FileN

Recent Commits

• Dwynr (30 Jun 26)

  fix: handle SDK realtime socket "error" so sleep/wake doesn't crash the worker The worker's SDK runs with connectToSocket: true but nothing attached an "error" listener to sdk.socket. When the TLS connection drops (e.g. the machine sleeping/waking) the socket emits "error", which Node treats as fatal when unhandled -> uncaught exception that crashes the worker. The SDK already auto-reconnects with backoff on close, so attach a listener that logs it.

• Dwynr (29 Jun 26)

  feat: uniform per-role rclone VFS cache limits + faster dir-cache invalidation Apply one cache policy across all three rclone roles (network drive, S3, WebDAV) via shared constants in constants.ts: - 32 GiB absolute cache cap per role (the drive only had a cap when a user size was set - not wired to the UI yet, so effectively uncapped; s3/webdav had none) - raise the disk free-space floor 5 -> 16 GiB on all roles - 720h VFS cache max-age on all roles (was drive-only) - dir-cache-time -> 15s on all roles (was drive 30s, s3 default 5m, webdav 5m) so external/remote changes surface faster; Filen has no ChangeNotify so this is the only freshness lever rclone never evicts dirty/open files to honor the size/free-space limits, so pending uploads are never dropped.

• Dwynr (29 Jun 26)

  chore: bump @filen/sync and @filen/web versions Updates runtime dependencies to `@filen/sync@^0.3.4` and `@filen/web@^0.1.93`. This also aligns transitive Filen packages around newer SDK/sync versions, reducing duplicate nested installs.

• Dwynr (29 Jun 26)

  fix: bundle WinFSP 2.2.26112 (CVE-2026-3006), fetch at build time, (re)install on update - bump bundled WinFSP 2.1.25156 -> 2.2.26112 (v2.2B1), which fixes CVE-2026-3006; no stable release carries the fix yet - fetch the WinFSP msi at build time into bin/deps (SHA256-pinned), like rclone and FUSE-T, instead of committing the 2 MB binary; remove build/winfsp-2.1.25156.msi - NSIS customInstall always runs the bundled MSI: msiexec installs when absent, major-upgrades when older, and no-ops/repairs when current, so the CVE fix reaches existing users on the next app update (install time only, /norestart). Runtime stays install-if-absent only - exclude bin/deps from the asar so the FUSE installers ship via extraResources only

• Dwynr (29 Jun 26)

  fix: serve 0-byte streamed files instead of 400 on a Range request A Range request against a 0-byte file made parseByteRange return null, so the loopback /stream server responded 400. Skip range handling when the file is empty so it falls through to a valid empty 200, matching the service-worker stream path in @filen/web.

• Dwynr (28 Jun 26)

  ci: remove Dependabot configuration Deletes `.github/dependabot.yml`, removing the daily npm Dependabot version update setup for the repository.

• Dwynr (28 Jun 26)

  Merge branch 'main' of https://github.com/FilenCloudDienste/filen-desktop

• Jan (28 Jun 26)

  Merge pull request #199 from ahmutkadim/fix/appimage-runtime fix: updated appimage runtime through electron-builder config

• Dwynr (28 Jun 26)

  fix: confine main-window navigation to the app origin; harden loopback server + preload - index.ts: add will-navigate/will-redirect handlers so the main window stays on the app origin (filendesktop://bundle in prod, the dev server in dev); off-origin http(s) links open in the external browser. SPA routing uses the History API and is unaffected. - preload.ts: expose desktopAPI only on the trusted bundle/dev origin (not on any other origin the webContents might load, e.g. the loopback HTTP server). - worker/http.ts: /stream now allowlists audio/video/image content types (octet-stream + attachment otherwise) and sends X-Content-Type-Options: nosniff + a strict CSP.

