[Tracker] AeroFTP 4.2.4 - Known issues, patches & updates

[axpnet]

AeroFTP 4.2.4, Rolling Tracker

Archive of the v4.2.4 release cycle: issues reported against v4.2.3 and changes shipped after its tag.

Released: v4.2.4 (release notes). Ongoing requests and new fixes continue in the 4.2.5 tracker.

Before opening a new issue, please check the lists below. If your problem is already tracked here, just add a thumbs-up reaction or a comment with your environment (OS, version, provider) instead of filing a duplicate. We update this issue as bugs are found and fixed.

Found something that is not listed? Open a new issue and we will link it here.

What shipped in 4.2.3

See the v4.2.3 tracker (#1081) and the release notes for the full change set, 86 tracked changes. A repair release: an operation that checks before writing writes only when the server confirmed the item is not there, a WebDAV replace keeps the old file until the new one is in place, crypt init writes nothing before the Emergency Kit is handed over, and a large download resumes the range it was reading instead of starting over; around that, SITE commands for FTP and FTPS, a local folder wherever the CLI takes a URL, a transfer speed that shows the current speed, and AeroAgent 1.7.

Patches & updates released in 4.2.4

Released in v4.2.4.

#	Type	Change	Status	Commit	Ref
1		Decrypted Overlays Path names in the breadcrumb: an encrypted anchor now has a readable label while navigation, path editing and overlay detection keep the server path, preserving the v4.2.3 fix.	✅	a5647b815	#1077
2		Saved SITE command templates: an FTP or FTPS profile can keep a command with holes, fill text, number and secret values, and run it from the CLI, the TUI palette and the SITE dialog. A secret is never stored, a value with whitespace is refused, and importing the glFTPd catalog leaves a name already saved.	✅	51fbf3b33	#1109
3		AeroImage save formats and confirmation: edited and cropped pictures save as PNG, JPG/JPEG, WebP, BMP, TIFF and GIF through exclusive per-save staging; a centered confirmation lasts 1.5 seconds and matching local panels refresh to show the output.	✅	3b8647805	#1075
4		Tray menu, Proton disclaimer, controller bar, and account counts: the Linux tray shows theme icons and Sync Now, Pause Sync, and Open Cloud Folder follow whether AeroCloud is on, including after it is switched. Proton Drive uses the standard independent-project line under the Quick Connect card, AI Settings model groups collapse, the controller toast is a bar above the status bar, and the account chooser shows each account's profile count.	✅	725cfab84	#1210
5		Windows file association opt-out: setup and Settings provide independent choices for AeroFTP formats and archive/Explorer integration; NSIS /NOASSOC and MSI feature maintenance preserve disabled choices, retain required binaries and shared registrations, and leave other programs' entries and protected defaults intact.	✅	57b5dd2ef	#454, #1209
6		Crypt overlay profiles with an empty Remote Path connect at the remote root again: the connect no longer opens inside the Overlays Path; the root listing shows first and the encrypted folder decrypts on entry, as on any other connection. Details.	✅	a3ca73398	#1211
7		Swift folder listings no longer stop on a short page: the client keeps asking for the next page until the server returns an empty one, including HTTP 204, so a cap below the 10000 limit (Ceph RGW answers at most 1000) no longer hides the rest of the folder. A page that does not move past the marker is an error. The command inventory also records file_associations_set_integration. Details.	✅	36743a620	#964, #1213
8		CLI explains S3 and HTTP parallel-download fallbacks: ordinary commands report why S3 or the shared WebDAV/Koofr Range path used one stream, through bounded provider warnings on stderr at command completion; JSON diagnostics remain structured, progress is preserved and new reasons omit paths, signed URLs and raw server errors. First scoped follow-up to Requested item 13.	✅	7d314d1d1	#1212
9		Dependency patch bundle: react-window 2.3.4, tokio-util 0.7.20 and zstd 0.14.2 with compatible native support libraries; shared lock resolution, React peers, existing Tauri pins and all six patch orders were verified together.	✅	bff261dbb	#1214
10		rustls security patch: update the shared TLS dependency from 0.23.45 to 0.23.46 to resolve four newly published RustSec advisories and restore the strict dependency audit; only the resolved version and checksum change, preserving the other 1208 packages and existing audit policy.	✅	fadb06593	#1218
11		CLI download fallback notices complete: FTP/SFTP/B2, the shared segmented executor and pget explain declined parallel attempts through safe stderr and structured JSON warnings, including quiet mode; fallback destination, progress and cancellation stay accurate. Completes Requested item 13 together with #1212.	✅	0b5220053	#1216
12		Crash staging cleanup: GUI and CLI startup reclaim recognized scratch leftovers older than 24 hours, including download partials; native file and process leases preserve active staging and open remote vaults, while failed writes, reads and cancelled crypt operations clean up promptly.	✅	60528f99e	#1217
13		Windows local folder shares refuse NTFS stream names: reads and mutations through local folder URLs and aeroftp-cli serve reject colon-containing file components before filesystem access, keeping hidden alternate streams private while ordinary Unix colon filenames remain usable. Completes Requested item 42.	✅	b040e062b	#1220
14		Interrupted batch multipart uploads clean up their remote parts: a file-scoped guard retains the original upload handle through completion and abort, so destroying a DAG task also schedules cleanup when its explicit abort was still in flight; successful uploads disarm the guard and single-file durable resume checkpoints keep their existing lifecycle. Completes Requested item 10.	✅	0f673e5e7	#1219
15		RAR5 hardlinks use the archive's extracted file: hardlinks and file-copy references resolve only to an earlier regular member inside the private extraction root, including Unicode paths and selected entries from the archive browser; a missing or unsafe target leaves an existing output untouched. Staging publication also explicitly releases its file lock despite inherited descriptors. Completes Requested item 19.	✅	4cd0da4ba	#1222
16		FTP batches wait for a real session before they take a transfer slot. Details.	✅	2aee19631	#1221
17		Deferred provider live acceptance complete: real FTPS post-data 552, OneDrive stale-ID deletion, Box/kDrive ambiguous-name purge refusal, Twake retry progress and Proton leading-dash share passwords are verified; Proton CLI 0.9.0 sharing responses are supported and parse diagnostics keep policy secrets private. Completes Requested item 24.	✅	282b33646	#1226
18		GUI Mirror kept-folder behavior verified live: local and FTP runs preserve excluded, hidden and unfinished children with every ancestor and the visible reason; ordinary removals and versioned backup still complete. A repeatable isolated GUI check and acceptance report close Requested item 23.	✅	42955fc4f	#1225
19		Internal cleanup, no user-visible change: 53 unused imports, locals and parameters removed from App.tsx, each traced in history first, none a lost call. Details.	✅	f398480da	#1227
20		Quick Look in the right local panel previews the file selected there. Details.	✅	207988178	#1228
21		A resumed download goes on only from a part of the same file version: a file replaced since the interruption is downloaded again instead of joined to its old start. Details.	✅	46c10eb28	#1224
22		Internal cleanup, no user-visible change: the orphaned Logo component, the three logo images only it loaded, and five LocalFilePanel props the panel never read are removed, each traced in history first. Details.	✅	7a6ed28d0	#1229
23		The Vault Sync dialog follows the theme again: opaque panel and table header, theme borders and hover highlight in every theme. Details.	✅	85591a2e7	#1230
24		AeroCloud is set up from saved profiles only: pick the profile in a searchable list and the folder to sync under it, and saved profiles that could not connect through AeroCloud (S3, B2, Azure, kDrive, OAuth providers and more) now do. Details.	✅	cf132f49d	#1231
25		ZIP support moved to zip 9 after upstream yanked the whole 8.x line, which had turned the dependency audit red on every branch. Details.	✅	fc2ccaf59	#1236
26		ImageKit folders are listed with their own path again, so deleting, searching or comparing a folder stays inside it instead of reaching the account root, where a recursive delete removed root files and never ended. Details.	✅	8599d4b21	#1232
27		Internal cleanup, no user-visible change: portal chooser tests take the setting and a lazy probe directly, removing process-wide environment writes and the module mutex while preserving the chooser decision. Details.	✅	aa9a959e8	#1237
28		Internal guard, no user-visible change: a unit test fails on any color variable that no stylesheet defines, the defect that took the theme out of the Vault Sync dialog and the AeroCloud panel. Details.	✅	6f921760f	#1233
29		The MCP server of a debug build answers again instead of aborting on its first tools/list: request futures are boxed and each tool table entry is built in its own frame, so every request fits a worker's stack. Details.	✅	26d484e5d	#1241
30		The Linux window stays opaque with square corners when WebKit composites in software, which left a transparent window blank or vanishing (seen on the Flatpak); the log says which corners were chosen and why. Details.	✅	64b286031	#1240
31		The startup GPU check asks EGL about the display GTK really opens (Wayland first), so the Flatpak on a Wayland desktop keeps GPU compositing instead of falling back to software. Details.	✅	d2d0f61fe	#1242
32		AeroFile trash and Properties times show the right local time instead of shifting by the UTC offset: backend instants now say they are UTC. Details.	✅	3c455a013	#1238
33		Markdown tables in the .md viewer and AeroAgent chat keep the alignment their columns declare. Details.	✅	cb716b77f	#1235
34		Icons alone in a centered table cell are centered (Dependencies Status, provider trash and B2 hidden-version checkboxes), and a test scans every component for the pattern. Details.	✅	c27aeff88	#1239
35		A first run on another config folder no longer overwrites the keyring key of an existing vault: a new vault takes the default keyring account only when it is empty, otherwise an account of its own recorded in vault.key, and claims run under a lock shared by all processes. Completes Requested item 53. Details.	✅	57474ebe7	#1234
36		The Linux window stays opaque with square corners also when WebKit renders in software because the app turns its DMA-BUF renderer off, which left only the repainting parts of the window visible on KDE Plasma. Details.	✅	a4eab6d41	#1254, #1249
37		Dependency patch bundle: vitest 5.0.4, react-virtuoso 4.18.19, postcss 8.5.30, sevenz-rust2 0.24.0, dompurify 3.4.17 and serde_json 1.0.154 land in one change that supersedes six Dependabot pull requests. Details.	✅	958b1d1c6	#1253
38		The AppImage recognises itself and its in-app update replaces the AppImage file; before, it reported itself as deb, installed the .deb through pkexec and stayed old. Details.	✅	88e32e6dc	#1250, #1256
39		SFTP downloads keep less in memory at the same speed, and two transfer defects are fixed: the read-ahead reads on a channel of its own (peak memory down 15 to 37 %), Ctrl-C no longer leaves a download-sized temporary, and servers that limit new connections no longer fail a 16-connection download. Details.	✅	8bdf2db57	#1252
40		While connected, the app reads the live session's connection instead of the connection form a saved-profile connect resets; the Debug Panel showed SFTP and dashes for a WebDAV session, and the same empty form reached provider capabilities, keep-alive, the terminal and the status bar. Details.	✅	05fd69485	#1251
41		A refused SSH host key is reported as one: a key that changed since it was saved names the known_hosts line and the command that removes it, exits 6 and is not retried; before, the CLI said "check hostname/port", exit 1, and retried. Details.	✅	65bb454cf	#1259
42		The AppImage update finds the AppImage also behind a symlinked TMPDIR and replaces it in one atomic rename, so a stopped update never leaves the launch path empty and a link planted at the staging name receives nothing. Details.	✅	97af8c28d	#1256, #1250
43		Recursive walks stay inside the folder they walk: a listing that names a folder inside itself, as /, above or outside the root, or an entry twice no longer sends a delete, scan, copy, size, search or cleanup there (ImageKit's rm -r deleted files in the account root, Swift's dedupe the only copy). Details.	✅	59b105fe3	#1255, #1232
44		SFTP downloads share one 64 MiB read-ahead budget across every download in the process: eight parallel downloads to a slow destination peak about 31 % lower, at the same speed. Details.	✅	f78267094	#1260
45		One SFTP connection on a delayed path is no longer held back by the SSH channel window: 128 MiB over a 50 ms path in 4.1 s instead of 7.9 s, ahead of rclone at 5.3 to 5.5 s. Details.	✅	6bc46e3e5	#1261
46		AeroSync journals describe recovery rather than completed-run history: unfinished journals say incomplete, while Local mirror separates planned dry-run copies from files actually copied and keeps the result tied to the executed request. Completes Requested item 57. Details.	✅	9c5591ceb	#1257
47		The snap starts again on a desktop: it plugs network-status, so the desktop portal answers the proxy lookup for the interface at http://127.0.0.1 instead of refusing it (snaps 4.2.1 to 4.2.3 showed an error page), and a new CI gate fails a snap the portal would refuse. Details.	✅	4df7a9549	#1262, #946
48		Linux users can explicitly opt into the DMA-BUF renderer: GUI startup and the dispatcher preserve WEBKIT_DISABLE_DMABUF_RENDERER=0 and other explicit values; an absent variable retains compatibility default 1. Ships step 1 of Requested56 with an isolated rendering lab; the default-policy decision remains open.	✅	853003d44	#1258
