VFS365 0.6.1

• Monitoring in one step: a Deploy to Azure button (README, Setting up monitoring) creates the storage account and tables, hosts the dashboard on the account's static website with CORS for that address only, and hands out the devices' MonitoringUrl and a ready dashboard link. Deploying again renews both.

VFS365 0.6.0

• Folder redirection (policy FolderRedirection): Decide if Windows' user folders (Desktop, Documents, Downloads, Pictures and the others, or any known folder by ID) move into VFS365 while the drive is mounted, and back at unmount. Paths take environment variables, %UPN% and %UPNNAME%, and wildcards (Sites\Project*\Documents); missing folders are made inside the library; |move moves the local content in. Folders moved by something else (OneDrive's folder backup, a Folder Redirection policy) are left alone and reported.
• Drive letters for folders (policy DriveMappings): Z:=Sites\Finance\Documents|Finance gives a library or folder a letter of its own, as OneDriveMapper did, with the same placeholders and wildcards. A letter still held or remembered by a SharePoint WebDAV mapping (OneDriveMapper, net use) is taken over. The network provider reports these letters to Explorer as connected.

VFS365 0.5.1

• The installer runs its machine steps without console windows and not on a repair; a rebuilt release of the same version replaces the installed one.

VFS365 0.5.0

Result of a second full review of the code, and a new sign-in.

Sign-in

• VFS365 signs in through Windows' own Web Account Manager, called directly. Microsoft's authentication library and its broker runtime (msalruntime.dll, which may not be redistributed) are no longer included. Sign-in works as before: silently with the Windows account, a window only from Sign in in the tray or at the start. vfs365 whoami --sign-in shows the sign-in window, to test it.
• With the tray icon off (TrayIcon 0), a needed sign-in opens the window by itself, once per problem.

Saving and data safety

• After your own save, a colleague's later version is no longer hidden for an hour; your next save builds on what you read, or ends in a conflict copy.
• Files named like temp files (starting with ~, ending in .tmp, or 8 digits such as 20261024) save like any other file when they exist in Microsoft 365, and new ones upload when still there 5 minutes after their close. Before, their saves stayed on the PC and were lost at the next start. Office's own temp and lock files still never upload.
• A cached file keeps the length it was served with, also after a restart: Office files that SharePoint added properties to no longer show as damaged.
• A folder renamed elsewhere is noticed even when only a folder below it was opened, so opens and saves can't land in the renamed folder.
• A file opened after the drive was idle, after sleep or right after a start is the version now in Microsoft 365.
• Renaming or moving a folder takes files still waiting to upload along.
• Word saves of a file with changes not uploaded yet, and backup copies made during a save, can no longer delete or move the saved document.
• A metadata change in SharePoint (a column, a label, a flow) no longer turns a save into a conflict copy.
• After a crash, changes that were still being written upload as a "(recovered)" copy next to the file instead of into it.
• A download no longer mixes two versions when a colleague saves the same size meanwhile.
• When Microsoft 365 can't be reached, files and folders opened before keep opening.

Reliability

• A connection that stops answering no longer hangs the drive, folder listings, change checks, discovery or downloads: they fail after a minute without progress and are tried again. Slow connections finish their uploads: parts get smaller and resume where they stopped.
• A failed or incomplete library search no longer leaves the drive without SharePoint libraries for a day; it is tried again within the hour, within minutes on a first start. A start after an interrupted first start reads the libraries at once.
• Deleting many files no longer holds up saving: deletes run in the background.
• The agent restarts after any unexpected exit; when it gives up, a tray icon offers Retry and Show log.
• Notifications: at most one per kind a minute. Refused deletes say why in plain words.
• Policy values written as text (yes, on, enabled) or as QWORD are read; unreadable ones keep the default and are named in the log.

API use

• Library details are checked weekly instead of every two days. Change checks slow down in busy libraries, push reconnects are spread out, and a folder loading in the background is served first when someone waits for it.

Security

• The network provider no longer asks the network about \VFS365 when the drive isn't mounted. DEPLOYMENT.md explains how to keep that name from resolving on the network; the agent warns (log and monitoring) when it does.
• The agent refuses a monitoring SAS that can read, change or delete rows, since every user can read it from the policy. Add-only SASes keep working.
• The installer runs its machine steps without console windows and not on a repair; a failed upgrade restores the previous version and restarts its agents; a rebuilt release of the same version replaces the installed one.
• Uninstall cleans up very deep folder trees and does the machine-wide steps first; stopping agents signals only each session's own agent.
• Releases are built and signed in separate jobs, only from main, and every signature is checked before publishing.

Monitoring

• Statistics are sent as the device they were used on (pooled AVD with roaming profiles), get a random row key, and are retried for a week. Changes to MonitoringUrl and MonitoringDetail apply without a restart.
• Dashboard: changing the connection or period during a load no longer mixes data; today's throttling counts; the last 3 days are marked as still arriving; keyboard access and contrast are better; duplicate rows are left out. The dashboard's SAS needs only Read. Opened from disk, it no longer stores the SAS beyond the tab.

VFS365 0.4.2

• Signed binaries!

