Download

[4.1.5] - 2026-07-15

Non-Identical Duplicate Detection, Restartable Transfers and AeroCrypt Portability

Find Duplicates gains near-duplicate detection across images, text and arbitrary payloads, exposed in the GUI, CLI and agent tools and always opt-in. The transfer queue now survives an app restart, bringing interrupted transfers back as re-queueable Restored items. AeroCrypt gains portability and safety work: an advanced default-salt mode, a shared .aerocrypt.tsv marker with verified migration, an offline Emergency Kit validity check, and a missing headed marker rebuilt from the local keystore. Password Forge becomes always-discoverable with reusable presets and honest 2FA-secret handling, classic rsync animates a live progress bar, and the CLI honours machine-mode and banner environment variables consistently. 47 languages translated.

Added

• Non-identical duplicate detection across the engine, GUI, CLI and agent tools: a shared engine routes raster images through pHash, text including SVG through SimHash with a MinHash cross-check, and any other payload through pure-Rust TLSH; the GUI and CLI expose Exact and Non-identical modes, local_find_duplicates delegates to the shared engine with similarity metadata, and aeroftp_dedupe / remote_dedupe support non-identical staging with similarity and distance while preserving the remote exact SHA-256 fast path. Non-identical mode is opt-in and never auto-selects files for deletion (@EhudKirsh, #383).
• The transfer queue survives an app restart: interrupted queue items are journaled atomically to aeroftp_data_root/transfer-queue/queue.json as re-executable descriptors, and on the next launch any transfer that was still pending or in flight comes back as a re-queueable "Restored" item with a Retry action. Restored items do not auto-start or auto-reconnect: after you reconnect to the same server, Retry re-runs them through the normal transfer path. Verified live end to end (persist, restart, restore, real re-upload of a 100 MB file). Per-provider byte-range resume stays deferred.
• AeroCrypt default-salt portability and TSV marker migration: default-salt mode is an advanced opt-in with a password-strength gate, explicit attestation and salt-mode MAC binding, and the recovery kit gains QR export controls; new headed markers write .aerocrypt.tsv while the legacy .aeroftp-crypt.json stays readable, and CLI and GUI migration verifies the new marker before deleting the old one (@EhudKirsh, #276).
• Emergency Kit validity check (crypt kit-verify and GUI Verify): a saved kit text, QR dump, .aerocrypt.tsv or legacy .aeroftp-crypt.json can be re-parsed offline and checked against the active profile keystore (vault id, salt, version, KDF) without a recovery drill or password, from the CLI crypt kit-verify, the Tauri aerocrypt_verify_recovery_kit command and the Recovery Kit modal Verify action with native Save and Print (@EhudKirsh, #276).
• Password Forge and encrypted-provider credential hardening: Security Tools is always discoverable, the generator supports reusable presets including Compatible 32, granular and custom character sets, exclusions, guaranteed selected groups, batch generation and live entropy, and inline generation covers AeroVault, encrypted overlays and protected archives. Saved Filen and MEGA 2FA secrets are demoted behind a collapsed advanced disclosure with an honest warning, Filen bridge credentials enforce the documented 32-character restrictions, and MD5/SHA-1 are marked legacy (@EhudKirsh, #266, #369).
• CLI machine mode via AEROFTP_MACHINE: a truthy AEROFTP_MACHINE enables machine and agent output mode as an equivalent to --machine, resolved right after argument parsing so agents and CI no longer repeat the flag on every call.

Changed

• AEROFTP_NO_BANNER realigned to the strict_env_truthy convention: it now matches AEROFTP_STRICT and AEROFTP_MACHINE, so only 1, true, yes or on suppress the banner, and =0 or =false no longer do.
• The Linux release workflow retries transient Tauri AppImage helper downloads: the bundling step retries the helper fetch that occasionally fails mid-build, reducing spurious red Build runs.

Fixed

• Emergency Kit recovery wording no longer contradicts itself: the printed kit and the recovery-kit panel told the user both to save the kit "together with your password" and to "NEVER store the password alongside this kit". The copy now separates the functional requirement (the kit and the password are both needed to recover a vault, neither one alone can open it) from the security rule (keep them in separate places), retranslated across all 46 non-EN locales (@EhudKirsh, #276).
• A missing headed marker is rebuilt from the local keystore with a one-shot lockout warning: when a headed vault's remote marker is gone, unlock no longer silently degrades to headerless; the marker is restored from the keystore and the user is told not to delete it again. Profile withHeader is plumbed end to end, and legacy JSON to TSV conversion is opt-in from the AEROCRYPT badge menu when the JSON is still present (@EhudKirsh, #276).
• Classic rsync transfers animate a live progress bar instead of jumping at the end: the classic rsync path (system rsync with --info=progress2) parsed live progress lines but dropped them, so a delta transfer over that path showed no movement until the final summary; the existing progress sink is now threaded through RsyncBinaryTransport into run_rsync and called on each parsed line, matching the native delta path.
• A drive attached while AeroFTP is in the background now appears in the PLACES sidebar on window focus: on Windows and macOS the volume watcher falls back to a 30s poll (real-time inotify is Linux-only), so a freshly attached drive could take up to 30s to show; AeroFile now refetches mounted volumes and unmounted partitions on window focus. Linux is unaffected (@EhudKirsh, #351).

Security

• Credential and marker hardening. Default-salt mode binds the salt mode into the MAC so a silent downgrade is detected, the missing-marker rebuild is fail-closed (it restores from the local keystore rather than silently opening headerless), and saved 2FA secrets are demoted behind an honest advanced disclosure. The dependency review was clean: cargo audit reported no advisories over 1206 crate dependencies and npm audit reported no production vulnerabilities.

Contributors

Downloads:

• Windows: .msi installer, .exe, or .zip portable (no installation required)
• macOS: .dmg disk image
• Linux: .deb, .rpm, .snap, or .AppImage

[4.1.4] - 2026-07-13

AeroCloud Multi-Pair Sync, Headerless AeroCrypt with an Optional Recovery Kit, a Strict Overlay Scope, and a CLI Agent Mode

AeroCloud grows from a single GUI-only folder into a real multi-pair sync engine reachable from the CLI, with delete propagation, one-way modes, a tunable real-time watcher, SFTP key auth and a compression overlay. AeroCrypt's default becomes a lean headerless base that writes nothing on the remote and opens with just your key, paired with an optional on-demand Recovery Kit that works in every mode and a strict sub-folder overlay scope, plus an opt-in same-name privacy hint. The CLI gains an agent-friendly machine mode and a remote find-and-replace edit, native profile backups round-trip every field, and Windows learns to open archives and expose an in-app File associations panel.

Added

• AeroCloud multiple sync pairs: run more than one local-to-remote pair per install, each with its own saved profile, protocol, direction, sync index and crypt overlay, driven by the same background worker and reachable from the CLI (aeroftp-cli aerocloud pair list/add/remove/enable/disable/sync). A dedicated cloud_pairs.json store keeps each pair's sync index isolated by a per-pair id plus a duplicate-target guard, an empty store falls back to the legacy single config, and the connect-wrap-sync sequence is unified into one helper the worker and CLI share. Verified headless with two independent pairs (MEGA and Koofr) synced in one pass. All 46 non-EN locales (@EhudKirsh, #405).
• AeroCloud delete propagation: a file deleted on one side is now removed on the other instead of the surviving copy resurrecting it, an index-aware decide-and-execute with a safety gate on both the provider and FTP twins. This is the line between sync and copy. Verified headless on a real MEGA remote (@EhudKirsh, #405).
• AeroCloud send-only and receive-only folders: per-folder direction (bidirectional, send-only, receive-only) with a preserve-remote-deletes toggle for additive backup versus strict mirror (@EhudKirsh, #405).
• AeroCloud from the CLI: aeroftp-cli aerocloud show/set/enable/disable/status/sync configures and runs AeroCloud headless where it used to be GUI-only, the first step toward the AeroCloud and AeroSync engine convergence (@EhudKirsh, #405).
• AeroCloud SFTP key-based auth: a saved key-auth SFTP profile, plaintext or passphrase-protected, now works as an AeroCloud target, covering both the background worker and aeroftp-cli aerocloud sync (@EhudKirsh, #405).
• AeroCloud AeroCompress overlay: compression is now a real per-config and per-pair overlay composed outside the crypt builder, so upload order is compress then optional encrypt; levels persist and are editable from the GUI and CLI. Verified on MEGA with zstd and stored modes and byte-equal round-trips (@EhudKirsh, #405, #276).
• AeroCloud real-time watcher tuning: the debounce quiet period and the cooldown between watcher-triggered syncs are now editable from the GUI and CLI (aerocloud set --watcher-debounce-ms / --watcher-cooldown-secs), answering the bandwidth concern about real-time sync (@EhudKirsh, #405).
• Overlays Remote Path, a strict sub-folder crypt scope: pin an AeroCrypt overlay to a strict descendant of the connection Remote Path (connect into /data, encrypt only /data/vault, pass everything outside through as plaintext), from the GUI Connection screen and the CLI crypt bind. Relative UX, live validation that rejects an ancestor, sibling or prefix-trap, empty means same-as-Remote-Path, and the scope locks once bound. All 46 non-EN locales (@EhudKirsh, #369).
• Optional same-name privacy hint for encrypted vaults: an opt-in setting (Privacy, off by default) that, inside an active crypt overlay, flags files and folders whose plaintext name also appears at another path you have browsed. Filename encryption is deterministic, so identical names are visible as identical to an observer of the encrypted store, the same tradeoff as rclone-crypt and Cryptomator; the hint is a quiet chip with an explanatory tooltip, never a nagging dialog. All 46 non-EN locales (@EhudKirsh, #276).
• CLI agent mode and a remote find-and-replace edit: a global --machine flag emits only structured data on stdout for clean agent parsing, and a new edit command (and MCP aeroftp_edit tool) does a literal find-and-replace on a remote text file in place with no local download, replacing all by default or the first with --first, a no-op when nothing matches, refusing binaries, directories and files over 10 MB. Live-verified on SFTP.
• CLI delete and del aliases for rm: rclone and DOS muscle-memory now resolve instead of erroring, as visible aliases with no new subcommand.
• users -i per-user group labels: the interactive Users section gained Add and Remove group verbs that edit the selected user's own group partition, idempotent add, clear failures on locked users, no global membership table (@EhudKirsh, #311).
• Windows archive opener registration: AeroFTP registers as an available opener for .zip, .7z, .rar, .tar, .tgz, .gz, .xz and .bz2 through a shared ProgID and Capabilities, preserving existing defaults, with NSIS and WiX parity (#361).
• In-app File associations panel: a compact OS-backed section in Settings > File Handling showing live Default and Available status for AeroFTP formats and archives, applied via xdg-mime on Linux, Default apps on Windows, best-effort on macOS. All locales, unit-tested (#361).
• AeroImage lossless-or-pass-through Save As: converting one lossy format into a different lossy one warns and keeps the save buttons disabled until an explicit acknowledgement, while pass-through and lossless targets stay silent; the guard is unit-tested across the full truth table. All 46 non-EN locales (@EhudKirsh, aerovault#2).
• Single pre-release smoke entrypoint npm run smoke: one command runs the deterministic Rust and frontend suites plus the lab-backed integration lanes, clean-SKIPs when Docker or credentials are absent, prints a PASS/SKIP/FAIL matrix and exits non-zero only on a real fail (@EhudKirsh, #347).

