v0.12.1

Downloads

• Windows: CypherrumSetup-0.12.1.exe (NSIS installer, includes Dokany driver) or Cypherrum-Windows-Portable-0.12.1.zip (portable, no install)
• Linux: cypherrum_0.12.1_amd64.deb (Ubuntu/Debian/KDE Neon), cypherrum-0.12.1-1.x86_64.rpm (Fedora/RHEL/openSUSE), or Cypherrum-Linux-Portable-0.12.1.tar.gz (portable)
• macOS: Cypherrum-0.12.1.dmg (Intel + Apple Silicon)

Verify

Checksums in SHA256SUMS-0.12.1 (ed25519 signature in SHA256SUMS.sig).

Release notes

Tooling and documentation patch. No runtime or wire-format changes since
v0.12.0 — upgrading is risk-free, and v0.11.x shares continue to mount
unchanged.

Added

• cypherrum.com/changelog — full release history on the website, with
  per-version anchors for deep-linking.
• Public release-notes mirror — every release's notes are now mirrored
  to RELEASE-NOTES.md in this repository.
• Inlined release notes on GitHub — release pages now contain the
  version notes inline; no click-through required.
• Download-page navigation — the "Changelog" and "All releases" cards
  on cypherrum.com/download now point at public destinations.

Changed

• Dokany is the documented default Windows mount path. The installer
  bundles the Dokany driver. The portable-zip README, the project README,
  and the User Guide install + troubleshooting sections all reflect this.

Release pipeline

• cypherrum.com/download auto-refreshes after every release, so the
  download buttons always serve the latest version within minutes of
  publish.

---

Full release notes → · GitHub mirror

v0.12.0

Downloads

• Windows: CypherrumSetup-0.12.0.exe (NSIS installer) or Cypherrum-Windows-Portable-0.12.0.zip (portable)
• Linux: cypherrum_0.12.0_amd64.deb (Ubuntu/Debian), cypherrum-0.12.0-1.x86_64.rpm (Fedora/RHEL), or Cypherrum-Linux-Portable-0.12.0.tar.gz (portable)
• macOS: Cypherrum-0.12.0.dmg (Intel + Apple Silicon)

Verify

Checksums in SHA256SUMS-0.12.0.

Release notes

Cypherrum's mesh sharing is now post-quantum by default. Vault keys
exchanged between contacts are wrapped with ML-KEM-768 (NIST FIPS 203),
protecting against future "harvest-now, decrypt-later" attacks on
network-borne share material.

Added

• Post-quantum mesh share envelopes. Vault member keys are wrapped
  with ML-KEM-768 across both supported share paths:
  • QR-paired contacts: the pairing code carries the recipient's
    post-quantum public key, so the share is wrapped immediately on
    pairing.
  • Invite-link contacts: the joiner posts its public key through the
    relay inbox, the inviter wraps the share and returns it — neither
    party needs to be online at the same time.
• Per-device post-quantum keypair. Created automatically on first
  service launch and stored alongside the device identity key.
• Forward-compatible inbox protocol. New message types carry the
  post-quantum bootstrap; clients ignore unrecognized types so future
  protocol additions don't break older versions.

Compatibility

• Existing v0.11.x shares mount unchanged. No migration is required;
  classical share entries continue to work indefinitely.

Known limitations

• Pairing-code QR is denser — best scanned at ~50 cm distance
  (Version 30 QR). Older phone cameras may need to back up slightly.

---

Full release notes → · GitHub mirror

v0.11.1

Downloads

• Windows: CypherrumSetup-0.11.1.exe (NSIS installer) or Cypherrum-Windows-Portable-0.11.1.zip (portable)
• Linux: cypherrum_0.11.1_amd64.deb (Ubuntu/Debian), cypherrum-0.11.1-1.x86_64.rpm (Fedora/RHEL), or Cypherrum-Linux-Portable-0.11.1.tar.gz (portable)
• macOS: Cypherrum-0.11.1.dmg (Intel + Apple Silicon)

Verify

Checksums in SHA256SUMS-0.11.1.

Release notes

First Cypherrum build whose Windows executables and installer are
Authenticode-signed by Logiqum Korlátolt Felelősségű Társaság.
Users will see Verified publisher: Logiqum Korlátolt Felelősségű Társaság in UAC prompts and Properties → Digital Signatures, and
SmartScreen warnings will diminish as the publisher's reputation
accrues (multi-week curve per Microsoft's post-2024 model).

