LordOS 0.8.8.7-beta

An update for 0.8.8 to 0.8.8.6 through Store → Updates and apt (no new ISO: the 0.8.8 live image stays the current one), with the Terminal's Files mode (the server's files over the tab's own ssh session, with transfers, permissions and a speed graph), its Settings and Profiles windows, the Claude Code footer inside screen, tmux and ssh, Lithuanian complete, Passwords filling sign-ins across LordOS, monitors that stay lit when a session hands over, and the issues reported on GitHub since 0.8.8.6 (#76 to #95, and #45).

Added

• Lithuanian is complete (GitHub #45). 0.8.8.6 translated the login screen, the desktop, Files, the installer and part of Settings. Now every app and message is translated, 11,909 keys, with Lithuanian plurals (one, few, other). The emoji names and keywords and the country names come from CLDR 45. Settings no longer lists Lithuanian as partly translated.

• Files and Disks: CDs and DVDs show up and mount read-only (#92). Optical drives (sr*) used to be left out of lord.disks.list() and refused by every disk-* action, so an inserted disc, such as the VirtualBox Guest Additions image, never appeared anywhere. A drive that holds a disc is now listed with transport: "optical" and ro: true; an empty drive is not listed. Files shows the disc in Locations, and a click mounts it at /media/<user>/<label>. disk-mount always mounts a disc read-only (nosuid,nodev). disk-unmount and disk-eject accept it, and eject unlocks the door and opens the tray with CDROMEJECT; in a VM this removes the image. Format, rename, erase, image copies, SMART and the LordOS Imager refuse an optical drive on the root side (disk.opticalReadOnly). Disks now offers Mount, Unmount and Eject for read-only disks too (discs, locked cards). A disc inserted during the session brings a notice whose Open mounts it and opens it in a new Files window.

• Files: a New Folder button in the toolbar, next to the back and forward arrows, makes a new folder in the folder shown and opens its name for editing, like Ctrl+Shift+N. It is disabled where the folder is read-only. Mail: the message editor in the compose and reply window now has a right-click menu with Cut, Copy, Paste and Select All, and a right click inside the selection keeps it. Ctrl+V already pastes, since the compositor lets isolated Mail read the clipboard once for a paste it saw (#64). Paste from the menu is a click the app draws itself, so when Mail has no clipboard permission yet it shows the system prompt ("Mail wants to read the clipboard") and pastes only if you allow it (GitHub #93).

• Terminal: Files mode, the server's files over the tab's own ssh session. It is one view per tab: this computer on the left and the server on the right, in the terminal's look. It is turned on with the footer's Files switch, View → Server Files (SFTP) (❖⇧F) or a right click on the tab. It covers the panes and the shell stays alive behind it.

  • It uses the same connection, with no second login and no password or code asked again. The shell integration's ssh (bash, zsh, fish) makes the connection a connection-sharing master, with one socket per shell in a 0700 folder of the session and ControlPersist=no. Options the user passes are left alone, and LORD_SSH_MUX=0 turns this off. lord-server finds that master by its pid being the tab's foreground process and opens a new channel on it with OpenSSH's own multiplexing protocol. It runs no program.
  • SFTP is spoken by lord-sftp, a new sandboxed helper that gets the channel and the local file as descriptors, never a path. Names with / or control characters, and odd owner names, are left out of listings.
  • Toolbar: New Folder, Refresh, Hidden, Filter, and As Root, which uses the server's sftp-server through sudo; when sudo needs a password, a sheet asks for it once and it isn't kept. The local side refreshes every 3 s and the server's every 5 s and after each change.
  • Right click on the server: Download, Rename, New Folder, Permissions (boxes and octal), Change Owner, Information (file, size, owner, permissions, and SHA-256 computed on the server), Copy Path, Open Terminal Here (cd), Delete. Right click on this computer: Upload, Rename, New Folder, Copy Path, Move to Trash.
  • Double click opens a folder or transfers a file. The arrows between the sides upload and download the selection, folders included.
  • Transfers run on channels of their own, so the listing stays usable and each one can be cancelled. Uploads are orange and downloads blue, with a speed graph of the last minute. A download never replaces a file unasked, and the local files follow lord.fs's rules.
  • An upload never replaces a file on the server unasked: when names are already there, a sheet asks Replace, Keep Both (a free name such as notes (2).txt) or Skip, and the choice applies inside existing folders too.
  • Not shared: an ssh opened before this version, or one made from inside another server.

• Terminal: the Claude Code footer inside screen or tmux, and over ssh. The footer showed Claude Code's state, context and limits only when claude was the pane's own process. Inside screen or tmux, or on a server reached with ssh, the pane's process is screen, tmux or ssh, so nothing showed. Now the Terminal reads Claude Code's status line on the pane's screen every 2 s, the line lord-claude-status prints: Opus 5.5 | LordOS | main | ctx 44% | 5h – | sem 26%. "esc to interrupt" on screen tells it Claude Code is working.

