Personal Device Bridge — Changelog

v0.4.0

2026-09-28T00:00:00+09:00

Twenty parallel workstreams, merged and verified together (reports in docs/work/).

Added

PC app in 12 languages with automatic OS-language detection, a first-run setup guide (install the phone app by QR → pair → permissions), and tray/notification text in every language.
Design system (PC app): light/dark/system theme, consistent components, full keyboard navigation, WCAG AA contrast, reduced motion.
Productivity (PC app): transfer history (search, filters, open/reveal, resend; stored only on this PC, auto-pruned after 180 days / 1,000 entries), command palette (Ctrl/⌘+K), drop files anywhere to send, tray menu with recent devices, native notifications with actions, configurable “send clipboard” shortcut.
Automatic updates: signed desktop updates (Tauri updater, verified before install; can be turned off) and an update prompt in the Android app downloaded from the website (SHA-256 verified).
Android: received photos/videos go to Pictures and other files to Download (MediaStore), open/share from the notification, background receiving that survives process death and network changes, a send queue that survives restarts, battery-optimization guidance; redesigned UI (Material 3, dynamic colour, tablets/foldables, TalkBack); all 12 languages with per-app language; Quick Settings tiles, a home-screen widget and Direct Share to your PCs.
Rich clipboard: images (PNG) and formatted text (HTML with plain-text fallback) between devices, negotiated with older peers; content marked sensitive by password managers is never read or sent.
USB connection via adb forward/reverse (auto-detected when a phone is plugged in).
Faster transfers: parallel lanes, pipelined disk I/O and optional zstd compression — TCP 1 GiB 190 → 332 MiB/s, compressible text over a 100 Mbit/s link about 2×.
Windows printing without extra apps (Windows.Data.Pdf) and Wayland remote input (xdg-desktop-portal).
Browser extension: Firefox alongside Chrome/Edge, context menus, shortcuts, redesigned popup/options, 12 languages, continue media position and PDF page on another device.
CLI: pdb doctor (diagnoses agent, firewall, mDNS, rendezvous, TURN, clock, disk, permissions with fixes), shell completions, man page, --json everywhere, progress bars, suggestions for mistyped commands.
SDKs: complete typed TypeScript/Python coverage of the public agent API, reconnect/backoff, events, examples, package metadata, and a new Go SDK (not yet published).
Packages: Linux .deb/.rpm/AppImage, macOS universal build (unsigned), winget and Scoop manifests.
Website: help center (40 articles × 12 languages, private in-browser search), honest comparison table with sources, changelog pages, performance section; Lighthouse-tuned.

Security and reliability

Pre-authentication crash in the TCP/USB multiplexer via an oversized credit window (High) fixed; pairing handshake timeout (slowloris); peer-supplied device names sanitized (control, bidi and zero-width characters); bounded receive pre-allocation; new fuzz targets and property tests.
Rendezvous service: per-IP/per-pair rate limits, request size limits, private JSON logs, metrics, graceful shutdown, versioned migrations, mailbox cleanup.
Network chaos tests (loss, latency, bandwidth, partitions, peer restarts) found and fixed two bugs: a race when both devices connect at once and silent loss under a stream flood.

Privacy

Privacy policy (12 languages, effective 2026-09-28) covers update checks, the local transfer history, where Android saves received files and the website visit counter.

v0.3.4

2026-09-26T00:00:00+09:00

Added

AI assistant (PC app) — bring your own AI. Connect any of 18 providers with your own API key — ChatGPT (OpenAI), Claude (Anthropic), Gemini, Grok, Mistral, DeepSeek, Qwen, Kimi, GLM, Doubao, ERNIE, MiniMax, Perplexity, Groq, Solar (Upstage), OpenRouter, Ollama on this PC, or any OpenAI-compatible server — ask up to four at once and compare the streamed answers side by side. Attach documents (HWP, Office, PDF, text) or the clipboard. Or open 15 AI web apps you are already signed in to (ChatGPT, Claude, Gemini, Grok, Copilot, Perplexity, Le Chat, DeepSeek, Qwen, Kimi, Doubao, ERNIE, Z.ai, CLOVA X, Wrtn) in an app window that keeps its login or in your browser. Prompts and answers go directly between the PC and the chosen provider; API keys stay in the OS credential store.
Website: the feature on the landing page and in the privacy policy (Article 15), in all 12 languages.

