v0.4.0

v0.4.0

Everything since v0.2.0. The headline is a redesigned header line, a full
security-hardening pass, and connection resilience (auto-reconnect, SSH
keepalives, flock self-heal).

Security hardening

• Command-injection defused in session/window names and the SSH host — all
  attacker-influenced values are now quoted/validated before reaching the shell
  or control-mode targets (#97, #75, #76, #90).
• Mode-line / header-line injection closed: % in pane-derived titles and
  fields is escaped so a pane can't forge mode-line constructs (#98).
• Reply-stream validation: pane ids from tmux are validated and the input
  accumulator is capped, so a hostile/runaway stream can't blow up Emacs (#99).
• Clipboard writes (OSC 52) ignored by default — a pane can no longer set
  your system clipboard unless you opt in via tmux-control-allow-clipboard-write
  (marked :risky) (#100).
• Supply-chain/CI: added SECURITY.md, Dependabot, and OpenSSF Scorecard (#95).

Redesigned header line ("here" / "elsewhere")

• The header now splits "here" (left: a persistent host:session › windows
  label, so you always know which server/session you're looking at) from
  "elsewhere" (right corner: other connected sessions with unseen output,
  named and grouped by server — click to jump) (#88, #86, #87).
• Cross-session activity is disambiguated by host, so two hosts' default
  sessions no longer collide into an indistinguishable marker (#85).
• Per-tab hover highlight; local connections are named local:session (#87).

Connection resilience

• Opt-in in-place auto-reconnect (tmux-control-auto-reconnect, default off)
  re-attaches a dropped session without losing your buffers (#104).
• Hardened SSH: keepalives and a connect timeout on every invocation, so a
  dead network surfaces fast instead of hanging (#101).
• Flock self-heal: the tiled grid re-lays-out when a session joins or dies (#105).
• Warn once when the controlled tmux has alternate-screen disabled (#103).

Rendering & tiling

• In-band tiling — the tiled view is built over the control connection
  instead of blocking SSH round-trips (#69, #83).
• Opt-in auto-heal for Eat render drift (tmux-control-auto-heal-drift,
  default off): clears and repaints a desynced pane (#81).
• Optional per-pane mode-line hide in tiled view for a gapless grid (#107).
• Skip resize round-trips when the requested size is unchanged (#82).

Navigation & UX

• Keyboard window jumps and a real scrollback-pager exit (l) (#93).
• In-place live-history scroll (wheel-up) is now the default (#94).
• Guards against acting on a session killed out from under the corner/switcher
  (#90, #91), and a quiet-window so the controller doesn't flag its own activity (#92).

Protocol correctness (bug-hunt batch)

• Seed/focus fixes, scrollback-seam dedup (no double lines on a scrolling pane),
  timer-lifecycle hygiene, and a literal-TAB-in-pane-title fix (#72, #74, #77, #78).

CI & docs

• Eat caching with a Codeberg-resilient, SHA-verified fallback fetch; fixed
  setup-emacs rate-limiting (#108, #106).
• Documented why tmux-control renders through Eat, plus a Troubleshooting
  section (#71).