  • In a local screen or tmux, the session with the same model, context and folder in ~/.claude/sessions gives the exact state, tokens, resets and cost.
  • Over ssh, the screen's numbers are shown. The server's Claude Code has to print that line.
  • The footer says ✳ Claude Code · screen (or tmux, ssh).

• Terminal: a Profiles window (❖O, Profiles → Profiles…). It works like the Profiles window of other terminals: a search by name or tag, the profiles grouped by tag (the folders fold), each with its star when it is the default and what it runs (its ssh line or the login shell). One click opens the profile, with no Enter or double click. The arrows move the selection and Enter opens it; Esc closes the window. Below the list, a choice of where one click opens it: New Tab, New Window, Split Right or Split Down, in the terminal window used last. "Close this window after opening a profile" (on by default) and Edit Profiles…, which opens Settings, complete it. Both choices are remembered in terminal.json.

• Terminal: profiles grouped by their tags. Importing another terminal's profiles keeps each profile's tags, and Shell → Profiles and the Dock's menu list the profiles without a tag first, then one submenu per tag in name order (a profile under each of its tags), instead of one long list of every profile.

• Passwords fills and saves sign-ins across LordOS. The password fields of Settings → Cloud (adding an account and Sign In Again), Files' shared-folder sign-in and Connect to Server (sftp, ftp, WebDAV), and Remote Desk's sign-in and credentials now have the 🔑 of Passwords, as Databases and Wi-Fi already did. For a server it lists only entries whose host field or site is exactly the address the password goes to, never a guess from a title and never the name a machine announces on the local network, so a device can't take a kept server's name and be offered its password; for a cloud provider, the entries kept under its sites. When a server accepts a password typed in the form (not one filled from Passwords or the keyring), the app asks whether to save it in Passwords; nothing is saved until Save is chosen, and the password never goes to a file or a log. Sign In Again for a cloud account keeps the saved user and password when the fields are left empty. Isolated apps (Mail, Calendar, Contacts, Reminders) can still only use their own keyring items.

• Cloud: pause one account and filter Recent from the menu bar (GitHub #83). Each account in the menu bar's Cloud panel has its own Pause or Resume button (or Unlock Keyring / Sign In Again when needed). Clicking accounts shows only their recent files; click again to remove one, or Show All to clear. With one account chosen, Show in Files and Cloud Settings open that account.

• Window buttons on the left or the right in both themes (GitHub #58). Settings → Desktop & Dock → Title bars → Window buttons: Automatic, Left or Right. Automatic keeps each theme's side (mirrored in right-to-left languages as before); Left puts close, minimize, maximize at the left edge and Right puts minimize, maximize, close at the right edge, in Lord Flow and Lord Classic alike. Linux apps that draw their own title bar get the same side.

• Thumbnail size in the file dialog (GitHub #58). In Thumbnails, the system file dialog (adding a wallpaper, a Notes image, a contact photo, a Linux app's file chooser) has Files' size control: seven steps, pictures from 48 to 200 px, Ctrl + and Ctrl −, remembered for picture dialogs and for the rest.

• Control Center opens every tile's Settings page (GitHub #58). As Wi-Fi and Bluetooth already did, a click on a tile's name in Lord Flow opens its page: Dark Mode, Transparency and Accent Color open Appearance, Sound opens Sound, Wallpaper opens Wallpaper. In Lord Classic's quick settings, Do Not Disturb, Dark Mode and Transparency get the "›" half, and a new "›" at the end of the volume row opens Sound.

• Photos: the cloud folders kept on this computer (GitHub #89). A Cloud section in the sidebar lists every folder a cloud account keeps on this computer (Keep on This Computer); their pictures are all local, so they open without the network. Folders only in the cloud are left out, and these folders are read off the compositor's thread, so Photos never waits for a provider.

• Text Editor: a scroll bar (GitHub #84). Drag it, or click the track to jump there; Ctrl+End (❖↓ in Lord Flow) still goes to the last line. With it, the editor reads its real height: until now it kept 600 × 400, so Page Up and Page Down, keeping the cursor in view and the end of the scroll were off in any other window size.

• Terminal: its own configuration file, wherever you want it. Profiles, colors, key mappings, shortcuts, the hotkey and the windows to restore move out of settings.json into ~/.config/lordos/terminal.json (with a schema number), so they can be backed up, versioned or synced on their own. The move is automatic and loses nothing: settings.json is backed up first (settings.json.pre-terminal-migration.bak) and the section leaves it only after the new file reads back the same. Preferences → Config File shows where it is and can put it anywhere in your home folder or on a mounted disk (move the current configuration there, or use the file already there), and back. Every write is atomic, 0600, with five rotating backups beside it. If the chosen place isn't there (a disk not mounted, a renamed folder), the Terminal keeps working from the last good copy, read-only, says so, and goes back to the file when it returns; a file changed from outside (a restore, a git pull) is read again within 2 s. Export Profiles… and Import Profiles… take LordTerminal JSON as well as other terminal emulators' files; a profile that would type into the shell by itself (initial text, a trigger that sends text, a key that types text) never replaces the default profile, the import list says what it would type, and global key mappings that type text come in only when you turn that option on. The file is protected from other apps' file operations wherever it is (lord.termconf, docs/TERMINAL.md "Configuration file").

