Changelog
Every version, dated.
Synced from the FileMayor app repo on every release. Nothing is hand-edited here.
Source: content/CHANGELOG.md
- v4.2.0— 2026.07.29
🎨 Desktop identity — off the template, onto "operator console"
The desktop app's whole visual system was the generic dark-glass-SaaS default (near-black + gold + a cyan pop, three drifting "mesh" gradient blobs, heavy frosted-glass cards, animated gradient text). Replaced it with an identity that matches the product and the site:
- **Palette:** warm ink + a single gold accent, with verdigris reserved for the "safe / reversible" semantic — on considered warm neutrals, not cold blue-black. The light theme is warm paper, matching filemayor.com.
- **Type:** system **monospace** for the brand, headings, labels and badges (the "command bar for your filesystem" identity), system sans for body — no web-font dependency, so nothing silently falls back offline.
- **Surfaces:** solid cards with hairline borders instead of frosted glass; one quiet static accent wash instead of animated mesh; crisp solid-gold buttons instead of shimmering gradients.
Every view re-skins through the shared design tokens, so the change is coherent app-wide. (Per-view layout polish continues from here.)
- v4.1.0— 2026.07.29
🧭 Multi-machine safety, real auto-updates, and a calmer look
- **Undo is now scoped to the machine that made the change.** The journal lives in your home dir, which corporate setups roam / OneDrive-sync between machines — so an undo on your work PC could try to replay moves recorded on your personal PC (paths that don't exist there). Every entry now records its host; undo and the session list only ever act on operations made on *this* machine. (Pre-4.1.0 entries stay undoable.)
- **Auto-update actually works now.** The updater was pointed at the private source repo (so update checks 404'd for everyone) and the build never shipped electron-updater's manifest files. Both fixed: updates now come from the public release, with the `latest*.yml` manifests published alongside the binaries — installed apps will self-update going forward.
- **Desktop UI, first pass:** removed the drifting multi-colour "mesh" background and the heavy frosted-glass cards for calmer, solid surfaces with hairline borders — a step away from the generic template look toward the site's identity. (A deeper visual/branding pass is in progress.)
- v4.0.16— 2026.07.29
🛠️ The desktop app actually uses the safe engine now
This is the real fix behind "the desktop engine is useless — it just makes folders, loses files, does the opposite of organising." The desktop **Organize** was a separate, naive reimplementation in the UI that bypassed the real engine entirely:
- **It had no project protection** — it flattened *everything* into category folders, shredding nested/project folders. It now runs the same **substrate-protected** engine as the CLI: code projects and their contents are left intact.
- **It swallowed move errors and always showed "Success!"** — even when nothing moved (hence empty folders). It now reports the **real** number moved and failed, and every move is **journaled and reversible from the app's Undo**.
- **Scan is now a true preview** — it shows the exact plan the engine will run, and touches nothing until you click Organize.
- **Terminal**: "Dedupe" and "Apply" printed `undefined`/`NaN` result counts, and "Clean" was a dead button — all three now read the correct fields and work.
- **Workspace/Analyze**: junk category sizes and the total rendered blank; fixed. Progress no longer shows "[object Object]".
- v4.0.15— 2026.07.28
🛟 Critical desktop fix — Organize is safe again
- **The desktop "Organize" was firing its file moves detached, with no plan and no results.** `organize()` is async, but the Electron handler called it without `await` — so the preview's file count was always 0 (the bulk-safety gate silently never fired), and the real run executed in the background while the UI showed nothing. That is the "it just makes folders / files vanish / does the opposite of organising" behaviour. The handler now awaits the plan, shows it before touching anything, enforces the bulk gate on the real count, and returns the actual results. **No files were ever deleted — `organize` only ever moves through the reversible engine — but the missing feedback made moved files look lost.**
- **The desktop "Undo" now reverses an Organize.** The app's Undo read a separate history file, while Organize/dedupe/clean journal to the master journal — so Undo couldn't reverse an organize at all. "Undo everything" now drains the master journal (the same source the CLI's `filemayor undo` uses), so every engine action is reversible from the app.
- Regression tests pin both: `organize()` must be awaited and return a real plan, and an organize run loses zero files and fully reverses.
- v4.0.14— 2026.07.22
🍎 macOS correctness + tested-on-every-platform CI
- **macOS: the security jailer no longer falsely rejects legitimate operations.** Two real bugs, caught the first time the test suite ran on a real Mac: (1) a destination that didn't exist yet was never symlink-resolved, so under macOS's symlinked paths (`/var` → `/private/var`, i.e. every temp location) it could never match the jail root — every new-file destination was refused; (2) the system-zone protection blocked the entire macOS user temp tree (it resolves inside `/private/var`). Both fixed strictly by removing false *rejections* — `/etc`, `/usr`, and the rest of the protected zones still block, verified by the same suite.
