[Tracker] AeroFTP 4.2.7 - Known issues, patches & updates

[axpnet]

AeroFTP 4.2.7, Rolling Tracker

Known issues, requested work and completed changes for the next release. The current published version is AeroFTP 4.2.6.

What shipped in 4.2.6

SCP support and consistent saved-profile presentation, safer transfer retries and recursive sync paths, startup and tray integration, provider compatibility repairs, and dependency security updates. The full pre-tag commit audit passed. See the 4.2.6 release notes and the preceding tracker #1424.

Snap Store publication pending: revision 231 (4.2.6) is uploaded but awaits Store review of the single-instance D-Bus slot (declaration-snap-v2_slots_connection, single-instance, dbus). The stable channel remains 4.2.5 revision 230. This channel follow-up is tracked separately from the published 4.2.6 packages.

Patches & updates queued for 4.2.7

Done on main, pending release.

#	Type	Change	Status	Commit	Ref
1		DEB/RPM updates now work with symlinked Downloads folders by staging verified packages privately, checking their digests and moving full-file I/O off async workers. Details.	🟢	aa0e47745	#1507
2		Public guides now match the current client: eight transports, a failed FTP upgrade that stops, the local audit report, scp://, Blomp, FileLu versions, IPFS in flight, and command inventory 4.2.6. Details.	🟢	f853a8954	#1508
3		FileLu times now show the real time: listing, version and trash times written on the US Eastern clock are converted to UTC, old AeroCloud receipts are matched through the old reading, and the CLI reaches the FileLu trash (Requested 147). Details.	🟢	f66d85791	#1509
4		Several AeroFTP processes (GUI, CLI, MCP) can now save credentials at the same time without losing one: vault writes take one cross-process lock, the key file is re-checked under it, and S3 gateways that list recursively connect at once (Requested 162, part of Requested 71). Details.	🟢	944389e1c	#1510
5		Connecting a second saved profile now parks the previous session first, a cancel or failure keeps every tab and a parked tab reconnects for real, and a cancelled FTP command closes at once without QUIT and redials (Requested 58). Details.	🟢	d7702d142	#1511
6		Tigris joins the S3 presets: static endpoint, region auto, metadata rename that keeps moved objects safe, storage usage from the Tigris API with fallbacks, soft-deleted versions in the trash, and rclone export and import. Details.	🟢	756510e83	#1512
7		MEGA bulk uploads and folder downloads run through one MEGAcmd command at native speed with per-file proof, and Proton Drive commands launch the official CLI fewer times; with #1510 this closes Requested 71. Details.	🟢	ccf3f4be9	#1513
8		A tab switch no longer reuses another server's connection when two profiles share a username, a stalled liveness probe falls back to a real reconnect, and "+" or a device open releases a listing in flight (Requested 166 and 163). Details.	🟢	491888054	#1514
9		Object names with spaces, +, %, #, ? or non-ASCII characters are encoded exactly once: S3 share links sign the path they send, Filen listings decode only what the gateway encoded, Azure encodes blob names on the wire, and OAuth 1 signs decoded values (Requested 167). Details.	🟢	d508eb0fe	#1515
10		rclone round trips through the bridge keep buckets, containers, keys and TLS choices: Swift no longer sends the password to another service, aliases open the right container and drive, and crypt scopes stay correct. Details.	🟢	9fe735ab8	#1516
11		The snap lists only the volumes it shares with the host (no runtime binds, no duplicates, EFI recognised by partition type), and a start refused because the UI port is taken ends cleanly with a notification instead of a black window that cannot be closed (Requested 136, 137). Details.	🟢	053062b85	#1519
12		Error outcomes are decided by markers, exit codes, OS error codes and listings instead of translated text: a cancelled queue row stays cancelled in every language, and localized Proton, MEGAcmd, Nextcloud and OS errors classify correctly (Requested 140, first part of 164). Details.	🟢	d58c80061	#1517
13		November security audit snapshot: the last open advisory (tokio in the test portal) is closed, 16 stale ignores are dropped, and the security report counts each finding once. Details.	🟢	79ebb33b5	#1518
14		Dependency patches from the Aikido re-scan (mio Windows named-pipe use-after-free, zerocopy, quinn-proto, peer-l0 set) and CI hardening: no persisted checkout credentials (guarded by a test), SHA-pinned actions, a safe apt cache prefix and a smoke test that notices a missing artifact. Details.	🟢	f2ed8e894	#1521
15		The remaining provider outcomes are decided by codes, headers and listings instead of error text: S3 skew vs expired credentials, GitHub quota and branch races, MEGAcmd, Drime, Jottacloud, Proton and WebDAV, an FTP upload never resent after a dropped connection, and an ordered circuit breaker (rest of Requested 164). Details.	🟢	2fb547e24	#1520
16		Docs site aligned with 4.2.6: the version nav, SCP and OpenStack Swift as their own transport pages, a short introduction on every transport page, and counts read from the provider inventory at the tag. Details.	🟢	93362fd14	docs #26
17		Tigris setup guide on the docs site (providers/tigris), live before the release that ships the preset (queued row 6). Details.	🟢	b19ae619b	docs #28
18		AeroCloud docs page: the saved-profile wizard of 4.2.4 and later, the integrations it really offers, the AeroCrypt overlay base and Uploadcare's flat layout. Details.	🟢	28d2a46f9	docs #27
19		Remote and archive names can no longer escape their destination, a local delete or move no longer follows a link into its target, a cross-device folder move keeps nested links, and temporary files are private (Requested 185 and 186). Details.	🟢	e08c39d52	#1528
20		rclone bridge review closed (no nested sections, bounded imports, the Filen API key kept in the vault, exact crypt secrets) and a relative SFTP or SCP folder read as the login folder everywhere an overlay is placed (follow-up to #1516). Details.	🟢	c501dcfae	#1523
21		A stray backdrop click no longer closes AeroSync or another window that is working or holding a result, and no longer answers a decision prompt; ESC goes to the topmost dialog only (Discussion #1527, part 1). Details.	🟢	324387b33	#1530
22		AeroAgent shows the whole of what it approves, checks the policy on every path it touches, and runs an approved change only on the approved profile, bound by id and connection identity (Requested 181 and 182). Details.	🟢	17e0c5b25	#1522
23		The peer-l0 replica never writes or deletes through a link, runs on its real root, refuses world-writable folders, creates decrypted files private and never deletes a file it did not write (Requested 186, deep-scan item 14). Details.	🟢	6eabfb450	#1529
24		S3 share links capped at 7 days on every preset, dotted bucket names over path-style, endpoints matched to presets on a domain boundary from one host map, and an imported region that follows its endpoint (Requested 174, 175, 200, frontend of 173). Details.	🟢	5b559afea	#1525
25		Fastly Object Storage setup guide on the docs site (providers/fastly-object-storage), with regional endpoints, allowances, limits and route test, live before the release that ships the preset. Details.	🟢	554749db8	docs #29
26		Apply, queued transfers, AI uploads and editor saves stay on their chosen target; refused sources cause no remote side effects, and stopped cuts retain unfinished files (Requested 184 and 212). Details.	🟢	6f17f1fe3	#1526
27		Fastly Object Storage joins the S3 presets (12 regional endpoints, path-style, 16 MiB single-PUT cutoff and 8 MiB multipart parts with one bounded 408/429 retry budget, rclone bridge, localized catalog and Discover card, hidden unsupported actions across session switches, 7-day share links, 30-minute AeroCloud scan floor on scheduled and manual syncs, shared preset-alias normalization; Requested 209 and 210). Details.	🟢	bd0578ab4	#1531
28		Snyk repository imports now accept the TypeScript configuration: two JSONC comments are removed without changing compiler options, and a CI-run Vitest test keeps the file valid strict JSON. Details.	🟢	cf3400953	#1532
29		Network trust and object names are hardened, and profile imports reset insecure options unless kept: URL-parsed IP checks, dot-segment S3 keys refused, FTP PASV pinned to control peer, MEGAcmd wildcards handled safely, and FTP TLS required everywhere (Requested 188, 189, 198). Details.	🟢	fcb5f440f	#1524
30		Add Services card descriptions clamp to uniform height with native tooltips, Quick Connect retains the short brand description in the header, and multi-connector or differing provider descriptions surface in a dedicated detail badge. Details.	🟢	354cedd75	#1531

Requested / under consideration

Community requests and follow-ups being evaluated for this or a later release. Unresolved rows carried forward from #1424, retaining their original numbers. The numbers stay the same across the three tables, so a reference such as "Requested 71" still means that row. The colored square is difficulty, not severity. Likelihood (fixes and defects), how probably the problem happens today: . Value (features and ideas), how much users would gain: . Hover a badge for its meaning; within each table rows are listed by priority, full rules in the legend at the bottom.

Features and ideas

New behaviour and product ideas. Not defects, so they carry a Value, not a Likelihood.

