Repository navigation
Replies: 52 comments
Startup resume-queue prompt with smart auto-connect (TQ-7c)Post-4.1.5 follow-up, fixed on TQ-7b already restored interrupted transfers as pending Restored items after restart. Live testing showed the per-item Retry is easy to miss, and pressing it while disconnected failed with no clear gate. This ships a discoverable banner plus a smart resume path that connects to the journal profile when needed.
Verified green: tsc --noEmit, vitest transfer queue helpers (54), npm run i18n:validate 46/46, live GUI resume path on SFTP. |
Windows hotplug: PLACES volumes update instantly on insert/ejectPost-4.1.5 follow-up, fixed on Windows PLACES used a 30s poll (plus the v4.1.5 focus refetch) because the real-time volume watcher was Linux-only. A dedicated thread now owns a hidden tool window that receives
Verified green: Linux |
Windows parent folder no-op at drive rootPost-4.1.5 follow-up, fixed on Going up from a first-level folder under a drive (
Verified green: |
|
Phones as saved servers: AeroFTP now rides the desktop's MTP mount instead of fighting itLanded on An Android phone can now be saved as a My Servers card, with a live dot for the cable and a Connect that opens the phone in the remote panel with the full transfer fabric. The interesting part is what had to change to get there, because the original design could not work on any normal Linux desktop. What the phone actually allowsControlled experiments on a Sony Xperia 1 V established a constraint that no amount of engineering can work around: the device grants one MTP session per physical connection. The first client to open it wins, and every later client fails until the cable is re-plugged. A clean close does not re-arm it, and a USB reset does not either. The desktop file manager takes that session automatically at plug time. So the previous model, claim the device exclusively and release the file manager's grip first, was a race that could only be lost, and losing it left the phone wedged for every client, the file manager included, until the user re-plugged the cable.
What shipped
Live results (Sony Xperia 1 V, XQ-DQ54)
Verified green: |
Native delta downloads now verify reconstructed bytes before commitPost-4.1.5 follow-up, fixed on The native delta receiver previously committed a reconstructed file after checking only its size. It already received the sender's whole-file checksum, but did not compare it, so a same-size bad reconstruction could be reported as successful. The receiver now verifies the negotiated xxh128 or md5 trailer before the atomic commit.
Verified green: full Rust gate recorded for the merged commits, targeted aerorsync tests, stock rsync 3.2.7 live interop, and all four path-applicable CI workflows on |
Incomplete AeroSync compare scans now fail closedPost-4.1.5 follow-up, fixed on The Compare walkers could swallow traversal failures and return a partial tree as if it were complete. A file hidden by an unmounted drive, a permission failure, a cancelled scan, or a failed remote listing then looked exactly like a user deletion and could feed a Mirror delete plan.
Verified green: |
Truncated delta signatures now require a real strong-checksum matchPost-4.1.5 follow-up, fixed on Real rsync signatures commonly carry a short strong-checksum prefix. The rolling matcher previously skipped the strong comparison whenever that prefix was shorter than 32 bytes, so any Adler-32 hit could be accepted. The matcher now recomputes the block digest with the negotiated algorithm and seed, then compares exactly the advertised prefix length.
Verified green: format, clippy with warnings denied, the Rust suite, 12 targeted producer tests, the aerorsync feature suite, stock rsync 3.2.7 interop for the implemented algorithms, and all four path-applicable CI workflows on |
An unstattable local file can no longer silently become a remote deletePost-4.1.5 follow-up, fixed on The AeroCloud local scan used
Verified green: |
Safe MD5 block matching restores delta reuse for MD5 peersPost-4.1.5 follow-up, fixed on After strong confirmation became mandatory, md5 peers correctly fell back to literals because AeroFTP could not yet reproduce rsync's per-block md5 digest. The block matcher now mirrors rsync 3.2.7 seed placement and compatibility-flag behavior, so md5 rolling hits can be confirmed safely.
Verified green: format, clippy with warnings denied, the Rust suite, 8 targeted md5 tests, the aerorsync feature suite, forced-md5 stock rsync 3.2.7 interop, and all four path-applicable CI workflows on |
xxh64 and xxh3 peers no longer hang on 8-byte checksum framesPost-4.1.5 follow-up, fixed on The native receiver assumed a 16-byte checksum in two places even after negotiating an 8-byte algorithm. On a complete xxh64 file-list frame, it consumed the terminator as digest data, classified the frame as truncated, and waited for another frame the peer would never send. The delta trailer carried the same latent fixed-width bug.
Verified green: |
xxh64 and xxh3 now reuse blocks against stock rsync, not just completePost-4.1.5 follow-up, fixed on The previous entry closed the negotiated-width hang and deliberately stopped there: xxh64 and xxh3 completed with exact bytes, but their block-strong algorithms still mapped to
Direct stock rsync 3.2.7 matrixEach case uses a 1 MiB incompressible baseline with a localized 4 KiB mutation, so a pass means real block reuse rather than compressed all-literal traffic. Every run asserts exact byte identity and nonzero CopyRun telemetry.
Verified green: This closes AUDIT-03 B3, the Sync-stack lane. |
|
Ehud v4.1.4 retest wave 1: 15 findings shipped to
|
| Area | What shipped | Status | Commit |
|---|---|---|---|
| Profiles | Cross-user Copy/Move stops the false "already saved": a real relocate identity key (account surface plus HMAC credential fingerprint), not the storage dedup_key. Move write-before-delete (#366) untouched |
🟢 fixed | ec1601ac5 |
| S3 | New Folder creates a real empty folder (x-directory marker plus HEAD-probe classification), no phantom file; live-tested on S3Drive and MinIO | 🟢 fixed | 3d112e5e7 |
| Crypt nav | Mixed-mode: edits outside the Overlays Path pass through as plaintext, the crypt toggle is gated to inside the anchor with an "Overlays Path" button outside, connect lands on the Remote Path. Owner-signed design; #388/#390 fail-closed guards verified untouched | 🟢 fixed | 8d7bbefa1 |
| AeroSync | Compare shows the % of items and bytes out of sync; crypt-aware Compare now passes the vault binding so rclone-crypt no longer diffs the whole folder | 🟢 fixed | 4305116cd, ec32e62cf |
| Add Service | One count source across grid and table, MEGA S4 folded into the MEGA row ("S4 (S3)" / "S5 (S3)"), new S3Drive / Quotaless / FileLu FTP rows | 🟢 fixed | c7ac9df6c |
| Trash / Queue | MEGA folder purge uses -r; Transfer Queue counter reads completed/total; progress card no longer overlaps the queue; Permanent Delete vs Empty Trash tooltips |
🟢 fixed | ec32e62cf, e25896ccf |
| UI | Shared icon-left search box across 10 inputs; dual-panel breadcrumb path bar; TAB.DIGITAL casing; README File Formats reorder | 🟢 fixed | 9b065e8ed, 5a05139f8, ec32e62cf |
Verified green: cargo fmt --check, cargo test --lib crypt 243/0, cargo test --lib relocate_ 9/0, cargo test --lib providers::s3 54/0, npm run typecheck 0, npm run i18n:validate 46/46 clean, npm run test:unit 503/503. GUI-to-backend crypt wiring verified at the code level (GUI mutations route through the same wrapped provider the CLI and MCP use). User-facing GUI live-tests are batched for a follow-up pass.
