[Tracker] AeroFTP 4.2.1 - Known issues, patches & updates

[axpnet]

AeroFTP 4.2.1, Rolling Tracker

Umbrella issue for the next AeroFTP release (v4.2.1): known issues reported against v4.2.0 and the patches/updates landing on main after the v4.2.0 tag.

Status note: the current release line is v4.2.0 (release notes, its tracker is #1418, now closed); this tracker collects what lands on main for v4.2.1.

Before opening a new issue, please check the lists below. If your problem is already tracked here, just add a thumbs-up reaction or a comment with your environment (OS, version, provider) instead of filing a duplicate. We update this issue as bugs are found and fixed.

Found something that is not listed? Open a new issue and we will link it here.

What shipped in 4.2.0

See the v4.2.0 tracker (#701) and the release notes for the full change set, 165 tracked changes over 169 commits in three weeks, the longest cycle since the project started. The theme was measurement rather than features. The transfer engine went through a live review battery against rclone on the same links, payloads and servers, and every gap it found was closed and measured again: a speed limit most providers ignored, one-way sync re-uploading unchanged trees, a new SSH handshake for every SFTP file, serial scans and serial reads. The last work of the cycle went into the download path, where a file assembled from several streams could be handed back built out of two versions of the same object, with the right length and nothing to signal it; that was reproduced on a live server before it was fixed, and the check now covers every path that assembles a file out of parallel windows. Three independent review passes ran over the cycle, and the final one returned three blockers, two of them older than this release, both able to delete a remote file after a symbolic link had been skipped by a scan. The shape that recurred across the whole cycle was an answer that looked complete while part of the work had not been seen, which is why so many entries are about scans, deletes, exit codes and percentages that now state what they did not cover.

Patches & updates queued for 4.2.1

Done on main, shipping in the next release.

