TetherBay 0.2.663
Get the update.

Highlights

• Formatted text is shared as formatted text — it had been arriving flat.

  Formatted text copied from spreadsheets, browsers, Gmail and Word now retains formatting in the tested cases. All fifteen recorded clipboard samples are accepted, compared with eight before the change. Content that cannot be preserved safely is still refused, including line breaks that depend only on CSS white-space rules; preformatted text remains supported.

• A file you send can carry a comment — and for a while it could not.

  File sends to a device or contact can now include a comment. The draft survives recipient changes. The limit is 4096 UTF-16 units; an over-limit comment is rejected before upload with its actual length shown, rather than silently truncated. The comment box is hidden when the relay does not support file-notes-v1.

• A download link can carry a comment too.

  The public download page shows it above the download button, so a link sent on its own can say what it is.

Fixes

• Formatted clipboard text now survives the tested spreadsheet, browser, Gmail and Word copies: fifteen recorded samples are accepted, compared with eight before the change. The sanitizer preserves supported wrappers, tables and line breaks while continuing to reject hidden or unsafe content. It also produces consistent results when content is checked again. Cases that depended only on CSS white-space rules remain unsupported rather than being silently reflowed; <pre> is unaffected.
• File sends to a device or contact can now include a comment. Previously, the sending code omitted it, so comments were discarded without a warning. Draft comments survive recipient changes. The limit is 4096 UTF-16 units; over-limit comments are rejected before upload with their actual length shown, rather than silently truncated. The comment box is hidden when the relay does not support file-notes-v1.
• Public download links can now carry a comment. The recipient sees it above the download button.
• Contact clipboard offers can now carry pictures up to 8 MB as canonical PNG. The relay must advertise contact-clipboard-images-v1, and recipients need a client that supports picture offers: older clients remain connected but reject this new format, while text offers still work. Spreadsheet copies that include both cells and a bitmap prefer the table text. Windows bitmap-only copies are no longer replaced with unrelated accompanying text, and cleared image snapshots cannot be sent as blank images.
• The Send screen now includes a comment editor, Replace for the selected file, Change for the recipient, collapsible destination counts, and pinned search and Create link controls. Scrolled destination rows no longer overlap Create link.
• Recall is now available for active contact clipboard offers. Its action and visibility checks previously disagreed, leaving the working control hidden. Offers that have already ended no longer show Recall.
• A macOS keychain denial no longer disables clipboard sync permanently. The refusal now expires so access can be tried again.
• A download that repeatedly fails validation is now recorded instead of being fetched indefinitely. The failure record expires when the conditions it depends on change, and the previously unreported failure path now reaches diagnostics.
• Deleting a synced folder’s root while TetherBay is running now pauses that folder instead of recreating it automatically. A folder you deliberately disabled remains disabled.
• Integrity-failure reports now identify the cause and provide an action. A permanently failing folder no longer appears with zero rows under the Errors filter.
• Waiting for a device now names the required device. Recovery and review screens also explain missing folder roots and unavailable lists, rather than showing misleading empty states or suggesting that a deleted folder can restart itself.
• Contacts now use consistent identity labels across the app, including when no email address is available. Email search and live language changes are preserved. The Check contact dialog includes the identity details needed to compare a safety code with the intended person.
• Background maintenance no longer clears the transfer readout on each pass. Deferred transfers keep their displayed progress instead of making the number disappear.
• On Linux, the app now reports when the start-at-login supervisor has exhausted its restart attempts. The failure is also recorded in diagnostics.
• Start over and Delete account now remove the account’s folder and clipboard encryption keys from the device’s protected store. Previously, cleanup removed the launcher-to-agent handoff cache but left the stored keys behind.
• A temporarily unavailable OS key store no longer marks a folder permanently unrecoverable. Previously, about 90 seconds of failed access, across three retries, could be mistaken for damaged encrypted data.