Hosted services (live 2026-09-25 – 2026-09-26, no app update needed)

2026-09-26T00:00:00+09:00

Security

TURN credential budget (reported by Krishu): GET /v1/turn on the hosted rendezvous proxy issued Cloudflare TURN credentials without any limit. Credentials are now issued only within a per-client-IP budget (20, refilled over an hour) and a service-wide daily cap, checked by the rendezvous service in memory (no IP is stored or logged). Browsers may request credentials only from personaldevicebridge.com (the share-link receiver, which now also gets the CORS header it needed). No user data was exposed: relayed traffic is end-to-end encrypted.
Signed client addresses (found in our own follow-up review): the rendezvous service trusted X-PDB-Client-IP from any Cloudflare address, so another Cloudflare Worker could pose as unlimited clients and bypass every per-IP limit. Our proxy now signs the address with an Ed25519 key (PDB_PROXY_PUBKEY on the service); unsigned, stale or mismatched values are ignored.
Admin assets behind Cloudflare Access (reported 2026-09-26): /admin%2fadmin.js (an encoded slash) was not matched by the Access policy for /admin/* but was served by the static router, exposing the admin dashboard's JavaScript and CSS (no data, no credentials; /api/admin/* stayed protected). The site now refuses any path with an encoded / or \ (HTTP 400) before anything else runs, and admin responses are never cached.

v0.3.3

2026-09-25T00:00:00+09:00

Added

32-bit Android phones: the APK now also carries the armeabi-v7a core, so Android 8.0+ phones with a 32-bit system (many 2017–2019 budget models) can install it. The APK is larger as a result.
Website: a System requirements section and an updated platforms FAQ in all 12 languages.
Website: a step-by-step Android install guide (Google Play coming soon), in all 12 languages.
Android targets API 36 (Android 16); releases also build an AAB and can upload it to Google Play.

v0.3.2

2026-09-25T00:00:00+09:00

Changed

Android APK is now a release build signed with one fixed key (PersonalDeviceBridge-<v>-android.apk), so later versions install over it. Earlier test APKs were debug-signed with a new key each build: uninstall the old app once before installing this one.
Windows portable ZIP contains the desktop app (…-windows-x64-portable.zip, signed exe, no installer); the command-line tool is …-windows-x64-cli.zip.

Fixed

Website: the offline page now shows when a page is opened without a connection (the service worker cached a URL that Cloudflare redirects); the contact e-mail is no longer rewritten by Cloudflare; Cloudflare no longer injects its analytics beacon (pages are sent with Cache-Control: no-transform).

v0.3.1

2026-09-25T00:00:00+09:00

Added

Desktop: Send by link — pick a file, choose 1 hour / 24 hours / 7 days, and a one-time link for someone without the app is copied; the page shows waiting, sending and delivered states and can cancel a link.
Desktop: cancel a send from the transfer list.
Android: Folder sync screen (add folders by the PC's folder name, sync now, add/open/share files) and rename a paired device; “Folder sync” is now among the per-PC permissions on the phone.
Public downloads on https://personaldevicebridge.com (Cloudflare R2) with anonymous download totals on the landing page; each release is copied there automatically.

Changed

Desktop: Folder sync and Screen-edge crossing have their own sidebar pages; Settings keeps General, File sharing, Security and About. Welcome, pairing and empty-state texts read on one line; the edge tips reflect that shortcuts and F1–F12 are forwarded.
Website: one-line section intros and share row on desktop; no more tester-only wording.

