Aether Desktop 1.4.0 — release notes

Aether Core 2.4.0 remains the engine version. This release ports the portable networking and custom-config features of mobile 1.6.0 to Tauri 2 / Windows. Android Intents, camera import, airplane-mode/radio controls, VpnService and phone hotspot UI are not copied.

Headline change: Windows UI and dimensions now match mobile 1.6.0

The Windows 1.4.0 interface was rebuilt to follow the mobile 1.6.0 design instead of the older 1.3.0 desktop layout. Only the frontend changed in this pass; Rust, native/ and third_party/ are byte-identical to the input (SHA-256 compared for 2292 files).

• Settings and cards. The connection-verification switch is a separate card above the core settings (same verifyConnection key, same wording as mobile); protocol tiles are two columns with a full-width last tile; option cards share mobile's structure.
• Custom configs page. Capsule tabs without extra background or line, equal-height Add config (green) and New tab (dark pink) buttons, no duplicate “Saved configs” title, no fixed 560 px table width (long names, ports and the three-dot button stay inside the window; domains wrap under the type/ping badges), and a full-width Test all card under the table with icon, hint and assistant button.
• RTL and language. Picker arrows point left in RTL; the “Exit country” hint sits under the whole row; technical names (Aether, Tor, MASQUE×2) stay English; Link or text, Import file and Name are translated; technical strings in inputs keep LTR order.
• Drawer and Gemini. Triangular logo removed from the drawer header, uniform group spacing; Gemini icons use the #9B8CFF token and sit in the title row.
• Modal fix. Escape now closes only the modal and no longer also leaves the sub-page.

Limits: checked with Chromium (layout and a new DOM/geometry parity test) and a test IPC, not in WebView2 on Windows; pixel-exact parity is not claimed. See docs/UI_PARITY_1.4.0.fa.md and docs/UIUX_1.4.0_REPORT.fa.md.

• Authenticated NPVS v5 input through native paths and browser byte input: P-256 signature, ChaCha20-Poly1305 fields, PBKDF2/app-key unlock, expiry and locked-content privacy. Legacy NPVT1 stays supported. Recipient-device keys and attestation are explicitly rejected, not bypassed.
• Persistent automatic/named tabs, counters, per-server action menu, group moves, lowest-delay sorting and 150/300 ms colors. Subscription records refresh atomically in the DPAPI store.
• Cold TLS + generate_204 real delay, monotonic timing, strict HTTP/1.0/1.1 CRLF parsing and distinct HTTP/network outcomes. A warm live-ping number is a different measurement and is not forced to equal cold setup delay.
• Config → Aether uses a bounded two-step custom TCP plan. ChainTrace logs lifecycle and teardown without exposing raw locked configs.
• IPv4 grace race, validated ISO countries, delayed generation-safe country enrichment, globe fallback and wrapping IPv6 display.
• Optional initial verification (default on), background group auto-selection with 120-second freshness and 50 ms / 20% hysteresis, configurable health interval.
• Native performance/security ports: CUBIC and bounded netstack queues, WireGuard handoff/rekey safeguards, asymmetric UDP buffers (including Windows socket tuning), routing/DNS fixes, custom TCP gateway scan/SNI policy. (The shipped core Cargo.lock pins rustls 0.23.43; see the security audit below.)
• Version-scoped What's New suppression remains persisted in prefs.json; Windows network-adapter/router troubleshooting replaces phone-only advice.

Reproducible source and validation limits

CORE_PORT_PATCHES.json records original/mobile/ported hashes. The upstream manifest has NOT been rewritten to disguise the reviewed overlay as pristine. Guards reject unrecorded changes. CORE_SYNC defaults to off; an explicit upgrade requires rebasing the overlay rather than discarding it.

See docs/PORT_1.4.0_REPORT.fa.md for actual test results and remaining limitations. Source delivery does not certify live VPN connectivity, signing, an installer or a remote GitHub Actions run. Third-party NPVS adaptation is AGPL-3.0 licensed; see THIRD_PARTY_NOTICES.md before distribution.

The existing explicit Tor → Psiphon connection label and official Tor process are retained; they are not replaced by a generic SMART label.

