Release v0.3.5

Added

• Setting to disable configuring the Windows firewall at startup (default on, Windows only). Applies live when turned on; turning it off leaves any existing rule in place (#18).
• Setting to disable mDNS advertising (default on). Discovery of other devices keeps working; toggling applies live (#18).
• "Add Remote" with a single IP now connects directly when the peer is already paired, and only falls back to the PIN/pairing flow otherwise (#18).
• A Diagnostics event log (Settings → Diagnostics): an in-memory view of pairing and mTLS connect/drop events, filterable by level (Minimal/Detailed/Debug), with copy/clear/pause/auto-scroll. It is never written to disk. Thanks to @mdunphy for the suggestion.

Fixed

• A general settings save no longer overwrites pairing_accept_enabled; the header-bar pairing toggle is now the sole writer, so a stale Settings tab can't clobber it.
• The cluster name is now shared across all devices instead of being per-device. Renaming on one device (or regenerating it) propagates to every peer, including peers that were offline at the time, so the name no longer silently diverges. Switching to an auto-generated name while in an active cluster now asks for confirmation first. Thanks to @mdunphy for the report.

Changed

• The Settings page is now organised into a left sidebar with categories (General, Cluster, Files, Notifications, Diagnostics) instead of one long scroll. All existing settings are preserved; keyboard shortcuts now live under General (shown when the matching auto-send/receive is off).

Security

• The device private key (device_key.der) and pairing PIN (network_pin) are now written with owner-only permissions (0600) on Linux and macOS, and existing files are re-hardened at startup. On Windows they rely on the default per-user %APPDATA% ACLs. Thanks to @mdunphy for the report.
• In Autogenerated mode the pairing PIN is no longer written to disk: it's generated in memory at each launch and any existing on-disk PIN is removed on startup, eliminating a stored-secret leak vector. Provisioned mode still persists a user-set PIN. Note: the auto-mode PIN now changes on every launch. Thanks to @mdunphy for the report.
• PIN values are no longer written to the on-disk log file. The verbose pairing-failure PIN dump now goes only to the in-memory Diagnostics event log (at Debug level), never to disk. The "Verbose pairing logs" setting still controls file-log failure detail (but never PINs). Thanks to @mdunphy for the report.

📦 Installation

Linux
If you're on a modern Linux distribution (i.e. with Wayland and Flatpak support), the recommended method of installing ClusterCut is via FriendlyHub.

macOS
Download the DMG file from the assets of this release.

Windows
Download the EXE file from the assets of this release.

Full Changelog: https://github.com/keithvassallomt/ClusterCut/blob/main/CHANGELOG.md