v0.1.0

Changelog

• a655b82: docs: install + self-update instructions (Fredrik Ahlgren fredrik@sourceful-labs.com)
• f6d4c71: feat(agent): opt-in --auto-update with idle gating + re-exec (Fredrik Ahlgren fredrik@sourceful-labs.com)
• d0211d9: feat(cli): self-update subcommand + non-blocking startup update notice (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 74abdf3: feat(selfupdate): throttled update-check cache + non-blocking stderr notice (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 0f29fd3: feat(selfupdate): SHA256 verify + atomic swap + re-exec (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 290fe1e: feat(selfupdate): release lookup, asset resolution, semver compare (Fredrik Ahlgren fredrik@sourceful-labs.com)
• c22863b: feat(install): curl|sh installer with checksum verification + shell test (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 77aeed0: ci: GoReleaser pipeline + tag-triggered release workflow (Fredrik Ahlgren fredrik@sourceful-labs.com)
• c08ec40: feat(version): internal/version package + --version on all CLIs (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 2f37e62: docs: distribution & self-update implementation plan (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 286edc7: docs: distribution & self-update design spec (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 2dc2af6: [P2][security] deploy: verify mir-signal checksum before root install; keep SSH key out of repo (#17) (Nilsson wachtelbruno@gmail.com)
• 3883e66: [P3][security] build: require go1.26.4 toolchain to clear 2 reachable stdlib CVEs (#18) (Nilsson wachtelbruno@gmail.com)
• f855442: [P2][security] web: validate the relay URL from a pairing code (#16) (Nilsson wachtelbruno@gmail.com)
• b1cd10a: [P2][security] signal: route answers via the agent's own bound sessions (#15) (Nilsson wachtelbruno@gmail.com)
• 3269e39: [P1][security] web: gate the plaintext dev owner key to localhost only (#14) (Nilsson wachtelbruno@gmail.com)
• da7ddf6: [P1][security] signal: bound the learned agent-registration-proof store (#13) (Nilsson wachtelbruno@gmail.com)
• 7745383: [P1][security] agent: cap concurrent pre-auth attach handshakes (#12) (Nilsson wachtelbruno@gmail.com)
• 4622d57: [P1][security] signal: tighten CSP connect-src to 'self' by default (#11) (Nilsson wachtelbruno@gmail.com)
• 95d967c: rebrand: terminal-relay → Miranda (mir / mir-agent / mir-signal) (#10) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• be7f1e8: feat: multi-session tmux overview on the mobile UI (#9) (Mira Voss mira@sourceful-labs.com)
• 6ad382d: feat: robust tmux window control via FrameControl (agent runs the command) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 327327f: fix(web): window switch/rename/kill use CR (not LF); bottom-corner gap (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 3cfdcd7: test(turn): expiry-window assertion tracks turnTTL (not hardcoded 10m) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 75463d1: test(turn): assert json ttl tracks turnTTL (was hardcoded 600) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 54720cc: fix(turn): raise ephemeral cred TTL 10m -> 12h (it must outlast a session) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• c786b51: fix(tr-signal): drop Read/WriteTimeout — they cut the long-lived WebSockets (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 633bd89: docs(client): note CLI window-overview parity is tmux-native (Fredrik Ahlgren fredrik@sourceful-labs.com)
• eeef510: feat(web): tmux window overview — clickable tab strip + grid (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 40d4b5e: feat(windows): agent reports tmux window snapshots (FrameWindows protocol) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 9f3e727: feat(web): dynamic terminal sizing (fit to viewport) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 3cbe16d: fix(agent): set TERM in the PTY (fixes "terminal does not support clear") (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 827c2e2: feat(web): multiple sessions per machine via tmux windows (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 0e246c6: feat(#1): serve HTTPS on the origin for Cloudflare Full (strict) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 346132b: feat(web): mobile terminal UX — topbar + quick machine switcher (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 14c7fc9: feat(deploy): macOS launchd installer for an always-on agent (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 6589010: docs: plan-6b RP-ID note -> term.sourceful-labs.net (matches #6) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• d066fc8: fix(csp): allow the SPA's inline import map via a per-request nonce (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 641d4d2: fix(signal): require agent registration proof (Fredrik Ahlgren fredrik@sourceful-labs.com)