Added

• Authenticode signing for every Windows artifact — cypherrum.exe,
  cypherrum-service.exe, the test binary, and the NSIS installer.
  Signatures are RFC3161-timestamped, so they remain valid after the
  underlying signing certificate rotates.

Fixed

• No more console-window flash on service start. Cypherrum's
  background service is now built in the GUI subsystem; non-launcher
  invocations (login auto-start, post-install hook, manual launch) no
  longer briefly show a console window.

---

Full release notes → · GitHub mirror

v0.11.0

Downloads

• Windows: CypherrumSetup-0.11.0.exe (NSIS installer) or Cypherrum-Windows-Portable-0.11.0.zip (portable)
• Linux: cypherrum_0.11.0_amd64.deb (Ubuntu/Debian), cypherrum-0.11.0-1.x86_64.rpm (Fedora/RHEL), or Cypherrum-Linux-Portable-0.11.0.tar.gz (portable)
• macOS: Cypherrum-0.11.0.dmg (Intel + Apple Silicon)

Verify

Checksums in SHA256SUMS-0.11.0.

Release notes

The mesh-bidirectional pass. Closes the joiner→inviter instant-
push gap that motivated the 5s polling band-aid in the 0.10.x
patch series, flips background-sync-while-locked to default-on
so set-and-forget Just Works after invite-accept, and bundles a
toolchain bump that closes two stdlib/HTTP2 vulnerabilities
(GO-2026-4971, GO-2026-4918). Also lands the dormant Azure
Trusted Signing pipeline that activates as soon as identity
validation completes (D-U-N-S 30-233-7716 received 2026-05-13).

Added

• Joiner-side InviterPushRoute. Invite payload now carries
  the inviter's relay-inbox device-identity fingerprint
  (separate from OwnerFingerprint, which is the TLS peer-cert
  fp). On invite accept the joiner persists this as
  VaultConfig.InviterPushRoute (a new, dedicated field — not
  in Members[], since that would flip the joiner's peer-server
  auth gate from open to closed and break the existing
  inviter-pulls-from-joiner direction). meshPusher.flush then
  routes vault.updated through to the inviter via the relay
  inbox. Joiner→inviter instant push works end-to-end. Backward-
  compatible: pre-0.11.0 invites lack the new fields, and
  joiners on those invites fall back to the periodic sync.
• Dormant Trusted Signing pipeline. New
  scripts/sign-windows-via-skymount.sh and
  scripts/ts-metadata.json.example. Documented end-to-end in
  docs/CODE-SIGNING-POLICY.md including the chosen identity
  (Logiqum Kft., D-U-N-S 30-233-7716, EU VAT HU33020983) and
  the SmartScreen reality (no EV bypass since March 2024,
  reputation accrues identically across cert tiers).

Changed

• MeshSyncWhileLocked default flipped from false to true.
  Pre-0.11.0 vault configs with the field unset get the new
  default; explicit opt-out via Settings is still honored.
  Joiner background sync now works the moment an invite is
  accepted, without the user having to discover a settings
  toggle. Memberkey persists in libsecret/Keychain/
  Credential Manager while locked — the security trade-off
  is documented in internal/config/config.go.
• Go toolchain bumped to 1.25.10 (was 1.25.9) and
  golang.org/x/net to v0.53.0 (was v0.52.0). Closes:
  • GO-2026-4971 — Windows net.Dial/LookupPort NUL-byte
    panic. Reachable from mesh.Connect,
    mesh.RelayClient.TurnConnect, and discovery.
  • GO-2026-4918 — HTTP/2 infinite loop on bad
    SETTINGS_MAX_FRAME_SIZE. Reachable from
    update.DownloadVerified, mesh.InboxClient.Push/Poll,
    and the E2E HTTP path.
• scripts/release.sh now syncs internal/version/VERSION
  alongside the root VERSION so
  TestEmbeddedVersionMatchesRootVERSION doesn't fail
  immediately after a version bump.

Fixed

(Inherited from the 0.10.3-0.10.13 in-session fix series; this
release tags them publicly.)

