axpdev-lab/aeroftp v4.2.3

AeroFTP v4.2.3

on GitHub

[4.2.3] - 2026-10-13

Checked Writes, Resumable Ranges, and SITE Commands

A repair release, one week after 4.2.2: 122 commits and 86 tracked changes. The thread running through it is data you could lose when something goes wrong half way. An operation that checks whether a file exists before writing now writes only when the server confirmed it is not there, a WebDAV replace keeps the old file until the new one is in place, crypt init writes nothing until the Emergency Kit is in your hands, and a large download that loses a connection resumes the range it was reading instead of starting over. Around that: SITE commands for FTP and FTPS, a local folder usable wherever the CLI takes a URL, a transfer speed that shows the current speed, and AeroAgent 1.7, which can drive the visible app when you ask it to.

Every change listed here is tracked, with its commit and its discussion, in the release tracker: AeroFTP 4.2.3, known issues, patches and updates.

Thank you to everyone who uses AeroFTP, at home or at work, and especially to those who write back when something does not behave. A large part of this release started from a report: benchmark runs from Western Europe that showed MEGA and Proton transfers with no progress, a request for raw SITE commands, a crash report about large uploads that led to the progress and speed rework, and two interface proposals now in the app. The people behind them are listed at the end.

Before the tag, an independent pre-release review read how this cycle's changes fit together on main, in three areas: writes that can lose data, the transfer engine and its retries, and the security surface, the latter checked against the security advisories rclone published on October 9. A second pass read the fixes that landed after it. Together they found three blockers, all fixed below before the tag; the non-blocking findings are recorded in the tracker.

What changes for you

The short version, split by where you meet it. Everything in this list appears again further down with the detail.

In the app

• A failed check no longer leads to a write. Creating a crypt vault, unlocking AeroCrypt, touching a file, and uploading with no-clobber, immutable or "skip existing" write only when the server answered that the item is not there. If the check itself fails (timeout, permission, server error), the operation stops instead of writing over what might be there.
• Replacing a file on WebDAV keeps the old one until the new one is in place. Apache, rclone serve and Nextcloud start an overwriting MOVE by deleting the destination, so a failure in between lost the file. The old file is now set aside, the new one moved in, and only then the old one deleted.
• Large downloads survive a stalled read. When one range of a segmented download stalls or loses its connection, that range resumes from where it stopped instead of the whole file starting again, on SFTP, FTP, S3 and every HTTP provider with ranged reads.
• The speed you see is the current one. Speed, graph and time remaining follow the last 3 seconds instead of the average since the start, the graph covers the whole transfer and keeps a stall as a dip, and progress moves while the file is being sent on S3, Azure, Dropbox, Box, Google Drive, B2, Swift, Jottacloud, Internxt, OpenDrive, MEGA and Proton.
• SITE commands for FTP and FTPS, from a new Connection menu, sent through the connection already open.
• Resizable Local and Remote panels, and a day and night appearance on a schedule. Drag or use the keyboard on the divider, and the split is kept across restarts. Appearance can follow the system or switch at the times you set.
• AeroAgent 1.7. It can operate the visible app when you ask it to (select, navigate, connect a saved profile, change settings), each step approved, with a cursor on screen and a badge to slow it down, pause or stop it. It also runs the community benchmark inside the app, gains the remote tools the MCP server already had, works with Anthropic again, and shows exact token counts instead of estimated costs.
• The Permissions dialog changes a file's mode again on FTP, FTPS and SFTP. Every Apply had failed with "Not connected to server" since v3.1.5.
• Encrypted folders behave. The unlock dialogs open the overlay at the folder you opened them on, an Overlays Path whose folder name is itself encrypted keeps the Crypt toggle, a default-salt AeroCrypt vault reopens from its password alone, and AeroCrypt slot changes work on eight more backends once you consent to a non-atomic replace.
• Providers that misbehaved: Azure accounts with a hierarchical namespace list folders as folders, B2 retries a busy storage pod and renews an expired token during a long copy, Nextcloud retries a refused chunk instead of failing the file, ownCloud reports a missing path as missing, Box waits for a commit answered 202, MEGA S4 accepts the new megas4.com domain, Internxt explains an unfinished account setup, and the Filen Desktop S3 preset lets you pick the folder to open as its bucket.
• Saved servers: opening Edit right after Save shows what you saved, Quick Connect keeps your edits, drafts and imported OAuth credentials, and Lock Now confirms that the lock happened.
• AeroImage crops what is on screen after a turn or a mirror, with undo and redo, and its preview gallery follows touchpad swipe and pinch.
• The AppImage starts on systems without WebKitGTK, using its bundled libraries only there.
• Translations: 165 strings with letters from another alphabet, 892 strings in Armenian, Khmer, Georgian and Macedonian that were not real words, translations left on the previous English in 46 languages, and seven Greek sentences whose semicolon reads as a question mark in Greek are corrected.