- **CI now runs the full engine suite + e2e pipeline on Windows, macOS, and Linux for every change.** Cross-platform behavior (no-clobber renames, cross-device fallbacks, lock retries) is a machine-checked fact on real runners, not an assumption. (The first Windows run also exposed that the test step silently never ran under PowerShell — fixed.)
- v4.0.13— 2026.07.22
🖥️ The desktop app and MCP servers get the same guarantees as the CLI
- **Desktop System Cleaner deletes are now trash-based and journaled.** This was the one remaining surface that deleted permanently (`unlink`) — `filemayor undo` can now reverse desktop cleanups too.
- **Desktop moves go through the journaled engine**: no-clobber (an occupied destination gets `name (N).ext` beside it instead of being silently overwritten), cross-device safe, resilient to transient Windows locks — and recorded in the master journal, so the CLI's `undo` sees desktop actions.
- **Desktop and MCP undo never overwrite.** Restoring a move onto a path where a *new* file now exists lands beside it. The old blanket copy-fallback — which turned Windows' "destination exists" refusal into an overwrite — is gone; copying now happens only for genuine cross-device renames.
- **`apply_plan` in the CLI's MCP server is now actually journaled.** It claimed "all moves are journaled, call undo to reverse" while writing no journal entries; moves now route through the engine, making the claim true.
- v4.0.12— 2026.07.21
⚡ 5× faster duplicate detection
- **`dedupe`/`duplicates` is ~5× faster on real-world folders** (benchmarked: 3.1s → 0.6s on a 20,000-file tree, identical results). Three compounding fixes: small files (≤64 KB) are hashed with direct reads instead of round-tripping Node's 4-thread I/O pool — measured 12× faster for that pass alone; files that fit inside the 64 KB head sample skip the second full-read pass entirely (the head hash already covers the whole file); and large-file hashing concurrency was raised 8 → 32.
- **Scanner is leaner on big trees** — extension filters and ignore globs are compiled once per scan instead of re-built per file (filtered scans ~33% faster), and directories no longer cost an extra `lstat` each.
- New regression tests pin the tricky large-file paths: identical >64 KB files are still caught, and same-head/different-tail files are still rejected.
- v4.0.11— 2026.07.20
🧱 No file left behind — on any platform
- **Moves never overwrite.** POSIX rename silently destroys an existing destination file (Windows errors instead) — so a move onto an occupied path was data loss on Mac/Linux and a hard failure on Windows. Every engine rename now lands beside an existing file as `name (1).ext` instead of over it, and the journal records the real destination so undo stays exact.
- **Undo never overwrites either.** Restoring a file to a path where you've since created a *new* file now restores it beside the newer file instead of clobbering it.
- **Windows lock resilience.** Renames retry briefly on `EPERM`/`EBUSY` — antivirus and indexer scans hold transient locks that made operations fail spuriously on Windows.
- **Watch-rule moves are now journaled.** The watcher's `move` rule used a raw rename (not undoable, could overwrite, no cross-device fallback); it now goes through the same journaled engine as everything else.
- v4.0.10— 2026.07.15
🛟 Reversibility hardening
- **Cross-device undo no longer strands files.** Deleting or moving a file across a filesystem boundary (external drive, separate mount, tmpfs) already fell back to copy+remove on the way out — but `undo` used a plain rename, which throws `EXDEV` across devices and left the file sitting in the trash. Both directions now share the cross-device fallback, so every deletion stays truly reversible regardless of where the file lived.
- **Deterministic rollback order for same-millisecond operations.** Chained moves (A→B→C) that were journaled within the same millisecond tied on the ISO timestamp and could reverse in the wrong order, stranding the file. A monotonic per-write sequence now breaks those ties in true write order.
- **`undo --session` with no id fails loudly** instead of silently undoing the most recent session (the bare flag parsed to `true` and fell through to the default scope). It now exits non-zero with a hint to run `undo --list`.
- v4.0.9— 2026.07.03
♻️ Deletions are now truly reversible
- **Trash-based deletes everywhere** — `clean`, `dedupe`, watch delete-rules, and the `filemayor_delete_files` MCP tool now move files to a durable FileMayor trash (`~/.filemayor-trash`) instead of unlinking permanently. Every removal is journaled, so `filemayor undo` restores it. (Previously the internal trash sat in the OS temp dir — wiped on reboot — and delete journaling was a no-op, so undo could never restore a deletion.)