• Self-sync loop on cinema-win where the relay's /peers
  endpoint included the host's own peer in the fallback list.
  syncVaultNow now reads mesh.status and filters self.
• Tray status icons not showing on Windows: switched to BMP-
  DIB ICO container so Win32 LoadImage accepts the bytes
  without an .ico extension hint. Added iconShown guard so
  the first poll triggers SetIcon even when the computed
  state equals the zero-valued default.
• Tray icon disappearing on Linux after switching to
  energye/systray — needed RunWithExternalLoop() +
  explicit start() to register the SNI on D-Bus.
• Quit doesn't quit on Linux/Windows: OnBeforeClose
  unconditionally hid to tray; now respects
  bridge.IsQuitting().
• "Cannot start cypherrum after Quit; second launch works":
  stale singleton PID file lingered after hard exit + PID
  recycling caused false-positive "already running".
  cleanupSingleInstance now defers + reads /proc/<pid>/comm
  to verify the PID is actually a cypherrum process.
• WebView2 "we couldn't create the data directory" dialog:
  NSIS installer no longer auto-launches cypherrum.exe from
  the SYSTEM-context post-install step. The -Launch section
  was the root cause; pinning WebviewUserDataPath to
  %APPDATA%\Cypherrum\WebView2 is a defense-in-depth.
• Explorer not auto-refreshing after mesh sync on Windows:
  NotifyPath was using / separators, which the NT kernel
  rejects. Now uses \\ on Windows + walks every directory
  for per-dir shell notify.
• Tray sync activity invisible: sync completes in <100ms on
  LAN, tray polls every 2s. markSyncStart/markSyncEnd now
  bumps MarkVaultDirty for an 8-second decay window so the
  status disc visibly transitions.
• 60s sync polling too slow for joiner→inviter direction.
  Dropped to 5s as a stopgap; fixed properly via
  InviterPushRoute instant push (see Added).
• Tray single-click on Linux: now toggles window visibility
  (hide if visible, show + focus if hidden).
• Service shutdown race: shutdownService now polls the
  socket up to 8s instead of a fixed 500ms sleep, fixing the
  "second launch works" race where the new instance raced an
  in-flight drain.

---

Full changelog → · GitHub mirror

v0.10.2

Downloads

• Windows: CypherrumSetup-0.10.2.exe (NSIS installer) or Cypherrum-Windows-Portable-0.10.2.zip (portable)
• Linux: cypherrum_0.10.2_amd64.deb (Ubuntu/Debian), cypherrum-0.10.2-1.x86_64.rpm (Fedora/RHEL), or Cypherrum-Linux-Portable-0.10.2.tar.gz (portable)
• macOS: Cypherrum-0.10.2.dmg (Intel + Apple Silicon)

Verify

Checksums in SHA256SUMS-0.10.2.

Release notes

The mesh-sync correctness pass. Closes the silent-data-loss
window that opened any time two peers edited the same file
between sync rounds, and ships symmetric "share/pull while
locked" so a user who sets up sync once doesn't have to remember
to keep their vault unlocked for it to keep working.

Fixed

• Silent overwrite on concurrent edits. Pre-fix, if peer A
  and peer B both edited the same file before a sync round, the
  puller's local edit was clobbered without warning — Sync()
  passed base=nil to SyncWithConflicts, so DiffWithBase
  fell into the "no base, remote wins" branch. Sync() now
  loads .manifest-base.json (the snapshot from the last
  successful sync), 3-way-diffs against it, and routes
  both-sides-changed entries to the conflict-copy path that
  preserves the local file untouched and saves the remote bytes
  under a (conflict from <peerFP[:8]> <ts>) filename. After
  each successful sync, the post-apply local manifest is saved
  as the new base.
• Orange-on-orange tray badge that rendered invisibly on the
  conflict-pending state — base disc and badge dot were both
  orange. Conflict-pending now uses a solid orange disc, no
  inner badge.