49		In the snap the volumes section says how to show the volumes instead of staying empty: the snap plugs mount-observe, which snapd does not connect on its own, and until sudo snap connect aeroftp:mount-observe the sidebar shows that command. Details.	✅	b53b289c7	#1263
50		Release gates that read a tool's output fail when they cannot read it: the snap GPU, GUI and glibc gates and the AppImage permission check passed a changed or failed tool output as clean, and now refuse it, pinned by tests that run the real scripts. Details.	✅	75a515478	#1265
51		CI: the two checkout deadline tests from #1221 no longer fail when the runner stalls the test process: they measure on tokio's paused clock, and they now also catch a deadline or stop that is honoured late. Details.	✅	78e9ba2cf	#1270
52		CI: the AppStream metadata gate reads the report of appstreamcli 1.1 (Ubuntu 26.04) as well as 1.0, instead of failing every pull request once the runner moves to it, and still refuses any report it cannot read. Details.	✅	766357500	#1264
53		Files with a long name download again: every temporary's name (.aerotmp, .aerosegtmp, ...) now fits within 255 bytes, so a 244-byte name no longer fails with "File name too long" on every attempt. Details.	✅	3e8e73798	#1267
54		Vault Error Correction labels read correctly in every language (most locales glued an uninflected feature name to a verb), lost diacritics are back in 21 locales, Serbian is all Cyrillic, and the vault Scrub and Repair tooltips are no longer half English. Details.	✅	66b92a21e	#1268
55		Five more checks that read a tool's output fail when they cannot read it: the snap stale-package audit, the release zsync pairing, the DCO check, the AeroRsync emitter guard and the GUI dev driver took a changed or failed output as success, and now refuse it, pinned by tests that run the real scripts. Details.	✅	08e72bbfd	#1266
56		CLI: RUST_LOG is read per target, so warn,<provider>=debug gives that provider DEBUG and keeps hyper, russh and rpgp at WARN, while the held crates (suppaftp, which writes the FTP password at TRACE) stay at their ceiling whatever the directive asks. Details.	✅	12e201557	#1271
57		MCP: an OAuth connect, sign-in, refresh or catalog edit no longer makes another write to the same passphrase-protected account wait 5 s and fail with "database is locked": every MCP transaction now takes the account's session before SQLite's write reservation, the order every other partition writer uses. Details.	✅	60dd9752e	#1274
58		CI: the TUI discard test no longer fails in the full CLI suite: tests that end a download claim and claim it again at once now unlock it before the close, since a process another test spawns keeps the lock until it execs, and the keyring lock guard unlocks when dropped. Details.	✅	db1c9fd22	#1279
59		Exports write each profile with its own password: two profiles of one name no longer both go out with the second one's, and in 8 formats the second gets a -2 name instead of landing on the first. Details.	✅	04f3c9bd7	#1276
60		The vault repair dialog says what a dry run found (it read "Dry-run: Successfully repaired 3 chunk(s). (no changes written)" with the English glued on), no longer calls a header or manifest rebuilt from parity "no damage", and a nameless portable device is no longer named in English. Details.	✅	eb3ab9db2	#1273
61		CI: the dependency audit on main is green again: RUSTSEC-2026-0370/0371/0372 mark zvariant, zbus_names and zvariant_derive unmaintained (folded into zbus 6), no crate we depend on uses zbus 6 yet, so the three are accepted in audit.toml with their paths and exit path. Details.	✅	4c3d1ba46	#1282
62		CLI: --machine and --format json reach import, export, keystore, profile-export and profile-import: forty subcommands read only a --json of their own, so under --machine some exited printing nothing and the rest printed text. Details.	✅	0743baa6a	#1275
63		AeroCloud: a local change now syncs only the paths that changed, with no rescan of the remote folder; a provider can declare a minimum interval between full scans, and KeepBoth no longer sets aside a conflict copy every cycle. Details.	✅	a284abab3	#1283
64		CI: the session-order test from #1274 no longer fails at random on Windows: an older test cleared the process-wide user session without the lock the session tests share, and now holds it; clearing or setting the session in a test without that lock fails every time instead of now and then. Details.	✅	2016c21c2	#1285
65		AeroAgent 2.0 roadmap reconciled with what shipped: docs/AEROAGENT-ROADMAP.md marks the MCP client, workers, GUI control and MCP parity of AeroAgent 1.6 and 1.7 as delivered, with their limits, and lists the 13 lanes left for 2.0 with acceptance criteria. AeroAgent stays 1.7. Details.	✅	048a9034f	#1288
66		WinSCP export and import keep non-ASCII session names: the export writes them as WinSCP does (UTF-8 BOM plus UTF-8, then PuTTY's escape), so €uro no longer comes back as ACuro, and the import strips the BOM WinSCP writes before every non-ASCII name. Details.	✅	e49a1aeab	#1278
67		The Google OAuth note gives the complete redirect URI: a Web application client registers the exact callback shown (port and /callback included), a Desktop app client registers nothing; shown for Drive and Photos in all 47 languages, where it ended in redirect_uri_mismatch before. Details.	✅	f5a890b46	#1287
68		CI: linux-validate has 150 minutes instead of 90, the time a run without a Rust cache needs: with the cache entry of main evicted, every pull request and main itself compiled cold and were cancelled at the limit with no code at fault. Details.	✅	4eb7ae45e	#1292
69		PuTTY export writes sessions PuTTY can open: each key is the one PuTTY itself writes for the name (its escape over the Windows code page), so a name with a space no longer loads with no host, and names the code page merges get a session each. Details.	✅	ee5c7ad32	#1277
70		CI: timing tests pin what they protect instead of a runner's speed: the sync graph build test, red at 57 ms against 50 ms on Windows, now requires a linear builder, and 13 sibling tests use tokio's paused clock, exact time windows or bounds read from the code. Details.	✅	5daece427	#1289
71		CLI integration tests run in a vault of their own on every platform: on Windows they opened the real debug vault (the dirs crate ignores APPDATA there); every launch now uses a portable hard-linked CLI in the test's own folder, and portable mode no longer sweeps the installed user's scratch. Details.	✅	054d7837e	#1291
72		AeroCloud: a new file at the path of one deleted on both sides is synced, not deleted: a full sync whose two scans were complete forgets the record of paths missing from both, except the paths the scans leave out on purpose. Details.	✅	458b66b6e	#1286
73		CLI: export --profiles selects a profile the way --profile does (index, name in any case, id, or a unique substring) instead of the exact, case-sensitive name only, and every selector that selects nothing is listed with the skipped profiles and the reason; a name two profiles share selects neither. Details.	✅	33bb142ff	#1272
74		English that many screens wrote straight into JSX is now translated in every language (the AeroAgent coding approval cards, the duplicate finder, GitHub, settings, sync and vault strings among them), and the guard test catches English rendered from a JSX literal or beside a translation. Details.	✅	8113e519e	#1280
75		Downloads let go of their claim on the temporary as soon as they are dropped, not only once a process another thread spawned has started, and a failed or cancelled segmented download removes its temporary while it still holds it, so a second download of the same file can no longer lose its own temporary. Details.	✅	b7aba3e4e	#1284
76		Profiles: no two saved profiles share a name; a profile imported, created, duplicated, renamed or restored onto a taken name (case-insensitive, as --profile selects) is stored with the first free " (1)", " (2)", ..., and every list, import report and confirmation shows the name as stored. Details.	✅	848bdc461	#1269
77		Live download tests look for every writer's temporary (.aerotmp, .aeroardtmp, .aerosegtmp, a part's record) instead of .aerotmp alone, which let a segmented run's leftover pass 14 checks in 4 files; a directory that cannot be read now fails the check. Details.	✅	235e1421e	#1294
78		Proton Drive CLI mode no longer opens a browser tab per failed file on a full drive, and a failed transfer names the item and its reason: uploads and downloads run the official CLI with -j and read its JSON summary, so a full drive is a quota error that is never retried. Details.	✅	2587cd73c	#1298
79		AeroAgent's Linux troubleshooting no longer says AeroFTP runs on XWayland or to set the DMA-BUF variable by hand; it names AEROFTP_SQUARE_CORNERS=1 (with its Flatpak override) and =0 for the GPU renderer. Details.	✅	fb5bfc707	#1300, #1249
80		The speed limit holds on segmented downloads, every serve mode and mount: ranges are paid before they are read, served files stream in paid windows instead of whole in memory (no 500 MiB cap, HTTP Range 206), serve ftp resumes with REST and APPE keeps the file, and the servers survive hang-ups and SIGTERM and no longer print a secret the user set. Details.	✅	46b51aadf	#1295
81		Proton Drive gains a native client, on by default in the build: browser sign-in, vault sessions, verified transfers, revisions, file operations, quota and configuration-bridge import/export; existing profiles retain CLI mode until changed. Details.	✅	0b938eae0	#1293
82		Proton native transfers use one request for small files and revisions, overlap large-file upload/download blocks, prefetch revision pages and read independent connection data concurrently. Details.	✅	3a4255f8c	#1302
83		Proton CLI mode transfers literal glob characters in local paths and finds downloads under the sanitized name written by the official CLI, then restores the requested name. Details.	✅	1a69f058d	#1303
84		Proton profiles can be created and signed in from the CLI: persist native/CLI mode, provide native sign-in/sign-out/status, dispatch the commands correctly, and reject sign-in responses after cancellation or expiry. Details.	✅	1e8fa666e	#1296
85		GUI startup omits D-Bus handshake chatter while keeping warnings, and deleting an absent credential leaves the vault file untouched. Details.	✅	3352e42cd	#1301
86		Agent listings derive readiness from the saved profile's actual sign-in source: anonymous/key/device profiles stay usable, native Proton checks its saved session, and externally managed CLI sessions remain unknown rather than falsely unsigned-in; safe MCP records preserve the classification. Details.	✅	0e369e491	#1299
87		New connection profiles share one manifest across GUI, CLI and MCP: canonical aliases, preset defaults and saved options stay consistent, existing FTP/Proton modes survive loading, and explicit Proton CLI/native choices retain their options and quota. Details.	✅	a0d250849	#1304
88		Saved profiles can be authorized headlessly through CLI and MCP: share encrypted profile-bound OAuth/GitHub flows, consume supported credential wrappers, reject unused seeds before persistence, and renew expired GitHub App sessions while retaining manifest and auth-source behavior. Details.	✅	25575ce40	#1305
89		Dependency maintenance bundle: update jsdom 30.1.3, Vitest 5.0.5, Tokio 1.53.3, rustls-native-certs 0.8.5, arboard 3.7.0 and zip 9.0.4 together, plus PostCSS 8.5.31, with compatible lock resolution and the existing advisory policy preserved.	✅	86b7c97e0	#1314
90		Proton native-client documentation and catalog: describe the native client already enabled in default builds alongside the official CLI option; align bridge/provider guides, workflow/vendor comments and the paired source/generated provider catalog without changing release features.	✅	188443522	#1315
91		CLI cross-profile copies reuse saved OAuth sessions and crypt overlays: shared profile resolution preserves encrypted paths, cancellation between parent creation, transfer accounting and per-file failures; incomplete scans and missing uploaded destinations fail explicitly.	✅	ba97f97be	#1306
92		Profile ownership and transfer publication are guarded: connection actions and Proton results retain their original account, cross-user relocation preserves durable credentials under session locks, and archive extraction, resumed downloads and Windows temporary files retain destination boundaries; AppStream, watcher coverage and all 47 locales are repaired.	✅	7c5d4327e	#1313
93		Saved cross-profile authentication retains its owner: GUI and agent copies reuse OAuth sessions and crypt overlays; profiles, options and every overlay secret/config/cache remain bound to the account captured before remote work. Proven legacy fallback and GUI secret re-entry preserve access safely.	✅	f12d36510	#1316
94		Repeated cross-profile copies skip unchanged destinations: equal-size files use the one-way timestamp rule, with size fallback for unavailable or incomparable times and source precision retained from planning.	✅	f12d36510	#1316
95		Recursive removal dispatches files correctly: rm-r of a file uses the file verb, symlinks are unlinked, and remote-root plus guarded-directory refusal remain effective.	✅	f12d36510	#1316
96		Empty directories survive cross-profile copies: CLI, GUI and agent plans retain roots and empty descendants, directory setup is guarded, and cancellation or partial batches report their actual outcome.	✅	f12d36510	#1316
97		Existing SFTP ancestors no longer abort uploads on generic mkdir failures: any failed mkdir requires successful stat proof of an existing directory; files, missing paths and inconclusive probes retain the original failure.	✅	f12d36510	#1316
98		Proton CLI bulk transfers: optional provider hooks and bounded shared batches serve CLI, GUI and compatible sync, preserving per-file results, cancellation and verified downloads. Existing resume/delta/checksum/crypt constraints retain their paths; MEGAcmd/Filen and wider performance work remain in Requested 71.	✅	e890fa672	#1317
99		Pre-tag commit audit: PASS; 4.2.4 prepared. Archived cycle reviews, focused fixes and bounded integration counterreviews passed; completed local gate reused, final PR CI green, eight version sites and AppStream validated. Exact final-main cross-platform CI is required before tagging; Requested 71 remains open.	✅	1b5a9014a	#1316, #1317