#	Type	Change	Status	Commit	Ref
1		Dependency updates after the release: clap 4.6.7 and clap_complete 4.6.11 (zsh completion escaping), vitest 5.0.1 and autoprefixer 10.6.1 (development only), codecov-action 7.1.1, grouped so each lockfile ran the build matrix once. Details.	🟢 done	8bdfefaa3, 111203c15, fef2538c0	#903, #904
2		FlatPark, the independent community Flatpak repository, is notified as soon as a release is published instead of finding it on its daily check, and is listed as a Linux install method; the README's AUR commands are corrected. Details.	🟢 done	ccf5d3349	#902
3		Move to Trash no longer silently becomes a copy of the whole item into the home folder (trash 5.2.9 on a drive without a usable trash) or a permanent delete (Duplicate Finder): AeroFTP asks first, and Escape no longer leaves a confirmation pending. Details.	🟢 done	2a0b0fada	#906
4		Recursive get, glob get and sync downloads now honour --multi-thread-streams, --multi-thread-cutoff and the SFTP presets instead of always using the measured default, and print the effective policy. Details.	🟢 done	70096c647	#905
5		A failed extraction no longer empties a file you already had: every extractor wrote the destination before decoding, so a wrong 7z password truncated a same-named file to zero bytes. Entries are now written aside and renamed in only when complete, permissions kept; a wrong 7z password is named as such. Details.	🟢 done	c2dcf151d	#907
6		AeroAgent now sees every saved server: on a large vault the list went through an 8 KB cap and the model saw only the first fifth. Profiles now fit on one line each, the tool can search by name, and any cut result says it is incomplete. Details.	🟢 done	853879b84	#908
7		AeroAgent approvals open in a dedicated AeroFTP window instead of the system message box, with a note on why it is separate: only that window can grant the approval, and it holds its own minimal capability. Batch approvals in expert mode no longer ask twice. Details.	🟢 done	b9e4c2ebe	#909
8		Proton Drive, through the official Proton Drive CLI: sign in to Proton in the browser, AeroFTP drives the CLI. The form has a mode strip with the official API announced for when Proton opens one; the executable never comes from a profile, and trash purges refuse ambiguous names. Details.	🟢 done	05e4fe8b0	#859
9		The command inventory counts the approval window's two commands; #909 had added them without regenerating it, and the CLI smoke check failed on later pull requests.	🟢 done	0d60af4f9	#910
10		OpenRouter's "Test connection" now checks the key itself (/key) instead of the public model list, so an invalid key no longer passes the test and fails at the first message; pasted keys are trimmed. Details.	🟢 done	17098e217	#912
11		The AeroAgent approval window and the extraction window no longer show the main menu bar, also after the menu is rebuilt. Details.	🟢 done	a88bef9cf	#913
12		Linux in-app updates no longer leave a copy of the package (about 70 MB, owned by root) in /var/tmp. Details.	🟢 done	61040d422	#915
13		AeroAgent's approval window can allow a tool for the rest of the chat (unticked by default, never for delete, trash, shell or extraction), so three folders need one approval instead of three. Details.	🟢 done	73df627d2	#914
14		Every copy button uses the native clipboard with the web API as fallback, and shows "copied" only when the copy happened; a guard test keeps new code on that path. Details.	🟢 done	75498232a	#911
15		The Proton Drive form has the MEGA and Filen two-column layout and a live check that says whether the Proton Drive CLI is installed and signed in. Details.	🟢 done	50b86947c	#916
16		AeroAgent opens alone from the status bar and starts on a new chat at launch; earlier conversations stay in the history. Details.	🟢 done	50cfa29db	#917
17		On Linux the main window reloads by itself when its WebKit web process crashes, instead of staying grey until AeroFTP is restarted from the tray. Details.	🟢 done	de7908839	#918
18		Copies of the update package left in /var/tmp by earlier versions are removed on the next .deb or .rpm install. Details.	🟢 done	bb4c32a1b	#919
19		Proton Drive refuses writes in its root (which only lists the account sections) with a clear message, counts only your own storage and says which folders it could not read; kDrive's root refusal reads as a permission error and is no longer retried; transfers that failed for good stay out of the restored queue. Details.	🟢 done	52d55cf19	#921
20		Three dependency patches refreshed on the application lockfile: rand 0.10.3, tauri-plugin-log 2.9.2 and tauri-plugin-single-instance 2.4.5, with no manifest or pin change. Details.	🟢 done	dfa1394e	#922
21		A keystore export and import restore My Servers as it was: a profile deleted before the export no longer comes back, because the vault's legacy profile list now follows the active partition instead of staying frozen since the partition migration. Details.	🟢 done	cdb43369c	#736
22		AeroCompress stores already-compressed formats (media, archives, AeroFTP containers) without a wasted zstd pass, and refuses an upload whose source changed length mid-read instead of sending a corrupted object. Details.	🟢 done	e241bd033	#925
23		The AeroSync Sync tab (local-to-local only) is no longer offered with a remote connected, where Start would have copied into a local folder named after the remote path. Details.	🟢 done	6508ce1e8	#926
24		A file larger than the destination accepts (HTTP 413, a plan cap) is its own kind, "File too large": reported once, never retried, and no longer stops the rest of the batch. Details.	🟢 done	4c34482f3	#927
25		AeroSync names direction and mode with the same words in the Plan tab and in template previews ("Local → Remote · Mirror" instead of local_to_remote), with headers and translated preset names. Details.	🟢 done	13dac0029	#928
26		AeroRsync crate: the multi-entry session and the crate flags now have measured wire evidence (35 frozen captures against stock rsync 3.2.7), and the capture instruments are tested in CI. Details.	🟢 done	f2b7590af	#930
27		Two new presets, IBM Cloud Object Storage (S3, every IBM location) and Mail.ru Cloud (WebDAV), with setup pages on the docs site; imported S3 profiles now keep the endpoint and the signing region they came with. Details.	🟢 done	325a4d6d5	#923
28		Zoho WorkDrive uploads files over 250 MB: above the 250 MB its single-request endpoint accepts (413 above it), uploads go through Zoho's documented stream upload server, proven live with 300 MiB. Details.	🟢 done	88f15f845	#933
29		Non-ASCII text (file names in provider responses, e-mails in credential masks) no longer crashes a log preview or a masked field: 54 previews and the TUI, Koofr and Jottacloud masks cut on a character boundary instead of a byte count. Details.	🟢 done	6cbcef94a	#934
30		AeroSync Compare lists, with a remote on one side, the files a sync toward it would send that the remote cannot store (too large, name or whole path too long), from limits in each provider's own documentation; providers with no documented limit show nothing. Details.	🟢 done	7c8aa17af	#932
31		Cyber Tools derives Argon2id keys and computes the BLAKE3 keyed and derive-key modes, locally and without history, pinned against the official test vectors. Details.	🟢 done	4ab49265	#929, #347
32		Downloads keep the remote modification time from the command line, and WebDAV dates are read in the app and the CLI, so a second sync no longer sees every downloaded file as changed. Details.	🟢 done	d76e1f0d	#936
33		A resource-sampler unit test no longer fails at random while other tests run in parallel. Details.	🟢 done	a00abaee	#938
34		Native delta sync works against rsync 3.1 servers (Ubuntu 20.04, Debian 10, RHEL 8, many NAS), and older servers (rsync 3.0 and below) fall back to plain SFTP instead of stopping the transfer. Details.	🟢 done	c713857e	#935
35		One exclude rule for every sync in the app and the CLI, which excludes everything either former reading excluded; on the command line a bare folder name now excludes its contents and an invalid pattern is an error instead of being dropped. Details.	🟢 done	e45118bb	#939
36		The AeroRsync comparison and the DAG engine page, in the repository and on the documentation site, describe older rsync peers the way main handles them after #935, and publish the measured results the review kept. Details.	🟢 done	3fd5c1a8, docs 41cb6eb	#942
37		Provider XML (WebDAV, S3, Azure Blob, STS, Jottacloud, FileZilla import) is parsed with quick-xml 0.42, and FileZilla imports keep & in site names, users, folders and plain-text passwords, which used to come through mangled. Details.	🟢 done	67b21b7e	#945, #754
38		Twake Drive (Linagora, formerly Cozy Cloud, 5 GB free) is a native provider in the app, the CLI, the MCP server and AeroCloud, signing in against the user's own instance with no vendor app. Details.	🟢 done	b4c7dc01	#937
39		Uploads to Zoho WorkDrive, Koofr, kDrive, 4shared and FileLu show real progress instead of jumping from 0 to 100 at the end, and a streamed upload is never retried as an empty request that a server could store as complete. Details.	🟢 done	ec8a2474	#943, #933
40		Versioned backup in AeroSync keeps the old copy on remote destinations too and never lets a later Mirror delete it; the Plan gains exclusions for every pair and the matching aeroftp-cli sync line, and Plan and Compare are translated; the template-import message that read as a contradiction ("applies exactly one, so nothing was imported") is reworded at the English source and in all 47 languages. Details.	🟢 done	750cda33	#941, #770
41		An exported .aeroftp-script runs what it says: the batch reads and checks the whole script first, runs SYNC as aeroftp-cli sync and CONNECT --profile as a saved profile, and a percentage delete cap can no longer let a fully replaced source empty the destination. Details.	🟢 done	2ccd56cc	#940
42		FTP checksums work on servers that implement HASH: the algorithm is selected with OPTS HASH, the digest is read correctly from the reply, and the legacy X* verbs no longer show a wrong value as a correct one. Details.	🟢 done	ef4f9923	#947
43		Importing a keystore backup shows, per server profile, what would change and lets you add, skip, keep this device's version, take the backup's, or keep both as a copy. Details.	🟢 done	b2967810	#931
44		On Linux the main window no longer stays blank at a cold start: the interface is served by a new built-in server that answers every connection, only for this app's address. Details.	🟢 done	4eefba62	#946
45		aeroftp-cli export rclone now exports Internxt profiles, and the rclone import refuses values it cannot read, names why it skips a remote and keeps secrets out of its output. Details.	🟢 done	bc32ec0b	#952
46		Drime, Cloudinary and ImageKit export to and import from rclone.conf, and plain rclone keys (S3, Azure, Swift, B2) are imported as written instead of a few being stored corrupted. Details.	🟢 done	0dc283a1	#954
47		A rename or move never overwrites what already has the destination name and never reports a move that did not happen, on every provider, and a replace (edit, a WebDAV client saving a document) overwrites in one step or refuses before it writes. Details.	🟢 done	5a428146	#944
48		The startup log no longer reports a migration of the legacy config folder on every launch: it says so only when files were actually copied. Details.	🟢 done	144fa28a	#959
49		Internxt connects again: the login fallback of free accounts goes to Internxt's gateway instead of a legacy host that no longer answers, and a failed login says what failed. Details.	🟢 done	55f83e9d	#953
50		The AppImage runs for every user: a file the launcher needs was executable by root only inside the image, which a sandboxed start (firejail, the AppImageHub test) refused. Details.	🟢 done	7f2dc003	#962
51		rclone crypt remotes open with the right key: AeroFTP records whether a crypt password or salt was typed or pasted from rclone.conf instead of guessing from its shape, and never derives rclone's all-zero key from an empty value. Details.	🟢 done	99169d4c	#955
52		The 4.2.0 changelog gives the real counts at the tag, 165 tracked changes over 169 commits (it said 161 over 165), and so does the published release page. Details.	🟢 done	6f8203046	#899
53		The winget publication waits for the GitHub release it reads: at v4.2.0 it asked thirteen seconds before the release existed and failed with a bare 404. Details.	🟢 done	1ba5fcae6	#897
54		AI assistance is described by role (implementation, independent review, translation, documentation) instead of by a list of products that had gone out of date; audit records keep the engine names, where the name is the evidence. Details.	🟢 done	ea8f55291	#901
55		--multi-thread-cutoff means the same on single-file, batch and pget downloads: WebDAV and Koofr honour a value under 1 MiB, an invalid value is a usage error (exit 5) instead of a silent 250M, and one planner decides how many streams a file gets. Details.	🟢 done	f502d2606	#920
56		A slow runner disk no longer fails the Delta Sync lane before its tests run: the disk reclaim steps are best effort. Details.	🟢 done	568d10bf4	#965
57		The Flatpak config import says what it actually did: imported, nothing copied, or the error, and whether the saved servers and vault came with it. Details.	🟢 done	6bebba966	#961
58		FTP moves to suppaftp 12.1.0: implicit FTPS transfers work again, a file the server refuses after the data is not sent twice, and a range cut short is an error. Details.	🟢 done	4c3b8c405	#950
59		rm without -r never erases a non-empty folder, served DELE and REMOVE delete files only, edits keep the file mode and refuse links, plus Azure, Swift, Jottacloud, Drime and rclone bridge fixes. Details.	🟢 done	f0dd7f870	#964
60		An SFTP transfer no longer hangs when the server drops: it ends as a lost connection the CLI retries and the GUI reconnects on. Details.	🟢 done	81ac0b4d4	#963
61		CLI batches on providers without a transfer pool sign in once per worker instead of once per file, and --immutable refuses the partial a cut left instead of skipping it. Details.	🟢 done	052043f9a	#956
62		Archive extraction no longer reports success with empty or truncated files: a wrong 7z password, a truncated archive, multi-member gz/bz2/xz and solid 7z in the browser are handled, and a failed RAR entry keeps the existing file. Details.	🟢 done	69f94a0d4	#966
63		Sync uses one modification-time rule on every surface and backend, and CLI one-way sync gets the GUI's Backup and Update rules (--update, --conflict-mode, --modify-window, --checksum). Details.	🟢 done	a44b3de41	#949
64		Filen WebDAV quota and Disconnect no longer hang, storage scans survive refreshes, OneDrive mkdir refreshes its parent, and the Dropbox trash retries throttled requests. Details.	🟢 done	0beacbad9	#960
65		Eight dependency updates in one review (sevenz-rust2 0.23, monaco-editor 0.57, vite 8.3.1 and others), and 7z compression with a very large dictionary keeps working. Details.	🟢 done	1847e16a0	#975
66		Ctrl-C stops a single-file get, put or pget, and a download temporary can no longer be taken over or published half-written by another writer. Details.	🟢 done	ba6ea3df0	#951
67		AeroAgent 1.5: native tool continuations for modern reasoning models, provider discovery for NVIDIA, Model Studio and OpenRouter, a Stop button, and agent --provider anthropic working again. Details.	🟢 done	3c38094f9	#948
68		Cloud providers no longer act on an item whose name differs only in case: Box, Google Drive, kDrive, Drime, Internxt and OneDrive keep cached ids and destructive steps exact, and a trash purge takes the right folder's item. Details.	🟢 done	aec5c2a66	#976
69		A skip-existing keystore import keeps the servers added after the backup. Details.	🟢 done	cef120d69	#980
70		FTPS no longer sends a refused file twice, OneDrive deletes the live file behind a stale id, and trash purges refuse an ambiguous name. Details.	🟢 done	69059502a	#981
71		A Mirror keeps the files it did not complete or was told to leave alone, sync scripts carry the Plan's exclusions, and removing a folder never takes its content along on any backend. Details.	🟢 done	cd9ac63d7	#979
72		Archives extract entries with names near the file-system limit again, and the Flatpak import brings the vault in whole. Details.	🟢 done	64fc765fd	#987
73		AeroAgent approvals fail closed for dangerous tools, and Stop reaches the tools still running. Details.	🟢 done	efaca4283	#982
74		The CLI reports Ctrl-C as interrupted (exit 130), never drops an immutable transfer silently, and rounds percentage delete caps down. Details.	🟢 done	2dd73e111	#993

Requested / under consideration

Community requests and internal follow-ups being evaluated for this or a later release.

