead of filing a duplicate. We update this issue as bugs are found and fixed.

Found something that is not listed? Open a new issue and we will link it here.

What shipped in 4.1.3

See the v4.1.3 tracker (#388) and the release notes for the full 4.1.3 change set: archive encryption surfaced at a glance in both the local and the remote file browser (padlock, cipher, Encryption/Compression columns, AeroVault generation chip, for zip/7z/rar and our own container formats, header-only and password-free), safer destructive CLI deletes (a real --dry-run on rm/purge, opt-in recursion that refuses by default, and the global filters honoured), roughly 3x faster recursive SFTP listings (no per-entry LSTAT, pipelined symlink follow-ups) with symlink-to-directory walks refused across every walker, the S3 trash/version management surface with a live-file safety fix, the crypt overlay showing plaintext outside its bound subtree from the CLI and MCP too (CWP-20C), the FTPS crypto-provider crash fix and the panic-safe connect family, macOS promoted to stable and now shipping signed, the in-app updater hardened (amber advisory Sigstore state, honest progress, pacman notify-only), the Flatpak first-run host import and per-scope keyring isolation, and a full pre-release plus pre-tag commit audit (PASS).

Patches & updates queued for 4.1.4

Landed on main after the v4.1.3 tag; shipping in v4.1.4.