• Databases (new app): a MySQL and MariaDB client. Favorites in groups with a color each; Standard, Socket and Cloud connections (managed MySQL services: writer or reader endpoint, TLS required and the provider's certificate checked); passwords kept in Passwords. Per connection: a database pop-up and a table list with filter; Structure (fields and indexes; every change is shown as the ALTER TABLE before it runs); Content (filter rules, sort, 1000-row pages, edit a cell, add, duplicate and delete rows, keyed by the primary key); Query (line numbers, highlighting, completion of tables, fields and keywords, Run Current with Ctrl+Enter and Run All, one tab per result, Explain, history per favorite, and a safe mode that asks before an UPDATE or DELETE without WHERE); Table Info; and a Console with every query the app sends, passwords hidden. A favorite marked production opens read-only until you unlock it. On first run it finds the favorites saved by the SQL client of another computer's system on the home folder or a mounted disk and imports them with their groups and colors (passwords stay in that system's keychain: each is asked once). SSH tunnels, IAM tokens, relations and triggers editing, users, processes, import and export come in a later phase (docs/DATABASES.md).

  • Each connection runs in its own sandboxed helper, lord-sql, that speaks the MySQL protocol itself (TLS, mysql_native_password and caching_sha2_password), with no sockets of its own and no files: lord-server connects only to a saved favorite, through a connector of its own, so the firewall and Monitor show it as "Databases" (lordos:sql). Everything a server sends is parsed bounds-checked and fuzzed in the tests.
  • A password is sent as such (MySQL 8's first login of a user) only over TLS whose certificate was verified or trusted by fingerprint, never to an unchecked certificate, so a machine in the middle can't read it.
  • Values written back into SQL (editing, deleting or duplicating a row) quote a ' as '', which no stored value can turn into the end of the string under any sql_mode (NO_BACKSLASH_ESCAPES included); completion compares table names as words and never builds a pattern from what the server returns.
  • Integrated with Passwords: every password field has the 🔑 button, which offers the password kept for that connection and the Passwords entries whose host is exactly the connection's (a Database, Network or SSH entry's host, or a site), each shown with its host, while Passwords is unlocked; the password leaves Passwords only when you pick one.

• Machines: shared folders. Up to four folders of this computer inside a machine, read-only unless you turn writing on for one (Configure → Sharing → Add a Folder; the bar's folder button lists them, opens each in Files and copies the command that mounts it in a Linux guest: mount -t virtiofs <tag> /mnt/<tag>). Each folder is served by its own virtiofsd (Debian's), started by lord-vm as you, in its own namespaces with only that folder mounted and its own seccomp filter; QEMU gets an already connected socket and never the folder. Only a real folder inside your home (not all of it) or on a disk under /media or /mnt can be shared, never a hidden one nor the machines' library, checked when it's chosen and again at every start; virtiofsd gets the folder as it was checked (opened once without following a link), so swapping a folder of its path for a link afterwards changes nothing. The guest's memory is shared with the helper only on machines that share a folder. Suspend, resume and snapshots with memory keep the folder mounted. machine.json schema 4 (shares); lord-vm --set --share ro|rw:TAG:FOLDER, --shares none. "What Machines Needs" installs virtiofsd.

Changed

-- whiptail and zstd come with LordOS. They are now in every image (the live ISO and the Raspberry Pi image) and among the lordos package's Recommends, so an update brings them to installs that lack them.

• whiptail (61 KB) shows the questions a package asks while it installs, as dialogs in the terminal. Without it debconf said "unable to initialize frontend: Dialog" and fell back to plain text.

• zstd (2.3 MB) is the compressor Debian prefers for the initramfs. Without it update-initramfs warned "No zstd … using gzip" and made a slower one to build and unpack at boot.

• Updates bring the Recommends a new version adds, as apt's full upgrade does, in Update All and when one package is upgraded. Before, the package engine followed only Depends on an upgrade, so a tool newly recommended by the lordos package (whiptail, zstd, and earlier the command-line tools) reached a system that was already installed only through apt. A group is added only when none of its names were recommended by the installed version, so a recommended package the user removed stays removed. One that can't be installed doesn't stop the update.