#	Value	Difficulty	Type	Item	Status	Ref
101	some users · improvement · requested	🟧		AeroSync scheduling from My Servers and Add Service. Add AeroSync entry points to both screens, a global table of scheduled syncs in a revised Scheduler tab, and scheduling even when the current plan has no actions, for 4.2.6. Today the Scheduler tab schedules AeroCloud, not an AeroSync plan, so it needs its own job: a scheduled entry must do what the same sync does by hand, Update with deletes included.	🔵 planned	#347 (@EhudKirsh)
150	some users · improvement · proposed	🟧		FileLu multipart upload. Our FileLu upload is one request (200 MiB took 69 s on 2026-11-01), so a failure near the end restarts from zero. FileLu offers multipart only on its rclone endpoint, behind a separate key. Asked FileLu for the same on the public API. ⏳ Waiting for FileLu: multipart on the public API or a user key for the rclone endpoint. Affects large FileLu uploads on unstable links only. Meanwhile a failed upload can simply be retried.	🔵 planned ⏳	#1481
88	some users · improvement · proposed	🟥		Proton native: a node cache kept current by Drive events. The official CLI keeps the decrypted nodes on disk and updates them from Drive events, so it lists a folder with one request; the native client asks for the details of every folder it lists (two requests per level). About 1.2 s on a 6-level tree at 150 ms per request, most of what still separates the two on deep trees. Ties in with event-based sync for AeroCloud.	🔵 idea	#1340
145	few users · improvement · proposed	🟩		FileLu S5: the region picks the host. The region in the S5 form changes only the signature; every request goes to s5lu.com. Map it to us., eu., ap. or me.s5lu.com (global stays s5lu.com), saved profiles unchanged. All hosts serve the same storage and one host reads its own writes at once, but US and EU replicate in 5 to 43 s (measured 2026-11-01), so a profile must keep one host.	🔵 planned	#1481
206	few users · improvement · requested	🟩		An S3 share link signed with a manually entered session token can outlive the token without saying so. A static session token in a profile carries no expiration AeroFTP can read, so the link reports the chosen lifetime even if the token ends sooner; links signed through AssumeRole are already bounded since #1525. An optional session-token expiration field would bound and report such links too. Raised in the CodeRabbit review of #1525 on 2026-11-07.	🔵 planned (Orion L1)	#1525
26	few users · improvement · planned	🟨		MCP client presets v1.1: Fetch and Git servers fetched at install time (the remote DeepWiki preset shipped in #1038): download pinned release artifacts when the user installs the preset, checked by SHA-256, gated by target OS and architecture and by the Python ABI, instead of embedding third-party archives in the app. Parked until after v4.2.2 for a design review of the supply-chain path.	🔵 planned	#1038
34	few users · improvement · proposed	🟨		One speed and benchmark engine for GUI, CLI and MCP: today there are four (GUI speed test, CLI speed, speed-compare and benchmark; MCP runs the CLI). The GUI speed test covers only FTP, FTPS, SFTP, S3 and WebDAV, integrity check and score exist only in the GUI, and labels and defaults differ between them.	🔵 idea	#368
109	few users · improvement · requested	🟨		E2E badge for local encrypting bridges: MEGAcmd WebDAV and Filen Desktop WebDAV and S3 show a LOCAL badge; the provider encryption happens in the local bridge before upload. Decide whether and how to show that next to LOCAL.	🔵 idea	#347 (@EhudKirsh)
1	few users · improvement · requested	🟧		Eager-evaluation preview and a single-vs-multi-target placeholder for the -i selectors (prioritised by the reporter ahead of Edit(E) and the 2-letter semantics; exact behaviour to be pinned)	🔵 idea	#311 (@EhudKirsh)
108	few users · improvement · requested	🟧		Refuse over-scoped tokens, starting with kDrive and Yandex Disk: first measure whether each API returns the granted scope set; only then refuse a token that carries more than AeroFTP uses, naming the extra scope and pointing at a narrower token. Today AeroFTP only reports missing scopes.	🔵 idea	#347 (@EhudKirsh)
204	few users · improvement · requested	🟧		Uploads into an existing MEGA folder whose name contains * or ? are refused. Since #1524 such a write is refused with a clear error instead of being matched as a wildcard; supporting it means addressing the folder by its handle in mega-put, which needs a live MEGAcmd check first. Found in the CodeRabbit review of #1524 on 2026-11-07.	🔵 planned (Orion L1)	#1524
2	few users · improvement · requested	🟥		Lossless .jpg to .jxl transcode in AeroFile: JXL re-encodes an existing JPEG losslessly and reversibly (the original JPEG bytes reconstruct exactly), for a real size win with no quality loss. Candidate framing: AeroFile as a GUI for libjxl	🔵 idea	aerovault#2 (@EhudKirsh)
3	few users · improvement · planned	🟥		macOS shell integration for the OS extract feature (Deliverable G macOS, deferred): Finder Sync "Extract Here / Extract to Folder" menu items mirroring the Linux Nautilus and Windows verbs, plus macOS custom document-type icons (CFBundleDocumentTypes) for the five aero formats and the generic fallback, and rebuilding the mimetype .icns multi-size (the v4.1.0 ones are single-resolution drafts). Needs a Mac to build and live-test	🔵 planned	#1408 (Deliverable G)
4	few users · improvement · planned	🟥		Filen Encrypted Notes: exit Beta: take Filen Notes out of Beta. Fix the participants/add contactUUID format (currently a best-effort workaround), investigate the Filen free-plan 10-note limit ghost-note cleanup, and add a rich text editor for the rich note type	🔵 planned	-
6	few users · improvement · requested	🟥		Recommended-protocol highlight on the Add Service / Quick Connect pages, from the user's own benchmark (#368). The recommendation itself shipped in the CLI benchmark (Queued 22: "From this network" and "Best protocol per service", with latency as signal bars); what is left is showing it in the GUI next to each service and protocol.	🔵 idea	#274 (@EhudKirsh)
211	some users · nice to have · requested	🟩		The Discover texts of the presets whose free tier needs a payment card (freeRequiresCard, for example Cloudflare R2 and Oracle Cloud) do not say so. #1531 fixes the Fastly text only; the others should name the card the same way, through the i18n batch, ideally from the flag rather than hand-written per preset. Found while fixing the CodeRabbit review of #1531 on 2026-11-07.	🔵 planned	#1531
214	few users · nice to have · proposed	🟩		Differentiate short vs detailed card descriptions for single-connector presets in Quick Connect. Today multi-connector mode groups (MEGA, Filen, FileLu, Proton) and 39 presets show a concise brand description in the header and a specific card description in the info badge, while ~38 single-connector presets share one description. Enrich them with distinct short/long texts translated across all 47 locales via the standard batch pipeline.	🔵 idea	#1531
41	few users · nice to have · requested	🟧		Tailwind CSS 4 migration: adopt its dedicated Vite or PostCSS plugin, migrate configuration and utilities, verify the main/extract/approval windows and define supported WebView versions. Separate task requested by the owner; v4 needs Safari 16.4+, while the macOS manifest currently declares 10.13.	🔵 planned	-
105	few users · nice to have · requested	🟧		World map view for Add Service: a third view next to grid and table that places each service on a world map from its Region flag (a country or the EU), drawn from an embedded public-domain SVG with no map library or network; global or unplaced services stay off the map. My Servers would follow once a profile can carry a user-set location. Under evaluation, not scheduled.	🔵 idea	#347 (@EhudKirsh)

Non-blocking fixes

Improvements and defects that do not block a release: follow-ups, measurements, and fixes with a contained effect.

