v4.0.1beta — 2026-09-19

Library copy, paste, move and delete

Copy, paste, move (including drag-and-drop) and delete in the library tree now follow role-based rights, the Shared Directory Write Access option, and destination-folder ownership (cid / gid).

What changed

• Regular users can write in their own space (matching cid and gid).
• Write-shared users may move and paste into their group's shared directory. They still cannot delete or create folders there.
• Group admins work in their group space; super users have no cid / gid restriction.
• Links may be copied; they cannot be moved.
• Workspace and shared root folders cannot be deleted.
• Paste no longer rejects a duplicate name: the pasted node is renamed with (copy).

v4.0.2beta — 2026-09-19

Software version and release notes

The About -> Version menu shows the git tag. Click the version number to open the release notes.

v4.0.3beta — 2026-09-20

Agent transport v2 release notes

Date: 20 September 2026

This release adds protocol v2 between the desktop/Android agent and the web server. The web client does not speak v2 directly: it keeps using the existing PHP helpers (utils/agent_status.php, utils/cmd_reader.php, dump load). The server translates those calls into the same MySQL queues the agent already used, and pushes work to the agent over SSE.

v2 is opt-in on the agent. Legacy long-poll (utils/reader_gw.php) remains the default when transport_v2 is absent from server.txt.

1. Roles

The web client therefore works the same whether the agent is on v2 or on long-poll. Presence, APDU results and dumps still land in tbl_cli_status / tbl_cli_msg / dumps/load.php.

Typical round trip:

1. Agent POST hello.php server creates a session, sets lastConnection, returns sessionId + cid.
2. Agent opens GET stream.php (SSE) and keeps reconnecting.
3. Web client GET agent_status.php every 2.5 s connected if lastConnection is less than 5 s old.
4. Web client GET cmd_reader.php server inserts tbl_cli_msg (sta = 0) and waits for sta = 2.
5. Stream sees the row, marks sta = 1, sends SSE event: command, closes.
6. Agent executes the APDU and POST reply.php sta = 2; the web client unblocks.
7. Agent POST heartbeat.php on a card/SAM change (and every 5 s).
8. On quit: agent aborts the stream GET and POST bye.php presence drops immediately.

2. Enabling v2

On the agent, add the keyword transport_v2 on its own line in the installation server.txt (non-comment). Desktop and Android both read that flag at startup.

version,1,
server,http://localhost,
root_dir,intertool_proj/intertool,
transport_v2

Without that keyword the agent keeps calling utils/reader_gw.php (legacy long-poll).

The server hello payload also reports transport (sse-post by default, or legacy if agent_transport_mode is set to legacy in site config). That field is informational; the agent chooses the stack from server.txt.

3. Base URL

All v2 agent endpoints are under:

{server}/{root_dir}/api/v2/agent/

Example with the localhost overlay: http://localhost/intertool_proj/intertool/api/v2/agent/hello.php.

JSON endpoints accept Content-Type: application/json and return application/json; charset=utf-8. The stream is text/event-stream.

Envelope field v is 1 for this protocol revision (independent of the application git tag).

4. Session lifecycle

4.1 POST hello.php register

Body (required): v, sam, agentVersion

sam is the SAM serial as uppercase hex (or the manual PIN used as a pseudo-SAM). agentVersion is the packed protocol version string from the agent (releases.json current, compared as a float to agentMinVersion).

Success body: sessionId, cid, aidRestrict, serverTime (epoch seconds), transport, minAgentVersion.

Side effects:

• Insert tbl_agent_sessions_v2 (connected = 1).
• agent_updt_sam + tbl_cli_status.lastConnection = now.
• Delete all tbl_cli_msg rows for that CID (empty the command queue).

The agent treats HTTP 200 + ok: true as connected. It does not wait for the first SSE event before showing the LED.

4.2 GET stream.php?sessionId=…&timeoutSec=… wait for a command

Long-lived GET. timeoutSec is clamped to 555, default 25.