• Terminal: Settings open in a window of their own. They used to cover the terminal window they were opened from, so nothing could be done in it meanwhile. Now ❖, (or Terminal → Settings) opens one Settings window, or brings it to the front if it is already open, and the terminal stays usable beside it. The profiles on the left are grouped by tag, the same groups as the Profiles menu: the untagged ones first, then one folder per tag that can be folded, with how many profiles it holds; a profile with two tags is in both. A search field filters by name, and by tag: a tag that matches shows its whole folder. The profile's sections (General, Colors, Text, Window, Terminal, Keys, Triggers and Config File) are tabs centred above the form, under the profile's name, its star and its tags, instead of a second list in the sidebar. Changes are still saved as they are made; Done or Esc closes the window. Cloud: "Only in the cloud" or "In sync with this computer", said plainly. Adding an account now asks how to use it, and its page has the same choice in place of the "Files on demand" switch, each with what it means: only in the cloud (every file listed, a file comes down when it is opened and what is copied in goes up, nothing kept on this computer) or in sync (a whole copy here and in the cloud, a deletion on one side goes to the other and the provider's trash keeps it). The browser sign-in's done card asks the same in place of "Keep everything on this computer".

• Passwords has a new icon: a gold key on graphite, unlike the Store's blue bag it was taken for in the Dock.

• Cloud settings: an account's Pause Syncing switch shows only its own pause and says when Pause All (or the battery, a metered network) paused it, with Resume All beside it; Check This Account has Close and waits for an account that works before it runs.

• Cloud: accounts in name order (GitHub #86). Files' sidebar, Files → Network, the file dialog, Settings → Cloud and the menu bar panel list accounts by name, ignoring case and accents and ordering numbers by value ("Drive 2" before "Drive 10"), instead of the order they were added in. Each account keeps its color.

• Cloud: two more providers verified, and clearer check results (GitHub #80, #81). Two providers whose Check This Account reports passed on 0.8.8.6 are listed as verified in Add Account, with the issues as evidence. A step skipped because the provider lacks the feature, such as links, says "Not offered by this provider, not a failure" on screen and in the report instead of a bare "skipped".

• Every app that changed has a new version (GitHub #91). 0.8.8.6 changed Files, Monitor, Settings and others and the Store still showed their old versions. Each app changed since 0.8.8.5 gets its next version, and a release package is refused when an app changed and its version didn't (tools/app-versions.mjs).

• Files: a connected share shows its server's name (GitHub #88). A share found on the network by its name showed as "software on 192.168.1.25" once connected; Files now keeps the name the server was found or typed under and shows it in the sidebar, the title and Network's list. The folder on disk keeps the address (a name is never resolved for the mount).

  A folder shared with write access can't be, sit under or hold a file this computer protects (settings.json, the Terminal's configuration wherever it is, launchers): the machine could change what this computer runs. Checked when the share is made and again before every start; read-only sharing is unaffected.

• Passwords: copy anything, and know what became of it. An item's title and notes have a copy button like every field; a right click on an item in the list copies its title, any field, its 2FA code or its notes without opening it. A copied password shows how many seconds it has before it is cleared, with Keep to leave it there. If something replaces it right away (another app, or a running machine), Passwords says so instead of failing silently. lord-server tells the app only whether its own copy is still on the clipboard, never what the clipboard holds, only for a few seconds after the copy, and not under the firewall's no-clipboard restriction (BOP_CLIP_STATUS). A secret replaced by a picture leaves the picture on the clipboard, and its text is still wiped on time.

• Machines' library looks like Remote Desk. A toolbar of icons, each named in its tooltip: Storage, what Machines needs (only when something is missing), Add (New Machine, Import a machine), pictures or a list, Sort (by name, running first, last used, disk space), Show (all, running, off) and a search over the name, the system and the architecture. The view, the order and the filter are remembered (settings.machinesView). The list view has one row per machine: picture, name and system, what it's doing, CPU, memory and disk. The summary of machines running, memory in use and free space moved to a status line under the library; a click on free space opens Storage. An empty library says "No machines yet" in the middle with New Machine and Import, and a search with no match says so.

• The machine window's bar is icons in groups. The agent and what it brings (clipboard, shared folders, Apps mode) | resolution and devices | shell, logs, screenshot, record | start, pause or resume, and power | Configure and full screen. Each group sits in one rounded container, with a thin line between groups, and every button has its tooltip. The clipboard button shows which ways it works for the machine and leads to Configure to change them; the folder button lists the shared folders; Apps mode is shown, dimmed, with "coming in a later version".

• A machine that is off shows one round Play button over its last picture, dimmed, with its name and state; a suspended one resumes from the same button.

Fixed

• Screenshots: a capture or recording that fails says the real reason (issue #77). 0.8.8.6 shipped without the lord-media helper. Window captures were neither saved nor copied, though the thumbnail said "Copied to clipboard". Screen recording said "Could not start recording (is another recording running?)" with an Open Privacy button, and the markup editor's Save said only "Could not save". The 0.8.8.7 package has lord-media again. In addition, a recording that cannot launch the helper now says "The media helper (lord-media) is not available" (src/ui/js_media.c), and the Screenshots notice offers Open Privacy only when a permission or a restriction is the cause. The editor's Save adds the reason, and a failed Copy says the picture was not copied instead of "Could not save".