Requested / under consideration

Community requests and internal follow-ups being evaluated for this or a later release. Rows carried over from #1421 with their numbers.

#		Type	Item	Status	Ref
1	🟧		Eager-evaluation preview and a single-vs-multi-target placeholder for the -i selectors (prioritised by the reporter ahead of Edit(E) and the 2-letter semantics; exact behaviour to be pinned)	🔵 idea	#311 (@EhudKirsh)
2	🟥		Lossless .jpg to .jxl transcode in AeroFile: JXL re-encodes an existing JPEG losslessly and reversibly (the original JPEG bytes reconstruct exactly), for a real size win with no quality loss. Candidate framing: AeroFile as a GUI for libjxl	🔵 idea	aerovault#2 (@EhudKirsh)
3	🟥		macOS shell integration for the OS extract feature (Deliverable G macOS, deferred): Finder Sync "Extract Here / Extract to Folder" menu items mirroring the Linux Nautilus and Windows verbs, plus macOS custom document-type icons (CFBundleDocumentTypes) for the five aero formats and the generic fallback, and rebuilding the mimetype .icns multi-size (the v4.1.0 ones are single-resolution drafts). Needs a Mac to build and live-test	🔵 planned	#1408 (Deliverable G)
4	🟥		Filen Encrypted Notes: exit Beta: take Filen Notes out of Beta. Fix the participants/add contactUUID format (currently a best-effort workaround), investigate the Filen free-plan 10-note limit ghost-note cleanup, and add a rich text editor for the rich note type	🔵 planned	-
5	🟥		PRIORITY: Linux tray/GTK heap corruption, still-uncovered off-main-thread corruptor. A GDBus worker aborts with malloc(): unaligned fastbin chunk detected, the classic GLib heap-corruption signature, and it is the victim rather than the corruptor. Two marshalling fixes shipped in v4.0.5 and the SIGABRT still recurs with an identical signature, so the marshalling is incomplete and the remaining suspects are the event and plugin callbacks whose thread context is unconfirmed. Details.	🔵 planned	-
6	🟥		Recommended-protocol highlight on the Add Service / Quick Connect pages, after real benchmarks land (#368)	🔵 idea	#274 (@EhudKirsh)
8	🟧		S3 recursive delete pays one extra HEAD per directory, because it lists with the trailing-slash prefix, which by construction cannot see the same-named key, so a separate probe is unavoidable given that listing. Listing with the slashless prefix would skip the probe entirely in the common case, where no same-named object exists, at the cost of a filter that must keep exactly path and path/.... The trap is the one #764 just closed, moved by one character: a sibling like reportsX also matches the shorter prefix. Whoever takes this must write both doors before the change, not after: reportsX survives a delete of reports, and reports survives when it is a real non-empty file. Worth doing when someone measures a slow recursive delete on a tree with many folders, not before. 4.2.1 context: #979 changed folder-removal semantics (a folder is removed only once empty, sync --delete removes the directories it emptied on every backend) but did not touch this listing or its probe; still open.	🔵 idea	#764
11	🟧		An HTTP 412 still does not distinguish a backend refusing If-Match from a source replacement. CLI fallback notices now ship in #1212 and #1216, so the missing fallback explanation from the original report is resolved. Backend diagnosis remains open: the client still cannot tell an incompatible gateway from an object that really changed.	🔵 planned	#885
12	🟧		A replacement that is slow and still in progress can pass the reading that decides whether to publish. That reading retries once; if the server is still writing the new version, the second reading can see an intermediate state. Neither the unit test nor the live reproduction covers it, because both replace in one write.	🔵 planned	#885
15	🟨		The same question has not been asked of parallel uploads. Azure, Box, Drime and Dropbox assemble parts read from the local file concurrently; whether a local file changing under them produces the mixture the download path had is an open question, not a finding.	🔵 planned	-
18	🟧		Flatpak vault migration after the GUI has initialized its sandbox vault: the current import deliberately skips a sandbox that already has any vault file, so that migration still needs its scope defined. Import into a vault-free sandbox, atomic copying of all three vault files, rollback, and JSON vault.db handling already shipped in #987, with a passing JSON-import regression test rechecked during the 4.2.3 triage.	🔵 planned	#961, #987
20	🟨		aerovault crate: zstd length handling. Deferred edge found while shipping the AeroCompress already-compressed skip.	🔵 planned	#925
21	🟨		Azure hierarchical-namespace folders: live test the directory-blob removal and HNS reporting against a real HNS account.	🔵 planned	#964
25	🟨		Line-ending follow-ups after the .gitattributes: drop the hand CRLF normalisations in the tray badge and checksum matrix tests once existing Windows development clones are refreshed, and move LICENSE to the LF rule only if the NSIS license page is shown to render LF text correctly on Windows.	🔵 planned	#1051
26	🟨		MCP client presets v1.1: Fetch and Git servers fetched at install time (the remote DeepWiki preset shipped in #1038): download pinned release artifacts when the user installs the preset, checked by SHA-256, gated by target OS and architecture and by the Python ABI, instead of embedding third-party archives in the app. Parked until after v4.2.2 for a design review of the supply-chain path.	🔵 planned	#1038
27	🟧		AppImage runtime with 0700 extraction folders: rechecked 2026-10-15: no dated type2-runtime release contains upstream 8f39b89e2 (only continuous does). Keep runtime 20251108 and its digest until a qualifying dated release exists; extracted runs still create folders 0755.	🔵 planned / upstream blocked	#1072, #1104
34	🟨		One speed and benchmark engine for GUI, CLI and MCP: today there are four (GUI speed test, CLI speed, speed-compare and benchmark; MCP runs the CLI). The GUI speed test covers only FTP, FTPS, SFTP, S3 and WebDAV, integrity check and score exist only in the GUI, and labels and defaults differ between them.	🔵 idea	#368
36	🟨		Live checks still owed on 4.2.2 changes: rounded window corners under the snap's X11 session, KWin, the NVIDIA driver, Flatpak and AppImage (fallback AEROFTP_SQUARE_CORNERS); Compare against a Digest WebDAV server; Stop, F4 and a disconnect during a Compare scan in the GUI; the tables whose columns moved left; ImageKit renameFolder on the real API. Progress 2026-10-16: ImageKit rename, Digest Compare, Stop/F4/disconnect and the tables verified live; corners verified on the AppImage, the Flatpak's vanishing window fixed (queued rows 30, 31), the KWin one from #1249 fixed by queued row 36 (not run on KWin itself), snap checked 2026-10-17 on GNOME (rounded corners, window fully visible) after fixing why it did not start (known issue 1); merged PR #1258 preserves explicit WEBKIT_DISABLE_DMABUF_RENDERER=0, which restores rounded corners on the measured AMD/Intel native Wayland systems while the absent-variable default remains 1; broader NVIDIA, KWin and X11 corner checks remain open; the defects found on the way are queued rows 32 to 34, and the Debug Panel one is queued row 40.	🟡 investigating	#1076, #1080, #1074, #1073, #1064, #1262
41	🟧		Tailwind CSS 4 migration: adopt its dedicated Vite or PostCSS plugin, migrate configuration and utilities, verify the main/extract/approval windows and define supported WebView versions. Separate task requested by the owner; v4 needs Safari 16.4+, while the macOS manifest currently declares 10.13.	🔵 planned	-
45	🟨		In-place resume is not tied to a file version. --inplace --partial goes on from the destination itself, which keeps no record of the version it was started from, so a file replaced in the meantime can still be joined to its old start (FTP and Koofr resume there by offset). Out-of-place resume is bound to the version since #1224.	🔵 planned	#1224
46	🟧		A silent HTTP server can hold a CLI command for up to 30 minutes. HTTP providers keep a 1800 s read timeout and no per-request limit; #1164 fixed the error wording and classification, not the wait. Still to do: measure metadata calls on Nextcloud and bound them, give the OAuth 1 sign-in client a timeout, add a global CLI --timeout.	🔵 planned	#1164
47	🟥		Some providers still report an error as "not there", or a missing item as an error. #1192 writes only on a confirmed NotFound and fixed four providers; an audit of 41 found more in the providers themselves (Box, Filen, MEGA exists, FTP dotfiles, MTP, B2, ImageKit, Jottacloud and others), plus WebDAV 404/401, S3 403, Koofr and OpenDrive 400 to decide case by case.	🔵 planned	#1192
49	🟧		Khmer translation: about 3800 strings not yet read. #1194 read and corrected the most damaged families (connection, protocol, Cryptomator, settings, common, the 500 most anomalous strings); the last block read was still about 10% broken, so the rest needs a full read.	🔵 planned	#1194
51	🟧		WebDAV Digest: parallel requests fail on a server that enforces nonce-count order. Parallel connections share one Digest challenge and their nonce counts arrive out of order; Apache with AuthDigestNcCheck On (not its default) refuses some: a Compare walk misses 56-70 of 331 folders, get/put --parallel 8 fail 27-36 requests, always reported (rc 4). Serial runs are clean.	🔵 planned	#1080
54	🟧		Recursive walks: what the walk-guard PR leaves open (read in code, not yet run). With a root the provider spells its own way, get -r, the CLI sync doctor and AeroAgent reconcile/sync_doctor cover the whole tree but build wrong local names. Partial results still read as complete: the cross-profile copy skips an unlistable folder with a log line only, the Properties folder size stops at its caps without saying so, tree --json answers ok with an empty tree when the root cannot be listed. Path guards still missing: B2 rm -r / empties the bucket (S3 refuses the root), GitLab joins an absolute path to the current folder and reads / as the current folder, the FUSE mount gives a child the inode of the path its listing names, and an AeroAgent upload of a local folder follows symlinks (a link to an ancestor never ends).	🔵 planned	#1255
55	🟧		Compare and sync scans of a provider list files only, so a folder present on both sides shows as only on one side. Seen live: a WebDAV tree of 330 folders against an identical local copy gave 330 differences and 100% out of sync. Read in code, not run: a mirror remote to local removes an empty folder the source has, an empty remote-only folder is never created locally, and local to remote plans one needless mkdir per folder. FTP/SFTP compare_directories and the S3 fast path to check the same way.	🔵 planned	-
56	🟨		Linux DMA-BUF renderer: explicit override and default policy. Step 1 merged in PR #1258 (853003d44, queued row 48): GUI startup and dispatcher preserve explicit values; absent still defaults to 1. WebKitGTK 2.52.6 native Wayland comparisons on AMD Radeon 890M and Intel UHD630 pass Monaco/xterm, eight canvas modes and six shaders ON/OFF; ON improves page cadence and restores rounded corners after unmaximizing. OFF WebGL still records GPU activity. The owner retains the compatibility default; a different default and broader driver/backend coverage, including NVIDIA, remain under consideration.	🟡 investigating	#1258, #1254, #1249
58	🟨		Connecting a second saved profile from the servers screen leaves the previous session active while it connects, so the in-session readers that follow the active session (#1251) show the old connection for that moment. Deselecting it when the connect starts changes how Cancel behaves, which needs a decision.	🔵 planned	#1251
60	🟨		The Windows portable update can leave no exe at the launch path if its helper script is stopped mid-swap. The script moves the running exe to .old, then moves the new exe from %TEMP% into place (from another volume that move is a copy, not a rename). Same class as the AppImage swap fixed in #1256: stage the new exe next to the old one, then replace it in one rename, retried until the old process has exited. Needs a run on a Windows station.	🔵 planned	#1256
61	🟨		CI: linux-validate can hit its 90-minute limit while cargo test is still compiling and linking. On 2026-10-16 it was cancelled twice (#1255, #1256), 84 minutes into cargo test with rustc and rust-lld still running; both reruns passed, and the green runs that day took 38 to 87 minutes. To measure: the link's memory on the runner, then whether line-tables-only debug info for tests or fewer parallel links keeps it well under the limit.	🔵 planned	-
62	🟨		SFTP downloads against Windows SFTP servers: the read-ahead on its own channel (#1252), the shared read-ahead budget (#1260) and the 8 MiB channel window (#1261) are verified on seven Linux SFTP servers in Docker, on the NAS and from the GUI, not yet on Cerberus, Bitvise and Win32-OpenSSH. Verification against those Windows servers remains pending. Optional: a check of #1261 on a real long fat WAN path. Follows Requested 37 (SFTP download follow-ups), closed by #1252, #1260 and #1261.	🔵 planned	#1252, #1260, #1261
64	🟨		In the snap the unmounted partitions never appear, and eject and mount cannot work: lsblk cannot run inside the snap (measured in 4.2.3: Permission denied; snapd grants it through hardware-observe, read in its AppArmor snippets, not tried), and eject and mount call udisksctl, which would also need the udisks2 interface (read in code, not measured). Neither interface connects automatically. To decide: plug them, or read the same data another way, and say in the app why the list is empty. Found with #1263.	🔵 planned	#1263
71	🟧		Investigate remaining wrapper and local-gateway transfer performance: profile MEGAcmd and Filen Desktop S3/WebDAV, plus residual Proton CLI upload overhead, using release builds, matched credentials, concurrency, retry policy and cache state. Separate vault/process startup, metadata, connection reuse and transfer-engine scheduling from wire I/O; distinguish local acknowledgement from independently verified cloud completion. Evaluate batching only with owned-transfer cancellation, per-file terminal outcomes, partial-failure handling and safe file-level recovery. Proton CLI bulk in #1317 does not complete this wider investigation; no cross-provider parity claim is made.	🔵 planned	#1317