In the CLI and for automation

• A folder of this machine works wherever the CLI takes a URL. aeroftp-cli serve webdav /srv/share shares it with no other server, and ls, get, put, sync, check and crypt take /abs/path, ./rel/path or file:///abs/path, inside a path jail. The folder hashes in place, reports df, copies inside itself with cp and resumes an interrupted transfer.
• aeroftp-cli site sends a SITE command through the open FTP or FTPS session, also from the TUI.
• hashsum no longer copies the file to the temporary folder. It hashes the bytes as they arrive; a 25.2 GB file used to fill a 27 GB tmpfs.
• serve sftp stores what it receives. It acknowledged every upload and discarded the data, 4.2.2 included.
• A server that accepts the connection and never answers is a timeout: exit 8 instead of 1 or 4, retried as a network error, with a hint that no longer names a --timeout flag ls, get and stat refuse.
• crypt init writes nothing until the Emergency Kit has been handed over, so a corrected command no longer exits 9 asking for --force.
• profiles shows the number --profile opens, also with a sort or a --group filter.
• -vv no longer prints the FTP password.
• An SFTP path that cannot be read is reported as unreadable (exit 3) instead of missing (exit 2), so rm --force, --immutable and the speed test refuse it instead of acting on it.
• The CLI agent counts tokens: --cost-limit becomes --token-limit and /cost becomes /usage.
• On WebDAV, edit and remote_edit need --allow-non-atomic, and so do AeroCrypt slot changes on the backends that cannot replace a file atomically.

Added

• SITE commands for FTP and FTPS. A Connection menu entry, aeroftp-cli site and the TUI send a SITE command through the open connection and show the whole reply. A command whose outcome is unknown is never sent again, and its arguments never reach the logs; the protocol feature matrix lists it (@jnewing, #1109, #1143, #1146).
• A local folder as a remote in the CLI. Wherever the CLI takes a URL it takes a folder of this machine, as /abs/path, ./rel/path or file:///abs/path, and serve webdav /srv/share shares one with no external server. The folder is the root of a path jail: nothing outside it can be read or written, and a served client cannot reach outside it (#1123). The folder computes md5, sha1, sha256, sha512 and blake3 in place, so hashsum, check --checksum and sync --checksum need no download, reports its filesystem to df, copies inside itself with cp, and resumes an interrupted transfer from the bytes already held (#1126).
• AeroAgent 1.7 can operate the visible app. Through stable selectors and bounded state it selects, navigates and refreshes with the same handlers as the interface (#1097, #1098), connects a saved profile by an opaque identity without reading its credentials (#1099), changes supported general and AI settings through approved commits that keep saved API keys and your unsaved drafts (#1107), and opens or closes the AeroTools workspace and its panels (#1108). Approvals are native and bound to the session, snapshots are redacted, control follows the calling session so two agents with the same name cannot act in each other's lease (#1139), a visible cursor shows each action and a badge lets you change the speed, pause, resume or stop (#1141), and Lock Now interrupts it (#1117).
• AeroAgent runs the community benchmark in the app, with progress, Stop and the report, and gains 18 remote tools the MCP server already had, with tests that keep every MCP tool reachable from AeroAgent or declined with a reason (#1130). The benchmark runs from the library the CLI and AeroAgent share, and its JSON report is anonymized on every exit (#1128).
• Resizable Local and Remote panels. The divider between connected panels can be dragged or moved from the keyboard, and the split is kept across restarts (@Omkar-Wagholikar, #1105, #1118).
• Scheduled day and night appearance. Appearance can be manual, follow the system, or switch at local times you choose, overnight schedules included, each with its own palette (@Omkar-Wagholikar, #1105, #1116).
• The Filen Desktop S3 preset lets you pick the top-level Filen folder to open as its bucket, and the status bar says where the account total lives on the Filen Desktop presets (@EhudKirsh, #958, #1121).
• MEGA S4 on megas4.com. Profiles on the new domain are recognized as S4, the preset lists its 14 published regions, and saved profiles on s4.mega.io keep working unchanged (#1191).
• CLI and GUI share profile column and protocol-breakdown choices. My Servers has a breakdown checkbox, profiles --breakdown=false turns it off, the preferences reload after unlock or on focus, and the default JSON output keeps its array shape (#1084).