#		Type	Item	Status	Ref
1	🟧		Eager-evaluation preview and a single-vs-multi-target placeholder for the -i selectors (prioritised by the reporter ahead of Edit(E) and the 2-letter semantics; exact behaviour to be pinned)	🔵 idea	#311 (@EhudKirsh)
2	🟥		Lossless .jpg to .jxl transcode in AeroFile: JXL re-encodes an existing JPEG losslessly and reversibly (the original JPEG bytes reconstruct exactly), for a real size win with no quality loss. Candidate framing: AeroFile as a GUI for libjxl	🔵 idea	aerovault#2 (@EhudKirsh)
3	🟥		macOS shell integration for the OS extract feature (Deliverable G macOS, deferred): Finder Sync "Extract Here / Extract to Folder" menu items mirroring the Linux Nautilus and Windows verbs, plus macOS custom document-type icons (CFBundleDocumentTypes) for the five aero formats and the generic fallback, and rebuilding the mimetype .icns multi-size (the v4.1.0 ones are single-resolution drafts). Needs a Mac to build and live-test	🔵 planned	#1408 (Deliverable G)
4	🟥		Filen Encrypted Notes: exit Beta: take Filen Notes out of Beta. Fix the participants/add contactUUID format (currently a best-effort workaround), investigate the Filen free-plan 10-note limit ghost-note cleanup, and add a rich text editor for the rich note type	🔵 planned	-
5	🟥		PRIORITY: Linux tray/GTK heap corruption, still-uncovered off-main-thread corruptor. A GDBus worker aborts with malloc(): unaligned fastbin chunk detected, the classic GLib heap-corruption signature, and it is the victim rather than the corruptor. Two marshalling fixes shipped in v4.0.5 and the SIGABRT still recurs with an identical signature, so the marshalling is incomplete and the remaining suspects are the event and plugin callbacks whose thread context is unconfirmed. Details.	🔵 planned	-
6	🟥		Recommended-protocol highlight on the Add Service / Quick Connect pages, after real benchmarks land (#368)	🔵 idea	#274 (@EhudKirsh)
7	🟧		File association opt-out (deferred, design parked): two switches, AeroFTP's own five formats against the eight general archive formats, persisted in HKCU and re-read by the NSIS post-install hook so an in-app update cannot silently restore the association, plus a /NOASSOC setup switch. Parked rather than half built, because a visible components-page checkbox needs forking the Tauri NSIS template. Details.	🔵 planned	#454
9	🟧		S3 recursive delete pays one extra HEAD per directory, because it lists with the trailing-slash prefix, which by construction cannot see the same-named key, so a separate probe is unavoidable given that listing. Listing with the slashless prefix would skip the probe entirely in the common case, where no same-named object exists, at the cost of a filter that must keep exactly path and path/.... The trap is the one #764 just closed, moved by one character: a sibling like reportsX also matches the shorter prefix. Whoever takes this must write both doors before the change, not after: reportsX survives a delete of reports, and reports survives when it is a real non-empty file. Worth doing when someone measures a slow recursive delete on a tree with many folders, not before. 4.2.1 context: #979 changed folder-removal semantics (a folder is removed only once empty, sync --delete removes the directories it emptied on every backend) but did not touch this listing or its probe; still open.	🔵 idea	#764
10	🟥		The AeroCrypt default-salt toggle promises more than the format offers: defaultSaltToggle says "no kit or keystore needed after create" and defaultSaltTierMeaning says "nothing else has to be carried", and neither holds, because the wrapped master key lives in the config rather than in the password, so a headerless vault needs the keystore whatever its salt mode. Two ways out, and the choice is a product call: implement the reconstruction and make the promise true, or correct the wording across 47 locales. Found while working #347; the copy was left untouched there on purpose. Details.	🔵 planned	#347
12	🟧		A hard task drop on the DAG runner path is not covered by the abort guard. Cooperative cancellation is: transfer_dag_batch.rs keeps a copy of the handle and aborts on the Err arm, which is how a cancelled token arrives. But if the task is dropped outright rather than cancelled through the token, the await inside multipart_abort dies with it and nothing on the runner path resends it, so the parts wait for the bucket lifecycle rule. Predates #766, which introduced the guard on the two provider paths only.	🔵 idea	#766
14	🟧		A backend that refuses If-Match cannot be told from an object that really changed. A gateway answering 412 to every pinned range would send every download back to a single stream while the output announces four, and nothing distinguishes that from a replacement today. Raised during the review of #885 and deferred with the reason written down.	🔵 planned	#885
15	🟧		A replacement that is slow and still in progress can pass the reading that decides whether to publish. That reading retries once; if the server is still writing the new version, the second reading can see an intermediate state. Neither the unit test nor the live reproduction covers it, because both replace in one write.	🔵 planned	#885
16	🟨		Nothing tells the user on the terminal why a download restarted on a single stream. Since #887 the fallback keeps its progress bar, but the refusal itself is still only a warning in the log, so a command-line user sees the stream count drop with no reason given. 4.2.1 context: #905 and #920 made recursive, glob and sync downloads print the effective multi-thread policy and one planner decide the stream count, but the server refusal itself is still log-only; still open.	🔵 planned	#885
17	🟨		Declare atomic rename as a capability read from the server rather than assumed from the protocol. TransferCapabilities.atomic_rename is Unsupported for every provider and nothing reads it, while SFTP servers that announce posix-rename do support it: the capability should carry the measured answer so a plan can show where it came from.	🔵 planned	-
18	🟨		The same question has not been asked of parallel uploads. Azure, Box, Drime and Dropbox assemble parts read from the local file concurrently; whether a local file changing under them produces the mixture the download path had is an open question, not a finding.	🔵 planned	-
19	🟨		A resumed .aerotmp is not tied to the version it was started from. Resuming a partial download against an object replaced in the meantime joins two versions by a route #885 did not close.	🔵 planned	-
20	🟧		AppImage delta updates: embed the update information and publish a .zsync next to the AppImage, so AppImageUpdate, AppImageLauncher, AM and AppManager can update AeroFTP by downloading only the changed blocks. The release workflow already repacks the AppImage with appimagetool, which is where -u "gh-releases-zsync|axpdev-lab|aeroftp|latest|AeroFTP_*_amd64.AppImage.zsync" goes; the .zsync must then reach the release assets.	🔵 planned	#900 (@shuvashish76)

Known issues found after release

Reported against v4.2.0. Empty at the time of opening: every entry in the previous tracker's block was resolved before it closed, so nothing carried over as pending.

#	Area	Description	Status	Ref
1	Rename and move	A rename or move onto a name that already exists overwrites the file there on pCloud (files), on MEGA through MEGAcmd (a move onto an existing folder lands inside it), and on devices mounted through MTP. Found by a live test on 2026-09-26: the other file is replaced without a question. Until the fix ships, rename onto a free name on these three. Fixed on main in 5a428146, shipping in v4.2.1 (row 47): every provider refuses an occupied destination, see #944 for v4.2.1.	🟢 fixed	#944

Legend: 🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released

[axpnet]

Dependency updates: clap, clap_complete, vitest, autoprefixer, codecov-action

Post-4.2.0 follow-up, done on main, shipping in v4.2.1 (#903, #904, #895).

Six Dependabot pull requests arrived after the release, all patch or minor versions. Changes that touch the same lockfile were grouped, so each group ran the full build matrix once instead of once per update. trash 5.2.9 is not in this batch: it changes behaviour and landed with its own guard in #906.

Area	Description	Status	Ref
Command line	clap 4.6.7 and clap_complete 4.6.11 (zsh completion values are now escaped correctly). Replaces #896 and #892	🟢 done	8bdfefaa3
Frontend tooling	vitest 5.0.1 and autoprefixer 10.6.1, development only. Replaces #893 and #891	🟢 done	111203c15
CI	codecov/codecov-action 7.1.1, pinned by SHA	🟢 done	fef2538c0

The lock changes are Dependabot's own, applied unchanged: regenerating with a local cargo also rewrote unrelated entries.

Verified green: full GitHub Actions on each merged head; for the frontend group also locally npm ci with the CI's npm 11.19.0 (lock unchanged), 951 frontend tests and the production build.

[axpnet]

FlatPark gets new releases right away, and is listed as a Linux install method

Post-4.2.0 follow-up, fixed on main, shipping in v4.2.1 (#902, from the FlatPark maintainer's offer in #310).

FlatPark is an independent community Flatpak repository that installs our official .deb unmodified. Until now it picked up a new release on its daily check, so a Flatpak user could wait up to a day for a release that was already out.