Still open from the retest (not in this wave): OneDrive OAuth redirect_uri (Known issue 3), pCloud trash auth (4), Dropbox trash buttons (5), the Add-Service company column and recommended-protocol highlight (Requested 22, 23), plus the CLI/markdown "S4 (S3)" parity and OAuth-token relocation follow-ups (tracked separately).
|
v4.1.4 retest follow-ups: catalog parity, cross-user token relocation, Security Tools wave 2Post-4.1.5 follow-up, merged on The six follow-ups that surfaced while shipping the v4.1.4 retest wave, plus the Security Tools feedback wave from the #369 thread.
Live-test proof for the #366 lane: a real pCloud-OAuth profile copied across users authenticates on the new id (the relocated token lists the pCloud root); the source stays intact on Copy. Verified green: |
Hash Forge drag&drop now fires in-appPost-4.1.5 follow-up, fixed on The main webview runs with
Verified green: typecheck 0, test:unit 504/504, clippy 0, plus a live in-app drop that hashed to the correct content digest. |
|
Legacy crypt overlay profiles auto-unlock againPost-4.1.5 follow-up, fixed on An encrypted-overlay profile created before the
Verified green: typecheck 0, test:unit 504/504, clippy 0, two new Rust unit tests, plus a live in-app unlock of the previously-broken profile. |
|
AeroRsync streaming signatures (Y-RSC.5)Post-4.1.5 follow-up, fixed on The native delta download signature phase no longer bulk-reads the local baseline into RAM. Production downloads open
Unit / parity (local,
|
| Gate | Result |
|---|---|
cargo fmt --all -- --check |
pass |
cargo clippy --lib --features aerorsync --all-targets -- -D warnings |
pass |
cargo test --features aerorsync --lib aerorsync -- --skip live |
593 passed, 0 failed, 6 ignored (23.12s) |
delta_sync::tests::compute_signatures_streaming_* (6 cases: empty / sub-block / exact / ragged / many-blocks + zero-size reject) |
6/6 pass |
build_signatures_streaming_matches_bulk |
1/1 pass |
Live against stock rsync 3.2.7 (Docker harness aeroftp-rsync-real :2224)
| Test | Result | Notes |
|---|---|---|
driver_upload_live_lane_3_real_rsync_byte_identical |
🟢 | bulk path, byte-identical remote |
driver_upload_streaming_live_lane_3_real_rsync_byte_identical |
🟢 | streaming twin |
delta_download_symlink_live_lane_3_readlink_identical |
🟢 | readlink target lane3-dl-target-1784893273131326452.bin |
Pair wall-clock: 0.25s; symlink download: 1.48s.
Integration fixture (aeroftp-delta-sync-fixture :2222, cargo test --test integration_delta_sync -- --ignored)
11/11 passed in 17.34s (3 password-auth cases skipped cleanly: password fixture not running).
| Measurement | Value |
|---|---|
| Native upload (stock rsync peer) | sent 1 048 850 B, received 24 B, speedup 1.00x, 221 ms |
| Native download (stock rsync peer) | sent 1 048 978 B, received 36 B, speedup 1.00x, 234 ms |
| Redundant second upload (delta cheap path) | sent 65 B of 2 097 152 B total (~2 MiB file) |
| Z.1.1 KPI delta savings (32 MiB, ~5% mutation) | second pass 10 728 ms, wire 43 776 B, ratio 0.0013 |
| Z.1.1 KPI batch 100×~1.1 KiB cold | uploaded 100, 0 errors, 9 292 ms, wire 18 600 B, 1 session |
| Z.1.1 KPI batch second pass (50 of 100 changed) | uploaded 50, 0 errors, 7 096 ms, wire 380 947 B, 1 session |
Also green offline offline mocks in the same binary: 5 non-ignored unit cases (hard-error / mock transport contracts).
RSS acceptance (not run this session)
build_signatures_streaming_rss_under_128mib_on_4gib_sparse is #[ignore] (4 GiB sparse baseline, peak VmHWM growth < 128 MiB). Run with:
cargo test --features aerorsync --lib \
aerorsync::engine_adapter::apply_delta_streaming_tests::build_signatures_streaming_rss_under_128mib_on_4gib_sparse \
-- --ignored --nocaptureVerified green: fmt, clippy -D warnings, aerorsync 593/0, streaming parity 6+1, live lane3 pair + symlink download, integration_delta_sync ignored 11/0 with the numbers above.