Known issues found after release

Reported against v4.2.3.

#	Area	Description	Status	Ref
1	Snap	The snap shows an error instead of the app on a desktop with xdg-desktop-portal (snaps 4.2.1 to 4.2.3): the portal refuses the proxy lookup for the interface at http://127.0.0.1 because the snap does not plug network-status. Workaround: GIO_USE_PROXY_RESOLVER=dummy snap run aeroftp. Details.	✅ released in v4.2.4 (row 47)	#1262, #946

Legend: 🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released

[axpnet]

Readable encrypted overlay anchors in the path bar

Post-4.2.3 follow-up, fixed on main, shipping in v4.2.4 (#1077, reported by @EhudKirsh).

Ehud confirmed the v4.2.3 navigation fix and noticed that the Overlays Path itself now appeared encrypted in the path bar. The breadcrumb now shows its decrypted folder name through a separate display label, while its navigation target stays the path present on the server.

Area	Description	Status	Ref
Path bar	Readable anchor names in visible segments, collapsed ancestors and subdirectory menus.	🟢 fixed	a5647b815
Navigation	Segment clicks, menu destinations, editable paths, scope detection and entry paths retain the canonical server anchor.	🟢 preserved	#1203
Overlay state	Labels belong to the committed listing and appear only for its unlocked overlay in scope. Crypt off and plain sessions show the actual names.	🟢 verified	a5647b815
Reporter confirmation	The original issue remains open with fixed | tbc for confirmation on v4.2.4.	🟢 fixed, awaiting release/test	#1077

Verification	Result	Status
Full local integration gate	npm run ci:pre-push: 6684 Rust tests passed, 95 ignored; 2277 frontend tests passed; all-targets clippy with warnings denied, formatting, typecheck, i18n validation, security regressions, version consistency and cargo audit.	🟢 passed
Focused regressions	98 overlay tests and seven breadcrumb interaction tests, including ciphertext anchors, nested paths, rclone name modes, AeroCrypt, raw providers, menus, editing and sync boundaries.	🟢 passed
Native Linux DEV GUI	Local read-only WebDAV fixture, standard rclone crypt, encrypted anchor and empty password2: canonical-path receipts, anchor click, nested folder double-clicks with spaces and accents, Crypt off/on and a fresh plain profile.	🟢 passed
PR CI	Linux validation and packaging, Windows build and native unit tests, macOS Apple Silicon and Intel builds, DCO and security checks.	🟢 passed
Review	CodeRabbit completed review on f8deb9a17 without actionable findings. The merged tree is identical to the checked PR head.	🟢 complete

Verified green: full local npm run ci:pre-push and every applicable PR check before merge. Live GUI coverage here is the Linux WebDAV fixture; no Windows or real Koofr runtime test was performed in this session.

A separate direct crypt-to-plain profile switch timed out in the fixture and required Stop/disconnect. The decrypted anchor label was correctly hidden during that transition, and a fresh plain connection passed. That session-transition case is recorded in the PR for follow-up and is not claimed as fixed by this patch.

[axpnet]

Saved SITE command templates

Post-4.2.3 follow-up, on main, shipping in v4.2.4 (#1109, requested by @jnewing).

An FTP or FTPS profile can save a SITE command with holes and run it from the CLI, the TUI palette and the SITE dialog. A secret is a hole: it is not stored, it is not written to history, and the echoed line masks it. Importing the glFTPd catalog leaves a name that is already saved.

Area	Description	Status	Ref
Templates	{name}, {name:number} and {name:secret} on the saved profile, shared by site --template, :site @name and the SITE dialog.	🟢 shipped	51fbf3b33
Secrets	A secret is never written to the profile, the history or the echoed line. --set on a secret slot exits 5 and sends nothing. A literal password in site-template add is refused.	🟢 shipped	#1205
Arguments	A slot value that contains whitespace is refused before the line is built, so a space cannot shift a later secret into the wrong argument.	🟢 shipped	51fbf3b33
Profile save	Import, save and remove write the template list read inside the profile save queue.	🟢 shipped	51fbf3b33
Dialog	The SITE dialog uses the same dark surfaces as the other modals, including truedark, tokyo, cyber, green and redhorse.	🟢 shipped	#1205

Verification	Result	Status
CLI, isolated vault, scripted FTP	site --template who sent SITE WHO once (200-who / lab / 200 end). The secret run echoed SITE CHPASS alice ••••••, put the secret on the wire once, and left it out of stdout and stderr. A second catalog import skipped names already saved, ignoring ASCII case.	🟢 passed
GUI, DEV window, same plain FTP profile	SITE WHO and SITE CHPASS alice •••••• (200 password changed). The secret field was cleared. The secret was absent from the dialog and from the saved template. Dialog background matched the other modals on the six themes above.	🟢 passed
Local gates before the pull request	cargo fmt, inventory check, typecheck, i18n validate, diacritics and untranslated, provider inventory, npm run test:unit (2277 vitest tests plus the controller script tests).	🟢 passed
Follow-up, without a local Rust compile	rustfmt on the template file, typecheck, 19 profile-store tests, former-English ledger rebuilt. The Rust slot was left to another session.	🟢 passed
Pull request CI	All 25 checks on 44991a193, including linux-validate, format and unit tests, Windows native tests, Linux, Windows and macOS builds, and CLI smoke on the three platforms.	🟢 passed
Review	CodeRabbit verified both follow-up findings on 44991a193 and resolved both threads.	🟢 complete

The TUI palette is covered by its unit tests. A live TUI session was not driven.

Verified green: the checks above, then squash-merged to main as 51fbf3b33.

[axpnet]

AeroImage: Save Copy and Replace Original in every format

Post-4.2.3 follow-up, fixed on main, shipping in v4.2.4 (#1075, reported by @EhudKirsh).

Saving an edited or cropped picture as PNG, WebP, BMP, TIFF or GIF failed because the encoder tried to infer the format from the staging file's .tmp extension. JPEG already used an explicit encoder. The save now uses the destination format and gives each call its own exclusively created staging file.