#	Type	Change	Status	Commit	Ref
1		Refreshed the Google Drive and OneDrive provider marks to their current official 2026 icons, in the provider logos and the README integrations row. Reporter supplied the sources	🟢 done	102b3fde3	#347 (@EhudKirsh)
2		Provider label accuracy: 'pCloud' renamed to 'pCloud Drive' and 'Amazon S3' to 'Amazon Web Services (AWS)', and the Add Services search now matches 'aws' (grid and list) through search aliases, where it returned nothing before	🟢 done	fd462dc93	#347 (@EhudKirsh)
3		Single pre-release smoke entrypoint npm run smoke: one command runs the deterministic Rust + frontend suites plus the lab-backed integration lanes, clean-SKIPs when Docker/creds are absent, prints a PASS/SKIP/FAIL matrix and exits non-zero only on a real FAIL, wired into the pre-tag release checklist	🟢 done	29c0b5131	#347
4		AeroImage Save As now enforces lossless-or-pass-through: converting one lossy format into a different lossy one (jpg to gif, gif to jpg) warns and keeps the save buttons disabled until an explicit acknowledgement checkbox is ticked; pass-through (same format) and lossless targets stay silent. The isLossyReencode guard is unit-tested across the full truth table, and the new strings ship in all 46 non-EN locales	🟢 done	67ae0d344	aerovault#2 (@EhudKirsh)
5		Routine dependency maintenance: six Dependabot bumps merged after the v4.1.3 tag. Dev tooling (vite 8.1.4, vitest 4.1.10, autoprefixer 10.5.2) and runtime/build patches (country-flag-icons 1.6.20, ssh2 0.9.6, clap_complete 4.6.7), all patch/minor with green CI. The three RustCrypto core-crate bumps (aes-gcm, chacha20poly1305, cbc) are held for breaking-API adaptation, tracked in Requested below	🟢 done	e93452ee6, 60f99cde1, 60d870d7e, 7d80a197a, 8ca62b2b9, d07b5d07a	-
6		AeroFTP MCP extension bumped to v1.4.0 and published to the VS Code Marketplace, documenting the v4.1.3 MCP surface change: the new remote-only S3 tools remote_versions / remote_trash and the dry_run preview on aeroftp_delete / aeroftp_delete_many (recursion now opt-in via recursive, refuses by default). Also aligned the advertised tool count to the 4.1.3 SSOT from aeroftp-cli inventory (75 total: 38 primary + 37 aliases)	🟢 done	f41defe (aeroftp-mcp)	-
7		AeroCrypt default flips to a lean headerless base: crypt init now writes nothing on the remote by default and stores the public config (version, salt, KDF params, vault_id) in the local keystore per profile; --with-header restores the on-remote .aeroftp-crypt.json marker as an opt-in. A MANDATORY, non-skippable Emergency Kit (vault_id + public config, printable) is emitted at setup on both the CLI and the GUI, so a lost keystore is never a lockout. Lossless headed and headerless migration both directions (crypt to-headerless / to-headed, metadata-only, AECR objects byte-identical). GUI header opt-in toggle (default headerless) plus connect-time keystore load, MCP unlock parity, i18n all 47 locales. Core landed on main; the full live SFTP matrix and the MCP tool audit (Task 5) complete before the v4.1.4 tag	🟢 done	1b46966a8, c8405ee3c, 34375b5b1, d16320cae, 555db6d08, fc6938778, eec44afaa	#276 (@EhudKirsh)
8		Native profile backup (.aeroftp) now round-trips every saved field. Four top-level profile fields lived outside the options blob and were silently dropped on export and re-import: the share-link base (publicUrlBase), the custom and detected icons, and the silenced classic-fallback modal preference. The per-profile Filen CLI API key (#230) and the OneDrive drive id/type, which live only in the vault, were dropped too, so a re-imported Filen profile fell back to password plus TOTP. All now survive export and import, and a second silent drop in the GUI import merge (which also lost persistModeCredentials from #215) is fixed	🟢 done	1616a1e29, 85a999f6a	-
9		A user action on a saved profile is now complete, no residue and no half-copy. Deleting a profile now removes every vault secret scoped to it (before: only the password, leaving the Filen key, crypt-overlay secrets and OAuth token orphaned); duplicating one copies all of them (before: only the password); export carries all of them. The three operations share one source of truth per_profile_vault_keys, backed by two new commands purge_profile_secrets / copy_profile_secrets used by both the GUI and the CLI so they can never diverge. App-global keys (OAuth client id and secret) are deliberately excluded so deleting one profile never breaks the others of a provider. The CLI reaches full parity: profile-add gained flags for all these fields, and a latent bug where a cloud profile with no host failed profile-export is fixed	🟢 done	85a999f6a, 1616a1e29	-
10		Headerless AeroCrypt unlock test coverage (Task 5 part A). Confirmed by reading that the MCP crypt path already honours the v4.1.4 headerless default end to end with no remote marker (the single unlock route loads the local keystore config and falls back to it when the marker is absent), and added the missing unit test for that branch: headerless unlock from the local config with no marker written, plus both fail-closed paths (no config anywhere, and a config/salt divergence)	🟢 done	88ad98cff	#276 (@EhudKirsh)
11		Headerless AeroCrypt now actually works in the GUI, and its recovery kit is optional and on demand. Connecting or toggling a headerless AeroCrypt profile failed closed every time ("Encrypted overlay could not be unlocked") and fell back to the raw provider, so files uploaded in plaintext into what looked like an encrypted folder. Root cause: the GUI dropped the profile id the keystore config is keyed by, so the backend saw no id and could not create or read the vault config (headerless writes no remote marker). Forwarding the id fixes connect-time unlock, the badge toggle, and create-at-first-connect (verified live: first connect bootstraps the vault, uploads encrypt with AES-SIV names on the raw view, toggle on and off, reconnect re-opens decrypted). Following the "frictionless like rclone" direction, the GUI Emergency Kit is no longer a blocking mandatory step (this refines the non-skippable GUI gate described in queued #7): the vault is usable immediately and the public recovery kit (vault_id, salt, KDF params, never secrets) is available on demand from a new modal, reachable from the saved-server right-click menu and from a right-click menu on the crypt badge, re-viewable and re-savable any time. Also in this batch: the overlay toggle-off is now recorded in the Activity Log, the flashing duplicate-profile alert on save is removed (kept in the log), an em-dash is gone from the badge tooltip, and the Overlays Remote Path placeholder no longer clones the Remote Path (now "/")	🟢 done	02821d52f, 9920784a5	#276 (@EhudKirsh)
12		CLI agent-friendly output mode and a remote find-and-replace edit command. A global --machine flag makes the CLI emit only structured data on stdout (human status lines suppressed), so an AI agent gets clean parseable output; documented in the CLI help and agent-info. New edit command (and MCP aeroftp_edit tool) does a literal find-and-replace on a remote UTF-8 text file in place without a local download: replaces all by default or only the first with --first, is a no-op that never re-uploads when nothing matches, and refuses binaries, directories and files over 10 MB. Live-verified on SFTP (replace-all, no-match no-op, --first, binary rejection, --machine pure-JSON stdout). Also a WebDAV MOVE Depth: 0 header fix for servers that require it on rename, and a delete-preview robustness tweak for stat-less pseudo-directories	🟢 done	b92982e0f, c7d65e64d	-
13		Overlays Remote Path: pin the crypt overlay to a strict subfolder of the Remote Path. A dedicated, optional "Overlays Remote Path" input (GUI Connection screen) plus the matching CLI crypt bind scopes encryption to a strict descendant of the connection Remote Path: connect into /data but encrypt only /data/vault, with everything outside the scope passed through as plaintext. Relative UX (type just a subfolder name, anchored under the Remote Path); live validation accepts the Remote Path or a strict descendant and rejects an ancestor, sibling or prefix-trap; empty means same-as-Remote-Path (backward compatible). The scope locks once the overlay is bound. New strings ship in all 47 locales. Completes the CWP-20C engine (4.1.3) with the dedicated sub-scope input requested	🟢 done	34ffd2ac5, f60dc04d4, bd5a3a19d	#369 (@EhudKirsh)