• File uploads and Transfers refreshes now remain tied to the account that started them. Signing out cancels the old work; a late completion no longer clears another account’s file selection or shows the previous account’s transfer details and errors.
• Copy Logs now copies the underlying log data even when the log panel is collapsed, raw or inactive. Previously, it could do nothing without showing an error.
• Failures when accepting or declining a contact clipboard offer remain visible. The next background refresh no longer erases the message immediately.
• A clipboard send now keeps control of the Send panel while it is uploading. An unrelated file transfer’s delivery check no longer re-enables Send over that upload.
• Missing translations on Sync Check, Plans and Transfers are now supplied. The affected Core catalog included 75 strings that had appeared in English; Russian was already complete.
• The launcher’s override catalogs now include missing Send translations. Seven languages were missing 92 of 236 keys and contained another 120–123 English values; German contained 49 English values. The missing next-step instructions are included too.
• Contact clipboard security checks now distinguish an unconfigured peer, an unreachable relay, a rotating identity and unreadable local security data. Each blocked notice offers Check again and explains the relevant next step. When no remote key is available, the dialog hides the code-comparison controls instead of allowing a comparison that cannot succeed.
• Clipboard items sent to one of your devices now expire only after an apply/skip decision or the delivery deadline, not merely because the recipient’s read position advanced. The default delivery window is 120 seconds and can be overridden by server configuration. Delivery status now reports the deadline and expiry. Once the window closes, the sender sees a terminal result without Retry; unconfirmed delivery is also recorded for diagnosis.
• Contact clipboard sends now include the multipart section length required by the relay. Previously, the shipping client omitted that header and every such request was rejected with HTTP 400 invalid_request before the relay read its encrypted content.
• Permanent clipboard-send failures no longer tell the user to retry while disabling Retry. Error messages now follow the relay’s retryability flag, while specifically explained errors keep their existing guidance.
• Closing Check contact now says verification was not completed. It no longer reports a code mismatch unless the user explicitly chose that result. Sending remains blocked until verification succeeds.
• Contact clipboard sends and security checks now record failure outcomes and error codes. Previously, several paths left no diagnostic record after a failure.
• Error reports now retain the explanatory message supplied alongside an exception. Previously, Bugsink received only the exception. Error grouping is unchanged.
• Retrying a clipboard publish with the same event ID no longer fails with HTTP 500 on PostgreSQL. The replay path now closes its database reader before committing the transaction.
• Production checks now include authenticated reads of contact clipboard offers and devices, including a subsequent offer page. Previously, health-only checks could pass while those features returned HTTP 503. These failures now fail the check. --traffic-token marks the test session as QA traffic; --no-authenticated-reads opts out.
• If a clipboard-enabled device prevents account clipboard encryption from becoming ready, the failure now names that device and tells you to update it or turn Clipboard off for it under Devices. Retry is hidden when that blocker is known. If no blocker can be identified and this device may still be waiting for its account key, the message and Retry remain available.
• Contact clipboard offers now load on PostgreSQL. An untyped empty paging parameter had made both incoming and sent-offer lists return HTTP 503, hiding offers and leaving Transfers partially refreshed. The query now includes typed cursor parameters only when needed. Six related server-query paths were corrected too.
• Unhandled contact clipboard server failures are now captured for diagnosis. Previously, conversion to a retryable HTTP 503 happened before error reporting, so a persistent fault could repeatedly suggest retrying without generating an issue.
• Send and Transfers now distinguish withdrawing one offer from removing every offer of a file. Recall reports ended offers and any remaining offers it can see; the sender’s history covers only the originating device. Terminal results refresh Transfers, upload errors retain the relay’s actual HTTP status, and filtered destination lists explain why no results appear. Leaving Send preserves the selected file, recipient and clipboard snapshot; leaving during a clipboard send reports its cancellation, and signing out clears the draft. Remote-access and folder-removal messages now fill in their values instead of displaying {0}. These changes address the findings recorded on 2026-09-14.