• Dwynr (28 Jun 26)

  chore: bump deps

• Dwynr (28 Jun 26)

  perf: O(1) amortized Semaphore dequeue (was O(N^2) under fan-out) The Semaphore's waiting queue dequeued with Array.shift() (O(n) — it re-indexes the whole array). When many tasks await one semaphore the queue grows to ~N and each of the N releases shifted an ~N-length array, making a large fan-out O(N^2) purely in queue churn. Replace the shift queue with a head-index queue (advance a pointer, null the consumed slot, compact the consumed prefix occasionally). FIFO wake order, the concurrency cap, and count()/setMax()/purge() are all preserved — a pure data-structure swap (verified: FIFO, cap incl. width > 1024, purge, and the compaction path under heavy queueing).

• Dwynr (28 Jun 26)

  ci: add ESLint workflow Desktop had no lint gate in CI. Add one mirroring the web repo: npm ci + npm run lint on push/PR to main, running the project's ESLint 9 flat config.

• Ahmet Özbay (27 Jun 26)

  fix: updated appimage runtime through electron-builder config

• Dwynr (27 Jun 26)

  fix: rclone: gate Linux FUSE3 detection on fusermount3, not libfuse3.so alone isFUSE3InstalledOnLinux previously returned true if EITHER fusermount3 was on PATH OR ldconfig -p listed libfuse3.so. But rclone's unprivileged mount goes through the fusermount3 setuid helper, so a box with libfuse3 present but no fusermount3 (the library pulled in transitively without the fuse3 utils package) was a false positive: detection passed, then the mount failed with a confusing error instead of surfacing the clean "install fuse3" instructions. Make fusermount3 authoritative and probe it PATH-independently (which, then the well-known absolute locations /usr/bin, /bin, /usr/local/bin, /sbin) so a minimal-PATH desktop launch still detects it. Drop the libfuse3.so-only acceptance.

• Dwynr (27 Jun 26)

  chore: modernize lint/type toolchain - ESLint 9 flat config + typescript-eslint 8 + TS 5.9 - eslint 8 -> 9.39 with flat config: eslint.config.mjs replaces .eslintrc; drop the standalone @typescript-eslint/{parser,eslint-plugin} for the unified typescript-eslint 8 package; add @eslint/js + globals - typescript 5.3 -> 5.9 (stayed on 5.x to avoid TS 6's moduleResolution/baseUrl churn) - tsconfig: add noUnusedLocals, noUnusedParameters, noFallthroughCasesInSwitch and noImplicitOverride (aligning desktop with the web repo's existing strictness) - fix the resulting lint/type errors: drop stale eslint-disable comments for rules removed/renamed in v9 / typescript-eslint 8 (ban-types, no-var-requires, no-extra-semi), allow require() in the dev-only .js entry shims, prefix intentionally-unused params with _ (+ argsIgnorePattern), use optional catch binding, drop an unused FS member Ruleset is otherwise unchanged (recommended, NOT type-checked) per the agreed "modernize only" scope. Full build (lint + tsc emit) passes.

• Dwynr (27 Jun 26)

  fix: rclone watchdog: fix Windows busy-loop, gate on arming, slower poll - Windows: the watchdog delayed with `timeout /t`, which aborts instantly with "Input redirection is not supported" when stdin isn't a console - and the helper runs with stdin = NUL (stdio:ignore) - turning the PID poll into a CPU-pegging busy loop. Delay with a loopback ping instead (console-free, reliable on every supported Windows version). Bump MONITOR_VERSION so the corrected script lands as a new file rather than reusing the buggy one an old install wrote. - never run an unguarded rclone: RcloneProcess.start now retries arming the watchdog and, if it still can't arm (or there's no PID), kills the just-spawned child and fails the start - so a hard exit can't orphan an rclone (an s3/webdav server holding its port, or a mount left mounted) with no watchdog to reap it. - bump the poll interval 2s -> 10s on both platforms (fewer wakeups / less CPU; the ~10s crash-cleanup latency is irrelevant). Supported targets (Electron 42): macOS 12+, Windows 10+, Linux (Ubuntu 18.04+ / Debian 10+ / Fedora 32+), x64 + arm64. The watchdog uses only universal OS primitives on each, so no native addon is needed.