14		About > Technical: the archive crate version now resolves in the library update check. The Technical tab keyed the crate as sevenz-rust, but the backend reports it under sevenz-rust2 (the actual dependency) and the crates.io query hit the old deprecated crate, so the row showed an error with no version. Aligned the label to sevenz-rust2 so the version resolves and the update check reports correctly	🟢 done	2b63c3975	-
15		AeroCloud delete propagation: a file deleted on one side is now removed on the other instead of the surviving copy resurrecting it (index-aware decide plus execute plus a safety gate, on both the provider and FTP twins). The line between sync and copy. Live-verified headless on a real MEGA remote: the delete propagated and the next cycle did not resurrect it	🟢 done	e167073e0, 55134fab2	#405 (@EhudKirsh)
16		AeroCloud send-only / receive-only folders (plus a send-only mirror mode): per-folder direction (bidirectional, send-only, receive-only) via a centralized decide_sync_action, with a preserve_remote_deletes toggle for additive backup vs strict mirror. Ehud's preferred one-way-to-the-cloud shape	🟢 done	b98f5b33f, 3fabf991b	#405 (@EhudKirsh)
17		AeroCloud is now reachable from the CLI: aeroftp-cli aerocloud show/set/enable/disable/status/sync configures and runs AeroCloud headless (it was GUI-only), the first step toward the AeroCloud/AeroSync engine convergence	🟢 done	49c4e97b3, 96a0c447e	#405 (@EhudKirsh)
18		AeroCloud real-time watcher is tunable: the debounce quiet period and the cooldown between watcher-triggered syncs are now CloudConfig fields, editable from the GUI and the CLI (aerocloud set --watcher-debounce-ms / --watcher-cooldown-secs), answering the bandwidth concern about real-time sync	🟢 done	405d47f61	#405 (@EhudKirsh)
19		Yandex Disk WebDAV recategorized as paid: Yandex 360 gates WebDAV behind the subscription since 22 June (confirmed by Yandex support to the reporter), so Yandex Disk WebDAV now carries the paid (gold) marker in the Add Service table, matching pCloud Drive; its OAuth API stays free (5 GB)	🟢 done	93e89d1c3	#274 (@EhudKirsh)
20		AeroCloud SFTP key-based auth: a saved key-auth SFTP profile now works as an AeroCloud target (it was password-only, so a key profile failed auth). The multi-protocol factory merges private_key_path and key_passphrase from the saved profile options after connection_params, preserving any explicit params and leaving password-auth SFTP and every other provider unchanged. Covers both the GUI background worker and aeroftp-cli aerocloud sync, passphrase-protected keys included. Live-verified headless on the DEV vault with a plaintext key and a passphrase-protected key	🟢 done	53241a770	#405 (@EhudKirsh)
21		AeroCloud multiple sync pairs: more than one local-to-remote pair per install, each with its own saved profile, protocol, direction, sync index and crypt overlay, driven by the same background worker and reachable from the CLI. A dedicated cloud_pairs.json store (CloudPathPair / CloudPairsConfig, kept separate from AeroSync's multi-path store), a new GUI pairs editor, and aeroftp-cli aerocloud pair list/add/remove/enable/disable/sync (46 locales). The connect-wrap-sync sequence was first unified into one sync_one_config helper the worker and CLI share; the worker resolves each pair's protocol from the vault, a per-pair UUID plus a duplicate-(local,remote) guard keep sync indexes isolated, and concurrent manual and background syncs are serialized by a restored RAII in-progress guard. An empty store falls back to the legacy single config (back-compat). Live-verified headless on the DEV vault: two independent non-FTP pairs (MEGA and Koofr) synced in one pass, uploaded 2 errors 0	🟢 done	07a96f83a, aaddd0501, 9d1e0c9fe	#405 (@EhudKirsh)
22		RustCrypto core crates held on the 0.10 cohort with documented pins (release Step 0 rule). The three Dependabot bumps (aes-gcm 0.11, chacha20poly1305 0.11, cbc 0.2) do not converge: aerovault 0.6.3 uses aes-gcm-siv 0.11 and chacha20poly1305 0.10, noq-proto pins aes-gcm 0.10.3, and cbc 0.1.2 stays transitive via keyring/pkcs5, so bumping only AeroFTP's direct dependency would leave both cohorts in the lock. Pinned aes-gcm =0.10.3, aes =0.8.4, cbc =0.1.2, chacha20poly1305 =0.10.1 with the reason recorded in Cargo.toml, and closed the three PRs. Crypto core verified still round-trips: DEV vault unlock, profile export then import decrypts old ciphertext, and a live Cryptomator vault mount and decrypt (guards #322)	🟢 done	df763719f	Dependabot #379 #380 #381
23		CLI delete and del aliases for rm: rclone and DOS muscle-memory now resolve instead of erroring, so a saved-server delete typed as delete or del runs rm. visible_aliases only, no new subcommand (the dispatcher allowlist metatest stays green). Kept deliberately narrow (the principal base names), not a full rclone command clone	🟢 done	815e9f5df	-
24		AeroCloud overlay stack A1/A2 is wired and live-verified. AeroCompress is now a real per-config/per-pair overlay: CloudConfig and CloudPathPair persist compress_enabled / compress_level, aerocloud set and aerocloud pair add save them, GUI pairs expose the toggle and level, and sync_one_config composes compress outside the crypt builder so upload order is compress then optional crypt. The old profile-only aeroCompress parser is removed, invalid levels fail closed, stored-mode and legacy passthrough stay covered. Live DEV MEGA evidence: compressible text uploaded with AECP zstd mode and downloaded byte-equal, random data used AECP stored mode with wire size equal to plaintext+13, and a legacy plaintext object downloaded byte-equal after compression was enabled. P5 AeroChunk and P6 AeroCorrect remain deferred	🟢 done	308bf5c3a..e0a298fad	#405 / #276
25		users -i can now manage per-user group labels directly. The interactive Users section gained Add/Remove group verbs that edit the selected user's own server_groups partition without switching the active user or inventing a global membership table. Add is idempotent, remove drops only the group label, locked users fail clearly, and the Users table/tree now report per-user groups without seeding legacy state.	🟢 done	142f6b45f	#311 (@EhudKirsh)
26		Windows archive opener registration for general compressed formats (Deliverable G #3): shared AeroFTP.Archive ProgID + OpenWithProgids + Capabilities + RegisteredApplications + SupportedTypes for .zip/.7z/.rar/.tar/.tgz/.gz/.xz/.bz2 using the bundled archive icon. Preserves existing defaults and extract verbs. NSIS + WiX parity. Linux gates (fmt, clippy -D warnings, rg) green; pushed 78f0e017a. Full clean-machine Explorer/Open-with + uninstall validation pending on Windows (reporter will test).	🟢 done (candidate)	78f0e017a	#1408 (Deliverable G)
27		In-app "File associations" settings panel (Deliverable G #3): compact OS-backed section inside Settings > File Handling. AeroFTP-owned formats and archives show live Default/Available status. Linux applies via xdg-mime, Windows opens Default apps (never writes UserChoice), macOS best-effort. Final audit tightened localized UI text, OS-settings error reporting, and Linux desktop MIME merge/snap coverage. i18n all locales, unit tests, gates.	🟢 done (candidate)	2cd804402, 2b61026aa	#1408 (Deliverable G)
28		The AeroCrypt Recovery Kit is now optional, on-demand and works in every mode. The public recovery kit (vault id, salt, KDF params, never secrets) was reachable only for headerless vaults; a headed (json) or keyfile vault errored from the card and toggle. Headed vaults now cache their public config in the local keystore at init and lazily on connect, so the kit opens without the on-remote marker, and a keyfile vault kit spells out that the keyfile is also required to reopen. Mode-neutral wording throughout	🟢 done	ceb916264	#276 (@EhudKirsh)
29		Opt-in same-name privacy hint for encrypted vaults. A Privacy setting (off by default) that, inside an active crypt overlay, flags files and folders whose plaintext name also appears at another path you have browsed. Filename encryption is deterministic, so identical names are visible as identical to an observer of the encrypted store, the same tradeoff as rclone-crypt and Cryptomator; the hint is a quiet chip with an explanatory tooltip in the list, grid and large-icons views, never a nagging dialog. All 46 non-EN locales	🟢 done	ed1ec0188	#276 (@EhudKirsh)