Changed

• AeroCrypt default is now a lean headerless base: crypt init writes nothing on the remote by default and stores the public config (version, salt, KDF params, vault id) in the local keystore per profile, so a vault opens with just your key and leaves no marker on the remote; --with-header restores the on-remote .aeroftp-crypt.json marker as an opt-in for self-contained portability and on-remote tamper-evidence. Lossless migration both directions (crypt to-headerless / to-headed, metadata only, objects byte-identical), GUI header opt-in toggle, connect-time keystore load, MCP unlock parity. All 46 non-EN locales (@EhudKirsh, #276).
• The AeroCrypt Recovery Kit is optional, on-demand and works in every mode: the public recovery kit (vault id, salt, KDF params, never secrets) no longer gates create or connect in the GUI; it is available any time from the crypt toggle and the saved-server menu, re-viewable and re-savable, for headerless, headed and keyfile vaults alike. Headed vaults now cache their public config locally on connect, so the kit is reachable without the remote marker, and a keyfile vault's kit spells out that the keyfile is also required (@EhudKirsh, #276).
• Provider label accuracy: 'pCloud' is now 'pCloud Drive' and 'Amazon S3' is 'Amazon Web Services (AWS)', and the Add Services search matches 'aws' where it returned nothing before (@EhudKirsh, #347).
• Yandex Disk WebDAV recategorized as paid: Yandex 360 gates WebDAV behind the subscription since 22 June, so Yandex Disk WebDAV now carries the paid marker in the Add Service table while its OAuth API stays free (@EhudKirsh, #274).
• Refreshed the Google Drive and OneDrive provider marks to their current official 2026 icons, in the provider logos and the README integrations row (@EhudKirsh, #347).
• RustCrypto core crates held on the 0.10 cohort with documented pins: the aes-gcm 0.11, chacha20poly1305 0.11 and cbc 0.2 bumps do not converge with aerovault, noq-proto and the transitive keyring cohort, so they are pinned with the reason recorded in Cargo.toml; crypto core verified to still round-trip including a live Cryptomator vault (Dependabot #379, #380, #381).
• Routine dependency maintenance: six Dependabot bumps merged after the v4.1.3 tag (vite 8.1.4, vitest 4.1.10, autoprefixer 10.5.2, country-flag-icons 1.6.20, ssh2 0.9.6, clap_complete 4.6.7), all patch or minor with green CI.

Fixed

• Headerless AeroCrypt now works in the GUI: connecting or toggling a headerless profile used to fail closed every time and fall back to the raw provider, so files could upload in plaintext into what looked like an encrypted folder; the GUI was dropping the profile id the keystore config is keyed by. Forwarding it fixes connect-time unlock, the badge toggle and create-at-first-connect, verified live end to end (@EhudKirsh, #276).
• Native profile backup (.aeroftp) round-trips every saved field: four top-level fields (share-link base, custom and detected icons, silenced classic-fallback preference), the per-profile Filen CLI API key and the OneDrive drive id and type were silently dropped on export or re-import; all now survive, and a second silent drop in the GUI import merge is fixed (#230, #215).
• A profile action leaves no residue and no half-copy: deleting a profile now removes every vault secret scoped to it (before: only the password, orphaning the Filen key, crypt-overlay secrets and OAuth token), duplicating copies all of them, and export carries all of them, through one shared source of truth used by both the GUI and CLI; profile-add reaches full CLI parity and a cloud profile with no host no longer fails profile-export.
• AeroCloud multi-pair correctness hardening: the background worker resolves each pair's protocol from the vault, concurrent manual and background syncs are serialized by a restored in-progress guard, and a locked-vault sync fails closed while the SFTP key passphrase is zeroized (@EhudKirsh, #405).
• Bounded and atomic remote edit: the CLI remote edit streams and caps the download at 10 MB instead of reading up to 500 MB first, and writes via a temp-then-rename so a failed transfer never corrupts the target.
• WebDAV rename on strict servers: the MOVE request now sends Depth: 0 for servers that require it, and the delete preview is more robust on stat-less pseudo-directories.
• About > Technical archive crate version resolves: the Technical tab keyed the crate as sevenz-rust but the backend reports sevenz-rust2, so the update check queried a deprecated crate and showed an error; aligned so the version resolves.

Security

• Pre-tag commit audit: PASS. A final adversarial commit audit ran over the cycle with three parallel reviewers (the universal recovery kit, the same-name privacy hint, and the AeroCloud / CLI / profile bulk) and confirmed no security or correctness defects: the recovery-kit config cached for headed vaults is public-only and its write is fail-closed for headerless and best-effort for headed, the same-name tracker is keyed to the live vault and cannot bleed across vaults, and AeroCloud delete propagation is gated against a mass-delete wipe. Two cosmetic follow-ups were fixed in the same release: a stale set of recovery-kit intro translations, and a defensive skip of . and .. in the same-name tracker. The dependency review was clean (cargo audit reported no advisories; the RustCrypto core crates stay on documented convergence pins).

Contributors

Downloads:

• Windows: .msi installer, .exe, or .zip portable (no installation required)
• macOS: .dmg disk image
• Linux: .deb, .rpm, .snap, or .AppImage

[4.1.3] - 2026-07-11

Archive Encryption and Compression at a Glance, Crypt-Overlay Scope with Keyfile 2FA, Safer CLI Deletes, Faster SFTP Listing and macOS Stable

A polish-and-hardening release: AeroFTP surfaces archive encryption, real compression method and AeroVault generation at a glance in both the local and remote file browsers without downloading anything, the crypt overlay now shows plaintext outside its bound subtree and decrypts only inside it across the GUI, CLI and MCP and gains an optional keyfile second factor, the destructive CLI delete verbs get a real dry-run preview with recursion now opt-in, recursive SFTP listing is about three times faster, macOS is promoted from beta to stable, and a broad security audit runs the length of the cycle. Pre-tag commit audit: PASS, the final pre-release audit closed six integrity, fail-open and race residuals; 47 languages translated.

Added

• Optional keyfile second factor for native AeroCrypt: a "something you have" file mixed into the key derivation (stronger than rclone's password2) with no change to the on-disk object format; generate a transfer-safe keyfile from the GUI or CLI, make a vault keyfile-only (an empty password is legal), and the keyfile path travels through profile export/import as a re-pointable pointer that resolves fail-closed at connect across GUI, CLI and MCP (@EhudKirsh, #272).
• Archive encryption, compression and AeroVault generation surfaced at a glance in the local file browser: a padlock next to the Type (closed emerald for a strong cipher, amber for weak ZipCrypto, open grey for a detectable but unprotected archive) for password-protected zip, 7z and RAR showing the real detected cipher (AES 256/192/128, ZipCrypto, RAR5 AES-256, RAR4 AES-128), an optional Encryption column, a Compression column with the real method (Deflate, BZip2, LZMA, LZMA2, PPMd, Zstd, or Store for an uncompressed archive), and an AeroVault generation chip (v2/v3/v4) on our own .aerovault, .aeroftp and .aeroftp-keystore containers; detection reads only the archive header lazily and never downloads or opens the file, and a locked archive gets a dedicated draggable unlock modal that names the real cipher.
• New Date format setting (Settings > General): choose how dates render app-wide (Localized, ISO 8601, DD/MM/YYYY or MM/DD/YYYY), applied live to the file browser and every other date with no restart; localized dates now follow the selected app language instead of the OS locale.
• The same encryption and AeroVault surfacing on the remote panel: an .aerovault, .aeroftp or .aeroftp-keystore on a remote, plus password-protected third-party zip and 7z, show the padlock, Encryption column and AeroVault chip without downloading the file, reading only the header via provider ranged reads; scoped to the range-capable transports (SFTP, FTP/FTPS, S3, WebDAV, Backblaze B2, Koofr, and now Azure Blob, Uploadcare, Cloudinary and ImageKit) and degrading to no badge where a transport cannot serve byte ranges.
• The crypt overlay now shows plaintext outside its bound subtree and decrypts only inside it, from the CLI and MCP too (CWP-20C): ls, tree, lsjson and the MCP listing tools were reporting a scoped-overlay remote whose root is not the vault as empty or as only its encrypted items; the read path is now scope-aware (decrypt strictly below the anchor, pass everything at or outside it through as raw plaintext) while every write stays fail-closed so plaintext can never land where ciphertext is expected, verified live on Filen and lab SFTP (@EhudKirsh, #369, #266).
• CLI --no-crypt connect flag to bypass a bound crypt overlay and connect raw, mirroring the GUI crypt button and closing a CLI-parity gap (#390).
• Full S3 trash and version management: browse soft-deleted objects and delete markers under a prefix, undelete, copy-forward an older version to current, purge a single version, and empty the trash with a dry-run preview, from the GUI, the CLI (versions trash / versions purge / versions empty-trash) and MCP; the crypt overlay is peeled to the concrete S3 provider so names decrypt while every operation round-trips on the raw key, and mkdir no longer writes a zero-byte directory marker that rendered as a phantom empty file on some gateways (@EhudKirsh, #266).
• A real dry-run for the destructive CLI delete verbs: aeroftp-cli rm --dry-run and purge --dry-run print the exact files and directories that would go plus the bytes reclaimed and delete nothing, the MCP aeroftp_delete / aeroftp_delete_many tools take the same dry_run returning would_delete: true with the byte total, and rm / purge now honour the global filters (--include, --exclude-global, --min-size / --max-size, --min-age / --max-age, --files-from) so a filtered recursive delete removes only the matching files and the directories it empties in doing so.
• New aeroftp-cli inventory subcommand: the authoritative, drift-proof inventory of every CLI subcommand and MCP tool read straight from the in-code registries, emitted as JSON, a Markdown table or a --check CI drift gate, with a committed snapshot at docs/COMMAND-INVENTORY.json (the real counts: 90 CLI subcommands, 73 MCP tools, 39 agent tools).
• lsjson --ndjson streaming and a listing spinner: a recursive lsjson -R can stream one compact JSON object per line as each entry is discovered, and a stderr progress spinner names the directory being listed on a TTY; the default sorted-array output is unchanged byte for byte and a pipe or redirect stays pure JSON.
• profile-import --dry-run and native export aeroftp / import aeroftp aliases: preview which profiles a .aeroftp bundle would add or skip as duplicates without touching the vault or keyring, and reach our own format from the export / import families next to the foreign ones.
• profile-add can seed the credential in one step: --password-stdin plus new --credential-json / --credential-json-file write into the same vault key the GUI Edit modal uses, so a CLI-created profile is immediately connectable; the sources are validated before the profile is persisted, so a malformed blob fails fast with no orphan profile.
• First-run host-config import for the Flatpak: a consent-gated, copy-only import of the native ~/.config/aeroftp on first run (nothing is overwritten and the vault still needs its password), from the GUI first-run prompt and aeroftp-cli flatpak-import, so a user moving from the .deb does not see an empty app (#310).