#	Likelihood	Difficulty	Type	Item	Status	Ref
56	observed · some users · always	🟨		Linux DMA-BUF renderer: explicit override and default policy. Step 1 merged in PR #1258 (853003d44, queued row 48): GUI startup and dispatcher preserve explicit values; absent still defaults to 1. WebKitGTK 2.52.6 native Wayland comparisons on AMD Radeon 890M and Intel UHD630 pass Monaco/xterm, eight canvas modes and six shaders ON/OFF; ON improves page cadence and restores rounded corners after unmaximizing. OFF WebGL still records GPU activity. The owner retains the compatibility default; a different default and broader driver/backend coverage, including NVIDIA, remain under consideration.	🟡 investigating	#1258, #1254, #1249
194	observed · some users · always	🟧		S3 multipart uploads use about four times the CPU and twice the RAM of rclone for the same wall time. Measured 2026-11-06: 2 GiB to Fastly took 18.7 s of user CPU and about 155 MB of memory against 4.6 s and 71 MB for rclone, and Tigris shows the same (30 runs, uploads above the 200 MiB multipart threshold). Measure where the CPU goes (per-part SigV4 payload hashing, buffer copies, TLS) before changing anything.	🟡 investigating (Orion L1)	-
92	observed · few users · always	🟨		A benchmark run on Koofr leaves its folders in the Koofr trash, and says nothing. The Koofr provider lists and restores trash items but has no permanent delete, so delete_permanent answers as if there were no trash, and a run on Koofr (native or its WebDAV preset) leaves its run folders there. The API used today can only empty the whole trash, which would also remove items the run did not create. Look for a targeted purge in the Koofr API and implement delete_permanent with it, and check the same gap on the Filen API and the Nextcloud trashbin. Today the Koofr trash can be listed and restored only from the GUI: the CLI trash list covers Nextcloud and the MCP remote_trash tool covers S3. Found by the #277 benchmark run on 2026-10-23. Since #1353 (1731978ad) the run no longer says nothing: its report notes that the Koofr trash was not emptied and must be emptied from Koofr; the purge itself is what this row still needs. Checked on 2026-10-25: Koofr offers no way to purge a single trash item (below). Filen does (its API purges one file or folder by UUID), but AeroFTP has no model of the Filen trash yet: planned. Nextcloud does too: shipped in #1374 (Queued 51), a benchmark or CLI speed-test cleanup on Nextcloud and ownCloud now purges exactly the trash item it deleted. A request for a selective purge was sent to Koofr on 2026-10-25. ⏳ Waiting for Koofr: Koofr's API, its web app and its own client can only empty the whole trash, which would also delete items you removed yourself, so AeroFTP will not use it. Until Koofr offers a way to delete one item from the trash, a benchmark run on Koofr (native or over WebDAV) leaves its run folders there and says so in its report; empty the Koofr trash from Koofr when you are ready (Koofr does not count the trash against your quota).	🔵 planned ⏳	#1341, #1353, #1374
195	from code · all users · always	🟨		CI never builds or tests the peer-l0 workspace (src-tauri/peer-l0), so a change there is verified only by a local build. No workflow references it; the deep scan items 14, 46, 82, 83 and 114 live there. Add a job that runs cargo test and clippy -D warnings on that workspace, path-gated on src-tauri/peer-l0/**. Found on 2026-11-06 while fixing item 14.	🔵 planned	-
203	from code · some users · sometimes	🟨		A dropped SFTP session stays in the CLI agent and MCP connection pool, so later calls keep failing. The pool drops an entry only on authentication errors; after a transport error (connection lost, I/O) the dead session is reused until the process restarts. Invalidate the entry on transport errors, never replaying a write automatically, with a test that drops the session. Found in the CodeRabbit review of #1522 on 2026-11-06. Identity-bound pool reuse (a pooled session is reused only for the same profile id and connection identity) landed in #1522; the dropped-session eviction itself is still open.	🔵 planned (Sirio L1, after Requested 184)	#1522
8	from code · some users · always	🟧		S3 recursive delete pays one extra HEAD per directory, because it lists with the trailing-slash prefix, which by construction cannot see the same-named key, so a separate probe is unavoidable given that listing. Listing with the slashless prefix would skip the probe entirely in the common case, where no same-named object exists, at the cost of a filter that must keep exactly path and path/.... The trap is the one #764 just closed, moved by one character: a sibling like reportsX also matches the shorter prefix. Whoever takes this must write both doors before the change, not after: reportsX survives a delete of reports, and reports survives when it is a real non-empty file. Worth doing when someone measures a slow recursive delete on a tree with many folders, not before. 4.2.1 context: #979 changed folder-removal semantics (a folder is removed only once empty, sync --delete removes the directories it emptied on every backend) but did not touch this listing or its probe; still open.	🔵 idea	#764
18	from code · some users · sometimes	🟧		Flatpak vault migration after the GUI has initialized its sandbox vault: the current import deliberately skips a sandbox that already has any vault file, so that migration still needs its scope defined. Import into a vault-free sandbox, atomic copying of all three vault files, rollback, and JSON vault.db handling already shipped in #987, with a passing JSON-import regression test rechecked during the 4.2.3 triage.	🔵 planned	#961, #987
76	from code · all users · always	🟧		CI: the Actions cache is saturated, so the apt archive cache added in #1332 is evicted within half an hour. Measured 2026-10-22: 10.14 of 10 GB in 10 entries, filled by the GB-sized Rust caches; on run 39827742722 one job restored a 71 MB apt set at 18:42 UTC and installed in 57 s, and 30 minutes later two jobs found no entry at all. To decide: smaller or fewer Rust cache entries (per-workflow keys, saving only on main, pruning stale ones), so the small caches that turn a slow mirror into a non-event survive. #1336 (3998c7b7f) merged: cache usage to be checked at 24 hours and after a week; if it stays above 10 GB, the next candidates are the macOS smoke build and windows-native.	🔵 planned	#1332, #1336
151	observed · some users · sometimes	🟧		CLI with --profile: a command given more positional arguments than it reads drops the last one without a word, and a command whose first positional is not a path reads it as one. hashsum --profile P md5 /file looks for /md5; stat --profile P /file extra ignores extra. Fix for the whole class (the shift is repeated in 53 dispatch arms plus profile_shifts_positionals and resolve_find_target): an argument left in the dropped slot is refused with exit code 2, as the deleting commands already do.	🔵 planned	-
180	from code · some users · sometimes	🟧		S3 objects uploaded in parts (every provider) or stored with an opaque ETag (Alibaba OSS, Tencent COS, SSE-KMS) have no verifiable hash, so hashsum and the sync compare cannot check them. Write our own MD5 in x-amz-meta-md5chksum (rclone-compatible) on upload and read it back where the ETag is not an MD5. S3-wide class, from the Fastly evaluation (decision D4). Decided 2026-11-06 after measuring it: pre-hash the source as rclone does (about 1 to 2 percent of the upload time at 1 to 2 GiB), reuse an MD5 the sync already knows, and trust a read-back value only for an object AeroFTP or rclone wrote with a matching size.	🔵 planned (Orion L1, after Requested 188 and 189)	-
98	observed · few users · sometimes	🟩		Proton Drive CLI 0.9.0 addresses trash items by name only, although its help says node UIDs can be used in paths. filesystem info and filesystem delete on /trash/<uid> answer "Trashed node not found"; in the official source getTrashedNode in cli/src/cli/paths.ts compares names only, while UID recognition exists for live paths. AeroFTP therefore purges a trashed item by name only when exactly one entry has that name and its UID is the expected one (Requested 94). To do: report it upstream (recognize UIDs in the trash resolver, or document the limit), and switch to UID addressing once a CLI release supports it. Found on 2026-10-24 during the live run of Requested 94.	🔵 planned	ProtonDriveApps/sdk
139	from code · some users · rarely	🟩		Retry All Failed can turn the failed rows pending and run none of them. The queue's retryAllFailed collects the ids of the rows to retry inside a setItems updater, and React runs an updater at once only when no other update of the queue is pending: during a transfer the list can come back empty, so the rows turn pending and no transfer starts. Found by reading the code while reviewing #1473; the fix takes the ids from the rows shown, then updates those rows.	🔵 planned	#1473
149	open question · few users · sometimes	🟩		FileLu folder rename: which characters it changes. Upload, file rename and folder create were measured on 2026-11-01 and the names they change are now refused up front; folder rename, now done by id (v1), was not measured. Measure it with the same name matrix and add its characters to the refusal.	🔵 planned	#1481
168	from code · few users · sometimes	🟩		A Cyberduck S3 bookmark whose host already carries the bucket imports with the bucket twice, so requests go to photos.photos.<host>. cyberduck_import.rs takes the host verbatim and the bucket from the path; strip a leading <bucket>. from the host when it matches the path bucket (every virtual-host provider). Found in review of #1512.	🔴 confirmed (bridge area, Star L2)	#1512
201	from code · few users · rarely	🟩		A Drime folder upload can report done for a folder whose name differs only in case. Drime folder lookup ignores case for nested paths, so creating /Docs/sub when /docs/sub exists is taken as already there; file uploads still resolve the exact path and fail, so nothing is written to the wrong folder, but an empty folder upload reports success. Resolve folder paths exactly, as files are. Found in the CodeRabbit review of #1520 on 2026-11-06.	🔵 planned (Sumo L1, after Requested 185)	#1520
20	from code · some users · rarely	🟨		aerovault crate: zstd length handling. Deferred edge found while shipping the AeroCompress already-compressed skip.	🔵 planned	#925
21	open question · some users · sometimes	🟨		Azure hierarchical-namespace folders: live test the directory-blob removal and HNS reporting against a real HNS account.	🔵 planned	#964
36	open question · some users · always	🟨		Live checks still owed on 4.2.2 changes: rounded window corners under the snap's X11 session, KWin, the NVIDIA driver, Flatpak and AppImage (fallback AEROFTP_SQUARE_CORNERS); Compare against a Digest WebDAV server; Stop, F4 and a disconnect during a Compare scan in the GUI; the tables whose columns moved left; ImageKit renameFolder on the real API. Progress 2026-10-16: ImageKit rename, Digest Compare, Stop/F4/disconnect and the tables verified live; corners verified on the AppImage, the Flatpak's vanishing window fixed (queued rows 30, 31), the KWin one from #1249 fixed by queued row 36 (not run on KWin itself), snap checked 2026-10-17 on GNOME (rounded corners, window fully visible) after fixing why it did not start (known issue 1); merged PR #1258 preserves explicit WEBKIT_DISABLE_DMABUF_RENDERER=0, which restores rounded corners on the measured AMD/Intel native Wayland systems while the absent-variable default remains 1; broader NVIDIA, KWin and X11 corner checks remain open; the defects found on the way are queued rows 32 to 34, and the Debug Panel one is queued row 40.	🟡 investigating	#1076, #1080, #1074, #1073, #1064, #1262
62	open question · some users · always	🟨		SFTP downloads against Windows SFTP servers: the read-ahead on its own channel (#1252), the shared read-ahead budget (#1260) and the 8 MiB channel window (#1261) are verified on seven Linux SFTP servers in Docker, on the NAS and from the GUI, not yet on Cerberus, Bitvise and Win32-OpenSSH. Verification against those Windows servers remains pending. Optional: a check of #1261 on a real long fat WAN path. Follows Requested 37 (SFTP download follow-ups), closed by #1252, #1260 and #1261.	🔵 planned	#1252, #1260, #1261
126	observed · few users · sometimes	🟨		Opening a new tab logs Path must be absolute in the Activity Log on Windows. Left from a Windows run whose other defects closed in #1458. Not reproduced on Linux; The next verification should record which path it receives.	🔵 planned	-
134	from code · some users · rarely	🟨		The CLI places a path under the profile's folder by string prefix, not by folder. resolve_cli_remote_path_in takes a path that starts with the base as already under it: with the base /www, /wwwroot/a is used as is, while /other/a becomes /www/other/a. The AeroSync Plan's CLI line mirrors the same test. Compare on a folder boundary, and decide in one place whether an absolute path outside the base is joined or kept. Found by reading the code.	🔵 planned	-
141	from code · some users · rarely	🟨		Seven XML parsers read a value in pieces and drop an entity reference in it. Found while fixing #1461 in #1469: a value split by a reference keeps only its last piece. Azure blob listings (size, metadata value, deleted flag), the two S3 version listings (IsTruncated: tr&#117;e reads as false and paging stops), and WebDAV iscollection plus the status in the trash-bin and file-id listings. A value-level check for the entity guard is written and lists exactly these seven functions.	🔵 planned	#1469
144	from code · few users · sometimes	🟨		Two pCloud accounts in different regions share one region value, so the last sign-in decides the host for both. pCloud tokens only work on the host that issued them, and connect and rclone export read the singleton oauth_pcloud_region, so the other account fails with an invalid token until it signs in again. The fix is a region per profile. Not reproduced.	🔴 confirmed	-
152	from code · some users · rarely	🟨		Tests that capture log lines with a thread-local subscriber can come back empty when another test in the same binary reaches the same log line first. tracing-core caches each call site's interest for the whole process: while one scoped subscriber is the only one registered, a call site first reached on another thread is cached as "never", and the capturing thread loses that line too. Measured on a new SCP log test (empty once in four runs of its file, fixed by running it alone in a child process with a process-wide subscriber). The same pattern is in tests/integration_delta_sync.rs (five captures in a 17-test binary) and in src/providers/filen/mod.rs (one capture in the library tests). Fix after 4.2.6 with the same isolation.	🔵 planned	-
165	observed · few users · sometimes	🟨		Filen Desktop's local S3 and WebDAV gateways acknowledge uploads that do not reach Filen for hours, and AeroFTP reports them as done. Measured 2026-11-05 to 11-06 (row 71 bench): six 256 MiB uploads acknowledged by the gateway in under 1 s were still missing from the Filen native API about 6 h later, behind a Desktop upload queue. AeroFTP treats the gateway acknowledgement as completion. To evaluate: a note on Filen gateway profiles that completion is local, and an optional verification against the native Filen API when the user has both profiles.	🔵 planned	-
171	from code · few users · sometimes	🟨		A MEGAcmd bulk folder download also fetches files another client adds to the folder after the admission listing. They land in private staging and are never published (the record check is exact), but they cost disk and bandwidth; list again right after the get and discard on a change, or cap the get by the listed total. Found in review of #1513.	🔵 planned	#1513
173	from code · few users · sometimes	🟨		An S3 endpoint is mapped to a provider by substring before domain boundaries, so a bucket-qualified host whose bucket names another vendor gets the wrong provider. For example backblaze-backup.s3.us-east-1.amazonaws.com maps to Backblaze in the frontend and idrivee2-copy.s3.filebase.io to IDrive in Rust, with the wrong logo and provider behaviour; one boundary-matched host table shared by the frontend and Rust, with a parity test. S3-wide class found in review of #1512. The frontend side (one shared host map with anchored patterns) landed in #1525; the Rust bridge side is still open.	🟡 in review (Orion L1 frontend table in #1525; Rust bridge side with Star L2)	#1512, #1525
205	from code · some users · sometimes	🟨		Owner decision: should import and --strict treat WebDAV automatic HTTP as a relaxation? A WebDAV profile with the automatic scheme picks HTTP on port 80 or a LAN host, by the documented rule for every WebDAV profile, created or imported. Treating it as a relaxation would make import reset it and --strict refuse it, which changes how existing profiles connect. Raised in the CodeRabbit review of #1524 on 2026-11-07.	🟡 owner decision	#1524
12	from code · some users · rarely	🟧		A replacement that is slow and still in progress can pass the reading that decides whether to publish. That reading retries once; if the server is still writing the new version, the second reading can see an intermediate state. Neither the unit test nor the live reproduction covers it, because both replace in one write.	🔵 planned	#885
51	observed · some users · rarely	🟧		WebDAV Digest: parallel requests fail on a server that enforces nonce-count order. Parallel connections share one Digest challenge and their nonce counts arrive out of order; Apache with AuthDigestNcCheck On (not its default) refuses some: a Compare walk misses 56-70 of 331 folders, get/put --parallel 8 fail 27-36 requests, always reported (rc 4). Serial runs are clean.	🔵 planned	#1080
93	from code · some users · rarely	🟧		Two profiles that sync the same pair of folders share one sync history. The sync index and the resumable journal are keyed by the local and remote folders only, so a second profile on another server that syncs the same pair overwrites the first one's baseline, and on main reads it as its own. #1352 (open) records the profile in each history and refuses another profile's, which turns the worst case into a lost baseline; the remaining fix is one history per profile, which renames every history file (CLI sync, AeroCloud, journals, the History dialog, the Proton mode switch). Found by the review of #1352.	🔵 planned	#1352
148	open question · few users · always	🟧		FileLu keys limited to one folder. FileLu now issues API keys with permissions and a folder limit; with such a key the root (fld_id=0) is refused, and the provider starts every lookup from the root. Not yet tried with AeroFTP: needs a key created on the FileLu site, then root handling for that folder. Asked FileLu whether /apiv2 paths are relative to the key's folder.	🟡 investigating	#1481
178	from code · some users · sometimes	🟧		The transfer scheduler classifies 503 and 421 from the message text, because the HTTP status is lost before error.rs. Carry the status in ProviderError so the retry decision reads the code. Part of the Requested 164 class.	🔵 planned (Sumo L1, after the Requested 164 follow-up)	#1517
179	from code · some users · sometimes	🟧		The FTP session pool decides on flattened FtpManagerError strings. A typed pool error lets it tell a dead session from a refused command without reading text. Part of the Requested 164 class.	🔵 planned (Sumo L1, after the Requested 164 follow-up)	#1517
202	from code · few users · sometimes	🟧		An encrypted overlay on an FTP profile with a relative start folder can point at the wrong folder. A relative FTP start folder such as docs opens under the FTP login folder, but its overlay scope still anchors at /docs, so the overlay may not cover what the connection opened. FTP has no reliable ~; anchor the scope at the folder the connection actually opened, and give the CLI and AeroCloud the same anchor. The SFTP and SCP side is fixed in #1523. Found by the #1523 sweep on 2026-11-06.	🔵 planned (Star L2, after #1523)	#1523
72	from code · some users · rarely	🟥		Preserve literal Unix filenames across sync/watch/GUI. The scoped native/IPC repair is merged in #1325 after #1324 fixed recursive put; exact literal/nested names, Windows roots, parent creation and escaped ignore traversal are covered. Adjacent vault/backup representations and provider-specific grammar contracts remain separately classified; canonical Unicode correspondence is merged in #1328, with final macOS/SFTP confirmation tracked in #1327 (the internal duplicate #1326 is closed).	🟡 adjacent contracts remain	#1325, #1327
177	from code · some users · sometimes	🟥		A server-side copy that the server refuses falls back to download and upload only when the refusal text matches. Providers should return NotSupported on 501/405 or a cross-scope refusal, so copy_fallback decides on the error kind; this touches every provider with server-side copy. Part of the Requested 164 class.	🔵 planned (Sumo L1, after the Requested 164 follow-up)	#1517
25	from code · few users · rarely	🟨		Line-ending follow-ups after the .gitattributes: drop the hand CRLF normalisations in the tray badge and checksum matrix tests once existing Windows development clones are refreshed, and move LICENSE to the LF rule only if the NSIS license page is shown to render LF text correctly on Windows.	🔵 planned	#1051
156	from code · few users · rarely	🟨		Note that AeroFTP does not open MPTCP sockets, in the threat model. A radar of 2026-11-01 cites CVE-2026-98432 (Linux kernel, a use-after-free reached through MPTCP listeners) and rclone turning MPTCP off. Checked on main: our sources ask for no MPTCP, and across the locked dependencies only libc, linux-raw-sys, rustix, socket2 and netlink-packet-route define the constants, with no Protocol::MPTCP in use; one package was not in the local registry. The CVE itself is not verified here.	🔵 planned	-
169	from code · few users · rarely	🟨		A manual AeroCloud "Sync now" before the first background cycle does not learn the provider's scan traits, so the next full scan ignores the provider floor (today only Tigris, 30 min). Learn the traits from the manual run's report as the background path does; the cost is at most one extra full LIST. Found in review of #1512.	🔴 confirmed	#1512
176	from code · few users · sometimes	🟨		The rclone export drops the stored path-style or virtual-host choice for every S3 preset except Tigris. force_path_style is written only in the Tigris branch, and rclone defaults Other, MinIO and Ceph to path style, so a profile saved as virtual-host exports as path style. S3-wide class found in review of #1512.	🔵 planned (bridge area, Star L2)	#1512
191	from code · few users · rarely	🟨		Peer transfer and the file server can be held or overloaded: a serial receiver with no deadline, and a one-byte range that downloads the whole object (items 83, 118; hardening 82, 114). CodeRabbit deep scan of 2026-10-27, re-verified on 2026-11-06.	🔵 planned (Star L2, after Requested 190)	-
157	from code · few users · rarely	🟧		Three dependency cleanups for after 4.2.6: zip 9.2.1 with sevenz-rust2 0.24.2 drop a lzma-rust2 copy, libunftp 0.24 with fuser 0.18 drop a nix copy, and keyring 4 may drop unmaintained crates. The first is a lockfile-only change, tried on 2026-11-01 but with no test run; no advisory names those versions. The others need a manifest edit, and keyring touches the credentials, so each gets its own PR. Reported by a radar of 2026-11-01; the crates keyring would drop are not verified.	🔵 planned	-
160	observed · few users · sometimes	🟧		Compare shows one row per name when Google Drive holds several files of one name. Measured on 2026-11-02: the panel counts 543 entries, Compare 483, with 60 duplicate names and nothing that says so. Read on main at e6baeeed0, not measured: the GUI Compare lists Drive one folder at a time and keys rows by path, so the row is the copy listed last (walk_compare_remote_serially); the CLI sync, check and reconcile scan keeps the copy listed first (scan_remote_dir, whose comment takes a repeated name for the same file counted twice). A Mirror then downloads, replaces or trashes by path, which resolves to the first exact hit of a separate name search (find_by_name): the copy it acts on need not be the one compared, and the others stay, so a trashed name comes back in the next Compare. Neither query sets orderBy, so which copy comes first is Drive's order. rclone also keeps the first entry (a stable sort in fs/march/march.go), but logs Duplicate object found in source - ignoring at NOTICE for each, and rclone dedupe resolves them (--dedupe-mode first, newest, oldest, largest, smallest or rename).	🔵 planned	-
170	from code · few users · rarely	🟧		After a MEGAcmd server restart during a bulk transfer, cancelling by tag can hit another transfer. Tags restart with the server, so a tag the bulk recorded may name a newer transfer; bind owned tags to the server session (its PID or start time) and skip the cancel after a change. Found in review of #1513.	🔵 planned	#1513
172	from code · few users · rarely	🟧		AeroCloud PreferLocal can upload again a file whose MEGA bulk upload was Uncertain when another client created a same-name file meanwhile, leaving two files. The scan keeps the last listing entry of a name; record Uncertain items in the AeroCloud journal and reconcile against every same-name entry before any re-upload. Found in review of #1513.	🔵 planned	#1513
190	from code · few users · rarely	🟧		Hostile storage can corrupt or truncate encrypted data: AeroCrypt unlock and overlay metadata, a zero block count that truncates an overlay, and an AeroVault plaintext member accepted (items 79, 84, 86; hardening 19). CodeRabbit deep scan of 2026-10-27, re-verified on 2026-11-06.	🔵 planned (Star L2, after Requested 183)	-
192	from code · few users · rarely	🟧		Hardening: unbounded parsers, AI arguments, special files and quadratic algorithms (items 7, 10 to 13, 31, 43, 68, 74, 85, 97, 98, 121; 89, 91 to 95; 100, 102 to 104; 101, 108, 120). CodeRabbit deep scan of 2026-10-27, re-verified on 2026-11-06.	🔵 planned (Sumo L1, after Requested 186)	-
193	from code · few users · rarely	🟧		Other hardening from the deep scan: TOCTOU, AWS INI export injection, serve over SFTP links, directory root trimming, the MEGA password in argv, crypt contexts that survive a lock, Windows update script variables, terminal control characters, the snap script, a /tmp IPC socket fallback for Nautilus and Nemo, log injection, and a reserved MCP OAuth prefix (items 32, 49, 54, 65, 71 to 78, 80, 88, 107, 112, 122; 4, 33 and 81 moved to Requested 185, 50 and 51 to 186, 27 to 182). Also two Snyk Code hardening items from 2026-11-06: check the scheme of the GitHub device-flow verification URL before opening it, and give the Vite dev-server prefix check a path separator. CodeRabbit deep scan of 2026-10-27, re-verified on 2026-11-06.	🔵 planned (Star L2, after Requested 191)	-