• Linux start-at-login now uses a per-user supervisor to relaunch TetherBay after an unexpected exit, with a bounded retry delay and restart budget. A deliberate Quit stops it. Older unsupervised entries are migrated on the next launch; missing or modified supervisor files are reported. Exhausted restart attempts are reported on the next launch too. This addresses the launcher crash recorded on 2026-09-14, which also stopped its folder-sync agents. macOS and Windows startup are unchanged.
• A pending clipboard item no longer blocks later items on the same device. An item sent to one device could keep returning after its read position had passed it, hiding newer items. That fix treated the read position as completion for the old item. The desktop still advances its position only after recording whether it applied or skipped the item.
• A clipboard item with an unavailable account key no longer blocks later items indefinitely. The app waits up to ten minutes for the key, then retires the item so the feed can continue.
• Infrastructure failures in contact clipboard sharing are now reported by both the app and relay. Previously, several failure paths recorded too little information to diagnose the problem. Input-validation failures remain separate.
• A share link that fails on your own machine no longer blames the server. When this device could not read or write the record that makes a link upload safe to retry, the app reported a server error code for a request it had never sent, and filed it alongside real relay outages. It now says that the link could not be prepared on this device, and is counted separately.
• Share-link download counts now use the caller address supplied by the trusted proxy. Previously, all recipients shared the proxy’s own address, so the count could advance only once per fifteen-minute window for everyone. Repeat requests from the same resolved address within a window still use one grant. View counts use the corrected address too.
• Blocking a contact from an incoming offer now confirms that the person was removed from Contacts, even if declining their file failed. The message still explains when the file remains listed.
• The share-link footnote now explains what the ten-download limit counts: download grants, not copies of the file. Repeat requests from the same network within fifteen minutes use one grant, so resumed transfers do not consume another. People sharing one gateway can also share a grant.
• Blocking someone from an incoming offer now says that they were also removed from Contacts. Blocking stops new sends and removes the contact; the message now explains both effects, as it already did when blocking from the contact card.
• A temporary refusal to send to a contact now expires after five minutes. Previously, the contact could remain unavailable in the picker even after the relationship was restored. A successful send still clears the refusal immediately. The picker’s message and enabled state now stay consistent during contact refreshes.
• After the app rejects a newly selected file, Send is disabled. Previously, selecting an oversized file, a folder or a file that had moved could clear the visible file card while leaving Send enabled for the earlier selection.
• Transfers now treats HTTP 204 from clipboard history as a successful empty result. With clipboard sharing off, this previously produced a persistent partial-refresh warning and hid the normal empty state. Genuine source failures are now also reported for diagnosis.
• Folder rows again show IN/OUT badges, including in narrow layouts. These badges distinguish files arriving on this device from files leaving it; the ownership label answers a different question.
• Companion devices can browse folders and fetch individual files again. A relay check had mistakenly denied them because they do not keep full folder copies; it also stopped collaborators without an explicit device setting. Access is now denied by this check only when the folder is explicitly disabled for that device.
• An upload refused by the relay remains pending. Previously, a retried upload could be counted as delivered, bringing progress to 100% while the file was still waiting.
• The confirmation for permanently deleting a recovery copy now expires after ten seconds, and the button shows that limit. Changing the app language also clears the pending confirmation, preventing a later click from deleting a copy without a visible warning.
• When a local-removal review contains more than 5,000 entries, it now reports how many you have reviewed and tells you to reopen the list for the remaining pages. Reviewing one page no longer promises that all notices will disappear.
• If the settings file cannot be read, the app now tries its saved previous copy. Previously, it could fall back to defaults and overwrite the device identity, server address and folder list on the next save.
• One bad timestamp no longer hides a folder's whole history. A single unreadable date in stored activity made the folder's file history fail to load entirely instead of showing the other events.