• Cloud: a provider that stops answering no longer freezes the desktop (#85). After a paused account was resumed while its provider could not be reached (pCloud, "dial tcp: lookup eapi.pcloud.com: i/o timeout"), Keep on This Computer walked the kept folders through the mount. rclone held each folder about 15 seconds while it tried the provider, one folder after another for minutes, and anything else reading those folders waited with it. The desktop froze for 2 to 3 seconds again and again. Now the keeper does not walk an account that is offline, or one not checked since it was mounted or resumed (Pause, Pause All, back on power). The account is listed once first, and the keeper comes back when it answers. A call through the mount that fails with an I/O error or a time out ends the pass at once and checks the account right away. Listing ~/Cloud (or any folder holding a cloud or network mount) no longer stats each mount's root, which on the interface's thread meant a round trip to the provider.

• Remote desktop: no more "connected but 0 frames decoded" when the graphics card's H.264 encoder produces a stream browsers can't play (#94). The session's live encoder used VA-API whenever the driver opened the H.264 encoder (even with LORD_GPU=0), and switched to libx264 only if opening failed. Some drivers, likely older AMD cards on the radeon kernel driver (VCE 2.0), open it and then return a stream with no SPS/PPS or a broken picture: every browser connected and showed nothing. lord-media now decodes VA-API's first keyframe with FFmpeg's software H.264 decoder before any packet goes out. The keyframe must decode on its own to a picture of the right size that looks like the frame that went in (a grid of luma samples). If it doesn't, if the card refuses a frame, or if it gives no packet for 8 frames, the same encoder goes on with libx264 from the current frame and the journal says why. When no picture arrives, the page's details also show how many video packets and frames the browser received, its decoder, and whether the computer encodes in hardware or software. New tests: encheck-test and lmstream-test (lord-media end to end with libx264, VA-API, and a build whose check always fails), in make -C server test-full.

• Xwayland: GTK programs that only allow X11 open again; VMware clipboard, partly (#76). The session set GDK_BACKEND=wayland. GTK then skips every backend a program doesn't allow, so a program that only allows X11 couldn't open any display. That included VMware's vmware-user agent from open-vm-tools-desktop, which stopped at gtk_init. The session now sets GDK_BACKEND=wayland,x11: GTK apps still open on Wayland, and X11-only GTK programs get Xwayland. With vmware-user running, what the host copies reaches LordOS through the X11 clipboard bridge. Copying from the guest to the host works for text copied in X11 apps. LordOS doesn't start the agent by itself yet (setsid vmware-user & from the Terminal), and text copied in LordOS or Wayland apps doesn't reach the host yet. Both need security review; see docs/WAYLAND.md, "VMware Tools". Not yet tested on a VMware host.

• lordos-issue now includes the last 40 lines that Linux apps printed (~/.cache/lordos/apps.log) and the last 20 lines of Xwayland's log (~/.cache/lordos/xwayland.log, without xkbcomp's keymap warnings), with the same name and address replacement as the rest of the report. When a Linux app closes as soon as it starts, its reason was only in those files, so reports did not show it (#95, WordCraft from the ArtCraft launcher on a Raspberry Pi 500). TROUBLESHOOTING.md gains "A Linux app doesn't open".

• A "More" menu near the bottom of a window opens upward. Every app's ⋯ button (the SDK's MenuButton) opened its menu downward, so a button in a footer, like the favorites' ⋯ in Databases, had its menu cut off by the window's bottom edge. The menu now opens upward when it doesn't fit below the button and there is more room above.

• Databases: a folder of favorites can be deleted or renamed even when it is empty. Rename Folder and Delete Folder were only in the ⋯ menu, and only for the folder of the selected favorite, so a folder with no favorites could not be removed. A right click on a folder now opens its own menu with New Favorite, Rename and Delete. Deleting a folder still moves what was in it up one level.

• Displays keep their signal across lock, logout and login, and logging out doesn't freeze the desktop. At every hand-off of the monitor, lord-sessiond removed the leaving session's framebuffers while they were still on the screen; amdgpu refuses to turn a plane off that way ("atomic remove_fb failed with -22" in the kernel log at every lock and logout) and the displays went dark, and a DisplayPort monitor put to sleep like that may not wake up until it is unplugged. Every lit display now gets a black frame of its own mode first, let go with CLOSEFB (it stays until the next session or the login screen shows its own), so nothing of the session stays visible and no link drops. Logging out asks lord-sessiond for the login screen at once; the session then closes its apps and unmounts its cloud folders off the screen, instead of leaving the desktop frozen for seconds meanwhile.