Higher-severity defects

Crashes, data loss, wrong file contents, or a security exposure. A row marked ⏳ waits on a step outside our code (an upstream release, or a crash we can trace); its note says what it waits for and what it means for you.

#	Likelihood	Difficulty	Type	Item	Status	Ref
27	observed · some users · sometimes	🟧		AppImage runtime with 0700 extraction folders: rechecked 2026-10-24: no dated type2-runtime release after 20251108 contains upstream 8f39b89e2 (#152); only continuous does (rebuilt 2026-10-19 at fedfad51a). Keep runtime 20251108 and its digest until a qualifying dated release exists; extracted runs still create folders 0755. Upstream #157 (open) restores the stored directory modes that #152 changed for --appimage-extract, and dated releases are requested in #140 (open since 2025-12). ⏳ Waiting for an upstream release: the fix already exists in the AppImage runtime and ships here as soon as a dated release contains it. Until then only the AppImage is concerned, and only when it is extracted instead of mounted (no FUSE, or --appimage-extract): its temporary folders can be read by other local users but not changed. The other packages do not use this runtime.	🔵 planned ⏳	#1072, #1104
183	from code · some users · always	🟧		Share-link restrictions are not applied on some providers. Dropbox drops the password and the expiry, Nextcloud does not send the password, a B2 token also opens sibling keys, and a failed Box revoke is reported as done (items 52, 64, 48, 110). CodeRabbit deep scan of 2026-10-27, re-verified on 2026-11-06.	🔵 planned (Star L2)	-
208	from code · some users · sometimes	🟥		An AeroSync run can delete or overwrite files on another server after a tab switch. The remote sync runner takes no target when a run starts and checks none before each write: mirror deletes, sidecar deletes, uploads and renames go to whatever the backend serves at that moment, and the profile id is only recorded in the journal. A tab switch, a reconnect or a cancelled connect during a run can therefore delete the same relative paths on another server. Snapshot the target at run start, check it (and that the backend serves it) before every write, and stop the remaining items with the reason, as the panel actions do since #1526. The same backend pin (the connection generation taken first and held to the end of each command) also covers the panel write commands that #1526 guards only in the window: upload and download of files and folders, mkdir, delete, rename and the OpenDrive and 4shared privacy calls, with two tests, a switch during Retry's overwrite prompt and a swap racing the command's provider acquisition (deferred from the #1526 reviews by owner decision). Found by the #1526 sweep on 2026-11-07.	🔵 planned (Sirio L1, after #1526)	#1526
187	from code · few users · sometimes	🟨		AI settings are global across user partitions, so one user can repoint another user's AI endpoint (item 8; hardening 44, 46). CodeRabbit deep scan of 2026-10-27, re-verified on 2026-11-06.	🔵 planned (Sirio L1, with Requested 181)	-
199	from code · few users · sometimes	🟨		A Tigris profile that asks for SSE-KMS uploads without it and reports success. Tigris does not take the aws:kms settings, so upload and copy requests leave them out, and an object the user meant to encrypt with a chosen key is stored without it. Kept on purpose in #1512 so imported profiles still work; the profile should instead say at connect and in the editor that the setting has no effect on Tigris, and a write should not claim the policy was applied. Open CodeRabbit finding on #1512, recorded on 2026-11-06.	🔵 planned (Orion L1, Tigris lane)	#1512
196	from code · few users · sometimes	🟧		AeroFTP serve can expose files outside the served root when the backend folder contains a symbolic link. The served path is checked as text, and links on SFTP, FTP or WebDAV backends are resolved by the backend server, not by AeroFTP; resolve and refuse only the entries the listing marks as links, using rclone serve as the reference. Deep-scan item 33, split from Requested 185 on 2026-11-06.	🔵 planned (Sumo L1, after item 14)	-
197	from code · few users · rarely	🟧		AI tools that check a local path and then open it again by path can act on a different file if the path is swapped in between. Uploads are pinned to the checked file by deep-scan item 27 (in Requested 184); the same check-then-reopen remains for local destinations (download_file, the GUI download_files, the archive extraction folder), the local readers (local_read, local_grep, the RAG index and search), archive sources, local copy, move and rename, the correction tools and the sync and transfer tree folders. Sources get the same pinned handle, destinations are written through a confined handle; this also closes the residual left in the AI recursive copy, which rereads the protected locations per folder (#1522) but can still race a retarget of ~/.ssh between that read and a write, and the THREAT-MODEL T-02 residual gets a sentence naming the recursive copy. Found by the item 27 sweep on 2026-11-06.	🔵 planned (Sirio L1, after Requested 184)	-
207	from code · few users · rarely	🟧		The local folder provider and the local copy still check a path and then use it, so a folder swapped in between can redirect a write. #1528 closes the reads and the upload truncation with handle checks, but a parent swapped between the check and an open can still leave a new empty file outside the root, a destination subfolder swapped after its per-level check is still a race, and on Windows the identity check compares canonical paths, not the handle. Resolve beneath the root in one step (openat2 RESOLVE_BENEATH or cap-std on Unix, handle identity on Windows), sharing one helper with the AI-tool destination confinement of Requested 197. The peer drive replica writes (peer-l0 drive.rs, #1529) have the same parent-swap residual and use the same helper; #1529 refuses world-writable folders, a sticky ancestor of a foreign owner and a foreign link in the given path, but a link inside a link's target (a link chain) is left to this resolution by owner decision (CodeRabbit r4500647428), with swap-and-restore tests for writes and deletions. Found in the CodeRabbit reviews of #1528 and #1529 on 2026-11-07.	🔵 planned (Sumo L1)	#1528
213	from code · few users · rarely	🟧		A peer-l0 replica rewrite keeps the file mode but not its ACL. On Linux a parent default ACL can grant a named user read access to the replacement even when the existing file denied it, and on Windows the attributes copied do not carry the ACL. Stage the data privately and give the replacement the existing file's effective access before it is published, with a test that uses different target and parent ACLs. Outside-diff Major in the CodeRabbit review of #1529 (review 5812308196, head aad8b97), left open at the merge by a coordinator error.	🔵 planned	#1529
5	observed · some users · rarely	🟥		Linux tray/GTK heap corruption, still-uncovered off-main-thread corruptor. A GDBus worker aborts with malloc(): unaligned fastbin chunk detected, the classic GLib heap-corruption signature, and it is the victim rather than the corruptor. Two marshalling fixes shipped in v4.0.5 and the SIGABRT still recurs with an identical signature, so the marshalling is incomplete and the remaining suspects are the event and plugin callbacks whose thread context is unconfirmed. Details. ⏳ Waiting for a crash we can trace: it is rare and so far seen only on development machines, with no report from users. If AeroFTP on Linux ever closes by itself with this message, please open an issue with the log: that is what lets us find the cause.	🟡 investigating ⏳	-

