Complete the tlbx repository cutover

What's Changed

• Canonicalized release, source, security, documentation, and installer links on the renamed tlbx-ai/tlbx repository
• Moved new voice and transcription traffic to api.tlbx.ai while preserving midterm.tlbx.ai as a compatibility proxy for older clients
• Updated the visible command-line and GitHub artwork to the tlbx name without changing executable, service, certificate, settings, or session identities
• Kept the former MidTerm repository coordinate as an explicit updater fallback and the old GitHub Pages installer paths as durable compatibility shims
• Serialized the small in-process integration suite so Program environment setup cannot race its environment-contract test

Introduce the tlbx transition bridge

What's Changed

• Renamed the user-facing application and PWA surface to tlbx while preserving executable, service, settings, session, and manifest identities
• Added allowlisted repository discovery through get.tlbx.ai with automatic fallback to the legacy GitHub coordinate
• Moved native install and uninstall entry points to get.tlbx.ai while retaining the existing package and release artifact names
• Repositioned the README and npm launcher around browser-native persistent AI agent work, with npx explicitly kept as the trial fallback

Harden terminal output isolation and recovery

What's Changed

• Added per-session Repair display plus the authenticated redraw API and mt_redraw/Mt-Redraw helpers; a serialized PTY row pulse repaints the foreground TUI while browser geometry stays canonical.
• Added mt_run_isolated/Mt-RunIsolated for browsers, profilers, daemons, and watchers with exact argv, closed stdin, separate stdout/stderr artifacts, and nohup lifecycle isolation on macOS/Linux.
• Hardened detached debug launches so delayed native diagnostics cannot inherit and corrupt an agent terminal.

Harden public release integrity

What's Changed

• Made stable publication atomic: draft until tests, six nonzero platform assets, and npm publication succeed
• Replaced stale public documentation with a concise current feature, architecture, security, and audit corpus
• Marked duplicate GitHub Pages content noindex with the canonical product site
• Added the unofficial midterm-gtk community client and preserved a focused capture runbook

Harden unauthenticated asset routing

What's Changed

• Restricted unauthenticated static assets to explicit owned files and directories
• Blocked extension-suffixed protected API and upload paths before endpoint routing
• Restored the pre-login certificate bootstrap and flattened PWA icon aliases

Harden remote control contracts

What's Changed

• Protect certificate regeneration and host paths behind authentication
• Keep only read-only certificate bootstrap routes public
• Fix Bash mt_bootstrap slash-command JSON and remove the retired Operator capability flag

Repair stable distribution and discovery

What's Changed

• Fixed the stable .NET release gate by reusing the built frontend artifact, including the Mobile Device Bridge archive, while removing duplicate Node setup work
• Reframed README and npm discovery around MidTerm as a self-hosted browser control station for remote AI coding agents, with npx explicitly kept as the quick-trial fallback
• Removed stale marketing claims and marked historical feature inventories clearly so public product truth points to the current website

Restore native xterm selection copy

What's Changed

• Copies selected xterm text through the synchronous browser copy event so Ctrl+C works even when the local HTTPS certificate is not yet trusted
• Recognizes Cmd+C as the native macOS copy shortcut while preserving Ctrl+C as SIGINT when no terminal selection exists
• Keeps terminal selections intact after copy and covers Windows, Unix, and macOS shortcut resolution with focused behavior tests

Keep terminal links in new tabs

What's Changed

• Open xterm-recognized HTTP and HTTPS URLs through native new-tab links so the active MidTerm terminal is never replaced.
• Consume terminal link activation and isolate the opened tab from MidTerm with noopener and noreferrer semantics.

MidTerm 9.19

Warning

Packaging for this stable release failed before platform binaries and npm 9.19.0 were published. The native installers and npm launcher therefore cannot install v9.19.0 through releases/latest.

The verified prerelease v9.19.6-dev is available for development-channel users. If you require the stable channel, wait for the corrected stable promotion.