Added

• Conflict files surface in the mounted drive. After a sync
  conflict, the encrypted directory metadata gets a sibling
  (conflict from <fp> <ts>) file. The vault loader now scans
  for those siblings in every d/<a>/ it reads, decrypts each
  with the same dir key (peers share the derivation), and grafts
  any colliding entries into the in-memory tree under suffixed
  names. The user sees report.docx and
  report (conflict from f78fffbf 2026-05-08 14-23).docx side
  by side in the FUSE/Dokany/WebDAV mount instead of having the
  remote bytes sit as orphan data.
• Full conflict resolution — IPC, CLI, GUI. New vault
  operation ResolveConflict(parentPath, conflictName, action, keepBothName) with three actions:
  • keep_local — discard peer's bytes, free their chunks.
  • keep_remote — canonical adopts peer's FileID/Size/
    ModTime; old local chunks are freed.
  • keep_both — promote peer's version to a new canonical
    entry under a chosen name (or auto:
    <stem>.from-<peerShort>.<ext>).
    Exposed as vault.resolveConflict + vault.listConflicts
    IPC, cypherrum-admin resolve / cypherrum-admin list-conflicts for terminal use, and a stepped Svelte
    ConflictDialog opened from the (now clickable) red conflict
    badge on each vault card.
• Mesh sync while locked — joiner side. New per-vault
  MeshSyncWhileLocked opt-in (default OFF) persists this
  device's mesh memberKey to the OS keystore (libsecret /
  Keychain / Credential Manager) under a separate Cypherrum- MemberKey service so the password keyring and member-key
  keyring don't collide. With it enabled, the GUI's 60s sync
  loop authenticates against the inviter's peer server using
  the keystore-cached key whenever the vault is locked — pulls
  keep working without the user having to unlock first.
  Disabling the toggle wipes the keystore entry; removing the
  vault wipes both the cached memberKey and any saved
  password.
• Tray conflict-pending state. Orange disc on the tray icon
  whenever any vault has unresolved sync conflicts. State
  hierarchy: Sync > Offline > Connecting > Conflict > Inbox >
  Idle. Aggregate count is computed once per GetVaults and
  published to a package-level atomic the tray's poll reads.

Changed

• MeshConflictCount now matches both the legacy
  .conflict-<unix> suffix and the new (conflict from ...)
  form so the badge counts post-2026-05-08 conflicts correctly.
• RemoveVault wipes saved password + cached memberKey from
  the OS keystore so removing a vault leaves no credential
  trail.
• vault.list IPC response now includes mesh_sync_while_locked
  and is_member so the GUI knows whether to show the
  sync-while-locked toggle and what state to render.
• 22 i18n files translated for the new conflict.* and
  vault_settings.sync_while_locked* strings.

Tests

• TestSync_ConflictPreservesLocal (mesh): both peers edit, local
  stays, conflict bytes preserved with peer-fp-tagged suffix.
• TestSync_RemoteOnlyChangePropagates / TestSync_LocalOnlyChangeStays:
  non-conflict paths still clean.
• TestVault_LoadConflictSiblings_GraftsCollidingEntries: full
  on-disk roundtrip — encrypted conflict sibling decrypted +
  surfaced in tree under suffixed name.
• TestVault_LoadConflictSiblings_NonCollidingEntriesSkipped:
  pins the "only collide → surface" policy.
• TestSuffixedConflictName_EdgeCases: filename composition for
  report.docx, file.tar.gz, README, .hidden,
  trailing..
• TestVault_ResolveConflict_KeepLocal / _KeepRemote /
  _KeepBoth / _KeepBoth_DefaultName / _RejectsLockedVault:
  end-to-end resolve actions including chunk reclaim + locked-
  vault refusal.
• TestSplitConflictName: parser pins.
• TestMemberKey_RoundTrip / _DistinctFromPassword: keystore
  Save/Load/Delete round-trip + invariant that member-key and
  password keyrings don't collide on a delete of one.
• TestConflictCount_Atomic: aggregate counter clamps negatives,
  same contract as InboxCount.

---

Full changelog → · GitHub mirror

v0.10.0

Downloads

• Windows: CypherrumSetup-0.10.0.exe (NSIS installer) or Cypherrum-Windows-Portable-0.10.0.zip (portable)
• Linux: cypherrum_0.10.0_amd64.deb (Ubuntu/Debian), cypherrum-0.10.0-1.x86_64.rpm (Fedora/RHEL), or Cypherrum-Linux-Portable-0.10.0.tar.gz (portable)
• macOS: Cypherrum-0.10.0.dmg (Intel + Apple Silicon)

Verify

Checksums in SHA256SUMS-0.10.0.

Release notes

Mesh sharing is no longer tied to GUI lifecycle.

