AeroFTP Files

[4.1.0] - 2026-06-28

AeroShare Peer-to-Peer (Beta Preview), the AeroAgent Coding Loop and Per-User Groups

The headline of v4.1.0 is AeroShare, a Beta preview of direct, end-to-end-encrypted device-to-device transfer with no server in the middle. It is the seventh module of the Aero Family: send a file or a folder straight to another person over a peer-to-peer channel (iroh 1.0 with Mainline-DHT discovery and federated relays), always-on at launch, with a Discover tile, a titlebar +friend button, a draggable hub and a status-bar receiver indicator. Alongside it, AeroAgent gains a foundation coding loop (a curated, GUI-only, approval-gated tool set for local development), server groups and favourites move into each user's encrypted partition, the interactive CLI grows a New(N) verb and per-user management, the aero benchmark defects are fixed, the Filen Desktop bridges work headless, OS "Extract here / to folder" verbs land on Nautilus and Windows, Windows USB eject works, and the in-app sigstore update verification verifies for real again. The P2P stack was migrated from iroh 0.92 to 1.0, clearing 6 Dependabot alerts. 47 languages translated.

Added

• AeroShare: end-to-end-encrypted peer-to-peer transfer (Beta): send files and folders directly to another user with no hosted account in the middle, over a peer-to-peer channel built on iroh 1.0 with decentralized Mainline-DHT discovery and federated relays as fallback. AeroShare is now always-on at launch (it was hidden behind an off-by-default Settings flag and undiscoverable): the Discover tile carries a 256-bit E2E badge, the +friend button sits in the titlebar, and the handshake dialog is always available. Adding a friend or sharing a folder auto-activates the feature; the standing receive loop is opt-in via a one-time prompt, both changeable from Settings. Each sender gets their own Inbox and an address book remembers the people you exchange with. The hub dialog is draggable by its header and a status-bar pill next to AeroCloud surfaces the receive loop at a glance and toggles it on click. i18n 47/47. (@EhudKirsh, #284)
• AeroAgent coding loop (foundation): a curated GUI tool set for local coding work, GUI-only and either read-only or approval-gated, with no change to the transfer or file-management tools. It adds ripgrep workspace search, structured cargo/tsc/eslint diagnostics, git read (log/show) plus stage and commit, a run-checks runner and an ordered multi-check verify, safe patch with automatic checkpoints, and review cards.
• Native CLI profile export/import (@EhudKirsh, #215): aeroftp-cli profile-export and profile-import write and read an encrypted .aeroftp profile backup, byte-compatible with the GUI's My Servers Export/Import (a file made in one imports in the other). It reuses the GUI's exact collect/restore path, so the per-protocol credential snapshots are shared, not duplicated; secrets are opt-in via --include-credentials.
• Per-protocol credentials survive profile export/import (@EhudKirsh, #215): a one-account-many-protocols profile (for example a Koofr account saved as Native API + WebDAV) now keeps each mode's saved credentials across export and import. The per-protocol snapshots, the "Remember credentials for every protocol" opt-in and the OAuth Remote Path field all round-trip, and the import dialog's "contains credentials" badge accounts for every secret kind.
• Interactive New(N) verb across profiles -i / groups -i / users -i (@EhudKirsh, #311): create a profile, group or user from inside the -i loop (the rclone n) New remote model) instead of dropping out to a separate add command. profiles -i n [query] runs a service-first catalog picker; groups -i n makes an empty group; users -i n a new local user.
• groups -i member add/remove (@EhudKirsh, #311): a <group> <profile...> and x <group> <profile...> curate a group's membership from inside the loop, idempotent and multi-target.
• Per-user server groups and favourites (CLI + GUI): groups and favourites used to live in a single global vault blob shared across every local user; they now route through each user's encrypted partition, with a best-effort one-time seed from the legacy blob so existing groups and favourites carry over. The default user is now a real is_default database column (was localStorage) with Manage Users parity and a vault-aware sidebar.
• OS "Extract here / to folder" verbs for archives and vaults (Deliverable G): a right-click "AeroFile" submenu on Nautilus (Linux) and the Windows shell, with "Extract here" and "Extract to folder" for zip/7z/tar/rar and the aero containers, mirroring the standard extract pair. A clear archive extracts headlessly via the CLI; an encrypted one or a vault opens a dedicated minimal password window that never boots the main app. The MSI installer reaches parity with NSIS via a WiX fragment. Additive verbs only, the double-click Open is untouched. Validated live on GNOME Nautilus 46.
• Quick Connect connector harmonization (@EhudKirsh, #215): the single-column connectors now use the same two-column layout as every other provider, and the 8 OAuth clouds expose Wrappers / Overlays (a transparent crypt overlay on the 7 overlay-eligible OAuth backends, persisted through the OAuth save path). The profile name with a clickable icon avatar moved to the top of the form, Local Path now sits above Remote Path, and the Wrappers / Overlays section starts expanded by default.
• .aeroftp-script registered as the 5th OS file format + a generic archive icon: the README advertised five AeroFTP file formats but only four were OS-registered; .aeroftp-script is now registered on all OSes, and a shared amber archive-family icon was added for the supported compressed formats.
• Windows USB eject (@EhudKirsh, #351): the AeroFile PLACES eject control now performs a real safe removal via the Shell.Application "Eject" verb, polling until the drive disappears so a real failure surfaces instead of a silent false success. The power glyph becomes a standard eject symbol, the no-media ghost row is dropped after a successful eject, and an eject failure always raises a visible toast. Validated on real Windows 11 hardware.
• OpenDrive privacy is editable end to end (@EhudKirsh, #252): OpenDrive's three-level access model (private, public, hidden) is now controllable from every surface. Properties > Permissions reads and changes the privacy of an existing file or folder, including a multi-selection that applies the same level to every selected item at once; Quick Connect gains a per-account "Default privacy for new items" so new uploads and folders inherit your chosen level instead of whatever OpenDrive assigns. The CLI gains an access verb (aeroftp-cli access --profile NAME /path --to private|public|hidden) for an existing path, plus an --access flag on put and mkdir; folder privacy cascades to children, and CLI creates default to private (max-privacy, opt out with --access public), mirroring rclone's --opendrive-access. The levels are private (not listed or shared, owner-only), public (anyone with the link, searchable) and hidden (reachable by direct link only, not searchable).

