Clavyn v0.1.2-alpha.6

What's Changed

This alpha is a performance and hardening release. Terminals now render on the GPU, the app boots in 3 IPC round-trips instead of 12, terminal output travels as coalesced binary batches instead of one JSON event per packet, and the vault file authenticates its own header. It also closes a remote process-crash vector in the SSH stack and a webview route to downgrade-installed updates.

Highlights

• GPU-accelerated terminal rendering. Panes render through the xterm WebGL addon — a render-bound stream measured 5.9x faster per frame (4.5 ms → 0.73 ms at 120x40), up to 10.7 MiB/s. A least-recently-used budget of eight panes keeps the app under the browser's 16-context WebGL cap; evicted panes and lost contexts fall back to the DOM renderer with the transcript intact. The addon loads on demand in its own chunk. (#63)
• Startup boots in 3 IPC round-trips instead of 12. The independent boot queries run in parallel and the update check no longer blocks first paint — it fires in the background and still opens the modal when a release is found. Host/group loads are de-duplicated and versioned, so an in-flight read can no longer overwrite a newer change. (#55)
• Terminal output is coalesced off the JSON event path. Output batches at 64 KiB or a 6 ms window and travels as binary over a per-session channel. Bulk output drops from 128 to 16 IPC messages per MiB; a byte-at-a-time writer drops from 19,519 messages to 30; a 32 KiB chunk no longer becomes ~114 KiB of evaluated JavaScript. Keystroke echo still goes out immediately. (#49)
• Changed host keys are reported with both fingerprints instead of a bare "Unknown server key". The presented key is held under Known Hosts pending fingerprint confirmation; removing a host tombstones its entry so it cannot silently fall back to trust-on-first-use; "Forget permanently" and key replacement confirm through a native OS dialog showing the real stored fingerprint. (#38)
• The vault file authenticates its own header. Key metadata, salt, version and epoch are bound to the ciphertext as AES-GCM associated data, so a tampered vault.json (e.g. a swapped-in public key under your label) fails the tag check. Decrypted payload memory is zeroized, and legacy vault migration rebuilds metadata from the private keys rather than trusting the old header. (#49)
• russh is built without zlib, closing an unbounded decompression loop a hostile server could drive into a panic that took the whole process down. Clavyn never negotiates compression, so nothing is lost. (#29)
• SSH connects no longer freeze the vault. Connects held the vault mutex across the network exchange — one silent host blocked unlock, reset and every key operation until restart. The lock is now held only for key auth, connects are time-bounded with keepalives, and the Argon2id KDF runs on a blocking thread with the master key cached per session. (#52)

Fixed

• A live session id can no longer be hijacked by a second terminal; concurrent local terminals are capped and the slot is reserved before the blocking PTY spawn. (#31, #49)
• A session's final output is never lost to the close notification — cat bigfile; exit previously dropped the last batch. A detached PTY reader can no longer emit stale output into a reused session id. (#49)
• A second instance can no longer clobber shared app data (it focuses the running window), and workspace layouts are validated on write so a corrupt split ratio can't brick startup. (#40)
• Key import no longer leaves private key material in the dialog after Cancel, a failed import, or a vault auto-lock; a failed import keeps your label and Import tab. (#58)
• Out-of-range terminal dimensions are rejected instead of wrapping to a zero-column PTY or going out on the wire over SSH. (#49, #61)
• The frontend entry chunk is 25% smaller — navigable views and the search addon load on first render, tailwind-merge is dropped, and the build targets es2022 with Vue production flags. (#37)
• The update check runs once per launch instead of twice. (#66)