• Device-link and download-link descriptions now state their different limits. A device link adds one device; the previous text incorrectly used the email sign-in link’s ten-device allowance. The Send screen no longer calls a download link one-time: its ten-grant limit and fifteen-minute repeat-download window still apply.
• Blocking someone now says what it actually does. The confirmation promised "They can't send you files", but a file they had already offered stays in your Transfers list — blocking stops new sends, it does not retract an offer already made. It now says "anything new". The leftover offer costs you nothing: it is held against the *sender's* relay quota, never yours, and nothing reaches your disk unless you accept it.
• The relay now records when a contact block begins and clears that timestamp when the block is lifted. This records the start of the current block; it is not a history of past blocks. No user-visible behavior changes in this release.
• An older transfer’s delivery check no longer overwrites a newer failed send with a green success message or clears the file selected for retry. Delivery updates now apply only to the transfer currently shown in the Send panel.
• Folder creation now checks that the device has successfully created its encryption key before enabling encryption and reports a key-creation failure. Previously, it could mark a folder encrypted without a usable key and silently hold every upload. In the implementation described by this original fix, a failed key creation left encryption disabled.
• Blocking someone no longer erases their name from what you already exchanged. Transfer history took its labels from the list of people you may send to, so blocking somebody rewrote every past transfer with them into a raw account id like "user-1a2b3c4d". Blocking stops new sends; it no longer rewrites the record of old ones.
• The administrative contact route now returns HTTP 409 for a blocked account. Previously, it returned HTTP 200 with an identifier that did not refer to a stored contact.
• Blocking a contact now actually blocks them. The button was there and the relay had enforced the blocked state for weeks, but the app asked for it the wrong way and the request was refused every single time — with a message suggesting you try again, which could never work. Blocking works now, and if a relay ever does refuse it the app says so plainly instead of inviting you to retry.
• Accepting a file on one of your devices now clears its pending-transfer badge on your other devices. Previously, they could keep a badge pointing to an empty Transfers page until restart.
• A folder invitation now confirms which folder the recipient joined. It no longer uses Device joined, the message for adding one of your own account devices.
• Removing a contact tells you about a file still on its way to them. Removing someone does not recall a file they have not picked up yet — they can still accept it. The confirmation now says so, and points at Withdraw.
• A failed send no longer looks like a successful one. The progress bar was green whatever it was reporting, including directly under the word "Failed". Sending, delivered and failed now each have their own colour. If someone has made themselves unreachable to you, the picker remembers the refusal you were already shown rather than letting you walk into it again.
• Sending a file no longer leaves it armed. The file you just sent stayed selected with Send still enabled, so returning to the page put a duplicate one click away — a duplicate that now lands in another person's transfers, not just on your own laptop.
• Live-test evidence now checks that its manifest, screenshots, app instances and packaged artifact hashes refer to the same candidate. Evidence from a different build is reported as a mismatch.
• The README no longer promises a notarized Mac build when the available beta is ad-hoc signed. Its build badge now reflects the real cross-platform workflow, its version is current, and the Mac download row directs readers to the release-specific signing and first-launch status.
• After you receive Editor access, saving a previously local-only edit now makes it eligible to sync, including saves that replace the file. Files you have not edited again remain local; the permission change alone does not publish earlier edits.
• Unclaimed file offers sent to a contact now have a Withdraw action in Transfers. It withdraws that offer; separate offers of the same file must be withdrawn separately. Files a recipient has already downloaded remain on their device.
• You can now block a contact. Removing a contact was never a block — the app said so itself, since the person can simply add you again — and there was nothing else to reach for. Blocking someone stops them sending you files and stops them sharing folders with you. Blocked people stay listed, marked as blocked, so you can undo it.