Changed

• AeroShare is discoverable by default (see Added): the feature is no longer gated behind an off-by-default Settings flag.
• -i action bars reordered safe-first (@EhudKirsh, #311): the profiles / groups / users interactive action bars lead with the read-only verbs and Help(H), with re-index moved out of the front and the destructive Delete(D) last before Quit. The key letters are unchanged, so no automation breaks.
• groups -i / users -i polish (@EhudKirsh, #311, #341): a labelled action bar with Help(H/?), a Refresh(.) that clears the screen, compact one-token selectors, a header rule, count columns, and arrow + strikethrough summaries on re-index and delete, matching profiles -i.

Fixed

• Filen S3 empty-folder rename explains itself instead of leaking a raw 401 (@EhudKirsh, #368): renaming an empty folder on Filen's local S3 bridge now returns the actionable "add a file inside the folder first, or use the native API / WebDAV bridge" message instead of a cryptic HEAD on rename source returned status 401. An empty folder is a virtual prefix with no object, so the copy-then-delete rename has nothing to copy; the 401/403 from a Filen S3 endpoint is mapped to that case, scoped to is_filen_s3_endpoint() so real files and non-empty folders are unaffected.
• Filen Desktop bridges work outside the GUI, OpenDrive API host self-heals (@EhudKirsh, #368): the Filen Desktop local bridges authenticate to a loopback server defaulting to admin/admin, but that blank-to-admin/admin fallback lived only in the GUI connect path, so the CLI, benchmark, MCP and schedulers sent empty credentials and failed. A shared helper now applies the same fallback on both headless paths. Separately, an OpenDrive profile switched from the WebDAV preset into native API mode could keep webdav.opendrive.com and hit the WebDAV HTML auth page; the host is now normalized to dev.opendrive.com.
• aero benchmark real defects fixed (@EhudKirsh, #368): the shared scratch base is removed after a run (guarded, so a pre-existing base, a concurrent run or a --test-root-prefix is never touched), the scratch tree is built with mkdir-parents so servers that refuse nested collections (pCloud WebDAV) work, both the per-profile header and the comparison tables gained a protocol column, a public-IP snapshot flags a run as not comparable if the IP changed mid-sweep, a multi-profile run shows [k/N] per profile plus per-operation run k/N, a Yandex region hint is shown on endpoint errors, and the Connection-type is clarified as downstream Mbps.
• aero benchmark --tui profile picker no longer flickers on scroll (@EhudKirsh, #277): the picker repaints in place instead of clearing the whole screen every frame.
• Filen Quick Connect Save persists an API-key deletion and cancels the 2FA countdown (@EhudKirsh, #128, #215): the green Save removes the key from the vault and cancels the bottom-right 2FA auto-login countdown so it cannot fire a stale TOTP reconnect.
• Copy/Move a server profile to another user no longer loses data (@EhudKirsh, #366): a Move now always materialises the profile in the destination first and removes the source only after, so moving a profile whose equivalent already existed in the target no longer destroys the only copy. The account picker also reuses the shared UserAvatar instead of rendering a raw base64 string that overflowed the avatar circle.
• Transfer Queue per-item bar advances on Crypt overlays (@EhudKirsh, #364): both the rclone-crypt and native AeroCrypt overlays now emit live start/progress/complete events, so folder uploads drive the running file-count badge and single-file uploads advance the byte-progress bar.
