[Tracker] AeroFTP 4.2.2 - Known issues, patches & updates #1420

axpnet · 2026-09-30T12:42:11Z

axpnet
Sep 30, 2026
Maintainer

AeroFTP 4.2.2, Rolling Tracker

Umbrella issue for the next AeroFTP release (v4.2.2): known issues reported against v4.2.1 and the patches/updates landing on main after the v4.2.1 tag.

Status note: the current release line is v4.2.1 (release notes, its tracker is #1419, now closed); this tracker collects what lands on main for v4.2.2.

Before opening a new issue, please check the lists below. If your problem is already tracked here, just add a thumbs-up reaction or a comment with your environment (OS, version, provider) instead of filing a duplicate. We update this issue as bugs are found and fixed.

Found something that is not listed? Open a new issue and we will link it here.

What shipped in 4.2.1

See the v4.2.1 tracker (#898) and the release notes for the full change set, 74 tracked changes. The headline was four new ways to connect: Twake Drive as a native provider, IBM Cloud Object Storage and Mail.ru Cloud as ready presets, and Proton Drive through the official Proton Drive CLI. AeroAgent reached 1.5, with provider-native reasoning kept across tool calls and approvals that fail closed in a dedicated window. Most of the rest was repair: extraction no longer empties or truncates files on failure, a Mirror keeps what it did not complete, removing a folder never takes its content along on any backend, AeroSync's versioned backup keeps old copies on remote destinations, SFTP transfers end instead of hanging when the server goes away, and the CLI reports Ctrl-C as interrupted (exit 130). A full pre-release review read every change since 4.2.0 and found four blockers and six high-severity defects, among them a Mirror that could delete files it had been told to keep and a keystore import that could drop servers; all of them shipped fixed, each with a test that failed before the fix.

Patches & updates queued for 4.2.2

Done on main, shipping in the next release.

#	Change	Status	Commit	Ref
1	The README lists the AM and AppMan install for Linux. Details.	🟢 done	`4a7c51f66`	#900
2	Scope outbound MCP secret references.	🟢 done	`2c45bd455`	#999
3	Store outbound MCP servers per user.	🟢 done	`97f5dfd4f`	#999
4	Add MCP server settings panel.	🟢 done	`dcc02db75`	#999
5	Use app confirmation for MCP removal.	🟢 done	`b7998ca06`	#999
6	Bound outbound MCP stdio frames.	🟢 done	`fc2fe23ff`	#999
7	Define outbound MCP stdio protocol contract.	🟢 done	`9c3e85b8e`	#999
8	Supervise outbound MCP stdio sessions.	🟢 done	`78cb91062`	#999
9	Gate outbound MCP calls with approval and audit.	🟢 done	`9e1fbc6d7`	#999
10	Define private MCP HTTP configuration contract.	🟢 done	`0084988c1`	#999
11	Isolate and gate outbound MCP stdio calls.	🟢 done	`ed11f833b`	#999
12	Add private MCP HTTP transport and OAuth primitives.	🟢 done	`eaf480206`	#999
13	Cover MCP HTTP wire responses and cancellation.	🟢 done	`1bbde8e4f`	#999
14	Bound untrusted MCP registry snapshots.	🟢 done	`b0fb89147`	#999
15	Tolerate early close after host refusal.	🟢 done	`d043cb6e1`	#999
16	Preserve safe MCP header annotations in registry.	🟢 done	`e91e81023`	#999
17	Integrate bounded MCP registry into private bridge lane.	🟢 done	`f310ba280`	#999
18	Inherit 4.2.1 backend approval hardening.	🟢 done	`741ba3c0c`	#999
19	Bind private MCP bridge to fresh backend schemas.	🟢 done	`b17eaf4ce`	#999
20	Harden MCP settings and transport review boundaries.	🟢 done	`09cff0341`	#999
21	Unblock settings and preserve CI fixture arguments.	🟢 done	`951e20e6b`	#999
22	Guard private legacy HTTP negotiation.	🟢 done	`1800e0622`	#999
23	Bind private OAuth lifecycle to live backend state.	🟢 done	`b5d48d5bc`	#999
24	Scope OAuth invalidation and accept token error extensions.	🟢 done	`8d127d153`	#999
25	Preserve Windows fixture runtime environment.	🟢 done	`6ce86b8f2`	#999
26	Close settings framing and negotiation review gaps.	🟢 done	`d0ca247e4`	#999
27	Restore scoped worker groundwork for 4.2.2.	🟢 done	`5513e3f23`	#999
28	Run confined local workers through shared runner.	🟢 done	`349f0577a`	#999
29	Connect delegated parent and local worker to one ledger.	🟢 done	`180bcb678`	#999
30	Run two scoped local workers concurrently.	🟢 done	`99f3bc8ef`	#999
31	Expose scoped local workers in AeroAgent.	🟢 done	`b26a79c62`	#999
32	Add pinned S3 scopes for read-only workers.	🟢 done	`53f718c16`	#999
33	Retain bounded worker source observations.	🟢 done	`032b6f86e`	#999
34	Exercise two pinned S3 worker reads end to end.	🟢 done	`c8ff4e982`	#999
35	Validate distinct remote profiles without borrowed closure.	🟢 done	`905c85246`	#999
36	Show cancelled worker cards after Stop.	🟢 done	`03dd7def6`	#999
37	Preserve worker stop state and pinned endpoint.	🟢 done	`a00dda9f6`	#999
38	Keep completed worker cards after event truncation.	🟢 done	`56478f495`	#999
39	Account for delegated commands and pending translations.	🟢 done	`f7e67b579`	#999
40	Allow expected close during rejected pipeline.	🟢 done	`f636638c0`	#999
41	Preserve delegation budgets and bounded worker results.	🟢 done	`958f63a59`	#999
42	Bound accumulated spending counters.	🟢 done	`4452b78d5`	#999
43	Normalize malformed persisted spending fields.	🟢 done	`e4a393306`	#999
44	Validate persisted cost before budget admission.	🟢 done	`2fc6be770`	#999
45	Merge main to restore worker PR CI.	🟢 done	`263e89ea2`	#999
46	Translate worker controls in every locale.	🟢 done	`31b8f6d9c`	#999
47	Consolidate reviewed worker lane into AeroAgent PR.	🟢 done	`79b828dfe`	#999
48	Add Amazon Bedrock Runtime provider.	🟢 done	`26b6eab38`	#999
49	Reject unsafe Bedrock endpoints before authentication.	🟢 done	`35e0c200a`	#999
50	Consolidate reviewed Bedrock provider into AeroAgent PR.	🟢 done	`d7041f914`	#999
51	Embed AppImage zsync update info and publish the .zsync asset.	🟢 done	`b5a62a804`	#999
52	Move the .zsync next to the AppImage, pair it with the published asset.	🟢 done	`020f7fe61`	#999
53	Repair the adjacent AppImage update sidecar.	🟢 done	`6790d541f`	#999
54	Consolidate AppImage update lane into AeroAgent PR.	🟢 done	`e9213b2f1`	#999
55	Retain protocol spike and cumulative command inventory.	🟢 done	`aa51c9bd3`	#999
56	Fail closed on ambiguous AppImage publication states.	🟢 done	`31ce32d77`	#999
57	Refresh catalog after failed secret persistence.	🟢 done	`428ad7ba9`	#999
58	Distinguish workers from workflows in Hungarian and Icelandic.	🟢 done	`e01ea2eb4`	#999
59	Preserve bounded worker recovery and shared cancellation.	🟢 done	`6d6f3af8b`	#999
60	Restrict delegation IPC to the main webview.	🟢 done	`c9c480a53`	#999
61	Reserve every private credential namespace from generic IPC.	🟢 done	`0390c621a`	#999
62	Derive the delegation app handle from the guarded webview, preserving the main-window boundary and strict lint compliance.	🟢 done	`36dd72a00`	#999
63	Accept the native 77-name MCP catalog under matching 128-tool frontend and backend caps, retaining strict transport, schema and argument bounds.	🟢 done	`4d2e52c10`	#999
64	Tolerate loaded Windows fixture startup with a test-only timeout and delayed modern probe regression preserving metadata and freshness checks.	🟢 done	`8ad10ddab`	#999
65	Land the reviewed AeroAgent workers, private MCP, Bedrock and AppImage cumulative foundation while retaining the full maintainer-signed commit history.	🟢 done	`f7cbbfb92`	#999
66	Update DOMPurify to 3.4.16 for sanitized HTML and SVG previews. Manifest/lock consistency, SVG policy and ESM/CommonJS entrypoints are verified.	🟢 done	`f6ad8f4ed`	#1002
67	AI Settings manage remote MCP HTTP servers with bearer tokens and backend-owned OAuth authorization. Details.	🟢 done	`ae8726058`	#1003
68	AeroAgent can use the tools of enabled MCP servers, each call approved once in the separate window. Details.	🟢 done	`1478f5296`	#1004
69	No more crash at startup on GNOME with appmenu-gtk-module when the interface is slow to load. Details.	🟢 done	`97063dde1`	#1005
70	A download test no longer reads a resumable part before its bytes reach the disk. Details.	🟢 done	`db3834a01`	#1006
71	Saving a server profile that another user account on this device already has now shows a non-blocking warning and an Activity Log entry; the multi-user check behind it was never called. Details.	🟢 done	`5a7efa640`	#1015
72	A development build started on another port loads its splash from its own dev server instead of a hardcoded 5173. Details.	🟢 done	`13e6dc077`	#1012
73	The superseded MCP approval runtime and a test-only dispatch module are removed; every MCP call keeps going through the schema-bound bridge. Details.	🟢 done	`3aa17d548`	#1007
74	Seven multi-user commands that the app never called are removed, including one that returned a decrypted per-user credential to the webview; a new test requires every registered command to have a caller. Details.	🟢 done	`756c1fe8b`	#1016
75	Right-click a server in My Servers to export it, and filter the server lists of Import/Export: "select all" acts on the rows shown. Details.	🟢 done	`e31af92b3`	#1008
76	WebDAV folders open again on servers behind an HTTPS reverse proxy (a bare 401 before), and a redirect that would leave HTTPS is refused with an error naming the server misconfiguration instead of dropping the credentials. Details.	🟢 done	`c07ce1315`	#1011
77	The Snap Store revision of 4.2.1 is rebuilt against USN-8863-1 (GStreamer Good Plugins) and published as r225; no code change, version unchanged. Details.	✅ released	`a470bb87b`	-
78	On Linux the main window no longer reloads when the AeroAgent approval window opens, and the approval and extract windows no longer crash with appmenu-gtk-module. Details.	🟢 done	`e0e78cdd1`	#1017
79	Parallel transfers no longer get pinned to one file at a time on a server after a few batches, folders or syncs. Details.	🟢 done	`0e0c5add5`	#1021
80	AeroAgent MCP: the reference servers' tools are usable (schema enums and bounds enforced, defaults never injected), and SDK HTTP servers such as DeepWiki connect through a narrow legacy fallback. Details.	🟢 done	`dc1a27a1a`	#1026
81	Clicking a saved OAuth server whose app keys are not in the vault now says so, names the provider and opens the OAuth settings, instead of doing nothing; a vault read error is reported apart. Details.	🟢 done	`b6b684a4a`	#1014
82	Editing a saved OAuth server in My Servers can be saved again, a failed save is reported instead of closing as saved, and a saved-servers panel unreachable since v3.3.0 is removed. Details.	🟢 done	`e8f4730f8`	#1009
83	Filen notes: add, remove, create, rename and delete tags from the editor, and a note type change is saved to Filen right away. Details.	🟢 done	`c33f6379e`	#1031
84	Share Link offers the expiry, password and permission options the connected provider supports, Revoke works on every provider that lists links, and closing the window early no longer creates a link. Details.	🟢 done	`45d5fe502`	#1019
85	GitLab files and folders get View on GitLab (self-hosted included), and View on GitHub and File History open the browser again. Details.	🟢 done	`560aa083a`	#1028
86	Box and Google Drive files get a comments window (list, add, delete), Box gets collaborators and Unlock Folder, all from the context menu. Details.	🟢 done	`17171b5d8`	#1029
87	AeroAgent MCP: local servers can be given confirmed read-only folder access in their sandbox, and reviewed pinned server installs have their backend foundation; custom servers stay without network. Details.	🟢 done	`17e9016f1`	#1033
