Termscape v0.4.4-selfhost.2

Claude Science panels (#19) plus fixes for the items deferred in v0.4.4-selfhost.1 (#22). Upstream's feed, announcements and telemetry stay off.

• Claude Science panels (#19, by @CountryTk). Opens the separately installed Claude Science app from the canvas and kanban board, with shared service controls (start or reuse, reconnect, redacted logs, explicit stop). The Server Edition reaches it through an authenticated HTTP/WebSocket proxy and an iframe; desktop uses a webview. Machine-wide panel permission is off by default and can be revoked in Settings → Agents. Science uses its own Claude sign-in.

• Deleting a managed Pi account sticks. Termscape could recreate a just-deleted Pi account folder as an empty, logged-out account when the deletion raced its integration upkeep: a remove landing mid-update, the Server Edition sharing the same data, or Termscape launched from inside a managed Pi terminal. Writes into a managed account folder can no longer create the folder itself.

• Codex API-key logins work on macOS and Linux. A managed Codex account signed in with codex login --api-key used to stay "pending" forever. One credential rule now applies everywhere: a real access token or API key counts, while an empty file, a blank token or an id_token alone does not. That includes accounts on SSH hosts, where the check runs on the host and only yes/no comes back.

• A managed Codex account can't borrow another login. If its auth.json is swapped for a symlink, or holds no credential, it's not signed in, and Codex's own daemon is no longer asked to vouch for it.

Built locally from main 8d78ecf with TERMSCAPE_UNGATE=1, Developer ID signed, app and dmg notarized, dmg stapled.

Termscape v0.4.4-selfhost.1

Upstream nodeterm main (0.4.4, unreleased upstream) merged on top of v0.4.2-selfhost.1. Upstream's update feed, announcements and telemetry stay off.

• Upstream v0.4.3 + main (342 commits, #21). Includes:
  • a privacy fix: after a short hold-to-talk tap the microphone could stay open and keep typing what it heard into the selected terminal for ~10 minutes
  • only the pane's foreground Claude reports status for a node; Codex hooks matched by thread when several share one Codex daemon
  • Codex usage backs off after a 429 and keeps the last good numbers
  • terminal scrollback stays in sync after screen clears; SSH project nodes never spawn locally
  • Cursor Agent as a built-in agent, a run node (VS Code launch.json "Run Without Debugging"), a Simulator node, pause a whole project or group
  • per-project "don't ask again" for agent actions, kanban cards get the node's session actions, arrange by lineage, sloppy focus
• Agents now ask before Termscape writes into their config. Upstream's consent step replaces the old automatic hook and skill installs. In the fork it also covers managed Pi accounts: nothing is written unless Pi is enabled, and turning an agent off removes exactly what Termscape added.
• Fork fixes:
  • CI tests no longer go red on dates after 2026-10-13: upstream's tests ran on the real clock past a hard-coded node-identity cutoff date (#20)
  • SSH hosts with Pi get both canvas skills
  • on hosts with no Codex app-server (Windows), a Codex login needs a real token
  • new macOS-visible strings say Termscape
  • upstream's download-badge cron and update-mirror check are not carried

Built locally from main fb53e2a with TERMSCAPE_UNGATE=1, Developer ID signed, app and dmg notarized, dmg stapled.

Termscape v0.4.2-selfhost.1

Upstream v0.4.2 merged, and the fork no longer listens to upstream's backend.

• No upstream notices, no upstream telemetry (#17). Upstream's update-check feed had started marking every selfhost build "Update required (minimum 0.4.2)" with a card that could not be dismissed, and its banners are upstream's announcements. That feed and the opt-out usage ping are both switched off in code; Settings → Privacy says so. "Download manually" now points at this repository's releases.
• Upstream v0.4.2 (824 commits since v0.3.16). Includes:
  • a fix for a project switch that could write one project's nodes into another
  • the kanban board can start agent runs
  • ⌘M chat for Gemini and Codex
  • much better file-path links in terminal output, plus a file-manager node
  • Antigravity as an agent
  • dev-server port forwarding
  • Open recent
  • live links
• Fork features kept: Pi, the canvas-control view rules, the launch consent gate (now also on nodeterm run), Codex account identity, Liquid Glass default.
• Hardening found while merging:
  • a read-only live-link viewer can no longer type into the host shell
  • managed Pi accounts are host-only on the Server Edition
  • starting a queued node in a background project no longer drops unsaved edits on screen
  • usage numbers no longer leak between organisations on one email
• Dock badge ignores deleted nodes (#18). The unread count included sessions whose nodes no longer exist anywhere, so the badge could show a number nothing on screen could clear.