Unknown or disconnected session 404 text unknown session. Missing sessionId 400.

While the connection is open the server:

1. Writes SSE comment keep-alives (:).
2. Refreshes tbl_cli_status.lastConnection about once per second (so the web client 5 s presence window stays green).
3. Every ~5 s, if no command is waiting, emits event: heartbeat.
4. Picks the oldest tbl_cli_msg row for the session CID with sta = 0, sets sta = 1 (collected), emits event: command, then closes the stream.
5. If the wait expires with no command, emits event: noop and closes.
6. If the agent aborts the GET (connection_aborted), the session is marked disconnected (same as bye).

The agent reconnects immediately after noop/heartbeat-only/command. Heartbeat SSE events are ignored by the agent loop (presence is a separate POST, see 4.4). After three consecutive stream HTTP errors the agent stops the proxy.

4.3 POST reply.php command result

Body (required): v, sessionId, seq, type, payload

type is RES_CMD_OK (legacy msg 4, sta = 2) or RES_CMD_ERROR (legacy msg -1, sta = -1).

payload.legacyRes is the string the web client already understands, typically {responseHex}{sw},{durationMs} (for example 9000,12). If legacyRes is omitted, the server builds it from responseHex, sw (default 6F00) and durationMs.

Also touches lastConnection.

The web clients comm_sendApdu only waits for sta = 2. An error reply (sta = -1) is not treated as a completed APDU there; the browser call times out (9998,0) after 20 s.

4.4 POST heartbeat.php card / SAM presence

Body (required): v, sessionId, type (HEARTBEAT), payload

payload fields used:

cardStatus bits (agent):

The agent sends a heartbeat at least every 5 s, and immediately when card/SAM/reader presence changes. Success body includes nextHeartbeatSec: 10 (advisory).

This is what the web client shows as SAM / card state: utils/agent_status.php reads tbl_cli_status via agent_infoSAM.

4.5 POST bye.php clean disconnect

Body (required): v, sessionId

Marks the session connected = 0, sets lastConnection 60 s in the past (so agent_ComStatus reports disconnected on the next poll), and resets card/SAM display fields (agent_reset_status).

The agent also aborts the in-flight stream.php GET so the PHP worker does not keep touching lastConnection. Quit without bye left the web UI green for ~20 s (remaining stream timeout).

5. JSON envelope (server agent on the stream)

{
  "v": 1,
  "sessionId": "…",
  "seq": 12345,
  "type": "CMD_SEND_APDU",
  "ts": 1770000000,
  "payload": {
    "legacyMsg": 2,
    "legacyArg": "0:00A40400…"
  },
  "meta": { "source": "server" }
}

SSE framing:

event: command
id: 12345
data: {…json…}

6. Web client path (unchanged URLs)

The browser never calls api/v2/agent/. It keeps:

Disconnected agent: comm_sendApdu returns 9999,0 without queueing. Timeout waiting for a reply: 9998,0.

Dump upload from the agent is not v2 JSON. After a dump command the agent still POSTs JSON to dumps/load.php (legacy).

7. Database

tbl_agent_sessions_v2

Created on first hello if missing. One row per sessionId (32 hex chars). connected is 1 until bye or aborted stream.

tbl_cli_msg (shared with legacy)

tbl_cli_status (shared with the web client)

lastConnection is the presence signal. Stream + hello + reply + heartbeat refresh it. Bye / abort set it 60 s back so the 5 s window fails immediately.

8. Legacy long-poll (still supported)

When transport_v2 is off, the agent loops on:

GET {server}/{root_dir}/utils/reader_gw.php?cid=&ts=&seq=&msg=&res=

That PHP both collects the next tbl_cli_msg and writes the previous result in the query string. v2 splits that into stream + reply, but the web client and the tables stay the same.