Added

• VaultConfig.MeshAlwaysOn flag, default true. Encodes
  the per-vault preference to keep the peer server + relay
  announce running while the vault is locked or the GUI is
  closed. Pre-0.10.0 vaults are treated as true (sensible
  default; users can opt out via vault settings going forward).
• vault.setMeshAlwaysOn IPC method + Bridge.SetVaultMeshAlwaysOn
  surface on the GUI side. Toggle wiring will land in the next UI
  release; backend + persistence ship in this one.
• Service-side mesh boot. New cmd/cypherrum-service/mesh_boot.go
  scans the config at service startup and registers peer-server
  • announce for every vault where MeshHash != "" && MeshAlwaysOn.
    Mirrors what the GUI's bridge_mesh.go did, but lives in the
    cypherrum-service process so closing the Cypherrum window no
    longer kills the network presence.
• vaultListEntry.IsMesh + MeshAlwaysOn in the vault.list
  response so the GUI can render the existing Mesh badge and
  the upcoming "keep syncing when locked" toggle.
• meshBoot.unshareVault + meshBoot.stop for clean teardown
  on vault removal and service shutdown.

Changed

• Network presence is decoupled from vault unlock state.
  Pre-0.10.0: peer server only ran for currently-unlocked
  vaults whose unlock path triggered ensureMeshShareForVault.
  Now: service auto-starts the peer server + announce for any
  shared vault at boot, independent of unlock. The actual
  joiner-side PULL still requires unlock (memberKey derivation
  needs the master key), but the SHARER side serves continuously
  — peers can pull from us while OUR vault is locked.
• Service shutdown handler now calls meshBoot.stop() before
  vm.lockAll, so an in-flight announce can't fire mid-shutdown.
• handleRegister (vault.register, the join path) now
  immediately calls meshBoot.registerVault after persisting
  the new entry. New invite-joined vaults enter mesh state
  without waiting for unlock.

Architectural status / what's next

• 0.10.0 ships the service-side ownership — closing the GUI
  window no longer kills mesh.
• Still pending in subsequent releases:
  • GUI Quit dialog with "Stop background sync" checkbox
  • Tray + taskbar status overlays (off / starting / idle /
    syncing / stale + add-ons for inbox / peers offline /
    update / license)
  • loginctl enable-linger + systemd-user / launchd /
    Task-Scheduler-at-logon wiring so the service auto-starts
    after reboot without the GUI being launched
  • Joiner-side memberKey persistence so PULL also works while
    locked (closes the "shareable while locked" gap fully)

---

Full changelog → · GitHub mirror

v0.9.7

Downloads

• Windows: CypherrumSetup-0.9.7.exe (NSIS installer) or Cypherrum-Windows-Portable-0.9.7.zip (portable)
• Linux: cypherrum_0.9.7_amd64.deb (Ubuntu/Debian), cypherrum-0.9.7-1.x86_64.rpm (Fedora/RHEL), or Cypherrum-Linux-Portable-0.9.7.tar.gz (portable)
• macOS: Cypherrum-0.9.7.dmg (Intel + Apple Silicon)

Verify

Checksums in SHA256SUMS-0.9.7.

Release notes

Fixed

• ensureMeshShareForVault skipped the relay /announce
  call. After 0.9.6, both sides logged
  [mesh] vault X registered for sync hash=Y with matching
  hashes, but relay /peers?vault=Y still returned empty. The
  reason: only MeshStartSharing (the explicit-share user
  action) called b.announceToRelay. The unlock-time
  registration set up the local peer server + LAN UDP
  discovery but never told the relay we existed. Cross-LAN
  peers (or LANs where UDP broadcast is blocked) couldn't
  find each other.
• Now ensureMeshShareForVault calls announceToRelay after
  registering the local state. Re-announce every 3 min is
  handled inside announceToRelay.

---

Full changelog → · GitHub mirror

v0.9.6

Downloads

• Windows: CypherrumSetup-0.9.6.exe (NSIS installer) or Cypherrum-Windows-Portable-0.9.6.zip (portable)
• Linux: cypherrum_0.9.6_amd64.deb (Ubuntu/Debian), cypherrum-0.9.6-1.x86_64.rpm (Fedora/RHEL), or Cypherrum-Linux-Portable-0.9.6.tar.gz (portable)
• macOS: Cypherrum-0.9.6.dmg (Intel + Apple Silicon)

Verify

Checksums in SHA256SUMS-0.9.6.