Built locally with TERMSCAPE_UNGATE=1, Developer ID signed, app and dmg notarized, dmg stapled.

Termscape v0.3.16-selfhost.3

Codex accounts release on top of v0.3.16-selfhost.2.

• Every Codex account shows up (#15). On a Homebrew or npm Codex install, a managed Codex account never finished logging in: the app read its identity only through codex app-server daemon start, which runs only on the standalone Codex build. Such accounts stayed pending and were hidden from the usage popover, the pickers and the phone. Identity now comes from the account's own auth.json. Accounts that were stuck resolve the next time Settings → Accounts is opened.
• Switch Codex account works without the daemon. Moving a running Codex conversation to another account now finds the conversation file on disk.
• Codex usage rows are account rows. Each is headed by the account with a "Codex" tag, and has "Use for new sessions" and "Move N sessions" like the Claude rows.
• Default Codex account per project (Project Settings, the usage popover, ✓ in the New Codex menu). Kept on this machine only, never in the shared project file.

Built locally with TERMSCAPE_UNGATE=1, Developer ID signed, app and dmg notarized, dmg stapled.

Termscape v0.3.16-selfhost.2

Appearance release on top of v0.3.16-selfhost.1.

• Liquid Glass is the out-of-box appearance (#14). Fresh installs start on Liquid Glass over the Dusk gradient wallpaper, never glass over plain black. Existing settings keep their own appearance and wallpaper: a file that never stored a wallpaper and isn't on glass keeps "none", and a glass user who picked "None" keeps it.
• CI now runs CodeQL and dependency review again (#13, repo-only, not in the app).

Built locally with TERMSCAPE_UNGATE=1, Developer ID signed, app and dmg notarized, dmg stapled.

Termscape v0.3.16-selfhost.1

First release from the upstream nodeterm v0.3.16 merge (415 upstream commits), plus the Pi harness and a swipe-navigation fix.

• Upstream v0.3.16 (#12): Liquid Glass chrome and wallpaper, the reworked machine-grouped Accounts panel, the ⌘M panel, upstream's running-node Claude account switch. The fork's own copy-first account switcher is retired in favour of upstream's.
• Pi coding agent (#10): Pi as a builtin harness next to Claude Code and Codex, with managed Pi accounts (one config dir per account), a per-provider account chip, open-agent --agent pi on the Server Edition, and a billing note in Settings → Accounts.
• Canvas swipes no longer trigger browser back navigation (#11).
• Kept from the fork: go-to-node frames clear of the pinned sidebar.
• Deps: Electron 42.11.3, electron-builder 26.16.1, @xyflow/react 12.11.6.

Built locally with TERMSCAPE_UNGATE=1, Developer ID signed, notarized and stapled. Gate: Codex + Gemini panel, blind security pass, Trivy. CI green on macOS/Linux and Windows.

Termscape v0.3.7-selfhost.2

Fix release on top of v0.3.7-selfhost.1.

• Go to node frames the node clear of the pinned sessions sidebar again. Clicking a session in the sidebar (or any focus path: notification click, ⌘K jump, minimap double-click) centres the node in the region the pinned sidebar leaves free. The v0.3.7 upstream merge had adopted upstream's whole-pane centring, which parks part of the terminal behind the panel. With nothing pinned the behaviour is unchanged; a maximized node is unchanged.

Built locally with TERMSCAPE_UNGATE=1, Developer ID signed, notarized and stapled. Gate: Codex + Gemini panel, blind security pass, Trivy; the docblock contradiction both reviewers found is fixed in the same PR.