Changed

• macOS promoted from beta to stable: it boots and runs cleanly on Intel and Apple Silicon, so the release dmg drops the -beta suffix (now AeroFTP_<ver>_<arch>.dmg) and the README badge and Platform Status row read stable alongside Linux and Windows; the dmg is still not Apple-signed, so Gatekeeper needs the documented xattr workaround.
• Recursive listing over SFTP is about three times faster: SftpProvider::list was issuing one serial LSTAT per directory entry purely to test the symlink bit, which the READDIR reply already carried, and this dominated every recursive walk (the GUI panel, sync scan, ls -R, tree, size, rmdirs, the delete plan); the mode now comes from the attributes already in hand and the few real per-entry follow-ups (attr-less recovery, symlink resolution) are pipelined over the one SFTP channel, measured at roughly 42s down to 16s on a 620-entry walk and 37s down to 12s on a symlink-heavy one, with byte-identical output.
• DEFLATE level 1 now stays in the native tools' size band: on this build flate2 resolves to the zlib-rs backend whose level 1 is a speed-first preset that ran about 40% larger than gzip -1 on text, so user level 1 is now pinned to backend level 2 at every DEFLATE entry point (zip, tar.gz, standalone gz and the size estimator), which comes out smaller and still faster than gzip -1; 7z level 1 was evaluated and deliberately left as-is, byte-identical to xz -1 (#406).
• Shared 6-box TOTP input across the 2FA Quick Connect pages: the Two-Factor Code entry is now one digit-only, paste-and-autofocus 6-box component reused on every 2FA page, and the kDrive Drive ID field is narrowed to its 10-digit numeric shape (@EhudKirsh, #369).
• Connection and profile edit polish: a duplicated profile now appends at the tail instead of jumping to the top, editing a saved OAuth or API profile can save a name or local-path change without re-running the sign-in (a Save/Cancel pair disabled until a field actually changes, applied to the live session immediately), and the FileLu Native API entry now shows the FILELU MODES tab bar like the S3 and WebDAV entries.
• The MCP listing tools now return one entry shape: aeroftp_tree routes every entry through the same entry_json chokepoint as list_files, search_files and file_info and adds only its depth field, so a recursive listing is exactly a flat listing plus depth; the CLI lsjson field names are frozen with a doc comment so no future cleanup can quietly break the scripts that parse them.
• The --checkers help is now honest: it promised parallel metadata probes, but the --no-traverse stat sweep runs sequentially today, so the help now says so and points at the provider-pool refactor as where it becomes a real concurrency gate.

Fixed

• Filen local S3 and WebDAV bridges auto-detect HTTP/HTTPS at connect: a mismatch between the profile and the protocol chosen in the Filen app no longer blocks the connection, the loopback IP is pinned to avoid a local.*.filen.io DNS failure on Windows, and the Filen WebDAV Quick Connect drops the manual selector for an auto-detect note (#389).
• Ejecting a removable drive while AeroFile is inside it steps the view back to Home instead of leaving a stale view of the removed drive, matching the system file explorer (@EhudKirsh, #351).
• The Filen Quick Connect no longer prints LOCAL twice: the local bridge modes read WebDAV and S3 under a single LOCAL badge, as the MEGA page already did (@EhudKirsh, #369).
• The pCloud Drive OAuth credentials link is renamed Manage credentials and points at the my_apps console so it reads honestly, translated across all locales (@EhudKirsh, #369).
• The overall Transfer Queue progress bar no longer pegs at 98-100% during a folder upload: it now climbs on the backend's real aggregate byte total, fixed upfront from the pre-scan, instead of a lazily-enqueued item count (@EhudKirsh, #364).
• With the crypt overlay on, uploading into a plaintext-named folder created while the overlay was off no longer creates a phantom encrypted folder and misplaces the file: the write is refused with a clear message, and arming the overlay re-anchors you out of a hidden plaintext folder to a valid encrypted location while keeping you in place inside a genuine encrypted subfolder (#390).
• The 2FA 6-box code input no longer skips a box on each keystroke: typing a digit advanced the caret by two boxes because the fill helper and the single-digit path both stepped forward; focus now advances one box at a time on all three pages, with paste and backspace unchanged (@EhudKirsh, #369).
• The red View Trash button now works under the crypt overlay for the cloud providers (Google Drive, pCloud, MEGA, kDrive, Koofr, Box, OpenDrive, Jottacloud, Dropbox): trash, restore and empty downcast the live provider box, but under Crypt that box is the overlay decorator, so a shared helper now peels the overlay to the inner transport before every provider-specific downcast, and the trash listing decodes the display name to plaintext where restore keys on an opaque id (@EhudKirsh, #397).
• Saving, uploading or downloading over SFTP no longer hangs about ten minutes before falling back: the native rsync delta probe had no bounded timeout on the russh leg, so an SFTP-only server that never answers blocked it and the negative cache re-probed per file; each probe is now bounded to 8 seconds and a failure is cached for 30 minutes, so a rsync-less remote falls back to plain SFTP within seconds and is not re-probed per file (@coolfocks, #398).
• A second double-click during a slow listing no longer overshoots the target (a relative .. on FTP going up twice): remote and local navigation now use a synchronous in-flight latch that ignores a re-entrant navigation, and the listing spinner carries a Cancel that discards the in-flight result and releases the latch so a stalled navigation never traps you (@JonathanHarford, #401).
• The batch delete, upload and download triggers no longer fire a duplicate op on a second click: the four batch handlers are now gated by a synchronous in-flight latch that covers the toolbar, keyboard shortcuts and context menu at once, the toolbar buttons grey out while in flight, and the scanning toast carries a Cancel that breaks the batch loops so an external stall never traps the user.
• Every foreground remote listing is now visible, named and genuinely interruptible: the connect handlers plus switchSession, switchGitHubBranch and the AeroCloud tab issued their initial listing through a raw invoke that bypassed the spinner, and the old Cancel only bumped a frontend counter while the listing kept running; the abort now happens in the backend under a cancellation token via a new cancel_remote_listing command that touches no provider state, so cancelling a blocked connect tears the half-open session down and returns you to My Servers, while cancelling a drill-in leaves you where you were.
• Connect no longer hangs forever in an endless spinner when a Tauri command dies by panic: every FTPS connection from the GUI was panicking before it ever spoke to the server because rustls could not auto-select a crypto backend with both aws-lc-rs and ring in the tree (the CLI already pinned it, the GUI never did), and a panicking async command never sent an IPC response so the spinner and its Cancel went dead; the crypto provider is now installed once at startup and the connect family runs under a panic-safe catch plus a 120s frontend backstop, so a panic becomes a normal error the UI renders.
• InfiniCLOUD's July 2026 SSO migration is handled: the provider Sign-up link is repointed at the new portal (the old teracloud.jp form now 404s) and the REST v2 discovery and quota calls send X-InfiniCLOUD-API-KEY alongside the legacy X-TeraCLOUD-API-KEY; existing profiles are unaffected since the data plane still uses the Apps Connection password.
• Connecting or navigating to a remote path that does not exist is now fast and honest instead of hanging or blaming your credentials: on chroot FTP accounts a missing directory could hang forever behind the spinner because an MLSD opened a PASV data connection the server never serviced (a control-only MLST probe now fails fast in about a second), and a post-login 550 is reported as a path-not-found with guidance to edit or clear the Remote Path instead of "Check credentials".
• The in-app updater no longer offers a .deb download on Arch: it now detects pacman and degrades to notify-only, exactly as on Snap and Flatpak (#310).
• The AUR aeroftp-bin package was repaired: a launcher wrapper had destroyed argv[0] so aeroftp-cli and aftp opened the GUI for every flag-first call, the desktop file carried one of five file associations with a duplicate menu entry, and the icon was pinned to a moving branch; none of this ever affected .deb, .rpm or AppImage (#310).
• The My Servers list no longer stays scrolled under the header after you edit a profile: the shared scroll container that a tall Edit form scrolls down now resets to the top on every tab change.
• The standalone extract/password window now follows the app theme (light, dark, auto) instead of always rendering light, reading the saved theme (falling back to the OS preference on auto) before render.
• The Transfer Queue no longer ticks a completed check on a failed transfer that shares a filename with a live one: the status transition is now a pure guard that refuses to move an error item to completed, while a genuine retry still completes because it re-enters transferring first.
• The Linux desktop entry now categorizes as Network;FileTransfer; (was Utility;) with the full eight-format MimeType and a Keywords line, converging every Linux package format; the stale in-repo aur/ folder was also removed.
• The archive_compress agent tool schema now states the real default level (5, 7-Zip Normal) instead of the stale 6.
• Two version gates so a mis-versioned snap cannot ship: build-snap now runs a version guard right after checkout and the manifest-match gate additionally compares all four manifests to the tag on tag builds, closing the gap that once let a 4.0.8 snap publish under the 4.0.9 release.
• SourceForge publishing is now an explicit, curated release step (installers plus Sigstore attestations, not the whole-release mirror that had grown the project to 44.5 GiB), uploaded through AeroFTP's own SFTP integration with retention pruning.

Security

• AeroFile vertical security audit complete (bundle B1, 17/17): the whole-archive extractors enforce decompression-bomb ceilings and zip metadata detection gets a passive OOM clamp, the zip-slip guard is consolidated across zip/7z/tar/rar, the Cryptomator vault walk gains a cycle guard and all its metadata reads (dir.c9r, name.c9s, masterkey and vault config) are size-capped against a hostile vault, image previews get decode limits, and the local file operations (cross-panel move, paste, drag-drop, inline and batch rename, Extract here) now refuse or pre-flag a silent overwrite.
• Integer-overflow guards on the remote archive-detect path: two hazards on attacker-controlled zip64 and 7z offsets that in a release build could wrap past the bounds check and panic the detection task are now guarded with checked arithmetic, with no behavior change on well-formed archives and never a wrong badge.
• The S3 trash no longer purges files nobody deleted: the trash view had reported the live current version of every key under a prefix as trash, so empty-trash could hard-delete live files irreversibly with no undo; a key is now trash only when its current version is a delete marker, the filter moved into a unit-tested pure function, and the bug was caught by a live test against a versioned AWS bucket before any release carried it (@EhudKirsh, #266).
• Recursive delete over MCP is now opt-in and fail-closed: recursive was declared on every delete tool and read by none, and the MCP backend called rmdir_recursive on any directory, so an aeroftp_delete with no flag silently erased the whole subtree while the GUI and CLI only unlinked a single entry; recursion now routes through a new delete_recursive whose default refuses rather than pretending, and a non-recursive delete of a non-empty directory answers "pass recursive=true" instead of a raw SFTP failure.
• No recursive walk follows a symlink-to-directory any more: list resolves a symlink-to-directory to is_dir = true so callers can render it, and fifteen walkers gated their descent on that alone and walked straight into a sub/loop -> .. cycle up to the depth cap, so rmdirs, get -r, sync, dedupe, cleanup and the MCP storage_quota and delete preview miscounted or double-wrote; the invariant now lives on RemoteEntry::is_walkable_dir() and gates every descent, with the entry still reported as a directory so only the traversal is refused.
• A sandboxed install can no longer lock a native install's vault: in the zero-password AutoKeyring default the vault passphrase lived in one shared OS-keyring slot, so a Flatpak or Snap initialising its own vault overwrote the native passphrase and left the still-intact native vault.db undecryptable (total credential loss to the user); the slot is now namespaced per install scope and a sandbox reads but never writes the native slot, reproduced and fixed after our own Flatpak live test locked the maintainer's vault.
• macOS releases now ship signed: the dmg had been globbed under its -beta name before the rename ran, so nothing was signed (v4.1.2 shipped two dmgs and zero .dmg.sigstore.json); the dmg is now signed under its real name so the in-app updater, which pins the same workflow identity for every platform, can verify it.
• crossbeam-epoch bumped 0.9.18 to 0.9.20 (Cargo.lock only), clearing RUSTSEC-2026-0204 (an invalid pointer dereference in its fmt::Pointer impl) and restoring a clean cargo audit gate.
• In-app updater signature verification is now honest and visible: a genuine sigstore verification failure now shows a distinct amber "Signature not verified (SHA-256 only)" badge instead of green and is echoed in the centered install overlay, the download progress bar turns green at 100%, and the update and verify strings are translated across all 46 locales; sigstore stays advisory with SHA-256 as the install gate (the hard block is planned for v4.1.4), and the same path was further hardened to distinguish an absent Sigstore bundle from an unparseable or unreachable one and to stage the artifact and its bundle as exclusive, collision-safe files.
• Final pre-release audit residuals closed: S3 batch delete rejects malformed 2xx bodies, FTP uses the MLST anti-hang probe only when that verb is advertised and preserves fallback on transient errors, and the local and remote batch-delete latches stay held through the actual async operation.