• Dwynr (27 Jun 26)

  fix: macOS: native window handling (hide on close, Cmd+Q quits, Dock-click restores) The drive window holds live renderer state, so it must never be destroyed and recreated while running. Make the macOS lifecycle native without losing that: - close (red light / Cmd+W) now HIDES the window instead of minimizing it - it stays fully alive (renderer, sockets, sync intact; backgroundThrottling is off), the app stays in the Dock + tray, and a Dock-icon click or the tray "Open" restores it - add a before-quit flag so an explicit quit (Cmd+Q, app-menu / Dock Quit, and Ctrl+Q on Windows/Linux) passes through the close handler and actually quits on all platforms - this also fixes the same minimize-instead-of-quit bug on Windows/Linux when "minimize to tray" is enabled - activate (Dock-icon click) re-shows the existing hidden/minimized window via showOrOpenDriveWindow() instead of only creating one when none exist - move the Dock-hide off the yellow-minimize event onto the macOS close->hide path (gated behind "minimize to tray" / menu-bar-agent mode), so minimizing no longer strands the window by erasing its Dock thumbnail Windows/Linux close/minimize/tray behavior is otherwise unchanged, and the quit path still hard-exits via app.exit(0) (graceful will-quit teardown left as a separate follow-up).

• Dwynr (26 Jun 26)

  perf: rclone: parallelize Filen transfers, drop no-op flags, tune per role/platform Audited every invoke arg against rclone v1.74.3 source/docs + the Filen Go SDK. - mount: remove --use-server-modtime and --vfs-fast-fingerprint (both no-ops for the Filen backend - ModTime always returns the real client mtime; the backend flags neither SlowHash nor SlowModTime); --buffer-size 0 -> 32Mi (0 stranded the SDK's serial reader); --dir-cache-time 3s -> 30s (Filen has no ChangeNotify, so this is the only freshness lever) - transfers: the Filen SDK has no parallel download (serial 1-MiB GETs), so add --vfs-read-chunk-streams (8 mount / 12 serve) - the only way to parallelize a download; add --filen-upload-concurrency + lower --multi-thread-cutoff so medium files take the concurrent, retryable upload path; size the fshttp pool via --transfers/--checkers - s3/webdav: bound the long-running VFS cache with --vfs-cache-min-free-space 5Gi - platform -o: Windows FileInfoTimeout/DirInfoTimeout, macFUSE noapplexattr, FUSE-T rwsize=1048576 (drop the redundant backend=nfs) All flags validated against the bundled rclone v1.74.3 binary.

• Dwynr (26 Jun 26)

  fix: rclone: surface the real failure reason in startup errors The rclone child is spawned with stdio "ignore" so its stderr is discarded, but it still logs operational failures to --log-file. On a startup readiness timeout or early exit, read the tail of the role's log and append the actual ERROR/CRITICAL line to the thrown error instead of a generic "(timeout)", so the user sees e.g. "address already in use" / "mountpoint already in use". Parser verified against the rclone v1.74.3 log format.

• Dwynr (26 Jun 26)

  fix: rclone: self-healing binary extraction, warm-up, config heal, relax S3 creds - binary: verify the binary actually runs (not just exists), extract to a temp dir and atomically publish, sweep leftover .extract-* debris, and dedupe concurrent callers, so a crash/restart/mid-run kill can never leave a partial binary that breaks startup - warm up the binary at app start; regenerate a missing-or-empty rclone.conf defensively - relax S3 access/secret key validation to 1-128 / 1-256 chars so the default admin credentials work

• Dwynr (26 Jun 26)

  chore(rclone): remove the worker's now-unused isAuthed() method Its only caller was the worker stop()'s network-drive cleanup, which moved to RcloneManager when the drive/S3/WebDAV roles left the worker thread. The separate config-module isAuthed() export is untouched.