|
|
| Area | Description | Status | Ref |
|---|---|---|---|
| Mode endpoint table | MODE_GROUPS now carries the per-mode endpoint and port, mirroring the matching frontend preset, applied when a duplicated or converted profile is materialized |
🟢 fixed | 998c5e902 |
| No guessing | modes with no derivable endpoint (the FileLu and Filen S3 surfaces, which need a bucket and region of their own) warn instead of producing a silently broken profile | 🟢 fixed | 998c5e902 |
| Distinct flag | --all-protocols is its own flag, --all keeps its meaning of one row per saved profile |
🟢 done | 3ab78005f |
| Fan-out | each selected profile expands into one run per mode of its provider group, one comparison row and one mini table per mode | 🟢 done | 3ab78005f |
| No vault writes | the per-mode profile is synthesized in memory keeping the source id, so the saved credential still resolves and an interrupted sweep cannot leave throwaway profiles or credentials behind | 🟢 done | 3ab78005f |
| Honest skips | a mode whose credentials are not shared across the group (FileLu, Filen) or whose endpoint is not derivable is reported with its reason, inline and in a summary, and never measured as a zero row | 🟢 done | 3ab78005f |
Live results, real accounts, 1 MiB payload:
| Profile | Type | Protocol | Upload Mbps | Download Mbps |
|---|---|---|---|---|
| Koofr (api) | Koofr | REST API | 11.12 | 15.15 |
| Koofr (webdav) | WebDAV | WebDAV | 12.73 | 12.00 |
| OpenDrive (api) | OpenDrive | REST API | 1.42 | 1.46 |
| OpenDrive (webdav) | WebDAV | WebDAV | 2.29 | 1.61 |
FileLu exercised the other path: its native mode was measured and the three sibling modes were skipped with the reason that each needs its own credentials. The vault held the same 99 profiles before and after every run, and the endpoint fix was checked both ways, the same duplicate returning 404 before and listing the real account after.
Verified green: cargo fmt --all, cargo clippy --all-features --tests and --bin aeroftp-cli both clean, cargo test 3802 passed 0 failed 69 ignored, npm run i18n:validate 0 errors and 0 placeholders across 47 locales.
The benchmark MCP tool reaches the many-files and per-protocol workloadsPost-4.1.5 follow-up, done on The many-small-files workload shipped for the CLI in v4.1.5 and the per-protocol fan-out shipped just now, but an agent could reach neither: the
Verified against the real MCP server over stdio, not a mock: a Koofr fan-out call returned two reports with Verified green: |
File associations: uninstall no longer leaves registry residue on Windows, and "Make default" works on LinuxPost-4.1.5 follow-up, fixed on One report opened a thread that turned out to have a mirror-image bug on the other platform. On Windows an uninstall left five
Measured rather than reasoned, on real hardware:
Scope note, stated rather than implied: the reporter also asked for a way to disable the associations. That is not in this change. AeroFTP never claims the default handler for the general formats, it only adds itself to "Open with" plus its own context-menu entries, so with the residue fixed what remains is menu visibility. The opt-out design is written up and parked as a "Requested / under consideration" row (#11) rather than half built, because a visible components-page checkbox is unreachable without forking the Tauri NSIS template. Verified green: |
FTP Max multi-file concurrency reaches 5 workers at
|
| Area | Description | Status | Ref |
|---|---|---|---|
| Governor | Raise DEFAULT_DISK_DEVICE_SLOTS 4 -> 8 (aligned with MAX_MAX_CONCURRENT) |
🟢 fixed | 296e97db |
| Unit pin | disk_device_slots_default_covers_transfer_concurrency_ceiling |
🟢 | governor tests |
| Live FTPS | true in-flight peak 4 -> 5; 8/8 files; wall ~27 s; settings all 5 | 🟢 | axpbuntu lab FTPS |
Verified green: cargo fmt --all; cargo clippy --lib --bin aeroftp-cli --all-features --tests -- -D warnings; cargo test --lib transfer_dag::governor:: 15 passed; provider_transfer_executor:: 30 passed; transfer_dag:: 249 passed; full npm run ci:pre-push exit 0 (lib ~3298, CLI 482); live lab FTPS instrumented peak before/after.
|
AeroRsync retires the legacy RSNP stack (Y-RSC.8)Post-4.1.5 follow-up, fixed on The prototype RSNP envelope path is gone. Production native delta talks only to stock
Unit / clippy (local,
|
| Gate | Result |
|---|---|
cargo fmt --all -- --check |
pass |
cargo clippy --lib --features aerorsync --all-targets -- -D warnings |
pass |
cargo test --features aerorsync --lib aerorsync |
559 passed, 0 failed, 14 ignored (23.12s) |
Live against stock rsync 3.2.7 (Docker harness :2224)
| Test | Result |
|---|---|
driver_upload_live_lane_3_real_rsync_byte_identical |
🟢 |
driver_upload_streaming_live_lane_3_real_rsync_byte_identical |
🟢 |
delta_upload_symlink_live_lane_3_readlink_identical |
🟢 |
delta_download_symlink_live_lane_3_readlink_identical |
🟢 |
Pair wall-clock: 0.25s.
Integration fixture (cargo test --test integration_delta_sync -- --ignored)
11/11 passed (password-auth cases included in this run).
Verified green: fmt, clippy -D warnings, 559 aerorsync lib tests, live lane3 bulk+streaming, integration_delta_sync ignored 11/11. CI on 8915b5d1 (Aerorsync Protocol must show check+lane3 only, no lane2).
Y-RSC July chapter wrapJuly AeroRsync track items in-scope for v4.1.6 are closed on
Evidence: Y-RSC.5 comment #1414 (comment) ; Y-RSC.8 comment #1414 (comment) Not opened this month (after August vacation): Y-RSC.6 xattr/ACL, Y-RSC.7 recursive tree sync. No open baton on the Y-RSC July mission. |
Profile sort, Crypt copy-to-user, and Jottacloud soft-deletePost-4.1.5 follow-up, fixed on Three small fixes from the same triage pass: My Servers drag-and-drop index, Crypt secrets on cross-user profile Copy/Move, and Jottacloud delete going to trash instead of hard-removing.
Verified green: |
Zoho WorkDrive connects on personal accounts with no teamPost-4.1.5 follow-up, fixed on OAuth succeeded and the token worked, then discovery stopped anyway: it required a team unit, and a pure Personal WorkDrive account has none, so both team endpoints answer with an empty list. The account's own My Folders (privatespace) was reachable the whole time. Discovery now uses it, which is also the route rclone takes for the PERSONAL edition.