Area	Description	Status	Ref
Image formats	Save Copy and Replace Original encode PNG, JPG/JPEG, WebP, BMP, TIFF and GIF using the final file's format.	🟢 fixed	3b8647805
Overlapping saves	JPEG and other encoders write through each save's owned file handle, with an explicit buffer flush before atomic publication. Saves in the same folder cannot share or truncate one another's staging file.	🟢 fixed	#1204
Failure cleanup	Failed or abandoned saves remove only their own temporary file, preserving the source, destination and another pending save.	🟢 verified	3b8647805
Save confirmation	A successful native save shows a centered, non-interactive confirmation for 1.5 seconds; pending or failed saves do not show success.	🟢 fixed	3b8647805
Local file panels	Panels displaying the output directory refresh immediately, so the saved image is listed when the preview closes.	🟢 fixed	3b8647805
Reporter confirmation	The original issue remains open with fixed | tbc for confirmation on v4.2.4.	🟢 fixed, awaiting release/test	#1075

Verification	Result	Status
Focused Rust tests	Seven image-pipeline tests passed, including 14 format/save-mode cases, overlapping JPEG/PNG/WebP stages published in reverse order and forced publication failure.	🟢 passed
Save-feedback regressions	Four UI tests cover pending and failed native saves, callback delivery, repeated-save timing and gallery changes. TypeScript and all 29 focused viewer/history tests passed.	🟢 passed
Linux DEV manual test	The maintainer confirmed crop/save tests in all six formats GREEN in the native Linux DEV GUI.	🟢 passed
Full local integration gate	npm run ci:pre-push completed with exit 0: 6687 Rust tests passed, 95 ignored; all-target Clippy with warnings denied, formatting, security regressions, version consistency, typecheck, i18n validation and cargo audit. Final frontend suite: 2281 tests plus 11 GUI-controller tests passed.	🟢 passed
PR CI	Final-head Linux validation and packaging, Windows build and native tests, macOS Apple Silicon and Intel builds, DCO and security checks all passed.	🟢 passed
Review	CodeRabbit confirmed the staging fix and completed review of final head 030f846b2 with no actionable merge risk identified.	🟢 complete

Verified green: full local npm run ci:pre-push and every applicable PR check before merge. The merge preserves the checked PR changes and the already merged SITE-template feature.

[axpnet]

Tray icons, AeroCloud rows, Proton note, controller bar, account counts

Post-4.2.3 follow-up, fixed on main, shipping in v4.2.4 (#1210).

The Linux tray menu shows a theme icon on the right of each row. Sync Now, Pause Sync, and Open Cloud Folder stay disabled while AeroCloud is off and become enabled again when it is switched on, on the same main-thread path as the tray badge. Proton Drive uses the standard independent-project line under the Quick Connect card. AI Settings model groups collapse. The controller toast is a bar above the status bar. The account chooser shows each account's profile count once the stats load.

Area	Description	Status	Ref
Tray menu	Theme icons sit on the right. Sync Now, Pause Sync, and Open Cloud Folder follow whether AeroCloud is on, including after it is switched, without rebuilding the menu. Pausing sync leaves those rows enabled.	🟢 fixed	725cfab84
Proton Drive	The extra unofficial disclaimer is gone. The standard independent-project line sits under the Quick Connect card.	🟢 fixed	#1210
AI Settings	The Models tab uses its own tab style, provider groups collapse, and each tab names its panel.	🟢 fixed	725cfab84
Controller	The centered toast is a bar above the status bar: an amber agent label, speed presets, and Pause beside Stop.	🟢 fixed	725cfab84
Accounts	The chooser shows each account's saved profile count after the stats load. A failed read leaves the line off.	🟢 fixed	725cfab84

Verification	Result	Status
Local tier 1	cargo fmt, typecheck, i18n validate (5725 keys, 46/46, 0 NEEDS TRANSLATION), diacritics, untranslated, provider inventory, and the unit suite (244 files, 2283 tests) plus 11 GUI-controller tests.	🟢 passed
Focused tests	Three tray-menu tests, seven AI Settings panel tests, and the stale-English ledger in strict mode (0).	🟢 passed
Linux DEV	The owner confirmed the tray icons, the grey AeroCloud rows when it is off, the rows lighting when a test AeroCloud is turned on, the controller bar, the Models tab, the Proton line, and the profile counts.	🟢 passed
PR CI	Every applicable check passed on 7bda3da24 before the squash, including Linux validation (Clippy with warnings denied), Windows native tests, and the Linux, Windows, and macOS release builds. Squash commit on main: 725cfab84.	🟢 passed
Review	CodeRabbit completed its review of the final PR head with no remaining actionable comments.	🟢 complete

Verified green: local tier 1 and every applicable PR check before merge.

[axpnet]

Windows setup and Settings: optional file associations

Post-4.2.3 follow-up, fixed on main, shipping in v4.2.4 (#454, #1209, reported by @pasha-zzz).

Windows users can now choose AeroFTP's five formats separately from the eight archive formats and Explorer extraction menus, during setup or in Settings > File Handling. Settings changes apply immediately. The opt-out carried in Requested item 7 is implemented and moves to the queued changes.

Area	Description	Status	Ref
NSIS	Visible setup choices and /NOASSOC; per-user choices survive reinstall and update.	🟢 fixed	57b5dd2ef
MSI	Two optional features publish disabled states as ABSENT, so Settings can re-enable them immediately. GUI/CLI remain mandatory; the shared icon/open command stays while either feature is installed.	🟢 fixed	57b5dd2ef
Maintenance	Windows Installer receives the real directory with value-only quoting; a saved HKCU path cannot override the explicit installed path.	🟢 fixed	57b5dd2ef
Registry policy	Additive registration, historical ProgID continuity, foreign data preservation, protected UserChoice unchanged and per-user rollback on failure.	🟢 verified	57b5dd2ef
Reporter follow-up	#454 stays open through publication, then reporter confirmation or a response period if no reply arrives. The opt-out is not in the published v4.2.3.	🟢 implemented, pending release	#454

Verification	Result	Status
Full local main-merge gate	npm run ci:pre-push exited 0 on 92073214c: 6705 Rust tests passed, 95 ignored; 2298 frontend tests plus 11 GUI-controller script tests passed; all-target Clippy with warnings denied, formatting, security regressions, version consistency, TypeScript, 46/46 translated locales and cargo audit passed.	🟢 passed
PR CI	Every applicable final-head check on 92073214c passed, including Linux validation, Windows native tests and packaged-MSI regression, and Linux/Windows/macOS builds.	🟢 passed
Windows 11	Native NSIS/MSI builds and ICE without errors (four qualified upstream warnings), fresh NOASSOC, actual Settings cycle, full common/group catalog, a path with spaces and stale HKCU path, disabled reinstall, normal/silent uninstall and HKLM foreign fixture preservation. UserChoice unchanged at 26 locations.	🟢 passed
Explorer	The owner confirmed menu ON/OFF behavior in a restarted Windows session and supplied classic-menu screenshots. Earlier stale presentation has no proven cause; no universal reboot requirement is claimed.	🟢 owner-assisted acceptance
Native evidence scope	Task 1314 tested cd111d0f9; installer/association product sources are identical on final head 92073214c. Elevation cancellation, another-user maintenance and disabled-feature migration between versions sharing the new IDs remain untested.	🟡 limits recorded
Review	CodeRabbit's latest review generated no actionable comments.	🟢 complete

Verified green: full local npm run ci:pre-push and every applicable PR check before the merge to main as 57b5dd2ef. No release was performed by this task.

[axpnet]

Crypt overlay: an empty Remote Path lands at the root, not inside the Overlays Path

Post-4.2.3 follow-up, fixed on main, shipping in v4.2.4 (#1211, reported by @EhudKirsh).

A saved profile with a crypt overlay binding and an empty Remote Path connected straight into the Overlays Path: the phase-2 auto-unlock effect passed an initial landing only for a non-empty initialPath, so the legacy re-anchor-into-scope ran instead. An empty Remote Path means the on-wire root, so the landing is now passed whenever the overlay scope is non-empty, with the empty case mapped to /. A whole-remote overlay keeps the legacy re-anchor, unchanged.

Area	Description	Status	Ref
Crypt overlay connect	Empty Remote Path lands on / through the existing initial-landing branch of smartReanchorOverlay; a configured Remote Path and whole-remote overlays behave as before	🟢 fixed	a3ca73398

Live verification on a local FTP fixture (pyftpdlib), with a profile built exactly as in the report: empty Remote Path, AeroCrypt binding on /Vault with header:

#	Scenario	Where	Result
1	Connect with the fix reverted	Dev GUI on the fixture profile	Landed on /Vault with 0 entries (the reported bug, reproduced)
2	Connect with the fix	Same profile	Landed on / with the root listing, overlay badge engaged
3	Enter /Vault, upload a file	Same session	Decrypted name in the panel; encrypted name and AECR header on the wire

A new wiring test (src/utils/cryptConnectLanding.wiring.test.ts) executes the production landing decision sliced from App.tsx: red on the old gate, green on the new one.

Verified green: repo pre-push gate (cargo fmt, clippy -D warnings, full cargo test, cargo audit), typecheck, 2304 vitest unit tests, i18n 46/46 locales, PR #1215 CI on Linux, Windows and macOS (x64 + aarch64), CodeRabbit clean on the final head.

[axpnet]

Swift listings follow a short page until the folder is empty

Post-4.2.3 follow-up, fixed on main, shipping in v4.2.4 (#964, #1213).

SwiftProvider::list treated a page shorter than the 10000 limit as the last page, so a server that caps a listing lower (Ceph RGW answers at most 1000) hid the rest of the folder. Listing now follows the marker until a page comes back empty, including an HTTP 204 with no body. A page whose last name does not move past the marker is an error, so a server that ignores the marker cannot loop. Requested row 22 moves to the queued changes.

The same squash records file_associations_set_integration in docs/COMMAND-INVENTORY.json. The Windows association change had registered that command without regenerating the snapshot, and the Linux smoke inventory check was comparing 783 live Tauri commands with a snapshot of 782.

Area	Description	Status	Ref
Swift list	Pages until an empty body or HTTP 204. Names at or before the marker are skipped. A page that does not advance is a server error.	🟢 fixed	36743a620
Command inventory	file_associations_set_integration is in the Tauri command snapshot (783).	🟢 fixed	36743a620

Verification	Result	Status
Fixture	list_follows_a_short_page_until_the_listing_is_empty (page cap 3, the next page overlaps the marker, the empty tail is HTTP 204) and list_stops_when_a_page_does_not_advance_past_its_marker	🟢
Swift lib tests	35 passed, 1 ignored (the live Blomp keystone test needs credentials)	🟢
Live Blomp	A probe prefix was uploaded and listed with the new CLI. The container index flipped between empty and a partial listing, and the omitted names were scattered, still present on HEAD. The new CLI did not error or loop and returned the same counts as the installed CLI. That run does not prove a short server page.	recorded
PR CI	linux-validate green on the rerun (clippy and Rust tests, 51m43s) after the first attempt was cancelled at the 90-minute job limit during compile; smoke on Ubuntu, macOS and Windows; format, audit and unit tests; Windows cross-OS unit tests; Linux, Windows and macOS builds. CodeRabbit full review finished with no review threads.	🟢

[axpnet]

CLI explains S3 and HTTP parallel-download fallbacks

Post-4.2.3 follow-up, fixed on main, shipping in v4.2.4 (#1212, first scoped follow-up to Requested item 13).