Fixed

• Operations that check before writing write only when the check said the item is not there. crypt init, AeroCrypt unlock, touch (CLI, TUI, MCP and AeroAgent), no-clobber and immutable uploads and folder upload with skip treated a failed check (a timeout, a permission error, a server error) like an absent file and went on to write, which could overwrite a vault's config and orphan every encrypted file. A failed check now stops the operation (#1192).
• A WebDAV replace sets the old file aside, moves the new one in and only then deletes the old one, instead of one overwriting MOVE that Apache, rclone serve and Nextcloud start by deleting. On WebDAV edit and remote_edit need --allow-non-atomic, and a missing AeroCrypt marker can be rebuilt on seven more backends (#1154).
• AeroCrypt slot changes (migrate-v4, add-slot, remove-slot, rotate-slot) run again on WebDAV, MEGA, Filen, FileLu, Dropbox, Koofr, Drime and kDrive, only with explicit consent (--allow-non-atomic in the CLI, a consent box in the slots dialog). A revocation deletes every leftover copy of the old marker or fails naming it, and the remove-factor note says what a revocation does not protect (#1180).
• crypt init writes nothing until the Emergency Kit has been handed over. A run without --emergency-kit, with a kit path it cannot write, or with a "no" at the prompt left a marker, a keystore config or a keyfile behind, so the corrected command exited 9 asking for --force (#1156).
• The AeroCrypt and rclone crypt unlock dialogs open the overlay at the folder they were opened on instead of the server root, so ad-hoc Open and Create work outside the root again, and an ad-hoc Open of a default-salt vault reopens it from its password alone, in memory, without writing to the remote (#1162). A saved AeroCrypt profile with a header whose marker and keystore copy are both gone reopens from its password and rebuilds the marker, and the rebuild is refused unless names in the folder decrypt and nothing could be overwritten (@EhudKirsh, #276, #347, #1120).
• An Overlays Path whose own folder name is ciphertext keeps the Crypt toggle and opens its subfolders. The name was decrypted on the way back, so the path never matched and subfolders answered Path not found or 400 (@EhudKirsh, #1077, #1148).
• A long segmented download no longer restarts from zero when one read stalls or a connection drops: the failed range resumes from where it stopped, on SFTP, FTP, S3 and every HTTP provider with ranged reads (#1190).
• A segmented download finishes when its own file already holds the only free transfer slot. With several large files at the maximum parallel setting, or with the endpoint or disk slot cap set to one, that download asked for a second slot and waited forever. A sync into a mounted subfolder on another disk now reserves that disk's slot too (#1200, #1201).
• A batch that mixes small and large files no longer stalls for good when the transfer limits are lowered. A small file took its server session and then a transfer slot, a large file did it the other way round, so a small and a large file could each wait for what the other held. Both now take them in the same order; this was already possible in 4.2.2 (#1198).
• Large transfers through an AeroCrypt or compression overlay, a remote AeroVault or a Proton Drive upload no longer pass through the temporary folder. On many Linux systems that folder lives in RAM, so a large file could fill memory and fail. They now use AeroFTP's on-disk scratch folder, and a transfer that cannot fit stops at once and says how much space it needs (#1199, #1201).
• The transfer speed is the speed of the last 3 seconds instead of the average since the start, so the number, the graph and the time remaining follow a slowdown or a recovery; a resumed download no longer opens at several GB/s, and fast archive operations show a speed (#1150). The progress card's graph covers the whole transfer by bytes and keeps a stall as a dip, every live speed falls while no progress arrives, the percentage sits left of the title, and the lock and maximize buttons that did nothing are gone (maximize is now a queue toggle) (@eagle-te, #658, #1161).
