versionCode 4. Bound the SSH handshake so a stalled server cannot hang a sync. Persist config, key, and host pin atomically so an interrupted write cannot corrupt state. Replace the chained one-time jobs with periodic work that survives reboots; the schedule floor is now WorkManager's 15-minute minimum.
Checksum-pin every downloaded toolchain archive. Before publishing, verify the APK was built from HEAD, the tag matches versionName, apksigner passes, and the tree is clean; publish a sha256 sidecar and treat published assets as immutable. Compare full unsigned APKs in verify-repro and run the Android unit tests in CI.
Persist config, key blob, and host pin via AtomicFile so an interrupted write cannot corrupt state. Validate the port, clear the host pin when the remote changes, cap imported key size, time out native helpers, and escalate rsync termination to destroyForcibly. Serialize manual and scheduled syncs behind a mutex. Replace the chained one-time jobs with plain periodic work: it survives reboots without a boot receiver and cannot silently die like a broken chain. Costs the sub-15-minute interval, which photo backup does not need. Document the floor and that syncs run on any unmetered network, not only WiFi.
versionCode 3. Drop --mkpath so remotes with an rsync older than 3.2.3 (stock macOS included) can receive syncs; rsync still creates the final remote path component on its own. NDK host toolchain detection so the native build also runs on macOS hosts.
rsync forwards --mkpath to the remote side when sending, so a remote rsync older than 3.2.3 (notably stock macOS, whose openrsync is "rsync 2.6.9 compatible") rejects every sync with "unrecognized option '--mkpath'". rsync creates the final component of the destination path on its own, so flat remote paths keep working everywhere, including the documented rrsync setup whose root is pre-created. Only a nested remote path with missing parents now needs a one-time mkdir -p on the server; the log shows rsync's error when it is missing. Reported-by: jsvk Link: https://codeberg.org/0xlena/rsend/pulls/1
versionCode 2. Empty-path and config-corruption fixes, rsync process cleanup on stopped syncs, keygen error reporting, and the store icon.
The containment check was a bare prefix match, so a sibling such as /storage/emulated/0-evil passed for a root of /storage/emulated/0.
A crash mid-write corrupted config.json, and every later load then threw on parse, crash-looping the app until its data was cleared, losing the key and pinned host. Write to a temp file and rename.
A stopped worker (schedule replaced, constraints lost) left rsync running detached until its own network timeout, including a window where a WiFi-only sync kept pushing on another network. A watchdog coroutine destroys the process on cancellation, which also closes its pipes and unblocks the log reader; the worker rethrows cancellation instead of logging it as a folder error.
The trailing-slash fix-up turns an empty local path into /, so a blank folder row would rsync the entire filesystem; an empty remote path pushes into the rrsync root. Reject both when saving a folder, skip and log them at run time in case the config was edited by hand, and log why a sync was skipped when the app is not configured yet.