An ordinary CLI command receives the reason when S3 or the shared WebDAV/Koofr HTTP path refuses parallel ranges. The existing bounded provider-warning channel renders it on stderr at command completion, including a structured warning in JSON mode. It follows the existing warning policy under quiet mode. New reasons contain no signed URLs, remote paths, header contents or raw provider errors.

Area	Description	Status	Ref
S3	Explain refused HEAD probes, missing strong ETag, advertised lack of ranges and inability to confirm one object version.	🟢 fixed	7d314d1d1
Shared HTTP	Explain ignored/refused Range probes, incoherent Content-Range, unknown total and mid-flight range/version refusal.	🟢 fixed	#1212
Progress and data	Keep the fallback callback; the S3 replacement fixture publishes a complete, byte-identical object. Planned below-cutoff use stays silent.	🟢 verified	7d314d1d1
Remaining scope	FTP/SFTP/B2-specific fallbacks and shared segmented-executor notices remain in Requested item 13.	🔵 planned	#1422

Verified green: focused formatting/diff checks, 58 shared-range tests and 147 S3 tests passed (4 S3 tests ignored), and every applicable final-head PR CI check on 0ee25e583, including Linux validation, Windows native tests, all four platform builds and CLI smoke on Linux, Windows and macOS. CodeRabbit review completed without actionable findings. The merged integration with #1214 has exactly the inspected local tree.

[axpnet]

Dependency patch bundle

Post-4.2.3 follow-up, on main, shipping in v4.2.4 (#1214, replacing #1206, #1207 and #1208).

React-window updates to 2.3.4, tokio-util to 0.7.20 and zstd to 0.14.2. Zstd-safe moves to 8.1.0 and zstd-sys to 2.1.1 with native zstd 1.5.7. The two wrapper branches share one native package, React peers are satisfied and the existing Tauri pins are preserved.

Area	Description	Status	Ref
Frontend	Fresh installation, satisfied React peers, typecheck, production build, 2298 unit tests and 11 controller tests passed. Production npm audit reported zero vulnerabilities.	🟢 verified	bff261dbb
Rust	Locked graph resolution, compatible MSRVs, formatting and 86 fresh compression/cancellation/Zstd fixtures passed.	🟢 verified	bff261dbb
Conflicts	All six dependency-patch orders give the same tree; simulated merges with the observed heads of #1212 and #1213 were clean. Final merged main matches the inspected integration exactly.	🟢 verified	#1214
Consolidation	The three original Dependabot PRs are closed and replaced by this bundle.	🟢 complete	#1206, #1207, #1208

Verified green: focused local checks above and every applicable final-head PR CI check on ce510044d, including Linux validation, Windows native tests, all four platform builds, standalone crate compilation on Linux/Windows/macOS, and the rsync protocol fixtures. The requested CodeRabbit full review completed without actionable findings.

[axpnet]

rustls security patch restores the dependency audit

Post-4.2.3 follow-up, fixed on main, shipping in v4.2.4 (#1218).

Four RustSec advisories published on 2026-10-14 made the strict audit fail on the previously resolved rustls 0.23.45. The shared TLS dependency now resolves to the patched 0.23.46, with the existing audit policy preserved.

Area	Description	Status	Ref
TLS dependency	rustls 0.23.46 fixes RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348 and RUSTSEC-2026-0349.	🟢 fixed	fadb06593
Locked graph	Only the rustls version and checksum change; the other 1208 packages and all dependency edges remain identical. Upstream MSRV, feature definitions and runtime requirements are unchanged.	🟢 verified	fadb06593
Strict audit	cargo audit --deny warnings passed locally with 0 vulnerabilities and 0 warnings under the existing project configuration, and the actual PR CI audit step was checked as successful.	🟢 verified	fadb06593

Verified green: complete required final-head PR GitHub Actions, including Linux validation, Windows native tests, all four desktop builds, standalone crate checks and protocol fixtures; focused local locked metadata, strict cargo audit and diff checks passed. Dependency review was skipped by the owner's configured title filter.

[axpnet]

CLI download fallback notices complete

Post-4.2.3 follow-up, fixed on main, shipping in v4.2.4 (#1216). This completes Requested item 13 together with #1212.

CLI users now receive a reason when an attempted parallel download is declined across all paths covered by item 13. The diagnostic uses bounded provider warnings on stderr at command completion, including structured JSON. New reasons omit private paths, signed URLs, headers and raw provider errors.

Area	Description	Status	Ref
FTP, SFTP, B2	Explain source-size, metadata and post-transfer version refusals; B2 also reports refused ranged responses and failed size probes, and SFTP covers concurrent read-ahead and pipeline refusals.	🟢 fixed	0b5220053
Shared segmented executor	Preserve a static diagnostic reason alongside the internal error, report it when callers select the provider download fallback, and describe subsequent DAG attempts accurately without promising a single stream or a retry.	🟢 fixed	0b5220053
CLI pget	Keep fallback reasons in quiet and JSON modes through the normal stderr warning envelope; stop attributing every fallback to a one-segment plan.	🟢 fixed	0b5220053
Transfer behavior	Preserve existing retry policy, progress, atomic publication and cancellation; ordinary small-file single-stream selection stays silent.	🟢 fixed	0b5220053

Verified green: final-head PR GitHub Actions, including Linux validation, Windows native unit tests, all four desktop builds, CLI smoke on Linux/macOS/Windows, protocol fixtures and DCO; CodeRabbit review completed without actionable findings. Local focused validation before the final segmented-destination wording adjustment: 70 library tests and 16 CLI tests passed.

[axpnet]

Startup cleanup preserves active staging

Post-4.2.3 follow-up, fixed on main, shipping in v4.2.4 (#1217). Completes Requested item 43 of #1422.

Staging moved from the temporary folder to the on-disk scratch folder in #1199, so crashes could leave files indefinitely. GUI and CLI startup now collect old recognized leftovers while preserving active work, including uploads with old source timestamps and transfers or open vaults lasting more than 24 hours.

Area	Description	Status	Ref
Startup collection	Reclaim recognized files and Proton staging folders older than 24 hours, including atomic download partials and stale orphan sidecars. Unknown names, symlinks, fresh entries and unprobeable entries remain.	🟢 fixed	60528f99e
Active staging	Crypt uploads, downloads and version downloads retain a separate native lease through reads, retries and cleanup. Compression, CLI staging, Proton and remote vaults retain a shared process lease; collection of unleased files requires its exclusive counterpart.	🟢 fixed	60528f99e
Failure cleanup	Remove partial ciphertext after a failed write, clean up failed staged reads, and remove crypt payloads and download partials when a future is cancelled. Source mtime propagation stays intact.	🟢 fixed	60528f99e
Diagnostics	Count directory, iterator, metadata, lock and removal errors. Missing directories and expected concurrent disappearance remain normal cases.	🟢 fixed	60528f99e
Regression coverage	152 focused tests passed, including a sweep in another process, abrupt owner exit, old source timestamps, long-lived unleased staging, permissions, symlinks and Proton hardlink/copy preflight.	🟢 verified	60528f99e

Verified green: the complete local pre-merge gate on 26cfcb7fc (formatting, security regression, version consistency, 2,304 frontend tests plus 11 controller tests, typecheck, 46 clean locales, all-target Clippy with warnings denied, 6,727 passing Rust tests and strict dependency audit); complete final-head PR CI on Linux, Windows, macOS ARM and macOS Intel, including native MSI regression and evidence upload, CLI smoke, SFTP integration and portal checks. CodeRabbit full review covered the final head with no actionable comments, and all original inline threads are resolved. The merged commit has the identical validated tree. Two Node fixtures requiring /usr/bin/node passed separately in a temporary mount namespace with the original sandbox and assertions intact; the other 6,725 Rust tests passed in the complete test invocation.

Post-merge CI verified green on 60528f99e: complete Build AeroFTP (Linux validation and Linux, Windows, macOS ARM and macOS Intel packages), Checks, native Windows tests, CLI smoke on all three platforms and SFTP integration. Native MSI regressions and evidence upload both passed. Local main is synchronized and clean.

[axpnet]

Windows local folder shares refuse alternate stream names

Post-4.2.3 follow-up, fixed on main, shipping in v4.2.4 (#1220). Completes Requested item 42 of #1202.

A client could name file.txt:stream in a served Windows folder and address an NTFS stream that the folder listing never displays. Local folder shares and URLs now expose ordinary file and directory entries, refusing stream syntax before resolving a read or mutation.

Area	Description	Status	Ref
Windows path policy	Reject colon-containing host components, including explicit :$DATA forms, in the shared DirectoryProvider resolver.	🟢 fixed	b040e062b
Native Windows regression	Create a real NTFS stream and verify metadata, ordinary and ranged reads, upload, delete, rename, replace, copy and checksum refuse its name while preserving the base file and stream. New stream creation is refused too.	🟢 verified	b040e062b
Unix filenames	Preserve real colon-containing files through listing, reads, rename, copy and deletion.	🟢 verified	b040e062b
Documentation	Describe the Windows filename policy in the CLI guide.	🟢 updated	b040e062b

Verified green: the complete local pre-merge gate on the exact published head eed0c5b39, including fmt, security regressions, version consistency, 2,304 frontend tests and 11 controller tests, typecheck, 47 locales with 5,731 reference keys and no placeholders, all-target Clippy with -D warnings, 6,729 Rust tests and strict cargo audit --deny warnings. The Rust suite retained 95 configured ignores; two unchanged Node sandbox fixtures ran separately in a private mount namespace because this host has no system /usr/bin/node. Native Windows PR CI passed 5,569 tests, including the real NTFS stream regression. All supported-platform packages and CLI smoke tests passed in PR CI; native Windows CI also verifies the NTFS fixture. CodeRabbit reviewed the exact published head with no actionable findings and no inline threads.

[axpnet]

Batch multipart uploads abort when their task is destroyed

Post-4.2.3 follow-up, fixed on main, shipping in v4.2.4 (#1219). Completes Requested item 10 of #1202.

An interrupted batch could leave uploaded parts on the remote server until a lifecycle rule removed them. Taking the handle out of the multipart state also left a second gap: destroying the task while its explicit abort was in flight lost that request. Each batch file now owns a separate guard until its completion or awaited abort finishes.

Area	Description	Status	Ref
Hard task destruction	Schedule best-effort cleanup using the original upload ID during part upload, completion or an in-flight explicit abort.	🟢 fixed	0f673e5e7
Ordinary terminal paths	Keep awaited failure cleanup and disarm the guard after completion or abort, preserving the existing event/accounting behavior.	🟢 fixed	0f673e5e7
Resume policy	Confine the guard to batch files; intentional durable checkpoints in the single-file runner retain their existing lifecycle.	🟢 preserved	0f673e5e7
Regression proof	Three new task-destruction tests failed on the original production code; all 58 focused batch tests pass with the fix. A pre-begin destruction control does not invent an abort, and normal terminal tests drain cleanup tasks before checking counts.	🟢 verified	0f673e5e7

Verified green: the complete local pre-merge gate, including fmt, security regressions, version consistency, 2,304 frontend tests and 11 controller tests, typecheck, 47 locales with 5,731 reference keys and no placeholders, all-target Clippy with -D warnings, 6,733 Rust tests on the exact merged integration tree and strict cargo audit --deny warnings. The Rust suite retained 95 configured ignores; two unchanged Node sandbox fixtures ran separately in a private mount namespace because this host has no system /usr/bin/node. Full supported-platform PR CI, including native Windows assertions and Linux, Windows, macOS ARM and Intel packages: passed, with native Windows assertions also green. CodeRabbit reviewed the exact published head with no actionable findings and no inline threads.