Requested / under consideration

Community requests and internal follow-ups being evaluated for this or a later release.

Effort: 🟩 quick win · 🟧 medium · 🟥 large / epic. Ordered by effort (quick wins first).

#	Effort	Type	Request	Status	Source
1	🟧		Windows hotplug detection in the AeroFile PLACES sidebar is slow: a freshly inserted drive can take up to ~30s to appear, because the real-time volume watcher is Linux-only (inotify) and Windows/macOS fall back to a 30s poll. A Rust-side WM_DEVICECHANGE listener emitting volumes-changed on device arrival/removal would make it instant; lighter mitigations are a refetch on window focus or a shorter poll interval. Surfaced during the #351 eject verification on real Windows hardware	🔵 idea	#351 (@EhudKirsh)
2	🟧		Eager-evaluation preview and a single-vs-multi-target placeholder for the -i selectors (prioritised by the reporter ahead of Edit(E) and the 2-letter semantics; exact behaviour to be pinned)	🔵 idea	#311 (@EhudKirsh)
3	🟧		AeroSync Compare crypt-awareness for scheduled and incremental sync over a crypt overlay: decrypt remote names and sizes at compare time so only changed files transfer instead of re-uploading the whole folder each run, matching rclone sync over a crypt remote. I will confirm which compare entrypoint is affected after the crypt-overlay epic before sizing it	🔵 idea	#347 (@EhudKirsh)
4	🟧		Trash / version management for S3-family backends (S3Drive, Storj): surface and manage soft-deleted objects and prior versions. Investigation (discussion #266) confirmed S3Drive's Trash is standard S3 bucket versioning, not a proprietary layer (corroborated by S3Drive's own docs, by Storj, and by a rclone cross-check that reaches the same deleted objects via --s3-versions / cleanup-hidden). AeroFTP already ships the generic per-file version primitives for every S3 backend (list versions, download a version, restore by server-side copy-forward, itself a first-class op rclone core lacks). The bounded remaining work, all standard S3, is a bucket-wide trash browse (our list_versions is per-key and drops delete markers, so a deleted file cannot be discovered without knowing its key) plus a permanent purge (DELETE with versionId for one version, and an empty-trash sweep equivalent to rclone's cleanup-hidden). Feasibility verdict only, no code this pass; owner-gated whether to build now or defer	🔵 idea	#266 (@EhudKirsh)
5	🟧		AeroFile text Preview selection and copy parity with the <> Editor: the gutter line-select works in the Editor, but in Preview drag-to-extend struggles (especially downward) and Ctrl+C does not copy (only right-click copy, though the context menu advertises Ctrl+C)	🔵 idea	#347 (@EhudKirsh)
6	🟥		MTP / portable-device provider for AeroFile: surface attached MTP/WPD devices that have no drive letter (phones, cameras; the reporter's Sony Xperia is one) in PLACES, browse the object tree as a virtual path, and copy whole files to and from the device. A design appendix is written (design only, no implementation): it documents the protocol and its hard MTP/OS limits (no real mount, no random access, no delta or resume, whole-file transfers only, best-effort metadata) so they are never read as an AeroFTP shortcoming, and maps the capability onto the existing StorageProvider trait, recommending a hybrid model. Implementation is a later, separate effort	🔵 idea	#351 (@EhudKirsh)
7	🟥		Lossless .jpg to .jxl transcode in AeroFile: JXL re-encodes an existing JPEG losslessly and reversibly (the original JPEG bytes reconstruct exactly), for a real size win with no quality loss. Candidate framing: AeroFile as a GUI for libjxl	🔵 idea	aerovault#2 (@EhudKirsh)
8	🟥		macOS shell integration for the OS extract feature (Deliverable G macOS, deferred): Finder Sync "Extract Here / Extract to Folder" menu items mirroring the Linux Nautilus and Windows verbs, plus macOS custom document-type icons (CFBundleDocumentTypes) for the five aero formats and the generic fallback, and rebuilding the mimetype .icns multi-size (the v4.1.0 ones are single-resolution drafts). Needs a Mac to build and live-test	🔵 planned	#1408 (Deliverable G)
9	🟥		Filen Encrypted Notes: exit Beta: take Filen Notes out of Beta. Fix the participants/add contactUUID format (currently a best-effort workaround), investigate the Filen free-plan 10-note limit ghost-note cleanup, and add a rich text editor for the rich note type	🔵 planned	-
10	🟥		Near-duplicate detection via fuzzy / perceptual hashing (ssdeep / TLSH / pHash) in AeroFile, complementing the existing byte-identical dedupe (BLAKE3, in the GUI Find Duplicates, the CLI aeroftp dedupe, and as an agent tool). Part of a broader principle: deterministic, repeatable file chores should run as ready-made native features or plugins, not through an LLM. The plugin lane (manifest plus script, no AI) is the natural home for these but is currently gated: the signed-registry client is unfinished and CLI plugin support is pending (Fase 6.4, Low). Related to the lossless jpg-to-jxl transcode already tracked above (item 12)	🔵 idea	#383 (@EhudKirsh)
11	🟥		PRIORITY: Linux tray/GTK heap corruption, still-uncovered off-main-thread corruptor. A GDBus worker thread aborts with malloc(): unaligned fastbin chunk detected while deserializing a D-Bus message, the classic GLib heap-corruption signature (that worker is the victim tripping over an already-poisoned fastbin, not the corruptor). Two marshalling fixes already shipped and are safe: tray badge (31db84f8b) and app_ready + splash-timeout (cae95ee91), present since v4.0.5. But the SIGABRT STILL recurs (v4.0.9 on 2026-06-25, and the v4.1.2-era build on 2026-07-05, identical signature): the marshalling is INCOMPLETE, a still-uncovered off-main-thread GTK path remains. Sync Tauri commands are provably main-thread (safe), so the suspects are the event/plugin callbacks whose thread context is unconfirmed: tray on_menu_event / on_tray_icon_event, the single-instance plugin callback, and on_window_event CloseRequested. Pre-existing across versions, intermittent, triggered by D-Bus storms on suspend/resume or monitor standby; it can corrupt the whole app until restart. Definitive path (owner-approved): adopt self-hosted crash reporting with native minidumps to capture the real corruptor, plus an ASan/valgrind repro, then finish the marshalling on the remaining callbacks	🔵 planned	-
12	🟥		User-supplied custom CSS snippets (Obsidian snippets-folder style) to restyle app chrome such as the preview scrollbar, applied across desktop and future mobile. Noted when the preview scrollbar was widened in v4.1.1	🔵 idea	#347 (@EhudKirsh)

Known issues found after release

Reported against v4.1.3. Fixed items ship in v4.1.4; reporters close after confirming in the release.

#	Area	Description	Status	Linked issue

_{Status legend: 🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released}

Affected platforms

• Windows
• macOS
• Linux

---

Maintained by the AeroFTP team. Current release v4.1.3 (#388), next v4.1.4. Patches accumulated here; each release line still gets its own tracker.

[axpnet]

Four quick wins landed on main for v4.1.4

The four green-square quick wins from the wishlist triage are done on main and shipping in v4.1.4 (queued rows 1-4). Two are user-facing polish, one is release tooling, one is a media-safety guard. Details and test evidence below.

#	Change	Status	Commit	Source
1	Google Drive + OneDrive marks refreshed to the official 2026 icons (provider logos + README row)	🟢 done	102b3fde3	#347 (@EhudKirsh)
2	'pCloud' renamed to 'pCloud Drive', 'Amazon S3' to 'Amazon Web Services (AWS)', and Add Services search now matches 'aws'	🟢 done	fd462dc93	#347 (@EhudKirsh)
3	Single pre-release smoke entrypoint npm run smoke	🟢 done	29c0b5131	#347
4	AeroImage Save As: lossless-or-pass-through, warn + confirm on lossy-to-lossy	🟢 done	67ae0d344	aerovault#2 (@EhudKirsh)

4. Lossless or pass-through media conversions (aerovault#2, @EhudKirsh)

The only real format-conversion surface in AeroFTP is AeroImage's "Save As", where the output format can differ from the source (there is no audio transcoder, so the principle applies there). Saving a lossy source into a different lossy format (JPEG to GIF, GIF to JPEG) re-encodes the picture and stacks a second, permanent generation of loss. That path now shows an amber warning and keeps both save buttons ("Save Copy" and "Replace Original") disabled until the user ticks an explicit acknowledgement checkbox. This is a warn-and-confirm, not a hard refuse. Pass-through (same format) and any lossless target (PNG/WebP/BMP/TIFF) stay silent; a lossless source keeps only its informational note.

source to target	guarded	reason
jpg to gif	yes	lossy source, different lossy target
gif to jpg	yes	lossy source, different lossy target
jpg to jpg	no	pass-through, same format
png to jpg	no	lossless source (informational note only)
jpg to png	no	lossless target, no new loss
webp to bmp	no	lossless target

New guard isLossyReencode(source, target) in Preview/types.ts, unit-tested across the full truth table in types.lossless.test.ts; the three new UI strings are translated into all 46 non-EN locales.