Area	Description	Status	Ref
Release workflow	A publish-flatpark job notifies FlatPark right after the GitHub release is published, so the update opens within minutes. It needs no token, and a FlatPark outage cannot fail our release	🟢 done	ccf5d3349
README	FlatPark listed next to Snap and AUR, described as the independent, developer-approved repository it is. The Flatpak ID stays com.aeroftp.AeroFTP	🟢 done	ccf5d3349
README	The AUR commands read yay - S and paru - S, which do not run; now yay -S and paru -S	🟢 fixed	ccf5d3349

The job runs only on a tag, so its first real run is v4.2.1. The same notification, sent by hand for v4.2.0, was accepted by FlatPark.

Verified green: full GitHub Actions on the merged head, including the Linux, Windows and macOS builds.

[axpnet]

Moving a local file to the trash no longer turns into a silent copy, or a silent permanent delete

Post-4.2.0 follow-up, fixed on main, shipping in v4.2.1 (#906, supersedes Dependabot's #894).

trash 5.2.9 changes what a move to the trash does on Linux. When a drive's own trash cannot be created because its root is not writable, which is the usual case for a data partition or an external drive, it used to fail. Now it copies the item into the trash in your home folder and then deletes the original. In AeroFTP that would have turned "Move to Trash" on a large folder into a copy of the whole tree into the home folder, with no progress bar and possibly no room for it. The update landed together with the guard.

Area	Description	Status	Ref
Trash across drives (GUI)	When the trash would have to copy into the home folder, AeroFTP now asks once per operation: delete permanently, copy to the home trash, or keep the items	🟢 fixed	2a0b0fada
Folder not writable	If the item's own folder is not writable, the crate would copy the item into the home trash and then fail to delete the original, leaving an orphaned copy. This is refused before the copy	🟢 fixed	2a0b0fada
Duplicate Finder	When the trash refused an item, it was deleted permanently without asking. It now asks first	🟢 fixed	2a0b0fada
Escape on a confirmation	Escape closed confirmations without cancelling them. Six prompts awaited that way stayed pending, and a pending batch delete then blocked every later batch operation until restart	🟢 fixed	2a0b0fada
AeroAgent local_trash	Goes through the same guard and never allows the copy, since it cannot ask	🟢 fixed	2a0b0fada
Responsiveness	The trash call runs off the async runtime, so a long move no longer blocks a worker	🟢 fixed	2a0b0fada

The prediction mirrors the crate's own choice of trash folder at 5.2.9: same mount table, .Trash/$uid then .Trash-$uid, and only a permission error falls back. It is Linux only; macOS and Windows use the system trash. Five new strings in 47 languages.

Verified green: full GitHub Actions on the merged head (Linux, Windows, macOS x64 and arm64 builds, linux-validate, format, audit and unit tests); locally cargo clippy -D warnings, 9 trash_guard tests and 958 frontend tests, with the new tests seen failing before the fix. Not reproduced on a real root-owned drive: the fixture checks real permissions and injects only the mount table.

[axpnet]

Recursive downloads now honour the stream flags

Post-4.2.0 follow-up, fixed on main, shipping in v4.2.1 (#905).

get -r, a glob get and the download jobs of sync ignored --multi-thread-streams, --multi-thread-cutoff and the SFTP presets: the shared batch path always asked for the provider's measured default. So get -r --multi-thread-streams 1 could still split files into eight streams on WebDAV. It was identical in v4.1.9, found by the final 4.2.0 review, and listed under "Requested" in this tracker.

Area	Description	Status	Ref
Batch downloads	The shared batch path uses the same resolved stream count and cutoff as a single-file download, with one helper for both	🟢 fixed	70096c647
Cutoff	Files below --multi-thread-cutoff are downloaded on one stream on the batch path too	🟢 fixed	70096c647
SFTP	An explicit --sftp-concurrency still wins over the preset's connection count; the preset's cutoff and read-ahead are kept	🟢 fixed	70096c647
Output	The effective policy is printed on stderr: streams per file, what was requested, the cutoff. Suppressed with --quiet and --json	🟢 done	70096c647
JSON results	Report the resolved CLI request instead of the unrelated measured default	🟢 fixed	70096c647

Coverage: three entry points (get -r, glob get, sync downloads), ten provider pools / eleven provider types. The tests failed on the 4.2.0 tree before the fix.

Verified green: full GitHub Actions on the merged head, including the CLI smoke tests on Linux, Windows and macOS.

[axpnet]

A failed extraction no longer empties a file you already had

Post-4.2.0 follow-up, fixed on main, shipping in v4.2.1 (#907).

Every extractor created the destination file before decoding the entry, and a wrong 7z password is only detected while decoding. So extracting with the wrong password left an empty file behind. When a file with the same name was already in the destination folder, it was truncated to zero bytes. Found while checking a failed AeroAgent 7z test: the archive and the tool were correct, but the extraction had been given a different password than the one used to create it.

Area	Description	Status	Ref
ZIP, 7z, tar, gz/xz/bz2	Each entry is written to a temporary file next to its destination and renamed into place only when it decodes completely. A failed entry leaves the folder exactly as it was	🟢 fixed	c2dcf151d
Permissions	Replacing an existing file keeps its permissions, so an executable stays one	🟢 fixed	c2dcf151d
7z errors	"Wrong password for this 7z archive (or the archive is damaged)" and "This 7z archive is encrypted: a password is required", instead of the library's MaybeBadPassword(Custom { .. })	🟢 fixed	c2dcf151d

Verified green: full GitHub Actions on the merged head. The new tests failed on the previous code first: the user's file came back empty, and the replaced script came back with mode 664.

[axpnet]

AeroAgent now sees every saved server

Post-4.2.0 follow-up, fixed on main, shipping in v4.2.1 (#908).

On a vault of 96 profiles, AeroAgent could not find a profile that was plainly there, and answered that it did not exist. The server list, about 34 KB, went through a generic 8 KB cap, so the model only ever saw the first fifth of it. The tool also did not tell the model that it could search by name.

Area	Description	Status	Ref
Server list	One line per profile (name, protocol, host, id): 96 profiles fit in about 7 KB. A longer list says how many are left and how to reach them	🟢 fixed	853879b84
Search	server_list_saved and remote_list_servers now declare name_contains, protocol, limit, offset and include_capabilities, which the backend already supported	🟢 fixed	853879b84
Profile data	A line break or a very long value in a profile name cannot make it read as several profiles	🟢 fixed	853879b84
Any cut result	The note now says the rest of the result was not shown and must not be treated as complete	🟢 fixed	853879b84

Verified green: full GitHub Actions on the merged head; the new tests failed on the previous code first.

[axpnet]

AeroAgent approvals open in a dedicated AeroFTP window

Post-4.2.0 follow-up, done on main, shipping in v4.2.1 (#909).

AeroAgent used to ask for approval of write actions through the system's message box. It was opened outside the chat on purpose, but it looked foreign to the app and showed plain text only. In expert mode it was also the only confirmation you saw for each write.

Area	Description	Status	Ref
Approval window	A dedicated AeroFTP window shows the action, its details and the scope. A note behind a shield icon explains why it is separate	🟢 done	b9e4c2ebe
Isolation	Only a window the backend opened for that request can answer it. The chat can ask for an approval but cannot grant one	🟢 done	b9e4c2ebe
Least privilege	The approval window has its own capability with a single permission (dragging its titlebar), none of the file, shell or dialog access of the main window	🟢 done	b9e4c2ebe
Safe defaults	Escape or closing the window refuses, and Cancel has the initial focus, so Enter never approves by reflex. Plugin tools use the same window	🟢 done	b9e4c2ebe
Batch approvals	In expert mode, approving several tool calls at once in the panel asked a second time for each one. Fixed	🟢 fixed	b9e4c2ebe

What it does not claim: the main window's own capabilities still include file and shell access. The approval window stops the chat from approving the agent's own actions; it does not protect against code that has already taken over the main window. The new strings are translated in 47 languages.

Verified green: full GitHub Actions on the merged head. The isolation tests failed first against a stub that accepted any window. Live check on the desktop pending.

[axpnet]

Proton Drive, through the official Proton Drive CLI

Post-4.2.0 follow-up, done on main, shipping in v4.2.1 (#859, requested in #573).

Proton Drive has no API open to third-party apps yet. Its official command-line client does exist: you install it, sign in to it in the browser, and it keeps its own session. AeroFTP now drives that CLI, the way it already drives MEGAcmd. You sign in to Proton in the browser and AeroFTP never sees your Proton password. Proton has been informed of the integration. AeroFTP is a third-party application, not supported by Proton, and the connection screen says so.