Cleanup remains best effort while the Tokio runtime is available. Process termination is outside this guarantee.

[axpnet]

RAR5 hardlinks resolve inside their own extraction

Post-4.2.3 follow-up, fixed on main, shipping in v4.2.4 (#1222, Requested item 19).

A Linux RAR5 extraction could silently make a hardlink to an unrelated file in AeroFTP's working directory. A real archive and a hostile CWD reproduced the wrong bytes. References now resolve only to previously extracted regular members inside the private staging root.

Area	Description	Status	Ref
Hardlinks and copies	References use the validated extraction root, refuse missing or escaping targets, and leave existing output intact on failure.	🟢 fixed	4cd0da4ba
Archive browser	Selecting a reference prepares its required archive prefix privately and publishes only the selected member. Ordinary members retain direct extraction.	🟢 fixed	4cd0da4ba
Staging claim	Publication explicitly releases its native file lock even if a concurrently created process inherited the descriptor. A deterministic duplicated-descriptor regression failed before the correction.	🟢 fixed	4cd0da4ba
Native metadata	A documented local wrapper patch exposes owned redirection metadata through the packed native header ABI. The native library and existing Unicode conversion remain unchanged.	🟢 fixed	4cd0da4ba

Verified green: complete GitHub Actions on PR head 8e5906677, including native Windows tests, CLI smoke on Linux/macOS/Windows, all four desktop package builds, linux-validate and the protocol/integration lanes; CodeRabbit confirmed its only finding inline on that head; complete local pre-merge gate on tree fac98f2b4: 6735 Rust tests (including two isolated Node fixtures), 95 configured ignores, 2304 frontend tests and 11 controller tests, typecheck, 47 locales with zero placeholders, formatting, security regressions, version agreement, Clippy on all targets with warnings denied, and strict dependency audit. Local focused run: 33 tests, including real ASCII/Unicode RAR5 archives, Unicode roots under locale C, whole/archive-browser extraction, Unix inode identity, file copies, unsafe/missing targets, existing output preservation and earlier RAR failure regressions; fmt, diff whitespace checks and Clippy with warnings denied.

[axpnet]

Proton native transfers use the SDK small-file path and concurrent blocks

On main, shipping in v4.2.4 (#1302).

The four-way benchmark exposed avoidable round trips in native transfers. The native client now uses the SDK's single-request path for small files and keeps large-file blocks in flight.

Area	Description	Status	Ref
Small uploads	New files and revisions below the SDK size threshold use one multipart API request; empty files need no block. Verification data is checked before sending, and stale drafts are handled without changing conflict behavior.	🟢 verified	3a4255f8c
Large files	Downloads fetch up to ten blocks concurrently and write in index order; uploads overlap two five-block batches within the existing ten-block limit.	🟢 verified	3a4255f8c
Latency	The next revision page is read while current blocks download; user and address reads connect concurrently under the shared refresh.	🟢 verified	3a4255f8c

Validation: Final-head PR CI on 7becab553 completed without failing or pending checks. Tests in the merged change cover the 119156/119157-byte boundary, verification code, multipart forms with and without a block, and a complete retry after HTTP 502. Benchmark times remain unpublished until the measured source is checked against main.

🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released

[axpnet]

Proton CLI mode preserves names with glob characters and renamed downloads

On main, shipping in v4.2.4 (#1303).

CLI-mode transfers could fail on local paths with glob characters, or report a completed download as missing after the official CLI sanitized its filename.

Area	Description	Status	Ref
Upload and destination paths	Escape local glob metacharacters so brackets, braces, stars and question marks are literal. A Unix backslash that the official CLI cannot escape is refused with an explicit reason.	🟢 verified	1a69f058d
Downloaded names	Locate the name written by the official CLI after its filesystem sanitization, then move the result to the requested local name.	🟢 verified	1a69f058d
Regression coverage	The shim expands local globs and sanitizes names like the official CLI. Removing escape and rename handling made five tests fail. Live checks verified upload and byte-identical download with proton-drive 0.9.0, including a destination named glob [d] {e}.	🟢 verified	1a69f058d

Validation: Final-head PR CI on 125742e35 completed without failing or pending checks. The handoff records the mutation checks and live checks above; the fix was independently reviewed without findings.

🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released

[axpnet]

Create and sign in Proton Drive profiles from the CLI

On main, shipping in v4.2.4 (#1296).

The CLI can create a Proton profile, choose native or CLI mode, and sign in, sign out or inspect the native session. Existing CLI-mode profiles keep their selected client.

Area	Description	Status	Ref
Profile and session commands	Save the chosen Proton mode and provide profile-bound native sign-in, explicit sign-out and session status. The main executable dispatches proton to the CLI.	🟢 verified	1e8fa666e
Sign-in boundaries	Display the one-time sign-in address only on an interactive terminal. Reject a response received after cancellation or expiry, and preserve the previous session when sign-in does not finish.	🟢 verified	1e8fa666e
Shared session target	GUI and CLI status/sign-out resolve the same profile or unbound session. Feature-off builds retain a usable sign-in hint.	🟢 verified	1e8fa666e
Local gate portability	Node fixtures use the executable resolved from PATH, including tests that clear their child environment.	🟢 verified	1e8fa666e

Verified green: all applicable final-head PR checks on 6bd8bb30a, with both CodeRabbit inline confirmations and no unresolved review threads. The full local ci:pre-push gate passed on that exact head: 7186 Rust tests passed, 0 failed, 99 ignored across 50 suites, plus frontend tests, typecheck, i18n validation, strict clippy and cargo audit. Focused feature-off/test-seed checks also passed. The terminal-only address and persisted options have mutation regression coverage.

🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released

[axpnet]

GUI startup keeps dependency warnings and avoids empty credential rewrites

On main, shipping in v4.2.4 (#1301).

Starting AeroFTP no longer fills the GUI log with D-Bus handshake chatter or rewrites the vault when asked to delete an entry that is absent.

Area	Description	Status	Ref
GUI log	Filter INFO chatter from zbus and tracing::span and their submodules, while retaining their warnings/errors and unrelated targets. The rule applies to stdout, the log file and DebugPanel.	🟢 fixed	3352e42cd
Credential deletion	Deleting a missing entry succeeds without rewriting the vault or reporting a deletion. Deleting an existing entry retains the normal write and removal behavior.	🟢 fixed	3352e42cd
Regression tests	Check the exact log target boundaries and verify byte-for-byte preservation of a vault file when an absent entry is deleted.	🟢 covered	3352e42cd

Verified green: all applicable final-head PR checks on c5dd5c52d, including format/audit/unit tests, Linux validation and Windows/macOS build checks. The merged commit is present on main.

🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released

[axpnet]

Agents read readiness from each saved profile's sign-in source

On main, shipping in v4.2.4 (#1299).

Profiles that connect without a stored password no longer appear unsigned-in simply because server_<id> is absent. CLI listings/bootstrap and MCP preserve the same readiness classification.

Area	Description	Status	Ref
Saved profile classes	Anonymous FTP/WebDAV, SFTP keys, local folders, MTP devices, peer tickets and Filen Desktop bridges use their actual authentication source.	🟢 verified	0e369e491
Proton and external sessions	Native Proton checks the profile or unbound vault session. Official Proton CLI and MEGAcmd sessions remain unknown when another program owns the session, so an agent can try connecting rather than skip it as unsigned-in.	🟢 verified	0e369e491
Safe MCP records	Carry the nonsecret auth-source classification through filtered profile records, retaining the same answer as a full saved profile.	🟢 verified	0e369e491
Isolated CLI regression	An anonymous FTP profile reports valid while a profile missing its required password reports no_credentials in both profiles JSON and agent-bootstrap. No remote connection is needed.	🟢 verified	0e369e491

Verified green: all applicable PR checks on d448280a1, with no unresolved review threads. The complete local ci:pre-push gate passed on the prospective merged tree: 7234 Rust tests passed, 0 failed, 99 ignored across 54 suites, plus frontend tests, typecheck, i18n validation, strict clippy and cargo audit. After the guarded squash merge, the actual main tree was verified equal to that tested tree (617fae45ac3c2f42f955026713612162594eccfa).

🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released

[axpnet]

Consistent saved connection profiles across GUI, CLI and MCP

Post-4.2.3 follow-up, fixed on main, shipping in v4.2.4 (#1304).

New connections use one manifest for protocol aliases, preset identity, ports and public options. CLI-created profiles keep the same settings when the GUI and agent tools load them; existing FTP/FTPS transport choices and legacy Proton CLI profiles retain their saved behavior.

Area	Description	Status	Ref
Shared connection contract	Rust and TypeScript resolve canonical protocols, preset defaults and saved options from one manifest. Caller aliases replace equivalent defaults; secret option aliases fail before persistence.	🟢 fixed	a0d250849
Proton CLI integration	Native/CLI mode and generic JSON options coexist. The dedicated client flag wins, a build without the native client defaults to CLI and rejects explicit native mode, and the protondrive alias reports canonical mode and sign-in guidance.	🟢 fixed	a0d250849
Provider compatibility	Existing FTP TLS values survive loading; the accepted TLS vocabulary matches the backend. Backblaze S3 and native B2 keep their separate credential and export formats.	🟢 fixed	a0d250849
CI coverage	Both smoke events include the shared manifest, loader, import and bridge dependencies; saved connection parity runs against the built CLI.	🟢 fixed	a0d250849

Evidence	Result
Integrated source	38 focused default-configuration tests and 5 feature-off Proton CLI tests passed.
Saved profile parity	98 profiles were created by the actual CLI and reloaded, including aliases, provider presets, ports and options.
Isolated Proton regression	Encrypted export/import inspection confirmed the persisted client, unrelated options, initial path and manual quota; no external account or credential restore was used.
Review	Independent applied-source review found no residual issue. CodeRabbit explicitly confirmed head 726c1f3b50a8134d4f02259e362eeff9afcb21c3 inline. All review threads resolved.
Final head CI	All applicable checks passed on 726c1f3b50a8134d4f02259e362eeff9afcb21c3, including Linux validation, Windows native tests and Linux/Windows/macOS builds and CLI smoke.

Verified green: complete local npm run ci:pre-push on exact head 726c1f3b50a8134d4f02259e362eeff9afcb21c3, including fmt, security/version checks, frontend and GUI-controller tests, typecheck, i18n (46 clean locales, zero placeholders), strict clippy (-D warnings), 7,249 Rust tests passed, 0 failed, 99 ignored across 54 suites, and cargo audit. The merged main tree matches the tested tree.

[axpnet]

Headless authorization for saved profiles through CLI and MCP

Post-4.2.3 follow-up, fixed on main, shipping in v4.2.4 (#1305).

A saved profile can be configured and authorized through profile-auth or the equivalent MCP tool without opening the desktop GUI or a browser on that machine. Both interfaces share profile-bound OAuth2, FourShared OAuth1, Twake, GitHub Device Flow and GitHub App routes; pending authorization data and resulting secrets remain in the encrypted vault.