Security hardening

• Vault reset now tears down live SSH sessions, SFTP channels and local PTYs under the same destructive boundary it describes. (#58)
• Disabling biometric unlock now requires an unlocked vault; the webview's unused updater/process capability — which permitted downgrades and an unconditional app-kill — is removed. (#33)
• The webview CSP now declares every directive that does not inherit from default-src, drops the unused GitHub connect-src origins, and scopes shell open to the two URLs the UI uses. (#47)
• Windows state files get an explicit owner-only DACL instead of inheriting the profile's, and the temp file is CREATE_NEW so a planted file can't be written through and renamed into place. (#46)
• The release pipeline is hardened: CI actions pinned to commit SHAs, npm ci without install scripts, per-job release permissions, fork PRs kept off self-hosted runners, and semver-validated dispatch inputs. (#42)
• Two unregistered SFTP commands — an unbounded remote read and an unconstrained remote write — are deleted. (#61)

Dependencies

• Rust: russh-sftp 3.0, russh-keys 0.49.2, russh-cryptovec 0.62, argon2 0.6, rand 0.10, base64 0.23, uuid. (#80, #82, #83, #84, #85, #88, #89)
• Frontend: Vite 8, TypeScript 7, @xterm/addon-fit 0.11, @xterm/addon-webgl 0.19; Playwright 1.63 for e2e. (#75, #78, #79, #90)
• CI: actions/checkout 7, actions/setup-node 7, actions/upload-artifact 7, tauri-action 1.0. (#72, #73, #74, #76)

See CHANGELOG.md for the full history.

Full Changelog: v0.1.2-alpha.5...v0.1.2-alpha.6

Clavyn v0.1.2-alpha.5

What's Changed

Tab drag-and-drop now works in the shipped desktop app, not just in the test harness. Tauri's dragDropEnabled window flag defaults to true, which installs a native drag-drop handler on the webview that swallows every drag before it reaches the DOM — dragstart/dragend fired, but dragenter/dragover/drop never did, leaving the split, swap, and reorder handlers from alpha.4 as unreachable dead code. The app registers no tauri://drag-drop listeners, so disabling the flag removes nothing and fixes the issue on WKWebView, WebView2, and WebKitGTK alike. (#34)

Also included: a new native-e2e agent skill documenting how to test and debug features that cross the webview↔OS boundary (drag-and-drop, clipboard, dialogs, windowing) in the real packaged app on macOS, Linux, and Windows. (#34)

See CHANGELOG.md for the full history.

Full Changelog: v0.1.2-alpha.4...v0.1.2-alpha.5

Clavyn v0.1.2-alpha.4

What's Changed

Vault reset from the locked unlock screen

The vault reset button previously lived only inside the unlocked "Danger Zone", which made it impossible to reset the vault after forgetting the master passphrase — the exact situation reset exists for. The unlock screen now shows a "Forgot passphrase? Reset vault" link that opens the same passphrase-gated confirmation form; cancelling returns to the normal unlock form. (#26)

The reset confirmation form is extracted into a shared VaultResetForm component so the locked and unlocked entry points render one implementation and cannot drift apart.

Termius-style tab drag-and-drop

Dropping a tab onto a terminal now splits the pane, dragging across tabs swaps them, and the tab strip supports reordering. (#27)

See CHANGELOG.md for the full history.

Full Changelog: v0.1.2-alpha.3...v0.1.2-alpha.4

Clavyn v0.1.2-alpha.3

Clavyn 0.1.2-alpha.3 — see assets below.

Clavyn v0.1.2-alpha.2

What's new

Vault reset with passphrase-gated authorization (#25)

Adds the ability to permanently reset (destroy) the encrypted vault and start fresh with a new passphrase. This is a destructive, defense-in-depth operation gated behind passphrase verification — a wrong passphrase never destroys stored keys.