88	The connection form loses the branches unreachable since v3.3.0 (40 sites of an always-true flag, dead state, handlers and four strings), with no behavior change. Details.	🟢 done	`2f7b0adc4`	#1010
89	AeroTools: Security Tools open as a column next to Editor, Terminal and AI Agent instead of a window over the app; the Cyber theme button keeps the window. Details.	🟢 done	`5f304b916`	#1037
90	The native menu is translated again when the app language changes, and rebuilding it no longer brings back a menu bar the user hid on Linux. Details.	🟢 done	`09205d442`	#1032
91	Stop now interrupts a large segmented download on HTTP providers (it ran on for seconds) and a cross-profile copy, and never publishes a partial file. Details.	🟢 done	`1d1ff611d`	#1036
92	S3 objects get Storage Class, Object Tags and Restore from Glacier, Azure blobs get Access Tier, all from the context menu, with the backend now checking every class and tier it is sent. Details.	🟢 done	`c8e40e386`	#1030
93	AeroSync's Plan and Local mirror tabs show the CLI flag beside Exclude patterns, Canary Mode and Dry run: (--exclude) and (--dry-run). Details.	🟢 done	`ddca42b93`	#1035
94	Selecting several files now transfers them in parallel on every protocol (one at a time before), the first Stop finishes the files in flight, and a cut deletes only the sources that arrived. Details.	🟢 done	`d89614e08`	#591
95	AeroSync runs fill the Transfer Queue: each file gets its row with live progress and ends as completed or failed with the reason. Details.	🟢 done	`1fc9ebd4b`	#364
96	AeroAgent MCP: a Recommended servers section starts with DeepWiki (install by id, disabled until enabled), and schema bounds and lengths from the reference servers are validated and fail closed. Details.	🟢 done	`dd60d9719`	#1038
97	Deleting a file from an AeroVault v2 vault now removes its encrypted data from the vault file (it stayed there before), and eleven unused vault commands leave the IPC surface. Details.	🟢 done	`a1aced17d`	#1022
98	The unused multi-session backend and 28 legacy commands nothing called leave the IPC surface (871 to 843 commands), with no behaviour change. Details.	🟢 done	`8bbdb9f8f`	#1018
99	24 provider commands whose flows were replaced leave the IPC surface (manual OAuth halves, old move-to-trash commands, a withdrawn Dropbox and Zoho labels feature). Details.	🟢 done	`7c5b5b6d2`	#1020
100	AeroAgent: the old tool router and plugin-hook runner that acted without approval are removed with 12 other unused agent, plugin and chat-history commands. Details.	🟢 done	`645fc4c87`	#1024
101	Pausing AeroCloud shows the Paused tray badge and resuming clears it; 19 commands whose work is done another way leave the IPC surface. Details.	🟢 done	`9c99f4489`	#1025
102	AeroSync journals are signed on every save so History can verify them, saved presets can be deleted, and 14 superseded sync commands go. Details.	🟢 done	`87d3df027`	#1023
103	File tags follow local renames, moves and deletes, folders included, instead of passing to the next file that takes the old path. Details.	🟢 done	`d5f694ae2`	#1027
104	A segmented download shows real progress, speed and ETA while its ranges run, instead of staying indeterminate until a whole range finishes. Details.	🟢 done	`7d9ff7673`	#1040
105	A tray badge test that could not read `lib.rs` on a Windows checkout (CRLF) passes again on Windows. Details.	🟢 done	`b9c8a87ea`	#1042
106	macOS installers build on macos-15 before the macos-14 image is retired, with the same minimum macOS (10.13 Intel, 11.0 Apple Silicon), and every DMG is checked against the last release. Details.	🟢 done	`5698f0cce`	#1039, #1425
107	The guard against uncalled IPC commands now follows hooks, invoke sites and imports to their real module; two dead commands go, one of which wrote agent memory without approval. Details.	🟢 done	`1b5d68233`	#1041
108	The `--transfer-engine` help, the router docs and the engine docs say what the router does: plain WebDAV and Nextcloud downloads take the direct path, and `-v` names the real override. Details.	🟢 done	`77e641b9d`	#1044
109	docs/DAG-TRANSFER-ENGINE.md gets five figures of the engine (shaping, dispatch, AIMD, many files, completion), light and dark, visible to readers without a GitHub session. Details.	🟢 done	`ffa941438`	#1045
110	A developer test tool that writes test profiles into the vault, shipped by mistake in the v4.2.1 Windows installers and macOS DMGs, is no longer packaged. Details.	🟢 done	`9e0d43409`	#1043
111	The `--transfer-engine` help and the engine docs say the override reaches only the plain single-file transfer, and the AIMD figure captions give the conditions of what they show. Details.	🟢 done	`dfa4d6160`	#1046
112	docs/DAG-TRANSFER-ENGINE.md says how to measure the engine against the direct path, which paths the override does not switch, and what is new work rather than a feature. Details.	🟢 done	`af80d5581`	#1048
113	WebDAV uploads show streamed progress, keep it monotonic across a Digest retry and report completion only after the server accepts the PUT. Details.	🟢 done	`eeb0e46e2`	#1047
114	The 4.2.0 changelog no longer quotes an S3 multi-stream figure that was measured on one stream; it gives the 4.2.1 measurement instead. Details.	🟢 done	`b3a1674cd`	#1050
115	Every checkout now gets LF line endings, Windows included, so tests and generated files see the same bytes on every OS; what the Windows installers ship is unchanged. Details.	🟢 done	`401d7d4e4`	#1051
116	Unit tests, two code comments and a CLI guide example use example hosts, users and paths instead of real ones. Details.	🟢 done	`f85516cf3`	#1052
117	A Windows CI flake in the MCP stdio transport tests is fixed: the tests give a cooperative peer the production budgets instead of timing `node.exe` on a busy runner. Details.	🟢 done	`6f20d3280`	#1054
118	Overwrite checks inspect the actual destination, preserve empty listings and refuse failed inspection before writing; batch rename targets are reserved so repeated names receive distinct paths. Details.	🟢 done	`e92df5c2b`	#1049
119	Failed saved-profile writes retain editors and input, avoid false success and restore touched credentials; saved-server actions, settings/import and background metadata persist before publishing state. Details.	🟢 done	`ce420b414`	#1053
120	Saved presets are selectable in AeroSync Plan without changing endpoints, with unsupported fields made explicit; right-to-left plans now swap source bucket roles correctly. Details.	🟢 done	`d40c7b4c9`	#1055
121	Single-file SFTP uploads send only whole WRITE requests, so twice as much data stays in flight: a 300 MiB upload over a 47 ms link went from about 20 s to about 10.6 s. Details.	🟢 done	`7709d994d`	#1057
122	S3 multipart uploads no longer hold every part twice (peak RAM 156-159 MB instead of 208-216 MB on 300 MiB), and S3 commands reuse the connect probe's connection. Details.	🟢 done	`ad83fff06`	#1056
123	The two DAG fail-fast timing tests no longer fail when a busy CI runner stalls them: they run on Tokio's paused clock with a 100 ms bound, so they time the executor and still fail if the cooperative cancel is lost. Details.	🟢 done	`82d9d5eeb`	#1058
124	The notice shown when a sync preset has nothing to run gets its own title, "Nothing to sync", in every language (it repeated "Sync presets"), and an i18n key nothing read leaves all 47 locales. Details.	🟢 done	`aeebdb1d1`	#1060
125	The AeroAgent in this release is version 1.6, as shown in AI Settings and the chat header: the one that brings MCP servers, scoped workers and Amazon Bedrock. Details.	🟢 done	`af48b5687`	#1061
126	SFTP downloads send each read-ahead chunk as one READ, so the server never idles between rounds: a 300 MiB download over a 47 ms link went from about 46-52 s to 34-39 s on one connection and from 22-27 s to 17-24 s on four, with less peak memory. Details.	🟢 done	`33bf6375c`	#1063
127	AeroSync's sync preset selector in Export Templates groups the built-in modes apart from your saved presets, by the same rule the delete button uses. Details.	🟢 done	`a5847ea55`	#347 (@EhudKirsh)
128	Two segmented downloads of one file can no longer leave the second one's empty, pre-sized file in place: the first keeps its temporary locked until it has published it (Linux, local filesystems). Details.	🟢 done	`3d3b1b95a`	#1062
129	The Linux build downloads appimagetool from the versioned release 1.9.1, checked by digest, instead of the rolling build whose upstream rebuild turned every Linux build red on 2026-10-04. Details.	🟢 done	`40df8460c`	#1071
130	A segmented SFTP download shares one read-ahead budget across its connections: the default four keep 16 READs each instead of 32, 25 to 33 MB less at the peak on a 300 MiB file with no consistent time cost. Details.	🟢 done	`14973d95e`	#1066
131	Flatpak data import results that only inform show OK alone, instead of a Cancel that offered no choice. Details.	🟢 done	`171ef16a1`	#1065
132	AeroImage says once per section whether an edit loses data (Lossless or Lossy by format), and Quick Connect calls the saved name "Profile name" with one Optional heading for the S3 temporary-credential fields. Details.	🟢 done	`205e84bb0`	#347 (@EhudKirsh), #1068
133	Snap gate G4 reports the lint check as UNVERIFIED when snapcraft lint could not run, instead of an OK that looked like a pass. Details.	🟢 done	`3668c3835`	#1070
134	The Linux build embeds the AppImage runtime from the dated release 20251108, checked by digest, instead of downloading the rolling build unchecked on every build. Details.	🟢 done	`d09135f8c`	#1072
135	Table cells follow their headers: a stylesheet rule no longer right-aligns the 2nd and 3rd column of every table, so AeroFile's sizes and placeholders line up under their headers. Details.	🟢 done	`edff2cce8`	#347 (@EhudKirsh), #1073
136	On Linux the main window has slightly rounded corners, 8px like on Windows 11, on desktops with a compositor; `AEROFTP_SQUARE_CORNERS=1` brings back the square ones. Details.	🟢 done	`09d1878c7`	#1076
137	SFTP connections turn off Nagle's algorithm, so the small READ and window packets of a download no longer wait for an acknowledgement: one connection on a faster line went from 33-35 s to 17-18 s on 300 MiB. Details.	🟢 done	`ae1893755`	#1067
138	Folders can be renamed on B2 and ImageKit; on B2 the rename never merges folders, leaves nothing in view under the old name on a versioned bucket, keeps a file someone else uploads meanwhile, and renews an expired token at the step where it expired. Details.	🟢 done	`d4f97fdd3`	#1064
139	AeroSync no longer scans both folders as soon as it opens: the compare starts on request, has a Stop button, stops when AeroSync closes, and uses a cancel flag of its own instead of the transfers' one. Details.	🟢 done	`48e111058`	#1074
140	AeroImage crops anywhere in the image: the selection starts as the whole image with its handles on the edges and reaches every side, where it used to be shifted by the margin around the picture. Details.	🟢 done	`30b2665c8`	#1075 (@EhudKirsh), #1078
141	Calculating used storage shows its progress live against the kept total, labelled "used / total (N files)", and on WebDAV a server that refused or never answered a whole-tree listing is not asked again on every click. Details.	🟢 done	`a99b807e2`	#958 (@EhudKirsh), #1079
142	The used-storage scan and every WebDAV walk list up to eight folders at once: a 60,800-file WebDAV tree went from 42-52 s to under 7 s, an SFTP one from 160-180 s to 23 s, with throttled listings retried instead of counted unreadable. Details.	🟢 done	`3c9865f80`	#958 (@EhudKirsh), #1080