VFS365 0.4.1

• Monitoring: a day's statistics carry the signed-in account and the version of that day. Before, an agent that sent them before its first sign-in of the day (statistics go out 1 to 15 minutes after the start) left the account out, and after an update the old day was labelled with the new version.
• Throttling is reported per episode (from the first throttled response until 2 quiet minutes): when it started and ended, how many responses, how long requests were held back, and whether it hit SharePoint or Graph, background work or user actions. The log gets the same line.
• Dashboard: a Throttling tab shows who got throttled, when and how much: episodes with exact times (agents from 0.4.1), or per user per day from the daily statistics. The Throttled tile opens it, the insight names the users most affected, and user and device details list their throttling. Throttling rows are not counted as errors.
• Dashboard: a PC rebuilt from an image (AVD hosts get a new Windows installation, and with it a new machine ID) counts as one device, found by its name; its details list the installations. Charts and totals start at the first report when monitoring began within the period, and errors are compared with the period before only when there was one. Yesterday's statistics, which devices send during today, show lighter and "still arriving". A host that reports two versions on one day counts as the newer. Insights name the user behind most reports and explain a cancelled sign-in, and a note counts statistics that came without the signed-in account.

VFS365 0.4.0

Result of a full review of the code (security, data safety, reliability, API use, user experience).

Saving and data safety

• A save that fails for any reason, sign-in problems included, is retried with back-off until it uploads; you are told once. Before, some failures (a file deleted in Microsoft 365 meanwhile, no access, sign-in needed) were never retried.
• A file deleted in Microsoft 365 while you edited it is saved again under its own name, or as a conflict copy when the name is taken meanwhile. Conflict copies get unique names (seconds, and a number when needed).
• A file that can't be deleted in Microsoft 365 (locked, or you may edit but not delete it) shows again with a notification. Before, it held up every other pending upload until the agent stopped.
• A program that keeps a file open after a conflict copy keeps writing into the copy, never into the colleague's version; reads after a save show the saved content.
• A file changed in Microsoft 365 while it was being read is no longer stored as a mix of two versions; the read fails once and opening it again gives the new version.
• A folder renamed, moved or deleted elsewhere is noticed even when its parent folder was never opened, so saves and deletes can't land in the wrong folder. Changes made elsewhere while a large folder is being read are no longer missed.
• Unsaved changes are flushed to disk before a close returns, and programs that flush a file get it written to disk. After a crash, files that had already uploaded are not uploaded again as conflict copies.
• Saves and other changes are no longer repeated automatically after a server error, which could make false conflict copies.
• Deleting a temp copy during a Word save can no longer delete the saved document.

Security

• Uninstall no longer follows links (junctions) in user profiles when it removes cached data as SYSTEM; links and folders owned by another account are skipped and named in the uninstall log. Before, a user could make the uninstall delete files elsewhere.
• Multi-session hosts: other users' requests to someone's drive are refused before the drive looks anything up; VFS365 doesn't start, warns and reports when another user's drive holds \\VFS365\<user>, and typed \\VFS365 paths only resolve to your own drive; other users can no longer block or stop someone's drive through its stop signal.
• Sign-in tokens are only sent over https to Microsoft Graph and the tenant's own SharePoint addresses.
• Cached content is encrypted and authenticated per block with a random key stream per file; a damaged cache file is downloaded again. The cache is emptied once after this update.
• Releases carry build provenance attestations and can be code signed; build dependencies and GitHub Actions are pinned.

The drive no longer disappears or hangs

• VFS365 no longer opens a sign-in window by itself while it runs, and files no longer wait behind one. When a sign-in is needed the tray says so: click the notification or choose Sign in.
• Without network or sign-in at the first start, VFS365 waits and tries again by itself, and the tray says what it waits for. Other start problems keep the tray icon with the cause, Retry and Show log.
• A drive letter that is in use or not valid no longer stops the drive: it starts without a letter, and the tray says why. M, m, M: and M:\ all work.
• Restart from the tray waits for pending uploads, however long they take. A cancelled shutdown keeps the drive; while changes upload, Windows shows why VFS365 delays the shutdown.
• Upgrades start VFS365 again right away for every signed-in user. New Start menu entry "VFS365" to start it again after it was closed.
• Opening or saving a large file no longer holds up other files and folders on the drive.
• Programs that read files in many places at once (databases, CAD, mail archives) no longer pause for 30 seconds or more. A download that failed is tried again by the next open.
• Fixed a rare hang of the whole drive when opening an empty file while the cache was full.
• The agent keeps memory in check when a backup or search tool walks a very large library, and the cache stays within CacheSizeMB.