Release notes

Fixed

• THE actual root-cause of "no sync". mesh.VaultHash is
  computed from name + ":" + encrypted_path — but the inviter's
  name+path differs from the joiner's, so each side computed a
  COMPLETELY DIFFERENT hash. The relay's peer discovery is
  hash-keyed; the two ends never matched up. Cinema-win was
  announcing 815997fe046ad428... for y:C:\temp\y while
  blackhawk was looking up 1eab007aed752790... for
  oncinema:/home/akos/Downloads/oncinema. Sync was
  architecturally impossible after the initial join.
• Fix: persist the cross-peer-stable hash on
  VaultConfig.MeshHash. Set on:
  • MeshStartSharing (first share captures local hash)
  • MeshJoinVault via vault.register (joiner stores the
    inviter's hash from the invite payload)
  • new vault.setMeshHash IPC method (admin tool path for
    already-joined vaults from before this work)
• ensureMeshShareForVault now reads vc.MeshHash first,
  falling back to compute-from-name+path only for vaults that
  predate the field. New shares always have it; freshly-joined
  vaults always have it.
• Switched the unlock-path mesh logging from appLog.Add
  (in-memory ring buffer) to log.Printf (gui.log on disk),
  because the previous logging was invisible to ad-hoc debugging.

Added

• vault.setMeshHash(name, hash) IPC method — admin helper for
  patching existing vaults that don't have a hash persisted.
  Required for the user's oncinema vault on blackhawk to
  actually sync after upgrade.

---

Full changelog → · GitHub mirror

v0.9.5

Downloads

• Windows: CypherrumSetup-0.9.5.exe (NSIS installer) or Cypherrum-Windows-Portable-0.9.5.zip (portable)
• Linux: cypherrum_0.9.5_amd64.deb (Ubuntu/Debian), cypherrum-0.9.5-1.x86_64.rpm (Fedora/RHEL), or Cypherrum-Linux-Portable-0.9.5.tar.gz (portable)
• macOS: Cypherrum-0.9.5.dmg (Intel + Apple Silicon)

Verify

Checksums in SHA256SUMS-0.9.5.

Release notes

Fixed

• ensureMeshShareForVault was filtering out vaults that
  needed it most. The 0.9.4 gate was
  len(Members) > 0 || OwnMember != nil — but the user's
  oncinema vault on blackhawk had both empty (joined before
  the OwnMember persistence work in #44). Those vaults were
  silently treated as local-only and never entered the sync
  loop. Now we register every unlocked vault. Cost is
  basically free: peer server is a singleton, the discovery
  announce is a small UDP broadcast, and the 60s sync loop is
  a no-op for vaults that no peer announces. Local-only
  vaults pay essentially nothing.
• Discovered post-0.9.4 deploy when the user did the
  prescribed lock+unlock cycle on blackhawk and still saw no
  sync — gui.log had no mesh peer server started line,
  proving ensureMeshShareForVault had short-circuited at
  the relevance gate.

---

Full changelog → · GitHub mirror

v0.9.4

Downloads

• Windows: CypherrumSetup-0.9.4.exe (NSIS installer) or Cypherrum-Windows-Portable-0.9.4.zip (portable)
• Linux: cypherrum_0.9.4_amd64.deb (Ubuntu/Debian), cypherrum-0.9.4-1.x86_64.rpm (Fedora/RHEL), or Cypherrum-Linux-Portable-0.9.4.tar.gz (portable)
• macOS: Cypherrum-0.9.4.dmg (Intel + Apple Silicon)

Verify

Checksums in SHA256SUMS-0.9.4.

Release notes

Two real bugs reported by the user during overnight verification.

Fixed

• Mesh sync didn't trigger after re-install / re-unlock.
  meshShared map was only populated at JOIN time
  (AcceptMeshShare), so after the user installed a fresh build
  and just unlocked an already-joined vault, the joiner-side
  background sync loop saw an empty map and never pulled. New
  helper Bridge.ensureMeshShareForVault registers the vault in
  meshShared AND lazily starts the joiner-side peer server +
  discovery, called from every unlock path (password,
  saved-password, member-key). Mesh-relevance check
  (len(Members) > 0 || OwnMember != nil) keeps local-only
  vaults out of mesh state. Idempotent, so a join immediately
  followed by unlock doesn't double-register.
• "Open vault" button opened the encrypted folder, not the
  mount. The frontend's openFolder used vault.drive || vault.path — on Linux/macOS where there's no drive letter,
  it fell back to vault.path which is the encrypted-chunks
  directory. New MountPath field on the vault.list response
  carries the real mount root (T:\\ on Windows,
  ~/Vaults/<name> on Linux/macOS); openFolder now prefers it.
  Also added MountPath to vaultState, set at unlock, exposed
  via vault.list. Falls back to drive letter then encrypted
  path so locked vaults still open the on-disk dir if the user
  wants to inspect chunks.

---

Full changelog → · GitHub mirror