🕘 Undo history
- **`filemayor undo --list`** shows every undoable session (id, time, moves/deletes); **`undo --session <id>`** reverses a specific past session; **`undo --all`** reverses everything. Plain `undo` now reverses only the *most recent* session instead of unwinding the entire journal.
🔍 Honest, fast duplicate detection
- **Dedupe is now genuinely content-hash based** (it previously matched on size+name, despite the docs saying "hash-based"). Three-stage pipeline — size buckets → 64 KB partial hash → full streamed hash with bounded-concurrency I/O — keeps it fast on very large folders. Identical files with different names are now caught; same-name-different-content files are no longer false-positived.
🗂️ PARA, continuous and semantic
- **`filemayor watch <dir> --para`** — new files auto-route into Projects / Areas / Resources / Archives as they land, journaled (undo works). The "a system that stays tidy" workflow.
- **`filemayor cure <dir> --para`** — semantic PARA via any AI provider: the planner receives a hard PARA destination contract and the plan validator now recognises moves *into* the four buckets as intentional re-filing rather than "domain scattering". The CLI `cure` also drops its stale Gemini-only gate: first key of Anthropic / Gemini / OpenAI wins, with the free FileMayor proxy as fallback.
- v4.0.8— 2026.06.28
🗂️ PARA method — sort by actionability
- **New `filemayor para <dir>` command** — sorts a folder into Projects / Areas / Resources / Archives (the PARA framework) by *actionability* rather than file type. Deterministic and read-only: it reasons from recency, file category, folder-name keywords, and project substrates, and **labels every move with the reason it chose** (e.g. "Not modified in 18 months"). Output is the same reversible plan shape as `cure` — review, then `filemayor apply`, undo anytime.
- **`filemayor init --para`** — scaffolds the four PARA folders with plain-English teaching READMEs so a first-timer who has never heard of PARA understands each bucket.
- **`filemayor_para` MCP tool** — exposes the deterministic PARA plan (plus a ready-to-apply `moves` array) to any MCP client, no AI key required. When Claude is the client it can also do *semantic* PARA: reason about true Projects-vs-Areas-vs-Resources itself, then apply.
- **Config** — new `para:` section (archive threshold, active window, renamable bucket folders, area/resource/project keyword lists) and a `--para` config preset.
- Engine respects project substrates (`.git`, `package.json`, `.als`…): a code/music project moves intact into Projects, never shredded file-by-file. Files already inside a PARA folder are left untouched (idempotent).
- v4.0.5— 2026.06.09
🎉 Everything is free
- **Every feature open to all users** — Watch Mode, AI SOP Engine, unlimited bulk organize, and CSV export now ship in the free tier. No license required. The tier system and Ed25519 license verification remain in place for the future.
- Removed the upgrade modal and all checkout links.
- Settings license card now states it plainly: free, every feature included.
🤖 Multi-model AI (4.0.4 follow-through)
- AI provider selector in Settings: FileMayor AI (default, no key), Google Gemini, OpenAI, Anthropic Claude, or local Ollama. Keys stored in the system keychain.
🖥️ Platforms
- **Intel Mac support** — macOS now ships both x64 and arm64 DMGs (4.0.4 and earlier were Apple Silicon-only).
🔧 Engineering
- **CI on every PR** — typecheck, Vite build, 36 core tests, and the 35-step e2e pipeline now gate every pull request and push to main.
- **Version singleton** — the app, CLI, MCP server, and READMEs all derive their version from `package.json`; `scripts/sync-version.js` covers the MCP package so strings can no longer drift.
- **Bundle −53%** — views are lazy-loaded and heavy deps (framer-motion, lucide, i18n) split into cacheable chunks; entry dropped from 518 KB to 244 KB.
- **MCP `--audit`** — `npx -y filemayor-mcp --audit` prints a machine-readable trust report (transport, egress, tool list with destructive flags, runtime safeguards) without starting a session.
- v4.0.0— 2026.05.16
✨ The Jarvis Release
- **Global ⌘K Command Bar** — A single command surface available from any view. Type what you want ("organize", "undo", "open assistant") and FileMayor does it. Keyboard-first, fuzzy-matched, with recent-action memory.
- **Mission Control Home** — Replaces the marketing-style dashboard with a workspace-centric home: active workspace card with "Change" / "Diagnose" inline, live activity counter, hardened-runtime stats, four-up quick actions.
- **Polished Assistant** — Conversational layout with quick-prompt chips, inline diagnosis & plan cards, "Review changes" + "Apply" right in the bubble, one-tap rollback after any apply. Restores the workspace from localStorage so chats feel continuous.