Area	Description	Status	Ref
Authorization lifecycle	Configure, begin, finish, status and cancel share persisted callback binding and PKCE state. Public responses expose authorization URLs and readiness rather than tokens, client secrets or private keys.	🟢 fixed	25575ce40
Credential ownership	Refresh retains the selected profile/user ownership. Structured password, API-key and access-token wrappers reach the actual provider credential parser; unsupported or unused server seeds fail before profile creation.	🟢 fixed	25575ce40
GitHub sessions	Device Flow and App credentials use their intended storage and readiness routes. Expired App sessions are removed and disconnected outside the pool lock; successful authorization invalidates the already resolved profile ID.	🟢 fixed	25575ce40
Main integration	General AuthSource classification, safe MCP metadata, connection-manifest creation, public options and explicit Proton client selection remain intact. GitHub App/Device Flow reject PAT-style seeds while PAT readiness remains usable in listings and agent bootstrap.	🟢 fixed	25575ce40
CI and test portability	Both smoke filters cover dispatcher, manifest, loader, auth, MCP and fixture dependencies. Both Linux parity probes remain configured. A compile-time public synthetic RSA fixture replaces external OpenSSL generation; the lifecycle child runs with an empty PATH.	🟢 fixed	25575ce40

Evidence	Result
Integrated focused checks	36 Rust test executions across 9 suites passed for lifecycle, general readiness, safe MCP records, pool, CLI dispatcher, Proton, inventory and isolated CLI behavior.
Headless CLI/MCP probe	Configuration, persisted PKCE, callback mismatch, cancellation, shared pending state, public redaction and actual HTTP authentication consumption passed against isolated synthetic fixtures.
Saved connection parity	98 profiles created by the actual CLI and reloaded preserved aliases, provider identity, ports, options and paths.
Complete inventory	Regenerated 99 CLI commands and 78 MCP tools; the entire generated JSON matches the live artifact, and all 9 inventory unit tests pass.
Lifecycle follow-up	The exact lifecycle fixture passes with an empty child PATH, including actual RS256 signing and the later FourShared/Twake checks.
Review	Integration points explicitly confirmed inline on the unchanged production source. Both final review fixes explicitly confirmed at f714224fa7bfbb4f7feb7fd0ba4158ec4787122a; all review threads resolved.
Final-head CI	All applicable checks passed on f714224fa7bfbb4f7feb7fd0ba4158ec4787122a, including Linux validation, Windows native tests, cross-platform builds and CLI smoke.

Verified green: complete local npm run ci:pre-push on exact head f714224fa7bfbb4f7feb7fd0ba4158ec4787122a, including fmt, security/version checks, frontend and GUI-controller tests, typecheck, i18n (46 clean locales, zero placeholders), strict clippy (-D warnings), 7,251 Rust tests passed, 0 failed, 99 ignored across 54 suites, and cargo audit. The merged main tree matches the tested tree.

[axpnet]

Dependency maintenance bundle

Fixed on main, shipping in v4.2.4 (#1314).

Area	Description	Status	Ref
Dependency maintenance bundle	Dependency maintenance bundle: update jsdom 30.1.3, Vitest 5.0.5, Tokio 1.53.3, rustls-native-certs 0.8.5, arboard 3.7.0 and zip 9.0.4 together, plus PostCSS 8.5.31, with compatible lock resolution and the existing advisory policy preserved.	🟢 fixed	86b7c97e0

Verified green: Linux validation, Windows native unit tests, Linux/Windows/macOS packaging, Proton native suite, standalone crates and AeroRsync protocol/integration lanes passed in GitHub Actions on the protected PR head before squash merge.

[axpnet]

Proton native-client documentation and catalog

Fixed on main, shipping in v4.2.4 (#1315).

Area	Description	Status	Ref
Proton native-client documentation and catalog	Proton native-client documentation and catalog: describe the native client already enabled in default builds alongside the official CLI option; align bridge/provider guides, workflow/vendor comments and the paired source/generated provider catalog without changing release features.	🟢 fixed	188443522

Verified green: Linux validation, Windows native unit tests, Linux/Windows/macOS CLI smoke and packaging, Proton native suite and AeroRsync protocol lanes passed in GitHub Actions on the protected PR head before squash merge.

[axpnet]

Saved sessions for CLI cross-profile copies

Fixed on main, shipping in v4.2.4 (#1306).

Area	Description	Status	Ref
Saved sessions for CLI cross-profile copies	CLI cross-profile and batch copies load saved OAuth sessions and crypt bindings through the normal profile resolver. Parent creation, cancellation, path mapping and upload verification retain guarded behavior, while failed files remain visible in the transfer tally.	🟢 fixed	ba97f97be

Verified green: full applicable PR CI on the protected head, including Linux validation, Windows native tests and Linux/Windows/macOS builds; complete local ci:pre-push gate on the integration tree, verified identical to the resulting main tree.

[axpnet]

Profile ownership and transfer publication guards

Fixed on main, shipping in v4.2.4 (#1313).

Area	Description	Status	Ref
Profile ownership and transfer publication guards	Provider actions and Proton authorization retain their original profile owner; durable credentials survive guarded cross-user relocation. Archive publication, resumed downloads, Windows reparse handling and served reads fail safely, with AppStream parsing, watcher coverage and all 47 locale updates included.	🟢 fixed	7c5d4327e

Verified green: full applicable PR CI on the protected head, including Linux validation, Windows native tests and Linux/Windows/macOS builds; the complete local gate was reused as expressly requested by the owner, with its verified baseline tree recorded separately; focused relocation regressions and the PR CI cover this change. No second full local suite was run.

[axpnet]

Cross-profile copy follow-ups completed

Fixed on main, shipping in v4.2.4 (#1316). The five confirmed follow-ups in Requested 66-70 are now completed.

Area	Description	Status	Ref
Requested 66: saved authentication	GUI and agent connections reuse OAuth sessions and crypt overlays. The original profile owner is captured before connection awaits and retained for options, passwords, salts, config and keyfiles; foreign legacy mirrors are rejected without ownership proof. Re-entering overlay secrets repairs the owned row.	🟢 fixed	f12d36510
Requested 67: repeat skip	Equal-size files use the one-way timestamp rule, with size fallback for unavailable or incomparable timestamps; planning retains source precision.	🟢 fixed	f12d36510
Requested 68: recursive file removal	Recursive removal dispatches by target type, unlinks symlinks and preserves remote-root and guarded-directory refusal.	🟢 fixed	f12d36510
Requested 69: empty directories	Plans and execution preserve empty directories across CLI, GUI and agent paths. Setup failures, cancellation and partial batches report accurately; encrypted ancestor checks remain guarded.	🟢 fixed	f12d36510
Requested 70: existing SFTP ancestors	A failed mkdir is accepted only when a successful stat proves a directory; files, missing paths and inconclusive probes retain their errors.	🟢 fixed	f12d36510

Verified green: 114 focused Rust overlay/auth tests plus 19 final planner tests; formatting and whitespace checks; 43 frontend tests and TypeScript on unchanged frontend code; all applicable CI on the protected PR head and bounded independent counterreview. Earlier DEV CLI and four-profile T6 checks covered both overlay formats, repeated skips, empty directories, decrypted byte-identical readback and recursive file removal with sibling preservation. Temporary remote roots were removed. These live checks predate the final ownership correction; authenticated live OAuth remains untested. The complete local pre-tag baseline gate was reused as expressly authorized by the owner; no second full local suite was run.

[axpnet]

Bounded bulk transfers in Proton CLI compatibility mode

Done on main, shipping in v4.2.4 (#1317, e890fa672). Suitable files share bounded native calls across the CLI, GUI and compatible sync operations.

Area	Description	Status	Ref
Optional bulk contract	Providers explicitly opt in; Proton CLI is the first adapter. Groups retain per-file outcomes, cancellation, conservative uncertain results and verified download publication.	🟢 done	e890fa672
Existing paths	Resume, delta, checksum, error-correction and crypt-wrapper constraints retain their established paths.	🟢 preserved	e890fa672
Remaining performance work	MEGAcmd and Filen bulk remain unsupported. Residual wrapper and local-gateway performance investigation, including Proton CLI upload overhead, stays open in Requested 71. This does not complete wrapper-wide performance alignment.	🔵 planned	Requested 71

Verified green: 48 focused bulk Rust tests and related focused regressions, 36 frontend tests, TypeScript, actual CLI build and live byte-identical fixture checks reported in the PR; all applicable CI passed on the protected head d20a11a8b5f16d1256d427966087c88c88e48389. The combined main tree matches the independently counterreviewed integration tree. The completed local pre-tag baseline gate is reused as authorized by the owner. No benchmark report or measurements are republished here.

[axpnet]

Pre-tag audit and 4.2.4 release preparation

Done on main, release not yet tagged (1b5a9014a). Version 4.2.4 and release notes are prepared on the actual merged main, including #1316 and #1317. The next gate is complete applicable CI on this exact main SHA across Linux, Windows and macOS; no release tag has been created.

Area	Finding	Fix	Ref
Profile and session ownership	Async connection, overlay recovery and native-session relocation needed consistent account scope and lock order.	Captured ownership, guarded fallback, scoped cache writes and atomic relocation were fixed and counterreviewed.	#1313, #1316
Transfer and archive boundaries	Response bounds, cancellation, temporary publication, recursive directory links and terminal outcomes needed regressions.	Confirmed defects were patched; focused tests and bounded independent counterreviews passed. Combined bulk integration preserves crypto and sync exclusions.	#1306, #1316, #1317
UI and platform contracts	SITE connection generation, late sign-in, AppStream parsing and native-platform fixture gates needed repair.	Fixes and focused regressions are merged; full applicable final PR checks passed.	#1313
Release metadata	All manifests and published descriptions must describe the same release.	Eight version sites agree on 4.2.4; AppStream and whitespace checks passed. Only release metadata changed after the merged code.	1b5a9014a

Verified green: completed full local pre-push gate reused as the owner-authorized pre-tag baseline, focused delta regressions and all applicable CI on final #1316/#1317 heads, plus version-site and AppStream validation after integration. Archived cycle reviews and bounded hot-path counterreviews retain their documented scope and limitations; no duplicate full suite or exhaustive new audit is claimed. Existing development-tool advisories remain documented. Broader wrapper performance investigation stays open in Requested 71; no diagnostic measurements are republished. Final-main CI is pending and must pass before tagging.

[axpnet]

AeroFTP 4.2.4 released

AeroFTP 4.2.4 is available in the GitHub release.

This cycle delivers native Proton Drive, headless saved-profile authorization, bounded Proton CLI bulk transfers, scoped cross-profile authentication and overlays, safer transfer recovery and archive publication, desktop integration repairs and updates across all 47 languages. The completed rows above are released in 4.2.4; release notes and individual Details retain their verification and limitations.

Distribution	Status	Reference
GitHub	✅ Published; all expected platform artifacts and Sigstore bundles present, with matching digests	v4.2.4
Snap	✅ 4.2.4 on latest/stable, revision 229	Snap Store
AUR	✅ aeroftp-bin 4.2.4 pushed with verified DEB checksum and matching package metadata	aeroftp-bin
SourceForge	✅ Curated artifacts, matching attestations and release README uploaded through AeroFTP CLI; retention and defaults verified	v4.2.4 mirror
winget	🟡 Submission successful; upstream PR remains pending integration at verification	winget-pkgs#457096
FlatPark	🟢 Publication notification accepted	AeroFTP
MCP extension	✅ Version 1.6.1 published, advertising 78 tools and the matching CLI requirements	Marketplace

Unresolved requests continue in the 4.2.5 tracker. Requested 71 keeps residual MEGAcmd, Filen local-gateway and Proton CLI upload performance investigation open. MEGAcmd/Filen bulk and broader wrapper parity are not completed; diagnostic benchmarks are not republished here.