v0.3.0

2026-09-24T00:00:00+09:00

Added

Shortcuts across screens: screen-edge crossing and remote input carry key combinations (Ctrl/Alt/Shift/Win + letter, digit, punctuation or named key, e.g. Ctrl+C/V/Z, Win+E, Shift+arrows, Alt+F4) and F1–F12; modifiers are always released on the target.
TURN relay live: /v1/turn issues one-hour Cloudflare TURN credentials; the deploy workflow verifies a relay-only WebRTC round trip in Chromium. The website now lists the relay as available.
Desktop UI for the moat features (Korean/English, light/dark): Find (ring + locate with an OpenStreetMap link) and Lock on the device page; photo-backup card (backup folder, last backup, back up a local folder); folder-sync card and Settings list (versions kept 30 days in .pdb-versions); 공동인증서 move with confirmation and a consent dialog that shows the certificate detail; Search page across this PC and connected devices (grouped, highlighted, download / show in folder); Snippets & clipboard page (search, copy, send to a device's clipboard, sync; memory-only received-clipboard history); Phone notifications panel with inline reply; HWP / HWPX / Office document preview for received files; "Use as webcam in other apps" (loopback MJPEG URL + OBS steps); walk-away lock; organisation section ("Managed by …", policy summary, team enroll / apply / leave, audit log with intact/tampered verification); joining the phone's hotspot; .hwp/.hwpx in the print picker. Settings are grouped in tabs; the sidebar gained a "Tools" section.
Screen-edge crossing on Windows (apps/desktop/src-tauri/src/edge.rs, rdev hook): push the pointer off a chosen edge to control the next PC over an approved remote-input session; Scroll Lock or Ctrl+Alt+Backspace returns control instantly; a live indicator shows while it is on.
Desktop integrations: OsCertStore, SystemLock, desktop "Find my device" (attention sound + notification), photo backups into <Pictures>/Personal Bridge Backup; reveal_path / desktop_info Tauri commands.
Browser extension for Chrome and Edge (Manifest V3, apps/browser-extension): right-click a page, link, image or selected text → Send to device; toolbar popup with paired devices and online state, Send this tab, Continue on … and Send clipboard text; Alt+Shift+S sends the tab to the last used device. English/Korean, light/dark. Talks only to the local app; no server, no analytics. See docs/BROWSER_EXTENSION.md.
pdb native-host: native messaging host (4-byte little-endian length + JSON, 1 MiB limit) that forwards an allow-list — list devices, send URL, send text, continue — to the running agent over IPC, with strict validation (http/https URLs only, text ≤ 64 KiB, full ids of paired devices only). Browsers start it as pdb chrome-extension://<id>/. Per-user installers: install-windows.ps1 / uninstall-windows.ps1 (HKCU keys for Chrome and Edge, manifest next to pdb.exe) and install-linux.sh.
Local developer SDK (moat #16): third-party apps and scripts can list the user's devices, send files, links, text, "continue" and My Drop items, and receive events through the per-user agent — never touching the network.
- docs/API.md: versioned reference of the agent IPC (endpoint and token discovery per OS, JSON-lines framing, every public v1 request and push event, stability rules, security notes). Pairing, pairing/consent approval, grants, remote input, camera and trust-store changes are internal and not part of the SDK surface.
- sdk/typescript — @personaldevicebridge/sdk (ESM + types, zero runtime dependencies, Node ≥ 18): typed client, async-iterator/EventEmitter events, timeouts and cancellation, connectWithRetry/watchEvents, error classes; node:test suite against a mock agent plus an end-to-end test with two real pdb nodes.
- sdk/python — personaldevicebridge (stdlib only, Python ≥ 3.9): blocking Client and asyncio AsyncClient with the same surface; unittest suite (mock agent + real-agent end-to-end).
- sdk/examples: send to a named device, watch incoming items (Node and Python), PowerShell via the CLI.
- CI: .github/workflows/sdk.yml runs both SDK suites on Ubuntu and Windows, and end-to-end against pdb built from the same commit.
Vulnerability disclosure and bug bounty programme: root SECURITY.md (scope, safe harbour, 72 h acknowledgement / 7-day triage / severity-based fix targets, discretionary CVSS-based rewards in KRW, 90-day coordinated disclosure) and a new website page /{lang}/security/ in all 12 languages (encryption design in plain words, honest audit status, verification of downloads, hall of fame), linked from the footer, sitemap, hreflang and /.well-known/security.txt (Policy:, Acknowledgments:).
Reproducible Linux CLI builds: scripts/repro-build.sh and the reproducible workflow, which builds pdb twice as different users in different directories and fails unless the SHA-256 match; the release uses the same recipe and ships BUILDINFO. Verification guide: docs/REPRODUCIBLE_BUILDS.md (bash and PowerShell).
Release provenance: SHA256SUMS for all release assets and Sigstore/SLSA build-provenance attestations (actions/attest-build-provenance) in the publish job.
Fuzzing: cargo-fuzz targets in fuzz/ for the protocol envelope and framing, pairing links, peer payloads, discovery beacons and received file names; weekly fuzz workflow (nightly, 60 s per target).
Android: moats on the phone (Kotlin bindings regenerated from crates/ffi; see apps/android/README.md):
- Home actions per PC: Lock PC, Find (ring and/or locate, result with an OpenStreetMap link) and Search across the shared folders of every connected PC (grouped by device, snippets, download → open / share / save to Downloads).
- 공동인증서 screen: the certificates this app keeps, expiry, and Send to PC after a confirmation (installed path / already there / older copy moved aside). Receiving asks with the holder · CA · expiry detail.
- Photo backup of DCIM and Pictures to a chosen PC with live progress and the final report, plus an optional automatic backup when charging on Wi-Fi (WorkManager; retries later when the PC is offline).
- Snippets: add, edit, delete, copy, send to the PC clipboard, sync with PCs.
- Scan document: ML Kit document scanner → PDF + on-device Korean/Latin OCR .txt (스캔_YYYYMMDD_HHMMSS), sent to a PC.
- Connect without Wi-Fi: local-only hotspot with the network name, password and a Wi-Fi QR code for the desktop app or pdb hotspot "WIFI:…"; stops when the screen is left.
- Find my phone: a PC the user allowed can ring the phone at full alarm volume (even on silent; full-screen alert with Stop) and get its location (foreground service only, no background-location permission).
- Notification mirroring sends the notification key and whether it can be answered; allowed PCs can reply through the app's own reply action.
- What this PC may do on this phone: per-PC switches for find, replies, certificates, snippets and camera (all off by default in the core).
- Manifest: location + FOREGROUND_SERVICE_LOCATION (service type dataSync|location), USE_FULL_SCREEN_INTENT, media read permissions, NEARBY_WIFI_DEVICES (neverForLocation), CHANGE_WIFI_STATE, a FileProvider for open/share.