• cff8cae: fix(signal): bound live relay attack surface (#5) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• a44cd29: fix(web): harden pairing trust boundary (#6) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• c31447f: docs(security): add live hardening runbook (#8) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 007db30: fix(deploy): TURN url -> origin IP (Cloudflare doesn't proxy UDP/3478) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 681dcdb: fix(tr-signal): route /turn-credentials to the signal server under --webroot (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 334ec8e: feat: TURN for symmetric-NAT / cellular — ephemeral creds via signaling (Fredrik Ahlgren fredrik@sourceful-labs.com)
• bf34aaa: fix(web): discoverable passkey login (surface the synced passkey directly) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• af5804a: feat(agent): hot-reload newly-paired owners (no restart after pairing) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 8e71010: fix(web): log-in-first passkey gate + in-app QR scanner (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 50d4d18: feat(web): passkey identity (WebAuthn prf) with dev fallback (Fredrik Ahlgren fredrik@sourceful-labs.com)
• ede630f: fix(agent): serve ALL paired owners, not just the first (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 52bc84f: fix(deploy): Cache-Control: no-store on the SPA so the CDN serves fresh code (Fredrik Ahlgren fredrik@sourceful-labs.com)
• ffa7e10: feat: QR pairing — scan to open the app and auto-pair (no copying) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 9e3bf37: feat(deploy): serve the SPA from tr-signal (--webroot) at term.sourceful-labs.net (Fredrik Ahlgren fredrik@sourceful-labs.com)
• ff519bd: feat(agent): auto-reconnect to signaling with backoff (stay online) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• fe38ba5: feat(web): vendor @noble + xterm locally — no crypto from a CDN at runtime (Fredrik Ahlgren fredrik@sourceful-labs.com)
• bed4a0d: feat(web): milestone 3 — in-browser pairing + machine list UI (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 59ba0c3: fix(web): cap ICE gathering wait; deploy: one-line redeploy via SSH alias (Fredrik Ahlgren fredrik@sourceful-labs.com)
• f35a071: feat(web): live terminal in a browser tab — milestone 2 (+ signal CORS fix) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 00528f5: feat(web): browser SPA foundation — crypto self-test passes in real Chrome (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 4f097ce: docs: capture the naming exploration (deferred; leaning Cantrip) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 127f7be: fix(pairing): validate pairing-code token in decodeCode like Go (fail closed) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 4c93314: feat(web): JS NNpsk0 pairing + SAS, certified against Go vectors (Fredrik Ahlgren fredrik@sourceful-labs.com)
• cc82d72: test(pairing): deterministic Go NNpsk0 + code/sas interop vectors (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 4bc3b26: docs: Plan 6a — browser pairing crypto (JS NNpsk0 + SAS), Go-interop certified (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 389d7a0: docs: public README (story + the Why, Hitchhiker flavour) + MIT LICENSE (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 8f62578: feat(pairing): safety number (SAS) — visible MITM detection (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 4861b5d: docs: SECURITY.md — the verifiable "don't trust the relay" model (Fredrik Ahlgren fredrik@sourceful-labs.com)
• bb91783: feat: bake in defaults — our relay + STUN, zero-flag UX (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 512502b: deploy: tr-signal on AWS Lightsail (Stockholm) + Cloudflare docs (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 1c38d5f: docs: mark Plan 5 (one-tap pairing) done; browser is Plan 6 (Fredrik Ahlgren fredrik@sourceful-labs.com)
• d0960ff: fix(signal): stop non-driving /pair handler leaking goroutine + hijacked socket (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 05c2db7: feat(trm): trm pair ; E2E pairing through the signaling server (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 62cc744cbb943c45cd39d7608281099d2336c9ca: feat(agent): tr-agent pair — token + QR + NNpsk0 responder (Fredrik Ahlgren fredrik@sourceful-labs.com)
