v0.6.0

Changelog

• d262645: fix(selfupdate): don't nag about cosign on every update (#46) (@frahlg)
• 10b1fb5: docs(spec): B2 wallet device registry — design + plan (#47) (@frahlg)
• ebe72f5: feat: B2 wallet device registry (stateless, encrypted, blind relay) (#48) (@frahlg)
• 8260918: fix(mir-signal): forward /registry in --webroot mode (404 in production) (#49) (@frahlg)

v0.5.1

Changelog

• f057e48: fix(web): vendor @noble/hashes/pbkdf2 + importmap entry (SPA black screen) (#44) (@frahlg)
• b73df2e: feat(cli): first-run guide, identity intro, and a guided wallet migration (#45) (@frahlg)

v0.5.0

Changelog

• 6be1d17: feat(release): cosign keyless signing for checksums.txt (#34) (@frahlg)
• 2b49c7f: feat(web): mobile keyboard accessory bar for the terminal (#35) (@frahlg)
• c9cd9f2: feat(wallet): B1 wallet identity — spec + B1.0 primitives + B1.1 derivation (#36) (@frahlg)
• 4964a46: ci: run go + web test suites on every PR (the byte-identical crypto gate) (#37) (@frahlg)
• 298f996: feat(wallet): B1.2 wallet→transport binding (sign/verify), Go+JS + vector (#38) (@frahlg)
• 8d4a874: feat(wallet): B1.3 mir wallet commands + prf-rooted CLI identity (#39) (@frahlg)
• 08a5780: docs(spec): B1.4 — wallet owner_id on the wire (for review) (#40) (@frahlg)
• 700ce3d: feat: wallet owner_id on the wire (B1.4 + B1.5) (#41) (@frahlg)
• b9fb511: feat: LAN-direct — Locator seam + QUIC + mDNS (C1 + C2) + happy-eyeballs (#43) (@frahlg)

v0.4.0

Changelog

• 2f302da: feat(web): installable PWA with offline app shell (#30) (#31) (@wachtelhund)
• 5601cfd: fix(deploy): package PWA app-shell (manifest, sw.js, icons) in redeploy (#33) (@frahlg)

v0.3.0

Changelog

• 6696835: ci(release): bump actions to Node 24 (checkout@v6, setup-go@v6, goreleaser-action@v7) (#29) (@frahlg)
• 8009839: P0–P2 batch: reconnect-loop fix + observability + security + ops hardening (#32) (@frahlg)

v0.2.0

Changelog

• 364883c: ci(release): point setup-go cache at go/go.sum (@frahlg)
• 813b82b: fix(web): don't gate passkey enrollment on create-time prf.enabled (#24) (@wachtelhund)
• 19d10c7: docs(spec): north-star — wallet identity, unified node, decentralized mesh (@frahlg)
• 944bd1c: docs(plan): unified node binary (Track A1) implementation plan (@frahlg)
• c56226f: feat: unify mir + mir-agent into one symmetric mir binary (Track A1) (#25) (@frahlg)
• 8a6f797: fix(web): attach — capture signal socket open before awaiting iceServers (#26) (@frahlg)
• 4130ea3: docs(spec): web client resilience — auto-reconnect + error UX (A2) (@frahlg)
• c3ae7bb: docs(plan): web client resilience — auto-reconnect + error UX (A2) (@frahlg)
• ba13d4b: feat(web): auto-reconnect + status pill + clearer errors (A2 hardening) (#27) (@frahlg)
• a176202: feat(web): mobile input hygiene + reconnected notice (#28) (@frahlg)