Known issues found after release

Reported against v4.2.6.

#	Likelihood	Area	Description	Status	Ref

Legend: 🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released · ⏳ waiting on an outside step (see the row's note)

Difficulty of a requested row (the colored square, not the status dot): 🟥 hard · 🟧 moderate · 🟨 light · 🟩 easy

Likelihood of a fix or defect row (Non-blocking, Higher-severity, Known issues): L = 1 + reach + trigger, capped by the evidence. Reach, who is affected: all users 2 (every user, on every platform, on a path everyone takes: startup, connecting, the transfer queue, the vault), some users 1 (one protocol family, one platform, Linux or Windows included, one package, one provider, or one optional feature), few users 0 (a niche: two of those restrictions together, a non-default setting, or nobody). Trigger, how often it happens to them: always 2 (every time, or in ordinary use), sometimes 1 (a specific but realistic condition), rarely 0 (a race, or a condition most users never meet). Evidence: observed (reproduced, measured or reported by a user), no cap; from code (derived from code or documentation), at most L3; open question, at most L2. For CI, build and test rows the user is the team. Priority = tier × L (Higher-severity defects 3, Non-blocking fixes 2): within each table rows are listed by priority, then lighter difficulty first. Rescore a row when its evidence changes.

Value of a feature or idea row: V = 1 + audience + gain. Audience, who would actually need and use it, not who would see it: most users 2 (every user, on a path everyone takes), some users 1 (a group: the users of one protocol family, platform, package, provider or optional feature), few users 0 (a niche, or a change nobody notices, such as an internal migration). Gain, against what AeroFTP is used for (moving, syncing, storing and protecting files): new capability 2 (not possible today), improvement 1 (an existing path made faster, clearer, safer or shorter, or a capability outside that job), nice to have 0 (an alternative view, a cosmetic change, a convenience nobody misses). The origin, requested (asked by a user or the owner), planned (on the roadmap) or proposed (our idea), is shown for reference and does not change the score: who asked does not measure who would use it. Features are listed by Value, then lighter difficulty first, and are not ranked against defects.

[axpnet]

Symlinked Downloads folders no longer block package updates

Post-4.2.6 follow-up, fixed on main, shipping in v4.2.7 (#1507).

Linux DEB and RPM updates now work when the XDG Downloads directory resolves through a symlink to another mount. The existing privileged helper receives a verified staged copy instead of rejecting the external path.

Area	Description	Status	Ref
Private staging	Verified packages are copied to a mode 0700 directory under /var/tmp. The copied digest must match before pkexec starts, and staging is removed after the helper exits.	🟢 fixed	aa0e47745
Async responsiveness	Initial artifact verification and package copy/hash run in spawn_blocking for both DEB and RPM installs, so slow external mounts do not hold an async worker.	🟢 fixed	aa0e47745
Regression coverage	A symlinked Downloads fixture passes through the real helper with a mocked installer. Tests also cover permissions, digest mismatch, missing sources and cleanup.	🟢 fixed	aa0e47745

Verified green: 82 Rust tests on the initial rebased head, the 3 focused regressions and strict Clippy again on the final head, 11 frontend verification tests, formatting and security regression. CodeRabbit completed the connected initial and incremental reviews with no actionable comments. Greptile confirmed the async finding fixed and reported 5/5 with no new issues. All seven applicable PR workflows and their Linux, Windows and macOS matrices passed on ff268d1a0; release-only jobs stayed skipped. The merge commit on main has the same tree as the reviewed head. No patched installed-build update was performed.

[axpnet]

Public guides now match the current client

Post-4.2.6 follow-up, done on main, shipping in v4.2.7 (#1508).

The public markdown in the repository described an older client. The pages now follow the revision that is on main.

Area	Description	Status	Ref
Transports and providers	Eight transports and 26 native integrations. The threat model cites 56 providers from the inventory on this revision.	🟢 fixed	f853a8954
FTP	Explicit and explicit-if-available both stop when the TLS upgrade fails. Neither continues in clear.	🟢 fixed	f853a8954
Audit pipeline	The self-hosted three-database report runs locally. CI runs cargo audit. CodeRabbit and Greptile are review, not a vulnerability scan.	🟢 fixed	f853a8954
CLI	scp:// is a direct URL. import winscp scans and prints sessions and does not write the vault.	🟢 fixed	f853a8954
Providers	Blomp storage is plain HTTP. FileLu version delete is the version API, not the trash purge.	🟢 fixed	f853a8954
Roadmap and inventory	IPFS is in flight. The command inventory app_version is 4.2.6. Counts are unchanged.	🟢 fixed	f853a8954

Verified green: aeroftp-cli inventory --check on the binary built from this revision. Format, audit and unit tests, sign-off, and CLI smoke on Ubuntu, macOS and Windows passed in CI on 423b21edb. CodeRabbit and Greptile left no actionable comments. Socket passed, and Snyk passed with no manifest changes. Coverage and cargo-install-smoke stayed skipped on the pull request, because those jobs run on main. The merge commit on main has the same tree as the reviewed head.

[axpnet]

FileLu times now show the real time, and the CLI reaches the FileLu trash

Post-4.2.6 follow-up, fixed on main, shipping in v4.2.7 (#1509, Requested 147).

FileLu writes listing, version and trash times on the America/New_York clock without a zone, and AeroFTP read them as UTC, so every FileLu time showed 4 or 5 hours early (a file uploaded at 10:31 UTC was listed at 05:31). The trash age had also moved to a new field and was always empty.

Area	Description	Status	Ref
Listing and versions	The exact FileLu shape is converted to a UTC instant at the provider boundary, through the single time parser and plain chrono arithmetic: US daylight rule since 2007, the repeated November hour read as daylight time first, no new dependency.	🟢 fixed	f66d85791
Trash age	deleted_ago_hours (sent as a string) is now read into the trash age, which was always empty before.	🟢 fixed	f66d85791
AeroCloud receipts	Upload receipts saved before the fix carry no time-format flag; they are compared only through the old reading, so a file uploaded before the update is not re-uploaded, and are rewritten with the real time in the first saved cycle of their own scope. Receipts of other providers are untouched.	🟢 fixed	f66d85791
CLI trash	aeroftp-cli trash list, restore, delete and empty reach the FileLu trash, with sanitized names, and exit 5 when an empty leaves entries behind.	🟢 fixed	f66d85791
Tests	The timezone label test pins the vitest pool it relies on and fails clearly if the pool changes.	🟢 fixed	f66d85791

Sync with FileLu stays size-only, since FileLu keeps no comparable mtime precision: the fix changes what users see and the receipt matching, not the sync decision.

Verified green: cargo fmt, clippy --all-targets --features test-seed -D warnings, the cloud_service suite 150 passed 0 failed, typecheck, i18n validate (0 placeholders), diacritics, untranslated, provider inventory, unit tests 340 files / 3331 tests; full CI on the merged head.

[axpnet]

Vault writes from several AeroFTP processes no longer lose credentials, and S3 gateways connect in a fraction of a second

Post-4.2.6 follow-up, fixed on main, shipping in v4.2.7 (#1510, Requested 162 and part of Requested 71).

The GUI, the CLI and the MCP server each rewrote the whole credential vault through one shared temporary file and an in-process lock only, so two processes saving at the same time could fail a save or drop each other's change (observed: a OneDrive token refresh failed with vault.db rename failed during a parallel connect sweep). Separately, connecting to an S3 gateway that lists recursively (Filen Desktop's rclone serve s3) walked the whole bucket on every command.

Area	Description	Status	Ref
Cross-process vault lock	Every vault and key-file write takes one guard: the in-process mutex plus a file lock on vault.db.lock, within a single 10 s deadline ("vault busy" after it). Each write uses its own temporary, and orphaned temporaries are removed under the lock.	🟢 fixed	944389e1c
Key file and keyring	vault.key is re-read under the lock before every change; the master-password enable, change and disable paths load the keyring and derive the key before the lock, so no path waits for the vault while holding the keyring claim (checked by a debug assertion). A claimed keyring account is given back on every error exit, but kept once vault.key names it.	🟢 fixed	944389e1c
Stale or replaced vault	A process with an outdated key cannot write entries into a vault another process reset, and a missing vault.db is created only for the vault.key it came from; opening follows the mode vault.key has at that moment.	🟢 fixed	944389e1c
Async workers	Token refreshes and every vault write wait for a busy lock off the async workers; the active user is read before the write, so a user switch during the wait cannot move a credential.	🟢 fixed	944389e1c
S3 connect probe	The probe lists with delimiter=/ on every preset, so a gateway that walks recursively answers at once (Filen S3 connect measured 6.39 s before, 0.14 s after).	🟢 fixed	944389e1c

Row 71 numbers measured for this change (release builds, concurrency 4): Filen WebDAV showed no AeroFTP-side cause; Filen S3 lost about 7 s per command to the probe walk before the fix.

Verified green: cargo fmt, clippy --all-targets --features test-seed -D warnings, the vault, user partition, profile auth and S3 suites (436 passed on the round-2 head, 216 on the final lock-order head, 49 on the final key-file head, 0 failed), typecheck, i18n validate, unit tests; full CI on the merged head, including a rerun of a macOS DMG bundling flake.