• c074c26c241aa113982b45e574119dde13e82383: feat(signal): blind /pair room bridge (rendezvous by roomID) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 07c992adc534809619998b5463dafd487a427546: feat(pairing): websocket -> MsgConn adapter + DialPair (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 6d0e09f5d98d2c0dbeb9fab29f3260d2b1922342: feat(pairing): NNpsk0 key-exchange handshake (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 7e51e1b0283eec4c69b22128034fc19ee2fbfeb9: feat(pairing): pairing code + domain-separated room/psk derivation (Fredrik Ahlgren fredrik@sourceful-labs.com)
• d415967ef31be91f8168a6aeea7335879b5bd794: docs: Plan 5 — one-tap pairing (token/QR, NNpsk0) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 7c3d0b818e275483c19b453a01034fb657a8410b: fix(mux): force tmux repaint on focus switch (resize wiggle) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• c8bba34190c3a0615723666d05c88ca4ea6ee07c: feat(trm): Ctrl-O switch prefix (configurable via --prefix); trm branding in TUI (Fredrik Ahlgren fredrik@sourceful-labs.com)
• d9e967b47ec2247bb93dcf8e041c60148a4f0d97: rename: tr CLI -> trm (avoid POSIX tr collision) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• d8b4731a9a690c0fc0c285027c1b27e9c2079a87: chore: gitignore .claude/ and .DS_Store (Fredrik Ahlgren fredrik@sourceful-labs.com)
• d8748587a462c2e64c9c74e77f6cfdb9692c01b2: feat(ice): opt-in TURN fallback (Noise keeps the relay blind) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• d79c6d13276345bee8c377a4797300dcea2b0eed: feat(netsim): Docker NAT-traversal harness + ICE debug (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 3580723eabb65a5c74815b0041f410c9c49a23e8: feat(cli): tr run — non-interactive command execution (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 046cc75b82f77c9f61204a0e0f8f61db29e7e004: feat(cli): --stun flag on tr attach and tr-agent up (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 0c99c449b1a05c09135485da0bf31851a7d73857: docs: mark Plan 4 + 4b done in roadmap (CLI client + multiplexer) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 4c7ac3ebbce7bf43ee43d8d63aea407ac3c99c90: fix(client/mux): atomic focus advance + non-blocking Run shutdown (Fredrik Ahlgren fredrik@sourceful-labs.com)
• d3f0f12d99fab56e72c0057d1ce888deb36072f7: test(client): E2E mux over two real shells; docs (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 0bdb87fed878203728c38943427085367666f909: feat(client): raw-mode mux wiring; tr attach accepts multiple machines (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 7b9020fbcaf122d24f54223eda4e8b27ce6423bf: feat(client): cross-machine focus-switcher mux core (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 45f49a0be654834217ca3ebfe2fd24b0aaf420a6: fix(client): serialize per-session encrypt (Noise nonce is not concurrency-safe) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• a1d23252c8be53590a7016e3851347b26b9ca5cc: docs: Plan 4b — multi-machine focus-switcher (tr mux) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 45cdfff49dbda1e87c6c61134d059fb7ff3e5406: fix(client): AddMachine must not destroy pin set on corrupt machines.json (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 6c5e1841ea872904fc0fc92a5c6f9dcdac46fa07: test(client): local E2E — tr drives a real shell over P2P; build tr Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 5dfacb1ad8efa9e848b40bcfaa4c8eb63c427933: feat(client): tr binary (keygen | add-machine | list | attach) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 5d0d106b052d752f9d3beb5fe48f0c564b84cf89: feat(client): raw-mode TTY wiring (x/term + SIGWINCH) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 96bb9b91ec66ba2e3388ae7213737a3efb2dda00: feat(client): Attach (signaling + offer + Noise initiator) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 8e87471cc637adfc3651ad0945ba0e93442cb468: feat(client): terminal bridge core (stdin/stdout <-> Noise frames) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• ef176db9abcb05ad049056e8252c2c41cd5a5eec: feat(client): owner keystore + known-machines registry (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 8674c3a87dcc5d269fd6b5387b1f3118325ef295: docs: Plan 4 — tr CLI client (single-machine attach) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 4f81a06f90fdc83c5ac4047b692b59a8346580c5: docs: capture cross-machine multiplexer vision (CLI-first) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• e28905308aed857b9723a4695878c40f1ff54e49: chore: gitignore bin/ build artifacts (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 7ba4f07d378e4c585ecaee0d645d2a42de796275: fix(agent): reap PTY child, decouple session/attach teardown, harden config perms (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 8c4583a650be2eb19601014d5c3e1e10d40d060b: feat: make dev + agent docs for the local loop (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 2099408747ff80cea1f04d3fdabb78446434a0ea: test(agent): local E2E — real shell over P2P through tr-signal (Fredrik Ahlgren fredrik@sourceful-labs.com)