Contributors

Downloads:

• Windows: .msi installer, .exe, or .zip portable (no installation required)
• macOS: .dmg disk image
• Linux: .deb, .rpm, .snap, or .AppImage

[4.1.2] - 2026-07-05

Complete Archive Format Coverage, Quick Connect Consistency and a Full-Surface Security Audit

An archive-focused release: a format-coverage audit closed every gap it found, so what AeroFTP creates it can always reopen, and archives from native tools (7-Zip, gzip, WinRAR) open reliably. A single file now compresses to and extracts from a plain .gz, .xz or .bz2, the Compress dialog gains a 7z Advanced section, ZIP archives using non-Deflate methods now open, tar symlinks extract safely, and the compression presets align with the 7-Zip canonical levels. Alongside archives: a full-surface security audit fixed 16 findings, AeroShare gains offline LAN (mDNS) discovery, and a broad Quick Connect consistency pass lands with the crypt-overlay fixes reported against v4.1.1. 47 languages translated.

Added

• Standalone gzip / xz / bzip2, full round-trip: a lone file compresses to a plain .gz, .xz or .bz2 with no tar wrapper, and extracts back through the real extract path (member name = archive name minus the codec extension). The Compress dialog adds GZ/XZ/BZ2 cards enabled only for a single non-folder selection; the CLI infers the format from the extension (longest match keeps foo.tar.gz a tarball) and the CLI, GUI and AI extract verbs all reach the standalone lane, including a .gz produced by system gzip. (#365)
• 7z Advanced options: content method, dictionary size, solid block, threads: a collapsed Advanced section in the Compress dialog, with matching aeroftp compress flags, exposes the 7z content method (LZMA2 default, plus LZMA, PPMd, BZip2), an LZMA2 dictionary size and thread count, and a solid-block option (one pack for every file: better ratio on many small files, off by default). Every method is decodable by the extractor, so an unreadable archive is never created. (#365)
• ZIP archives with non-Deflate methods now open (BZip2, LZMA, Deflate64, Zstd, XZ): these previously failed with "unsupported compression". The read codecs are now enabled and such archives extract byte-exact; the write path is unchanged (AeroFTP still emits Store/Deflate + AES, which every native archiver opens). Full bidirectional interop with 7-Zip verified.
• AeroShare LAN (mDNS) discovery: a new lan discovery mode resolves peers over local mDNS only, publishing nothing to n0 or the public DHT, so two devices on the same subnet find each other fully offline (no internet, no relay). mDNS is also folded into the default both mode, so LAN peers resolve instantly there too. (@EhudKirsh, #284)
• aero benchmark --all-protocols alias for the existing --all flag (benchmarks every saved profile), so the intent reads clearly. (@EhudKirsh, #277)

Changed

• Compression level presets aligned with the 7-Zip canonical levels: the Compress dialog now offers six presets (Store=0, Fastest=1, Fast=3, Normal=5, Maximum=7, Ultra=9) shared across all compressible formats; 7z and the tar.gz/tar.xz/tar.bz2 family drop Store since their codecs have no real store mode. The default level moves from 6 to 5 (7-Zip "Normal") in the dialog, in every backend fallback and in the CLI --level help. (#365)
• 2FA Quick Connect polish (Filen, MEGA, Internxt): the six-digit Two-Factor Code field is compact (six digits, centered, 000000 placeholder) and digit-only, the code auto-submits the moment the sixth digit lands, and on Filen and MEGA the live TOTP preview (key, code, copy, timer) sits on the 2FA Secret label row. (@EhudKirsh, #369)
• Interactive -i sections split clear from cls / .: in profiles -i, groups -i and users -i, clear now does a plain screen wipe with no reprint (the universal terminal behaviour), while cls, the single-key . and refresh keep the clear-and-reprint refresh. (@EhudKirsh, #266)
• Add Service catalog refinements: a single Grid/Table "switch to" toggle (mirroring My Servers), the generic-servers strip filtered to the active tab, Microsoft-prefixed OneDrive and Azure Blob so the two sort together, consistent S3 / WebDAV / API badge order, and corrected free tiers (DriveHQ 5 GB, Uploadcare 1 GB). (@EhudKirsh, #274)

Fixed

• Crypt overlay stuck decrypting forever after a reconnect (kDrive and other OAuth backends): the red Disconnect never tore down the transparent crypt overlay, so a stale vault id survived and the next connect short-circuited the auto-unlock. Disconnect now locks the backend keys, unwraps the provider and resets the overlay state so a reconnect starts clean. (@EhudKirsh, #386)
• Crypt upload "Path not found" on strict WebDAV (Koofr, OpenDrive): a PUT failed when the encrypted parent collection did not exist. The overlay now creates the encrypted parent chain and retries once on a path-missing error, gated so an auth or quota failure leaves no stray encrypted directories. (@EhudKirsh, #385)
• Koofr WebDAV endpoint dropped on an in-edit mode switch (404): the per-mode credential stash keyed on providerId || protocol, which collides for Koofr, so switching Native API to/from WebDAV leaked the bare API host over the WebDAV preset endpoint. Now keyed collision-free; for a crypt profile this also restores the transparent overlay, which had vanished only because the connection never came up. (@EhudKirsh, #385)
• Crypt overlay secrets carried over on Convert / Save-as-new: converting a crypt profile to another mode (or saving it as new) minted a new profile id but left the overlay password and salt under the old id, so the new profile never auto-unlocked. The secrets are now copied to the new id. (@EhudKirsh, #385)
• MEGA API/CMD Quick Connect adopts the two-column layout: the narrow legacy card squeezed the MEGA MODES tab bar and never exposed the transparent Crypt overlay or the Remember-credentials toggle; API/CMD now use the shared grid, verified live on real MEGA with both overlay kinds. (@EhudKirsh, #369)
• Quick Connect edit-mode consistency: a preset endpoint stays hidden from the main form in edit mode too (collapsed and unlock-gated in Advanced), a provider's WebDAV mode reads the preset's own field labels instead of generic Username/Password, kDrive's Drive ID sits above the API Token as a numeric-only field with direct find-your-id and create-a-token links, and single-preset provider names keep their brand casing. (@EhudKirsh, #369)
• A delta transport drop no longer fails the transfer outright: when the native delta lane dies on a wire-level drop (for example a fragile NAS closing the SSH exec channel mid file list, observed live on a WD MyCloud), the single-file transfer now falls back to the classic SFTP path instead of surfacing "delta hard rejection". The destination is never torn (every write goes through a temp file plus atomic rename), and security refusals (host-key mismatch) still never fall back.
• Text preview copy and gutter drag-selection: Ctrl+C now copies the active text selection (the global file-manager shortcut used to swallow it), and the line-number gutter drag-selection tracks both ways from a window mousemove. (@EhudKirsh, #347)
• Split / multi-volume archive parts report a clear message: a .7z.001, .zip.001, .z01 or .r00 part gets a specific "rejoin the volumes" message instead of the generic "Unsupported archive type"; real multi-part RAR (.partN.rar) stays on the normal .rar lane so it keeps working.
• i18n: provider.modes.lockedInEdit translated in all 47 locales: the mode-tabs hint referenced a key that existed in no locale, flooding the console with missing-translation warnings.

Security

• Full-surface security and hardening audit: 16 findings fixed (3 high, 7 medium, 6 low). High: remote-controlled path traversal in the sync_tree download engine, unbounded eager allocation from a server-declared native-rsync block count, FileLu API key leaking into surfaced errors. Medium: privileged auto-update installs fail closed on a backend-authoritative registry of signature-verified artifacts, Azure Service SAS rebuilt to the correct field layout, MEGA and OpenDrive session ids redacted from errors, native-rsync symlink varint panic guarded, shell_execute meta-character filter closed for redirection and glob, DebugPanel redaction extended to serialized secret fields. Low: vault mountpoint collision hash, component-aware update-path boundary, MCP deny-list parity, bounded peer inbound-rate map, CLI edit temp 0o600 with no-follow, constant-time SFTP serve auth.
• Tar symlink and hardlink entries extract safely: a link target is validated with the same in-root check as file paths, an in-root symlink is recreated (unix), and a malicious link pointing outside the destination is never materialised and is surfaced in the report instead of being silently dropped.
• quick-xml bumped to 0.41 for RUSTSEC-2026-0194 and RUSTSEC-2026-0195.
• Pre-tag commit audit: PASS. A punctual multi-reviewer audit of every commit in this cycle (archive, connection and share/CLI/catalog lanes) confirmed the security posture: no path traversal in the new extract lanes (symlink chains, hardlinks and TOCTOU covered), no secret ever logged or misdirected by the credential migrations, dependencies clean. The six minor findings it surfaced are all fixed in this release: the LAN discovery mode now disables relays entirely (true offline, no WAN service contacted), the default discovery description honestly discloses the local mDNS announce in all 47 languages, tar re-extraction overwrites existing links instead of failing, the CLI tar extract report stays a clean path, per-mode credential snapshots saved by earlier versions migrate to the new collision-free keys, and pasting a 2FA code with separators keeps all six digits.

Contributors

Downloads:

• Windows: .msi installer, .exe, or .zip portable (no installation required)
• macOS: .dmg disk image
• Linux: .deb, .rpm, .snap, or .AppImage

[4.1.1] - 2026-07-01

Transparent Crypt Overlays, AeroShare Privacy Controls and 7z Encrypted Headers

A consolidation release built on the v4.1.0 feedback. Encrypted-overlay profiles (AeroCrypt and rclone-crypt) now stay encrypted through one transparent decorator wired at every provider chokepoint, so no surface can bypass the overlay and write plaintext into an encrypted store. AeroShare gains the two deferred P2P privacy controls (an anti-flood gate and a public-DHT opt-out), 7z can create archives with encrypted headers to hide filenames, Kilo Gateway joins the native AeroAgent providers, and a broad triage batch closes the confirmed bugs reported against v4.1.0. 47 languages translated.