Test evidence:
Verified green: |
|
Batch of @EhudKirsh CLI + GUI fixes: copy user, background tabs,
|
| # | Area | Change | Status | Commit | Ref |
|---|---|---|---|---|---|
| 66 | Users (GUI) | Manage Users can copy a user: creates a fresh, password free, non admin user that copies the avatar and all server profiles and copies no passwords or credentials, named <source> (copy), mirroring the CLI users -i Copy verb |
🟢 fixed | f4ba7cfca |
#347 |
| 67 | Add Service (GUI) | Middle click opens a provider in a background tab without stealing focus (grid cards, list rows, protocol badges, custom buttons); the grid and list search boxes now persist across tab switches and reset only on app quit | 🟢 fixed | 44b23ed6a |
#274 |
| 68 | CLI TUI | --tui inline action menu now works on groups and users (pick with a key or arrows plus Enter, then type the target). Picker core factored into one shared, tested helper; profiles --tui behaviour unchanged |
🟢 fixed | aa1087a9c |
#311 |
| 69 | CLI banner | Native API profiles print (REST API -> ...) instead of (KOOFR -> ...), consistent with WebDAV mode's (WEBDAV -> ...), across all 11 native API providers |
🟢 fixed | b0ed3b16a |
#277 |
The column rename and benchmark line format also raised in #277 are intentionally left open for a design proposal (posted on that thread), not shipped, per the reporter's request not to churn CLI formats before agreeing them.
Verified green: cargo fmt --all -- --check, cargo clippy --lib --bin aeroftp-cli -- -D warnings, cargo check, tsc --noEmit, vitest 517/517, plus a live pty smoke test of profiles / groups / users --tui (the Fav action's toggle was confirmed persisted in the vault, all menus exit cleanly) and the banner verified live (Koofr -> REST API, Box1 -> WEBDAV).
Add Service catalog Requested entries closedTracker housekeeping on The former Requested item on missing Add Service entries is fully covered by work already on
Removed from Requested / under consideration and renumbered. Blomp stays out of production UI until its API is ready; it is not re-listed as Requested. |
Optional Company column on Add ServicePost-v4.1.5 follow-up, fixed on The product name alone only partly grouped siblings (Microsoft OneDrive / Azure). An optional, default-hidden Company column now carries the parent brand so GitHub sits with Microsoft, kDrive with Infomaniak, Google Drive with Google Cloud Storage, and so on. Sort by Company groups siblings; search also matches the parent. Brand-as-product rows leave the cell blank. This merge also fills the missing
Verified green: unit (518), typecheck, i18n 47/47, pre-push gate; PR i18n step green before merge. |
CodeRabbit i18n polish (Company column)Post-v4.1.5 follow-up, fixed on
Verified green: i18n 47/47, Format/audit unit tests. |
File associations padding, one "Default" badge, no backdrop-close on SettingsPost-v4.1.5 follow-up, fixed on Three defects in Settings, File Handling, found while reviewing the panel that shipped with queued #58. Nothing here changes what the panel does to the OS, only what it shows and how the modal closes.
No new i18n keys: the panel reuses the existing Verified green: typecheck, unit suite 518 tests in 53 files, i18n 47/47 (0 missing, 0 orphan, 0 needs-translation), security regression 3/3, and CI |
v4.1.6 is released, closing this trackerv4.1.6 shipped on 2026-07-25 with all 73 queued items. Every platform artifact is published and the Snap Store is on revision 217 (
Known issue #4 (pCloud trash, stale-token re-auth, 🟡 investigating) and the eight Requested / under consideration rows carry over to the 4.1.7 tracker. Three moderate Verified green: cargo fmt, security regression 5/5, R10 across 7 files, vitest 518, typecheck, i18n 46/46 locales, clippy -D warnings, cargo test 3270 lib + 482 integration, cargo audit clean over 1206 crates, smoke 2 PASS / 0 FAIL. On CI: Build AeroFTP (tag and Thanks as always to @EhudKirsh, and to @pasha-zzz for the Windows uninstall residue report (#454). Follow-up tracker: #1415 |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
AeroFTP 4.1.6, Rolling Tracker
Umbrella issue for the next AeroFTP point release (v4.1.6): known issues reported against v4.1.5 and the patches/updates landing on
mainafter the v4.1.5 tag.Before opening a new issue, please check the lists below. If your problem is already tracked here, just add a thumbs-up reaction or a comment with your environment (OS, version, provider) instead of filing a duplicate. We update this issue as bugs are found and fixed.
Found something that is not listed? Open a new issue and we will link it here.
What shipped in 4.1.5
See the v4.1.5 tracker (#421) and the release notes for the full 4.1.5 change set: non-identical duplicate detection across the engine, GUI, CLI and agent tools (raster via pHash, text and SVG via SimHash with a MinHash cross-check, other payloads via pure-Rust TLSH, opt-in and never auto-selecting files for deletion), a transfer queue that survives an app restart (an atomic backend journal plus a frontend restore that brings interrupted transfers back as re-queueable Restored items with Retry), AeroCrypt default-salt portability with the shared .aerocrypt.tsv marker and a migration that verifies the new marker before deleting the legacy JSON, an offline Emergency Kit validity check (crypt kit-verify plus a GUI Verify action), a missing headed marker rebuilt from the local keystore with a one-shot lockout warning instead of silently degrading to headerless, Password Forge and encrypted-provider credential hardening (an always-discoverable generator with reusable presets, custom character sets, batch generation and live entropy, plus honest 2FA-secret handling), a live classic-rsync progress bar, PLACES volume refetch on window focus (the lighter #351 hotplug mitigation), and the CLI honouring AEROFTP_MACHINE and AEROFTP_NO_BANNER consistently. 47 languages translated.