• A click anywhere in a window brings it forward, and the keyboard with it. A sheet or dialog that keeps its clicks to itself (Settings → Cloud's sign-in, Mail's, Contacts' and Calendar's sheets, the file dialog, Monitor's map buttons, and more) stopped the click before the window could come forward. With another window in front (Passwords, opened to unlock it for the 🔑), the code typed into the Settings sheet went to that window instead. The runtime now has a capture phase for presses (onMouseDownCapture, outermost first, which nothing inside can stop), and windows come forward there.

• Cloud: an account signed in with a password and a device code no longer asks for a new sign-in after every logout or reboot. rclone keeps the account's session (cookies, trust token) in its options and updates it in memory, but only accounts signed in through a browser were read back into the keyring, so rclone started again with the session of the first sign-in, which the provider refuses. Every account is now read back every 5 minutes and once more before rclone stops. An option rclone gives back stays out of rclone.conf unless it is known not to be secret. When the provider refuses a saved session the way rclone sometimes does for a password provider after a restart (its issue 9658: "Missing WEBAUTH-TOKEN cookie", whether or not the account has end-to-end encryption), the session is dropped once and rclone signs in again with the password and the kept trust token, which asks for no code while the token lasts. If that fails too, the account says Sign In Again (instead of "couldn't open the account's folder") and is tried again after 30 minutes instead of every 30 seconds.

• Files: a folder of photos no longer runs the desktop out of memory (GitHub #71, #82). Each JPEG or PNG icon was the whole picture, decoded on lord-server's interface thread and kept until the session ended: a 12-megapixel photo took 48 MB, so opening a folder of phone photos (a cloud account kept on this computer, for example) froze the desktop and lord-server ran out of memory and the session ended. Icons and the preview are now thumbnails made by two background threads at the size shown; pictures no window shows are kept up to 64 MB and then let go, and nothing over 67 megapixels is decoded. Measured with 1,520 12-megapixel photos: from 10 GB in 23 seconds (then killed) to 265 MB at most, no pause over 0.4 s; with 300 of them, 154 MB once the thumbnails are made.

• Thumbnails: a big folder of videos no longer keeps the desktop busy. Every thumbnail asked lord-server again on each redraw, and every answer, or failure, redrew all of them; with 1,500 videos and no media helper (as 0.8.8.6 shipped) the desktop stayed unresponsive for minutes. Each thumbnail is now asked once (again at most every 5 s while it is being made, every minute once known) and an answer redraws only the items that show it.

• Bluetooth headsets play in high fidelity (GitHub #78). A headset that paired but stayed silent as the output now plays. The sound server switched a headset to its low-quality hands-free mode whenever anything recorded (even the level meter in Settings → Sound), which some adapters can't carry at all. That automatic switch is off (/etc/wireplumber/wireplumber.conf.d/lordos-bluez-profiles.conf) and LordOS picks the profile itself: choosing a headset as the output gives it high-fidelity playback unless its microphone is the chosen input, which Settings → Sound offers as "(headset mode)". Settings → Bluetooth no longer offers the low-energy side some headsets also advertise as "LE-" when the headset's own entry is listed, and a failed pairing of it says why instead of "the code did not match". Not yet tested with a real headset.

• Cloud: Tell Us on GitHub works (GitHub #79). After Check This Account the button opens the provider issue form with the report filled in. The browser launcher refused any web address over 300 characters and the report's parentheses went unencoded, so nothing happened. A web address may now be up to 3000 characters (other schemes keep 300, same allowed characters), and when no browser takes it the report is copied with a note saying where to paste it.

• Cloud: a second browser sign-in no longer fails after the provider's success page (GitHub #87). When a provider listed first a drive that can't be opened, setting up the account stopped and Settings said the sign-in didn't finish. LordOS now tries the next drive (up to four); if the account has no usable drive it says so (open the account once on the provider's website), shows rclone's own message and removes the half-made account. Tested against a local stand-in for rclone, not a real account.

• Cloud: Keep on This Computer shows a steady badge, and the check understands kept accounts (GitHub #71). A kept folder keeps the "coming down" badge until every file in it is on this computer, instead of flashing the green check between files. On an account kept on this computer, Check This Account skips Free Up Space ("Kept on this computer, so not freed: not a failure") instead of failing after 40 seconds.

• Window screenshots include the window's open dialog (GitHub #58). Choosing a window with ❖⇧4 and Space left out a dialog the window had open (the file dialog of Settings → Wallpaper → Choose picture…). A sheet an app opens is now painted over its window in the capture; other windows' sheets, menus and the Dock are still left out, and protected windows stay black.

• Mail, Calendar, Contacts, Reminders and Passwords can paste (GitHub #64). These apps run isolated, and reading the clipboard needs a permission they never ask for, so Ctrl+V did nothing. Now a paste the person asks for in the app's window (Ctrl+V or Shift+Insert, which lord-server sees reach it, or the clipboard panel) lets that app read the clipboard once within 2 seconds. The app can't fake the keys, and any other read still needs the permission.