- **Status Bar** — Persistent bottom strip shows active workspace, license tier, hardened-runtime indicator, version, and the ⌘K hint.
- **Slimmer Sidebar** — Tighter padding, refined active indicator, "AI" / "PRO" badges, and an inline-undo affordance pinned to the bottom.
- **First-run as a conversation** — Onboarding rewritten as "Hello. I'm FileMayor." with four-promise grid (local-first, reversible, Jarvis-style, hardened) and an immediate first scan so users see value in under 30 seconds.
🤖 AI Integration Surfaces
- **`filemayor-mcp` — MCP server** (`mcp/`) — FileMayor speaks Model Context Protocol over stdio. 14 tools exposed: `filemayor_scan`, `filemayor_analyze`, `filemayor_explain`, `filemayor_plan`, `filemayor_apply`, `filemayor_rollback`, `filemayor_organize`, `filemayor_clean`, `filemayor_duplicates`, `filemayor_dedupe`, `filemayor_delete_files`, `filemayor_history`, `filemayor_undo_last`, `filemayor_info`. Drops into Claude Desktop, Cursor, Zed via one JSON snippet. Reuses the same hardened-runtime safeguards as the CLI and desktop app.
- **Claude Code Skill** (`.claude/skills/filemayor/SKILL.md`) — Teaches Claude when to reach for FileMayor (messy Downloads, "tidy this folder", "find duplicates", disk-space questions) and how to drive the Curative Triad safely (always show diagnosis + plan before applying, prefer dry-run, never bypass blocked system dirs).
🐛 Bug Fixes
- **Fix SOP crash** — `parseSOP` was called in `electron/main.js` but never imported. Importing now from `cli/core/sop-parser`. The SOP feature was a guaranteed crash on first use.
- **Fix auto-updater silence** — `update:available`, `update:downloaded`, and `download-progress` events were registered in the preload bridge but never forwarded from the main process. The "Restart to update" banner would never appear. Forwarders added in `initAutoUpdater`.
- **Fix `TerminalView` build error** — Removed duplicate `formatSize` definition that prevented strict TS compilation.
- **Fix dark-theme CSS variables** — `--success`, `--danger`, `--warning`, `--border-subtle`, `--bg-main`, `--bg-card`, `--text-tertiary`, and mesh backgrounds existed only in light theme. Now present in both, so toasts and legal/onboarding modals render correctly in dark mode.
- **Fix 3 pre-existing test failures** — `core.test.js` Organizer tests were calling the async `organize()` synchronously, asserting against a Promise (now async + awaited). `test-e2e-pipeline.js` asserted that `validatePath` blocks system dirs, but that's `isDirSafe`'s job and the path was Windows-only on a Linux runner — switched to the correct API with an OS-aware path. Suite now 36/36 + 35/35 green.
🔧 Changed
- Version → `4.0.0` across root `package.json`, `cli/package.json`, CLI `VERSION` constant, TerminalView banner, runtime UI.
- Tagline updated: "Your intelligent filesystem clerk."
- v3.6.0— 2026.04.03
🛡️ Hardened Runtime (Chevza Doctrine)
- **Jailer** — Symlink-aware path jailing blocks system-critical directory access.
- **Vault** — OS-native System Keychain integration for secure API key storage.
- **Logic Guardrail** — Prevents destructive AI-generated operations via batch verification.
- **Emergency Halt** — SIGINT/SIGTERM interception persists the Master Journal to disk.
- **Security Architect** — Domain-scatter blocking validates all AI plans before execution.
🐛 Bug Fixes (9 total)
- Fixed `CureEngine` constructor mismatch (wrong arg count).
- Fixed CLI `cure` command argument ordering and missing `generatePlan()` call.
- Fixed Electron `main.js` missing 6 module imports.
- Fixed Electron `curative:rollback` variable shadowing bug.
- Fixed `reporter.formatOrganizeReport` crash on empty results (null guards).
- Fixed `isFileSafe` crash when passed null/undefined (type guard).
- Fixed `progressBar` crash on negative values (clamp to 0-100).
- Fixed `MetadataSentry` crash on files missing `path` field.
- Fixed `IntentStrategist.detectArchetype` crash on null folder name.
🚀 Added
- **CLI .env auto-loader** — Zero-dependency `.env` parser, no more manual exports.
- **Domain Archetypes** — 6 folder archetypes: Music, Civics/Law, Agri-Tech, Business, Technical, Library.
- **Bug Hunter test suite** — 93-test stress test covering every module edge case.
- **E2E pipeline tests** — 35-test end-to-end verification (Scan → Explain → Cure → Apply → Undo).