• Progress keeps moving on slow transfers. A delta upload reports inside each block it sends instead of once per percent after each 2 MiB block, and AeroVault add, the AeroShare send dialog and AeroAgent's tree copy no longer wait a whole percent or five files (@eagle-te, #658, #1157).
• Upload progress moves while the file is being sent on S3, Azure, Dropbox, Box, Google Drive, B2, Swift, Jottacloud, Internxt and OpenDrive, also for uploads sent in parts, and reaches 100 only after the server accepts the upload (@EhudKirsh, #368, #1122).
• MEGAcmd and Proton transfers. MEGAcmd uploads show progress while sending, and MEGAcmd transfers over a minute no longer fail with Timeout (#1124). MEGAcmd downloads follow mega-get's own progress from zero of the listed size, and MEGA and Proton transfers no longer open at the "done" state, which read as finished even when they then failed (@EhudKirsh, #368, #1124, #1149).
• hashsum on a file without a usable server digest no longer downloads the whole object into the temporary folder. It hashes the bytes as they arrive, from 8 MiB windows read in order, a stalled window resumed from where it stopped; a 25.2 GB file filled a 27 GB tmpfs on the #658 re-test. dedupe keeps a first-window timeout a timeout instead of turning it into a 500 MB size error (#1195).
• An HTTP server that accepts the connection and never answers is reported as a timeout on every HTTP provider. The CLI exits 8 instead of 1 or 4, transfers retry it as a network error, the connect hint no longer names a --timeout flag that ls, get and stat refuse, and "Connection failed" is printed once (#1164).
• Azure accounts with a hierarchical namespace list directories as directories, instead of showing an empty folder as a zero-byte file or a full one twice; files sharing a folder's name stay separate (#1188).
• B2 uploads retry a busy or refused storage pod on a fresh upload URL, honoring Retry-After, without ever posting a small file twice (#1181). B2 renames over 5 GB and large uploads renew an expired token at each step and cancel the large file a failure leaves, instead of retrying the whole copy and leaving an unfinished large file billed on the bucket (#1155).
• Nextcloud uploads retry a refused chunk in place instead of failing the whole file, and a batch with one session and one chunk credit no longer stalls (#1182).
• On ownCloud a path that does not exist is reported as missing, instead of appearing as an empty file or folder when the server answers with a malformed listing (#1183).
• A Box upload sent as an upload session is reported done only once Box has created the file: a commit answered 202 Accepted is sent again after Retry-After instead of being taken as success (#1127).
• An Internxt login refused because the account setup is not finished says so and points to the emailed setup link, instead of a generic refusal (#1184).
• Filen Desktop S3 no longer writes a directory marker, so a new folder is a real folder instead of a zero-byte file followed by a 500 (#1096). Filen Desktop benchmarks keep the write-back wait out of the download time and say they measure the local bridge, not Filen (@EhudKirsh, #368, #1119).
• Benchmarks measure Koofr downloads again (payloads named .dat), and MEGAcmd no longer leaves every run in the rubbish bin (#1083).
• An SFTP folder that cannot be read, or a path behind a folder that cannot be traversed, is reported as unreadable instead of missing. rm -r --force no longer reports it deleted, --immutable, rm --force previews and the speed test refuse it instead of acting on it, and ls, stat and get exit 3 instead of 2 (#1131, #1138).
• The Permissions dialog changes a file's mode again on FTP, FTPS and SFTP, only on the connection it was opened on. Every Apply had failed with "Not connected to server" since v3.1.5 (#1144).
• Files uploaded through aeroftp-cli serve sftp are stored. Writes were acknowledged and thrown away on every backend, 4.2.2 included, and the OpenSSH client no longer hangs at the end of a session (#1125).