• Dwynr (26 Jun 26)

  build(rclone): bundle FUSE-T installer + bump WinFSP to stable, wire auto-install Restores fresh-machine FUSE-layer auto-install parity with the old @filen/network-drive. macOS: bundles the FUSE-T 1.2.7 .pkg (fetched + SHA256-pin-verified at build time into bin/deps, shipped via mac.extraResources to resources/deps - not committed, ~24MB). Windows: bumps WinFSP 2.1.24255 (beta) -> 2.1.25156 (stable) for both the NSIS install-time copy and a runtime-fallback copy under resources/deps; updates installer.nsh + the files/extraFiles references. index.ts now passes winfspMsiPath/fuseTPkgPath to RcloneManager (platform-gated, dev/prod path-resolved), so dependencies.ensureDriveDependencies auto-installs the FUSE layer when neither it nor macFUSE is present. FUSE-T SHA256 is pinned (no upstream checksum file); WinFSP verified against its published SHA256.

• Dwynr (26 Jun 26)

  build(rclone): bundle rclone binaries via extraResources + CI fetch Bundles the 2 rclone zips per platform (both arches) so the installer extracts the matching one at runtime (spec section 11, D3). build/rclone/fetch.mjs (Node builtins only) downloads + SHA256-verifies the current platform's zips into bin/rclone/ - idempotent, fails CI loudly on mismatch - and the build workflow runs it before electron-builder in each platform job. package.json adds per-platform extraResources (bin/rclone/*.zip -> resources/rclone/, which is binary.ts's prod process.resourcesPath/rclone) and excludes bin/rclone from the asar files glob so the zips ship exactly once. macOS: bundling the ZIP (not the raw binary) keeps notarization clean since no rclone executable sits loose in the .app; rclone's own macOS binaries are Developer-ID-signed + notarized, so runtime extract+exec works (verified live earlier).

• Dwynr (26 Jun 26)

  chore(rclone): remove @filen/network-drive, @filen/s3, @filen/webdav These three packages are fully replaced by the bundled rclone binary + the new src/lib/rclone modules (network drive via rclone mount, S3/WebDAV via rclone serve). Nothing imports them anymore; tsc + eslint stay green after removal. The install:filen script drops them too (express/cors stay - the worker HTTP stream server still uses them).

• Dwynr (26 Jun 26)

  feat(rclone): wire RcloneManager into main + IPC, remove old worker modules Integrates the main-process RcloneManager into the live app. index.ts instantiates it; the will-quit handler now calls rclone.killAll() before stopping the worker (the per-process watchdogs cover the non-graceful exit paths). ipc/index.ts re-points every network-drive/S3/WebDAV handler from worker.invoke(...) to desktop.rclone.* (identical channel names + return shapes), setConfig also feeds rclone.setConfig, and the dependency/mount-validation handlers resolve from the new src/lib/rclone modules. The worker thread loses its WebDAV/S3/NetworkDrive instances, channels and cache methods (sync + the HTTP stream server stay); src/worker/{networkDrive,s3,webdav}.ts are deleted; the dead WorkerInvokeChannel entries are pruned; preload's GetStats type is re-pointed to the structurally-identical NetworkDriveStats. @filen/network-drive/s3/webdav are now unreferenced. tsc + eslint green.

• Dwynr (26 Jun 26)

  feat(rclone): add RcloneManager orchestration manager.ts owns the bundled binary, the shared INTERNAL-auth rclone.conf, and the three role instances (drive/s3/webdav) in the Electron main process (spec section 4). setConfig writes the config from sdkConfig only when authed; each feature has idempotent, per-feature-mutex start/stop/restart that rebuilds the role from the current config plus a DISTINCT free rc port - a port-reservation mutex prevents concurrent starts colliding, since findFreePort's bind/close probe frees the port immediately. Distinct cache dirs + per-role TLS certs (spec 6.5/9). killAll() stops all three concurrently (allSettled, idempotent) for the exit hooks; networkDriveCleanupCache refuses while uploads are pending (spec 12); the IPC contract surface is preserved (isXActive/isXOnline/isNetworkDriveMounted/networkDriveStats/cache ops). Live-validated on macOS arm64 with the test account: all three roles up simultaneously with 3 distinct PIDs, rc ports, and cache dirs, then killAll left no processes, watchdog scripts, or mount.