Added

• Transparent crypt overlays end to end via a single decorator: encrypted-overlay profiles (native AeroCrypt and rclone-crypt) are now wrapped by one CryptOverlayProvider wired at every provider resolver chokepoint (CLI, cross-profile, AeroAgent, MCP, GUI, AeroCloud background sync, the selective-sync folder tree), so a surface that resolves its own provider can no longer bypass the overlay and write plaintext into the encrypted store or read ciphertext back. The decorator is fail-closed: a bound-but-locked vault is refused, never downgraded to raw. This grew out of an AeroSync compare/sync mismatch on a crypt profile where the overlay was applied ad hoc per command. (@EhudKirsh)
• Resume interrupted transfers: a Resume action continues an interrupted upload or download from where it stopped instead of restarting from zero.
• 7z create with encrypted header (-mhe) to hide filenames: opt-in like 7-Zip's "Encrypt file names" checkbox under the password. Off keeps content-only encryption (names readable); on hides the names too and then requires the password even to list the archive. Migrated from the unmaintained sevenz-rust 0.6 to sevenz-rust2 0.21. Wired into the Compress dialog and the CLI (aeroftp compress --encrypt-names); encrypted-header archives open in the existing GUI browser and standalone extract window. (#365)
• AeroShare anti-flood gate and public-DHT opt-out (the two AeroShare P2P follow-ups deferred from the v4.1.0 audit): inbound knocks, actions and file offers are gated before they reach the UI with a per-sender mute (always on), an optional friends-only allowlist (off by default to preserve first contact) and an in-memory sliding-window rate limit (default 20 signals per sender per minute, 0 disables). The long-term AFID can be kept off the public DHT with a new none discovery mode, discovery is now a persisted per-partition setting (both/dht/n0/none, all in Settings), and a destructive AFID rotation is guarded by a two-step confirm and stops every live served share first. New AeroSharePrivacySettings panel and a Mute-sender action on the knock prompt, 29 i18n keys across 47 locales. (#284)
• Kilo Gateway as a native AeroAgent AI provider: an OpenAI-compatible gateway routing to many open and free models behind one key, including the rotating Auto Free model (kilo-auto/free, 256K context, no credits required), plus paid Anthropic, OpenAI and Mistral with a signup credit. Wired through the existing OpenAI-compatible dispatch with full CLI parity. (#382)
• Benchmark group and all selection: aero benchmark --group <NAME> (repeatable, comma-aware) benchmarks the members of a My Servers group and --all benchmarks every saved profile, so a comparison needs no manual list. A profile-type column disambiguates multi-protocol profiles, the many-small-files run shows a live progress bar instead of a blind wait, and a mid-run public-IP change that reverts before the sweep ends still flags the comparison as not comparable. (@EhudKirsh, #277)
• AeroSync receipt item total and JSON export: the sync success banner now prints the total item count (uploaded plus downloaded plus deleted plus folders created) so it reconciles at a glance with the compare difference count, and an Export JSON button saves the full run report as pretty JSON.

Fixed

• v4.1.0 feedback triage batch (six confirmed bugs): Filen S3 rename and delete of emoji or non-ASCII names no longer return a 401 signature error (Filen's already percent-encoded keys were double-encoded, breaking the SigV4 copy-source); OpenDrive API upload no longer fails with "Incorrect chunk offset" (its multipart protocol is strictly sequential, so fan-out is capped at 1); the benchmark no longer leaves an empty scratch folder on Google Drive, MEGA and kDrive (best-effort emptiness-guarded cleanup plus idempotent mkdir); the --tui picker no longer flickers when the help row wraps in split-screen; AeroFile eject no longer flashes a console window on Windows (a shared CREATE_NO_WINDOW spawn helper now also covers rclone import and the schtasks autostart); and a just-ejected drive no longer lingers in Other Locations. (@EhudKirsh, #368, #351, #277)
• FTPS and other TLS connections from aeroftp-cli no longer crash on connect: the CLI never installed a rustls CryptoProvider while both aws-lc-rs and ring were in the dependency tree, so the first TLS handshake panicked; fixed by pinning aws-lc-rs once at startup. Alongside, suppaftp was bumped 8.0.3 to 10.0.0, replacing its internal panics on malformed server responses with proper error results and closing RUSTSEC-2026-0009 (stack exhaustion via time). Validated live on plain FTP and explicit FTPS put/get round-trips.
• The 7z compression level now takes effect: the Compress dialog's Fast/Normal/Maximum buttons and the CLI's --level were handed to the encoder but then dropped, so every 7z used the library default; the create path now maps the 0-9 level onto LZMA2's preset in both the password and the plain branch. (#365)
• Duplicating a saved profile now copies every stored secret, not just the main password: the copy dropped the per-mode credential snapshot, the Filen CLI key and the AeroCrypt overlay password and salt, so the copy opened blank and could not connect. A shared vault-secrets helper now copies each per-profile vault key on duplicate and purges the full key set on delete, recomputing every has-stored flag from what actually copied (audit F-01/F-02). (@EhudKirsh, #366)
• Profile import keeps distinct profiles that share an account: import skipped any profile whose host, port and username matched an existing one, silently dropping legitimately distinct profiles that differ by protocol, crypt overlay, bound folder or auth mode. Only a true re-import (same stable profile id) is now skipped; a profile that merely resembles an existing one is kept and reported.
• An rclone-crypt overlay connection now opens at the configured Remote Path instead of the provider root: the post-unlock decrypted reload listed with a null path and fell back to the root; it now anchors to the session's bound overlay scope.
• A 2FA-protected connection to an encrypted-overlay profile now unlocks the overlay after the code is entered: the 2FA retry re-entered through the Quick Connect path, which had none of the saved-profile overlay logic; it now runs the same overlay activation as the saved-server connect.
• AeroCrypt overlays unlock on OAuth backends: a crypt password saved on an OAuth profile (Google Drive, Dropbox, OneDrive, Box, pCloud, 4shared) was never unlocked because both OAuth connect paths returned early before the overlay logic; the credential-provider sequence is now mirrored on both OAuth branches. (@EhudKirsh)
• AeroCrypt v3 reports decrypted sizes and preserves the upload mtime: the overlay now advertises plaintext sizes for v3 items and keeps the original modification time across an encrypted upload.
• AeroShare "reveal received file" selects the file in the file manager on Linux instead of opening it, via the D-Bus org.freedesktop.FileManager1.ShowItems method (Nautilus, Dolphin, Nemo, Caja), falling back to opening the parent folder on minimal distros. Matches the Windows /select, and macOS -R paths.
• The "Open Cloud Folder" tray entry is now disabled when AeroCloud is off, guarding the stale-enabled case where the menu opened the non-existent ~/AeroCloud default path.
• The folder picker no longer crashes on a stale or non-existent start path: handing a non-existent defaultPath to the native GTK folder chooser crashed the app with heap corruption (common after importing a profile from another machine); the chooser is now fixed at the point of use so it still opens for picking a new folder.
• The AeroTools bottom panel and the text preview now follow the Ice theme instead of rendering dark, and the AI Settings, Add/Edit Model and AeroAgent model modals are draggable by their header; the text-preview scrollbar is widened. (@EhudKirsh, #347)
• The master-password lock screen now has the window controls and a top drag region, mirroring the account picker, so the window can be moved and controlled before unlocking. Clicking a line number in the text preview selects that whole line, IDE-gutter style. (@EhudKirsh, #347)
• The remote file panel deselects on an empty-area click (matching the local panel) and the toolbar Stop button shows a cancel spinner while an AeroSync run is being stopped.
• The AeroSync receipt no longer undercounts created folders: parent-directory creations are now counted into the report so the total reconciles with the compare difference count.
• v4.1.1 pre-release audit hardening: crypt compare and reconcile no longer double-handle an already wrapped CLI/MCP overlay provider; shaped multipart Stop cancels begin/part/commit and aborts the provider session; crypt-wrapped GitHub profiles use the generic encrypting write path instead of failing a GitHub-only downcast; the GitHub executor upload is cancel-aware; and Google Drive folder-only mkdir is idempotent.

Changed

• Retired the legacy per-command crypt layer: the crypt-overlay decorator subsumes the old unlock-dialog mini-browser and the per-command crypt folder, mkdir and rename commands, which have been removed.

Contributors

Downloads:

• Windows: .msi installer, .exe, or .zip portable (no installation required)
• macOS: .dmg disk image
• Linux: .deb, .rpm, .snap, or .AppImage

[4.1.0] - 2026-06-28

AeroShare Peer-to-Peer (Beta Preview), the AeroAgent Coding Loop and Per-User Groups

The headline of v4.1.0 is AeroShare, a Beta preview of direct, end-to-end-encrypted device-to-device transfer with no server in the middle. It is the seventh module of the Aero Family: send a file or a folder straight to another person over a peer-to-peer channel (iroh 1.0 with Mainline-DHT discovery and federated relays), always-on at launch, with a Discover tile, a titlebar +friend button, a draggable hub and a status-bar receiver indicator. Alongside it, AeroAgent gains a foundation coding loop (a curated, GUI-only, approval-gated tool set for local development), server groups and favourites move into each user's encrypted partition, the interactive CLI grows a New(N) verb and per-user management, the aero benchmark defects are fixed, the Filen Desktop bridges work headless, OS "Extract here / to folder" verbs land on Nautilus and Windows, Windows USB eject works, and the in-app sigstore update verification verifies for real again. The P2P stack was migrated from iroh 0.92 to 1.0, clearing 6 Dependabot alerts. 47 languages translated.

Added

• AeroShare: end-to-end-encrypted peer-to-peer transfer (Beta): send files and folders directly to another user with no hosted account in the middle, over a peer-to-peer channel built on iroh 1.0 with decentralized Mainline-DHT discovery and federated relays as fallback. AeroShare is now always-on at launch (it was hidden behind an off-by-default Settings flag and undiscoverable): the Discover tile carries a 256-bit E2E badge, the +friend button sits in the titlebar, and the handshake dialog is always available. Adding a friend or sharing a folder auto-activates the feature; the standing receive loop is opt-in via a one-time prompt, both changeable from Settings. Each sender gets their own Inbox and an address book remembers the people you exchange with. The hub dialog is draggable by its header and a status-bar pill next to AeroCloud surfaces the receive loop at a glance and toggles it on click. i18n 47/47. (@EhudKirsh, #284)
• AeroAgent coding loop (foundation): a curated GUI tool set for local coding work, GUI-only and either read-only or approval-gated, with no change to the transfer or file-management tools. It adds ripgrep workspace search, structured cargo/tsc/eslint diagnostics, git read (log/show) plus stage and commit, a run-checks runner and an ordered multi-check verify, safe patch with automatic checkpoints, and review cards.
• Native CLI profile export/import (@EhudKirsh, #215): aeroftp-cli profile-export and profile-import write and read an encrypted .aeroftp profile backup, byte-compatible with the GUI's My Servers Export/Import (a file made in one imports in the other). It reuses the GUI's exact collect/restore path, so the per-protocol credential snapshots are shared, not duplicated; secrets are opt-in via --include-credentials.
• Per-protocol credentials survive profile export/import (@EhudKirsh, #215): a one-account-many-protocols profile (for example a Koofr account saved as Native API + WebDAV) now keeps each mode's saved credentials across export and import. The per-protocol snapshots, the "Remember credentials for every protocol" opt-in and the OAuth Remote Path field all round-trip, and the import dialog's "contains credentials" badge accounts for every secret kind.
• Interactive New(N) verb across profiles -i / groups -i / users -i (@EhudKirsh, #311): create a profile, group or user from inside the -i loop (the rclone n) New remote model) instead of dropping out to a separate add command. profiles -i n [query] runs a service-first catalog picker; groups -i n makes an empty group; users -i n a new local user.
• groups -i member add/remove (@EhudKirsh, #311): a <group> <profile...> and x <group> <profile...> curate a group's membership from inside the loop, idempotent and multi-target.
• Per-user server groups and favourites (CLI + GUI): groups and favourites used to live in a single global vault blob shared across every local user; they now route through each user's encrypted partition, with a best-effort one-time seed from the legacy blob so existing groups and favourites carry over. The default user is now a real is_default database column (was localStorage) with Manage Users parity and a vault-aware sidebar.
• OS "Extract here / to folder" verbs for archives and vaults (Deliverable G): a right-click "AeroFile" submenu on Nautilus (Linux) and the Windows shell, with "Extract here" and "Extract to folder" for zip/7z/tar/rar and the aero containers, mirroring the standard extract pair. A clear archive extracts headlessly via the CLI; an encrypted one or a vault opens a dedicated minimal password window that never boots the main app. The MSI installer reaches parity with NSIS via a WiX fragment. Additive verbs only, the double-click Open is untouched. Validated live on GNOME Nautilus 46.
• Quick Connect connector harmonization (@EhudKirsh, #215): the single-column connectors now use the same two-column layout as every other provider, and the 8 OAuth clouds expose Wrappers / Overlays (a transparent crypt overlay on the 7 overlay-eligible OAuth backends, persisted through the OAuth save path). The profile name with a clickable icon avatar moved to the top of the form, Local Path now sits above Remote Path, and the Wrappers / Overlays section starts expanded by default.
• .aeroftp-script registered as the 5th OS file format + a generic archive icon: the README advertised five AeroFTP file formats but only four were OS-registered; .aeroftp-script is now registered on all OSes, and a shared amber archive-family icon was added for the supported compressed formats.
• Windows USB eject (@EhudKirsh, #351): the AeroFile PLACES eject control now performs a real safe removal via the Shell.Application "Eject" verb, polling until the drive disappears so a real failure surfaces instead of a silent false success. The power glyph becomes a standard eject symbol, the no-media ghost row is dropped after a successful eject, and an eject failure always raises a visible toast. Validated on real Windows 11 hardware.
• OpenDrive privacy is editable end to end (@EhudKirsh, #252): OpenDrive's three-level access model (private, public, hidden) is now controllable from every surface. Properties > Permissions reads and changes the privacy of an existing file or folder, including a multi-selection that applies the same level to every selected item at once; Quick Connect gains a per-account "Default privacy for new items" so new uploads and folders inherit your chosen level instead of whatever OpenDrive assigns. The CLI gains an access verb (aeroftp-cli access --profile NAME /path --to private|public|hidden) for an existing path, plus an --access flag on put and mkdir; folder privacy cascades to children, and CLI creates default to private (max-privacy, opt out with --access public), mirroring rclone's --opendrive-access. The levels are private (not listed or shared, owner-only), public (anyone with the link, searchable) and hidden (reachable by direct link only, not searchable).