3. Single pre-release smoke entrypoint (#347)

One command npm run smoke runs the deterministic Rust + frontend suites plus the lab-backed #[ignore] integration lanes, clean-SKIPs when Docker fixtures or creds are absent, prints a PASS/SKIP/FAIL matrix, and exits non-zero only on a real FAIL. Wired into the pre-tag release checklist. Live run on a station with no fixtures up and the vault locked:

== smoke matrix ==
SUITE                          KIND           RESULT  NOTE
----------------------------------------------------------
rust-unit                      deterministic  PASS    ok (519.4s)
frontend-unit                  deterministic  PASS    ok (3.1s)
integration_delta_sync         integration    SKIP    sftp-rsync fixture not up on 127.0.0.1:2222
integration_sftp_pool          integration    SKIP    sftp-rsync fixture not up on 127.0.0.1:2222
integration_sftp_pipeline      integration    SKIP    sftp-rsync fixture not up on 127.0.0.1:2222
integration_ftp_pool           integration    SKIP    ftp fixture not up on 127.0.0.1:2123
integration_b2                 integration    SKIP    set AEROFTP_TEST_B2_* to enable
dag_s3_multipart               integration    SKIP    dev vault locked (set AEROFTP_MASTER_PASSWORD)
dag_s3_server_side_copy        integration    SKIP    dev vault locked (set AEROFTP_MASTER_PASSWORD)
dag_webdav_copy                integration    SKIP    dev vault locked (set AEROFTP_MASTER_PASSWORD)
dag_b2_multipart               integration    SKIP    dev vault locked (set AEROFTP_MASTER_PASSWORD)
integration_gtc_wan_segmented  integration    SKIP    dev vault locked (set AEROFTP_MASTER_PASSWORD)

summary: 2 PASS, 10 SKIP, 0 FAIL
SMOKE: OK

1-2. Provider icons and labels (#347, @EhudKirsh)

Google Drive and OneDrive were both redrawn in 2026; their marks are refreshed to the current official icons in the provider logos and the README integrations row (reporter supplied the sources). Provider labels are now accurate: 'pCloud' reads 'pCloud Drive' (pCloud is the company, Drive is the app) and 'Amazon S3' reads 'Amazon Web Services (AWS)'; typing 'aws' in Add Services now finds AWS in both the grid and the list through search aliases, where it returned nothing before.

Verified green: npm run typecheck (0), npm run test:unit (43 files, 407 tests, +4 new isLossyReencode cases), npm run build, npm run i18n:validate (46/46 locales, 0 placeholders), cargo fmt --all -- --check, and the deterministic cargo test inside npm run smoke.

[axpnet]

AeroCrypt default flips to a lean headerless base

v4.1.4 work, landed on main (merge e1ec47e2c), shipping in v4.1.4 (#276, from @EhudKirsh).

The default AeroCrypt overlay is now HEADERLESS: crypt init writes nothing on the remote and keeps the per-vault public config (version, salt, KDF params, vault_id) in the local keystore, so a default vault carries zero external files. The .aeroftp-crypt.json header and the keyfile stay strictly opt-in. A mandatory, non-skippable Emergency Kit at setup backs up the public config to paper, so a lost keystore is never a lockout. Delivered across CLI, GUI and MCP, with lossless conversion both directions.

Area	Change	Status	Commit
Backend init	headerless is the default, --with-header is the opt-in, the public config is persisted in the keystore per profile, unlock branches marker then keystore then fail-closed, and a non-empty target is refused (no silent salt rotation)	🟢 done	1b46966a8, c8405ee3c
Migration	crypt to-headerless / to-headed, metadata-only in both directions (salt, vault_id and MAC preserved), verify-before-destroy, idempotent	🟢 done	34375b5b1
Emergency Kit	single builder, public fields only (never the password, master key or MAC), non-skippable on both CLI init exits and the GUI create dialog	🟢 done	fc6938778
GUI + i18n	header opt-in toggle (default headerless), connect-time keystore load, kit dialog wired to i18n, all 47 locales	🟢 done	d16320cae, 555db6d08, eec44afaa

Verified per commit: cargo fmt --all -- --check, cargo clippy --all-targets --tests -- -D warnings, cargo test -p aeroftp (2587 lib + 448 CLI green, including the aerocrypt and emergency_kit unit tests), npm run build, npm run i18n:validate (0 placeholders across 46 locales). Each external-agent contribution was audited by the orchestrator, which found and fixed 4 defects before merge (2 in the GUI create path, 2 in the Emergency Kit wiring).

Still pending before the v4.1.4 tag (Task 5): the MCP crypt tool audit and the full live SFTP matrix (headerless default, --with-header, both migration directions, MCP headerless connect, GUI toggle plus mandatory kit plus the no-orphan guard). Main CI is running on the merge.

[axpnet]

Profile export/import, delete and duplicate are now complete: no dropped field, no orphaned secret, no half-copy

Landed on main, shipping in v4.1.4. Found by an audit of the native .aeroftp profile backup while closing the AeroCrypt overlay work: a saved profile carried more state than its export, its delete, and its duplicate actually handled. The Filen CLI API key was the sentinel; the fix makes all three operations coherent around one enumeration.

Area	Description	Status	Commit
Export/import round-trip	Four top-level ServerProfile fields outside options were dropped on export and re-import (publicUrlBase, customIconUrl, faviconUrl, skipDeltaEligibilityPrompt), plus the vault-only Filen API key (#230) and OneDrive drive id/type. All now survive. The GUI import merge was a second silent drop point (it also lost persistModeCredentials from #215): fixed	🟢 fixed	1616a1e29, 85a999f6a
Delete leaves nothing	Deleting a profile now purges every vault secret scoped to it, not just server_<id>. Before, the Filen key, the four crypt-overlay secrets, the OAuth token, the per-mode snapshots and the OneDrive hints were orphaned in the vault	🟢 fixed	85a999f6a
Duplicate carries everything	Copying a profile now copies all of its secrets, so a duplicate is a working clone (crypt overlay, Filen key, OAuth/Jotta token), not just the password	🟢 fixed	85a999f6a
One source of truth	per_profile_vault_keys(id, protocol) is the single list shared by export-collect, delete and duplicate, backed by two new commands purge_profile_secrets / copy_profile_secrets that both the GUI and the CLI go through, so they can never diverge. App-global keys (oauth_<slug>_client_id/secret) are excluded so deleting one profile never breaks the others of a provider	🟢 fixed	85a999f6a
CLI parity	profile-add gained --public-url-base, --custom-icon-url, --favicon-url, --skip-delta-eligibility-prompt, --filen-api-key; a latent bug where a cloud profile with no host failed profile-export ("missing field host") is fixed	🟢 fixed	1616a1e29
Headerless MCP unlock test (Task 5 A)	Confirmed the MCP crypt path already honours the headerless default with no remote marker; added the missing unit test (headerless unlock, and both fail-closed paths)	🟢 fixed	88ad98cff

Live-verified with the release CLI against the real vault: a Filen profile carrying a server credential plus the Filen key exports with hasCredentials: true; export then delete then re-export still carries all four top-level fields plus the key; duplicating it copies both keys onto the new id; and deleting it leaves all ten per-profile vault keys absent.