Area	Description	Status	Ref
Files	Browse, upload, download, rename, move, delete, trash and share links on your Proton Drive	🟢 done	05e4fe8b0
Connection form	Same layout as Filen: a mode strip with the official API (announced, not available yet) and the CLI. When Proton opens an API to third-party apps, it becomes the native connector and the CLI stays as the second one	🟢 done	05e4fe8b0
Trash safety	The CLI can only address the trash by name, so when two items there share a name AeroFTP refuses to purge, instead of deleting the first one it finds	🟢 done	05e4fe8b0
Share links	Password, expiry (never earlier than tomorrow, since the CLI takes a date) and view or edit permission	🟢 done	05e4fe8b0
Security	The executable is never taken from a saved or imported profile, only from PATH, the usual install locations or AEROFTP_PROTON_CLI. AeroFTP's own environment variables do not reach the CLI. A share link password is visible in the local process list while the command runs: the CLI offers no other way to pass it	🟢 done	05e4fe8b0
Icon	A generic purple folder drawn for AeroFTP, not Proton's logo	🟢 done	05e4fe8b0

Known limits of the CLI today: one Proton account per OS user, no storage quota, no transfer progress, no ranged reads, and each operation starts the CLI anew.

Verified green: full GitHub Actions on the merged head (Linux, Windows and macOS builds, CLI smoke, linux-validate with clippy --all-targets). The provider sequences run against a stand-in CLI, and the security and trash tests failed before their fixes.

[axpnet]

OpenRouter: "Test connection" now tells a valid key from an invalid one

Post-4.2.0 follow-up, fixed on main, shipping in v4.2.1 (#912).

The AeroAgent settings tested an OpenRouter key by asking for the model list. OpenRouter serves that list to anyone, so a wrong or revoked key passed the test and failed only at the first chat message, with a 401 that seemed to contradict the green test.

Area	Description	Status	Ref
Key test	OpenRouter keys are now tested against /key, which answers only for a valid key: a fake key gets 401 there while the model list still returns 200	🟢 fixed	17098e217
Pasted keys	Leading and trailing whitespace and line breaks are removed from an API key before it is used, in the test, the model list and every chat request	🟢 fixed	17098e217

Verified green: full GitHub Actions on the merged head (Linux, Windows and macOS builds, linux-validate), plus the new key-cleaning tests.

[axpnet]

Secondary windows no longer carry the main menu bar

Post-4.2.0 follow-up, fixed on main, shipping in v4.2.1 (#913).

On Linux the application menu (File, Edit, View, Help) is set for every window, so the new AeroAgent approval window and the extraction progress window showed the full menu bar of the main window, with commands that make no sense there.

Area	Description	Status	Ref
Approval and extraction windows	Open without the menu bar	🟢 fixed	a88bef9cf
Menu rebuilds	When the menu is rebuilt (language change, settings) it is removed again from every open secondary window, so it does not come back	🟢 fixed	a88bef9cf

Verified green: full GitHub Actions on the merged head (Linux, Windows and macOS builds, linux-validate), and checked live in the dev build.

[axpnet]

Linux in-app updates no longer leave a copy of the package in /var/tmp

Post-4.2.0 follow-up, fixed on main, shipping in v4.2.1 (#915).

The Linux update helper copies the verified package to /var/tmp and registers an exit trap to delete the copy, then ran dpkg or rpm through exec. exec replaces the shell, so the trap never ran and every in-app update left a copy of about 70 MB owned by root. On one workstation 51 copies had accumulated since 2026-04-01 (3.2 GB).

Area	Description	Status	Ref
Updater (Linux)	dpkg and rpm run as child processes: the installer exit status still propagates, and the copy is removed on success and on failure	🟢 fixed	61040d422

Helper run as an unprivileged user with stub dpkg / rpm on PATH, counting the copies left in /var/tmp:

#	Scenario	Before (main)	After
1	.deb, install succeeds	exit 0, 1 copy left	exit 0, 0 left
2	.deb, install fails	exit 1, 1 copy left	exit 1, 0 left
3	.rpm, install succeeds	exit 0, 1 copy left	exit 0, 0 left
4	.rpm, install fails	exit 1, 1 copy left	exit 1, 0 left

Not run: a real root install through the updater on a packaged build. The stubs replace only the installer, so the gap leans on dpkg / rpm themselves, not on the cleanup path. Copies left by earlier versions are not removed: deleting in /var/tmp as root deserves its own review.

Verified green: full GitHub Actions on the merged head (Linux, Windows and macOS builds, linux-validate, format, audit and unit tests), bash -n on the helper.

[axpnet]

AeroAgent: allow a tool for the rest of the chat, from the approval window

Post-4.2.0 follow-up, fixed on main, shipping in v4.2.1 (#914).

Asking AeroAgent to create three folders meant approving three times, and the "remember" choice only covered a repeat of the exact same call, so the next folder asked again.

Area	Description	Status	Ref
Approval window	A new "Allow this tool for the rest of this chat" box, unticked by default. It covers the same tool in the same chat and context, whatever the arguments, so three folders need one approval	🟢 fixed	73df627d2
Scope	Offered only for non-destructive actions: never for delete, trash, shell commands, archive extraction, a mutating remote command or a cross-profile transfer. It ends with the chat, never carries to another chat, and is not remembered across restarts	🟢 fixed	73df627d2
Execution check	The backend check that runs when the tool executes now honours the chat-wide grant too; before the fix the second call was let through by the approval step and then refused at execution	🟢 fixed	73df627d2
Refusal	Closing or refusing the window now shows "Operation was not approved in the approval window."	🟢 fixed	73df627d2

Verified green: full GitHub Actions on the merged head (Linux, Windows and macOS builds, linux-validate with clippy --all-targets). The execution-time test fails on the previous code. Checked live: three folders created with a single approval.

[axpnet]

Copy buttons: always the native clipboard, and "copied" only when it happened

Post-4.2.0 follow-up, fixed on main, shipping in v4.2.1 (#911).

Some copy buttons wrote through the web clipboard API, which can fail silently in the desktop webview, and several showed "copied" whether or not the copy worked.

Area	Description	Status	Ref
One path	Every copy in the app goes through one helper: the native clipboard first, the web API as fallback, an error only when both fail. About fifty sites, including AeroAgent message copy, share links, reports, paths and TOTP codes	🟢 fixed	75498232a
Honest feedback	The check mark or "copied" toast appears only after a successful copy; a failure shows "Copy failed" where the screen has a toast, and no check mark otherwise	🟢 fixed	75498232a
Guard	A test fails if any source file writes to the web clipboard or calls the native command outside the helper	🟢 fixed	75498232a

Verified green: full GitHub Actions on the merged head (Linux, Windows and macOS builds, linux-validate), tsc clean and the full frontend suite (969 tests). Checked live on the AeroAgent message copy.

[axpnet]

Proton Drive form: two columns and a live check of the CLI

Post-4.2.0 follow-up, done on main, shipping in v4.2.1 (#916, follow-up to #859).

The Proton Drive connection form now follows the MEGA and Filen layout, and tells you whether the Proton Drive CLI is ready before you press Connect.

Area	Description	Status	Ref
Status check	Under the mode strip: green when the CLI is installed and signed in, amber when it is installed but not signed in (with the command to run), red when it is not found. A refresh button checks again	🟢 done	50b86947c
Layout	Two columns: the setup instructions on the left, collapsing on their own once the CLI is ready, and the connection fields on the right	🟢 done	50b86947c
One check at a time	The check runs the CLI, which can take a few seconds: a new check never starts while one is running, and a result for a mode you left is discarded	🟢 done	50b86947c

Verified green: full GitHub Actions on the merged head (Linux, Windows and macOS builds, CLI smoke, linux-validate), i18n 47 locales. Checked live with the CLI signed in.

[axpnet]

AeroAgent opens alone, on a new chat

Post-4.2.0 follow-up, fixed on main, shipping in v4.2.1 (#917).

Area	Description	Status	Ref
Status bar	The AeroAgent button opens AeroAgent alone, as View > AeroAgent does, instead of next to the Editor or Terminal that was open last. With the tools panel already open it still shows or hides the chat, so a layout you arranged stays	🟢 fixed	50cfa29db
New chat	AeroAgent starts on a new chat at launch instead of reopening the last conversation; earlier ones stay in the history. Closing and reopening the panel during a session keeps the chat in progress	🟢 fixed	50cfa29db

Verified green: full GitHub Actions on the merged head, tsc clean. Checked live in the dev build.

[axpnet]

Archive extraction no longer reports success with empty or truncated files

Post-4.2.0 follow-up, on main, shipping in v4.2.1 (#966).

Found through a random CI red: with a wrong 7z password, about one extraction in 256 succeeded and replaced the file already at the destination with 0 bytes, because an entry that ended before its declared size was accepted and the 7z library checks the CRC only at the full size. The review of that fix found the same kind of silent short or wrong extraction in several other readers.