Patches & updates queued for 4.1.6
Landed on
mainafter the v4.1.5 tag; shipping in v4.1.6.87f65b9e3WM_DEVICECHANGEhidden tool window emitsvolumes-changedon drive arrival/removal (~0.5-1s live on Win11 USB, no focus cycle).volumes_changedcomparesGetLogicalDrivesmask so the 30s poll only full-refetches on real change; Linux inotify path unchanged; focus refetch stays as safety net. Surfaced during #351 eject verification on real Windows hardware8b88b6ea3,8ecfdedbaD:/boot,C:/Users) produced bareD:/C:, which Rust rejects as non-absolute. Normalize toX:/viaparentLocalPath; drive roots treated as root for go-up UI (toolbar, table, grid, Backspace). Found during #422 live hotplug test6343a3e19b073a3822fef543a4f,e0c267847cc2b32592b0034c321e44d2ad96b79923ebb579b4309dUnknown, so a negotiated xxh64 or xxh3 transfer degraded to all-literal traffic instead of reusing blocks. Seeded block signatures and negotiated whole-file checksums now implement both algorithms across the send and receive paths, with CopyRun telemetry reaching product stats. Proven directly against stock rsync 3.2.7 in both directions: exact 1 MiB byte identity and 1020 copied blocks per algorithm, where the same forced upload previously failed with remote rsync exit code 22. Closes the AUDIT-03 B3 Sync-stack laned9b34631965dced88..30b9db3a3dedup_key, so distinct S3 / preset-OAuth / preset-WebDAV accounts no longer collide; Copy lands, Move keeps its write-before-delete orderingec1601ac5mkdirwrites anapplication/x-directorymarker andlistHEAD-probes zero-byte no-sibling entries, reclassifying only directory content-types, so New Folder shows a real empty folder on S3Drive and spec gateways with no phantom file. Live-tested on S3Drive + MinIO3d112e5e7c7ac9df6c<SearchBox>replaces 10 inline inputs so the 🔍 no longer sits over the placeholder or typed text (My Servers and Add Service first)9b065e8ed>browse in the remote and connected-local panes, reusing the AeroFile breadcrumb (crypt-aware nav, non-mutating lister)5a05139f8e25896ccf4305116cd8d7bbefa1-r, the Transfer Queue counter reads completed/total, the progress card no longer overlaps the queue, TAB.DIGITAL casing (URLs and ids stay lowercase), provider display-name casing (Dropbox, OneDrive, box, kDrive, Filen, pCloud Drive, Google Drive corrected; MEGA and TAB.DIGITAL stay all-caps), and the README File Formats reorder (compression, encryption, error-correction order; adds.aerocorrectand.aeroignore)ec32e62cf4shared-webdavpreset (the catalog row no longer collides with the OAuth registry id), the CLI catalog and providers tables emit the branded "S4 (S3)" / "S5 (S3)" labels, and TAB.DIGITAL's flag is corrected to EUf5ae25b21,3bb9e73da,5ca59335f,1ca6e961d,09ef8b672server_*,oauth_*,jottacloud_refresh_*) with the same write-before-delete gating per key, so a copied or moved pCloud-OAuth / Jottacloud profile authenticates on the new id (live-tested end-to-end: the relocated token lists the real pCloud root; source intact on Copy). Also: the cross-user "already exists" soft warning no longer false-fires between distinct empty-key S3 accounts, anddedup_keyis documented as aggregation-only, never an identity keyd648c6b19,f3d274ac9,62b52e39758e2b4c17,9396bd7bd,41e382e5b4cec03e09disable_drag_drop_handler, so Tauri'sonDragDropEventnever fired and a file dropped on the Hash Forge tab was ignored; the drop now stages the blob viastage_hash_dropand streams its contents throughhash_file, with the local-panel import listener suppressed while Security Tools is open. Live-verified: a dropped file hashes to the correct content digest49de07c95hasStoredAeroCrypt*flags are recomputed from the vault on every load, so an overlay profile created before those flags existed no longer loads with a stalefalseand silently skips auto-unlock (which had shown raw ciphertext with no prompt). Self-healsfalsetotruewith no re-save; verified live on a previously-broken SFTP rclone-crypt profile (9 items decrypt). Two new Rust unit tests1dd53fd63[VID:PID]label; the MTP connection form hides the manual-quota field and used-scan checkbox (MTP reports real free/total); the startup probe no longer logs a false "portable device disconnected"; and the PLACES sidebar subtitle shows the full device id ("usb:5:3"). Live-verified with a real Sony Xperia 1 V8b7759ad0,3ac7bec71f52662053malloc_consolidate(): unaligned fastbin chunk detectedfired on Disconnect (GLib heap-corruption class). The remaining off-main GTK/DBus sites now marshal viaAppHandle::run_on_main_thread:open_extract_window(single-instance zbus callback), tray menu/icon window ops,rebuild_menuandaeroshare_notify; the async disconnect commands are documented UI-free. Live-verified: 12 repeated connect/disconnect cycles underG_SLICE=always-malloc G_DEBUG=gc-friendly MALLOC_CHECK_=3with no crash600fcff69malloc_consolidate(): unaligned fastbincorruption reproduces during crypt navigation with a phone attached, correlated with a burst of libmtp bus scans; a USB pendrive does not reproduce (mass-storage takes the volume path), so the trigger is the MTP detect churn.list_mtp_deviceswas called by 3+ uncoalesced FE listeners per hotplug event plus polls (continuous ~113 libmtp scans per 30s at idle with a device attached). Now: a backend single-flight + 800ms TTL cache so concurrent callers share one bus scan (errors never cached), and an FE shared in-flight promise + ~300ms debounce + poll-skip-while-in-flight. Idle detect churn with the phone attached dropped from ~113 per 30s to 0; 8 concurrent list calls coalesced to one detect (6ms). Reduces the exposure that amplifies the upstream libmtp corruptor (Known #7 stays open, it is upstream). Also landed theusb_iproduct_forrustfmt that had reddened Checks onmain942d13467,0b0ebf6a1mtp:host=...), with the inherent whole-file-only + best-effort-metadata limits. Completes the AeroFile-local residual of the MTP profile work (previously "Requested #3"). Verified live in the v4.1.6 GUI test: the Sony XQ-DQ54 is listed in PLACES and browsablef420867f1,b073a3822http://127.0.0.1:27154/callback, but the app requestshttp://localhost:27154/callback(Entra ID requireslocalhost, fixed port 27154). Microsoft treats the two hosts as distinct registered redirect URIs, so minting a new OneDrive token failed withinvalid_request: redirect_uri is not valid, blocking trash and every re-auth. An audit of all 8 OAuth providers found OneDrive was the only host mismatch. Also removed the dead Dropbox permanent-delete handlers (no button wires them;files/permanent_deleteneeds a Business/Team scope unavailable to personal accounts, so the missing red/orange buttons are by design). Verified:tsc --noEmitclean365317990files/permanently_deleteis a Dropbox Business only endpoint, so a newdropbox_account_typecommand reads the tier (basic/pro/business) and the GUI enables the actions for Business/Team accounts while personal accounts see them disabled with an amber premium