Requested / under consideration

Community requests and internal follow-ups being evaluated for this or a later release. Rows carried over from #1419 (renumbered) and from the 4.2.1 release follow-ups.

#		Item	Status	Ref
1	🟧	Eager-evaluation preview and a single-vs-multi-target placeholder for the `-i` selectors (prioritised by the reporter ahead of `Edit(E)` and the 2-letter semantics; exact behaviour to be pinned)	🔵 idea	#311 (@EhudKirsh)
2	🟥	Lossless `.jpg` to `.jxl` transcode in AeroFile: JXL re-encodes an existing JPEG losslessly and reversibly (the original JPEG bytes reconstruct exactly), for a real size win with no quality loss. Candidate framing: AeroFile as a GUI for libjxl	🔵 idea	aerovault#2 (@EhudKirsh)
3	🟥	macOS shell integration for the OS extract feature (Deliverable G macOS, deferred): Finder Sync "Extract Here / Extract to Folder" menu items mirroring the Linux Nautilus and Windows verbs, plus macOS custom document-type icons (CFBundleDocumentTypes) for the five aero formats and the generic fallback, and rebuilding the mimetype `.icns` multi-size (the v4.1.0 ones are single-resolution drafts). Needs a Mac to build and live-test	🔵 planned	#1408 (Deliverable G)
4	🟥	Filen Encrypted Notes: exit Beta: take Filen Notes out of Beta. Fix the `participants/add` contactUUID format (currently a best-effort workaround), investigate the Filen free-plan 10-note limit ghost-note cleanup, and add a rich text editor for the rich note type	🔵 planned	-
5	🟥	PRIORITY: Linux tray/GTK heap corruption, still-uncovered off-main-thread corruptor. A GDBus worker aborts with `malloc(): unaligned fastbin chunk detected`, the classic GLib heap-corruption signature, and it is the victim rather than the corruptor. Two marshalling fixes shipped in v4.0.5 and the SIGABRT still recurs with an identical signature, so the marshalling is incomplete and the remaining suspects are the event and plugin callbacks whose thread context is unconfirmed. Details.	🔵 planned	-
6	🟥	Recommended-protocol highlight on the Add Service / Quick Connect pages, after real benchmarks land (#368)	🔵 idea	#274 (@EhudKirsh)
7	🟧	File association opt-out (deferred, design parked): two switches, AeroFTP's own five formats against the eight general archive formats, persisted in `HKCU` and re-read by the NSIS post-install hook so an in-app update cannot silently restore the association, plus a `/NOASSOC` setup switch. Parked rather than half built, because a visible components-page checkbox needs forking the Tauri NSIS template. Details.	🔵 planned	#454
8	🟧	S3 recursive delete pays one extra HEAD per directory, because it lists with the trailing-slash prefix, which by construction cannot see the same-named key, so a separate probe is unavoidable given that listing. Listing with the slashless prefix would skip the probe entirely in the common case, where no same-named object exists, at the cost of a filter that must keep exactly `path` and `path/...`. The trap is the one #764 just closed, moved by one character: a sibling like `reportsX` also matches the shorter prefix. Whoever takes this must write both doors before the change, not after: `reportsX` survives a delete of `reports`, and `reports` survives when it is a real non-empty file. Worth doing when someone measures a slow recursive delete on a tree with many folders, not before. 4.2.1 context: #979 changed folder-removal semantics (a folder is removed only once empty, `sync --delete` removes the directories it emptied on every backend) but did not touch this listing or its probe; still open.	🔵 idea	#764
9	🟥	The AeroCrypt default-salt toggle promises more than the format offers: `defaultSaltToggle` says "no kit or keystore needed after create" and `defaultSaltTierMeaning` says "nothing else has to be carried", and neither holds, because the wrapped master key lives in the config rather than in the password, so a headerless vault needs the keystore whatever its salt mode. Two ways out, and the choice is a product call: implement the reconstruction and make the promise true, or correct the wording across 47 locales. Found while working #347; the copy was left untouched there on purpose. Details.	🔵 planned	#347
10	🟧	A hard task drop on the DAG runner path is not covered by the abort guard. Cooperative cancellation is: `transfer_dag_batch.rs` keeps a copy of the handle and aborts on the `Err` arm, which is how a cancelled token arrives. But if the task is dropped outright rather than cancelled through the token, the await inside `multipart_abort` dies with it and nothing on the runner path resends it, so the parts wait for the bucket lifecycle rule. Predates #766, which introduced the guard on the two provider paths only.	🔵 idea	#766
11	🟧	A backend that refuses `If-Match` cannot be told from an object that really changed. A gateway answering 412 to every pinned range would send every download back to a single stream while the output announces four, and nothing distinguishes that from a replacement today. Raised during the review of #885 and deferred with the reason written down.	🔵 planned	#885
12	🟧	A replacement that is slow and still in progress can pass the reading that decides whether to publish. That reading retries once; if the server is still writing the new version, the second reading can see an intermediate state. Neither the unit test nor the live reproduction covers it, because both replace in one write.	🔵 planned	#885
13	🟨	Nothing tells the user on the terminal why a download restarted on a single stream. Since #887 the fallback keeps its progress bar, but the refusal itself is still only a warning in the log, so a command-line user sees the stream count drop with no reason given. 4.2.1 context: #905 and #920 made recursive, glob and `sync` downloads print the effective multi-thread policy and one planner decide the stream count, but the server refusal itself is still log-only; still open.	🔵 planned	#885
14	🟨	Declare atomic rename as a capability read from the server rather than assumed from the protocol. `TransferCapabilities.atomic_rename` is `Unsupported` for every provider and nothing reads it, while SFTP servers that announce `posix-rename` do support it: the capability should carry the measured answer so a plan can show where it came from.	🔵 planned	-
15	🟨	The same question has not been asked of parallel uploads. Azure, Box, Drime and Dropbox assemble parts read from the local file concurrently; whether a local file changing under them produces the mixture the download path had is an open question, not a finding.	🔵 planned	-
16	🟨	A resumed `.aerotmp` is not tied to the version it was started from. Resuming a partial download against an object replaced in the meantime joins two versions by a route #885 did not close.	🔵 planned	-
17	🟧	AppImage delta updates: live post-tag verification. Embedded update information and matching `.zsync` publication landed in #999; verify AppImageUpdate/AM delta downloads against the next real release assets.	🔵 planned	#1000
18	🟧	Flatpak vault migration and `vault.db` JSON handling. Follow-ups left by the 4.2.1 Flatpak config import work: the host-config migration path and the vault database's JSON handling need their deferred edges closed.	🔵 planned	#961, #987
19	🟨	RAR5 hardlinks are resolved relative to the current working directory instead of the extraction root; pinned by review, fix deferred.	🔵 planned	#966
20	🟨	aerovault crate: zstd length handling. Deferred edge found while shipping the AeroCompress already-compressed skip.	🔵 planned	#925
21	🟨	B2 and ImageKit folder rename cases left open by the rename/move contract work.	🔵 planned	#944
22	🟨	Azure hierarchical-namespace folders: live test the directory-blob removal and HNS reporting against a real HNS account.	🔵 planned	#964
23	🟨	Swift: a listing page shorter than the marker (short page) needs a live confirmation that pagination stops correctly.	🔵 planned	#964
24	🟨	GUI Mirror live test of the kept-folder behavior shipped in 4.2.1: a Mirror that could not complete or was told to leave files alone keeps their folders, with the reason listed.	🔵 planned	#979
25	🟨	Live tests deferred from 4.2.1: FTPS 552 after the data (sent once, refusal reported), OneDrive delete behind a stale id, Box and kDrive trash purge refusing an ambiguous name, Twake upload progress across retries, Proton share password starting with a dash.	🔵 planned	#981
26	🟨	Line-ending follow-ups after the `.gitattributes`: drop the hand CRLF normalisations in the tray badge and checksum matrix tests once existing Windows development clones are refreshed, and move `LICENSE` to the LF rule only if the NSIS license page is shown to render LF text correctly on Windows.	🔵 planned	#1051
27	🟨	MCP client presets v1.1: Fetch and Git servers fetched at install time (the remote DeepWiki preset shipped in #1038): download pinned release artifacts when the user installs the preset, checked by SHA-256, gated by target OS and architecture and by the Python ABI, instead of embedding third-party archives in the app. Parked until after v4.2.2 for a design review of the supply-chain path.	🔵 planned	#1038
28	🟧	AppImage runtime with 0700 extraction folders: move the runtime pin (and its digest) to the first dated type2-runtime release that contains upstream 8f39b89e2; until then an AppImage run extracted creates its folders with mode 0755	🔵 planned	#1072
29	🟧	Pin the linuxdeploy plugins the Tauri bundler downloads (`linuxdeploy-plugin-appimage` from `continuous`, the gtk and gstreamer plugins from `master`): they are fetched unchecked on every Linux build, outside `build.yml`, so pinning them needs the bundler's own controls	🔵 planned	#1072

Known issues found after release

Reported against v4.2.1. Empty at the time of opening: every entry in the previous tracker's block was resolved before it closed, so nothing carried over as pending.

#	Area	Description	Status	Ref

Legend: 🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released

axpnet · 2026-09-30T14:07:08Z

axpnet
Sep 30, 2026
Maintainer Author

The README lists the AM and AppMan install for Linux

Docs update on main, shipping with v4.2.2 (#900, suggested by @shuvashish76).

AeroFTP has been packaged in the AM and AppMan AppImage managers since ivan-hc/AM#2735. The README now shows both install commands next to the other Linux formats.

Area	Description	Status	Ref
README	`am -i aeroftp` (system-wide) and `appman -i aeroftp` (per user, no root)	🟢 done	`4a7c51f66`

The AppImage delta updates (.zsync) asked in the same discussion did not make 4.2.1; they are tracked in this tracker under "Requested / under consideration" (row 17).

Verified green: docs-only change (README), no code touched.

0 replies

axpnet · 2026-10-01T13:55:15Z

axpnet
Oct 1, 2026
Maintainer Author

Private MCP foundation for AeroAgent

Post-4.2.1 follow-up, fixed on main, shipping in v4.2.2 (cumulative PR #999).

The private client foundation stores STDIO servers per user and keeps secrets in the encrypted vault. Bounded framing and protocol negotiation feed isolated processes, one-shot native approvals and audit; the private bridge rechecks live configuration and fresh tool schemas. Streamable HTTP and OAuth tokens are bound to current user/server revisions. The existing settings page saves STDIO configuration; HTTP settings, browser callback UX, live health/tools snapshots and model routing are follow-up work.

Area	Description	Status	Ref
Settings drafts	Stable card keys and independent saved-value effects preserve drafts during unrelated updates; stale list responses cannot overwrite newer state.	🟢 done / fixed (pending release)	#999
Protocol and transport	Malformed JSON-RPC envelopes fail closed; only method-not-found allows the error-based legacy STDIO handshake. Windows fixtures preserve SystemRoot only in tests.	🟢 done / fixed (pending release)	#999
Security boundaries	Production process isolation, fresh schemas, native one-shot approval, private token resolution and atomic OAuth credential cleanup remain mandatory.	🟢 done / fixed (pending release)	#999
Focused evidence	Focused dispatch regressions: 6 passed, 1 own-server test explicitly skipped in that focused run; 4 React/jsdom draft/race and partial-secret-write tests passed. Deterministic STDIO and loopback HTTP/OAuth fixtures exercise cancellation and stale-state boundaries.	🟢 done / fixed (pending release)	#999

The source lane previously passed its own AeroFTP MCP server self-test inside Linux bubblewrap, using tools/list and read-only aeroftp_mcp_info without saved profiles or a third-party server. Current wire tests use deterministic STDIO peers and test-only loopback HTTP. The subsequent own-server validation passed as recorded below.

A live round trip through the sandboxed private client to the freshly built AeroFTP MCP server called aeroftp_mcp_info successfully. The catalog limit is 128 tool names, accepting AeroFTP's 77 primary/compatibility names while preserving the 64 KiB transport frame and strict per-tool schemas; frontend and backend tests accept 128 and reject 129.

All MCP credential namespaces, including HTTP bearer and OAuth tokens, stay unavailable through generic user credential IPC. Settings refresh after a partial secret-write failure adopts the backend revision before retry.

Commits in this lane:

Commit	Change
`2c45bd455`	Scope outbound MCP secret references.
`97f5dfd4f`	Store outbound MCP servers per user.
`dcc02db75`	Add MCP server settings panel.
`b7998ca06`	Use app confirmation for MCP removal.
`fc2fe23ff`	Bound outbound MCP stdio frames.
`9c3e85b8e`	Define outbound MCP stdio protocol contract.
`78cb91062`	Supervise outbound MCP stdio sessions.
`9e1fbc6d7`	Gate outbound MCP calls with approval and audit.
`0084988c1`	Define private MCP HTTP configuration contract.
`ed11f833b`	Isolate and gate outbound MCP stdio calls.
`eaf480206`	Add private MCP HTTP transport and OAuth primitives.
`1bbde8e4f`	Cover MCP HTTP wire responses and cancellation.
`b0fb89147`	Bound untrusted MCP registry snapshots.
`d043cb6e1`	Tolerate early close after host refusal.
`e91e81023`	Preserve safe MCP header annotations in registry.
`f310ba280`	Integrate bounded MCP registry into private bridge lane.
`741ba3c0c`	Inherit 4.2.1 backend approval hardening.
`b17eaf4ce`	Bind private MCP bridge to fresh backend schemas.
`09cff0341`	Harden MCP settings and transport review boundaries.
`951e20e6b`	Unblock settings and preserve CI fixture arguments.
`1800e0622`	Guard private legacy HTTP negotiation.
`b5d48d5bc`	Bind private OAuth lifecycle to live backend state.
`8d127d153`	Scope OAuth invalidation and accept token error extensions.
`6ce86b8f2`	Preserve Windows fixture runtime environment.
`d0ca247e4`	Close settings framing and negotiation review gaps.
`aa51c9bd3`	Retain protocol spike and cumulative command inventory.
`428ad7ba9`	Refresh catalog after failed secret persistence.
`0390c621a`	Reserve every private credential namespace from generic IPC.
`4d2e52c10`	Accept the native 77-name MCP catalog under matching 128-tool frontend and backend caps, retaining strict transport, schema and argument bounds.
`8ad10ddab`	Tolerate loaded Windows fixture startup with a test-only timeout and delayed modern probe regression preserving metadata and freshness checks.
`f7cbbfb92`	Land the reviewed AeroAgent workers, private MCP, Bedrock and AppImage cumulative foundation while retaining the full maintainer-signed commit history.

Verified green: complete local landing checks on 8ad10ddab: fmt, security regressions, eight version sites, frontend 1276 tests/146 files, typecheck, i18n 5436 keys across 47 locales with zero missing/extra/placeholders, strict all-target Clippy, Rust 6158 passed/0 failed/93 configured skips and strict cargo audit. The audit database download initially hit a network error; only the audit was retried successfully. Additional sandboxed self-MCP roundtrip 1/1, exact compiled CLI inventory and seven offline AppImage publication cases passed. Exact-head Actions: all eight workflows succeeded, 23 successful checks and 6 configured skips, including Windows native tests, Linux validation, macOS ARM/Intel and Windows/Linux package builds. Build and native validation, CLI smoke, protocol fixtures. CodeRabbit completed the final review at 2026-10-01T12:51:16Z, with no unresolved findings. Merge f7cbbfb92 preserves the verified tree and all 63 branch commits.