Area	Description	Status	Ref
zip, 7z, tar, archive browser, AeroVault v1	An entry that ends before its declared size is refused (wrong 7z password, truncated or corrupt archive); nothing is left behind and an existing file is untouched	🟢 fixed	69f94a0d4
gz, bz2, xz	Files of several members or streams (pbzip2, bgzip, concatenated) decode every member instead of only the first	🟢 fixed	69f94a0d4
RAR	A failed entry (corrupt, wrong password) no longer deletes the file already at its path	🟢 fixed	69f94a0d4
7z solid archives	In the archive browser, extracting any file but the first of a solid 7z (7-Zip's default) no longer fails its CRC	🟢 fixed	69f94a0d4
tar PAX sizes	An entry sized by a PAX record extracts and lists at its real size instead of being refused as a compression bomb	🟢 fixed	69f94a0d4
Compressed overlay	A zstd payload is held to the length its header declares, and an in-memory decode refuses a declared length above 500 MiB	🟢 fixed	69f94a0d4
Error messages	A disk-full or read-only destination under a 7z password is no longer reported as a wrong password; an entry named passwords.txt no longer reopens the password prompt	🟢 fixed	69f94a0d4

No live test against a remote: these are local extraction paths, pinned by deterministic fixtures (a 7z whose wrong password decrypts to an early end, checked independently with 7-Zip, and RAR test data from the unrar crate), each fix seen red on the code before it.

Verified green: GitHub Actions on Linux, macOS and Windows; clippy -D warnings, the archive lib tests (243), vitest and the GUI unit suite. CodeRabbit reviewed the final head; every thread was fixed or answered.

[axpnet]

One modification-time rule for sync, and CLI one-way sync at parity with the GUI

Post-4.2.0 follow-up, on main, shipping in v4.2.1 (#949).

Sync compared file times differently on every surface and backend: some compared raw date strings, FTP LIST dates were read with invented seconds, a pair with the same date could be decided by the larger file, and the CLI one-way sync lacked the GUI's Backup and Update rules.

Area	Description	Status	Ref
Time rule	Two times within 2 s are the same instant, the window is raised to the precision each backend keeps (FTP MLSD 1 s, LIST none, per backend otherwise), and a backend with no comparable time is compared by size only, stated in the result	🟢 done	a44b3de41
One date parser	One parser replaces 13 local copies, and an audit test pins where dates are parsed; FTP LIST dates follow the 6-month rule and are never used to stamp a download	🟢 done	a44b3de41
CLI one-way sync	--update, --conflict-mode source/skip, --modify-window, --checksum (server checksum against a local digest), empty directories removed after --delete only when safe; every pair left open is reported with how to settle it	🟢 done	a44b3de41
Two-way sync	A pair with the same date is never decided by size; the bisync snapshot records only what a run settled	🟢 fixed	a44b3de41
AeroCloud	An upload waits until the file is quiet, a file that keeps changing is reported as unsettled instead of stamped as synced, and its next cycle treats it as a conflict	🟢 fixed	a44b3de41
SFTP and FTP uploads	The remote time is stamped from the time the upload started from, not from the file after the upload	🟢 fixed	a44b3de41

Declared in the PR: under PreferNewer or PreferRemote a file left unsettled stays in conflict until the user settles it (one cycle under PreferLocal or KeepBoth), and the sentinel baseline and a short window between the re-read and the stamp are stated limits.

Verified green: GitHub Actions on Linux, macOS and Windows; clippy -D warnings, the full lib suite (4873) including the date-parse audit, the CLI suite (769) and the GUI unit suite; every fix of the six review rounds seen red on the head before it and the mutations killed. CodeRabbit reviewed the final head; every thread was fixed or answered.

[axpnet]

Storage reads can be cancelled, the Dropbox trash survives throttling, and OneDrive mkdir refreshes its parent

Post-4.2.0 follow-up, on main, shipping in v4.2.1 (#960, reported by @EhudKirsh).

Three provider problems from EhudKirsh's reports, plus a review round and a OneDrive cache fix found on the way.

Area	Description	Status	Ref
Filen WebDAV (#958)	The storage quota no longer loads forever and Disconnect works: storage reads (used-storage scan, quota, folder size) are cancellable, connect, disconnect and the crypt-overlay clear cancel them before waiting for the provider, and a Depth: infinity listing that never answers falls back to Depth:1 after 30 s	🟢 fixed	0beacbad9
Storage scans	A long listing or a transfer holding the provider no longer turns Properties or the quota into "timed out"; a finished scan is no longer discarded by an ordinary quota refresh; a cancelled scan restores the right figure	🟢 fixed	0beacbad9
OneDrive (#957)	mkdir resolves the live parent instead of a cached id that may point at a deleted or moved folder; an existing folder name is reported as already existing; delete, rename and trash forget cached ids under every capitalization	🟢 fixed	0beacbad9
Dropbox (#397)	Trash listing and restore retry a throttled request under a bounded policy instead of failing on the first 429	🟢 fixed	0beacbad9

Not reproduced live: the Filen WebDAV stall and the exact Windows plus crypt-overlay OneDrive case need EhudKirsh's retest, so #958 and #957 stay open until he confirms.

Verified green: GitHub Actions on Linux, macOS and Windows; clippy -D warnings, the full lib suite (4899), the CLI suite (769) and the GUI unit suite, each fix seen red on the code before it. CodeRabbit reviewed the final head; every thread was fixed or answered.

[axpnet]

Eight dependency updates in one review, and 7z compression with a very large dictionary keeps working

Post-4.2.0 follow-up, on main, shipping in v4.2.1 (#975, superseding Dependabot #967 to #974).

Package	From	To
hyper-util	0.1.20	0.1.21
sevenz-rust2	0.22.2	0.23.0
thiserror	2.0.20	2.0.21
vite (dev)	8.3.0	8.3.1
react-window	2.3.1	2.3.3
monaco-editor	0.56.0	0.57.0
@tauri-apps/plugin-log	2.9.1	2.9.2
react-virtuoso	4.18.13	4.18.15

sevenz-rust2 0.23 now refuses to encode with an LZMA2 dictionary above 1073741823 bytes; AeroFTP clamped a requested size only to 4 GiB, so compress --dictionary 2147483648 (and the same GUI option) would have failed. The size is now clamped to what the encoder accepts, pinned by a test. The same version accepts PPMd archives made by 7-Zip. Both lockfiles keep their package counts (1199 crates, 348 npm packages); the transitive packages that moved are listed in the PR.

Area	Description	Status	Ref
Dependencies	Eight bumps applied with the native tools, identical byte for byte to Dependabot's changes	🟢 done	1847e16a0
7z compression	A dictionary request larger than the encoder accepts is clamped instead of failing	🟢 fixed	1847e16a0

Verified green: GitHub Actions on Linux, macOS and Windows; clippy -D warnings, the archive tests including the 7z early-end precondition, the frontend build with vite 8.3.1 and monaco 0.57, and the GUI unit suite. CodeRabbit reviewed the head with no findings.

[axpnet]

Ctrl-C stops a single-file transfer, and download temporaries are no longer taken over by another writer

Post-4.2.0 follow-up, on main, shipping in v4.2.1 (#951).

Ctrl-C during a single-file aeroftp-cli get, put or pget did not stop the transfer: the flag was raised and never read, so the transfer ran to its end, or forever against a server that stopped answering. Folded in, from the same files: a race that could publish a half-written download.

Area	Description	Status	Ref
Ctrl-C	get, put, pget and get --segments stop on Ctrl-C in every phase (connect, checks, delta, transfer), close the connection within 2 s and exit 130; --retries and batch stop too	🟢 fixed	ba6ea3df0
Download temporaries	Every writer of a download's temporary holds a lock on it for as long as it writes, so a resume or a second download can no longer append to a live one or publish it half-written; where locks cannot be used (Windows, NFS, SMB) an interrupted part is discarded as before	🟢 fixed	ba6ea3df0
In-place downloads	A plain in-place download starts from zero instead of taking any file already at the destination for a partial one	🟢 fixed	ba6ea3df0
Segmented downloads	The segmented engine writes its own .aerosegtmp, so a full-size file with holes left by a crash is never taken for a complete part; --limit-rate now holds on pget and get --segments	🟢 fixed	ba6ea3df0

Declared and carried to v4.2.2: the segmented engine releases its claim before its caller's last check and rename, so two segmented downloads of the same destination started in that window can still collide.

No live test against a remote service: the paths are pinned by tests on scripted FTP servers and local doubles, each red on the code before it (18 mutations, all killed).