notice and tooltip (personal trash auto-empties after 30 days). Corrects the earlier "by design, Restore only" stance. The purge happy-path is not live-testable without a Business/Team account; detection, gating and the notice UX are verified. i18n 47/47. Verified:cargo check,tsc --noEmit,i18n-validate3ff47f9664a868e2bb41e4c144e/proc/selfCPU/RSS/FD sampler (Linux, compile-time stub elsewhere). Additive serde-default fields, no consumer removed, no WAN number claimed. Internal for now: the unified CLI/MCP/GUI stats surface and the slow optimization loop (blocks E/F) follow on L26bdd3eb7aerorsync_bench_*)8dc950075,841d012efEngineTransferStatssource read three ways: the CLI--json(engine_statson batch,statson sync), a read-only MCP accessoraeroftp_transfer_stats, and a GUItransfer_engine_statsevent, with the/proc/selfCPU/RSS/FD sampler now wired at job start and end (Linux delta, honest None elsewhere). A decrease-biased slow optimization loop feeds observed throughput and dispatch-wait back into the adaptive profile registry (P2-06 conventions), and a schedule-only nightly workflow runs the telemetry suites plus one local no-WAN benchmark cell that uploads a JSON stats envelope. The closing audit fix wave corrected job-level TTFB attribution (no double count), honest delta wire bytes, and added an additivecancelledflag; additive serde-default fields only, no consumer removed, no WAN number claimed. Closes the DAG-P2-07 wave69d89baf1,4ecfc610d,bde8dea56server_<id>credential instead of silently keeping it, so a saved password (including the WebDAV mode of Filen, MEGA, Koofr, OpenDrive) can finally be removed. A per-mode reference tracks the password shown for the active mode, so the deletion fires only when a non-empty password was actually cleared, never for a passwordless mode (Filen API) or an in-flight hydration, keeping a mode group's primary credential intact (no #215 regression)66de9c40f66de9c40f2babffe3fAdmissionPolicy. DefaultFifopreserves arrival order and the P2-04 10M scale proof; opt-inSizeFairpicks pending work by a small-file score plus aging and reserves a slot so large files never starve. Wired throughTransferBatchConfig/SyncOptionsand a CLI--schedule fifo|size. Ships with a Nightly flake fix: the batch concurrency barrier tests now inject a disabled AIMD controller with explicit file-parallel caps, so the 2-party rendezvous proofs no longer deadlock when the process-global adaptive registry had learned a File target of 1 under parallel test loadb219162eCHANGELOG.mdandsrc-tauri/.cargo/audit.tomlnow use the generic OpenSSF / OSSSign / supply-chain auditor framing, and two outdated annotations were removed from the roadmap On the Horizon items (IPFS/Web3, Tor). Docs plus a cargo-audit config comment only, no code, i18n or behaviour change9eee1492--sftp-download-presetand--sftp-readaheadwith locked precedence. A serialized 1 GiB lab matrix passed all five CLI presets plus driven-GUI Efficient, Fast, and Maximum tested with exact SHA-256 and no sidecar residue63c8eb06,38336453,281efc6b,8feaee2f,beb1a49b,a70fd011supports_transfer_worker_reusecapability, FTP opts in, SFTP/HTTP untouched), amortising the per-file handshake and closing the last gap: multi-file FTPS lands at parity with rclone (param 3 +1.0 percent, param 5 +1.4 percent, was 8-18 percent behind), reuse proven by distinct connections dropping 18 to 13. Validated live against rclone on FTP and FTPS, GUI and CLI: 72/72 matrix plus 6/6 driven-GUI plus 10/10 buffer plus 18/18 multi-file A/B runs, all exact SHA-256edfd550a,2a6ec50f,8d71b442create_parentsupload no longer aborts on ProFTPD hosts: anaeroftp_upload_manywithcreate_parentsinto an already-existing docroot on Aruba shared hosting (ProFTPD) failed every item, because MKD on a directory that already exists answers550 Permission deniedinstead of a recognizable exists message, soensure_remote_parentshit its fatal branch. It now confirms existence with astatfallback and treats the mkdir as a no-op, rather than widening the error-string match (which would mask genuine permission failures)c19f1272-iand--tuipickers gain Type/Protocol/Profile headers and a Type column, and the single-file size sweep shows a byte progress bar (real per-byte, 10 MiB threshold). A bare number in--file-size/--sizesnow means mebibytes (so--file-count 10 --file-size 1is ten 1 MiB files, not ten 1-byte files), and--file-countwithout--sizesruns only the many-files workload. Per-protocol fan-out (--all-protocols) is spec'd and deferred pending live multi-mode profilesef4886dd,6adc72f00cd0aa6a797a5176f0b7e58cbe1becf7/etc/passwdor a parent traversal. Landed with a live re-verification that md4 delta block reuse works against stock rsync (audit R1)a6b11ecdBaselineSource::read_block(single pass for rolling + wire strong), so peak RSS isO(block_size + writer buffer)independent of baseline size. Byte-identical parity vs bulk, live lane3 green, integration_delta_sync 11/11 ignored026b374eprofile-duplicate-mode/profile-convert-mode(#215) copied the source host verbatim, so a Koofr profile duplicated into WebDAV stayed onapp.koofr.netand returned 404 on every request, since the Koofr DAV surface only answers under/dav/Koofr. The CLI had no endpoint table at all (the GUI was immune through its preset registry).MODE_GROUPSnow carries the per-mode endpoint mirroring the frontend presets, applied when the copy is created; modes with no derivable endpoint (the FileLu and Filen S3 surfaces, which need a bucket and region of their own) warn instead of producing a silently broken profile. Found while triaging the--all-protocolsfan-out998c5e902benchmark --all-protocolsnow expands a profile per transport mode: it used to be a plain alias of--all, so asking for it never expanded anything. It is a distinct flag that benchmarks one saved account over each mode of its provider, giving aKoofr (api)row and aKoofr (webdav)row, each with its own mini table above the summary.