Droppen v0.2.129

Droppen v0.2.129: the server for macOS (Apple silicon and Intel) and Linux.

On a Mac, the Droppen desktop App (Droppen-<version>.dmg, when it is attached
to a release) is the recommended way for everyday use. The files below are the
server, for running Droppen in the background or on a device with no screen.
Install or upgrade it, and add the device to your account with a one-time code
(on droppen.app: my devices → add a device that runs AI → show a one-time code):

curl -fsSL https://droppen.app/install.sh | DROPPEN_CODE=<code> sh

Or download the tarball for your device, check it against SHA256SUMS
(shasum -a 256 -c --ignore-missing SHA256SUMS, or sha256sum -c --ignore-missing SHA256SUMS),
and follow INSTALL.txt. The server is droppen; remote-hand-server is the
same program under its old name, which the installed service keeps.

file	for
droppen-v0.2.129-macos-aarch64.tar.gz	Apple silicon
droppen-v0.2.129-macos-x86_64.tar.gz	Intel Mac
droppen-v0.2.129-macos-universal.tar.gz	either Mac
droppen-v0.2.129-linux-x86_64.tar.gz	Linux x86_64, glibc 2.28+
droppen-v0.2.129-linux-aarch64.tar.gz	Linux aarch64, glibc 2.28+
remote-hand-v0.2.129-macos-{aarch64,x86_64,universal}.tar.gz and remote-hand-v0.2.129-linux-{x86_64,aarch64}.tar.gz	the same server under its old name only, for older copies of the installer (on every release until at least 2027-01-31)
install.sh	the installer above (https://droppen.app/install.sh redirects to the latest release's)
INSTALL-macos.txt, INSTALL-linux.txt	installing by hand (each tarball has its own INSTALL.txt)
LICENSE	Droppen's licence: AGPL-3.0-only
THIRD_PARTY_NOTICES	the third-party software in the server, with its licences
web-manifest.json	the embedded web app's files and digest
droppen-v0.2.129.sigstore.json, web-manifest.sigstore.json	the build provenance attestations: every file here was built by this repository's release workflow from the commit below. Check one with gh attestation verify <file> --repo getdroppen/droppen --signer-workflow getdroppen/droppen/.github/workflows/release.yml --source-ref refs/tags/v0.2.129

Droppen is licensed under AGPL-3.0-only. The source of this release is
https://github.com/getdroppen/droppen/tree/a9b410abf8f20fb7f21eb3c34dc2c680345bd246.

Copyright (C) 2026 Kilerd

Built from commit a9b410abf8f20fb7f21eb3c34dc2c680345bd246 (server 0.2.129+ga9b410a).

Droppen App for macOS

Droppen-0.2.129.dmg — the desktop app (Apple silicon and Intel), signed with Developer ID and notarised by Apple. It needs macOS 13 or later. Open the DMG, drag Droppen to Applications, open it.

Droppen 0.2.127 and 0.2.128 update themselves to this release: they download it in the background and install it the next time you quit, or at once with Restart to Update. Droppen 0.2.125 and 0.2.126 update themselves in two steps: first to 0.2.127, which https://github.com/getdroppen/releases (where they look for updates, now archived) still offers, then from 0.2.127 to this release. Version 0.2.124 and older do not update themselves: download this DMG once and replace the app in Applications.

macOS 版 Droppen App

Droppen-0.2.129.dmg 是桌面 App（Apple 芯片和 Intel 芯片的 Mac 都能用），使用 Developer ID 签名并经过 Apple 公证，需要 macOS 13 或更高版本。打开 DMG，把 Droppen 拖到「应用程序」，然后打开它。

0.2.127 和 0.2.128 会自动更新到这个版本：在后台下载，并在你下次退出时安装；也可以用「重启以更新」立即安装。0.2.125 和 0.2.126 会分两步自动更新：先更新到 0.2.127（它们检查更新的 https://github.com/getdroppen/releases 已归档，但仍提供 0.2.127），再从 0.2.127 更新到这个版本。0.2.124 及更早的版本不会自动更新：请手动下载一次这个 DMG，替换「应用程序」里的 Droppen。