• Danger Zone UI — Unlocked vault view shows a "Danger Zone" card with a "Reset Vault" button. Clicking it reveals a confirmation form with a strong warning and a passphrase input; the destructive confirmation button enables only once a passphrase is entered. On success the UI transitions to the setup screen; on failure the error stays local to the confirmation form for retry.
• Authorization gate — secure_reset_vault verifies the current master passphrase against the vault payload before any destructive action. A wrong passphrase returns an error and the vault remains intact.
• Authoritative biometric cleanup — The vault-bound biometric Keychain credential is deleted before the vault binding id is destroyed. If deletion fails, reset aborts with the vault intact so cleanup can be retried safely.
• Cross-build macOS tracking — Biometric enrollment writes a durable, non-secret vault-binding marker. If a later build can no longer see a tracked Data Protection Keychain item because its code-signing access group changed, reset/disable fail closed instead of treating errSecItemNotFound as proof the credential is gone. Untracked legacy vaults transition directly to Pending without an intermediate Clear write, so a scope-probe failure leaves the vault untracked (Unknown) and disable fails closed rather than skipping Keychain deletion.
• Credential/reset serialization — Backend biometric enable/disable and vault reset share a mutation mutex, preventing direct IPC callers from recreating the old vault-bound credential between cleanup and destruction.
• Auth generation invalidation — After the vault file is destroyed, the auth generation is advanced before acquiring the passphrase mutex, so an in-flight unlock or biometric request that started before reset cannot commit its passphrase afterward.
• Crash-leftover cleanup + durability — Reset removes both vault.json.tmp and vault.json, deleting the temporary copy first. On Unix the containing directory is synced before success is reported so the unlink survives a crash/power loss.
• Frontend state fails closed — After reset, initialized=false, unlocked=false, biometricEnabled=false, and cached SSH-key metadata is cleared so host/identity forms cannot retain key IDs that no longer exist.

Fail closed when persisted state cannot be parsed (#20)

Persisted app state that fails to parse now fails closed rather than silently falling back to defaults, preventing a corrupt state file from masking a real configuration problem.

Write state files atomically and owner-only (#21)

State files are now written atomically (temp file + rename) with owner-only permissions, preventing partial writes and avoiding world-readable state on shared systems.

Track Cargo.lock and audit dependencies in CI (#23)

Cargo.lock is now committed and dependency auditing runs in CI, keeping Rust dependency versions reproducible and surfacing advisories automatically.

Full changelog

v0.1.2-alpha.1...v0.1.2-alpha.2

Clavyn v0.1.2-alpha.1

What's new

Termius-style terminal workspace organization (#11)

Drag a terminal pane from one tab onto another tab to automatically split them side by side — both live connections are preserved without interruption. Directional drop zones (split above/below/left/right + center swap) mirror Termius workspaces. A pane can be dragged to the New-session area to extract it back into its own tab.

Fullscreen terminal pane fix (#11)

Fixed a bug where clicking fullscreen on a terminal pane produced a blank white screen in some viewport sizes (especially ultrawide windows). The pane now teleports directly to <body> via Vue's <Teleport>, escaping all ancestor overflow:hidden/display:none containers. Verified across six viewport sizes including 2882×816 with 65/65 browser assertions passing.

Escape exits fullscreen without leaking to the remote shell (#11)

Fixed xterm calling stopPropagation() on Escape, which prevented the window-level Escape handler from firing. Escape now correctly exits fullscreen and is not sent to the remote shell.

Terminal search fix (#10)

Fixed the terminal search being silently broken — SearchAddon decorations are now enabled, match highlighting works, and the result count is shown.

Mask host addresses by default (#9)

Host addresses are now masked by default to avoid exposing them at a glance. The setting can be toggled in preferences.

Agent verification CLI + feature map (#8)

Added a composable CLI for driving and verifying the live Tauri renderer over CDP/Playwright, with a feature map cataloging every view and how to reach it.

OpenTermius → Clavyn rename complete

Completed the full rename from OpenTermius to Clavyn across all code, docs, and build configuration. Documented unsigned-build warnings for macOS users.

Full changelog

v0.1.1...v0.1.2-alpha.1

Clavyn v0.1.1

Clavyn v0.1.1 — First Stable Release

Clavyn (formerly OpenTermius) is a desktop SSH terminal manager with split panes, vault-secured credentials, SFTP file browsing, and biometric unlock.