• Photos: a picture that can't be opened says why (GitHub #90). 0.8.8.6 shipped without the media helper and every picture showed as a black screen with nothing said, because the decoding failed before the picture could be told. It now shows "This image cannot be opened" and the reason. 0.8.8.7's package has the helper again (and the packaging refuses a package without it).

• The package can't be built without its helpers. 0.8.8.6 shipped without lord-media (screenshots, video, music, camera) and lord-vmdisplay, because the machine that built it lacked FFmpeg's and libsystemd's -dev packages and make skips a helper quietly when its libraries are missing. tools/iso/mkdeb.sh now stops and names each missing helper and what it needs; ALLOW_MISSING="name …" leaves one out on purpose.

• Screenshots says when a capture couldn't be saved or copied. A notification names why (for example, the media helper is missing), and the thumbnail says so instead of "Copied to the clipboard".

• Media jobs no longer wait forever when lord-media is missing. A job that failed at once (no lord-media) was freed before lord-server returned its id, so the app got a wrong id and never heard the job end: Screenshots saved and copied nothing and said nothing. The id is now taken first (src/media/media.c).

• Migrate from another app: an encrypted VMware machine is called encrypted. A machine VMware Fusion encrypted as a whole (as it does for a virtual TPM) keeps only its name and the wrapped key in the clear in its .vmx; the importer said "not a .vmx settings file". It now names the machine and stops with encrypted, which tells to remove the encryption in the app that made it.

• Files: a Cloud or network folder never freezes the desktop any more. Deleting a file inside a Cloud account's folder (any Cloud account, mounted by rclone through FUSE) froze the whole desktop, pointer and every window, until rclone finished, and going back to the parent folder could freeze it again until rclone answered. lord-server is one thread for input, layout, painting and JS, and Files read those folders with synchronous lord.fs calls on it: the folder's listing (lord.fs.list: a readdir, a stat per item and a realpath per subfolder, apps/files/locations.js), a lord.fs.stat per row for the list view's extra columns, the folder's own stat (is it writable) and statvfs (free space). On a FUSE mount each of those waits for rclone, which asks the provider when its listing is old or was just changed; and while the delete (on the Cloud's own thread since 0.8.5) runs unlink, the kernel holds that folder's lock, so the listing Files asked for right after waited for the provider too. Now:

  • New lord.fs.listAsync / statAsync / trashAsync / freeAsync / mkdirAsync / renameAsync run on a small pool of worker threads (server/src/fsasync.c, at most 6 threads and 256 requests; a full queue answers fs.busy at once) and answer through an eventfd the main loop polls (__lordFsReply). A worker resolves and checks each path with exactly the functions the synchronous calls use, now shared in fsops.c (fsops_resolve_readable / _target / _stat, fsops_list, fsops_stat): the writable roots, /proc, /sys, /dev and /run, the fsops_protected deny list (also for a parent of a protected path), a share that stopped answering, and only the Trash as a way to delete. No new operation and no way to run commands.
  • lord.fs.mounts() gives the mount table, and fs.isRemote(path) in the SDK says from it (no file system call) whether a folder is on a Cloud account, Connect to Server, SMB, NFS or other FUSE mount.
  • Files lists those folders off the thread and keeps each listing (apps/files/remotedirs.js): a folder opens at once with "Loading…" the first time, a folder seen before (going back) shows its last listing while a new one comes, the status bar says "Waiting for the folder to answer…" when a listing takes longer than 0.4 s, and the window, the Dock and every other app keep answering meanwhile. The listing brings what the list view's columns need, so rows aren't asked one by one. Deleting in a Cloud account, or moving to the Trash on a share, takes the items off the view at once; a new listing when it ends brings back any the provider refused, with the reason in the status bar. New Folder, Rename, the folder's write permission, its free space, Get Info, the column view, unfolded folders in the list view, favorites and the names a copy or paste picks run off the thread there as well.
  • A move inside a Cloud account or a share (a rename at the provider) runs on the copy job's thread instead of the interface's.
  • Local folders keep the synchronous calls (nothing changes there).
  • Tests: build/fsasync-test holds requests in a fake slow file system and checks that submitting never waits, that other folders answer meanwhile, a full queue, every answer, and that each refusal is the synchronous call's own (outside the roots, /proc, protected files and their parents, renaming onto an existing name); tests/files_remote_test.mjs checks the listings Files keeps (one at a time per folder, the last one shown while a new one runs, items hidden during a delete and back only if still there) and which folders count as slow.