Changed

• AeroShare is discoverable by default (see Added): the feature is no longer gated behind an off-by-default Settings flag.
• -i action bars reordered safe-first (@EhudKirsh, #311): the profiles / groups / users interactive action bars lead with the read-only verbs and Help(H), with re-index moved out of the front and the destructive Delete(D) last before Quit. The key letters are unchanged, so no automation breaks.
• groups -i / users -i polish (@EhudKirsh, #311, #341): a labelled action bar with Help(H/?), a Refresh(.) that clears the screen, compact one-token selectors, a header rule, count columns, and arrow + strikethrough summaries on re-index and delete, matching profiles -i.

Fixed

• Filen S3 empty-folder rename explains itself instead of leaking a raw 401 (@EhudKirsh, #368): renaming an empty folder on Filen's local S3 bridge now returns the actionable "add a file inside the folder first, or use the native API / WebDAV bridge" message instead of a cryptic HEAD on rename source returned status 401. An empty folder is a virtual prefix with no object, so the copy-then-delete rename has nothing to copy; the 401/403 from a Filen S3 endpoint is mapped to that case, scoped to is_filen_s3_endpoint() so real files and non-empty folders are unaffected.
• Filen Desktop bridges work outside the GUI, OpenDrive API host self-heals (@EhudKirsh, #368): the Filen Desktop local bridges authenticate to a loopback server defaulting to admin/admin, but that blank-to-admin/admin fallback lived only in the GUI connect path, so the CLI, benchmark, MCP and schedulers sent empty credentials and failed. A shared helper now applies the same fallback on both headless paths. Separately, an OpenDrive profile switched from the WebDAV preset into native API mode could keep webdav.opendrive.com and hit the WebDAV HTML auth page; the host is now normalized to dev.opendrive.com.
• aero benchmark real defects fixed (@EhudKirsh, #368): the shared scratch base is removed after a run (guarded, so a pre-existing base, a concurrent run or a --test-root-prefix is never touched), the scratch tree is built with mkdir-parents so servers that refuse nested collections (pCloud WebDAV) work, both the per-profile header and the comparison tables gained a protocol column, a public-IP snapshot flags a run as not comparable if the IP changed mid-sweep, a multi-profile run shows [k/N] per profile plus per-operation run k/N, a Yandex region hint is shown on endpoint errors, and the Connection-type is clarified as downstream Mbps.
• aero benchmark --tui profile picker no longer flickers on scroll (@EhudKirsh, #277): the picker repaints in place instead of clearing the whole screen every frame.
• Filen Quick Connect Save persists an API-key deletion and cancels the 2FA countdown (@EhudKirsh, #128, #215): the green Save removes the key from the vault and cancels the bottom-right 2FA auto-login countdown so it cannot fire a stale TOTP reconnect.
• Copy/Move a server profile to another user no longer loses data (@EhudKirsh, #366): a Move now always materialises the profile in the destination first and removes the source only after, so moving a profile whose equivalent already existed in the target no longer destroys the only copy. The account picker also reuses the shared UserAvatar instead of rendering a raw base64 string that overflowed the avatar circle.
• Transfer Queue per-item bar advances on Crypt overlays (@EhudKirsh, #364): both the rclone-crypt and native AeroCrypt overlays now emit live start/progress/complete events, so folder uploads drive the running file-count badge and single-file uploads advance the byte-progress bar.
• "Active Sessions" sidebar filter appears for Quick Connect re-auths (#128, @EhudKirsh): a form-driven connection (notably an OAuth re-auth) now binds to its matching saved profile before the session is created, so it lights up both the header badge and the sidebar filter.
• Bridge setup box no longer flashes open then collapses (@EhudKirsh, #215): switching to a Filen Desktop / MEGAcmd bridge tab no longer flashes the "Setup first" box during the probe; it knows synchronously that the active mode is a bridge and starts collapsed.
• Run tray-less when libappindicator is missing (@redpay, #362): the app no longer panics at launch on Fedora Silverblue and other minimal or immutable distros that lack libappindicator / ayatana-appindicator3; it runs without a tray and bypasses close-to-tray when no tray is available.
• Welcome / splash version is now dynamic (@EhudKirsh, #367): the splash injects the real running crate version at launch instead of a hardcoded string that read "v4.0.8" under v4.0.9, so the label can never drift from the published version again.

Security

• iroh family migrated 0.92 to 1.0 (iroh 1.0, iroh-blobs 0.103, iroh-docs 0.101, iroh-gossip 0.101), clearing the 6 Dependabot alerts the old line pinned (hickory-proto x4 and lru x2) via hickory-proto 0.26.1 and lru 0.18.0. Decentralized Mainline-DHT discovery is preserved by re-wiring onto iroh 1.0's address-lookup API.
• Sigstore update verification now actually verifies (#358): the in-app signature check had been stuck on its amber "verification unavailable" fallback since v3.3.2 because sigstore 0.13 could not parse GitHub's v0.3 signing bundles; the bump to sigstore 0.14 adds v0.3 parsing, so it returns a real verified result on releases. It stays a non-blocking second factor with the artifact SHA-256 as the primary integrity check. Drops 3 now-moot cargo-audit ignores.
• In-range dependency refresh plus the softprops/action-gh-release 3.0.0 to 3.0.1 bump (#353, kept SHA-pinned), and the Checks CI workflow restored to green after a cargo fmt drift.
• Windows local-STT build fix (#344): two MSVC-only CMake env vars force whisper.cpp to the static release runtime, resolving the LNK2038 runtime-library mismatch at the link stage; inert on Linux and macOS.

Internal

• Provider offline-test coverage complete across all 16 unit-only providers (@EhudKirsh, #347): a deterministic, no-network regression net for Azure Blob, Koofr, Yandex Disk, Cloudinary, Uploadcare, GitLab, Filen, 4shared, kDrive, Jottacloud, Zoho WorkDrive, Internxt, Drime and Immich (GitHub was already covered; Swift is skipped as its only profile, Blomp, is inactive). Each provider gained a behaviour-preserving pure classify or parse seam plus matrix tests; 30 new unit tests, no production behaviour change.

Documentation

• Public documentation refreshed for v4.1.0: AeroShare added to the README and the Aero Family, per-user groups and favourites documented in docs/MULTI-USER.md, the AeroAgent coding tools added to the AeroAgent docs, the new CLI verbs (profile-export/profile-import, the -i loops) documented in AGENTS.md and docs/CLI-GUIDE.md, and the benchmark, Filen Desktop bridge and OpenDrive notes carried into docs/COMMUNITY-BENCHMARK.md, docs/BRIDGE-COMPATIBILITY.md and docs/PROVIDERS.md.

Contributors

<img src="https://github.com/EhudKirsh.png?size=48" width="48" height="48" alt="@EhudKirsh" />
<img src="https://github.com/redpay.png?size=48" width="48" height="48" alt="@redpay" />

Downloads:

• Windows: .msi installer, .exe, or .zip portable (no installation required)
• macOS: .dmg disk image
• Linux: .deb, .rpm, .snap, or .AppImage

[4.0.9] - 2026-06-24

AeroVault Create Redesign, the AeroVault Zip Plaintext Lane and Universal rclone Export

A large pass on AeroVault and the bridge. The vault create flow is rebuilt to match the Compressor: a named vault, mode cards with a conditional password, a result receipt instead of a jump into the browser, and a single tabbed shell (Home, Recent, Files) shared by the standalone modal and the browser. A new AeroVault Zip plaintext lane adds a fast, honestly-unencrypted .aerozip archive format for cases where compression matters and confidentiality does not, with optional recovery parity and a real measured size estimate. AeroMount gains a read-only mount and a one-shot Save-All for unlocked vaults (Ehud Kirsh's idea #1). On the bridge side, rclone export now reaches Filen and every OAuth cloud provider, not just import. The release closes a pre-release audit of all 86 changes (12 findings, including a formatting gate that was red on the previous commit) before tagging.