Named private MCP regression tests (107 passed in the full native gate)

mcp_client_bridge::http_wire_tests::private_bridge_reaches_guarded_legacy_http_with_fresh_schema_and_approval
mcp_client_bridge::tests::approval_scope_separates_transport_user_schema_config_arguments_and_tool
mcp_client_bridge::tests::auth_challenge_fails_without_approval_or_retry
mcp_client_bridge::tests::cancellation_before_approval_after_approval_and_after_call
mcp_client_bridge::tests::denied_approval_never_calls_tool
mcp_client_bridge::tests::fresh_schema_binds_approval_and_supplies_call_headers
mcp_client_bridge::http_wire_tests::backend_discovered_header_is_mirrored_on_real_http_wire
mcp_client_bridge::tests::live_state_rejection_at_each_boundary_suppresses_calls_or_result
mcp_client_bridge::tests::preparation_discovers_but_never_executes
mcp_client_bridge::tests::schema_change_during_approval_never_calls_tool
mcp_client_bridge::tests::stale_snapshot_and_invalid_arguments_fail_before_approval
mcp_client_commands::tests::catalog_rejects_duplicates_and_excessive_servers
mcp_client_commands::tests::concurrent_catalog_writer_cannot_read_stale_revision
mcp_client_commands::tests::upsert_requires_fresh_revisions_and_identifies_removed_secret_refs
mcp_client_config::tests::disabled_configs_never_request_secrets_and_revision_tracks_config_edits
mcp_client_config::tests::refs_are_scoped_and_shell_expansion_is_rejected
mcp_client_config::tests::resolution_is_redacted_and_changes_revision_after_secret_mutation
mcp_client_dispatch::tests::freshness_precedes_process_start
mcp_client_bridge::wire_tests::isolated_stdio_bridge_round_trips_modern_and_legacy_fixture
mcp_client_dispatch::tests::isolated_fixture_is_listed_called_and_rechecked
mcp_client_dispatch::tests::revision_change_during_call_discards_result
mcp_client_framing::tests::fragmented_and_multiple_frames
mcp_client_framing::tests::invalid_envelopes_never_reach_dispatch
mcp_client_framing::tests::oversized_and_malformed_frames_fail_closed
mcp_client_framing::tests::truncated_eof_fails_closed
mcp_client_framing::tests::valid_requests_notifications_and_error_responses_are_preserved
mcp_client_gate::tests::disabled_missing_secret_and_changed_revision_fail_before_approval
mcp_client_gate::tests::invalid_peer_identifiers_never_enter_audit
mcp_client_gate::tests::invisible_tool_names_never_reach_approval_or_raw_audit
mcp_client_gate::tests::oversized_arguments_are_rejected_before_approval
mcp_client_gate::tests::scopes_separate_server_tool_arguments_user_and_revision
mcp_client_gate::tests::user_secret_or_config_change_during_approval_invalidates_grant
mcp_client_gate::tests::valid_gate_rechecks_state_and_audit_omits_secrets_and_arguments
mcp_client_gate::tests::wrong_grant_is_denied_and_audited_without_raw_input
mcp_client_http_config::tests::auth_modes_reject_inline_tokens_and_wrong_references
mcp_client_http_config::tests::disabled_and_revision_changes_invalidate_resolution
mcp_client_http_config::tests::https_endpoint_excludes_inline_credentials_and_local_targets
mcp_client_http_transport::tests::bearer_challenge_is_bounded_and_redacted
mcp_client_http_transport::tests::bearer_header_is_sensitive_and_debug_redacted
mcp_client_http_transport::tests::downgrade_requires_authoritative_version_and_correlated_envelope
mcp_client_dispatch::tests::stale_revision_after_connect_suppresses_tool_call
mcp_client_dispatch::tests::unknown_advertised_tool_is_not_called
mcp_client_http_transport::tests::guarded_legacy_negotiation_initializes_and_binds_json_and_sse_session
mcp_client_http_transport::tests::header_annotations_are_reachable_primitive_unique_and_safe
mcp_client_http_transport::tests::header_values_use_exact_base64_sentinel_rules
mcp_client_http_transport::tests::json_and_request_scoped_sse_are_bounded_and_correlated
mcp_client_http_transport::tests::legacy_handshake_rejects_unknown_version_id_and_session_replacement
mcp_client_http_transport::tests::modern_headers_match_body_source_fields
mcp_client_http_transport::tests::modern_success_stays_stateless_and_later_version_error_never_replays_call
mcp_client_http_transport::tests::public_ip_policy_rejects_non_public_ranges
mcp_client_http_transport::tests::session_ids_are_bounded_unique_visible_ascii_and_sensitive
mcp_client_http_transport::tests::guarded_negotiation_never_retries_auth_arbitrary_error_or_malformed_reply
mcp_client_http_transport::tests::timeout_and_network_failure_never_negotiate_legacy
mcp_client_http_transport::tests::wire_fixture_cancellation_stops_a_pending_request
mcp_client_http_transport::tests::stale_user_config_or_endpoint_cannot_reuse_session
mcp_client_http_transport::tests::wire_fixture_checks_json_sse_headers_and_correlated_reply
mcp_client_oauth::lifecycle::tests::active_exchange_cannot_be_superseded_and_pending_authorization_blocks_refresh
mcp_client_http_transport::tests::freshness_and_cancellation_guard_every_negotiation_call_and_result
mcp_client_http_transport::tests::wire_fixture_rejects_redirect_large_body_and_handles_401_scope
mcp_client_oauth::lifecycle::tests::bound_storage_resolver_rejects_config_user_expiry_and_secret_changes
mcp_client_oauth::lifecycle::tests::callback_origin_path_denial_duplicates_and_mixups_consume_once
mcp_client_oauth::lifecycle::tests::canonical_resource_accepts_root_and_case_without_normalizing_issuer
mcp_client_oauth::lifecycle::tests::cleanup_is_atomic_and_keeps_other_users_and_servers
mcp_client_oauth::lifecycle::tests::binding_mutations_disable_remove_endpoint_client_and_lock_fail_closed
mcp_client_oauth::lifecycle::tests::explicit_refresh_lease_serializes_rotation_and_releases_on_drop
mcp_client_oauth::lifecycle::tests::exchange_wire_checks_pkce_and_each_freshness_boundary
mcp_client_oauth::lifecycle::tests::local_oauth_errors_preserve_other_servers_and_users_while_lock_invalidates_all
mcp_client_oauth::lifecycle::tests::pending_concurrent_consumption_expiry_cancel_and_bounded_invalidation
mcp_client_oauth::lifecycle::tests::pending_invalidation_interrupts_an_inflight_exchange
mcp_client_oauth::lifecycle::tests::invalid_grant_wire_completion_cleans_atomically_and_cancel_or_stale_preserves_tokens
mcp_client_oauth::lifecycle::tests::token_save_rechecks_snapshot_and_rolls_back_on_final_freshness_failure
mcp_client_oauth::tests::authorization_metadata_requires_explicit_s256_pkce
mcp_client_oauth::tests::encrypted_tokens_remain_in_the_selected_user_partition
mcp_client_oauth::tests::pkce_state_issuer_and_resource_are_bound
mcp_client_oauth::tests::protected_resource_and_issuer_paths_follow_spec_order
mcp_client_oauth::tests::resource_and_issuer_mixups_fail_closed
mcp_client_oauth::tests::token_values_are_redacted_and_bound_to_issuer_resource
mcp_client_protocol::tests::discovery_requires_valid_version_overlap
mcp_client_protocol::tests::legacy_requires_explicit_initialize_on_fresh_session
mcp_client_protocol::tests::malformed_and_unsolicited_messages_fail_closed
mcp_client_protocol::tests::modern_request_carries_metadata_on_every_call
mcp_client_protocol::tests::recognized_modern_error_never_falls_back
mcp_client_protocol::tests::remote_probe_errors_do_not_trigger_legacy_handshake
mcp_client_sandbox::tests::invalid_config_cannot_form_a_command
mcp_client_sandbox::tests::linux_sandbox_has_no_ambient_home_or_network
mcp_client_sandbox::tests::linux_sandbox_hides_unlisted_host_files
mcp_client_sandbox::tests::unsandboxed_test_fixture_receives_its_script_and_literal_arguments
mcp_client_oauth::lifecycle::tests::refresh_wire_rotation_preservation_invalid_grant_and_cancel
mcp_client_schema::tests::backend_enforces_required_integer_array_and_unknown_arguments
mcp_client_schema::tests::catalog_limit_accepts_128_unique_tools_and_refuses_129
mcp_client_schema::tests::duplicate_paginated_and_oversized_catalogs_are_unavailable
mcp_client_schema::tests::header_only_change_invalidates_backend_schema_revision
mcp_client_schema::tests::arguments_leave_room_for_the_complete_transport_envelope
mcp_client_schema::tests::unsupported_constraints_and_header_collisions_fail_closed
mcp_client_schema::tests::own_server_catalog_including_compatibility_names_can_discover_diagnostics
mcp_client_oauth::lifecycle::tests::discovery_gets_recheck_each_freshness_boundary_and_cancel
mcp_client_transport::tests::freshness_after_probe_prevents_session_launch
mcp_client_transport::tests::cancellation_tears_down_session_without_result_or_restart
mcp_client_transport::tests::legacy_exit_requires_valid_fresh_initialize
mcp_client_transport::tests::modern_probe_uses_disposable_child_and_request_metadata
mcp_client_transport::tests::notifications_before_replies_are_skipped_but_floods_and_requests_fail_closed
mcp_client_dispatch::tests::delayed_modern_probe_keeps_metadata_and_freshness_checks
mcp_client_transport::tests::session_eof_restarts_once_without_replaying_request
mcp_client_transport::tests::stderr_flood_is_drained_and_eof_shutdown_escalates
mcp_client_transport::tests::malformed_session_output_and_partial_eof_fail_closed
mcp_client_transport::tests::session_timeout_is_bounded_and_restart_is_not_a_retry
mcp_client_transport::tests::only_typed_probe_silence_can_reach_legacy_handshake

The separately enabled mcp_client_dispatch::tests::self_mcp_server_round_trip also passed against the freshly built CLI in the process sandbox.

0 replies

axpnet · 2026-10-01T13:55:17Z

axpnet
Oct 1, 2026
Maintainer Author

Scoped read-only AeroAgent workers

Post-4.2.1 follow-up, fixed on main, shipping in v4.2.2 (cumulative PR #999).

AeroAgent can delegate confined local read tasks and up to two explicitly selected saved S3 scopes. Parent and worker usage share a bounded ledger, cancellation survives UI races, and completed worker cards retain bounded observations. Both workers can consume all three tool steps and their final model response before the parent join (10 aggregate requests). Shared ledger cancellation is reflected in every worker terminal event. Per-call file/argument errors return bounded, budgeted tool results so the model can correct them; scope, credential, lifecycle and budget failures remain terminal. Malformed persisted spending fails closed before budget admission. Delegation start and cancellation IPC are restricted to the main window. All twelve worker controls/status strings are translated into 46 non-English locales.

Area	Description	Status	Ref
Scopes	Local paths and distinct S3 profiles are pinned to selected roots; workers read through the bounded shared runner.	🟢 done / fixed (pending release)	#999
Budget and cancellation	Admission validates persisted totals before spending; counters saturate safely, completed usage remains charged, and Stop preserves cancelled/stopping cards.	🟢 done / fixed (pending release)	#999
Observations	Bounded source observations survive worker completion and event truncation.	🟢 done / fixed (pending release)	#999
Focused evidence	CostBudgetManager and delegation-budget tests passed 13/13; native runner/worker tests are included in the cumulative Rust gate. Translation canary merged 552 values across 46 locales with zero warnings.	🟢 done / fixed (pending release)	#999

Prior live evidence from the worker lane: the dev GUI previously exercised a Kimi K3 local fixture, two selected S3 test profiles with distinct result cards, and Stop while both remote children ran. No separate GUI rerun is claimed for the later Stop/card and budget corrections; those have review and automated regression evidence.

Commits in this lane:

Commit	Change
`5513e3f23`	Restore scoped worker groundwork for 4.2.2.
`349f0577a`	Run confined local workers through shared runner.
`180bcb678`	Connect delegated parent and local worker to one ledger.
`99f3bc8ef`	Run two scoped local workers concurrently.
`b26a79c62`	Expose scoped local workers in AeroAgent.
`53f718c16`	Add pinned S3 scopes for read-only workers.
`032b6f86e`	Retain bounded worker source observations.
`c8ff4e982`	Exercise two pinned S3 worker reads end to end.
`905c85246`	Validate distinct remote profiles without borrowed closure.
`03dd7def6`	Show cancelled worker cards after Stop.
`a00dda9f6`	Preserve worker stop state and pinned endpoint.
`56478f495`	Keep completed worker cards after event truncation.
`f7e67b579`	Account for delegated commands and pending translations.
`f636638c0`	Allow expected close during rejected pipeline.
`958f63a59`	Preserve delegation budgets and bounded worker results.
`4452b78d5`	Bound accumulated spending counters.
`e4a393306`	Normalize malformed persisted spending fields.
`2fc6be770`	Validate persisted cost before budget admission.
`263e89ea2`	Merge main to restore worker PR CI.
`31b8f6d9c`	Translate worker controls in every locale.
`79b828dfe`	Consolidate reviewed worker lane into AeroAgent PR.
`e01ea2eb4`	Distinguish workers from workflows in Hungarian and Icelandic.
`6d6f3af8b`	Preserve bounded worker recovery and shared cancellation.
`c9c480a53`	Restrict delegation IPC to the main webview.
`36dd72a00`	Derive the delegation app handle from the guarded webview, preserving the main-window boundary and strict lint compliance.

Verified green: complete local landing checks on 8ad10ddab: fmt, security regressions, eight version sites, frontend 1276 tests/146 files, typecheck, i18n 5436 keys across 47 locales with zero missing/extra/placeholders, strict all-target Clippy, Rust 6158 passed/0 failed/93 configured skips and strict cargo audit. The audit database download initially hit a network error; only the audit was retried successfully. Additional sandboxed self-MCP roundtrip 1/1, exact compiled CLI inventory and seven offline AppImage publication cases passed. Exact-head Actions: all eight workflows succeeded, 23 successful checks and 6 configured skips, including Windows native tests, Linux validation, macOS ARM/Intel and Windows/Linux package builds. Build and native validation, CLI smoke, protocol fixtures. CodeRabbit completed the final review at 2026-10-01T12:51:16Z, with no unresolved findings. Merge f7cbbfb92 preserves the verified tree and all 63 branch commits.