[axpnet]

Connecting a second profile no longer leaves the previous session half alive, and a cancelled FTP command ends at once

Post-4.2.6 follow-up, fixed on main, shipping in v4.2.7 (#1511, Requested 58).

Connecting a second saved profile from My Servers kept the previous session active while its backend was already being closed, so the panels that follow the active session showed the old connection for that moment. Planning the fix turned up several related defects on the same path, all fixed here.

Area	Description	Status	Ref
Park on connect	Every connect started from My Servers, Quick Connect, OAuth and 4shared parks the live tab the way the new-tab button already did, right before the old backend is closed and after the host key check; the remote list, selection, search and quota work of the parked session are cleared.	🟢 fixed	d7702d142
Cancel and failure	A cancel or a failed connect keeps every tab instead of clearing them all, and the tabs it keeps are shown as parked, since their backend is closed.	🟢 fixed	d7702d142
Reconnect a parked tab	A tab, its My Servers card, Active Sessions or a transfer resume reconnects a parked session for real, shows it connected only after success, and parks it again on failure, cancel or a refused host key, so a later click retries. A stall in the reconnect listing has its own Cancel.	🟢 fixed	d7702d142
Encrypted overlays	A parked tab with an AeroCrypt or rclone-crypt overlay keeps it while it reconnects; the overlay is cleared on cancel, failure or disconnect.	🟢 fixed	d7702d142
Portable devices	Opening, closing or detaching a portable device no longer replaces or empties the tab list, and a detach does not disconnect another server's provider.	🟢 fixed	d7702d142
FTP abandoned commands	A listing, path or folder change cancelled before its reply leaves the control channel out of step; disconnect then closes without QUIT (no 5 s wait), and the next command on that session redials instead of reading the late reply. A login whose PWD times out fails and closes.	🟢 fixed	d7702d142

Known limits, written in the PR: the breadcrumb shows the old path until the new listing lands; the OAuth and 4shared form parks a moment late; a device tab is closed rather than parked. The navigation cleanup for "+" and the device open, and a cancelled switch between two live tabs, follow in Requested 163.

Verified green: cargo fmt, clippy --all-targets --features test-seed -D warnings, the FTP suites with the source guards (313 passed, 0 failed), typecheck, i18n validate, unit tests 341 files / 3355 tests, security regression; the parked-tab cases checked live on an isolated dev GUI with local FTP servers and an AeroCrypt overlay; full CI on the merged head.

[axpnet]

Tigris joins the S3 presets

Post-4.2.6 follow-up, done on main, shipping in v4.2.7 (#1512).

Tigris is now a ready S3 preset: static endpoint t3.storage.dev, region auto, virtual-host addressing, with its catalog row, grid tile, logo and Discover text in every language.

Area	Description	Status	Ref
Connection	Current and legacy Tigris hosts are recognised by domain before the generic vendor rules, so a backblaze-* bucket on Tigris is not taken for Backblaze.	🟢 done	756510e83
Rename	Folder rename uses Tigris metadata rename where available; a copy that fails halfway keeps the objects already moved safe, and the message never advises clearing the destination.	🟢 done	756510e83
Usage	Storage usage is read from the Tigris API where the key allows it, with the cached figure, manual cap and opt-in scan as fallbacks; 429 and 5xx are reported as server errors, not as "not supported".	🟢 done	756510e83
Trash and versions	Soft-deleted versions show in the trash and in empty-trash on buckets with soft delete.	🟢 done	756510e83
Bridges	rclone export as Other with explicit region and addressing (path style by default for dotted buckets), rclone import of a Tigris remote without a region gives auto.	🟢 done	756510e83

Known: the docs page providers/tigris is published before the release that ships this preset. Three app-wide findings from this review are tracked as Requested 167 (encoding class, in review), 168 and 169; S3-wide classes as Requested 173 to 176.

Verified green: cargo fmt, clippy --all-targets --features test-seed -D warnings, the S3, bridge, rclone import, profile loader and dedup suites (426 passed on the final head, red first on the review fixes), typecheck, unit tests, i18n validate and the former-English ledger; read-only and fixture live tests on two Tigris test buckets, fixtures removed; full CI on the merged head.

[axpnet]

MEGA bulk transfers at native speed, and fewer Proton CLI launches per command

Post-4.2.6 follow-up, done on main, shipping in v4.2.7 (#1513, closes Requested 71 together with #1510).

Requested 71 asked where the time goes when AeroFTP drives a vendor tool or a local gateway. #1510 shipped the WebDAV and S3 gateway part; this change closes the MEGAcmd and Proton Drive CLI part. Release builds, concurrency 4, medians of 3.

Area	Description	Status	Ref
MEGA uploads	A group of new files goes up with one mega-put, each file proven by its own transfer tag, terminal state and listed size; files that cannot be proven are reported uncertain and never replayed. 20 x 4 MiB: 8.0 to 11.3 s, on par with MEGAcmd used directly (7.8 to 11.2 s).	🟢 done	ccf3f4be9
MEGA downloads	A whole folder (up to 256 files) comes down with one folder mega-get into private staging, and a file is published only on a completed transfer at its listed size. 20 x 4 MiB: 8.4 to 9.0 s, against 11.5 to 14.7 s before and 8.5 to 8.7 s for MEGAcmd directly.	🟢 done	ccf3f4be9
Safety	Cancellation touches only the transfers AeroFTP started (never -a), staging is kept while the server may still write into it and is hidden from sync scans, and a group the bulk path would refuse keeps the parallel workers.	🟢 done	ccf3f4be9
Capability truth	MEGAcmd sessions no longer claim download resume, which their single-file path never did.	🟢 done	ccf3f4be9
Proton Drive	Connect needs one proton-drive launch instead of two, an existing folder is recognised by listing its parent instead of by an English message, and a bulk download reuses the planning listing: an upload into an existing folder went from 6 launches to 4, a download from 4 to 3 (about 3.6 s before the transfer instead of 5).	🟢 done	ccf3f4be9

The spread in Proton downloads of many small files (18 to 44 s) also shows with the official CLI, so it is on the Proton side. Follow-ups opened from the reviews: Requested 170, 171 and 172.

Verified green: cargo fmt, clippy --all-targets --features test-seed -D warnings, the MEGA, Proton, bulk, transfer and scan suites (443 passed on the final head), replay tests on real MEGAcmd 2.6 output, typecheck, unit tests; live benchmarks in two clean windows with test fixtures removed afterwards; full CI on the merged head.

[axpnet]

A tab switch acts on its own server, and the takeover leaves no spinner or stuck tab behind

Post-4.2.6 follow-up, fixed on main, shipping in v4.2.7 (#1514, Requested 166 and 163).

Requested 166 was found while testing Requested 163 live: switching to a tab could reuse another server's live connection when two profiles used the same username, so the tab showed the other server's files and an upload, delete or rename would have gone there.

Area	Description	Status	Ref
Live connection check	The probe that decides whether a tab's connection is still alive now compares the profile and the endpoint (host, effective port, S3 bucket, endpoint and region, WebDAV path), not only protocol and username. Providers with a fixed API host keep matching by profile and user, so MEGA or Internxt do not ask for 2FA again.	🟢 fixed	491888054
Stalled probe	The probe has a 5 s limit that also covers waiting for the provider lock; a stall falls back to a real reconnect with a Cancel on screen.	🟢 fixed	491888054
Takeover	"+", a portable device and the OAuth or 4shared sign-in release the spinner and the navigation latch of a listing in flight.	🟢 fixed	491888054
Cancelled switch	A switch between live tabs that fails or is cancelled (including a controller or agent Stop) leaves the target parked and nothing active, so a click retries; the tab left behind shows as parked instead of connected.	🟢 fixed	491888054

Verified green: cargo fmt, clippy --all-targets --features test-seed -D warnings, the provider command, provider type and source-guard suites (261 passed on the final head), typecheck, unit tests 343 files; live on an isolated dev build with two local FTP servers sharing one username, where actions land on the right server; full CI on the merged head.

[axpnet]

Object names with spaces and special characters are encoded exactly once everywhere

Post-4.2.6 follow-up, fixed on main, shipping in v4.2.7 (#1515, Requested 167).

A share link or a listing could encode an object name twice, or not at all, depending on the provider. The fix covers the whole class found in a sweep of every signer and link builder.

Area	Description	Status	Ref
S3 share links	Both S3 signers use one canonical path (decode each segment, encode once), so a share link for a name with a space, +, %, & or non-ASCII characters no longer fails with SignatureDoesNotMatch. Checked against the AWS documentation vectors.	🟢 fixed	d508eb0fe
Filen listings	Search, versions and listings ask for encoded keys and decode only when the gateway confirms the encoding, so a file literally named report%20final.txt is no longer read as another name, and a delete cannot hit a different object.	🟢 fixed	d508eb0fe
Azure	Blob names are encoded once on the wire, so # or ? no longer cut the URL and a literal %41 no longer reaches blob A.	🟢 fixed	d508eb0fe
OAuth 1	Query values are decoded before signing, sorted by encoded name and kept when repeated (RFC 5849 vector). No caller is affected today.	🟢 fixed	d508eb0fe

Verified green: cargo fmt, clippy --all-targets --features test-seed -D warnings, the S3, Azure, OAuth 1 and 4shared suites (387 passed, the six class tests red before the fix), typecheck, unit tests; a read-only probe on the Filen gateway; full CI on the merged head.

[axpnet]

rclone round trips through the bridge keep buckets, keys and TLS choices

Post-4.2.6 follow-up, fixed on main, shipping in v4.2.7 (#1516).

A live round trip of every production profile through the rclone bridge (export to rclone.conf, import back) found places where a remote came back different from what went out. They are fixed together, each against rclone's own behaviour.

Area	Description	Status	Ref
Export	FTPS keeps a disabled certificate check, Swift writes the host the native provider dials (the password no longer goes to another service), Blomp, Swift v2 and tenant settings survive, B2 aliases keep their bucket, an SFTP root exports as remote:/.	🟢 fixed	9fe735ab8
Import	Aliases resolve their container from the path (rclone ignores container = there), keep the OAuth app of the remote they open, refuse SharePoint and rooted Drive aliases instead of opening the wrong drive, keep a leading space in a path, and read booleans the way rclone does. Key files expand environment variables, a blank root_folder_id is not a root, and WebDAV keeps its scheme and default port.	🟢 fixed	9fe735ab8
Crypt	A crypt scope under a pinned bucket or an SFTP home path (~/x) stays correct.	🟢 fixed	9fe735ab8

Verified green: cargo fmt, clippy -D warnings, the rclone import, bridge and source-guard suites (158 passed on the final head), the CodeRabbit CLI; a live, read-only round trip of the production profiles with rclone 1.75.2; full CI on the merged head.

[axpnet]

The snap lists only shared volumes and ends a refused start cleanly

Post-4.2.6 follow-up, fixed on main, shipping in v4.2.7 (#1519).

Two snap defects measured live on L1 (Requested 136 and 137) are fixed together, both in the startup and volume code that strict confinement exercises.