Termscape v0.3.7-selfhost.1

First release cut from the eneskirca/nodeterm v0.3.7 merge (359 upstream commits since the last merge base). Built locally with TERMSCAPE_UNGATE=1, Developer ID signed, notarized and stapled (app and dmg). One arm64 dmg.

From upstream v0.3.5 → v0.3.7 (PR #6)

• SSH projects: ControlMaster published before its setup chain and pre-warmed at boot, one remote session-list read per project switch, capped exec channels per master. Measured upstream: 14 refusals + 4 resets per 12-terminal switch → 3 + 0.
• Dead agent CLI detection with one-click resume; cold-restore falls back to a fresh launch when the transcript is gone.
• Canvas control: bulk close --node a,b,c, confirm dialogs that expire with the request, per-project durable "don't ask again", settings and color verbs. Headless canvas control on the Server Edition.
• Named canvas layouts; window size/position memory; observed + linked Claude accounts; per-account ~/.claude/skills sharing; notch HUD placement (side + vertical offset); Chrome-style tab bar with a height setting; decorative animations pause while the window is idle; file-manager node; kanban global swimlanes; edge model with ropes.

Fork-side (PR #5, PR #6)

• Settings → Accounts: the system account row has "Sign in / switch" (one process-wide wait; a second click is refused).
• A close whose targets come from ropes (close --spawned) is never waived, whatever waiver exists.
• Long --prompt values are spilled to a file again at open-agent / spawn-team / verify; one off-screen verb table for routing and the agent help.
• Everything the fork keeps: the ungate build flag, Termscape branding, canvas control never moves the user's view, spawn placement, consent-bound held launches, cross-process settings lock, peer accounts on the Server Edition.

Verification

12,377 tests, 0 failed (baseline before the merge: 10,699 / 0). Consort gate: Codex + Gemini panel on the merge resolution, blind security side-pass, Trivy. Not exercised in Electron before this build: smoke-test goToNode, spawn placement, the tab bar and the notch HUD after installing.

Termscape v0.3.4-selfhost.22

A stray file drop can't navigate the window away anymore

Follow-up to v0.3.4-selfhost.21, closing the other half of that fix. The whole-window guard that stops a file dropped outside a terminal from navigating the window to the dropped file:// (which unloads your whole workspace) re-checked the drag's file flag on every tick. macOS/Electron report that flag intermittently mid-drag, so a drop whose tick came back empty slipped past the guard.

• The guard now latches. It arms on the first tick that says the drag carries files and keeps preventing the navigation for the rest of the drag, then clears between drags. A non-file drag (dragging selected text into an input or editor) is never touched.
• Canvas image and folder drops are more reliable too. Because the guard now arms the window as a drop target for the whole drag, an image or folder dropped on the canvas lands even when a dragover tick flaked.

Under the hood the guard's reset runs in the capture phase so a terminal node handling its own drop can't hide it and leave the guard stuck. Verified across three cross-vendor review rounds and 10,691 tests.

sha256 Termscape-0.3.4-arm64.dmg: de622ffdf59cd8e07abdb1817d245eb2e5dda2d3860ea11b959c63cbf8653ebb

Termscape v0.3.4-selfhost.21

A file dropped onto a terminal lands wherever you drop it

Dragging an image or file from Finder onto a terminal lit up the whole node body, but a drop released over the upper output area could wedge: the blue overlay stayed on and nothing pasted, while a drop over the input line worked. So the droppable area quietly disagreed with the area that looked droppable.

• The whole terminal body now accepts the drop. The drop zone arms on dragenter (which fires the instant the drag crosses any edge into the body), not only on the first dragover tick. macOS/Electron report the drag's file flag intermittently mid-drag, and a blind tick before the zone latched could reject the drop; a rejected drop from an external app (Finder) fires neither drop nor a resetting dragleave, so the overlay wedged with nothing delivered. Arming on entry closes that window.
• Fixed on both terminal surfaces: the canvas node and the kanban card modal's co-attached terminal.

Known and deliberately left for a separate change: the canvas's own image/folder drop zones and the window-level navigation guard still re-check the file flag per tick without the same latch.

sha256 Termscape-0.3.4-arm64.dmg: 7fb99754037526b5fb4732bcd012b7217813505cd26c97198103c3df38745262