0 replies

axpnet · 2026-10-01T13:55:18Z

axpnet
Oct 1, 2026
Maintainer Author

Amazon Bedrock Runtime provider

Post-4.2.1 follow-up, fixed on main, shipping in v4.2.2 (cumulative PR #999).

Amazon Bedrock is available as an OpenAI-compatible Runtime provider with Region configuration and manual model IDs. Backend endpoint validation requires HTTPS and rejects URL credentials before provider tests, catalogs, nonstream and streaming inference. Exact plaintext loopback is permitted only inside test builds.

Area	Description	Status	Ref
Provider configuration	Region presets, provider icon/catalog and selected model are carried through GUI and CLI request paths.	🟢 done / fixed (pending release)	#999
Credential boundary	HTTPS validation runs before credentialed public entrypoints and native request construction.	🟢 done / fixed (pending release)	#999
Focused evidence	Four Bedrock tests passed: endpoint rejection/acceptance, all public/native entrypoints rejecting plaintext, manual-model/catalog behavior, and a bounded loopback chat-completion wire fixture.	🟢 done / fixed (pending release)	#999
Live scope	No live Amazon Bedrock provider call was performed for this change; deterministic wire validation is the claimed evidence.	🟢 done / fixed (pending release)	#999

Commits in this lane:

Commit	Change
`26b6eab38`	Add Amazon Bedrock Runtime provider.
`35e0c200a`	Reject unsafe Bedrock endpoints before authentication.
`d7041f914`	Consolidate reviewed Bedrock provider into AeroAgent PR.

Verified green: complete local landing checks on 8ad10ddab: fmt, security regressions, eight version sites, frontend 1276 tests/146 files, typecheck, i18n 5436 keys across 47 locales with zero missing/extra/placeholders, strict all-target Clippy, Rust 6158 passed/0 failed/93 configured skips and strict cargo audit. The audit database download initially hit a network error; only the audit was retried successfully. Additional sandboxed self-MCP roundtrip 1/1, exact compiled CLI inventory and seven offline AppImage publication cases passed. Exact-head Actions: all eight workflows succeeded, 23 successful checks and 6 configured skips, including Windows native tests, Linux validation, macOS ARM/Intel and Windows/Linux package builds. Build and native validation, CLI smoke, protocol fixtures. CodeRabbit completed the final review at 2026-10-01T12:51:16Z, with no unresolved findings. Merge f7cbbfb92 preserves the verified tree and all 63 branch commits.

0 replies

axpnet · 2026-10-01T13:55:19Z

axpnet
Oct 1, 2026
Maintainer Author

AppImage update information and matching delta sidecars

Post-4.2.1 follow-up, fixed on main, shipping in v4.2.2 (cumulative PR #999).

Linux AppImages embed update information and ship an adjacent .zsync release asset. The build reads the update information back from the finished artifact and checks the sidecar. A partial-release repair regenerates a missing sidecar from the already-published AppImage bytes, using the downloaded appimage/ directory and replacing the adjacent file.

Area	Description	Status	Ref
Artifact verification	The repackaged AppImage embeds the gh-releases-zsync locator; workflow checks the embedded value and adjacent sidecar before upload.	🟢 done / fixed (pending release)	#999
Partial release repair	Preserves a previously published AppImage and derives its missing .zsync from those exact bytes before signing; the recursive artifact upload retains one adjacent sidecar. API lookup errors and a sidecar-only publication stop the release rather than pairing uncertain bytes.	🟢 done / fixed (pending release)	#999
Focused evidence	Seven offline executions of the workflow repair step passed: no AppImage, fresh release, missing published sidecar, existing published pair, API 503, authentication failure and an orphan published sidecar. The repair fixture verifies published bytes and no duplicate root sidecar.	🟢 done / fixed (pending release)	#999
Deferred validation	A real appimageupdatetool delta update remains a post-v4.2.2-tag check, once a release actually ships the update information and sidecar.	🔵 planned	#999

Commits in this lane:

Commit	Change
`b5a62a804`	Embed AppImage zsync update info and publish the .zsync asset.
`020f7fe61`	Move the .zsync next to the AppImage, pair it with the published asset.
`6790d541f`	Repair the adjacent AppImage update sidecar.
`e9213b2f1`	Consolidate AppImage update lane into AeroAgent PR.
`31ce32d77`	Fail closed on ambiguous AppImage publication states.

Verified green: complete local landing checks on 8ad10ddab: fmt, security regressions, eight version sites, frontend 1276 tests/146 files, typecheck, i18n 5436 keys across 47 locales with zero missing/extra/placeholders, strict all-target Clippy, Rust 6158 passed/0 failed/93 configured skips and strict cargo audit. The audit database download initially hit a network error; only the audit was retried successfully. Additional sandboxed self-MCP roundtrip 1/1, exact compiled CLI inventory and seven offline AppImage publication cases passed. Exact-head Actions: all eight workflows succeeded, 23 successful checks and 6 configured skips, including Windows native tests, Linux validation, macOS ARM/Intel and Windows/Linux package builds. Build and native validation, CLI smoke, protocol fixtures. CodeRabbit completed the final review at 2026-10-01T12:51:16Z, with no unresolved findings. Merge f7cbbfb92 preserves the verified tree and all 63 branch commits.

0 replies

axpnet · 2026-10-01T15:23:36Z

axpnet
Oct 1, 2026
Maintainer Author

DOMPurify patch update for preview sanitization

Post-4.2.1 follow-up, fixed on main, shipping in v4.2.2 (#1002).

DOMPurify is updated from the locked version 3.4.15 to 3.4.16. The manifest and lock file agree. The update retains our SVG-only sanitization profile and HTML highlighting sanitization; upstream repairs include IN_PLACE raw-text/hook handling and CommonJS declarations.

Area	Description	Status	Ref
Dependency	DOMPurify 3.4.16 is locked with its registry integrity; the manifest requests ^3.4.16.	🟢 done / fixed (pending release)	`f6ad8f4ed`
Sanitization	Fourteen assertions exercise ESM and CommonJS imports, preserve harmless highlighted text/SVG shapes, and reject scripts, event handlers, javascript links and foreignObject.	🟢 done / fixed (pending release)	#1002
Validation	npm ci and frontend production build pass. Full local landing gate: fmt, security regressions, version consistency, 1276 frontend tests in 146 files, typecheck, i18n 5436 keys/47 locales complete, strict all-target Clippy, 6158 Rust tests passed/0 failed/93 configured skips and strict cargo audit. Exact-head CI and review availability: all three triggered workflows succeeded, nine checks passed and four were configured skips. Snyk passed. CodeRabbit was requested manually but skipped because the Dependabot author has no assigned review seat; the two-file manifest/lock diff was reviewed directly.	🟢 done / fixed (pending release)	#1002

Verified green: clean npm install (zero reported vulnerabilities), production frontend build, fourteen sanitizer assertions, fmt, security regressions, version consistency, 1276 frontend tests in 146 files, typecheck, i18n 5436 keys/47 locales complete, strict all-target Clippy, 6158 Rust tests passed/0 failed/93 configured skips and strict cargo audit. CI: all three triggered workflows succeeded, nine checks passed and four were configured skips. Snyk passed. CodeRabbit was requested manually but skipped because the Dependabot author has no assigned review seat; the two-file manifest/lock diff was reviewed directly.

Legend: 🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released

0 replies

axpnet · 2026-10-01T20:59:24Z

axpnet
Oct 1, 2026
Maintainer Author

MCP HTTP server settings and backend-owned OAuth authorization

Post-4.2.1 follow-up, done on main, shipping in v4.2.2 (#1003).

AI Settings > MCP now manages remote Streamable HTTP servers next to the local STDIO ones: add, enable, edit and remove a server, save a bearer token, or authorize through OAuth in the browser. The backend owns every secret and the whole authorization: the frontend only ever sees an opaque attempt, the public authorization URL and a redacted outcome. Enabling a server here still grants no tool access; routing tools to AeroAgent is the next slice (#1004).

Area	Description	Status	Ref
Settings commands	Guarded list, upsert, remove and bearer commands, main window only, backend-assigned revisions, server IDs unique across the STDIO and HTTP catalogs, OAuth tokens cleaned in the same transaction on edit, disable and removal.	🟢 done / fixed (pending release)	`ae8726058`
Authorization lifecycle	One shared authorization manager; vault lock, partition lock and user switch cancel every pending and in-flight attempt.	🟢 done / fixed (pending release)	`ae8726058`
Loopback listener	127.0.0.1 only, fixed `/callback`, bounded request head, single-consumption callback. Connections are served concurrently (at most eight), so an idle local peer can neither stall the browser callback nor end the attempt; complete stray requests keep a fixed budget.	🟢 done / fixed (pending release)	`ae8726058`
Settings UI	HTTP server cards with authorize, cancel, refresh and sign-out; a start that resolves after the settings close is cancelled and never waited on; existing MCP strings localized, 76 keys in 47 locales; stripped cs/ro diacritics restored.	🟢 done / fixed (pending release)	`ae8726058`
Test stability	The cloud sync quiet-bound test now runs on a paused clock (it failed on a loaded Windows runner at 1.99 s against a 700 ms wall-clock ceiling); a per-send regression shows as 900 ms.	🟢 done / fixed (pending release)	`ae8726058`

Live test on the dev build (real GUI, driven through the WebKit inspector, English locale):

#	Scenario	Where	Result
1	Add HTTP server `gui-test` at `https://mcp.example.invalid/mcp`, auth none	L1 dev build, AI Settings > MCP	Card "No credentials required", disabled by default
2	Enable, disable, enable	same	Each change saved, card follows the refreshed list
3	Switch to bearer, save a token	same	"Token saved, value hidden"; field cleared; value absent from the whole DOM
4	Switch to OAuth, Authorize	same	Localized "The server could not be reached at a public address." (DNS fails on `.invalid`, no third-party contact)
5	Remove with confirm	same	Confirm names the token or authorization; card removed
6	Add and remove a STDIO server	same	Localized card and secret notice
7	Lock the credential store while on the tab	same	Both lists show "The encrypted settings store is unavailable."; no raw code

Not run live: a user switch from the GUI (covered by partition_lock_and_user_switch_cancel_shared_attempts) and OAuth against a named third-party server (none approved), so the browser consent round trip is proven by fixtures only.

Review: CodeRabbit found two issues on the first head (loopback stalls, late start after unmount), both fixed with regression tests verified red on the old code; two later outside-diff findings were verified against the code and withdrawn.

Verified green: exact-head Actions on Linux, Windows and macOS (14 checks passed, 4 configured skips), Snyk and Socket; local cargo test --lib mcp_client 122 passed/0 failed/1 ignored, strict all-target Clippy, fmt, 1283 frontend tests in 147 files, typecheck, i18n validate/diacritics/untranslated, provider inventory, CLI inventory --check.

Legend: 🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released

0 replies

axpnet · 2026-10-01T22:23:15Z

axpnet
Oct 1, 2026
Maintainer Author

AeroAgent can use the tools of enabled MCP servers

Post-4.2.1 follow-up, done on main, shipping in v4.2.2 (#1004).

MCP servers enabled in AI Settings now offer their tools to AeroAgent. A snapshot grants nothing: every tool call is checked again by the backend and needs its own approval in the separate approval window. Settings show the live health of each server and the tools it offers.

Area	Description	Status	Ref
Live snapshots	Each enabled STDIO and HTTP server of the active user is resolved under its live binding, listed once and closed; health, effective revision and every tool whose schema passes the backend subset, each with its own schema revision. Disabled servers are never started. Bounded: 20 s per server through cancellation (a STDIO server goes through its explicit shutdown), four at a time; a listing is reused only while its binding is unchanged, and a changed schema drops it.	🟢 done / fixed (pending release)	`1478f5296`
Tool calls	Prepare and call go through the private bridge: the backend re-resolves the server, re-lists its tools, refuses a changed binding (`MCP_CONFIG_STALE_REVISION`) or schema (`MCP_TOOL_SCHEMA_CHANGED`) and requires a one-shot approval that can never be remembered for the chat; the chat's Stop cancels a running call. No call is replayed after an auth or version failure.	🟢 done / fixed (pending release)	`1478f5296`
Provenance and trust	Server annotations never reach the registry, every MCP tool stays high risk, the tool description and the approval window name the supplying server and its transport. Unknown request fields (a frontend schema, a danger claim) are rejected.	🟢 done / fixed (pending release)	`1478f5296`
Settings	Live health per server (ready with the tool list, unsupported schemas counted, not started while disabled, localized failure), Check now with a localized alert when it fails; every server change refreshes the chat. 23 strings in 47 locales.	🟢 done / fixed (pending release)	`1478f5296`
OAuth	A finished authorization stays readable for its wait even when another one starts first.	🟢 done / fixed (pending release)	`1478f5296`

Live tests on the dev build (own AeroFTP MCP server, aeroftp-cli mcp over STDIO in the Linux sandbox):

#	Scenario	Where	Result
1	Add the server disabled, then enable it	L1 dev build, AI Settings > MCP	"Not started while disabled", then "Ready, tools available to AeroAgent: 53" and 24 unsupported schemas (77 in total, matching the inventory)
2	Prepare, approve in the separate window, call `aeroftp_mcp_info`	same	Window shows server, transport stdio and tool, "Approves this exact action once"; the call returns the server's real diagnostics
3	Reuse the consumed grant	same	`MCP_APPROVAL_REQUIRED`
4	Call with another schema revision, then another server revision	same	`MCP_TOOL_SCHEMA_CHANGED`, then `MCP_CONFIG_STALE_REVISION`
5	Add a `dangerLevel` field to the request; call without a grant; ask to remember the grant	same	Rejected at deserialization; `MCP_APPROVAL_REQUIRED`; refused by the backend
6	A STDIO server that never answers (`/usr/bin/sleep 120`) next to the own server	same	`MCP_SERVER_TIMEOUT` after 22 s, no process left; the own server stays ready with 53 tools
7	Chat turn with OpenRouter `nvidia/nemotron-3-super-120b-a12b:free`	same	The model found the tool through `tool_search` (provenance `[MCP stdio: aeroftp-self]`, approval high) and asked to run it; Confirm and the approval window appeared. Not completed: the main window reloaded when the approval window closed, a separate pre-existing defect under investigation, so the model-driven call is not claimed

Not run live: any third-party STDIO or HTTP MCP server, and non-Linux process isolation (external servers still fail closed there).