Area	Description	Status	Ref
Volumes	Inside a strict snap the volume list counts only the mounts the snap shares with the host at the host's own path: removable media under /media, /run/media and /mnt, and network or FUSE mounts in the real home, each once. The snap's runtime binds and the hostfs copies no longer show. The EFI system partition is recognised by its partition type instead of a size rule, so a small FAT stick is listed again.	🟢 fixed	053062b85
Port in use	A start refused because the UI port is taken no longer deadlocks on a blocking dialog on the main thread: setup returns without a window, the dialog is shown without blocking and its answer ends the process, a desktop notification goes out, and a 30 second deadline ends an unanswered refusal. A second launch during the refusal or during the ownership check opens no window on an origin another process serves.	🟢 fixed	053062b85

Verified green: cargo fmt, clippy -D warnings on Linux, Windows and macOS (a Linux-only helper is now gated so Windows has no dead code), the source guards, full CI on the merged head (20 passed, 0 failed).

[axpnet]

Error outcomes are decided by markers, codes and listings, not by translated text

Post-4.2.6 follow-up, fixed on main, shipping in v4.2.7 (#1517).

A sweep on 2026-11-06 found about 25 places that decided an outcome from an error message, which changes with the language of the app, of the system or of a provider's own CLI. This change fixes the high-severity ones (Requested 140 and the first part of Requested 164); the medium ones follow in #1520.

Area	Description	Status	Ref
Transfer queue	A row the user cancelled carries a marker instead of being recognised by its translated label, so "Retry all failed" no longer re-runs stopped rows in any of the 47 languages.	🟢 fixed	d58c80061
Folders	A failed mkdir of a folder root is judged by the folder itself, not by the text of the error.	🟢 fixed	d58c80061
OS errors	The shared classifiers, the sync scan and the FTP redial check read the (os error N) code, so localized Windows and Linux messages classify the same way.	🟢 fixed	d58c80061
Providers	A Nextcloud link password follows the server capability; the batch circuit breaker uses the backend classifier; Proton Drive decides existence from one parent listing and reads the SDK error class first; MEGAcmd failures are classified by exit status.	🟢 fixed	d58c80061

Each change has a test that feeds localized messages and fails with the previous check.

Verified green: cargo fmt, clippy -D warnings, the focused suites and source guards, full CI on the merged head.

[axpnet]

November security audit snapshot

Post-4.2.6 follow-up, on main, shipping in v4.2.7 (#1518).

A fresh run of cargo audit, npm audit and osv-scanner on main, published as the November row of the security report.

Area	Description	Status	Ref
Advisory	The one open advisory, tokio 1.53.1 (RUSTSEC-2026-0386) in the fake-portal test helper, moves to tokio 1.54.1 like the app lock.	🟢 fixed	79ebb33b5
Ignores	audit.toml drops 16 ignores that no longer match anything, and the RUSTSEC-2024-0429 rationale now names glib::VariantStrIter, which AeroFTP never calls.	🟢 done	79ebb33b5
Report	Each OSV finding counts once per package version (or commit, for a git submodule) and advisory across lockfiles, and the scanner's paths resolve against the repository root, pinned by a test in checks.yml.	🟢 fixed	79ebb33b5
Docs	README and SECURITY.md carry the new row and say what each scanner covers.	🟢 done	79ebb33b5

Result on main plus these changes: 0 open and 25 suppressed findings, with cargo audit --deny warnings clean.

[axpnet]

Dependency patches and CI hardening from the Aikido re-scan

Post-4.2.6 follow-up, on main, shipping in v4.2.7 (#1521).

Area	Description	Status	Ref
Dependencies	Targeted lockfile updates: mio 1.2.4 (a Windows named-pipe use-after-free, reachable through the sync badge server), zerocopy 0.8.63, quinn-proto 0.11.19 and the flagged peer-l0 set. The pest family is lock-only (the optional ratatui-termwiz backend is not enabled), so nothing new is compiled. Tauri, zbus and WebKitGTK do not move.	🟢 done	f2ed8e894
Checkouts	Every actions/checkout sets persist-credentials: false, guarded by a checks.yml test that fails on any checkout without it under with:.	🟢 done	f2ed8e894
Pins	The remaining tag-pinned actions are pinned to commit SHAs.	🟢 done	f2ed8e894
apt-install	The cache prefix reaches the script through env, a prefix with a newline or carriage return is rejected before any write, and its regression test, written for #1367 but never run, now runs in checks.yml.	🟢 fixed	f2ed8e894
Smoke test	The upload-artifact smoke test now fails when a runner's artifact is missing.	🟢 fixed	f2ed8e894

[axpnet]

The remaining provider outcomes are decided by codes, headers and listings

Post-4.2.6 follow-up, on main, shipping in v4.2.7 (#1520).

The second half of the 2026-11-06 sweep (Requested 164): the medium-severity places that still decided an outcome from error text now read something that does not change with the language. The high-severity half shipped in #1517 (queued row 12).

Area	Description	Status	Ref
S3	Clock skew is told from expired credentials by the error code (an ExpiredToken was retried as skew); an AccessDenied with a skew message is recognised.	🟢 fixed	2fb547e24
GitHub	A branch created meanwhile is found by a second lookup, a spent quota is read from x-ratelimit-remaining, and a failed recovery lookup keeps its own error.	🟢 fixed	2fb547e24
MEGAcmd, Drime, Jottacloud	MEGAcmd's not-logged-in exit status decides; Drime decides a taken folder by the listing and auth by 401; Jottacloud reads invalid_grant from the OAuth error field.	🟢 fixed	2fb547e24
FTP	A dropped connection is redialled for reads only, and an upload is never resent after it; a Windows connection abort (10053, 10054) no longer widens the write-replay rule.	🟢 fixed	2fb547e24
Proton, WebDAV	An unconfirmed absence on Proton is a failure, not "missing"; WebDAV names a failed capability lookup without echoing the raw error, and a server that echoes a generated password does not leak it into the error.	🟢 fixed	2fb547e24
Circuit breaker	Failure decisions run one at a time, in order.	🟢 fixed	2fb547e24

Verified green: cargo fmt, clippy -D warnings, the provider suites and source guards, the Windows-only connection-abort test on Windows CI, full CI on the merged head.

[axpnet]

The docs site follows the app: 4.2.6 alignment and the Tigris guide

Post-4.2.6 follow-up, live on docs.aeroftp.app (docs #26, docs #28).

From this release on, the docs site's changes are logged here too, next to the app changes they document.

Area	Description	Status	Ref
4.2.6 alignment	The version nav points at the 4.2.6 release page; SCP is documented as its own transport (with the SFTP fallback and the WinSCP mapping) and OpenStack Swift has its own page; each transport page opens with what the protocol is, who designed it and how a transfer works; present-tense counts come from the provider inventory at v4.2.6.	🟢 live	93362fd14
Tigris guide	providers/tigris: credentials and bucket, the fixed endpoint and region, dotted bucket names, integrity, the metadata rename and its fallback, trash and versions, the storage usage figure in the app and in aeroftp-cli df, the 7 day share link limit, encryption and troubleshooting. It is live before the release that ships the preset (queued row 6).	🟢 live	b19ae619b

[axpnet]

AeroCloud page: the wizard as it is since 4.2.4

Live on docs.aeroftp.app (docs #27).

Area	Description	Status	Ref
Wizard steps	The AeroCloud wizard is described as it works since 4.2.4: three steps on a server already saved in My Servers (cloud name and local folder, the saved profile, sync settings). The page says that 4.2.3 and earlier used a four-step wizard with protocol selection and connection fields.	🟢 live	28d2a46f9
Offered integrations	The server step lists only profiles of an integration the wizard offers: the table plus Backblaze B2, ImageKit, Uploadcare and Cloudinary, the same list the app uses. Google Drive, Jottacloud and 4shared stay out of the wizard until a saved profile passes its live connect check.	🟢 live	28d2a46f9
Remote folder	A sub-folder (cloud by default) of the profile's starting folder, or of the folder its AeroCrypt overlay is bound to. Uploadcare has no folders, so the field is cleared there and AeroCloud syncs at the profile's base.	🟢 live	28d2a46f9

[axpnet]

Path escapes, link following and shared temporaries (Requested 185 and 186)

Merged as e08c39d52, #1528, ships in the next release.

Area	Description	Status	Ref
Destination escapes	AeroVault extraction and sync refuse entry names that leave the destination (drive-qualified ones on Windows included) and entries through a link inside it; a cross-profile plan refuses listed names that climb out of the target folder.	🟢 queued	e08c39d52
Links and temporaries	A local delete or move no longer follows a symbolic link into its target, a cross-device folder move recreates nested links instead of losing them, local reads open without following links and are bounded, and temporary files are created privately instead of at a predictable shared path.	🟢 queued	e08c39d52
Residual	A folder swapped between a check and an open is the scope of Requested 207 (resolution beneath the root in one step).	🔵 planned	Requested 207

[axpnet]

rclone bridge review and the SFTP login folder (follow-up to #1516)

Merged as c501dcfae, #1523, ships in the next release.

Area	Description	Status	Ref
Bridge review (RCB-01 to 04)	No exported rclone sections nest across a dot; imports are size-capped and alias expansion is bounded; an imported Filen API key goes into the vault and never into a profile or an export; crypt secrets and the SFTP key passphrase keep their exact bytes.	🟢 queued	c501dcfae
SFTP login folder	A relative SFTP or SCP folder (nas:docs) opens under the login folder, and every overlay reader (window, CLI, MCP, AeroCloud, export and import) reads it as ~/... and places it through the live session before comparing.	🟢 queued	c501dcfae

[axpnet]

A stray backdrop click no longer loses work or answers a prompt (Discussion #1527, part 1)

Merged as 324387b33, #1530, ships in the next release. Requested by @456vv in #1527.

Area	Description	Status	Ref
Decision prompts	Overwrite, host key, delta eligibility, AeroShare activation, keystore migration and the GitHub sync warning no longer take a decision on a backdrop click; ESC gives the safe answer.	🟢 queued	324387b33
Work and results	AeroSync (during a compare scan, a sync or a restore, and while a result is shown), cross-profile transfer, an open vault, speed test, server health check, vault sync, the transfer plan, share link and TOTP setup close only from their own button.	🟢 queued	324387b33
ESC	One topmost-only ESC owner: a dialog over another takes ESC first, and a hidden dialog claims none.	🟢 queued	324387b33

[axpnet]

AeroAgent: the approval shows what it authorizes, and every path and target is checked (Requested 181 and 182)

Merged as 17e0c5b25, #1522, ships in the next release.

Area	Description	Status	Ref
Approval	The approval shows every value whole and escaped, and a session grant covers only the arguments it was given.	🟢 queued	17e0c5b25
Paths	The file tools check the policy on every path they touch, as given and canonical, so a protected folder (~/.ssh, ~/.aws, ~/.docker) cannot be read or sent through a link or a different spelling.	🟢 queued	17e0c5b25
Targets	An approved change runs on the approved profile, resolved by its id with its connection identity (including the provider options, so a changed bucket or region voids the approval), never by a name lookup; transfers and the CLI and MCP pools use the same identity.	🟢 queued	17e0c5b25

[axpnet]

peer-l0 replica: never written or deleted through a link (Requested 186, deep-scan item 14)

Merged as 6eabfb450, #1529, ships in the next release.