What's Changed

All changes since v9.18.0:

v9.18.1-dev: Fix Dev Browser upstream previews

• Fixed Dev Browser upstream connection handling so mixed IPv6/IPv4 dynamic DNS targets fall back to a reachable address instead of surfacing MidTerm's timeout page.
• Dev Browser previews now proceed through upstream HTTPS certificate validation errors for explicitly targeted preview URLs, so expired-cert share pages can render their real upstream error page.
• Added WebPreviewService regression coverage and documented upstream TLS/DNS behavior.

v9.18.2-dev: Browser perf diagnostics

• Adds an opt-in browser performance recorder under mmDebug.perf for capturing RAF frame pacing, long tasks, browser state, and terminal/WebGL summaries from the affected MidTerm window.

v9.18.3-dev: Harden degraded mux transport

• Detect slow mux WebSocket clients and temporarily prioritize active or visible terminal sessions over hidden background output.
• Add browser-side backoff for transport-loss buffer refreshes so repeated data loss cannot trigger tight replay loops.
• Cover the degraded mux delivery policy and transport-loss refresh backoff with targeted tests.

v9.18.4-dev: Keep dev macOS release artifacts when Apple notarization is blocked

• Allow dev prerelease macOS artifacts to continue when Apple notarization is blocked by an expired or missing Developer agreement.
• Keep stable release notarization strict while preserving signed macOS dev artifacts for test distribution.

v9.18.5-dev: Restore strict dev macOS notarization

• Restore strict Apple notarization for dev prerelease macOS artifacts now that the Apple Developer agreement has been renewed.

v9.18.6-dev: Prune Lens history measurement cache

• Prune stale Lens history measurement caches outside the active history window.
• Add regression coverage for AppServerControl measurement cache pruning.

v9.18.7-dev: Fix terminal corruption after mux data loss

• Mux resync now fully resets the terminal parser state, so buffer replays recover sessions whose dropped bytes left a stuck charset or half-parsed escape sequence (all characters rendering as symbols until page refresh)
• Degraded-transport suppression of hidden session output is now an accounted loss: the client receives a data-loss frame when delivery resumes and requests a resync instead of continuing silently on a holed byte stream

v9.18.8-dev: Mobile UX, WebGL renderer, and git chip fixes; refreshed GitHub landing

• Compact mobile sidebar rows with a touch dropdown action menu - roughly twice as many sessions visible per screen, close action stays neutral until pressed
• Mobile Dev Browser dock becomes a real phone layout: full-viewport overlay, 44px touch chrome, two-row URL bar, and opening the dock reuses an existing named preview target instead of adding an empty default tab
• Sidebar git chip shows the repo label and real branch instead of 'repo - HEAD +0 -0': status is refreshed before repos are announced, explicit labels apply to the primary repo, and bare statuses no longer synthesize placeholder chips
• Shared WebGL glyph atlas hardening: per-renderer invalidation generations and page-identity tracking remove the permanent every-frame model rebuild after atlas merges and a latent stale-texture aliasing path; session-switch churn no longer clears the shared atlas
• GitHub landing refreshed with a banner built from the real product logo and three current screenshots; frontend codegen now runs project-local binaries so dev builds cannot lint-drift

v9.18.9-dev: Atomic terminal recovery

• Atomic per-session terminal recovery with sequence cursors and explicit gap detection.
• Bounded priority WebSocket writer prevents slow-client memory growth while preserving active-terminal latency.
• Recovery telemetry, lifecycle and WebGL trigger cleanup, and mobile CPU/memory regression coverage.

v9.18.10-dev: Remote-first Mobile Device Lab

• Adds an optional local Chrome MV3 bridge for real top-level Pixel 8 emulation even when MidTerm runs remotely.
• Separates fast responsive-frame sizing from Chromium touch, UA, DPR, rotation, lifecycle, keyboard-viewport, screenshot, and DOM automation behavior.
• Adds mt_mobile controls and ships the bridge as a downloadable no-runtime-dependency ZIP.

v9.18.11-dev: Surface embedded Chrome bridge download

• Shows the embedded Chrome bridge download directly in the Dev Browser toolbar whenever no local bridge is connected.
• Switches the same control to the Pixel 8 device action after the extension handshake succeeds.
• Keeps the overflow download as a fallback and verifies the ZIP remains embedded in published MidTerm binaries.

v9.18.12-dev: Serve embedded Chrome bridge archive

• Fixes published single-binary MidTerm builds so the embedded Chrome bridge ZIP resolves at its UI download path.
• Adds ZIP-aware embedded-resource path mapping, an explicit application/zip content type, and an assembly-level regression test.
• Includes the direct toolbar download introduced in v9.18.11-dev.

