v0.0.3

Changed

• The macOS installer now installs the fl command too: it links fl and flashlink in
  ~/.local/bin to the standalone binary the Finder menu uses, so Terminal and Finder run the same
  version and nothing depends on Node. It never overwrites an fl installed some other way, says
  when ~/.local/bin is not on your PATH (with the line to add), and when another fl comes first.
  Already installed? Run the install command again.
• The installer's output is clearer: grouped steps, colors on a terminal (not with NO_COLOR), and a
  "Next steps" list that only includes connecting to your Worker when that is still needed.

v0.0.2

Security

• The standalone macOS binaries (flashlink-darwin-arm64, flashlink-darwin-x64) are now built with
  Bun 1.4.4. The 0.0.1 binaries embed Bun 1.4.2, whose Brotli decoder has an out-of-bounds write
  (CVE-2026-111497) reachable when decompressing a br-encoded HTTP response. Reinstall with the
  installer to update. The npm package runs on your own Node.js and is not affected by this change.

Changed

• The macOS support archive no longer includes macos/qa.sh, a maintainer-only QA script the installer
  never used.

v0.0.1

Added

• Worker on Cloudflare R2 with one SQLite-backed Durable Object: short public links
  (https://<worker>/<code>) that serve the raw file with its Content-Type, expire on their own
  (1 hour by default, 7 days at most), can be refreshed under the same code, revoked or purged,
  and support Range and HEAD.
• fl CLI (also installed as flashlink): init, up (files, several files, stdin, and folders as a zip), refresh, revoke,
  ls, status and config; local-only upload history; --ttl, --max-downloads, --with-name,
  --json (including machine-readable errors), --notify and --no-copy. --max-downloads closes a
  link after N downloads; every satisfiable GET counts (whole file or Range), but not HEAD or a
  416, so a client that reads a file in several ranges is not suited to it.
• A warning before uploading files that look like secrets (.env, keys, tokens), with
  --allow-secrets to override.
• macOS Finder Quick Actions with a lifetime picker and notifications, plus an installer that
  downloads a standalone fl binary (with a flashlink alias) from a release and checks its checksum.
• A landing page on the Worker's own URL: what the tool is, how to use the CLI and how to deploy your
  own copy.
• An agent skill (skills/flashlink/SKILL.md) so coding agents can create, refresh and revoke links.
• pnpm setup:cloudflare: one command to create the bucket, deploy the Worker, set the token and add
  the lifecycle rule in your own Cloudflare account; scripts/verify-deployment.mjs checks a
  deployment end to end.
• Guardrails: per-IP and global rate limits, a 50 MB default file cap, a total-storage cap and a daily
  upload cap, all configurable in packages/worker/wrangler.jsonc.
• MIT license.