9. Disconnect matrix

10. Tests

v4.1.0beta — 2026-09-20

Write-card Environment authenticator (envAuth) release notes

Date: 20 September 2026

When write preprocessing is on, Intertool does not copy the dumps Environment authenticator (EnvAuthenticator, envAuth) onto the card as-is. The seal is bound to the card CSN. This note describes how po_preproc_data() rewrites that field in the dump record before the update APDU is built.

Preprocessing runs from update_PO_from_DB() in php/lib_db.php when the write command is diff_update_PO_from_DB (writePreprocEnabled = true). The command diff_update_PO_from_DB_no_preproc skips this patch and writes the dump bits unchanged.

Write PO and Clone PO now default writePreprocEnabled to true, so envAuth rewriting is the default path. SELECT_PREPROC only shows or hides the checkbox; it does not choose the command.

1. Scope

Other AIDs, SFIs and records are left unchanged.

2. Bit layout in the Environment record

s_hex2bin() expands each hex nibble to four ASCII bits (0/1). Offsets in the preprocessor are bit indexes, not bytes.

The hardcoded window substr(..., 59, 16) assumes the usual Intercode Environment bitmap without EnvPayMethod (bitmap bit 3 clear):

The preprocessor splices only bits 5974. Network, issuer, validity date and holder data still come from the dump.

3. Why the dump seal cannot be copied

EnvAuthenticator is a SAM-computed seal over this portable object. Inputs include the card CSN (from FCI) and the application KVC (from FCP). A value taken from another card is invalid on this one.

Write-card preprocessing therefore treats the dump seal as a request (keep a seal / clear a seal), not as the bytes to program.

4. Decision: which value is written

Both the dump record and the live card record are read at bits 5974. A field of all zeros is no seal.

4.1 Dump seal is zero

No patch. The dump already contains envAuth 0000, so the write programs zeros and clears the card seal. Used when the operator wants the card unsigned.

4.2 Dump seal is non-zero and the card already has a seal

Bits 5974 of $p_data are replaced with the cards current 16 bits. The dumps envAuth is discarded.

This is the usual clone/update onto a card that is already personalized: Environment data (network, dates, holder, ) can change; the existing CSN-bound signature stays.

4.3 Dump seal is non-zero and the card seal is zero

The card has never been signed (or was cleared). The server calls:

EnvAuthenticator(0, card FCI, card FCP, null, true)

calcMode = true asks the SAM to compute a 16-bit seal for this CSN and KVC (legacy or modern method from the FCP KVC). On success, that hex value is expanded to 16 bits and spliced into $p_data at bits 5974.

If the SAM call fails (success != true: unknown KVC, key missing, comms error), the dumps envAuth bits are kept so the write can still proceed.

5. How this is selected from the UI

Confirm Write PO / Clone PO sets write_cmd from MenuModel.writePreprocEnabled:

Opening Write PO or Clone PO sets both the model and the checkbox to checked. Uncheck the preproc box to write the dump seal without rewriting.

lib_dump.php maps those commands to update_PO_from_DB(..., true) and update_PO_from_DB(..., false).

6. Files

v4.1.1beta — 2026-09-21

Cascade owned folder and dump gid

when a user's group changes, and regroup is selected, the owned folder and dump gid are updated. The user's group is updated in the database, and the owned folder and dump gid are updated in the file system.

Token import no longer writes links.

It copies the dump into the Import tree.

Password managment

TL Password support removed.

v4.1.2beta — 2026-09-21

Bug Fixes

INT-33 https://gcnits.atlassian.net/browse/INT-33

Limit group rename to the shared root folder.

v4.1.3 — 2026-09-22

User privileges

INT-48 https://gcnits.atlassian.net/browse/INT-48

The three User privileges options are exclusive now.

In-app dialogs

Show alert, confirm and prompt in in-app dialogs so they work in the Android WebView.