• edb7a6f342ce85a19e490be254bf0be4ead1f82f: feat(agent): tr-agent binary (enroll | pair-dev | up) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• da9daa3c8796858b171c93d585616db0bfa916c4: feat(agent): runtime loop (signaling -> answerer -> responder -> shell) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• c03461fe68e35e2739187ee247a6612b0affdea5: feat(agent): frame-protocol session bridge (Noise <-> shell) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 24481099b01e0ea1086b232c9297738fa8b55b89: feat(agent): PTY launcher (creack/pty) with resize (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 26e4180a4e158ffbec2df4ca2d61286c6dbd777f: feat(agent): keystore (host key, machine id, pinned owners) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• dd9d3e1ae745f9d06bd3e0e55b5a3ee8d3fab66b: feat(peer): in-memory MsgConn pipe for tests + creack/pty dep (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 999d7145dbc338a4c96ed0de4c8e6999f5d2b977: docs: Plan 3 — agent (real shell over P2P, locally testable) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 198ae3e35e40236b2c6892c81c61d022b9914d3e: fix(signal): tie browser session lifecycle to its agent (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 6e9fc9ad330175b9eda3bb993759588211c6fca3: feat(signal): tr-signal binary + docs (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 4e085ea3285072b364389395d85cb1b0b92ff885: test(signal): full P2P spike through the signaling server (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 3d4151354ecc90b23390041008b6b60e6fbfa690: test(peer): pion P2P DataChannel + Noise KK echo (WebRTC de-risk) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 812dc9cdb58dd4f4dc69b2616395a77d6d6445fb: feat(peer): pion DataChannel MsgConn + Noise KK handshake driver (Fredrik Ahlgren fredrik@sourceful-labs.com)
• e0eaeb475a409427f6f8e8488d7bed7bdb45c69b: feat(signal): SDP broker (agent register + attach routing) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• b833101d42bc928d635c3c352297995cfcb031c0: feat(signal): signaling message protocol (Fredrik Ahlgren fredrik@sourceful-labs.com)
• e2d96734be6b41cf82d0e9bb785ac81155bb1faf: chore(go): add pion/webrtc + coder/websocket (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 826b0dcf24ec7f6dacdf997d2e504c504283ff31: docs: pivot data plane to strict P2P WebRTC (no tunneling relay) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 047ea65335fad89955574c2b071eb542626d41ab: test(noise): harden interop gate per adversarial review (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 7fba15439a243dee42b64993566bea8d91bf4b8f: docs: README + CLAUDE.md for the crypto core (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 289a3b3557fd8849abec0c7593391241fcf2fddd: test(web): certify JS<->Go Noise_KK byte-for-byte interop (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 584cbc0b2d1f7e5bab316a89a0e456512dab1616: feat(web): owner-key derivation matching the Go reference (Fredrik Ahlgren fredrik@sourceful-labs.com)
• ca45ea536384c021b24dda49011ee9e99eaa031f: feat(web): frame codec mirroring the Go codec (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 6d15449854500243790e1a7d56e163761a07eb4d: feat(web): from-spec Noise_KK handshake on @noble (Fredrik Ahlgren fredrik@sourceful-labs.com)
• d59735e6749bb483a132182998af5bac1c1e53fa: chore(web): scaffold JS package with @noble deps (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 276009a5125a0dfd9897426acedad60a234beec8: test(noise): deterministic cross-language interop vectors (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 319bcd74e7c670600534af169aca2a8a024f1d4d: feat(identity): prf -> X25519 owner-key derivation (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 8c69cf14b2760685ceb66e07303f3abdb358d273: feat(noise): typed frame codec (DATA/RESIZE/HELLO) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• eb93586765c0303ce46323145927bf84091d3f35: feat(noise): Noise_KK handshake wrapper + transport session (Fredrik Ahlgren fredrik@sourceful-labs.com)
• a251378e00230d1118ffa302bfde18ac85b583a0: feat(noise): X25519 static keypair helpers (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 354fbce997c37915ac7c0abf39e87314e6b65b15: chore(go): init module with flynn/noise + x/crypto (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 065a26e151f5bc90e74f99c2951341e03425644c: docs: implementation roadmap + Plan 1 (crypto core + interop) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 31c432ef7f0d32e666f33355779027b8006fd031: docs: pin PoC domains (srcfl.xyz now, passterm.io later) (Fredrik Ahlgren fredrik@sourceful-labs.com)
• 8ebb98673d04e5b886c98ba19656d4a01c990c4d: docs: add terminal-relay v1 design spec (Fredrik Ahlgren fredrik@sourceful-labs.com)