• Dwynr (26 Jun 26)

  feat(rclone): add WebDAV server role (rclone serve webdav) webdav.ts serves a Filen WebDAV endpoint via rclone serve webdav, replacing @filen/webdav (spec section 6.4). HTTP Basic single-user (--user/--pass) only - digest and proxy mode are dropped (D5). --vfs-cache-mode full + a SEPARATE persistent cache dir (never wiped) so desktop clients can seek/read-back; --dir-cache-time 5m; --server-read/write-timeout 0; --max-header-bytes 65536; optional SAN-cert HTTPS. isOnline = unauth GET / returning 401 (via the existing httpHealthCheck), matching the old contract and proving auth is enforced. Live-validated on macOS arm64 with a test account: unauth and wrong-password both 401 (fails closed), correct creds 200, rclone-as-webdav-client byte-exact upload/download round-trip, clean teardown.

• Dwynr (26 Jun 26)

  feat(rclone): add S3 server role (rclone serve s3) s3.ts serves a Filen S3 endpoint via rclone serve s3, replacing @filen/s3 (spec section 6.3). Composes RcloneProcess + TLS cert gen + validation: --auth-key on the CLI (the RCLONE_AUTH_KEY env var is broken and fails open, rclone#9044), --force-path-style=true, --etag-hash= (Filen has no MD5), --vfs-cache-mode writes with a SEPARATE cache dir, --server-read/write-timeout 0 for big transfers, --max-header-bytes 65536 for SigV4 headers; optional SAN-cert HTTPS. isOnline treats any HTTP response on the owned port as up (observed 400 unauth, matching old @filen/s3), with a TCP fallback. Live-validated on macOS arm64 with a test account using rclone as a real SigV4 client: bucket listing + byte-exact upload/download round-trip, and a wrong secret key REJECTED with 403 (auth fails closed); clean teardown, no orphan.

• Dwynr (26 Jun 26)

  feat(rclone): add network drive mount role networkDrive.ts mounts a Filen drive via rclone mount, composing the foundation modules: FUSE-layer dependency check, mount-point validation + stale-mount recovery, the PERSISTENT VFS cache (ensured but NEVER wiped - the upload-loss bug fix, spec section 12), per-OS arg building (Windows/WinFSP, macOS macFUSE-or-FUSE-T with the /etc/hosts location fallback, Linux/FUSE3), the supervised RcloneProcess (kill ladder + watchdog), OS unmount, and rc-based getStats in the exact existing IPC shape. Readiness is gated on the mount being genuinely attached (st_dev change vs parent), since rclone's rc answers vfs/list before the FUSE/NFS mount attaches on a cold start - accepting vfs/list alone reported ready too early. Live-validated on macOS arm64 + FUSE-T with a test account: real mount, 40MB written through the mount and read back byte-identical, confirmed persisted on the account, live getStats upload progress, then clean unmount with no orphan process.

• Dwynr (26 Jun 26)

  fix(rclone): re-encode public key SPKI->PKCS1 for the Filen backend The @filen/sdk stores publicKey as SPKI/PKIX DER, but rclone's native Filen backend parses public_key with Go's x509.ParsePKCS1PublicKey (filen-sdk-go v0.0.39 crypto.go:461, the version rclone v1.74.3 pins). Without conversion, INTERNAL-mode auth fails at filesystem creation ('failed to parse public key, use ParsePKIXPublicKey instead'). config.ts now re-encodes the public key SPKI->PKCS1; the private key is already PKCS#8 (ParsePKCS8PrivateKey) and stays raw. Source-verified against the exact pinned versions that master_keys.join('|') is correct for auth v2 (per-element NewMasterKey) AND v3 (single DEK hex via MakeEncryptionKeyFromStr), and the obscure key + algorithm match. Validated end-to-end against a real account: rclone about/lsd authenticate via the production writeRcloneConfig path on macOS arm64.