What's new in v0.2.129

Your account

• You can delete your account in its settings. Account settings has a new last section, on a full device of the account; other devices say that only a full device can do it. It first says what deleting means: everything the account keeps at Droppen is erased for good (the encrypted copies of your sessions and terminals, its keys, its devices and its ways to sign in), every device of the account stops working at once, and the e-mail address cannot sign up again for a few days (7 at droppen.app). To delete, type the account's e-mail address and confirm with your password or a passkey. This browser then forgets the account's keys and offline copies at once; your other browsers and phones forget theirs as soon as droppen.app tells them the account is gone.
• Sign out, or sign out and remove this browser. Signing out used to end the session only: the browser kept its device keys. Every sign-out now offers two choices. Sign out is for a device of your own: the browser stays one of your account's devices, and signing in again opens it as before. Sign out and remove this browser is for a shared or borrowed device: the browser takes itself off your account's devices and deletes its keys here. Where it cannot take itself off (only a full device can; the account's last full device stays, and so does one whose removal would void the recovery words or passkeys it set up), its keys are still deleted here, and it says what is left to do, such as removing it in my devices on another full device. Deleting the keys of the account's last full device asks you twice. Either way, this browser's offline copies are cleared, and it now also stops getting notifications.
• Terms of service, and a fuller privacy notice. droppen.app/terms is new, in English, Chinese and Japanese: what the hosted service at droppen.app covers (the code itself is under its licence), what it asks of you, the Free plan, the beta, leaving and suspension, the law that applies, and that you must be 16 or older. The footer of every public page links it, and the sign-up form says that signing up accepts it. droppen.app/privacy now names the providers behind droppen.app and says how long things are kept: the encrypted copies of your sessions for 7 days on Free and 30 on Pro, an account that never verified its e-mail address and never added a device for 7 days, and copies in backups and logs expire within 30 days. A new section says what deleting your account erases, and the little that is kept for a while.

Getting the app

• Download the app straight from droppen.app, for the device you are on. The home page and the download page now download the latest release's file directly, with its version and size beside it. On a Mac, Download for Mac gets the DMG (Apple silicon and Intel); on Linux the install command comes first, then the tarball for your processor; on Windows, which has no app yet, and on phones, the page shows how to use Droppen in the browser. The page tells which device it is on by itself, without a request. droppen.app checks the latest release's file names and addresses before it offers them; where it cannot, the buttons open the release page on GitHub as before.

The page's offline copy

• The offline copy of the page is checked against its build. The service worker that keeps the page's files for offline use, at droppen.app and on the local page, now carries the SHA-256 of every file of its build, and keeps and serves only files that match: a cached file that does not match is deleted and downloaded again, and a download that does not match is refused. Before, it served whatever its cache held, so a file tampered with once could keep running after later releases. Offline, it opens only its own build's page, with security headers it sets itself. Files of earlier builds are no longer kept: a tab still open on an earlier build loads the parts it has not loaded yet from the network, and may need a reload once droppen.app has moved on.
• Stray service workers are retired. A service worker registered at another address of the site (one malicious page load could do it) used to stay, since every update of it failed. The local server, and droppen.app, now answer it with a worker that deletes the site's caches and unregisters itself.

Other security fixes

• Adding a device at a public internet address asks you to type its name. When a device's local page asks droppen.app to add it from a public address, you now type its host name before the device can be added: a page pretending to be a device's settings is more likely there than a device of your own. Private and local network addresses still need only a tick.
• A tap on a notification opens only a page of the site it came from.
• The note a browser keeps that it has signed in to an account before is now filed under a hash of the e-mail address, not under the address itself.
• droppen.app/.well-known/security.txt says how to report a security problem.
• The server and the desktop app use updated TLS libraries (rustls 0.23.46, rustls-webpki 0.103.16, webpki-roots and webpki-root-certs 1.0.10), which fix the published advisories RUSTSEC-2026-0346 to 0349 and 0381 to 0383; the web app's seroval is 1.7.1.

Reconnecting

• A page back from sleep finds its relay again. After a phone or laptop slept, or was offline for a long time, droppen.app could stay on "connecting…" with "no relay available: live features are unavailable for now", although your device that runs AI was online, and it never recovered by itself. It now reconnects as soon as the page comes back, waits for the device's current status before it chooses a relay instead of going by what it heard before the pause, and tries again the relays it gave up on earlier. While it can still reach the device, it says "connecting…" rather than "no relay available".

Coming next

• Groundwork for moving the web app to my.droppen.app, with the public pages at www.droppen.app: not switched on yet.