Verified green: cargo fmt --all -- --check, cargo clippy (bin + all-features --tests -D warnings), cargo test -p aeroftp (lib 2595, cli 449), npm run typecheck, npm run test:unit (424), npm run i18n:validate (0 placeholders), npm run build.

[axpnet]

Headerless AeroCrypt now works end to end in the GUI, with an optional on-demand recovery kit

Post-4.1.3 follow-up, fixed on main, shipping in v4.1.4 (#276, @EhudKirsh).

The v4.1.4 headerless default (queued #7) shipped its CLI and MCP paths, but the GUI connect flow was still broken: a headerless AeroCrypt profile failed closed on every connect and every manual toggle, fell back to the raw provider, and would upload in plaintext into a folder the user believed was encrypted. This batch fixes the connect path and, per the owner's "as frictionless as rclone" direction, makes the recovery kit optional and reachable on demand instead of a blocking setup step in the GUI.

Area	Description	Status	Ref
GUI overlay unlock	The activation payload dropped the profile id that keys the headerless vault config in the local keystore, so the backend could neither create nor read it and refused ("could not be unlocked"). Forwarding the id fixes auto-unlock on connect, the badge toggle, and create-at-first-connect on an empty folder	🟢 fixed	9920784a5
Plaintext fallback	With the overlay failing to arm, uploads went to the raw provider in cleartext. Fixing the unlock closes that path; the backend now also logs the real unlock-failure reason (kind only, no path or secrets) instead of swallowing it	🟢 fixed	9920784a5
Recovery kit, non-blocking	The GUI Emergency Kit is no longer a mandatory non-skippable gate at creation (this refines the GUI half of queued #7). The vault is usable immediately; the public kit (vault_id, salt, KDF params, no secrets) is shown on demand in a new modal, re-viewable and re-savable any time	🟢 done	02821d52f, 9920784a5
Kit access points	New backend command builds the kit from the keystore config without connecting. Reachable from the saved-server right-click menu (native AeroCrypt profiles) and from a right-click menu on the crypt badge; the badge menu also toggles the overlay on and off. The rclone-crypt badge menu is toggle-only (stateless, no kit)	🟢 done	9920784a5
UX	Overlay toggle-off is now recorded in the Activity Log; the flashing duplicate-profile alert on save is removed (kept in the log); an em-dash is gone from the badge tooltip; the Overlays Remote Path placeholder no longer clones the Remote Path (now "/")	🟢 done	9920784a5

Verified live end to end on an isolated SFTP server (connect bootstraps the vault, uploads encrypt, toggle on/off, reconnect re-opens decrypted) and green on the full gate: fmt, clippy (bin and all-features with --tests, -D warnings), cargo test (lib 2595, cli 449), typecheck, vitest 424, i18n:validate 0 across 47 locales, build.

[axpnet]

AeroCloud #405: delete propagation, one-way folders, and CLI parity land for v4.1.4

The first slice of the AeroCloud #405 build-out is on main, shipping in v4.1.4 (#405, @EhudKirsh).

Area	Change	Status	Commit
Delete propagation	A delete on one side removes the file on the other (index-aware decide plus execute plus a safety gate), on both the provider and FTP twins. No more resurrection.	🟢 done	e167073e0, 55134fab2
One-way folders	Send-only / receive-only per folder via a centralized decide_sync_action, plus a preserve_remote_deletes toggle (additive backup vs strict mirror).	🟢 done	b98f5b33f, 3fabf991b
CLI parity	aeroftp-cli aerocloud show/set/enable/disable/status/sync; AeroCloud was GUI-only.	🟢 done	49c4e97b3, 96a0c447e
Watcher knobs	Debounce and cooldown between watcher-triggered syncs are now configurable (GUI and CLI).	🟢 done	405d47f61

Live-verified headless against a real MEGA remote via aerocloud sync: the initial sync uploaded, a steady-state cycle was a true no-op (baseline preserved), deleting a local file propagated the delete to the remote on the next cycle, and the following cycle did NOT resurrect it (the remote listing confirmed it gone, the others intact). Two adversarial audits passed (one critical baseline-wipe bug found and fixed). The watcher knobs were CLI round-trip verified (set then show).

Still cooking for #405: multiple sync pairs, SFTP key-based auth for AeroCloud, and the full transformative overlay stack (all tracked in Requested).

Verified green: cargo test (sync 763, cloud 101+), clippy -D warnings, fmt --check, npm build, i18n 47 locales (0 placeholders).

[axpnet]

Yandex Disk WebDAV is now marked paid (Yandex 360 subscription)

Post-4.1.3 follow-up, fixed on main, shipping in v4.1.4 (#274, reported by @EhudKirsh).

Yandex 360 confirmed to the reporter (by email from their support team) that WebDAV is restricted to Yandex 360 subscribers as of 22 June, which is the 402 that WebDAV clients including AeroFTP hit. Yandex Disk WebDAV now carries the paid (gold) marker in the Add Service table and sits in the paid column, matching pCloud Drive; the Yandex Disk OAuth API stays free (5 GB).

Area	Change	Status	Commit
Provider catalog	Yandex Disk WebDAV marked paid, note "Yandex 360 subscription"; OAuth stays free.	🟢 fixed	93e89d1c3

Verified green: regenerated cli_catalog.json plus the README matrix and docs/PROVIDERS.md, the catalog drift-guard tests pass, npm build.

[axpnet]

AeroCloud now connects with a key-auth SFTP profile

Post-4.1.3 follow-up, fixed on main, shipping in v4.1.4 (#405, requested by @EhudKirsh).

AeroCloud connect was password-only: pointing it at a saved SFTP profile that authenticates with a key failed with "Authentication rejected by server". The key material (private_key_path, key_passphrase) lives in the saved profile's options, and the AeroCloud factory built the provider from connection_params only, so the key never reached the connector. The fix mirrors the normal GUI/CLI/MCP connect path, which already resolves SSH keys.