• Manage access now lists outstanding emailed invitations for folders you own, including recipients who have not created an account yet. You can revoke a mistyped invitation instead of waiting for its week-long lifetime to end.
• Sending to a contact appears within minutes of the relay offering it. The app asked once and remembered a "no" for as long as it stayed open, so a desktop left running when the feature was switched on kept the option hidden — and, on the receiving side, never picked up files people had sent. A "no" is now re-checked periodically.
• Transfers now distinguishes delivered, declined, withdrawn, waiting and expired offers. Previously, all of them appeared as sent, so a declined file looked the same as one that arrived.
• Taking a file back no longer tells the other person it "expired". Withdrawing an offer was recorded as an expiry, so someone pressing Accept a moment too late was told they had been too slow, when in fact the sender had changed their mind. The two are now different events with different words.
• Transfers use the name you gave a contact. A row could show a raw account id for somebody your Contacts page names perfectly well, because it used the name that person set for themselves rather than the one you chose for them.
• Send-to-contact availability is now remembered separately for each relay. A refusal from an older relay or a temporarily disabled deployment no longer hides the feature after you switch to a relay that supports it.
• An emailed folder invitation whose owner is unavailable now waits longer between attempts. It no longer repeats the same unsuccessful claim and contact updates every 30 seconds throughout the invitation’s lifetime.
• Re-adding a contact can no longer quietly undo a block.
• You can send a file to a contact as well as to your own devices. The contact receives an offer and one of their devices downloads it into Received after acceptance. You can withdraw it until it is claimed and see whether it is waiting, accepted, declined or expired. When contact sends were first introduced, they used encryption in transit and at rest but did not yet use end-to-end encryption; synced folders provided that protection at the time. Neither person sees the other’s device details. The relay operator enables contact sends per deployment.
• The encryption table gained an entry for one-off device sends. At the time of that change, these sends did not yet use end-to-end encryption, unlike synced folders, clipboard items and new browser share links.
• Accepting a shared folder now proposes an incoming folder, TetherBay Incoming/<folder name>, and shows its path before downloading. Choose Change location… to use another folder. Not now leaves the invitation pending in Contacts; cancelling the location picker returns to this choice.
• People who join an encrypted folder through Contacts or an emailed invitation can now receive its key. Previously, only an invitation link carried the key, so other accepted members could not decrypt the files. The owner’s app now encrypts a copy of the key for each accepted member who needs it; the relay cannot decrypt that copy.
• Folder invitations sent to an email address now appear after the recipient installs TetherBay and verifies that address. An invitation received later appears on the next refresh. The recipient must still accept it before gaining access. This applies to folder invitations, not links for adding an account device.
• Invitation emails and the join page now tell new recipients to install TetherBay and sign in with the invited email address. The installer does not preserve the invitation link, so the instructions no longer rely on it surviving installation.
• Windows Setup can continue when it cannot verify a legacy-updater cleanup step through WMI or Task Scheduler. It still attempts to stop and remove the old updater, but logs an unverified cleanup step instead of sending the user into an ineffective restart-and-retry loop.
• Beta upgrades can use the Paddle Sandbox checkout. Beta testers can open the official tetherbay.com checkout when the relay explicitly reports Sandbox mode. Their verified-email accounts and plan access persist, while the Paddle payment uses test money. Temporary tunnel checkout URLs remain limited to local test relays.
• Fresh Windows installs no longer fail a legacy-updater check. Setup now treats an absent legacy scheduled task as the normal state without depending on a version-specific Task Scheduler error identifier. A detected enabled legacy task or a still-running updater continues to block installation.
• Windows upgrades no longer fail on harmless legacy cleanup leftovers. Setup checks only the named legacy scheduled task instead of enumerating every task on the machine, accepts a task that is already disabled, and treats a locked obsolete LocalAppData application tree as recoverable after proving that no legacy updater is running. An active updater or enabled legacy task still blocks the upgrade.