This release consolidates 24 alpha builds into the first stable release.

---

Rebrand & Design System (#7)

• Renamed from OpenTermius to Clavyn across all Cargo crates (clavyn-core, clavyn-desktop), package manifests, Tauri config, workflows, scripts, and docs.
• New Grok Bot-inspired UI design system: neutral, compact, desktop-native interface with a 252px sidebar, 36px rows, 7px radius, and a full light/dark token set (neutral grays, blue reserved for focus/links/informational state).
• Fixed dark mode: theme tokens were inside @layer base, causing Tailwind to strip the entire .dark block. Moved to plain CSS so dark mode applies correctly.
• Theme-aware terminal chrome: the session strip and pane headers now adapt to light/dark instead of using hardcoded dark colors. The xterm viewport itself stays dark.
• Preserved user data across the rename: kept the Tauri identifier (org.opentermius.app) and macOS keychain service (com.opentermius.vault) so upgrading users retain all saved hosts, keys, vault data, and Touch ID credentials. Migrated localStorage keys with fallback to the old names.

Persistent Terminal Sessions & Multi-Host Workspace (#6)

• Sessions survive navigation: terminal sessions and xterm instances are no longer remounted or reconnected when switching between Terminal, Files, and other views.
• Split pane resilience: drag-drop, move-to-tab, and pane swapping preserve the original SSH session and xterm DOM — no reconnection or output loss.
• SSH identity resolution: linked identities are resolved at connection time and frozen into the transport host. Editing an identity does not relabel a live terminal; a reconnect is required to pick up the new username.
• Input ownership hardening: keyboard focus is tracked per-pane, preventing input from leaking to background sessions during vault unlock, password prompts, or session picker interactions.
• SFTP ownership & concurrency: SFTP connections are tied to their terminal session and properly cleaned up on close.
• Vault concurrency: vault unlock/lock operations are serialized to prevent race conditions.
• Failure isolation: a failed connection in one pane does not affect other panes or tabs.
• E2E browser tests: added Playwright-based browser UI tests with a mocked Tauri IPC fixture, covering session creation, identity snapshots, picker cancellation, and workspace navigation.

Touch ID Biometric Vault Unlock for macOS (#5)

• Replaced the biometric stub with a real macOS Keychain + Touch ID implementation behind the opt-in macos-biometric Cargo feature.
• Vault passphrase is stored in the Data Protection Keychain, bound to the current vault generation so an orphaned Keychain item can never become authoritative for a newly initialized vault.
• Legacy file-based Keychain credential cleanup is performed opportunistically on startup.

SFTP Remote File Browser (#4)

• Added a remote SFTP file browser accessible from the Files navigation item.
• Uses native open/save dialogs for choosing local upload/download paths.
• Streaming transfers with progress indication.

Vault Auto-Lock & Security Hardening (#2, #3)

• Auto-lock on inactivity: vault auto-locks after a configurable idle timeout (default 15 minutes).
• Lock-on-sleep: optionally locks after the app has been backgrounded for an extended period.
• Authenticated passphrase verification: vault passphrase is verified before any unlock is accepted — an incorrect passphrase cannot mark the vault as unlocked.
• Biometric support gating: biometric unlock is safely gated behind feature detection and vault initialization state.

In-Terminal Search (#1)

• Added in-terminal search using @xterm/addon-search.
• Press Cmd+F / Ctrl+F (or click the search icon in the pane header) to open the search bar.
• Supports case-sensitive, whole-word, and regex search modes.

Release Infrastructure

• Cross-platform release CI via GitHub Actions (macOS arm64 + x86_64, Linux, Windows).
• Custom update checker that queries the GitHub releases API including prereleases (GitHub's releases/latest redirect excludes prereleases).
• NSIS installer for Windows (replaces MSI to fix alpha version detection).
• Local release automation scripts (scripts/release.sh, scripts/version.sh).

