Repository navigation
feat(all): improve sync reliability, client settings, and server session management - #182
Merged
Merged
Conversation
Server - Fix NPE in CustomAuthenticationSuccessHandler / setLoginDetails when ipDetails is null (first login from new IP). - New endpoint /admin/online-users plus OnlineUsersService that tracks live WebSocket users in both P2S (STOMP event listener) and P2P (P2PWebSocketHandler.getOnlineUsers) modes. - Add CC_P2P_SIGNALING_RATE_LIMIT_PER_SEC (default -1 = off): per-session token-bucket rate limiter on /p2psignaling messages. - Add CC_CAPTCHA_DIFFICULTY_PERCENT (default 100 = current behavior): scale noise lines, distortion, and background from 0..100. - Advance page: searchable, sortable (per column), paginated tables for user details, online users, and BFA tracker. - Admin Panel (index.html): search box, sortable headers, pager for the users table. - Bump server version to 3.3.0. - added actual endpoint to sort columns and ui update in server to add pagination and column resize horizontally. Desktop (Python) - Frame.unmarshall_single: tolerate malformed STOMP frames (return None instead of crashing the receive thread). - request_manager.login: clean error if the login page has no CSRF input (e.g. wrong server URL). - STOMP and P2P signaling reconnect: exponential backoff + jitter capped at 120s, reset on success and manual reconnect. - P2P fragment reassembly: drop partial buffers older than 60s to avoid memory leak when a peer drops the final fragment. - Single-instance lock: write PID to the lock file, sweep stale lock files on startup, register atexit + signal handlers for cleanup. - Tray (GUI and CLI): read-only "Version v3.3.0" entry. - Login (GUI and CLI): drop "(optional)" suffix from SSL CA bundle label. - Bump desktop version to 3.3.0. Mobile (React Native + Kotlin) - Foreground service: 5s timeout around stompClient.deactivate() so a stuck close cannot hang the service. - P2P fragment reassembly: TTL on partial buffers (60s) matching desktop. - Small "v3.3.0" version line under the footer on both screens. - Bump app version to 3.3.0.
- Add Python 3.14-compatible dependencies and xxhash 4.x support. - Retry failed STOMP/P2P connections with cancellable capped backoff. - Move macOS clipboard and tray operations to the main thread. - Preserve CA data for reconnects after temporary bundle cleanup. - Validate STOMP handshakes and fix UTF-8/multiline framing. - Preserve Unicode across P2P fragments and expire idle partial transfers.
Replace exponential backoff with a fixed 10-second retry delay and ±25% jitter for desktop STOMP and P2P signaling connections. - Retry immediately after detecting a disconnect. - Wait 7.5–12.5 seconds between subsequent failed attempts. - Make manual reconnect interrupt pending waits. - Preserve cancellable retries and serialized connection attempts. - Reset retry state on success and cancel retries on disconnect/logout.
Add CC_SESSION_PERSISTENCE_ENABLED, defaulting to false, to preserve login sessions across server restarts using Spring Session JDBC. - Initialize session tables for H2 and PostgreSQL when enabled - Preserve JSESSIONID compatibility with existing clients - Exclude password hashes and service references from saved principals - Clear saved sessions when starting with persistence disabled - Revoke sessions on password changes and account updates - Add per-user and all-user revocation controls to the admin panel - Disconnect local STOMP and P2P signaling sockets on revocation - Add browser monitoring retries with exponential backoff - Stop retries and redirect to login when authentication expires
Use Tk's main loop with pystray's detached mode so native macOS quit requests are processed without requiring tray interaction. - Route system quit, tray Quit, and Logoff and Quit through shared cleanup - Run network cleanup on a worker while keeping the UI responsive - Release pasteboard objects and destroy Tk on the main thread - Bound P2P cleanup, cancel pending tasks, and close its event loop - Add a 15-second forced-exit fallback for stuck shutdowns
- Add inline Import, Replace, and Remove controls in Extra Config. - Validate imported PEM/CRT bundles and save certificates locally after login. - Trust imported certificates alongside system CAs for the configured server hostname. - Apply custom trust to HTTPS/WSS, including background connections. - Preserve hostname verification and allow HTTP/WS with a bundle selected. - Document SSL CA bundle support in the shared Desktop/Mobile settings section.
Restore AppKit as the tray event loop to avoid the Tk/PyObjC crash. Handle quit Apple events, logout/shutdown notifications, and SIGINT through the shared cleanup path without requiring a tray click. Preserve asynchronous cleanup and the shutdown watchdog, restore the previous SIGINT handler on exit, and initialize shutdown state early.
Save device preferences immediately in desktop and Android clients, while keeping connection and encryption settings tied to successful login. Clear saved credentials when password storage is disabled, and start or stop Android periodic checks when toggled. Prevent desktop autosaves from persisting login drafts and serialize Android preference writes to preserve rapid changes.
- Clarify login and advanced-setting labels across desktop and Android - Move Android connection notifications outside advanced settings - Add blue question marks to complex Android settings with contextual help - Allow Android help dialogs to close by tapping outside - Refine desktop hover help with relevant notes and examples - Add desktop folder and CA bundle pickers with compact trash buttons - Keep path controls together without reducing other input widths - Update README wording and preserve the renamed section’s old anchor
- Check for updates at startup and every 24 hours on desktop and Android. - Retry failed checks after one hour without blocking the app. - Enable update alerts by default, with a toggle at the bottom of advanced settings. - Show foreground popups, background notifications, or CLI terminal messages. - Alert once per version per session and prevent duplicate Android checks. - Show updates only when the published version is newer, including on the server webpage. - Share Android’s version constant between the UI and service, and update release CI.
Document authentication, HTTP endpoints, STOMP/WebRTC protocols, encryption, payload formats, fragmentation, and recovery. Add examples, test vectors, and interoperability checks, and update the README link.
Require prebuilt cryptography wheels to avoid shared OpenSSL conflicts in PyInstaller bundles. Reject dynamically linked cryptography builds during macOS packaging. Build with --clean and disable pip's dependency cache in CI. Run a headless self-test inside the packaged executable on Intel and Apple Silicon before publishing, with a 5-minute timeout. The self-test checks native dependency imports, certificate generation, and P2P data-channel offer creation.
- Preserve the lock file across launches and shutdowns. - Acquire the lock before clearing or updating the stored PID. - Close failed lock handles without affecting the running instance. - Remove PID-based stale-file deletion and the "Run anyway" bypass. - Report only lock contention as an already-running instance.
Sathvik-Rao
changed the title
This was referenced Oct 25, 2026
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Improve clipboard sync reliability, simplify client settings, and expand
server administration across all platforms.
Desktop and Android
abandoned fragment buffers.
Desktop reliability and packaging
Server and web dashboard
Compatibility and upgrade notes
with persistence disabled clears previously saved sessions.
instead of HTTP 400.