Known issues and limitations

• A cloud account signed in with a password and a device code may ask for the code again after every logout or restart. The session is kept in the keyring, but the provider refuses it when rclone starts again, and signing in with the kept trust token asks for a new code (an open problem in rclone's backend for that provider: its issues 9658 and 9966, with fixes proposed and not released yet). LordOS says so when the account is added and asks for a new sign-in instead of failing quietly. An account waiting for a sign-in is no longer tried again by itself: not every 30 minutes, and not when its folder is opened in Files, because each try could send a code to the person's devices. The account's page in Settings explains it and links rclone's issue. It also has Copy Log for rclone: the last lines of rclone's log about that backend, with the account's name, e-mail addresses, the home folder, query strings and long tokens taken out, ready to paste in the issue. In Files, the account's folder says that it needs a new sign-in instead of "Folder is empty", with Sign In… (it opens the account in Settings) and the issue's link. lordos-rclone will follow rclone's release with the fix. A build with the proposed escrow fix (rclone PR 10048, reviewed line by line) was tried with a real account and did not help, so it is not shipped.
• The browser sign-in drive and the password-and-code drive (onedrive, iclouddrive) are verified providers now: tested end to end by the maintainer with their own accounts on a bare-metal machine. They are listed first in Add Account, and Check This Account for them moves under Advanced.

---

Downloads

File	What it is
lordos-live-0.8.8-amd64.iso	Live and installable image for 64-bit PCs (UEFI and BIOS). Write it to a USB stick as is; Secure Boot off. It installs 0.8.8; Store → Updates brings it to 0.8.8.7.
lordos-0.8.8-amd64.ova	Virtual machine image for VirtualBox and VMware: open it and the machine is imported. You create your own account on its first boot.
lordos-live-0.8.8-arm64.iso	Live and installable image for generic arm64 machines and virtual machines with UEFI. Secure Boot off.
lordos-0.8.8-rpi5-arm64.img.xz	Image for the Raspberry Pi 5, for the LordOS Imager (below) or Raspberry Pi Imager ("Use custom"), an SD card or an NVMe drive.
lordos_0.8.8.7_amd64.deb	The LordOS package for an existing Debian 13 on a PC (installed by install.sh, or with apt install ./…).
lordos_0.8.8.7_arm64.deb	The same package for Debian 13 on arm64.
lordos-rclone_1.75.2-1_amd64.deb, lordos-rclone_1.75.2-1_arm64.deb	rclone's official release binary (the same files as in 0.8.8.5 and 0.8.8.6), for Cloud and Connect to Server; the LordOS package depends on it (install.sh installs it with the package). MIT.
lordos-hwdata_2026.11.06_all.deb	The signed tested-hardware snapshot for System Information's Compatibility panel (the same file as in 0.8.8.6), which the LordOS package depends on; install.sh installs it with the package.
lordos_imager_0.8.6_universal.dmg	LordOS Imager for Mac (both processor families, signed and notarized): writes LordOS to an SD card or a USB stick and prepares the Raspberry Pi 5's first boot.
lordos_imager_0.8.8.6_x64_setup.exe	LordOS Imager for Windows (64-bit installer, the same as in 0.8.8.6; not code-signed yet, so the system asks before running it).
lordos_imager_0.8.8.6_amd64.deb	LordOS Imager for Linux (Debian 13 and similar, amd64; needs udisks2; the same as in 0.8.8.6).
lordos-disk-formats_0.8.8.7_<arch>.deb	Store → Disk Formats: support for more disk and file system formats, installed from the Store (never inside the images).
install.sh	The one-line installer for Debian 13: curl -fsSL https://lordos.org/install.sh | sh. It checks the signature before installing.
SHA256SUMS	The SHA-256 of every file in this release.
SHA256SUMS.sig	The Ed25519 signature of SHA256SUMS with the LordOS release key (base64).
lordos_0.8.8.7_<arch>.spdx.json	Software bill of materials (SPDX 2.3) for each package: what it bundles and the Debian packages it depends on.

Verifying the downloads

The LordOS release public key is lordos-release.pub.pem (in the repository, or at https://lordos.org/lordos-release.pub.pem). Its fingerprint, the SHA-256 of the DER public key, is:

c7155b8e6bbbb180f907381994d06af76d333016cd6f3facf67cadd053ea108e

With OpenSSL 3, in the folder with the downloads:

openssl pkey -pubin -in lordos-release.pub.pem -outform DER | sha256sum   # must match the fingerprint
base64 -d SHA256SUMS.sig > SHA256SUMS.sig.bin
openssl pkeyutl -verify -pubin -inkey lordos-release.pub.pem -rawin -in SHA256SUMS -sigfile SHA256SUMS.sig.bin
sha256sum -c --ignore-missing SHA256SUMS

"Signature Verified Successfully" and "OK" for each downloaded file mean the files are the ones we published. Details: docs/SIGNING.md.

Links

• Website: lordos.org
• The project paper: lordos.org/paper
• Documentation: docs/README.md
• Security policy and reporting a vulnerability: lordos.org/legal/security
• Full changelog: CHANGELOG.md