Fewer Microsoft 365 calls

• Discovery reads all document libraries of a site with one request instead of one per library, and spreads the 48-hour re-checks over several days.
• A library missing from one search run stays until it is missing twice in a row, so a hiccup in SharePoint Search no longer empties its cached files. Search pages through results in a stable order, no longer returns colleagues' OneDrive libraries, and covers every geo of a multi-geo tenant.
• Libraries are discovered again daily while the PC stays signed in. Hidden libraries that are made visible again show up within two days. Pinned links that point to nothing are checked once every two days.
• After Microsoft throttles, all background work (discovery, refreshes, change checks, loading ahead) waits ThrottlePauseMinutes; what you open and save goes on as soon as Microsoft allows. Waits vary a little per device and queued requests resume gradually, so a tenant's devices don't all come back at once.
• Folders known from the last session are trusted for a day, change checks slow down while nothing changes, a library only glanced at in Explorer gets no change checks, push notifications are combined per library, opening many files of one folder lists the folder once, and downloads need one call less.

Tray and notifications

• Notifications are combined ("27 files are waiting to upload: offline") and give plain causes. New NotifyUploads policy mutes "Uploaded".
• The tray shows offline and throttled states, has access keys, opens from the keyboard, opens one Explorer window per double-click, and shows when Refresh works again in the item itself. Refresh says when it failed, and a failed refresh doesn't use up the daily one.
• The tray, its notifications and the Refresh hint are in Dutch on Dutch Windows.
• OneDrive-only drives start without the network from the second start on.

Monitoring and log

• New MonitoringDetail policy: NoPaths keeps file and folder paths out of error reports.
• Statistics that couldn't be sent are kept and sent later, and time asleep no longer counts as running. A device where VFS365 stopped restarting after repeated crashes reports it, and crash details are read correctly on non-English Windows. The dashboard warns about both and removes #connect= from the address bar.
• The log no longer loses lines during a restart. It records sleep and resume, network changes, the signed-in account, and values outside their range. Policy changes are noticed and apply after Restart.
• vfs365 signout waits until pending uploads finish before removing local data.

Installer and policy

• The x64 package refuses to install on ARM64 devices and points to the arm64 package.
• Navigation pane entries of users who were signed out during an uninstall are removed at their next sign-in.
• The DriveLetter policy template no longer suggests M (the default is None).

VFS365 0.3.2

• Sites by template: the new IncludedSiteTemplates and ExcludedSiteTemplates policies show or hide libraries by their site's template, for example only GROUP (team sites with a Microsoft 365 group, Teams) or everything but TEAMCHANNEL (private and shared channel sites). The template comes with the search results, so it costs no extra calls. vfs365 discover shows each library's template.
• Fixed: excluding sites by policy now takes effect even when it hides more than 40% of the libraries. Before, discovery's safety check (nothing is hidden when the set shrinks that much, against search hiccups) kept them all visible.

VFS365 0.3.1

• Downloads: a file that Microsoft 365 serves with another length than it lists (changed since the folder was listed, or an Office file SharePoint writes library properties into) no longer fails three times with "Unable to read beyond the end of the stream", and a longer one is no longer cut off without notice. The read fails once, the drive takes the length served, and opening the file again works; the log names the file.
• Downloads that break off are tried again after 1 and 2 s. Only when all three attempts fail is the error logged, now with the file's path, and reported to monitoring.

VFS365 0.3.0

• Fewer calls at sign-in, spread over time: when the libraries of the last session are less than a week old, the drive shows them at once and discovery waits a random 5 to 90 minutes, so a tenant's morning sign-ins don't all discover at the same moment. Library details are then read again only for libraries checked more than 48 hours ago (each library by its own age; before, all of them every 24 hours). A first start, or a state older than a week, discovers right away.
• Tray: Refresh reads all libraries and folders again (folders as they are opened). It works once a day, and only when the libraries were read more than an hour ago; when it is greyed out, pointing at it says why and when it works again.
• Log: every sign-in starts a new agent.log, which begins with the settings that differ from the defaults and where each comes from (computer or user policy, marked Intune when Intune set it, or the config file). Earlier sign-ins move to logs\, kept for 7 days (at most 50 files); a log that reaches 10 MB continues in a new file. A restart from the tray keeps writing to the same log.
• vfs365 settings shows every setting with its source.
• Stability: vfs365-agent.exe now watches the agent and starts it again within seconds when it crashes (at most 3 times in 15 minutes), so the drive comes back without a new sign-in. The log says what Windows recorded about the crash (faulting module, exception, stack), and monitoring reports it.
• Drive letter checks: at the start and every 5 minutes the agent checks what Windows tells Explorer about its drive letter, and logs when something is off, with the cause and the fix: a remembered mapping to another share on the same letter, no network provider reporting the letter (WinFsp.Np missing from the provider order), the letter removed by another tool, or VFS365.Np missing (typed \\VFS365 paths).
• Refresh in the tray shows one notification when it is done (the status reads "refreshing" meanwhile).
• Monitoring: daily statistics split the time waited for the API budget into user actions (BudgetWaitForegroundSeconds) and background work (BudgetWaitBackgroundSeconds); BudgetWaitSeconds stays the total. The log line at unmount shows both.
• Monitoring dashboard: vfs365-monitoring.html, one file that shows the monitoring tables in a browser: what needs attention, trends per day (including what users and background work waited for, with an explanation), devices, users, errors grouped by cause and installs, with details per row. It reads with a Read and List SAS, refreshes on a schedule and explains SAS and CORS problems. See DEPLOYMENT.md.