• Mirror downloads remain readable after activation. The publisher sets their read permissions before moving them into the web server’s download directory, preventing HTTP 403 errors caused by a restrictive SSH file-creation mask.
• Windows setup now retries transient legacy-tree file locks. After stopping the obsolete updater, both Setup and the one-line installer retry removal of its LocalAppData application tree for up to 15 seconds. A short-lived archive or process handle can no longer turn a successful updater shutdown into an immediate restart-required installation failure.
• RecruitLead download instructions no longer depend on the primary domain. Pages reached through the CIS mirror now show mirror-hosted one-line installer URLs, and /get.ps1 plus /get.sh default their release-feed requests to that same mirror ingress and use the mirror artifact URL returned by the feed. Mirror deployment and release verification reject either script if it contains a primary-domain dependency.
• Windows upgrades now retire even an already-running legacy beta updater. Setup disables and removes the old scheduled task, terminates its active PowerShell/VBS process tree, verifies the scheduled task is absent or disabled, and makes a best-effort removal of the obsolete LocalAppData application copy. This closes the race that could restore and launch an old beta one second after a successful Program Files installation while preserving settings and synced folders.
• Windows one-line upgrades now complete cleanly over running beta clients. The PowerShell flow downloads a recognisably named installer, closes existing launcher and agent processes, waits for setup to finish, verifies the installed binary version, and explicitly opens the matching launcher from Program Files. The release packager also rejects stale launcher or agent payloads whose FileVersion does not match the installer version, so a current filename cannot conceal old application bytes.
• One-command Windows upgrades handle running beta clients. The PowerShell flow downloads a clearly named installer, closes running launcher and agent processes, waits for Setup, checks the installed version, and opens its launcher from Program Files. Packaging also checks launcher and agent FileVersion values against the installer version to help catch stale components.
• Folder and account contention can be isolated. The optional sharded lock manager separates write contention by folder and account. A fair-share throttle slows an overactive account, and per-account lock metrics are available on /metrics. These controls reduce the risk that one account delays the rest of the service.
• PostgreSQL is now a supported metadata backend for the relay (selectable by configuration), alongside the existing SQLite store which remains the default for local and self-hosted use. Includes a one-shot SQLite→Postgres data migration tool with row-count reconciliation.
• Support for Cloudflare R2 and S3-compatible blob storage. The relay can store encrypted blobs in R2 and provide presigned downloads. Storage health checks and a global storage cap help detect failures and limit usage. The integration was tested with an S3 server.
• Storage maintenance can run after startup. The startup storage audit can run after the server begins listening, allowing health checks to respond while storage cleanup continues. TETHERBAY_STARTUP_AUDIT_MODE selects background (the default), off, or blocking for the earlier pre-listen behaviour.
• Folder encryption now activates once every participating device advertises support and the device enabling it holds the folder key. Previously, clients recorded keys without advertising the capability, leaving encryption inactive despite the advertised feature. Once encryption is enabled, uploads wait for compatible devices rather than falling back to plaintext.
• End-to-end encryption for synced folders and clipboard. File contents are encrypted on the sending device with AES-256-GCM in authenticated frames before upload. Folder keys are delivered to devices in sealed ECDH envelopes; the relay has no unwrapped content keys. Clipboard items are encrypted per event with the account key. For these protected payloads, the relay stores ciphertext without a decryption path. Uploads wait if a participating device does not yet support E2E, so update every device in the folder before transfers resume. Clipboard E2E has been enabled by default since 2026-06-15.
• Remote file access hardened alongside folder encryption.

Known issues

• macOS beta packages are unsigned and not notarized; follow the documented Gatekeeper first-launch steps.

• Windowscf347fe15b9b8f17e500e0e3afb722e0693ab9a216cee60c49e68e22290c4e54
• macOS · Apple Silicon2140041c217b3c07497e660ca2aa2082be7990b822e1a62a5accccece57b1d0e
• macOS · Intela76fddbb396e4a140296c75f476ac961292f1cd396aa7895d665a05571590b4b
• Linux · x640f7024589cdddfd473a5ed9f4b146c58ca3cdf89381030d654d88cb782c4c88e
• Linux · ARM64aafd7baab6e5d3fb31dd7b495ae20f0dc0cb17f13fd4a5a02a19291e454988b3
• Android443556b0c0dbd348f3e3c6f5bf5159f7e159b6c7197f6edca62f2ce5c83834c4

• Download page
• Release page