Area	Description	Status	Ref
AeroCloud	The multi-protocol factory now merges private_key_path and key_passphrase from the saved SFTP profile's options into the provider config, after connection_params and gated to SFTP. Explicit connection_params win (no clobber), password-auth SFTP and every other provider are untouched. One change covers both the GUI background worker and aeroftp-cli aerocloud sync (both go through the same factory)	🟢 done	53241a770
Coverage	Passphrase-protected keys included. ssh-agent stays out of scope (matches GUI/CLI/MCP, file-based keys only); an unknown host still needs a pre-seeded known_hosts, same as password SFTP	🟢 done	53241a770

Live-verified headless on the DEV vault: a plaintext key-auth SFTP profile and a temporary passphrase-protected key, each aerocloud set then aerocloud sync --dry-run then a real aerocloud sync, with the uploaded marker read back over SFTP. Temporary key and profile removed after.

Verified green: cargo fmt, cargo clippy --all-targets -D warnings, cargo test --lib cloud (109 passed, 5 new SFTP-key unit tests), cargo build --bin aeroftp-cli, plus the live DEV-vault sync above. Isolated to cloud_provider_factory.rs (+121 lines).

[axpnet]

AeroCloud now syncs more than one pair per install

Post-4.1.3 follow-up, fixed on main, shipping in v4.1.4 (#405, requested by @EhudKirsh).

AeroCloud synced a single local-to-remote pair. It now drives N independent pairs, each with its own saved profile, protocol, direction, sync index and crypt overlay, from the same background worker and from the CLI. The store is deliberately separate from AeroSync's multi-path store so the two features never share state.

Area	Description	Status	Ref
Store	New cloud_pairs.json with CloudPathPair / CloudPairsConfig (atomic write, per-pair full sync fields, to_cloud_config seam). AeroSync's multi_path.json / PathPair untouched. Empty or absent store falls back to the legacy single CloudConfig (back-compat)	🟢 done	07a96f83a
Engine	The connect, crypt-wrap, ensure-remote, sync sequence was first unified into one cloud_service::sync_one_config helper shared by the worker and the CLI (removing a duplicated copy). The worker then loops the enabled pairs, resolving each pair's protocol from the vault before syncing so a non-FTP pair works, not just FTP	🟢 done	07a96f83a, aaddd0501
CLI + GUI	aeroftp-cli aerocloud pair list/add/remove/enable/disable/sync (nested under aerocloud, no allowlist change) plus a new GUI pairs editor wired to the same store, strings in all 46 locales	🟢 done	9e2582c3f, aaddd0501
Safety	Per-pair UUID id (no collision after remove then add) and a duplicate-(local,remote) guard keep each pair's sync-index baseline isolated. A restored RAII in-progress guard serializes a manual sync against the background batch (they no longer race the same index)	🟢 done	aaddd0501, 9d1e0c9fe

Live-verified headless on the DEV vault: two independent non-FTP pairs (MEGA and Koofr, both stored with the default protocol and resolved at sync time) synced in a single pair sync pass, uploaded 2 and errors 0, then cleaned up.

Verified green: cargo fmt, cargo clippy --all-targets -D warnings, cargo test --lib cloud (113 passed), cargo test --lib sync (763 passed), cargo build --bin aeroftp-cli, npm run build, npm run i18n:validate (46 locales, 0 placeholders), plus the live 2-pair non-FTP sync above.

[axpnet]

RustCrypto core crates: held on the 0.10 cohort with documented pins (Step 0)

Post-4.1.3 follow-up, resolved on main, shipping in v4.1.4 (Dependabot #379 #380 #381).

The three Dependabot bumps (aes-gcm to 0.11, chacha20poly1305 to 0.11, cbc to 0.2) cannot land as a clean unification: the 0.11 cohort does not converge with the rest of the tree. Rather than half-migrate the encryption core, we applied the release Step 0 rule and pinned the working versions with a recorded reason.

Area	Description	Status	Ref
Why it does not converge	aerovault 0.6.3 uses aes-gcm-siv 0.11 and chacha20poly1305 0.10, noq-proto pins aes-gcm 0.10.3, and cbc 0.1.2 stays transitive via keyring/pkcs5. Bumping only AeroFTP's direct dependency would leave BOTH cohorts in Cargo.lock (no net win, more surface)	🟢 done	df763719f
What shipped	Explicit pins aes-gcm =0.10.3, aes =0.8.4, cbc =0.1.2, chacha20poly1305 =0.10.1 in src-tauri/Cargo.toml (and the peer-l0 crate), each with an inline reason, and the three Dependabot PRs closed pointing here	🟢 done	df763719f

Crypto core verified still round-trips (no format change, API-only posture): DEV vault unlock read 24 profiles, a profile export then import decrypted old ciphertext, and a live Cryptomator vault mount decrypted real files (guards #322), unmounted clean.

Verified green: cargo fmt, cargo clippy --all-targets -D warnings, cargo test (crypto 29, cryptomator 7, providers::internxt 7, providers::mega_crypto 14), the AeroCrypt and aerovault_v3 golden/test-vector suites, cargo build, plus the live crypto round-trips above.

[axpnet]

Windows archive opener registration (Deliverable G #3)

Post-v4.1.3 follow-up, fixed on main, shipping in v4.1.4 (#1408).

NSIS and MSI/WiX now register the shared AeroFTP.Archive ProgID (DefaultIcon using the yellow archive mimetype asset), OpenWithProgids values, SupportedTypes, Capabilities (with FileAssociations) and the RegisteredApplications entry for .zip .7z .rar .tar .tgz .gz .xz .bz2. The registration is "available opener" only: no default handler is written on the extension keys, existing double-click behaviour and the additive "Extract here / to folder" verbs are untouched. Uninstall removes only AeroFTP-owned keys and values.

Small accompanying improvement: single-instance and first-launch paths now forward qualifying archive paths and the frontend listener opens the in-app ArchiveBrowser (with encryption probe) so choosing AeroFTP from Open-with actually surfaces the archive instead of an empty main window.

Area	Description	Status	Commit
Windows installer (NSIS)	New narrow macros for ProgID, OpenWith, Capabilities, SupportedTypes, RegisteredApplications + symmetric cleanup	🟢 done (candidate)	78f0e017a
Windows installer (WiX)	Matching components with stable GUIDs, HKMU, KeyPath hygiene, correct aeroftp.exe casing	🟢 done (candidate)	78f0e017a
App launch	Archive path forwarding + frontend listener	🟢 done (candidate)	78f0e017a

No general archives were added to tauri.conf.json fileAssociations. Linux-only validation performed: cargo fmt --check, cargo clippy --all-targets -D warnings, rg structural assertions covering all 8 extensions in both installers, XML well-formed, TypeScript check.