--allkeeps its meaning (every saved profile, one row each). The per-mode profile is synthesized in memory, never written to the vault, so an interrupted sweep leaves no throwaway profiles; modes that cannot be measured honestly (a group whose modes need separate credentials, or an S3 surface without a bucket of its own) are reported with their reason and never faked as a zero row. Live-verified on Koofr and OpenDrive (two working rows each) with FileLu exercising the skip path3ab78005faeroftp_benchmarkMCP tool exposed only the single-file knobs, so the many-small-files workload and the fan-out were CLI-only. It now takesfile_count,file_sizeandall_protocols, and documents that a bare number means mebibytes exactly as the CLI help does. Withall_protocolsthe result is always{reports, skipped}(the skipped modes carry their reason, so an agent cannot mistake a short list for 'this account speaks one protocol'); without it the result stays the single schema-v1 report object, unchanged. Reports gained an additivemodefield (api,webdav,s3,ftp), a fixed vocabulary that leaves the report as anonymous as it was, because until now a JSON consumer could not tell fan-out rows apart825d7c909xdg-mime defaultexits 0 even when handed a desktop id that is installed nowhere, so the apply loop broke on the first candidate and wroteapplication/zip=com.aeroftp.AeroFTP.desktop, a dangling entry the desktop environment ignores (the package installsAeroFTP.desktop). The write reported success, the panel re-read the real OS state correctly and still showed the old handler, so the button looked inert. The desktop id is now resolved once among candidates that actually exist under the XDG application dirs, the association is read back after setting so a write the DE ignores is never reported as applied, and with no desktop file installed at all the panel says so instead of claiming a success that changes nothing. Two related honesty fixes: a dangling entry no longer counts as "Default", andis_availablereflects whether anything can be applied. Bundled: the Windows panel now also recognises the bare NSIS ProgIDs (aeroftp,aerovault,aeroftp-keystore,aerozip,aeroftp-script) that the Tauri template derives from the extension, which it used to report as "not default"59d020e6.aero*keys and Explorer FileExts entries behind: we were creating them, not failing to delete them. Our PREUNINSTALL hook ran before the bundledAPP_UNASSOCIATEand had already deleted the whole extension key including the<progid>_backupvalue that step reads, so itsReadRegStryielded an empty string and the nextWriteRegStrrecreated the key as an empty shell. Deleting harder in PREUNINSTALL could never fix it, so the sweep moved to POSTUNINSTALL (afterAPP_UNASSOCIATE), guarded by$UpdateModeso an upgrade never wipes a hand-pickedUserChoice, and placed before theIfSilentjump so scripted and WinGet uninstalls get cleaned too. Also retires the emptySystemFileAssociationsandOpenWithProgidscontainers left by our extract verbs, viaDeleteRegKey /ifemptyso a key survives the moment another app has a value in it. The MSI path was never affected and is deliberately untouchedabf06954--parallel 5: true in-flight peak was 4 even thoughmax_concurrent, FTP leases andfile_slotsall resolved to 5. Root cause was the process-global local disk write ceiling (DEFAULT_DISK_DEVICE_SLOTSstill 4), which silently queued the 5th whole-file download write lease; raised to 8 so it matchesMAX_MAX_CONCURRENT. Live lab FTPS peak 4 -> 5296e97dbaerorsync_servebinary, and CI Docker lane 2 are gone (~3.3k LOC).SignatureBlock/DeltaInstructionstay as thin engine-bridge types; production dispatch remains WrapperParity against stockrsync --serveronlydbcf9791,8915b5d1aero profiles --tui#). The classic list-insertto-1formula had landed one slot short when dragging right or down in grid and table views5158375dserver_*and OAuth keys, so Crypt badges moved with the profile JSON while overlay password/salt/config stayed on the source id. Dual now walks the fullper_profile_vault_keysset (same as same-user Duplicate)201bd1f9,1e117392delete()used hard?rm=true/?rmDir=trueand skipped the recycle bin (unlike OpenDrive). It now routes throughmove_to_trash; permanent purge stays on the trash manager /delete_permanentpath4c97883c/teamsand/users/{id}/teamscome back empty, so the connection died with "No teams found in Zoho WorkDrive. Create a team", advice a personal account cannot act on. Discovery now falls back to the account's own privatespace (GET /users/{zuid}/privatespace, the route rclone takes for the PERSONAL edition) and uses that workspace as the root. The team-first order (/teams, then/users/{id}/teams, then privatespace) is unchanged, so team and free-org accounts take exactly the path they took before. Team-less sessions no longer assume a team elsewhere either: server and account info reportPersonal, the storage quota is read from the user record with the free quota as fallback instead of erroring "Not connected to a team", and remote search returns NotSupported with its reason because the Zoho search endpoint is team scoped. The failure message now names the causes that actually apply to a personal account (region mismatch, WorkDrive not enabled)b290ee5ausers -iCopy already could. A per row Copy button (admin only) creates a fresh, password free, non admin user that copies the avatar and all server profiles and copies no passwords or credentials, named<source> (copy), mirroring the CLI exactlyf4ba7cfca44b23ed6a--tuiinline action menu ongroupsandusers: the raw mode action bar thatprofiles --tuioffered now works ongroupsanduserstoo (pick with a key or arrows plus Enter, then type the target). The picker core was factored into one shared, tested helper so all three sections drive the same menu;profiles --tuibehaviour is unchangedaa1087a9cUsing profile: Koofr (KOOFR -> ...)now reads(REST API -> ...), consistent with WebDAV mode's(WEBDAV -> ...), for every native API provider (Koofr, kDrive, MEGA, Filen, Drime, OpenDrive, Jottacloud, FileLu, Internxt, GitHub, GitLab); the provider stays identifiable via the host and[preset]. The column rename and benchmark line format raised in the same thread are left open for design confirmationb0ed3b16amanageUsers.copy/copyLockedHinttranslations that were red-failing i18n validation on main after #455. i18n 47/478faaa0db5cb273854bpx-3 py-2with the two right-hand cells rebalanced to 80px status / 104px action. Separately, the Settings modal held unsaved form state but closed on any backdrop click, silently discarding it: the backdrop no longer closes it, the header X, the footer Cancel and Escape remain. No new i18n keys, the panel reuses the existingsettings.fileAssociation*setf0f48b4f0upload_parthas no lower bound, so a loaded runner cancelled before the DAG reached the provider call and turnedBuild AeroFTPred onmainfor scheduling reasons rather than an engine regression; it now waits on the observable precondition (thepart_startedcounter the mock already exposes), bounded so a real regression still fails loudly.package-lock.jsoncarries the app version in two places and the bump left it at 4.1.5, which the local gate cannot catch because it never runsnpm ci, so CI would have gone red only after the tag was pushed; regenerated with CI's own npm 10.8.2, diff is exactly the two version lines. The R10 version-drift check went from 4 manifests to all 7 version carriers (addingpackage-lock.jsonboth entries,Cargo.lockandpublic/splash.html), anddocs/RELEASE.mdfrom 6 files to 7 with thenpm citrap documented. Also re-auditeddocs/PROTOCOL-RSYNC-COMPARE.md, the public rsync reference, stale on five rows after the Y-RSC wave (it still claimed xxh128-only checksums, no symlink support and anaerorsync_servebinary that Y-RSC.8 deleted)5579f57ffRequested / under consideration
Community requests and internal follow-ups being evaluated for this or a later release.