Review: CodeRabbit found five issues (out-of-order snapshot answers, cached schema after a change, invisible check failure, snapshot deadline dropping discovery, OAuth outcome pruned before its wait); all fixed with regression tests verified red on the previous code, threads resolved.

Verified green: exact-head Actions on Linux, Windows and macOS (14 checks passed, 4 configured skips), Snyk and Socket; local cargo test --lib mcp_client 130 passed/0 failed/1 ignored, strict all-target Clippy, fmt, 1291 frontend tests in 148 files, typecheck, i18n validate/diacritics/untranslated, provider inventory, aeroftp-cli inventory --check (880 Tauri commands).

Legend: 🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released

0 replies

axpnet · 2026-10-01T22:23:29Z

axpnet
Oct 1, 2026
Maintainer Author

No more crash at startup when the interface is slow to load, with appmenu-gtk-module

Post-4.2.1 follow-up, fixed on main, shipping in v4.2.2 (#1005).

When the interface took more than 10 seconds to signal that it was ready, the splash safety timeout ran its own copy of the startup and set the application menu while the splash window was still alive. With appmenu-gtk-module loaded (the default GTK_MODULES of a GNOME session on Ubuntu) GTK then recursed until the main thread overflowed its stack and AeroFTP aborted. The normal path waited for the splash to be gone first and was never affected.

Area	Description	Status	Ref
Startup (Linux)	One startup routine for the normal path and for the safety timeout: the splash is torn down and given time to disappear, then the menu, then the window. Whichever path starts first runs it, the other one does nothing, so they can no longer interleave.	🟢 done / fixed (pending release)	`97063dde1`
Root cause	gdb on a live crash: 37,419 frames, `AppHandle::set_menu` from the timeout, then muda's menubar realize, `appmenu-gtk-module` exporting it as a `GMenu`, and unbounded `items-changed` recursion inside GTK 3.24.52.	🟢 done / fixed (pending release)	#1005

#	Scenario	Where	Result
1	Start the dev build without its frontend (forces the timeout), `appmenu-gtk-module` loaded	L1, Ubuntu 26.04, GTK 3.24.52, WebKitGTK 2.52.6	Before: 4 of 4 aborts with "thread 'main' has overflowed its stack". After: 5 of 5 starts finish ("Finishing startup (safety timeout)", menu set, window shown)
2	Same binary with `GTK_MODULES=gail:atk-bridge` (control)	same	Before the fix it stayed up, which isolated the module
3	Frontend mounted after the timeout already finished the startup	same	The late `app_ready` does nothing, the interface comes up with its menu bar

Not run: a release-build reproduction. A release build reaches the same code whenever its interface needs more than 10 seconds to start (first launch, slow disk), so it may have affected users of desktops that load appmenu-gtk-module.

Verified green: exact-head Actions on Linux, Windows and macOS (14 checks passed, 4 configured skips; one Windows job rerun after an unrelated MCP fixture timeout on a loaded runner); CodeRabbit review with no findings; strict all-target Clippy and fmt on the combination with current main, typecheck, i18n, provider inventory, 1272 frontend tests.

Legend: 🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released

0 replies

axpnet · 2026-10-02T04:30:34Z

axpnet
Oct 2, 2026
Maintainer Author

A download test no longer reads a part before its bytes reach the disk

Post-4.2.1 follow-up, fixed on main, shipping in v4.2.2 (#1006).

a_resumable_part_being_written_is_left_alone failed once on main's Linux validation after #1003 landed (left: [], right: "first part", suite at 1330 s on a loaded runner). The test wrote a resumable part through tokio::fs::File, dropped it and read the file at once; tokio hands writes to a blocking thread and a drop without a flush does not wait for them, so the read could come first.

Area	Description	Status	Ref
Tests	The test flushes the part before dropping it. What it checks is unchanged: an atomic download refuses to take a live resumable part, and the part keeps its bytes.	🟢 done / fixed (pending release)	`db3834a01`
Production	Not affected: `commit` flushes and syncs before the rename, and a resume measures the part's real length.	🟢 done / fixed (pending release)	#1006

Not reproduced locally: it is a timing race; the evidence is the failed main run and tokio's documented drop behavior. Every other test in the module reads back only after commit.

Verified green: exact-head Actions (12 checks passed, 6 configured skips), CodeRabbit review with no findings; local cargo test --lib providers::atomic_write 22 passed, strict all-target Clippy, fmt. Main CI on 97063dde1 (with #1003, #1004 and #1005) was green on Linux, Windows and macOS.

Legend: 🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released

0 replies

axpnet · 2026-10-02T10:18:04Z

axpnet
Oct 2, 2026
Maintainer Author

Saving a server that another user account already has now says so

Post-4.2.1 follow-up, fixed on main, shipping in v4.2.2 (#1015).

Multi-user AeroFTP was built to warn when you save a server profile that another user account on the same device already stores. The backend check shipped with the multi-user release, but nothing in the app ever called it, so the warning never appeared.

Area	Description	Status	Ref
GUI	After a save from the connection form (new profile, edit, Save as new, Convert to mode), a warning toast names the other accounts that store the same server account. The save always goes through. A rename or icon change on the same account does not repeat it. Single-user installs see no change.	🟢 done / fixed (pending release)	`5a7efa640`
Activity Log	The same fact is recorded as a `PROFILE_DUPLICATE` entry naming the other accounts, so it is visible with toast notifications turned off.	🟢 done / fixed (pending release)	`5a7efa640`
Docs and i18n	Stale doc comments that described a flow which never called the check are corrected; `docs/MULTI-USER.md` says what the check does. New strings in all 47 locales.	🟢 done / fixed (pending release)	`5a7efa640`

Seven more multi-user backend commands have no caller in the app; they are handled separately in #1016.

Verified green: tsc --noEmit 0, vitest run 149 files and 1296 tests (the new save-path test fails on the unchanged form and passes with the change), i18n:validate 0 missing and 0 untranslated in 47 locales, cargo fmt --check; exact-head Actions all passed on Linux, Windows and macOS, CodeRabbit review with no actionable comments.

Legend: 🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released

0 replies

axpnet · 2026-10-02T10:38:16Z

axpnet
Oct 2, 2026
Maintainer Author

A dev instance on another port now loads its own splash screen

Post-4.2.1 follow-up, fixed on main, shipping in v4.2.2 (#1012).

Development builds only, nothing changes for users of the released app. A dev instance started with a devUrl override on a port other than 5173, which is how two isolated GUIs run side by side, loaded its main window from its own Vite but its splash from the hardcoded http://127.0.0.1:5173/splash.html, i.e. from the other instance's Vite, or a blank page when nothing listened there.

Area	Description	Status	Ref
Dev splash	Under `cfg(dev)` the splash URL is now `splash.html` joined onto `app.config().build.dev_url`, the same base and join Tauri uses for the main window's `WebviewUrl::App`. The 5173 literal remains only as the fallback for a config without `devUrl`. Release branches are untouched.	🟢 done / fixed (pending release)	`13e6dc077`
Recon guard	`tests/portal-chooser/recon-session.sh` greps a binary for that literal to refuse dev builds; keeping it as the fallback keeps the guard true, and a comment on each side names the other. `strings` on the new dev binary still finds it.	🟢 done / fixed (pending release)	`13e6dc077`
Siblings	Zero: the literal occurred once in `src-tauri/src`. The other secondary windows go through `app_page_url`, which in dev already follows `devUrl`.	🟢 done / fixed (pending release)	`13e6dc077`

Verified green: cargo fmt --check, debug build; live run with devUrl 5185 on its own Xvfb and dbus session, where the WebKit inspector lists AeroFTP http://127.0.0.1:5185/splash.html next to the main window and no 5173 target; exact-head Actions all passed on Linux, Windows and macOS, CodeRabbit review with no actionable comments.

Legend: 🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released

0 replies

axpnet · 2026-10-02T11:16:36Z

axpnet
Oct 2, 2026
Maintainer Author

The superseded MCP gate runtime and the test-only dispatch module are gone

Post-4.2.1 follow-up, fixed on main, shipping in v4.2.2 (#1007).

No behavior change for users: the removed code had no caller outside its own tests. Since #1004 every outbound MCP call goes through the schema-bound bridge, so the older approval runtime of mcp_client_gate and the mcp_client_dispatch module only kept a dead_code allowance alive and carried a Windows fixture that flaked on a loaded runner during #1005.

Area	Description	Status	Ref
MCP gate	Removed the prepare, authorize, revalidate-for-dispatch, SQLite store and audit runtime of `mcp_client_gate` (770 to about 170 lines); only `GateRequest`, `GateError` and `validate` remain. Both `dead_code` allowances on the module are gone.	🟢 done / fixed (pending release)	`3aa17d548`
MCP dispatch	Deleted the test-only `mcp_client_dispatch` module and its Windows fixture.	🟢 done / fixed (pending release)	`3aa17d548`
Coverage	Coverage unique to the removed tests moved to the live paths: request validation now targets `GateRequest::validate`, the delayed modern probe moved to the transport tests with a 20 s budget, an absent advertised tool is refused before approval in the bridge tests, and the ignored self-MCP round trip runs through the bridge.	🟢 done / fixed (pending release)	`3aa17d548`

#	Scenario	Where	Result
1	Ignored self-MCP round trip through the bridge (prepare, then execute `aeroftp_mcp_info` over sandboxed STDIO)	own AeroFTP MCP, debug `aeroftp-cli`, read-only	PASSED
2	Same test with `/usr/bin/false` as the server binary (negative control)	local	failed as expected
3	Mutation check: invisible-character check removed, byte limit disabled, probe budget cut to 2 s, absent tool falling back to `echo`	local	exactly the 5 new or changed tests failed (116 passed, 5 failed)

Verified green: cargo test --lib mcp_client_ 121 passed, 0 failed, 1 ignored; cargo fmt --check, strict all-target Clippy exit 0; npm run typecheck, test:unit 1291 passed in 148 files, i18n validate, diacritics and untranslated, provider inventory; exact-head Actions 14 successful and 4 configured skips on Linux, Windows and macOS, CodeRabbit review with no actionable comments. The squash merge carries exactly the verified head's diff (same patch-id).

Legend: 🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released

0 replies

axpnet · 2026-10-02T13:20:24Z

axpnet
Oct 2, 2026
Maintainer Author

Seven multi-user commands that nothing called are removed, and a test keeps new ones from piling up

Post-4.2.1 follow-up, fixed on main, shipping in v4.2.2 (#1016).

No behavior change for users: none of these commands had a caller in the app. A registered command is still IPC surface, though, and one of the seven handed a decrypted per-user credential to the webview as a plain string. Each one was traced through its history and the multi-user design notes, and each had been replaced by a later flow, or added for API completeness and never used.

Area	Description	Status	Ref
Credentials	`user_partitions_get/set/delete_user_credential` removed. Since MUV-3 the backend reads every credential itself and the app writes them through the dual-write `store_credential` / `delete_credential`; these were the only path that reached the per-user credential table by an id the webview chose. The `mcp_*` namespace guard that protected them, and three uncalled CLI helpers from the same batch, go with them.	🟢 done / fixed (pending release)	`756c1fe8b`
Accounts	`user_partitions_get_active_user` and `user_partitions_set_active_user` removed. The app reads the active account from the user list and unlock status, and switches through the passphrase-checked unlock; the separate unchecked switch was a second route to the same state. The CLI `users` switch is unchanged.	🟢 done / fixed (pending release)	`756c1fe8b`
Diagnostics, settings	`user_partitions_debug_state` (a bring-up diagnostic no panel showed; the Repair panel uses `health`) and `user_partitions_list_active_setting_scopes` (no consumer) removed. The two Rust tests that used the listing keep their checks on a test-local query.	🟢 done / fixed (pending release)	`756c1fe8b`
Guard	New `tauriCommandCallers.test.ts`: every registered command needs a caller in the shipped frontend, following one hop through wrappers, so a typed wrapper nothing imports does not count. It reads sources through vite's parser and failed on exactly these seven before the change. 143 commands already in that state are listed as an inherited set that can only shrink; their audit runs separately.	🟢 done / fixed (pending release)	`756c1fe8b`

docs/COMMAND-INVENTORY.json is regenerated: 880 to 873 Tauri commands.