• "Active Sessions" sidebar filter appears for Quick Connect re-auths (#128, @EhudKirsh): a form-driven connection (notably an OAuth re-auth) now binds to its matching saved profile before the session is created, so it lights up both the header badge and the sidebar filter.
• Bridge setup box no longer flashes open then collapses (@EhudKirsh, #215): switching to a Filen Desktop / MEGAcmd bridge tab no longer flashes the "Setup first" box during the probe; it knows synchronously that the active mode is a bridge and starts collapsed.
• Run tray-less when libappindicator is missing (@redpay, #362): the app no longer panics at launch on Fedora Silverblue and other minimal or immutable distros that lack libappindicator / ayatana-appindicator3; it runs without a tray and bypasses close-to-tray when no tray is available.
• Welcome / splash version is now dynamic (@EhudKirsh, #367): the splash injects the real running crate version at launch instead of a hardcoded string that read "v4.0.8" under v4.0.9, so the label can never drift from the published version again.

Security

• iroh family migrated 0.92 to 1.0 (iroh 1.0, iroh-blobs 0.103, iroh-docs 0.101, iroh-gossip 0.101), clearing the 6 Dependabot alerts the old line pinned (hickory-proto x4 and lru x2) via hickory-proto 0.26.1 and lru 0.18.0. Decentralized Mainline-DHT discovery is preserved by re-wiring onto iroh 1.0's address-lookup API.
• Sigstore update verification now actually verifies (#358): the in-app signature check had been stuck on its amber "verification unavailable" fallback since v3.3.2 because sigstore 0.13 could not parse GitHub's v0.3 signing bundles; the bump to sigstore 0.14 adds v0.3 parsing, so it returns a real verified result on releases. It stays a non-blocking second factor with the artifact SHA-256 as the primary integrity check. Drops 3 now-moot cargo-audit ignores.
• In-range dependency refresh plus the softprops/action-gh-release 3.0.0 to 3.0.1 bump (#353, kept SHA-pinned), and the Checks CI workflow restored to green after a cargo fmt drift.
• Windows local-STT build fix (#344): two MSVC-only CMake env vars force whisper.cpp to the static release runtime, resolving the LNK2038 runtime-library mismatch at the link stage; inert on Linux and macOS.

Internal

• Provider offline-test coverage complete across all 16 unit-only providers (@EhudKirsh, #347): a deterministic, no-network regression net for Azure Blob, Koofr, Yandex Disk, Cloudinary, Uploadcare, GitLab, Filen, 4shared, kDrive, Jottacloud, Zoho WorkDrive, Internxt, Drime and Immich (GitHub was already covered; Swift is skipped as its only profile, Blomp, is inactive). Each provider gained a behaviour-preserving pure classify or parse seam plus matrix tests; 30 new unit tests, no production behaviour change.

Documentation

• Public documentation refreshed for v4.1.0: AeroShare added to the README and the Aero Family, per-user groups and favourites documented in docs/MULTI-USER.md, the AeroAgent coding tools added to the AeroAgent docs, the new CLI verbs (profile-export/profile-import, the -i loops) documented in AGENTS.md and docs/CLI-GUIDE.md, and the benchmark, Filen Desktop bridge and OpenDrive notes carried into docs/COMMUNITY-BENCHMARK.md, docs/BRIDGE-COMPATIBILITY.md and docs/PROVIDERS.md.

Contributors

Downloads:

• Windows: .msi installer, .exe, or .zip portable (no installation required)
• macOS: .dmg disk image
• Linux: .deb, .rpm, .snap, or .AppImage