v0.2.129 更新内容

你的账户

• 可以在账户设置里删除账户。 账户设置的最后多了一节，只在账户的完整设备上可用；其它设备会说明只有完整设备才能删除。它先说明删除意味着什么：账户在 Droppen 保存的一切都会被永久抹去（会话和终端的加密副本、钥匙、设备和登录方式），账户里的每台设备都会立即停止工作，这个邮箱几天内不能再用来注册（droppen.app 上是 7 天）。删除时，请输入账户的邮箱地址，并用密码或通行密钥确认。随后这个浏览器会立即清除账户的钥匙和离线副本；你的其它浏览器和手机，一旦 droppen.app 告诉它们账户已不存在，也会清除自己的。
• 退出登录，或退出登录并移除这个浏览器。 以前退出登录只是结束会话：浏览器仍保留着它的设备钥匙。现在每次退出登录都有两个选择。「退出登录」适合你自己的设备：这个浏览器仍是你账户里的设备，再次登录即可照旧使用。「退出登录并移除这个浏览器」适合共用或借来的设备：这个浏览器会自己离开你账户的设备列表，并删除它在这里的钥匙。如果它不能自己离开（只有完整设备可以；账户里最后一台完整设备会留下，移除后会让它设置的恢复词或通行密钥失效的设备也会留下），它在这里的钥匙仍会被删除，并说明还要做什么，比如在另一台完整设备的「我的设备」里把它移除。删除账户里最后一台完整设备的钥匙，需要你确认两次。无论哪种方式，这个浏览器的离线副本都会被清除，现在它也不再收到通知。
• 服务条款，以及更完整的隐私说明。 新增 droppen.app/terms，有英文、中文和日文：droppen.app 上的托管服务包括什么（代码本身适用它的许可证）、对你有什么要求、免费方案、测试阶段、离开与暂停服务、适用的法律，以及须年满 16 岁。每个公开页面的页脚都链接到它，注册表单也写明注册即表示同意。droppen.app/privacy 现在列出了 droppen.app 所用的服务商，并说明各类数据保存多久：会话的加密副本，免费方案 7 天，Pro 方案 30 天；从未验证邮箱、也从未添加设备的账户，7 天后删除；备份和日志里的副本在 30 天内过期。新增的一节说明删除账户会抹去什么，以及短期内仍会保留的少量内容。

获取 App

• 直接从 droppen.app 下载适合你这台设备的 App。 首页和下载页现在直接下载最新版本的文件，旁边标着版本号和大小。在 Mac 上，「下载 Mac 版」下载 DMG（Apple 芯片和 Intel 都能用）；在 Linux 上，先给出安装命令，再给出适合你处理器的压缩包；在还没有 App 的 Windows 上以及在手机上，页面会说明怎样在浏览器里使用 Droppen。页面自己判断它在哪种设备上，不发出任何请求。droppen.app 会先核对最新版本的文件名和下载地址再提供；核对不了时，按钮仍像以前一样打开 GitHub 上的发布页。

网页的离线副本

• 网页的离线副本会按它的构建逐一核对。 为离线使用保存网页文件的 Service Worker（droppen.app 上的和本地页面上的）现在带着它那个构建每个文件的 SHA-256，只保存和提供核对一致的文件：缓存里不一致的文件会被删除并重新下载，下载到不一致的文件会被拒绝。以前它缓存里有什么就提供什么，所以文件只要被篡改过一次，之后的版本里也可能一直运行着它。离线时，它只打开自己这个构建的页面，并使用它自己设置的安全响应头。旧构建的文件不再保留：仍停留在旧构建上的标签页，会从网络加载它还没加载过的部分；droppen.app 更新之后，可能需要刷新一下。
• 注册在别处的 Service Worker 会被清退。 以前，在网站其它地址注册的 Service Worker（一次恶意的页面加载就能做到）会一直留着。现在本地服务端和 droppen.app 会用一个新的 Worker 回应它：这个 Worker 删除网站的缓存，然后注销自己。

其它安全修复

• 添加公网地址上的设备，需要输入它的名字。 设备的本地页面从公网地址请求 droppen.app 添加它时，现在要先输入它的主机名才能添加：这样的地址上，冒充设备设置页的网页比你自己的设备更常见。私有地址和局域网地址仍然只需勾选一下。
• 点击通知只会打开它所属网站的页面。
• 浏览器记下的「曾登录过这个账户」的记录，现在以邮箱地址的哈希为名保存，而不再直接用邮箱地址。
• droppen.app/.well-known/security.txt 说明了如何报告安全问题。
• 服务端和桌面 App 使用了更新后的 TLS 库（rustls 0.23.46、rustls-webpki 0.103.16、webpki-roots 和 webpki-root-certs 1.0.10），已修复公开通告 RUSTSEC-2026-0346 至 0349 以及 0381 至 0383；网页使用的 seroval 升级到 1.7.1。

重新连接

• 网页从休眠中回来后，会重新找到它的中继。 手机或笔记本电脑休眠、或长时间离线之后，droppen.app 可能一直停在「连接中…」，并提示「没有可用的中继：实时功能暂不可用」，即使你那台可运行 AI 的设备在线，而且它自己再也恢复不过来。现在，页面一回来就会立即重新连接；它会先等到设备的最新状态，再选择中继，而不是按休眠前听到的情况来选；之前放弃的中继也会再试。只要还连得上设备，它显示的是「连接中…」，而不是「没有可用的中继」。

接下来

• 为把网页版搬到 my.droppen.app、公开页面搬到 www.droppen.app 做的准备工作：尚未启用。