Verified green: GitHub Actions on Linux, macOS and Windows; clippy -D warnings, the full lib suite (4920) and the CLI suite (798). CodeRabbit reviewed the final head; every thread was fixed or answered.

[axpnet]

AeroAgent 1.5: modern provider contracts, native tool continuations and a Stop button

Post-4.2.0 follow-up, on main, shipping in v4.2.1 (#948).

AeroAgent now talks to modern reasoning models the way each provider expects, keeps their native state across tool calls, and gains a Stop button. It carries its own version, 1.5, shown in the welcome screen and in settings.

Area	Description	Status	Ref
Native tool continuations	Reasoning models keep their provider-native state across foreground tool calls (OpenAI Responses items, Anthropic content blocks, compatible Chat messages), with the original call and result ids and scope checks on provider, model, endpoint and transport; an incomplete or cancelled stream never publishes a tool turn	🟢 done	3c38094f9
Providers	NVIDIA and Alibaba Model Studio capabilities are discovered exactly, public OpenRouter metadata enriches its models, and an endpoint change drops stale automatic capabilities; custom providers can be added more than once and named	🟢 done	3c38094f9
Chat	The Send button becomes Stop during generation, and a draft typed before stopping is kept; each turn starts with four core tools and loads more through a local tool search, which never grants approval	🟢 done	3c38094f9
CLI agent	agent --provider anthropic reaches the right endpoint again (it posted to /messages without /v1), a saved base URL works with or without /v1, Ctrl-C exits 130 with the partial answer, and the history and tool results stay within their limits	🟢 fixed	3c38094f9
Robustness	Provider error text reaches the user bounded and with keys removed, null or empty fields in a streamed answer no longer abort it, and zero-argument tool calls are replayed as {}	🟢 fixed	3c38094f9

Not in this release: the background workers of the AeroAgent lane stay off and ship complete in v4.2.2.

#	Scenario	Where	Result
1	Read, read, missing-file error and final answer through native tool continuations	NVIDIA, live	PASSED
2	Streaming and cancellation after the first event	NVIDIA, live	PASSED, no tool ran after the cancel
3	Composer Send and Stop, capabilities kept across reopening (6 Alibaba, 5 NVIDIA models), OpenRouter metadata on 458 entries without a key	GUI	PASSED

Not verified live: the OpenAI Responses continuation with encrypted reasoning (tested on recorded shapes only) and the Anthropic transports (no paid calls).

Verified green: GitHub Actions on Linux, macOS and Windows; clippy -D warnings, the full lib suite, the CLI suite (806) and the GUI unit suite (1191). Every fix of the review rounds was seen red on the code before it. CodeRabbit reviewed the final head; every thread was fixed or answered.

[axpnet]

Cloud providers no longer act on an item whose name differs only in case

Post-4.2.0 follow-up, on main, shipping in v4.2.1 (#976).

A review finding on #960 (OneDrive forgot cached folder ids by an exact, case-sensitive match) turned out to be a class. On several providers a folder cached under one capitalization kept a stale id after a rename, move or delete, and some lookups matched a name while ignoring its case, so an upload, a delete or a replace could land on a different, live item.

Area	Description	Status	Ref
Box	Rename, move, trash and rmdir forget the cached ids of the whole subtree; renaming or moving a folder works (it always failed with a 404); stat and copy of a folder use the folder endpoint	🟢 fixed	aec5c2a66
Google Drive	A name lookup takes the exact name only, so uploading a.txt beside A.txt no longer overwrites A.txt and a replace never picks the other file	🟢 fixed	aec5c2a66
kDrive, Drime, Internxt	The cache keeps exact names only, and every destructive step (delete, recursive delete, the delete before an upload, the replace occupant, share links, version restore, the upload parent on kDrive) resolves the exact path	🟢 fixed	aec5c2a66
Trash purge	A permanent delete from the trash takes the item of that name trashed from that folder only (Google Drive, Box, kDrive, Internxt), not a same-named file from another folder	🟢 fixed	aec5c2a66
Drime	An upload onto a folder of the same name is refused instead of trashing the folder	🟢 fixed	aec5c2a66
OneDrive, Filen, 4shared, MTP	Trash, delete and rmdir forget the cached subtree	🟢 fixed	aec5c2a66

Declared: on Google Drive, where two names differing only in case are distinct items, a read with a differently cased path is now NotFound and mkdir -p under a differently cased parent creates a sibling folder. On kDrive, Drime and Internxt a case fallback remains for reads and the source of a rename only, which never destroy anything.

Not verified live: each provider's case behaviour and the trash parent fields come from the providers' documentation and rclone, modelled in local doubles; every fix is pinned by a test seen red on the code before it.

Verified green: GitHub Actions on Linux, macOS and Windows; clippy -D warnings, the full lib suite (4940) and the CLI suite (769). CodeRabbit reviewed the final head; every thread and outside-diff comment was fixed or answered.

[axpnet]

A skip-existing keystore import keeps the profiles added after the backup

Found by the 4.2.1 pre-release review, fixed on main, shipping in v4.2.1 (#980).

Importing a keystore backup with the default "Skip existing" and without opening "Review changes" replaced My Servers with the backup's list whenever the backup carried the account partition: a server added after the backup disappeared. The import now applies the same profile plan the review dialog uses, with its defaults, so nothing local is removed unless you choose it.

Area	Description	Status	Ref
Keystore import	Skip-existing without a review runs the profile plan with its defaults (added accepted, changed and removed rejected): a local-only profile stays (review B1)	🟢 fixed	cef120d69
Keystore preview	When the backup's partition cannot be read on this device the preview says the list will be replaced, instead of describing a merge; new message in all 47 locales (M6)	🟢 fixed	cef120d69
Keystore review	The plan fingerprint no longer includes last-connected time and quota, so a background connection between Review and Import does not make your choices stale (L11)	🟢 fixed	cef120d69
rclone export	An export without credentials drops a crypt password, crypt salt or Filen API key left in a profile's options (L10)	🟢 fixed	cef120d69

Each fix has a test seen red on the previous code. No live test: the import runs on local files only, and the tests cover it end to end on real temporary vaults.

Verified green: CI on the final head (Format, audit and unit tests, build on Linux, Windows and macOS x64/aarch64, CLI smoke on three OSes, portal checks), CodeRabbit clean on the final tree after three rounds, zero open threads.

[axpnet]

Provider fixes from the pre-release review: FTPS refusals, OneDrive stale ids, trash purges

Found by the 4.2.1 pre-release review, fixed on main, shipping in v4.2.1 (#981).

Nine provider findings closed before the tag. Each behaviour fix has a test seen red on the previous code.

Area	Description	Status	Ref
FTPS	A file the server refuses after receiving the data (552, for example over quota) is sent once and the refusal is reported, instead of a silent second upload over TLS (H1). Fixed on our side; the pinned suppaftp fork is unchanged	🟢 fixed	69059502a
FTP	A redial after a dropped session returns to the working directory; a case-insensitive server that lists with LIST alone refuses a rename onto a taken name of another case; a taken name reported on RNTO is "already exists"; a dotfile a bare LIST hides is deleted as a file (M1, M2, L6, L7)	🟢 fixed	69059502a
OneDrive	A delete on a stale cached id resolves the path again and deletes the live file; a permanent delete takes only the trashed item of its own folder (H2)	🟢 fixed	69059502a
Box, kDrive, Internxt, Google Drive, OneDrive	A permanent delete refuses when several trashed items share the name, and reads the whole trash (every page) before deciding (L4)	🟢 fixed	69059502a
Twake Drive	Upload progress rises once across retries and never reads complete before the server accepts the file (M3)	🟢 fixed	69059502a
Proton Drive	A share-link password starting with - is passed as one token (L5)	🟢 fixed	69059502a

Live checks not yet run: FTPS 552 refusal, OneDrive stale id, Box and kDrive trash purge, Twake progress, Proton share password. They need live accounts on the release station; this post will be updated with the results.

Verified green: CI on the final head (Format, audit and unit tests, build on Linux, Windows and macOS x64/aarch64, CLI smoke on three OSes, Windows native unit tests), CodeRabbit clean on the final head, zero open threads.

[axpnet]

A Mirror keeps what it did not complete, and removing a folder never takes its content along

Found by the 4.2.1 pre-release review, fixed on main, shipping in v4.2.1 (#979).

Two blockers of the review sat in AeroSync: a Mirror could delete a destination folder together with files it had not completed or had been told to leave alone, and an exported sync script ran without the Plan's exclusions. Fixing the first led to a deeper rule: a folder removal that is not explicitly recursive now refuses a folder that holds anything, on every backend.