Added

• AeroVault create rebuilt Compressor-style (@EhudKirsh, #322): a required Vault Name drives the saved filename, the security level and compression are chosen on mode cards, the password field only appears for an encrypted vault, and create ends in a result receipt with the size composition instead of dropping you into the browser. The create form gained hover states, a reset button, a padlock and format label, an encryption badge and proportional before/after size bars.
• Unified tabbed AeroVault shell: the standalone modal and the in-browser view share one tab strip (Home and Recent standalone, Files and Recent in the browser), with the recent-vaults list extracted into a single reusable component rendered in both.
• AeroVault Zip plaintext archive lane (.aerozip): a new fast, unencrypted archive format with a CLI (aeroftp archive) and a GUI scaffold, opened by header on double-click with the OS file-type association registered. The copy is explicit that it provides no confidentiality. Recovery parity is opt-out (default on); --recovery-level 0 (or off/none) disables it.
• AeroMount read-only mount of unlocked vaults (@EhudKirsh, #322, idea #1): mount an unlocked Cryptomator vault, .aerovault or .aerozip as a read-only filesystem in your OS file manager. It is ephemeral and session-bound, the password is passed over stdin and never stored, and it auto-unmounts when you lock the vault or quit. Linux first.
• AeroMount "Save all..." for unlocked vaults (@EhudKirsh, #322, idea #1): export the whole decrypted tree of an unlocked Cryptomator vault, .aerovault or .aerozip in one shot, to a folder, a single .zip or a single .aerozip, instead of one file at a time. A shared ReadableVault seam drives a streaming zip writer for both container types, behind a confirm dialog that flags the plaintext export.
• Real graphical compressed-size estimate: the Compress and AeroVault Zip dialogs show the estimated output size as a bar that updates on every option change. A backend canary samples the actual input, compresses it with the chosen codec and level and extrapolates (exact when the whole input fits the sample cap).
• Live progress bars and a busy-lock for archive and vault operations, with a byte-true inverse bar and an honest result for incompressible input.
• Grid and list view in the AeroVault browse modal, the Cryptomator browser and the archive browsers, with a 3-level small/medium/large icon toggle and larger container modals.
• Export Filen and the OAuth cloud providers to working rclone remotes (@EhudKirsh, #128): Filen, Google Drive, Dropbox, OneDrive, Box, pCloud, Yandex, OpenDrive and Backblaze B2 now export to rclone.conf as usable remotes, not just import, extending the earlier Jottacloud-only export. Filen carries email, password and its CLI api key; the OAuth backends emit the AeroFTP-persisted token that rclone refreshes on first use (OneDrive also drive_id/drive_type, pCloud the EU hostname); OpenDrive and B2 their account secrets.
• Active Sessions in My Servers (@EhudKirsh, #128): a contextual filter for profiles with a live backend session, plus an open-session count chip on the button.
• Interactive aeroftp groups and aeroftp users CLI sections (@EhudKirsh, #311): dedicated groups [-i] and users -i prompts on the same -i engine as profiles -i (selectors by index or name, . refresh, h help, sticky loop). Groups gain re-index, Rename, Copy, Delete and List with a persisted order shared with the now drag-reorderable My Servers group list; users gain re-index, Rename, Copy, Delete, Fav, List and Tree, where Copy duplicates a user's servers into a new password-free user and Fav marks the default user auto-unlocked on launch. The default user is now a real is_default DB column with Manage Users parity, and the sidebar is vault-aware (standard buckets hide at zero, user groups always show).
• AeroFile recognizes bridge-config files (@EhudKirsh, #128): a bridge config dropped in the home folder is detected and an "Import to AeroFTP" context-menu action brings it into the app.
• Preview modal upgrade with an image gallery (@EhudKirsh, #128): opens instantly with a pulsing skeleton, shows load errors inside the modal, and adds hover arrows, toolbar prev/next and arrow-key navigation through a folder's images with a light fade.
• Consistent password-create UX on every create-password surface (@EhudKirsh, #322): a strength meter, a live confirm-match indicator and a show/hide toggle across the Cryptomator, AeroCrypt and rclone crypt dialogs, the new-server crypt binding, .aerovault create and change-password, master-password setup, keystore and settings export, user add, the optional Compress password and the share-link field. Save is blocked until the confirm matches; login and unlock boxes are deliberately left alone.

Changed

• Compression "Maximum" profile: the third compression preset is relabeled from "Archive" to "Maximum" (the old name collided with the encrypted v3 Archive mode) and the level labels are now translated. The backend mapping is unchanged (fast zstd-3, balanced zstd-9, maximum zstd-15).
• Crypt overlay padlock badge (@EhudKirsh, #272): the crypt overlay now reads as a padlock at every site (path bar, file context menu, the My Servers saved-profile badge and the unlock dialog headers), replacing the generic two-squares icon. The native AeroCrypt and rclone-crypt overlays stay distinguished by colour and label.
• Remote preview cap raised to 25 MB (@EhudKirsh, #128): the backend cap matched the 25 MB the UI already allowed (one shared limit), so 10 to 25 MB photos preview instead of being rejected.

Fixed

• Filen API key persists in Quick Connect when editing a profile (@EhudKirsh, #215): it is reloaded from the vault into the form on edit, survives switching protocol and back, and the misleading "key stored" hint was removed.
• Files from other Filen clients preview correctly (@EhudKirsh, #128): v2 (32-char) file keys are now decrypted, where the previous hex-only path rejected every cross-client file.
• 2FA reconnect no longer fires a stale retry (@EhudKirsh, #128): starting a connect by hand during the countdown cancels the pending saved-secret auto-retry, and a live backend session is reused on re-entry instead of re-logging in.
• aeroftp-cli profiles --tui stays in the TUI after an action (@EhudKirsh, #311) instead of dropping to the -i line prompt; only an explicit Quit exits.
• profiles -i action prompt is labeled with a h help alias (@EhudKirsh, #311), and the . refresh clears the screen via crossterm so the redraw is clean on legacy Windows consoles (#341).
• MCP setup dialog shows the correct Claude Code step: the user-scope claude mcp add -s user aeroftp -- aeroftp-cli mcp command replaces the ~/.claude/.mcp.json path that Claude Code does not read.
• Usable OneDrive and EU pCloud rclone remotes (@EhudKirsh, #128): OneDrive captures and injects drive_id/drive_type, pCloud the EU hostname, and the CLI export was synced with the GUI.
• Accessibility on password and create forms (@EhudKirsh, #322): the password show/hide eye toggle is no longer a Tab stop, the password input is focused when a vault or archive unlock dialog opens, and vault and compressor modals lock to the X with the create form autofocused.
• Pre-release audit fixes (F-01 to F-12): a final audit of all 86 changes fixed a Rust formatting gate that was red on the previous commit; a Backblaze B2 application key that skipped CR/LF sanitization on rclone export; a panic in groups -i and users -i on a quote-only line; a vault empty-state hint that rendered a raw i18n key; a leftover googlephotos entry in the release CLI capability JSON; an .aerozip extract and list report that always claimed recovery parity; a compressed-size estimate that could report "exact" after a skipped file; and two dormant context-menu translation keys removed across all 47 locales.

Security

• rclone config export hardened: the exported rclone.conf is written 0600 before any OAuth refresh token or obscured password lands in it, and every config value (host, user, region, endpoint, secrets, including the Backblaze B2 application key) is stripped of CR/LF so a crafted profile field cannot forge an extra [remote] section on re-export. Covered by injection tests.
• quinn-proto advisory RUSTSEC-2026-0185 patched (with a precautionary crypto-bigint unyank), plus routine dependency updates (rustls 0.23.41, regex 1.12.4, country-flag-icons 1.6.18).
• Dev-only providers hidden from the release surface: Google Photos and Blomp are no longer advertised by the release CLI capability catalog or the public docs, matching the GUI.

Documentation

• Bridge compatibility matrix published: docs/BRIDGE-COMPATIBILITY.md, linked from the README, gives the full per-protocol and per-provider import and export breakdown for all 15 bridge tools, corrected to the real export behaviour (recoverable-secret backends plus the OAuth and Jottacloud export added this release).
• Testing and Verification page added with the provider coverage matrix, and the README banner and provider grid were refreshed with native file-type icons in the File Formats table.

Contributors

<img src="https://github.com/EhudKirsh.png?size=48" width="48" height="48" alt="@EhudKirsh" />

Downloads:

• Windows: .msi installer, .exe, or .zip portable (no installation required)
• macOS: .dmg disk image
• Linux: .deb, .rpm, .snap, or .AppImage

_{_Updated 2026-06-25 09:12 CEST (post-tag doc fix): corrected the .aerozip CLI command name from aeroftp aerovz to aeroftp archive (aerovz is the internal lane codename, not a public command). Same fix applied to CHANGELOG.md and docs/UNIVERSAL-VAULT.md on main (commit 5199421bf). No binaries, code or behaviour changed._}

[4.0.8] - 2026-06-22

AeroProgress, Quick Connect Polish and AeroCrypt as a First-Class Profile

A flagship pass on the transfer and encryption progress experience (AeroProgress): the floating transfer card is back with a lane per file, live speed, ETA and bytes, a collapsible speed graph and per-theme styling, and the Transfer Queue, vault creation and cross-profile transfers all report real progress instead of a bare spinner or a frozen "Streaming" state. Around it, Quick Connect gets the polish from Ehud Kirsh's v4.0.6 connection review (#215), including a per-mode credential isolation fix and an app-aware local-bridge detector, and AeroCrypt is promoted from the roadmap to a first-class Crypt profile type with a navigate-out encrypted scope (#272). The Windows portable build and the contributor setup docs round out the release.

Added

• AeroCrypt is a first-class Crypt profile type: the native AeroCrypt overlay and the rclone-crypt interop overlay (equal grade) now show as a single Crypt class in My Servers and in aeroftp-cli profiles, with an Encrypted marker on the card, instead of living only in CLI commands and .sh / .ps1 automation. Public share links and server-side checksums are disabled while inside the encrypted area, since they would act on ciphertext, not your file. (@EhudKirsh, #272)
• Navigate-out encrypted scope: one connection can bind the overlay to a subfolder, show its contents decrypted, and step above it to see the rest of the server in clear (the path-bar badge switches to an "outside" state), then step back in to transparent decryption. A single fail-closed rule drives the badge, the transfer routing and the action gating, so the badge can never disagree with what an operation actually does. (@EhudKirsh, #272)
• Live progress bar for AeroVault create and add: creating a vault or adding files now shows a live progress bar for the compression and encryption stage with real bytes, instead of a bare spinner, which is most useful on a large vault that takes a few seconds.
• App-aware local-bridge detector: the Filen Desktop / MEGAcmd "Local WebDAV / Local S3" modes show a live 🔴/🟠/🟢 status dot and an app-aware message (not installed / installed but not running / active) in place of the static "Requires …" warning, and Save is disabled only when the helper app is confidently not installed. (@EhudKirsh, #215)
• CLI aeroftp profiles --health: an opt-in flag that probes the local-bridge helper apps for every bridge profile and prints a 🔴/🟠/🟢 status line after the table, mirroring the GUI detector (off by default so the plain listing stays instant). (@EhudKirsh, #215)
• Per-theme progress styling: the progress card, the shared progress bar and the speed graph have a dedicated look for every one of the 8 app themes (light, dark, true dark, tokyo, cyber, green, ice, redhorse), instead of the extra themes falling back to the dark gradient.
• Settings opt-out for the transfer progress card: shown by default, under Settings then General, for users who prefer not to see it.
• Export a technical report from an open vault and OS drag-and-drop with mixed file/folder staging for AeroVault.
• Change Mode for an open vault: re-pack a vault under a new security level (Standard / Advanced / Paranoid / Archive), compression profile and Error Correction, keeping the same password. It moves a vault between the v2 and v3 formats and toggles the AES + ChaCha20 cascade by re-encrypting every file in place, available next to Change Password in the GUI and as aeroftp vault change-mode in the CLI. (@EhudKirsh)
• Full AeroVault command parity in the CLI, so every file-management operation in the GUI is now scriptable for automation and agents: add --to-dir, add-dir (recursive folder add), extract-all (whole-vault, tree-preserving), mkdir, rm, mv, cp, change-password, compact, scan-dir, sync-compare / sync-apply and recovery-status, each auto-detecting the v2 / v3 format from the file.

Changed

• Archive vault preset lowered to zstd -15: a better ratio-to-speed balance for the Archive compression preset.
• Bundled aerovault crate updated to 0.6.3: the shared AEROVAULT3 core gains streaming seal and extract (constant-memory on large vaults), progress callbacks behind the new live vault progress bar, and per-shard error-correction health, all from a single audited implementation published on crates.io and pinned byte-for-byte with the app via the cross-implementation golden.
• Dependencies panel now covers every direct crate: the in-app Help then Dependencies check expanded from 49 to 115 monitored crates (all direct dependencies of the desktop app and CLI), grouped into Core, Protocols, Security, Archives, CLI & Tools, System and Plugins, each resolved from Cargo.lock and checked live against crates.io so an available update or a major bump is visible at a glance. log was advanced to 0.4.33 (a safe patch); tauri, suppaftp and aes-kw are deliberately held at their pinned versions for compatibility.