Completion pass: portable mobile 1.6.0 gaps

• SmartPlus is a real two-family WARP/MASQUE race, with independent loopback probe ports/process ownership, serial tactics within each lane, a 7-second stagger, bounded budgets, confirmed winner and joined/cancelled losing workers. Saved profiles are never rewritten to the winning tactic.
• Tactics Memory is per default physical network (hashed gateway/DNS/NetworkGuid), not installation-global: 14-day proven evidence, 6-hour failed evidence, at most 32 networks, bounded/atomic storage and reset support. Unknown networks do not create a global cache entry.
• Auto-selection performs a fresh active-group Real Delay batch before connecting when enabled. Periodic results are rejected if their catalog basis changed; cancellation closes sockets, stops Xray and joins workers.
• Local QR image import, persistent HTTPS subscriptions from Paste, and native-path image import are implemented.
• Psiphon upload SQM ports the mobile delay-gradient autorate, token-bucket/SFQ and sparse-flow priority. It starts open, uses an independent warm verified-TLS RTT session, applies backpressure only to tunneled uploads, and resets/stops with the connection. Direct routes and downloads are not capped.
• ChainTrace now includes owned Xray/native exit status, session-linked SOCKS handshake stages and aggregate transfer counters without packet payloads or credentials.
• AI custom-exit eligibility follows the active session's actual final SOCKS port, not the saved backend's intermediate/default port. Disconnected/ineligible routes fail closed. Zero Trust handoff Debug output never reveals an access token.
• Development tooling refreshed to Vite 7.3.7 / puppeteer-core 25.14.0, with patched transitive dependencies; npm audit reports zero known advisories at validation time. Node >=22.12 is required.

Actual validation and release boundary

Portable production-module tests: 171 passed. Core-policy tests: 33 passed. Full native core tests on Linux: 423 passed, 2 explicitly ignored live-network tests. No failures. These suites overlap in coverage and are not 627 distinct product behaviours.

Both app cargo check --tests and complete native core cargo check succeeded for x86_64-pc-windows-msvc and i686-pc-windows-msvc, including BoringSSL/ring/QUIC with a Windows SDK and Clang 19. The app checks use the CI resource-only override, not fake executable resources. npm test (13 harnesses), web build, Chromium layout and project preflight succeeded. See the Persian report and delivery verification log.

No source-level gap listed in the previous report is deliberately left as a future implementation item. This is not a proof of universal semantic equality or a Windows runtime certification. Windows linking/installers/signing, remote GitHub Actions and live chain/NPVS interoperability still need a real release test; they were not run in this Linux session. Android-only services, radio controls, camera Intents, Keystore/attestation and phone hotspot UI remain platform exclusions, not bypasses.

1.4.0 — fixes (Windows parity with mobile)

• Import of NapsternetV NPVO1 text exports (.npvs), including npvs1: encoded values (port of NpvoCodec.kt).
• Server rows show only TYPE S# • IP:PORT (no names, adverts or worker hosts); S numbers are consecutive per tab.
• "New tab" button is on the left; the sparkle (AI) buttons were removed from the config page.
• Real ping now mirrors mobile: www.gstatic.com, discarded warm-up, two keep-alive rounds, validated TLS.
• "Home screen animations" off disables only the background glow; the connect-button spin keeps running.
• Wintun: DLL check, retries, reuse of a stale adapter, exact OS error; no silent fall-back to the system proxy.

Security audit — Windows 1.4.0 (score 70/100)

Source-level review of this repository, scored on eight areas with fixed weights, plus tools actually run for this release: cargo audit (RustSec database of 30 Oct 2026) on both Cargo.lock files, npm audit (0 advisories), grep review of TLS, capabilities, CSP, CI and key material. It is not a penetration test; no leak test, installer, signing or live tunnel was run on Windows hardware. The scores are the reviewer's judgement against the evidence in the table, not an automated metric.

Findings to fix next (not changed in this release, because the core overlay is hash-guarded and unverified edits would break check-core-pristine):

1. Core dependency advisories. native/aether/aether/Cargo.lock pins rustls 0.23.43, quinn-proto 0.11.17 (RUSTSEC-2026-0338/0340/0343, remote panic/DoS), rustls-webpki 0.103.15, crypto-bigint 0.5.5, ctutils 0.4.2, zstd crates and rsa 0.9.10 (RUSTSEC-2023-0071, no fix available). The mobile project upgrades several of these in CI with scripts/patch-engine-dependencies.py; the Windows CI has no equivalent step. An earlier line of these notes said “rustls 0.23.46”; that is not what the shipped lock file contains and has been corrected.
2. Clean-IP scanner accepts any certificate. src-tauri/src/custom/cleanip.rs:517-518 (danger_accept_invalid_certs(true) + danger_accept_invalid_hostnames(true)). If the scan only measures reachability and no secret is sent, impact is low; it should still be documented or replaced by a pinned check.
3. Supply chain. Pin GitHub Actions to commit SHAs, pin the Rust toolchain version, add Authenticode signing when a certificate exists (.github/expected-signer.txt is empty).
4. Plaintext state. WARP identity, profile.json and the log are not encrypted (not secrets by design, but sensitive).