Effort: 🟩 quick win · 🟧 medium · 🟥 large / epic. Ordered by effort (quick wins first).
-iselectors (prioritised by the reporter ahead ofEdit(E)and the 2-letter semantics; exact behaviour to be pinned).jpgto.jxltranscode in AeroFile: JXL re-encodes an existing JPEG losslessly and reversibly (the original JPEG bytes reconstruct exactly), for a real size win with no quality loss. Candidate framing: AeroFile as a GUI for libjxl.icnsmulti-size (the v4.1.0 ones are single-resolution drafts). Needs a Mac to build and live-testparticipants/addcontactUUID format (currently a best-effort workaround), investigate the Filen free-plan 10-note limit ghost-note cleanup, and add a rich text editor for the rich note typemalloc(): unaligned fastbin chunk detectedwhile deserializing a D-Bus message, the classic GLib heap-corruption signature (that worker is the victim tripping over an already-poisoned fastbin, not the corruptor). Two marshalling fixes already shipped and are safe: tray badge (31db84f8b) andapp_ready+ splash-timeout (cae95ee91), present since v4.0.5. But the SIGABRT STILL recurs (v4.0.9 on 2026-06-25, and the v4.1.2-era build on 2026-07-05, identical signature): the marshalling is INCOMPLETE, a still-uncovered off-main-thread GTK path remains. Sync Tauri commands are provably main-thread (safe), so the suspects are the event/plugin callbacks whose thread context is unconfirmed: trayon_menu_event/on_tray_icon_event, the single-instance plugin callback, andon_window_eventCloseRequested. Pre-existing across versions, intermittent, triggered by D-Bus storms on suspend/resume or monitor standby; it can corrupt the whole app until restart. Definitive path (owner-approved): adopt self-hosted crash reporting with native minidumps to capture the real corruptor, plus an ASan/valgrind repro, then finish the marshalling on the remaining callbacksHKCU\Software\AeroFTP\Settingsand re-read byNSIS_HOOK_POSTINSTALLso an in-app update cannot silently restore it (POSTINSTALL runs on every install, and an update is an install), plus a/NOASSOCsetup switch. A visible components-page checkbox is out of reach without forking the Tauri NSIS template, which is why it is parked rather than half built. Raised in #454; deferred because AeroFTP never claims the default handler for the general formats, it only adds itself to "Open with" plus its own context-menu entries, so with the uninstall residue fixed (queued #59) what remains is menu visibilityKnown issues found after release
Reported against v4.1.4-v4.1.5: the v4.1.4 items are @EhudKirsh's retests of the fixes announced for that release. Fixed items ship in v4.1.6; reporters close after confirming in the release.
<Profile>is already saved in<User>" when the destination has no such profile. The relocate probe reuses the storagededup_key(which strips profile id and secrets) as an identity check, so different accounts on the same provider collide (S3 / preset-OAuth / preset-WebDAV worst). Copy is fully broken (nothing lands); Move still materialises (the #366 write-before-delete ordering holds) but mis-reports. The existing #366 tests only exercise SFTP. Fixed in 4.1.6 (ec1601ac5, queued #13)crypt_vault_id/crypt_kindtoprovider_compare_directories, so when the compare runs against a raw (un-wrapped) provider the normalization is skipped and files compare local-plaintext-size vs on-wire-padded-size. Not the deferred AeroCrypt residual (I1); closes the rclone-crypt half of the former Requested crypt-awareness item (GUI vault binding). Fixed in 4.1.6 (ec32e62cf, queued #21)invalid_request: The provided value for the input parameter 'redirect_uri' is not valid. Only a previously-minted token still works;rclone config reconnectsucceeds, so AeroFTP's registered OneDrive redirect URI is the mismatch. Blocks trash and all re-auth. Fixed in 4.1.6 (365317990, queued #33): the connect screen told users to registerhttp://127.0.0.1:27154/callbackbut the app requestshttp://localhost:27154/callback(Entra ID requires localhost, fixed port 27154), and Microsoft treats the two hosts as distinct registered redirect URIs; the UI now shows the localhost value to registeraccess_tokenquery param (pCloud rejects the Bearer header on trash) and refreshes viaget_valid_token(both since v3.1.4), with the crypt fix ind1e0bef90, so no code defect remains. The residual is a stale-token / re-auth condition (same family as #3), pending a live re-auth re-test3ff47f966, queued #34): Permanent Delete and Empty Trash now ship, enabled for Business/Team accounts and disabled with a premium notice for personal accounts, sincefiles/permanently_deleteis a Dropbox Business only endpoint (personal trash auto-empties after 30 days). The purge happy-path is not live-testable without a Business/Team account; detection, gating and the notice UX are verifiedUnable to delete folder: //bin/try. Use -r to delete a folder recursively; the purge is issued without-r(MEGAcmd soft-deletes files but hard-deletes folders). Fixed in 4.1.6 (ec32e62cf, queued #21)[148/150]on a 600+ file transfer: the denominator tracks the lazily-enqueued/in-flight batch, not the total. Should be items-completed / total-items (the real total already exists in the batch snapshot the footer bar uses). Fixed in 4.1.6 (ec32e62cf, queued #21)ec32e62cf, queued #21)prefix/marker is a product call. Shipped the solid way in 4.1.6 (3d112e5e7, queued #14)c7ac9df6c, queued #15)--no-crypt. Minor visibility inconsistency (reporter: not blocking). Resolved (stale report): the v4.1.6 live re-test shows crypt-ON now DROPS the plaintext folder in BOTH GUI and CLI (aeroftp-cli lson the Overlays Path returns only the 3 decrypted entries;--no-cryptreturns the 4 raw entries incl the plaintext folder, matching SSH ground-truth), so GUI and CLI agree. The report predates the Mixed-mode nav alignment (queued #20,8d7bbefa1)Status legend: 🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released
Affected platforms
Maintained by the AeroFTP team. Current release v4.1.5 (#421), next v4.1.6. Patches accumulated here; each release line still gets its own tracker.
All reactions