Fixed

Receivers ignore unknown remote-input event types from newer peers instead of ending the session.
The deploy workflow read the wrong field of Cloudflare's TURN key response and left orphan keys.
Folder sync refuses a folder that contains or sits inside the app's own data (seen on Windows, where Sync and sync are the same folder).

v0.2.0

2026-09-24T00:00:00+09:00

Added

SmartPrint (pdb-print): list a device's printers with a recommendation and print PDF/PNG/JPEG/text there (CUPS lp; Windows via SumatraPDF or shell print paths, with an honest applied/ignored report). CLI pdb printers / pdb print, desktop card, Android "Print on PC". Real-CUPS end-to-end test in CI.
Internet P2P (ADR-0006): WebRTC data-channel transport (conformance-tested) and the rendezvous service (services/rendezvous, Railway + PostgreSQL) with per-pair, end-to-end encrypted mailboxes. PDB_RENDEZVOUS=off keeps everything on the LAN.
Extended capabilities (pdb-extended), all default-deny: read-only file browser for shared folders, notification mirroring with per-app privacy on the phone, phone as touchpad/keyboard for the PC, and phone camera viewing — remote input and camera require consent every session and show an indicator with Stop. CLI pdb share / browse / fetch / notify; desktop and Android UIs.
Privacy policy (12 languages) describes the rendezvous service; website copy updated.

v0.1.0

2026-09-24T00:00:00+09:00

Added

Per-user background agent with owner-only IPC (ADR-0005); CLI and desktop share one node; start at sign-in.
Explorer "Send to" and right-click "Send with Personal Bridge", global shortcut Ctrl+Shift+B, single instance.
FILE_SMALL fast path, batched durability (10 000 × 4 KiB ≈ 3.9 s), PAIR_DONE pairing completion.
Dependency upgrades: snow 0.10, rand 0.10, mdns-sd 0.21, socket2 0.6, if-addrs 0.15, rcgen 0.14.
Signed Windows binaries and installers (Azure Artifact Signing), Linux build, Android test APK.