v9.18.13-dev: Chrome Web Store device bridge install

• Install the Mobile Device Bridge from its Chrome Web Store listing when the local bridge is not connected.
• Keep the embedded ZIP download available in the Dev Browser overflow menu as a manual fallback.
• Add reproducible store assets, privacy disclosures, packaging, and future Chrome Web Store publishing automation for extension mipkpmmedaoighaadeedfedimiaaekcn.

v9.18.14-dev: Deterministic agent operator workflow

• Adds durable Terminal prompt, paste, image, and file history with replay in the browser and generated mt CLI helpers.
• Adds the agent-written control plane and dense Operator view for exact session facts, work items, published status, and checkpoints across Hub machines.
• Adds explicit multi-session dispatch, runtime capability discovery, and ordered control-plane events without PTY-text or timing inference.

v9.18.15-dev: Restore sidebar and expose input history

• Restore the original Bookmarks label, star, behavior, and inherited sidebar colors.
• Expose Terminal prompt, paste, image, and file history through a direct Prompt & Paste sidebar entry and Alt+H.
• Remove the parallel History tab and input-kind color treatment so the new surface reuses MidTerm styling.

v9.18.16-dev: Session-owned prompt and paste history

• Moved Prompt & Paste from global navigation into each session top bar while preserving the existing theme and Bookmarks surface.
• Required session-scoped input-history queries and locked UI replay to the menu owner; generated mt helpers now reject sessionless listing.
• Added mobile access and verified 50 open/close cycles with zero retained menu DOM nodes.

v9.18.17-dev: Simplify the session history label

• Renamed the per-session Prompt & Paste action to History across all supported UI languages.
• Kept the existing session ownership, styling, shortcut, and deterministic capture behavior unchanged.

v9.18.18-dev: Per-session terminal input timeline

• Captures browser-authored terminal submissions per session when plain Enter actually sends them.
• Keeps Shift/Ctrl/Alt/Meta+Enter, Codex multiline bursts, and pasted newlines inside one history item.
• Renders History as a timestamped vertical timeline with text and pasted-image thumbnails.

v9.18.19-dev: Polish the session History menu

• Tightens the per-session History menu to a compact 360px layout with aligned timeline rows.
• Uses full 36px replay and delete targets with clear SVG icons instead of legacy 18px font glyphs.
• Keeps keyboard actions isolated so delete/replay controls cannot trigger the parent row action.

v9.18.20-dev: Restore mobile PWA installation

• Make the root MidTerm URL installable with a root-scoped manifest and service worker.
• Keep Install as App usable after a dismissed or unavailable native browser prompt.
• Show localized manual install steps on Android, iOS, and other browsers.

v9.18.21-dev: Keep mobile terminal above keyboard

• Make mobile layout content-resizing explicit so browser and PWA terminals end above the on-screen keyboard.
• Track visual viewport panning even when only its offset changes.
• Reveal the exact terminal cursor row on input instead of scrolling the entire terminal canvas to its bottom.

v9.18.22-dev: Stabilize mobile keyboard viewport

• Keep content-resized Chromium layouts anchored while keyboard focus emits transient visual viewport offsets.
• Retain the visual viewport offset fallback for iOS and browsers that keep a larger layout viewport.
• Preserve the zero-overlap keyboard boundary without whole-shell movement during terminal input.

v9.18.23-dev: Stop mobile terminal input reshuffling

• Keep the app shell fixed while focused terminal or prompt input emits offset-only mobile viewport panning.
• Stop direct xterm keystrokes from forcing a cursor-scroll cycle before terminal output is rendered.
• Coalesce cursor reveals after rendering and write scroll position only when the cursor is actually outside the visible terminal.

v9.18.24-dev: Restore dark sidebar contrast

• Start new browser origins in the tuned dark theme without cross-port theme leakage
• Keep high-contrast sidebar colors when switching away from Solarized themes
• Store UI theme per origin so stable and source instances stay isolated

v9.18.25-dev: Keep browser sessions securely alive

• Keep active browser sessions alive with an eight-day sliding window and background renewal, while requ...