Verified green: tsc --noEmit; vitest run 1304 passed in 150 files; cargo fmt --check; cargo clippy --all-targets -- -D warnings exit 0; cargo test --lib user_partitions:: 88 passed, 1 ignored; cargo test --bin aeroftp-cli inventory 9 passed; a fresh aeroftp-cli inventory byte-identical to the committed file; exact-head Actions 14 successful and 4 configured skips on Linux, Windows and macOS; CodeRabbit with no actionable comments on the final head. Rebased on #1015 and #1012 before the merge, with the guard and inventory rechecked on each new base.

Legend: 🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released

0 replies

axpnet · 2026-10-02T13:44:51Z

axpnet
Oct 2, 2026
Maintainer Author

Export a server from its right-click menu, and filter the list in Import/Export

Post-4.2.1 follow-up, done on main, shipping in v4.2.2 (#1008).

Exporting one server used to take four steps: open Import/Export, choose Export, find the profile in the full list, untick everything else. Now a right-click on the server in My Servers goes straight to the encrypted export with that profile selected, and every server list in the Import/Export dialog can be filtered, so picking "all the axpbuntu servers on Hetzner" is one word away.

Area	Description	Status	Ref
Server context menu	Export... opens the encrypted `.aeroftp` export on the export step with that profile selected and the cursor in the password field; the profile's row is scrolled into view.	🟢 done / fixed (pending release)	`e31af92b3`
Group chip menu	Export group... opens the export with the group's members selected. Members that point to a profile deleted since are left out, and the item is disabled when none remain.	🟢 done / fixed (pending release)	`e31af92b3`
Filter box	Above the three server checklists of the dialog (AeroFTP export, export to another app, import from another app). It matches name, host, protocol, username and provider, case-insensitive, with the same search as the My Servers box; several words narrow together (`axpbuntu webdav`).	🟢 done / fixed (pending release)	`e31af92b3`
Select all	While a filter is active the button reads Select the N shown / Deselect the N shown and acts only on the rows on screen. Selections survive filtering, and the line under the list counts selected servers the filter hides, which stay included.	🟢 done / fixed (pending release)	`e31af92b3`
Default selection	The export selection follows the server list until it is touched, so a list loaded after the dialog opens no longer leaves "select all" computed from an empty list.	🟢 done / fixed (pending release)	`e31af92b3`

Verified green: tsc --noEmit; vitest 1306 tests, with the new serverListFilter suite mutation-checked; i18n:validate, i18n:diacritics, i18n:untranslated at 0 with 7 new keys in all 47 locales; live GUI run on an isolated instance (own Xvfb, dbus session, HOME and ports) driven through the WebKit inspector: profile export preselection, filter, select shown, hidden selection count, group export including stale members, export to FileZilla; exact-head Actions on Linux, Windows and macOS and the CodeRabbit review on the merged head. Not driven: writing the .aeroftp file itself, since the save dialog cannot open without a desktop portal in the isolated session.

Legend: 🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released

0 replies

axpnet · 2026-10-04T16:59:19Z

axpnet
Oct 4, 2026
Maintainer Author

The Linux build pins appimagetool to a versioned release

Fixed on main, shipping in v4.2.2 (#1071, 40df8460c).

On 2026-10-04 every Linux build-and-release job failed with "appimagetool checksum mismatch: possible supply chain compromise". The build downloaded appimagetool from its continuous release, which upstream rebuilds on every commit, and checked it against a fixed checksum. Upstream merged two commits that afternoon and republished the asset at 14:58 UTC. The checksum our job computed was the digest GitHub publishes for that new asset, so it was a legitimate rebuild, not a substituted file.

Area	Description	Status	Ref
appimagetool	Downloaded from the versioned release 1.9.1 and checked against the digest GitHub publishes for its asset. Built from the same upstream source (8c8c91f76) as the binary pinned before; the two new upstream commits are not run. A future replacement of the asset fails the build instead of passing.	🟢 fixed	`40df8460c`
Proof	The pull request's Linux job ran appimagetool 1.9.1, produced the AppImage and its `.zsync`, and verified the embedded update information.	🟢 verified	#1071
Follow-up	The AppImage runtime appimagetool embedded was still downloaded from a rolling release on every build; it is pinned in #1072.	🔵 planned	#1072

Verified green: every CI check on the PR head, including the Linux AppImage build. Reviewed on the head by another session.

0 replies

axpnet · 2026-10-04T20:45:03Z

axpnet
Oct 4, 2026
Maintainer Author

A segmented SFTP download shares one read-ahead budget across its connections

Fixed on main, shipping in v4.2.2 (#1066, 14973d95e).

Every READ in flight holds a chunk-sized buffer until its reply is written out, so a segmented download keeps its read-ahead window in memory once per connection. With nothing asked, each connection took the whole one-connection window: the default four connections kept 4 x 32 READs of 256 KiB in flight for one file.

Area	Description	Status	Ref
Shared default	The default window is now a byte budget for the whole download, twice the one-connection default, shared by its connections: one or two connections keep 32 READs, four keep 16 each, eight keep 8. A window asked for (command line, preset, environment) stays per connection.	🟢 fixed	`14973d95e`
Short replies	A server that sends less per READ than the chunk gets its depth back after the first READ, never past the 32 handles per connection the release opened, so no server gets less depth or more load than before. A server that refuses the extra handles leaves the download with the ones it has.	🟢 fixed	`14973d95e`
Measured	Lab, OpenSSH over a 47 ms link, 300 MiB over four connections, two rounds with the order reversed: 15.4 and 18.0 s at a peak of 115-116 MB, against 21.6 and 16.3 s at 141-148 MB without it. No consistent time cost, 25 to 33 MB less at the peak.	🟢 verified	#1066

Verified green: the 50 providers::sftp tests, each new test seen red under its own mutation, cargo fmt --check, cargo clippy --all-targets -D warnings; full CI on the pull request.

0 replies

axpnet · 2026-10-04T21:04:07Z

axpnet
Oct 4, 2026
Maintainer Author

Flatpak import results that only inform show OK alone

Fixed on main, shipping in v4.2.2 (#1065, 171ef16a1).

After a Flatpak data import that needs no restart, the result dialog offered Cancel next to OK although there was nothing to cancel.

Area	Description	Status	Ref
Import results	A result that only informs shows OK alone; a result that asks for a restart keeps its choice.	🟢 fixed	`171ef16a1`

Verified green: confirmDialog.test.ts (red on the previous component), typecheck; full CI on the pull request.

0 replies

axpnet · 2026-10-04T21:04:08Z

axpnet
Oct 4, 2026
Maintainer Author

AeroImage marks loss once per section, Quick Connect labels get shorter

Fixed on main, shipping in v4.2.2 (#1068, 205e84bb0, requested in #347 by @EhudKirsh).

Area	Description	Status	Ref
AeroImage	Crop, rotate, flip and invert share one section, titled Lossless on PNG and the other formats that keep pixels and Lossy on JPEG and GIF, where saving re-encodes; resize and colour controls stay under Lossy. The word no longer repeats on every control.	🟢 fixed	`205e84bb0`
Quick Connect	The saved name is "Profile name", and the S3 session token and AssumeRole fields share one Optional heading. Four keys nothing read any more are removed from all 47 locales.	🟢 fixed	`205e84bb0`

Verified green: i18n:validate on 47 locales, typecheck; full CI on the pull request.

0 replies

axpnet · 2026-10-04T21:04:10Z

axpnet
Oct 4, 2026
Maintainer Author

Snap gate G4 says UNVERIFIED when snapcraft lint never ran

Fixed on main, shipping in v4.2.2 (#1070, 3668c3835).

Gate G4 checks the built snap for primed GPU libraries with snapcraft lint. When the linter could not run (no network in its environment, for one) the gate still printed OK, so a pass and a skipped check looked the same.

Area	Description	Status	Ref
Lint pass	A lint that did not run prints a warning that the criterion is UNVERIFIED in that run, never OK; GPU findings still fail the gate and library findings still warn. Empty output and timestamped lint lines are read correctly.	🟢 fixed	`3668c3835`
Next	After the 4.2.2 tag, the `build-snap` log shows which of the three lines the gate printed; if it is UNVERIFIED on every run, the lint half of #465 criterion 5 is never checked in CI and the next step is the proposal in the pull request.	🔵 planned	#1070

Verified green: test_snap_gpu_lint_check.py (each case red on the earlier head), ShellCheck 0.11.0 clean; full CI on the pull request.

0 replies

axpnet · 2026-10-04T21:04:12Z

axpnet
Oct 4, 2026
Maintainer Author

The AppImage runtime is pinned and checked by digest

Fixed on main, shipping in v4.2.2 (#1072, d09135f8c).

The runtime appimagetool embeds is the first code that runs when an AppImage starts. Until now appimagetool downloaded it from type2-runtime's rolling continuous release on every build, with no check at all.

Area	Description	Status	Ref
Runtime	Downloaded from the dated release `20251108`, checked against the digest GitHub publishes, and passed to appimagetool with `--runtime-file`. The Linux job fails if appimagetool reports that it fetched a runtime of its own.	🟢 fixed	`d09135f8c`
Known gap	`20251108` predates upstream 8f39b89e2, which creates the extraction folders with mode 0700 instead of 0755 when the AppImage runs extracted; the 4.2.1 AppImage, built on `continuous`, had it. The pin moves to the first dated release that contains it (Requested row 28).	🟡 open	#1072

Verified green: the pull request's Linux job built the AppImage with the pinned runtime and did not download one; full CI on the pull request.

0 replies

axpnet · 2026-10-04T21:04:13Z

axpnet
Oct 4, 2026
Maintainer Author

Table cells follow their headers

Fixed on main, shipping in v4.2.2 (#1073, edff2cce8, requested in #347 by @EhudKirsh).

In the AeroFile file lists the sizes and the - placeholders sat on the right under left-aligned headers. The cause was a stylesheet rule written when the 2nd and 3rd columns were always Size and Modified: it right-aligned those two columns in every table of the app, overriding the alignment each table declared.

Area	Description	Status	Ref
Stylesheet	The positional alignment is removed (and its right-to-left twin); `white-space: nowrap` stays. Every table follows its own classes; the numeric columns already carried `text-right`, so none needed one added.	🟢 fixed	`edff2cce8`
AeroFile trash	Its Size column, header and cells, is aligned to the left like its other columns.	🟢 fixed	`edff2cce8`

Verified green: typecheck, vitest (180 files), security-regression; a pass over the 31 tables of the app sorted every 2nd and 3rd column; full CI on the pull request.

0 replies

axpnet · 2026-10-04T22:24:57Z

axpnet
Oct 4, 2026
Maintainer Author

The main window has rounded corners on Linux

Fixed on main, shipping in v4.2.2 (#1076, 09d1878c7).

The main window is borderless: the app draws its own title bar. Windows 11 rounds such a window itself, but a Linux compositor rounds only the windows it decorates, so on Linux AeroFTP had square corners next to every other window on the desktop.

Area	Description	Status	Ref
Corners	On a composited screen the window is transparent and the page cuts 8px corners, the Windows 11 radius; square again while maximized or fullscreen. Without a compositor nothing changes, since transparent corners would show black.	🟢 fixed	`09d1878c7`
Way out	`AEROFTP_SQUARE_CORNERS=1` keeps the window opaque with square corners, for a graphics driver that cannot draw a transparent window.	🟢 fixed	`09d1878c7`
Seen	Isolated test display with and without a compositor; a real GNOME desktop with accelerated compositing on Wayland and on X11 (the snap's path). Not yet seen: KWin, the proprietary NVIDIA driver, the snap itself, Flatpak and AppImage; the snap is checked live after the tag.	🟡 partly verified	#1076

Verified green: WindowResizeEdges.test.ts (each case red under its mutation), typecheck, fmt, clippy; full CI on the pull request.

0 replies

axpnet · 2026-10-04T22:26:48Z

axpnet
Oct 4, 2026
Maintainer Author

SFTP connections turn off Nagle's algorithm

Fixed on main, shipping in v4.2.2 (#1067, ae1893755).

During a download the client sends only small packets: READ requests and the window adjustments that let the server send more. With Nagle's algorithm on, each waited for the previous one to be acknowledged, and when the server had just run out of credit only its delayed-ACK timer carried that acknowledgement back.

Area	Description	Status	Ref
SFTP connections	Every SFTP connection (the provider's own, pools, range and transfer workers) sets TCP_NODELAY, from one shared SSH client configuration; the rest of the configuration is unchanged.	🟢 fixed	`ae1893755`
Measured	From a station with more bandwidth, one connection, 300 MiB: 32.66 and 35.11 s down to 18.50 and 17.41 s against a paired reference. At four connections no gain is claimed. Uploads: no regression measured.	🟢 verified	#1067

Verified green: the 48 providers::sftp tests (the new one red with nodelay off), cargo fmt --check, cargo clippy --all-targets -D warnings; full CI on the pull request.

0 replies

axpnet · 2026-10-04T22:26:50Z

axpnet
Oct 4, 2026
Maintainer Author

Folders can be renamed on B2 and ImageKit

Fixed on main, shipping in v4.2.2 (#1064, d4f97fdd3).

Renaming a folder failed on both: B2 answered "Path not found" (it has no folders, only names with a common prefix) and ImageKit refused it.