• aeroftp-cli serve webdav answers 404 to a PROPFIND on a missing path instead of describing it as an empty folder, so its clients (including aeroftp-cli stat and crypt init --with-header) no longer see every missing file as an existing directory (#1158).
• serve prints a generated login even under --quiet: it printed none, so nobody could log in. The CLI guide now matches the CLI on hashsum -a and on serve refusing a non-loopback address without --allow-remote-bind (#1133).
• aeroftp-cli sync <folder> <local> <remote> with a folder as the first argument keeps the third one instead of syncing folder to folder (#1123).
• aeroftp-cli profiles shows the number --profile opens even with a sort or a --group filter, where a number read from a sorted table could open another server, and an interactive reorder no longer overwrites one made by another session (#1145).
• Editing a saved profile and opening Edit again right after Save shows the saved values, Cancel Editing closes its tab, and a profile save stays in the account it was read from when the account is switched meanwhile (#1134).
• Quick Connect saves icon and path removals, keeps tab drafts and loads imported OAuth credentials consistently; 4shared and Blomp share the profile layout, with field-copy controls and a protected optional Blomp endpoint (@EhudKirsh, #1100, #1115).
• Lock Now confirms that the account and vault locks succeeded, interrupts GUI agent control and keeps the failure visible when a lock fails (#1117).
• AeroAgent works with Anthropic again. Every request carried an API version header Anthropic rejects, so chat, the model list and the Test button failed with HTTP 400, and the Test button sent the key as a Bearer token. The current Claude models use the request shape they require, and the model list has no retired model (#1129).
• AeroAgent runs the benchmark and the speed test alone instead of beside a transfer that skewed them, and the scheduler no longer runs a plan step before the step it explicitly waits for (#1132).
• Transfer capabilities report atomic rename from what each provider established: SFTP from the server's posix-rename@openssh.com, Google Drive from its revision upload, WebDAV not claimed (its MOVE deletes the destination first), overlays from the provider under them. Agents were told SFTP had none (#1151).
• The canary trial (Canary Mode on the AeroSync Plan tab) is available in builds without aerorsync too, where a leftover cfg had dropped it (#1159).
• AeroImage crops the picture as shown after a turn or a mirror, applies the crop at once with undo and redo, and no longer fails with "Crop area exceeds image bounds"; the preview gallery pages from any entry point, goes round, and follows touchpad swipe and pinch (#1147).
• The AppImage starts on systems without WebKitGTK (the AppImageHub test system among them) by using its bundled libraries only there; where WebKitGTK is installed nothing changes, and Arch without WebKitGTK renders without the EGL error of #90 (@Graninius, #90, #1135).
• Hash Forge's Argon2id starts from the AeroVault and AeroCrypt profile (128 MiB, 4 iterations, 4 lanes, 32-byte output) instead of the smaller RFC 9106 option; the salt stays a fresh 16-byte value (@EhudKirsh, #347, #1153).
• Used-storage walks count bytes without keeping every file in memory, which lowers peak memory on large trees, and SFTP listing workers open their first connection before listing, so a pooled scan no longer starts with false "reconnecting" warnings (#1082).
• Translations. 165 strings in eleven languages no longer contain letters from other alphabets, and a CI check stops them from coming back (#1193). 892 strings in Armenian, Khmer, Georgian and Macedonian that were not real words, meant something else or were out of date are retranslated, and the privacy note no longer says data is collected (#1194). Translations that still showed the previous English follow the current wording in 46 languages, and CI fails if a translation matches an old English sentence (#1196). Seven Greek sentences used a semicolon, which Greek reads as a question mark, where the ano teleia belongs.