Write to card and Clone

INT-42 INT-43 https://gcnits.atlassian.net/browse/INT-42 https://gcnits.atlassian.net/browse/INT-43

Disable Write to card and Clone when the reader SAM is locked or absent. Menu, drag-and-drop, and Reader Clone stay blocked until the SAM is present and unlocked.

v4.2.0beta — 2026-09-27

Dump autoload

When the global parameter dumpAutoload is 1, a card insert loads the dump into the reader tree, selects that dump, and shows Card Summary. If the user AID filter is not %, the application whose name contains that AID is selected. 0 leaves the tree unselected.

Card content refresh

autoRefreshCardContent mode 2 loads the dump on insert when the reader tree is empty, and keeps the dump when the card is removed.

SAM counters refresh on agent connection only when UpdateSAMonAgentConnection is enabled. A missing or zero value skips those reads.

Login and password

The login dialog opens when the main page is served without an active session.

Password self-service opens from the login dialog. The new password is checked as it is typed, and the user is signed in after a successful change.

Layout

The desktop layout stays side by side. PO and App tabs stay visible while their panel content scrolls. File system and raw tabs are hidden when expert view is off. The panel splitter is wider, and dump table headers stay pinned to the top of the PO content panels.

Compact view

A compact layout for small screens and the agent WebView lets a reader dump be saved, written, and moved without drag-and-drop. A card insert opens the dump, a waiting write can start, and webviewDndEnable is honored. In simplified view the description column is hidden and redundant dump owner information is removed.

v4.3.0 — 2026-10-26

Compact layout

The compact bar shows edit icons, and library and reader commands follow the selected node.

Rehabilitate and invalidate wait for a card. The web indicator stays on card present after the dump reloads.

On a wide screen the library context menu sits above the panel. Compact and WebView layouts hide that menu.

Card control opens from the compact bar, and its PDF is handed to the Android agent. Library and Reader close that view. Revert, redo, and save stay available while Library or Reader is open.

Library filter

The library dump filter opens in a dialog. Apply and Clear close the dialog, and the Filter item stays yellow while a filter is active.

Card control

The card control bar and panel fill the window. The PDF report can be emailed to the signed-in user.

Card refresh

autoRefreshCardContent is split into desktopAutoRefreshCardContent and androidAutoRefreshCardContent.

Virtual SAM

A user's decimal CID is accepted as a virtual SAM, so a shared phone can connect without a registered hardware SAM.

Agent download

The agent download path serves the Android APK named for the site.

Intercode translations

Super users can edit grouped elementary-data value lists, import and export them, and save a site overlay. Shared translation files stay unchanged.

v4.3.1 — 2026-10-27

Card control

A reader option gates the card control view. Without that option, the menu item is disabled, the compact-view button is hidden, and the page is refused.

Expert view

Expert view is suspended on a small screen or in the agent WebView. The saved option is restored on a large screen.

v4.3.2 — 2026-10-28

Supervisor

A read-only status API reports the working-tree revision, redacted configuration hashes, and usage counts for a site. A bearer token authenticates it. secrets.php is never returned.

A super user can arm one git pull for 15 minutes from the admin console. The server accepts a single signed command and answers 404 when the window is closed. The status token cannot arm the site or pull.

v4.3.3 — 2026-11-03

Global parameters

Every super user sees the full System Parameters list. The company id no longer hides system parameters.

Sync database from files copies the merged common and site global_parameters.json into tbl_global_parameters, and inserts names that exist only in the files.

Export database to site file replaces the site global_parameters.json with every database row. The common file is not changed.

Card views

Card Summary and Container Parameters are formatted in the browser. Startup data can be edited, including the AID and application type bits. DF parameters can be edited for status, KVC, and KIF.

The full AID is shown with the application text. Decimal and hex serial numbers share a line. System issuer shares a line with chip type, and application type shares a line with application subtype.

Admin users

Saving user options in the admin console leaves the expert view bit unchanged.

Agent status

After the agent disconnects, the next status poll shows it as disconnected. An open v2 stream no longer keeps the indicator green until that request times out.

Card emulation

The card emulation option can export and apply a dump.