Area	Description	Status	Ref
AeroSync Mirror	A destination folder is removed only once it is empty: a file whose versioned-backup move failed, or a file the compare excluded (such as .env), keeps its folder. The result dialog lists each kept folder with the reason; a permission or other refusal is an error (review B2, H6)	🟢 fixed	cd9ac63d7
Sync scripts and CLI line	Exported .aeroftp-script, .sh and .ps1 files carry the compare's default exclusions and the backup folder, which an import gives back to the Plan; the Plan offers the matching aeroftp-cli sync line (B3, M4)	🟢 fixed	cd9ac63d7
Folder removal, every backend	rmdir refuses a folder that holds anything: native guards where the API has one (Box, pCloud, OneDrive If-Match on the cTag, S3/Azure/Swift/B2 markers), a listing check elsewhere; FTP and SFTP servers that refuse without saying why are read correctly (exit 9); the crypt overlay keeps a folder's dirIV when it holds a hidden name	🟢 fixed	cd9ac63d7
CLI	aeroftp-cli rmdir and sync --delete share that call; sync --delete now removes the directories it emptied on every backend, lists the ones it kept with the reason, and fails the run when a removal is refused for another reason	🟢 fixed	cd9ac63d7

Live tests, debug CLI built from the branch, each in a throwaway folder removed afterwards:

#	Scenario	Where	Result
1	rmdir of an empty folder	FTP, SFTP, WebDAV, S3 (MinIO), OneDrive, Box	PASSED
2	rmdir of a folder holding one file: exit 9, the file stays	FTP, SFTP, WebDAV, S3 (MinIO), OneDrive, Box	PASSED (FTP and SFTP after a fix found by this run: they exited 10)
3	rmdir of a folder holding only a dotfile: exit 9, the dotfile stays	FTP, SFTP, WebDAV, S3 (MinIO), OneDrive, Box	PASSED (same fix)
4	sync --delete --exclude .env: the emptied folder is removed, the one holding .env stays	FTP, SFTP, WebDAV, S3 (MinIO), OneDrive, Box	PASSED

Not run live: the Mirror from the GUI itself (its runner is covered by unit tests; the provider and CLI paths it calls ran live above). Where an API offers no delete that refuses a non-empty folder, one round trip remains between the check and the delete; the delete goes to the provider's trash there.

Verified green: CI on the final head (Format, audit and unit tests, build on Linux, Windows and macOS x64/aarch64, Windows native unit tests, CLI smoke on three OSes), CodeRabbit clean on the final head after five rounds, zero open threads.

[axpnet]

Archive extraction near the name limit, Flatpak import, trash and platform fixes

Found by the 4.2.1 pre-release review, fixed on main, shipping in v4.2.1 (#987).

Ten findings closed before the tag, one of them a blocker: extracting an archive stopped on any entry whose file name was longer than about 232 bytes. Each behaviour fix has a test seen red on the previous code.

Area	Description	Status	Ref
Archives	Entries whose names sit near the file-system limit extract again: the temporary file has a short fixed name and is renamed into place only on success; a 7z entry that cannot be found is an error, not an empty file (review B4, L13)	🟢 fixed	64fc765fd
Flatpak import	The three vault files are imported only together, never mixed with the sandbox's own; a failed import says how many files it had copied, also in flatpak-import --json (M5, L12)	🟢 fixed	64fc765fd
Downloads	A temporary name or path too long for the file system is reported plainly, telling a long name from a long path and, on Windows, an invalid name from a too-long one (L18)	🟢 fixed	64fc765fd
Trash	An escaped mount path can no longer overflow, and only the explicit choice deletes permanently (L2, L3)	🟢 fixed	64fc765fd
Platform	Each Quick Connect method opens its own docs page, the clipboard guard catches every web clipboard use, Proton Drive is shown as a CLI connection, IBM COS locations match IBM's documented endpoints (L19, L20, L21)	🟢 fixed	64fc765fd

No live test beyond the unit and integration tests: the extraction cases run on real temporary archives and folders.

Verified green: CI on the final head after realigning on current main (Format, audit and unit tests, build on Linux, Windows and macOS x64/aarch64, Windows native unit tests, CLI smoke on three OSes), CodeRabbit clean on the final head, zero open threads.

[axpnet]

AeroAgent approvals fail closed, and Stop reaches the running tools

Found by the 4.2.1 pre-release review, fixed on main, shipping in v4.2.1 (#982).

Six AeroAgent findings closed before the tag. Each behaviour fix has a test seen red on the previous code.

Area	Description	Status	Ref
Approvals	"Allow for the rest of the chat" is refused for every high-danger tool and for any tool the app does not know; a grant must match the folder and server it was given in; the approval window is never skipped for delete, trash, shell, extraction, a mutating server command or a sync start (review M7, M8)	🟢 fixed	efaca4283
Stop	Stop cancels the follow-up request of a multi-step answer and the tools still running for that turn: a batch upload stops after the file in flight, a tree walk stops, and a tool the chat still sends for the stopped turn does not start (M9)	🟢 fixed	efaca4283
Native tool calls	A tool call with no arguments sent as an empty string is accepted (M10)	🟢 fixed	efaca4283
Remote edit	On the legacy FTP session an edit is published by replacing the file, not by writing over it in place (L17)	🟢 fixed	efaca4283
Linux	The approval window can be dragged on release builds (L14)	🟢 fixed	efaca4283

Declared in the PR: a blocking step already running (a hash, a local scan) ends there and its result is discarded; the CLI and MCP contexts keep their own cancellation path. No live test with a model provider.

Verified green: CI on the final head after realigning on current main (Format, audit and unit tests, build on Linux, Windows and macOS x64/aarch64, Windows native unit tests), CodeRabbit clean, zero open threads.

[axpnet]

The CLI reports Ctrl-C as interrupted, never drops an immutable transfer, and rounds delete caps down

Found by the 4.2.1 pre-release review, fixed on main, shipping in v4.2.1 (#993).

Ten CLI findings closed before the tag. Each behaviour fix has a test seen red on the previous code.

Area	Description	Status	Ref
Ctrl-C	Interrupting sync, a recursive get/put or a glob transfer exits 130 with "status": "interrupted", instead of 0 or the retryable 4; a sync whose planned work had already finished keeps its outcome (review H3, H4)	🟢 fixed	2dd73e111
sync --immutable	A destination of another size is refused (exit 4, listed in errors) and one of the same size counts as skipped, instead of being dropped without a word (H5)	🟢 fixed	2dd73e111
Delete cap	A percentage --max-delete rounds down, so a cap under 100% never empties a side (L1)	🟢 fixed	2dd73e111
Exit codes	rm --dry-run and a filtered rm on a non-empty directory exit 9 like the real run; a file too large keeps exit 5, which is not retried (L8, L9)	🟢 fixed	2dd73e111
Agent	--auto-approve high stops short of delete and shell, which only all or -y approve; an API key from the vault or the environment is trimmed (L15, L16)	🟢 fixed	2dd73e111
Docs	CLI-GUIDE and AGENTS.md cover the new sync flags and exclude rules, Ctrl-C, --immutable, the providers and tool counts (M11, L23)	🟢 fixed	2dd73e111

Verified green: CI on the final head, realigned on current main (Format, audit and unit tests, build on Linux, Windows and macOS x64/aarch64, CLI smoke on three OSes), CodeRabbit clean on the final head, zero open threads; on the realigned tree 5103 lib and 816 CLI tests passed.

[axpnet]

✅ Released as v4.2.1

AeroFTP v4.2.1 is out: Four New Ways to Connect, and a Round of Repairs. Every one of the 74 queued rows above shipped. Highlights:

• Four new connections: Twake Drive as a native provider (OAuth2 with PKCE against your own instance), IBM Cloud Object Storage and Mail.ru Cloud as ready presets with setup pages, and Proton Drive through the official Proton Drive CLI.
• AeroAgent 1.5: provider-native reasoning kept across tool calls, approvals that fail closed in a dedicated window, "allow for the rest of the chat" for safe tools, and a Stop that reaches the tools still running.
• Extraction you can trust: a wrong 7z password or a truncated archive no longer empties or shortens files you already had.
• Safer sync: a Mirror keeps what it did not complete, removing a folder never takes its content along on any backend, AeroSync's versioned backup keeps old copies on remote destinations, and one modification-time rule and one exclude rule now apply everywhere.
• Transfers that end: SFTP transfers no longer hang when the server goes away, Ctrl-C stops any CLI transfer and exits 130 as interrupted, and implicit FTPS and Internxt connect again.
• The pre-release review read every change since 4.2.0 and found four blockers and six high-severity defects; all shipped fixed, each with a test that failed before the fix.

Thanks to @EhudKirsh and @Markoise for the reports and discussion that shaped this release.

The still-open Requested rows and the 4.2.1 follow-ups carry over to the new tracker: [Tracker] AeroFTP 4.2.2 (#998). This tracker now closes.

[axpnet]

completed