Security

• On Windows, a client of aeroftp-cli serve on a local folder can no longer delete or create files outside that folder. A path segment carrying ..\, a drive or a UNC prefix (DELETE /..%5coutside.txt) was read as path syntax when joined to the folder, over WebDAV, FTP and SFTP alike. Introduced earlier in this cycle by the local-folder support and found by the pre-release review, so no released version is affected (#1197).
• aeroftp-cli -vv (or RUST_LOG=trace) no longer prints the FTP login password: the FTP library's wire trace is held at INFO in the CLI log (#1142).
• reconcile and sync_doctor refuse a local_dir under ~/.ssh (#1128).
• Dependency updates: russh 0.64.1 with its client-side rekey and authentication fixes, tokio, hyper, libc, toml, vite and jsdom (#1177); zeroize 1.9.1, whose Debug of a wrapped secret no longer prints it, and uuid 1.28.0 (#1189); tauri-build 2.7.1, libunftp 0.23.1, tokio-rustls 0.26.6, xxhash-rust 0.8.19 (#1095); CSS tooling and P2P updates with the patched selector parser pinned and the DNS, TLS and standalone peer fixes aligned, without changing application features (#1114); quinn-proto 0.11.18 for RUSTSEC-2026-0338, RUSTSEC-2026-0340 and RUSTSEC-2026-0343 (#1201).
• Linux AppImage builds pin and verify all five linuxdeploy helpers against a dated release or source commit and their SHA-256, together with AppRun and linuxdeploy; a corrupt cache entry, a missing verified helper or an unverified plugin stops packaging. A compatible non-yanked iroh-blobs restores strict dependency auditing (#1104).

Changed

• AeroAgent is version 1.7 in AI Settings and the chat header.
• AeroAgent shows exact token counts instead of estimated costs. The amount was estimated from prices built into AeroFTP, which change per model and per provider without notice, and no provider returns the price of a request. Token counts are the provider's own: per reply, with input, output and prompt cache in the tooltip, and per conversation, now counting every request. The monthly cost budgets and the Cost estimates setting go with it, and in the CLI agent --cost-limit becomes --token-limit, an exact count that includes the prompt cache, and /cost becomes /usage (#1140).
• AppImage delta updates are verified on a real release: zsync rebuilds the 4.2.2 AppImage from the 4.2.1 one with a matching SHA-256 (#1000).
• The tauri runtime layer and the tauri 2.12 plugins are held on the 2.11 line under the tauri =2.11.0 pin, because a plain cargo update moved them to 2.12, on which tauri 2.11.0 does not compile (#1177, #1178).
• Interface and design proposals start in the Design Threads discussions: maintainers implement the agreed design across every theme and language, and the proposer is credited as co-author (#1106).
• Build and CI: Windows unit tests run on every Rust change and the Windows build fails on any warning (#1136, #1160), the Tauri context is generated once in build.rs, which saves 6 to 8 minutes of Windows test time per run (#1163), the feature-off build fails on any warning (#1159), and the snap gate G4 runs snapcraft's GPU, library and metadata linters inside core22, where a missing lint can no longer pass as green (#1070, #1152).
• The AeroCrypt key map left without a writer by #1162 is removed with its aerocrypt_lock command; a crypt Compare resolves AeroCrypt keys only through the overlay it opened (#1179).

Contributors

Thanks to the people who shaped this release:

Downloads:

• Windows: .msi installer, .exe, or .zip portable (no installation required)
• macOS: .dmg disk image
• Linux: .deb, .rpm, .snap, or .AppImage