v0.1.0

Changelog

• a655b82: docs: install + self-update instructions (Fredrik Ahlgren fredrik@sourceful-labs.com)
• f6d4c71: feat(agent): opt-in --auto-update with idle gating + re-exec (Fredrik Ahlgren fredrik@sourceful-labs.com)
• d0211d9: feat(cli): self-update subcommand + non-blocking startup update notice (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 74abdf3: feat(selfupdate): throttled update-check cache + non-blocking stderr notice (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 0f29fd3: feat(selfupdate): SHA256 verify + atomic swap + re-exec (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 290fe1e: feat(selfupdate): release lookup, asset resolution, semver compare (Fredrik Ahlgren fredrik@sourceful-labs.com)
• c22863b: feat(install): curl|sh installer with checksum verification + shell test (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 77aeed0: ci: GoReleaser pipeline + tag-triggered release workflow (Fredrik Ahlgren fredrik@sourceful-labs.com)
• c08ec40: feat(version): internal/version package + --version on all CLIs (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 2f37e62: docs: distribution & self-update implementation plan (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 286edc7: docs: distribution & self-update design spec (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 2dc2af6: [P2][security] deploy: verify mir-signal checksum before root install; keep SSH key out of repo (#17) (Nilsson wachtelbruno@gmail.com)
• 3883e66: [P3][security] build: require go1.26.4 toolchain to clear 2 reachable stdlib CVEs (#18) (Nilsson wachtelbruno@gmail.com)
• f855442: [P2][security] web: validate the relay URL from a pairing code (#16) (Nilsson wachtelbruno@gmail.com)
• b1cd10a: [P2][security] signal: route answers via the agent's own bound sessions (#15) (Nilsson wachtelbruno@gmail.com)
• 3269e39: [P1][security] web: gate the plaintext dev owner key to localhost only (#14) (Nilsson wachtelbruno@gmail.com)
• da7ddf6: [P1][security] signal: bound the learned agent-registration-proof store (#13) (Nilsson wachtelbruno@gmail.com)
• 7745383: [P1][security] agent: cap concurrent pre-auth attach handshakes (#12) (Nilsson wachtelbruno@gmail.com)
• 4622d57: [P1][security] signal: tighten CSP connect-src to 'self' by default (#11) (Nilsson wachtelbruno@gmail.com)
• 95d967c: rebrand: terminal-relay → Miranda (mir / mir-agent / mir-signal) (#10) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• be7f1e8: feat: multi-session tmux overview on the mobile UI (#9) (Mira Voss mira@sourceful-labs.com)
• 6ad382d: feat: robust tmux window control via FrameControl (agent runs the command) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 327327f: fix(web): window switch/rename/kill use CR (not LF); bottom-corner gap (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 3cfdcd7: test(turn): expiry-window assertion tracks turnTTL (not hardcoded 10m) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 75463d1: test(turn): assert json ttl tracks turnTTL (was hardcoded 600) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 54720cc: fix(turn): raise ephemeral cred TTL 10m -> 12h (it must outlast a session) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• c786b51: fix(tr-signal): drop Read/WriteTimeout — they cut the long-lived WebSockets (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 633bd89: docs(client): note CLI window-overview parity is tmux-native (Fredrik Ahlgren fredrik@sourceful-labs.com)
• eeef510: feat(web): tmux window overview — clickable tab strip + grid (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 40d4b5e: feat(windows): agent reports tmux window snapshots (FrameWindows protocol) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 9f3e727: feat(web): dynamic terminal sizing (fit to viewport) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 3cbe16d: fix(agent): set TERM in the PTY (fixes "terminal does not support clear") (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 827c2e2: feat(web): multiple sessions per machine via tmux windows (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 0e246c6: feat(#1): serve HTTPS on the origin for Cloudflare Full (strict) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 346132b: feat(web): mobile terminal UX — topbar + quick machine switcher (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 14c7fc9: feat(deploy): macOS launchd installer for an always-on agent (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 6589010: docs: plan-6b RP-ID note -> term.sourceful-labs.net (matches #6) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• d066fc8: fix(csp): allow the SPA's inline import map via a per-request nonce (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 641d4d2: fix(signal): require agent registration proof (Fredrik Ahlgren fredrik@sourceful-labs.com)
• cff8cae: fix(signal): bound live relay attack surface (#5) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• a44cd29: fix(web): harden pairing trust boundary (#6) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• c31447f: docs(security): add live hardening runbook (#8) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 007db30: fix(deploy): TURN url -> origin IP (Cloudflare doesn't proxy UDP/3478) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 681dcdb: fix(tr-signal): route /turn-credentials to the signal server under --webroot (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 334ec8e: feat: TURN for symmetric-NAT / cellular — ephemeral creds via signaling (Fredrik Ahlgren fredrik@sourceful-labs.com)
• bf34aaa: fix(web): discoverable passkey login (surface the synced passkey directly) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• af5804a: feat(agent): hot-reload newly-paired owners (no restart after pairing) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 8e71010: fix(web): log-in-first passkey gate + in-app QR scanner (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 50d4d18: feat(web): passkey identity (WebAuthn prf) with dev fallback (Fredrik Ahlgren fredrik@sourceful-labs.com)
• ede630f: fix(agent): serve ALL paired owners, not just the first (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 52bc84f: fix(deploy): Cache-Control: no-store on the SPA so the CDN serves fresh code (Fredrik Ahlgren fredrik@sourceful-labs.com)
• ffa7e10: feat: QR pairing — scan to open the app and auto-pair (no copying) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 9e3bf37: feat(deploy): serve the SPA from tr-signal (--webroot) at term.sourceful-labs.net (Fredrik Ahlgren fredrik@sourceful-labs.com)
• ff519bd: feat(agent): auto-reconnect to signaling with backoff (stay online) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• fe38ba5: feat(web): vendor @noble + xterm locally — no crypto from a CDN at runtime (Fredrik Ahlgren fredrik@sourceful-labs.com)
• bed4a0d: feat(web): milestone 3 — in-browser pairing + machine list UI (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 59ba0c3: fix(web): cap ICE gathering wait; deploy: one-line redeploy via SSH alias (Fredrik Ahlgren fredrik@sourceful-labs.com)
• f35a071: feat(web): live terminal in a browser tab — milestone 2 (+ signal CORS fix) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 00528f5: feat(web): browser SPA foundation — crypto self-test passes in real Chrome (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 4f097ce: docs: capture the naming exploration (deferred; leaning Cantrip) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 127f7be: fix(pairing): validate pairing-code token in decodeCode like Go (fail closed) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 4c93314: feat(web): JS NNpsk0 pairing + SAS, certified against Go vectors (Fredrik Ahlgren fredrik@sourceful-labs.com)
• cc82d72: test(pairing): deterministic Go NNpsk0 + code/sas interop vectors (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 4bc3b26: docs: Plan 6a — browser pairing crypto (JS NNpsk0 + SAS), Go-interop certified (Fredrik Ahl...