Area	Description	Status	Ref
B2	A folder rename copies every file under the new prefix and deletes the originals only once every copy is made. It refuses a folder moved into itself, never merges two folders, never replaces a file with a folder or the reverse, and if it stops part way it says what is where.	🟢 fixed	`d4f97fdd3`
B2, versioned buckets	A renamed file or folder no longer stays in view under its old name when the bucket keeps older versions: what the delete uncovers is hidden. A file someone else uploads at that name during the rename is newer and stays in view.	🟢 fixed	`d4f97fdd3`
B2, long renames	A token that expires during the rename is renewed at the step where it expired (listing pages, copies, deletes, hides, and the checks made before anything changes), never by running earlier steps again.	🟢 fixed	`d4f97fdd3`
ImageKit	Uses its renameFolder job, and refuses a name the service would rewrite.	🟢 fixed	`d4f97fdd3`

Verified green: 88 B2 tests on API doubles (renewal at every step, versioned buckets, concurrent uploads, each new case red under its own mutation), fmt, clippy; full CI on the pull request.

0 replies

axpnet · 2026-10-04T22:26:51Z

axpnet
Oct 4, 2026
Maintainer Author

AeroSync compares only when asked, and a compare can be stopped

Fixed on main, shipping in v4.2.2 (#1074, 48e111058).

Opening AeroSync started reading both folders and every folder under them at once. On a home folder that is hundreds of thousands of files, with no way to stop the scan, and it kept running after the window closed. The compare also used the transfer cancel flag: it reset it when starting, which could clear a Stop just pressed on a transfer.

Area	Description	Status	Ref
Start	The Compare and Plan tabs show the pair and a Start button; nothing scans until it is pressed.	🟢 fixed	`48e111058`
Stop	A running compare shows its counters and a Stop button. Stop, closing AeroSync, opening it again or starting another compare all stop the scan that is running.	🟢 fixed	`48e111058`
Cancel flag	Each compare has a cancel flag of its own, found by its progress id; transfers are no longer touched. A Stop that reaches the backend before the compare has started is remembered and applied when it starts.	🟢 fixed	`48e111058`

Verified green: compare_cancel tests, CompareScanState.test.ts, useCancelStaleCompare.test.ts, sync_command_audit, i18n on 47 locales, typecheck; full CI on the pull request.

0 replies

axpnet · 2026-10-05T00:37:10Z

axpnet
Oct 5, 2026
Maintainer Author

AeroImage crops anywhere in the image

Fixed on main, shipping in v4.2.2 (#1078, 30b2665c8, reported in #1075 by @EhudKirsh).

The crop selection only reached part of the picture: the bottom of a landscape image, a side of a portrait one, could not be selected. The selection was computed relative to the image but drawn relative to the whole viewer, where the image sits centred with margins, so it was shifted by the margin. It dates from the first AeroImage editor.

Area	Description	Status	Ref
Selection	Drawn in a frame over the image, so it is under the pointer and reaches every edge; it follows the image when the viewer resizes or the image only moves.	🟢 fixed	`30b2665c8`
Start	Starts as the whole image with its eight handles on the edges, as in other image editors; a crop already chosen is where it starts when crop mode is entered again. A whole-image selection adds no crop to the save.	🟢 fixed	`30b2665c8`

Verified green: CropOverlay.test.ts (7 cases, each red under its own mutation), the Preview tests, typecheck; full CI on the pull request.

0 replies

axpnet · 2026-10-05T02:22:49Z

axpnet
Oct 5, 2026
Maintainer Author

Calculating used storage shows its progress and keeps its total

Fixed on main, shipping in v4.2.2 (#1079, a99b807e2, from the follow-up in #958 by @EhudKirsh).

Clicking the storage figure in the status bar starts a scan of the used space. It started by dropping the figure to zero, moved only with a manual total, ended on a total of 0, and showed its running count as "files · bytes", which read as a product or a fraction. On WebDAV each click first waited up to 30 s for a whole-tree listing that the Filen Desktop bridge never answers.

Area	Description	Status	Ref
Display, every protocol	The figure on screen stays until the scan reports one, then updates on every progress report against the manual total or the total on screen, and the scan ends on that total. One chip, with a spinner and Cancel while it runs, labelled "used / total (N files)". A suspect scan (folders listed, no file counted) puts back the figure it replaced.	🟢 fixed	`a99b807e2`
WebDAV	A server that refused `PROPFIND Depth: infinity` (403, 400, 405 or 501) is not asked again until it reconnects; one that sent no answer within 30 s is not asked again for ten minutes; the Filen Desktop bridge is never asked.	🟢 fixed	`a99b807e2`
Folder walk speed	The walk itself becomes parallel in #1080.	🔵 in review	#1080

Verified green: the App quota lifecycle tests on the real closures (kept total during and after the scan, no reset, deferred React updates, suspect scan), the StatusBar chip render tests, the WebDAV refusal tests (statuses, expiry, reconnect, Filen bridge), each red under its mutation; vitest 1635, clippy on the lib and the tests; full CI on the pull request.

0 replies

axpnet · 2026-10-05T04:34:27Z

axpnet
Oct 5, 2026
Maintainer Author

The used-storage scan and WebDAV walks list several folders at once

Fixed on main, shipping in v4.2.2 (#1080, 3c9865f80, from the follow-up in #958 by @EhudKirsh: "increase its speed. It takes multiple minutes now").

The used-storage scan walked one folder after another on every provider, and WebDAV listed one folder at a time on every walk. Both now run on the sync core's walker: up to eight folders at once where the provider lists on independent clones (SFTP, Azure Blob, WebDAV), one at a time under the provider lock elsewhere.

Area	Description	Status	Ref
Used-storage scan	The GUI scan and the CLI `df --scan` and `size` use the shared walker. The figure keeps its meaning: a folder past its listing limit is counted unreadable while its siblings are walked, links are left out, and the cap counts files plus folders. `df --scan` and `size` honour `--checkers`.	🟢 fixed	`3c9865f80`
WebDAV	Lists on the clone pool, so AeroSync Compare, `check`, `sync` and the MCP tools walk a WebDAV tree eight folders at once. A listing answered 429 or 503 is retried after `Retry-After` or a short pause, within 30 s in all, so a server that limits concurrency is not reported unreadable. A sibling clone's Digest nonce rotation is replayed. A single-file profile and an AeroCrypt overlay stay on one session.	🟢 fixed	`3c9865f80`
Measured	Lab WebDAV, 875 folders and 60,800 files: `size` from 42-52 s to 6.5-6.8 s, the Compare walk from 48-60 s to 7 s, with the same figure and rows every run. SFTP, 834 folders: 160-180 s to 23 s. Eight more WebDAV servers gave identical rows and 0 errors.	🟢 verified	#1080
Known	Peak memory of a scan is +26 MB on 60,800 files (the walker keeps each file entry); a walk that keeps only totals is the first follow-up. Digest under a parallel listing and Filen Desktop's bridge were not measured live.	🟡 follow-up	#1080

Verified green: new tests for the parallel listing, the per-folder limit on one session, the 429/503 retry and its 30 s budget, the Digest rotation, and the folder cap on both walks, each red under its mutation; the full local release gate (cargo test 6278, vitest 1644, clippy, audit) on the release tree; full CI on the pull request.

0 replies

axpnet · 2026-10-05T05:54:00Z

axpnet
Oct 5, 2026
Maintainer Author

✅ Released as v4.2.2

AeroFTP v4.2.2 is out: MCP Servers for AeroAgent, Faster SFTP, and Parallel Selections. Every one of the 142 queued rows above shipped. Highlights:

AeroAgent 1.6 uses MCP servers: local servers in a sandbox (Linux for now) and remote ones over HTTP, with every call approved once in the approval window and never remembered for the chat; read-only work can go to up to two scoped workers, and Amazon Bedrock joins the providers.
Faster SFTP: uploads send whole write requests (300 MiB over a 47 ms link from about 20 s to 10.6 s), downloads read each chunk in one request with Nagle's algorithm turned off, and a segmented download shares one memory budget across its connections.
Parallel selections: selecting several files transfers them as one parallel batch on every protocol, and segmented downloads show real progress and stop when asked.
Provider actions in the context menu: S3 storage classes, object tags and Glacier restore, Azure access tiers, Box and Google Drive comments, GitLab links and Filen note tags; folders can be renamed on B2 and ImageKit.
AeroSync shows its work: a run fills the Transfer Queue, saved presets apply in the Plan, and a compare starts only when asked and can be stopped.
Used storage, live and fast: the status bar figure updates while the scan runs and keeps its total, and the scan lists several folders at once (a WebDAV tree of 60,800 files from about 45 s to under 7 s), as every walk of a WebDAV tree now does; an AeroImage crop reaches the whole image.
Security: deleting a file from an AeroVault v2 vault removes its encrypted data, a developer test tool shipped by mistake in the 4.2.1 Windows and macOS installers is gone, more than a hundred backend commands nothing called are removed, and the Linux build pins the AppImage tools it downloads.

Thanks to @EhudKirsh, @roflhouse and @shuvashish76 for the reports and discussion that shaped this release.

The still-open Requested rows carry over to the new tracker: [Tracker] AeroFTP 4.2.3 (#1081). This tracker now closes.

0 replies

[Tracker] AeroFTP 4.2.2 - Known issues, patches & updates #1420

Uh oh!

Uh oh!

axpnet Sep 30, 2026 Maintainer

AeroFTP 4.2.2, Rolling Tracker

What shipped in 4.2.1

Patches & updates queued for 4.2.2

Requested / under consideration

Known issues found after release

Replies: 79 comments

Uh oh!

axpnet Sep 30, 2026 Maintainer Author

The README lists the AM and AppMan install for Linux

Uh oh!

axpnet Oct 1, 2026 Maintainer Author

Private MCP foundation for AeroAgent

Uh oh!

axpnet Oct 1, 2026 Maintainer Author

Scoped read-only AeroAgent workers

Uh oh!

axpnet Oct 1, 2026 Maintainer Author

Amazon Bedrock Runtime provider

Uh oh!

axpnet Oct 1, 2026 Maintainer Author

AppImage update information and matching delta sidecars

Uh oh!

axpnet Oct 1, 2026 Maintainer Author

DOMPurify patch update for preview sanitization

Uh oh!

axpnet Oct 1, 2026 Maintainer Author

MCP HTTP server settings and backend-owned OAuth authorization

Uh oh!

axpnet Oct 1, 2026 Maintainer Author

AeroAgent can use the tools of enabled MCP servers

Uh oh!

axpnet Oct 1, 2026 Maintainer Author

No more crash at startup when the interface is slow to load, with appmenu-gtk-module

Uh oh!

axpnet Oct 2, 2026 Maintainer Author

A download test no longer reads a part before its bytes reach the disk

Uh oh!

axpnet Oct 2, 2026 Maintainer Author

Saving a server that another user account already has now says so

Uh oh!

axpnet Oct 2, 2026 Maintainer Author

A dev instance on another port now loads its own splash screen

Uh oh!

axpnet Oct 2, 2026 Maintainer Author

The superseded MCP gate runtime and the test-only dispatch module are gone

Uh oh!

axpnet Oct 2, 2026 Maintainer Author

Seven multi-user commands that nothing called are removed, and a test keeps new ones from piling up

Uh oh!

axpnet Oct 2, 2026 Maintainer Author

Export a server from its right-click menu, and filter the list in Import/Export

Uh oh!

axpnet Oct 4, 2026 Maintainer Author

The Linux build pins appimagetool to a versioned release

Uh oh!

axpnet Oct 4, 2026 Maintainer Author

A segmented SFTP download shares one read-ahead budget across its connections

Uh oh!

axpnet Oct 4, 2026 Maintainer Author

Flatpak import results that only inform show OK alone

Uh oh!

axpnet Oct 4, 2026 Maintainer Author

AeroImage marks loss once per section, Quick Connect labels get shorter

Uh oh!

axpnet Oct 4, 2026 Maintainer Author

Snap gate G4 says UNVERIFIED when snapcraft lint never ran

Uh oh!

axpnet Oct 4, 2026 Maintainer Author

The AppImage runtime is pinned and checked by digest

Uh oh!

axpnet Oct 4, 2026 Maintainer Author

Table cells follow their headers

Uh oh!

axpnet Oct 4, 2026 Maintainer Author

The main window has rounded corners on Linux

Uh oh!

axpnet
Sep 30, 2026
Maintainer

axpnet
Sep 30, 2026
Maintainer Author

axpnet
Oct 1, 2026
Maintainer Author

axpnet
Oct 1, 2026
Maintainer Author

axpnet
Oct 1, 2026
Maintainer Author

axpnet
Oct 1, 2026
Maintainer Author

axpnet
Oct 1, 2026
Maintainer Author

axpnet
Oct 1, 2026
Maintainer Author

axpnet
Oct 1, 2026
Maintainer Author

axpnet
Oct 1, 2026
Maintainer Author

axpnet
Oct 2, 2026
Maintainer Author

axpnet
Oct 2, 2026
Maintainer Author

axpnet
Oct 2, 2026
Maintainer Author

axpnet
Oct 2, 2026
Maintainer Author

axpnet
Oct 2, 2026
Maintainer Author

axpnet
Oct 2, 2026
Maintainer Author

axpnet
Oct 4, 2026
Maintainer Author

axpnet
Oct 4, 2026
Maintainer Author

axpnet
Oct 4, 2026
Maintainer Author

axpnet
Oct 4, 2026
Maintainer Author

axpnet
Oct 4, 2026
Maintainer Author

axpnet
Oct 4, 2026
Maintainer Author

axpnet
Oct 4, 2026
Maintainer Author

axpnet
Oct 4, 2026
Maintainer Author

axpnet
Oct 4, 2026
Maintainer Author

axpnet
Oct 4, 2026
Maintainer Author

axpnet
Oct 4, 2026
Maintainer Author