Area	Description	Status	Ref
Links	The replica refuses to write or delete through a link inside its folder, resolves its root once to the real path (a chained link included) and works only there afterwards.	🟢 queued	6eabfb450
Folder guard	A replica folder that anyone can write to is refused, on its path as given and as resolved and above it (a sticky folder only when it belongs to root or to the replica's owner, and each link on the given path likewise); a group-writable folder gets a warning.	🟢 queued	6eabfb450
Private and resilient	A decrypted file is created private (0600) from the first byte, an existing file keeps its mode, folders are created 0700; a failed write is retried on a fixed schedule and held back from "live", a key never applied is never deleted, and a file already gone counts as deleted.	🟢 queued	6eabfb450
Residual	The check-to-write race and a link inside a link's target outside the given path stay in Requested 207 (per-component no-follow opens).	🔵 planned	Requested 207

[axpnet]

S3-wide classes from the Tigris and Fastly reviews (Requested 173, 174, 175, 200)

Merged as 5b559afea, #1525, ships in the next release.

Area	Description	Status	Ref
Share links	S3 share links are capped at the 7 days SigV4 allows on every preset, and the modal offers only what the provider accepts; a date-only expiry is shown in local time, and an untouched preselected expiry no longer asks to discard.	🟢 queued	5b559afea
Dotted buckets	A bucket with a dot in its name uses path-style addressing instead of failing TLS on the wildcard certificate.	🟢 queued	5b559afea
Endpoint and region	An S3 host is matched to its preset on a domain boundary from one shared table (s3-host-map.json, with anchored, linear host patterns guarded by a test), and an imported profile's region follows its endpoint when the two contradict.	🟢 queued	5b559afea
Residual	The Rust bridge side of the host map (Requested 173) is still to come.	🔵 planned	Requested 173

[axpnet]

Fastly Object Storage setup guide on the docs site

Live on docs.aeroftp.app (docs #29).

Area	Description	Status	Ref
Fastly guide	providers/fastly-object-storage: account and card requirements, the 12 regional endpoints and signing regions, path-style addressing, the 16 MiB single-PUT cutoff and 8 MiB multipart parts, unsupported versions, object tags and trash, the 30-minute AeroCloud full-scan interval, the 7-day presigned link cap, and troubleshooting.	🟢 live	554749db8
Plan card and route test	Adds the Fastly plan entry with its separate monthly allowances (1,000 Class A and 10,000 Class B operations, card required) and a Node test that pins the plan table route and guide card id to /providers/fastly-object-storage.	🟢 live	554749db8

[axpnet]

Transfers and AI actions stay on the server and file the user chose (Requested 184 and 212)

Post-4.2.6 follow-up, fixed on main, shipping in v4.2.7 (#1526).

Apply, queued transfers, AI uploads and editor saves now retain their intended target across tab switches and reconnects. A refused source or changed destination stops the action before a remote write, and a target-stopped cut keeps the unprocessed files available for Paste.

Area	Description	Status	Ref
Target binding	Apply, queued and retried uploads, AI uploads and editor saves carry their source and destination identity instead of following the active tab.	🟢 fixed	6f17f1fe3
Refusal before side effects	A source refused by policy creates no remote folder and uploads nothing; batch deletes and teardown paths check their target before acting.	🟢 fixed	6f17f1fe3
Interrupted cuts	A target stop keeps exactly the files not yet moved on the clipboard, so switching back and pasting finishes the cut.	🟢 fixed	6f17f1fe3
Behavioral proof	The recording-provider test proves that a refused symlink produces neither mkdir nor upload, closing Requested 212. Requested 208 remains the separate backend-pin follow-up.	🟢 fixed	6f17f1fe3

Verified green: fmt/check, 170 focused Rust tests, Clippy -D warnings, focused frontend and i18n checks, plus the complete Linux, Windows and macOS PR CI on the reviewed head.

[axpnet]

Fastly Object Storage joins the S3 presets (Requested 209, 210)

Post-4.2.6 follow-up, done on main, shipping in v4.2.7 (#1531).

Fastly Object Storage is now a ready S3 preset: 12 regional endpoints ({region}.object.fastlystorage.app), path-style addressing, catalog row, grid tile, logo and localized Discover card in all 47 locales, with the setup guide live at providers/fastly-object-storage (queued row 25).

Area	Description	Status	Ref
Uploads and retries	Uploads use Fastly's 16 MiB single-PUT cutoff and 8 MiB multipart parts, with one bounded retry budget shared across 429 and Fastly's 408 timeout responses.	🟢 done	bd0578ab4
Endpoints and regions	All 12 regional endpoints are mapped in the shared S3 host table; region mismatches produce actionable guidance naming the region to set, and rclone export prefers the endpoint label, then a nonblank stored region, then Frankfurt.	🟢 done	bd0578ab4
Capabilities and share links	Unsupported versions, object tags, trash and usage actions stay hidden in the UI (including for stored aliases and across connected S3 tab switches) or refuse direct calls cleanly; share links keep the SigV4 7-day cap.	🟢 done	bd0578ab4
Alias normalization (Requested 209)	Preset aliases (fastly-object-storage, backblaze-b2, azure-blob) are normalized in one shared place used by rclone export, capability checks and both duplicate-profile checks.	🟢 done	bd0578ab4
Manual sync scan floor (Requested 210)	cloud_scan_schedule records the connected provider's scan floor (30 minutes for Fastly) on manual syncs as well as scheduled passes.	🟢 done	bd0578ab4
Residual	Extending the payment-card note in Discover texts to other freeRequiresCard presets stays tracked as Requested 211.	🔵 planned	Requested 211

Verified green: cargo fmt, clippy --all-targets --features test-seed -D warnings, 716 focused Rust tests (fastly, providers::s3, bridge_shared, rclone_import, storage_dedup, cloud_scan_schedule, connection_manifest, source guards, with red-then-green checks on the review fixes and the 7-day expiry cap), 88 focused frontend tests, typecheck, i18n validate and former-English ledger, 260px browser card verification, and full CI on the merged head.

[axpnet]

Snyk can import the TypeScript configuration as strict JSON

Post-4.2.6 follow-up, fixed on main, shipping in v4.2.7 (#1532).

The repository's tsconfig.json contained two JSONC comments that TypeScript accepted but Snyk's strict JSON importer rejected. Those comments are removed without changing any compiler option, and a CI-run regression test now prevents the incompatibility from returning.

Area	Description	Status	Ref
Snyk import	tsconfig.json parses as standard JSON during repository imports; TypeScript compiler settings are unchanged.	🟢 fixed	cf3400953
Regression coverage	src/tsconfigJson.test.ts reads the real configuration and requires JSON.parse to succeed under Vitest in CI.	🟢 fixed	cf3400953

Verified green: focused Vitest regression test (1 test), TypeScript typecheck, strict JSON parsing, diff check, and the complete Linux, Windows and macOS PR CI on the reviewed head.

[axpnet]

Hardened network trust, object names, and imported security options (Requested 188, 189, 198)

Post-4.2.6 follow-up, fixed on main, shipping in v4.2.7 (#1524).

Tightened network boundaries, object name handling, and profile import safety across GUI, CLI, MCP and keystore paths. URL parsing now governs private and loopback decisions and dot-segment S3 paths; FTP passive data connections stick to the control peer by default; MEGAcmd nodes with wildcard characters are addressed safely by handle; and imported profile options that relax security are previewed and reset to safe values by default unless explicitly kept.

Area	Description	Status	Ref
Network trust & endpoints (Requested 188)	Private IP and loopback detection uses the parsed address; S3 .local mDNS trust parses real hosts; FTP PASV data connections default to the control peer, with a new opt-in trustPasvAddress checkbox and CLI flag.	🟢 fixed	fcb5f440f
S3 dot-segment paths (Requested 189)	Both SigV4 signers compare the built and parsed paths and refuse keys with . or .. segments rather than signing rewritten paths that could target unintended objects.	🟢 fixed	fcb5f440f
MEGAcmd wildcard handling (Requested 189)	Existing nodes with * or ? in their names are addressed by handle via recursive resolution through folders only; new wildcard names and bulks are rejected before execution.	🟢 fixed	fcb5f440f
Profile import security review (Requested 198)	A unified table catalogs security-relaxing options; backup, third-party bridge and CLI imports reset them to safe values by default unless explicitly kept in the preview; CLI strict mode rejects relaxed saved profiles and --keep-insecure-options.	🟢 fixed	fcb5f440f
Keystore restores & strict checks (Requested 198)	Keystore profile restores enforce the safe defaults across multi-account and passphrase-protected stores at unlock; unkept plain-HTTP WebDAV imports reset to HTTPS.	🟢 fixed	fcb5f440f
Saved FTP TLS enforcement	Saved FTP profiles without an explicit tlsMode default to explicit TLS across CLI, MCP, agent and background transfers, matching GUI behavior.	🟢 fixed	fcb5f440f

Verified green: cargo fmt, clippy --all-targets --features test-seed -D warnings, Rust unit and integration test suites, Vitest bridge and import security tests, TypeScript typecheck, i18n validation across 47 locales, and complete cross-platform CI on the merged head.

[axpnet]

Add Services cards and Quick Connect header descriptions align

Pre-release follow-up, fixed on main, shipping in v4.2.7 (#1531).

Add Services cards clamp descriptions to a single line with native tooltip hover to preserve uniform row height and grid alignment. The Quick Connect form retains the concise brand description in the top-right header, while multi-connector mode groups (MEGA, Filen, FileLu, Proton) and differing presets surface the full translated card description in a dedicated details badge.

Area	Description	Status	Ref
GUI / Add Services	Clamp service card descriptions to single line with title tooltip to keep uniform tile heights	🟢 fixed	354cedd75
GUI / Quick Connect	Retain short brand description under logo and render full card description in dedicated info badge	🟢 fixed	354cedd75
Multi-connector	Multi-mode groups (MEGA, Filen, FileLu, Proton) resolve group header short description and tab-specific card details	🟢 fixed	354cedd75

Verified green: npx tsc --noEmit clean (0 errors), npm run test:unit passing 367/367 test files (3869/3869 tests), version sites consistent on 4.2.7.

[axpnet]

AeroFTP 4.2.7 published: Network Trust, Storage Presets and Object Integrity

AeroFTP 4.2.7 is available with Tigris Data and Fastly Object Storage presets, hardened network trust with explicit local loopback checks, strict S3 key and object path validation, resilient backend single-instance and replica safeguards, aligned provider catalogs across GUI and documentation, and dependency security updates. This release tracker is now archived; open requests, their original IDs and scores, and unresolved security follow-ups continue in the v4.2.8 tracker (#1533).

Area	Result	Status
GitHub packages	All packages and their Sigstore bundles verified by digest, size, workflow identity and issuer across Linux, Windows and macOS.	✅ published
Arch Linux	AUR package aeroftp-bin updated to 4.2.7-1 with the checksum of the verified Debian package.	✅ published
SourceForge	All 19 curated files verified, per-OS default downloads point to 4.2.7, and older binary retention completed.	✅ published
Docs site	Release notes published, provider catalog grid and counts synchronized across 58 providers and 49 presets.	✅ published
Website	Lumo CMS remote database and assets updated across 58 providers, 49 presets and 72 connection methods.	✅ published
Snap Store	Existing revision 232 is uploaded but awaits manual review of the single-instance D-Bus slot. Stable remains 4.2.5 revision 230. The signed 4.2.7 Snap is available on GitHub Releases; Store publication is pending Canonical reviewer approval.	⏳ Store review

Pre-tag commit audit and counter-audit: PASS. The local gate passed 3,869 unit tests, formatting, clippy with zero warnings, TypeScript, all 47 locales and packaging checks. The reviewed source tree is identical to release commit 354cedd75. All CI release builds completed green across Linux, Windows and macOS x64 and aarch64.