🔄 Changed
- Removed legacy `Dockerfile` (Snyk vulnerability source, not needed).
- Updated all dependencies to latest compatible versions.
- Resolved all 6 npm audit vulnerabilities (0 remaining).
- Node.js requirement bumped to `>= 20.20.0`.
- v3.0.0— 2026.03.15
✨ The Agentic Revolution
- **Curative Triad** — Introduced the "Explain -> Cure -> Apply" workflow for trust-based AI organization.
- **Agentic Crew** — Specialized agents (Strategist, Sentry, Planner, Architect) for safe, intelligent file management.
- **Folder Health Score** — New diagnostic engine with gamified health scoring (0-100).
- **Dedupe Engine** — High-speed duplicate detection and one-click purging CLI.
- **Curative UI** — Premium AI Assistant interface in Desktop with real-time health gauges.
- **Filesystem Abstraction v3.0** — Safe, transactional, and rollback-ready engine.
- v2.1.0— 2026.03.09
🚀 Added
- **Deep Intelligence Engine** — New `analyze` command for duplicate detection, bloat mapping, and potential space recovery.
- **Desktop UI Parity** — Brought the "Analyze" feature to the Desktop App with a premium data-rich dashboard.
- **Safety Signals** — Standardized "🛡️ Integrity Check: PASSED" signals across CLI and Desktop UI.
- **Security Playbook** — Full adherence to the "AI Vibe Coding Security Playbook" (Zero-network, cryptographic logs, path sanitization).
- **Internationalization** — Full `analyze` section added to all 10 languages (EN, ES, PT, FR, DE, KO, ZH, AR, HI, JA).
- **16:3 Store Header** — High-fidelity 1600x300 assets for app store and launch platforms.
🔄 Changed
- **Global Version Sync** — Unified v2.1.0 across root, CLI, Desktop (SettingsView), and Landing Page.
- **Hardened Handlers** — Patched unguarded `fs:findTempFiles` IPC handler. Reinforced all handlers with strict `validatePath` and `isFileSafe` checks.
- **Production Cleanup** — Stripped all `console.error` and `console.warn` calls from Electron main, SOP parser, and React views.
- **i18n Completeness** — Replaced all hardcoded English strings in AnalyzeView, OrganizeView, CleanerView, and SettingsView with `t()` calls.
- **i18n Bug Fix** — Fixed `fileayor-language` → `filemayor-language` localStorage key typo (language preferences now persist).
- **Secret Management** — Moved hardcoded `CHECKSUM_SECRET` to `process.env.FM_CHECKSUM_SECRET`.
- **Service Worker** — Bumped cache from `filemayor-v1` → `filemayor-v2.1`.
- **Project Cleanup** — Deleted stale `landing/` directory, 5 root marketing PNGs, and `CLAUDE_HANDOFF.md.resolved`.
- **Dependency Audit** — Critical security patch for build dependencies (`npm audit fix`).
- v2.0.0— 2026.02.26
🚀 Added
- **CLI Engine** — Full command-line interface with 7 subcommands (`scan`, `organize`, `clean`, `watch`, `init`, `undo`, `info`)
- **Core Engine** — 9 platform-agnostic modules: scanner, organizer, cleaner, watcher, config, reporter, categories, security, barrel index
- **180+ file extensions** mapped across 12 categories (Documents, Images, Audio, Video, Archives, Code, Config, Fonts, Data, Executables, Design, Books)
- **Path traversal protection** and system directory guards
- **Rollback journal** — undo any organization operation
- **YAML config** — `.filemayor.yml` with hierarchical merge and env var expansion
- **Multi-format output** — table, JSON, CSV, minimal (for piping)
- **File watcher daemon** with rules engine and auto-organize
- **Terminal View** — in-app terminal for running CLI operations visually
- **Install script** — one-liner curl install for servers
- **Professional README** with badges, architecture docs, and usage examples
- **Contributing guide** and MIT License
🔄 Changed
- **Electron main.js** refactored to use shared core engine (was inline, now modular)
- **package.json** — fixed name typo, added `bin`, `files`, `repository`, `keywords`, `engines`, Linux/Mac build targets
- **App.tsx** — added Terminal tab to navigation
- v1.0.0— 2026.02.08
🚀 Added
- Initial desktop app with Electron + React + Vite
- File scanner and organizer UI
- System cleaner with junk detection
- Life Setup wizard (directory structure creator)
- Settings with theme toggle and language selection
- Auto-updater via electron-updater
- PWA support with service worker
- Internationalization (10 languages)
- Legal consent dialog (EULA, Privacy Policy, Terms, Disclaimer)
- Launch plan and marketing plan documents