Skip to content

v0.9.38

Choose a tag to compare

View all tags
@github-actions github-actions released this 25 Jul 16:12
v0.9.38
c5aa3d2

0.9.38

  • fix: A link in terminal output can no longer point the preview at another machine. A path starting with two slashes (//somehost/share/report.html) names a network location, and on Windows opening one makes the system contact that host — handing it your Windows account name and password hash before anything is shown. Since terminal output can come from a build script, a log line or an agent, such targets are now refused outright, both for the preview window and for the markdown reader
  • fix: A pane title can no longer be tricked into capturing what you type into another program. Panes learn the name of the running command from a private marker your local shell prints at each prompt. Any program that writes to the terminal — including the remote side of an SSH session — could print that same marker and make the next line you typed become the pane title (and, with notifications on, the text of a system notification that macOS keeps in Notification Center). The marker now carries a secret generated fresh at every app start, which terminal output cannot know
  • fix: Secrets on a command line no longer end up in the pane title or in notifications. export GITHUB_TOKEN=…, PGPASSWORD=… psql or --api-key … now show as [versteckt] in the title, the same way prompts to Claude and Codex have always been treated
  • fix: Saved terminal history and the app's own state file are now readable only by your account. They were written with the system default, which on a shared machine let other local accounts read whatever had scrolled through your terminals. If you would rather not keep terminal history at all, Settings › Session still has the switch
  • fix: A pasted command line with an unterminated quote followed by many backslashes no longer freezes the window. The title parser needed exponentially more time for each additional character — 26 of them already blocked the app for one and a half seconds
  • change: Pages shown in the preview panel are refused every browser permission (location, notifications, clipboard reading). The app itself needs none of them, so only embedded pages could ask — and previously nothing stood in the way of them being granted
Assets 13
Loading