Ship client-side telemetry, crash capture, and bug-report assembly behind a
user opt-in, with NoOp transport until Cloudflare is wired. Builds can set
vnidrop.diagnostics.included=false to omit the Share-diagnostics UI and
disable the telemetry/crash auto-upload stack while keeping bug reports.
Tighten approve-endpoint to active shares with TTL sessions, reject non-file
FDs, lower default ticket/approval/size caps, show endpoint IDs and Public-mode
warnings, harden Android receive path checks, and run cargo-audit in CI.
Close high-severity findings from the security review: default-deny blob
gets for unmapped hashes, map collection members for ACL, fail closed on
unknown access modes, require vnd1 tickets only, redact tickets from events,
exclude Android app-data backups, and tighten secret-file creation.
Make agent instructions imperative and command-first, add nested
crates/vnidrop and shared guides, and keep compose-skill as the UI
source of truth with VniDrop-specific overrides.
Capture stack map, hard rules, compose-skill usage, sparse comment
policy, testing/CI commands, git/PR conventions, and anti-patterns so
agents adapt to VniDrop without rediscovering them.
Break the ~1.7k-line runtime orchestration unit into facade, share,
receive, lifecycle, and provider modules so future send/receive work
stays reviewable. Behavior and UniFFI surface are unchanged.
Signal transfer cancel synchronously before any runtime await, drive
API calls via Handle::block_on so concurrent cancel cannot deadlock a
receive, and rewrite the gated output-sink cancel test to avoid the
slow multi-megabyte write loop that starved CI.
Attribute provider transfer progress to each remote endpoint so the
receivers panel and catalog can show per-peer send bars for multi-file
collections while a share is active.
Add folder pickers on Android, iOS, and desktop. Desktop and iOS walk
directory paths in Rust; Android expands SAF trees to per-file FDs
with relative collection paths because directory FDs are unsupported.
Allow selecting multiple files on Android, desktop, and iOS and share them
as one transfer through the core multi-source path. Update the composer UI
for multi-file review, hide unfinished iOS receive methods, and surface
refusal reasons on the receivers list.
Remove the transfer-details progress bar and Stop sharing control now that
delete already revokes a share. Fix preferences username typing by keeping
local draft state and debouncing DataStore writes so trim/races no longer
fight the caret.
Make the transfer loop feel live: parse real core progress payloads, show
progress on send/receive surfaces, allow cancel/stop, retry failed receives,
and fix delivery-phase events so receiver completion updates the UI.
Add a path-filtered Shared KMP workflow so receive/send ViewModel and
Compose foundation regressions fail CI. Runs on macOS arm64 because host
Rust embedding for Linux JVM is disabled in the Gradle cargo config.
Default Android receive destination is now the shared system Downloads
collection (like desktop), using MediaStore on API 29+ instead of
app-private storage. Legacy app-private defaults are promoted back to
public Downloads so existing installs pick up the fix.
Android emulated storage rejects hard-link commit even when canWrite()
reports success. Fall back to exclusive rename for publish, probe real
writes during folder validation, and label the default app downloads dir
clearly so it is not confused with shared system Downloads.
Tighten cold-open and in-app invitation handling so ticket acquisition is
stricter and less racey across hosts, and expand automated coverage for the
receive history and acquisition flow before merge.