Fixed

• AeroProgress: the rich transfer card is back: the floating card was demoted to a bare percentage pill by an earlier Transfer Queue refactor. It now shows a lane per file (parallel uploads and downloads at once), live speed, ETA and bytes, a collapsible speed graph and a minimize-to-chip control, all from the real data the backend already reported.
• Transfer Queue real progress: a bar per active file plus an aggregate footer with the X of Y file counter, replacing the previous one-pixel strip and plain percentage.
• Real transfer progress over SFTP and cloud: transfers show the real filling bar with live speed and ETA instead of a frozen "Streaming" state, and large file uploads complete reliably. The floating card stays locked while a transfer runs (minimize only, no dismiss until 100 percent), the queue bar reflects only the current transfer, and every percentage is rounded.
• Real aggregate ETA for folder and multi-file transfers: a byte-based aggregate ETA computed from the actual remaining bytes over the live combined speed, instead of a blank zero, with each queued file showing its own live speed.
• Cross-profile transfer ETA and shared AeroSync bar: server-to-server transfers show a real ETA, and AeroSync uses the same shared progress bar as the rest of the app instead of its own inline strip.
• AeroProgress hardening after an independent correctness, security and performance review: the aggregate snapshot is matched to its own transfer so concurrent folder transfers cannot skew each other's ETA, the displayed percentage is clamped, malformed sizes can no longer render as NaN, and Transfer Queue rows are memoized so a long queue stays smooth.
• Native delta sync re-enabled over SFTP: byte-level differential transfer fills the card with live wire-byte progress. It had been routed through the classic streaming path because it showed no progress and a brand-new upload whose compressed delta exceeded the protocol frame limit failed outright; the delta payload is now split into protocol-safe frames, so those large uploads complete.
• Windows portable ZIP ships the CLI: the portable .zip bundled only AeroFTP.exe, so the headless aeroftp-cli (and Mount a folder, which calls it) was unavailable in portable mode while the .msi / .exe installers already included it. The portable ZIP now ships aeroftp-cli.exe and aeroftp-dispatch.exe next to AeroFTP.exe, with a hard-fail packaging guard so a future build cannot silently drop them. (@Trihedraf, #342)
• Quick Connect feedback from the v4.0.6 connection review: the Filen local-bridge admin default now shows as the username/password placeholder instead of being masked by the generic WebDAV default; the Filen CLI API key is documented like the 2FA secret (stored encrypted, reused on reconnect, with an edit-time "already saved" indicator); the MEGAcmd "Fetch URL" hint is corrected and the native ↔ MEGAcmd toggle is unlocked while editing; Koofr and OpenDrive drop the per-protocol "remember credentials" opt-in (one credential set), while Convert and Save-as-new carry that opt-in onto the new profile; the ⭐ favourite and server-group membership survive a protocol switch; and the InfiniCloud and GitHub auth-method toggles are switchable while editing. (@EhudKirsh, #215)
• Collapsible bridge setup box: the tall "Setup … first" instruction box on the bridge modes auto-collapses once the bridge is active and expands while it is not. (@EhudKirsh, #215)
• CLI interactive profiles refresh is consistent across terminals: the . refresh now clears the scrollback too (ESC3J), so Alacritty / pwsh / Windows Terminal no longer keep old tables stacked while WezTerm wiped them. (#341)
• Crypt overlay survives export/import: exporting a profile that carries an encrypted overlay and re-importing it now round-trips the binding for both overlay kinds (it previously dropped on import and came back as plaintext), and the stored-credential indicators reflect exactly what was restored. (@EhudKirsh, #272)
• Visual consistency: the floating transfer card and several dialogs (host key, permissions, insecure-certificate warning, keystore import result) share the same corner radius as the Transfer Queue panel and the other app dialogs.
• Cryptomator vaults are interoperable with the real Cryptomator: "Create Cryptomator Vault..." from a selection now encrypts the selected files and folders into the vault instead of leaving it empty, and AeroFTP vaults round-trip byte-for-byte with the official Cryptomator in both directions. Two format defects were fixed alongside the empty-vault one: directory-ID hashing (AES-SIV with zero associated-data components per RFC 5297, not one empty component) and encrypted-filename encoding (padded base64url, not unpadded), both of which a real Cryptomator requires. Proven bidirectionally against cryptomator-cli 0.6.2 (cryptofs 2.8.0) with sha256 byte-identity, and covered by new round-trip, edge-case and reverse-read tests. (@EhudKirsh, #322)
• AeroVault v2 extract now preserves the directory tree: extracting a whole v2 vault wrote every nested file into the destination root, so two files that shared a name across different folders (a/x.txt and b/x.txt) silently overwrote each other. Extraction rebuilds the full tree, including empty directories, and the Change Mode re-pack relies on the same fix to round-trip a v2 vault byte-for-byte. Covered by stress tests over duplicate basenames, deep nesting, empty files and directories, unicode paths and both the Standard and cascade modes.
• Used-storage quota falls back to a full scan: the My Servers used-storage figure now falls back to a breadth-first directory walk when a provider's recursive fast path fails, so the quota bar fills in instead of staying blank on servers that reject the deep listing. (#277, e33923e1d)
• OpenDrive large-file upload returns a clear error: a single file over OpenDrive's 100 MB ceiling now surfaces a dedicated, non-retryable FileTooLarge instead of being retried against a 403 that will never succeed. (d688c9c85)
• Koofr upload 404 is non-retryable: Koofr returns a non-standard 404 on some uploads; it is now mapped to a clear non-retryable error rather than being retried as a transient failure. (ec951b0a2)

[<img src="https://github.com/EhudKirsh.png?size=48" width="48" height="48" alt="@EhudKirsh" />
<img src="https://github.com/Trihedraf.png?size=48" width="48" height="48" alt="@Trihedraf" />
<img src="https://github.com/timint.png?size=48" width="48" height="48" alt="@timint" />

Downloads:

• Windows: .msi installer, .exe, or .zip portable (no installation required)
• macOS: .dmg disk image
• Linux: .deb, .rpm, .snap, or .AppImage

[4.0.7] - 2026-06-18

AeroVault Security Audit Hardening and Error-Correction Convergence

AeroVault went through an independent dual blind security audit (Claude Opus 4.8 and Codex GPT-5) followed by full remediation and a two-round adversarial controaudit that closed every finding (1 High, 1 Medium, 3 Low, 4 Info, 0 Critical, grade A). In the same pass the error-correction engine became a single audited implementation living in the published aerovault crate (0.6.2) instead of a copy forked into the app, and the My Servers grid got a pair of layout fixes.

Fixed

• No leftover temp or lock after an interrupted vault seal: killing a vault operation mid-seal used to leave a 56-byte .aerovault.lock that blocked the next writer and an 8 GB .aerovault-v3-XXXX plaintext temp beside the target. The container now writes through an auto-deleting temp on the error path, the standalone repair scrubs its temp on the persist-error branch (M1), and a lock orphaned by a crashed run is auto-reclaimed once its recorded owner PID is provably dead, via an atomic rename-aside (M9). (@EhudKirsh, #2)
• AeroVault extract blocks reparse-point escape: extracting a vault could follow a pre-planted intermediate Windows directory junction out of the destination, writing decrypted plaintext into a sibling directory. Each path component is now created refusing to follow a pre-existing reparse point, and the canonical parent is checked to stay inside the destination root (M2).
• correct repair honors an authenticity anchor: a bare repair reconstructed toward whatever hash the sidecar declared, so a planted same-length sidecar could drive it to attacker content. A new --expect-sha256 anchor refuses a sidecar that declares a different hash before any byte is written, on the CLI, the library and the MCP tool (M3).
• AeroVault rejects a forged extension directory at open: the header MAC covered the extension-directory offset and length but not its JSON bytes, so a forged directory is now rejected at open, before any recovery uses it (M4).
• AI local tools resolve absolute POSIX paths on Windows: a /-rooted path was treated as relative on Windows and re-based under the tool working directory; a leading / is now treated as absolute on every operating system.
• IntroHub layout: the My Servers grid now uses container-aware column counts (3 to 9) with a full-height sidebar divider, symmetric grid gutters, and aligned toolbar and cards.

Changed

• Error correction converged onto the aerovault crate (0.6.2): the app's forked standalone .aerocorrect and AeroSync error-correction engine (about 3,500 lines) is removed and replaced by a logic-free re-export of the crate, so the .aerocorrect format has a single audited implementation shared by the desktop app, the CLI and any Rust consumer. A cross-implementation golden keeps the bytes byte-for-byte identical (M7).
• Accurate AeroVault error-correction capability string: the app reported error correction as a Phase 1 stub while shipping live Reed-Solomon error correction; the capability string now reflects the real RS engine (M5).

Security

• AeroVault dual blind security audit, grade A: an independent dual blind audit (Claude Opus 4.8 and Codex GPT-5) plus full remediation and a two-round adversarial controaudit closed 1 High, 1 Medium, 3 Low and 4 Info findings with zero Critical and zero open findings, verified on both the crate and the app. The kill-cleanup pair (M1 and M9) was surfaced by Ehud Kirsh's V3 Beta test pass. (@EhudKirsh, #2)
• DOMPurify updated to 3.4.11: clears a Dependabot advisory (GHSA-cmwh-pvxp-8882, ALLOWED_ATTR pollution via setConfig). A precautionary transitive bump; the affected configuration path is not exercised by AeroFTP.

Contributors

<img src="https://github.com/EhudKirsh.png?size=48" width="48" height="48" alt="@EhudKirsh" />

Downloads:

• Windows: .msi installer, .exe, or .zip portable (no installation required)
• macOS: .dmg disk image
• Linux: .deb, .rpm, .snap, or .AppImage

[4.0.6] - 2026-06-17

AeroVault Crate Convergence

AeroFTP's AEROVAULT3 vault engine and its revision 4 Reed-Solomon error correction now live entirely in the published aerovault crate, so the desktop app, the standalone CLI and any third-party Rust project all run a single audited implementation instead of parallel copies. The app keeps only thin command wrappers over the crate, and the container format is now defined and tested in one place.

Changed

• AeroVault engine moved into the aerovault crate (0.6.0 on crates.io): the full AEROVAULT3 container (1024-byte header, gear content-defined chunking, per-chunk zstd, keyed-BLAKE3 deduplication, small-file packing, authenticated manifest) and revision 4 Reed-Solomon error correction are now owned by the crate. The app's vault_v3_* commands became thin wrappers over it, removing about four thousand three hundred lines of duplicated cryptography. A cross-implementation fixture pins the app and the crate to byte-for-byte identical containers, so a vault created by either side opens and extracts in the other and existing vaults are unaffected. AEROVAULT3 design and the unified .aerocorrect direction were driven by Ehud Kirsh. (@EhudKirsh, #162, #276)
• Benchmark profile picker uses a checkmark: the full-screen benchmark profile picker marks selected rows with [✓] instead of [x]. (@EhudKirsh, #277)

Fixed

• Folder uploads honor the skip and overwrite policy: uploading a folder to a cloud provider accepted a file-exists policy but silently ignored it, so re-uploading a tree re-sent unchanged files. The policy is now applied per file and the skipped count is reported. Found by an independent CLI security audit.

Contributors

<img src="https://github.com/EhudKirsh.png?size=48" width="48" height="48" alt="@EhudKirsh" />

Downloads:

• Windows: .msi installer, .exe, or .zip portable (no installation required)
• macOS: .dmg disk image
• Linux: .deb, .rpm, .snap, or .AppImage