Full validation (reg query HKCU...AeroFTP.Archive, OpenWithProgids, Capabilities, RegisteredApplications; Explorer right-click "Open with" list + icon; Settings > Default apps discovery; uninstall cleanup leaving no AeroFTP.Archive residue; confirmation that defaults for .zip etc. are unchanged) remains to be performed on a clean Windows machine.

[axpnet]

In-app File associations settings panel (Deliverable G)

Post-4.1.3 follow-up, implemented on main, shipping in v4.1.4 (#1412).

Settings > File Handling now contains a compact, live OS-backed "File associations" section. AeroFTP-owned formats and the archive formats from the previous Windows opener work display accurate Default / Available / Other state pulled from the OS.

• Linux: checkboxes / Make default apply immediately with xdg-mime default com.aeroftp.AeroFTP.desktop <mime> (and tolerant fallbacks).
• Windows: never touches protected UserChoice; "make default" reliably opens the real Default apps UI (ms-settings:defaultapps); status only reads.
• macOS: best-effort path present and compile-clean (no claim of live validation).

Refresh always re-queries the OS. No fake persisted state. All 17 strings fully translated to 46 locales via batch method. Unit tests + all gates green.

Area	Description	Status	Ref
Backend	New file_associations.rs module, 3 Tauri commands, pure catalog for 5+5 formats, platform status + apply logic	🟢 fixed	2cd804402
Frontend	FileAssociationsPanel.tsx (compact rows, groups, action per OS, ExternalLink on Win) integrated under File Handling	🟢 fixed	2cd804402
OS integration	Desktop MimeType lines expanded for archives; deb postinst kept in sync	🟢 fixed	2cd804402
i18n	17 keys + full sync + batch translate + 0 placeholders across 46 locales	🟢 fixed	2cd804402
Tests / gates	Rust 6 + TS 4; fmt/clippy/typecheck/i18n/Linux xdg smoke all green	🟢 fixed	2cd804402

Verified green: cargo fmt --all -- --check; cargo clippy --all-targets -D warnings; cargo test file_associations --lib (6 passed); npm run typecheck; npm run test:unit -- fileAssociations (4 passed); npm run i18n:validate (0 placeholders, PASSED); Linux xdg-mime smoke with isolated XDG_CONFIG_HOME + data dir.

Windows eyeball pending: open the panel, click an archive row, confirm Default apps appears, pick AeroFTP for .zip, return, Refresh, row becomes Default. Other extensions unchanged.

[axpnet]

AeroCrypt Recovery Kit in every mode, and an opt-in same-name privacy hint

Post-4.1.3 follow-up, done on main, shipping in v4.1.4 (#276, from @EhudKirsh).

Two changes out of the AeroVault design thread. The on-demand Recovery Kit used to work only for headerless vaults; it now works in every mode. And a new opt-in setting surfaces the deterministic-name observability Ehud raised, quietly and only when you ask for it.

Area	Description	Status	Ref
AeroCrypt	Recovery Kit optional and on-demand in every mode (headerless, headed, keyfile): headed vaults cache their public config in the local keystore at init and lazily on connect, so the kit opens without the on-remote marker; a keyfile vault kit notes the keyfile is also required	🟢 done	ceb916264
Privacy	Opt-in same-name hint (off by default): inside an active crypt overlay, a quiet chip flags files and folders whose plaintext name also appears at another path you browsed, since deterministic name encryption makes identical names visible to an observer (as in rclone-crypt and Cryptomator). List, grid and large-icons views, all 46 non-EN locales	🟢 done	ed1ec0188

Verified green: cargo fmt, clippy --all-features --tests and --bin aeroftp-cli with -D warnings, cargo test (full suite), typecheck, vitest 432, i18n:validate 46 locales 0 placeholders, cargo audit clean, npm run smoke 2 PASS 0 FAIL. The v4.1.4 CHANGELOG is prepared and the release is pushed to main; the tag lands once CI is green on all platforms.

[axpnet]

v4.1.4 is released, closing this tracker

AeroFTP v4.1.4 is tagged and published, sigstore-signed: the Windows (.msi/.exe/portable), macOS (.dmg on Intel and Apple Silicon) and Snap assets are live, and the Linux .deb/.rpm/.AppImage are finishing upload as the tag CI completes. This tracker is now closed; anything reported against 4.1.4 and every patch landing on main after this tag move to the v4.1.5 tracker (#421).

What shipped in 4.1.4

A polish-and-hardening release. The 29 queued rows above are the full list; the headline themes:

Area	What shipped
Archive at a glance	Archive encryption, the real compression method and AeroVault generation surfaced in both the local and the remote file browser (padlock with the detected cipher, Encryption/Compression columns, AeroVault chip), header-only and download-free
AeroCrypt	Optional keyfile second factor (keyfile-only vaults allowed, fail-closed through export/import), the default flipped to a lean headerless base, and the recovery kit now optional, on-demand and working in every mode (headerless, headed, keyfile)
Crypt overlay scope	A dedicated Overlays Remote Path sub-scope input and CLI crypt bind: plaintext outside the bound subtree, decrypt only inside, across the GUI, CLI and MCP (completes CWP-20C)
Safer deletes	A real --dry-run on the destructive CLI verbs with recursion now opt-in and the global filters honoured, and MCP recursive delete made opt-in and fail-closed; plus full S3 trash and version management from the GUI, CLI and MCP with a live-file safety fix
AeroCloud	Multiple sync pairs, delete propagation, send-only/receive-only folders, CLI reachability, SFTP key auth, a tunable real-time watcher and a compress overlay
CLI for agents	A global --machine structured-output mode, a remote find-and-replace edit command and the MCP aeroftp_edit tool, and the drift-proof aeroftp-cli inventory command-and-tool SSOT
Platforms and speed	macOS promoted from beta to stable and now shipping signed, and roughly 3x faster recursive SFTP listing
Security	A vertical audit the length of the cycle (AeroFile B1 17/17, integer-overflow guards on remote archive detect, no walker follows a symlink-to-directory cycle, per-scope keyring isolation so a sandbox cannot lock a native vault, a signed macOS dmg), with the pre-release and pre-tag commit audits both PASS

Also in the release: an app-wide Date format setting, the Windows archive opener registration and an in-app File associations panel, and a broad set of connection, Filen, Transfer Queue and FTPS crash fixes. 47 languages translated.

Full detail: the release notes. Thanks to the reporters who drove this cycle, @EhudKirsh, @coolfocks and @JonathanHarford.