---

Downloads

Platform binaries and installers are built by the release workflow and will appear below when the builds complete.

Screenshots

---

Full changelog: v0.1.1-alpha.1...v0.1.1

OpenTermius v0.1.1-alpha.9

Improved Host Connection Flow

Select + Confirm Pattern

Host list interaction is now a two-step process like native SSH clients:

• Single click: Selects the host (visual highlight + status bar at bottom)
• Double click: Shows a connection confirmation dialog with full host details, then connects when you click "Connect"
• Enter key: Same as double-click — shows the confirmation dialog
• Arrow Up/Down: Navigate through the host list with keyboard
• Plug icon (hover): Quick connect button, same as double-click

Connection Confirmation Dialog

The dialog shows a summary card with:

• Host label and connection string (user@host:port)
• Connection target (hostname:port)
• Username
• Auth method (Identity / SSH Key / Agent / Password)
• Identity name if the host uses an identity
• SSH key status if configured

Click "Connect" to open a new terminal tab and start the SSH session, or "Cancel" to go back.

Status Bar

A status bar at the bottom of the host list shows the currently selected host with its connection string and a "Connect" button.

Identity Badge

Hosts that use an identity now show an "Identity" badge in the list.

Downloads

• macOS (Apple Silicon): OpenTermius_0.1.1-alpha.9_aarch64.dmg

macOS Installation

If macOS shows "OpenTermius is damaged and can't be opened," run:

xattr -cr /Applications/OpenTermius.app

OpenTermius v0.1.1-alpha.8

New: Settings Page with Updates

Settings Page

A proper Settings page (like native macOS/Windows/Linux apps have) is now available in the sidebar. It includes:

About Section

• App name, version, and platform/arch info
• Links to GitHub repository and releases page

Updates Section

• Current version display
• Update status indicator (up to date / update available / error)
• "Check Now" button for manual update checks
• Release notes preview when an update is available
• "Download & Restart" button with progress bar
• Error handling with retry option
• "Last checked" timestamp

Auto-Update Info

• Explains how automatic updates work

How Updates Work

1. Automatic: On startup, the app silently checks for updates. If available, a notification banner appears in the bottom-right corner with release notes and a "Download & Restart" button.
2. Manual: Go to Settings > Updates > Click "Check Now". If an update is available, you see the release notes and can download + install + restart in one click.

Other Changes

• Added get_app_info Tauri command (name, version, platform, arch)
• Added Settings to sidebar navigation and Command Palette (Cmd+K)
• Cmd+, now opens Settings (was Vault)
• Removed the inline check-for-updates button from sidebar footer

Downloads

• macOS (Apple Silicon): OpenTermius_0.1.1-alpha.8_aarch64.dmg

macOS Installation

If macOS shows "OpenTermius is damaged and can't be opened," run:

xattr -cr /Applications/OpenTermius.app

OpenTermius v0.1.1-alpha.7

Fixes

Robust Auto-Update System

Multiple fixes to make the update notification banner reliably appear:

1. checkForUpdates() runs first: The explicit update check now runs before event listener registration, so even if a listener fails, the check still executes
2. Each listener wrapped in try/catch: One failing listener no longer blocks the others
3. Fixed positioning: Changed from absolute to fixed and increased z-index to z-[100] for reliable visibility
4. Complete event payload: The backend silent check now includes all fields (available, current_version) in the event payload

Manual Check for Updates Button

Added a "Check for Updates" button in the sidebar footer. If auto-detection fails, you can manually trigger an update check. Shows an alert if you're up-to-date, or shows the update banner if an update is available.

Downloads

• macOS (Apple Silicon): OpenTermius_0.1.1-alpha.7_aarch64.dmg

macOS Installation

If macOS shows "OpenTermius is damaged and can't be opened," run:

xattr -cr /Applications/OpenTermius.app