Reliable terminals, smoother mobile sessions, and secure connections

What's Changed

All changes since v10.12.0:

v10.12.1-dev: Keep mobile session menus open

• Mobile session action menus now stay open while keyed sidebar updates preserve their session anchor, and are repositioned after structural changes instead of being dismissed by every render.
• Sidebar row patches now update only owned structural classes so transient menu and drag state survives; explicit actions, outside taps, Escape, resize, rotation, or anchor removal still close the menu.

v10.12.2-dev: Keep Codex controller turns observable

• Codex Agent Controller tool events now tolerate nullable numeric fields such as the in-progress exitCode instead of terminating the provider event stream and leaving a live worker permanently displayed as running.
• Individual Codex provider-message projection failures are isolated and reported while the JSON-RPC reader continues, allowing later tool and turn completion events to restore the correct idle state.

v10.12.3-dev: Reliable agent browser control

• Serialize agent browser open, close, dock, detach, and viewport transitions per preview so stale work cannot overwrite newer commands.
• Return correlated browser UI success or actionable failure to the CLI, including popup-blocker errors, instead of acknowledging delivery only.
• Preserve background and detached viewport dimensions without activating another session or focusing its popup.
• Prefer the owning tlbx session environment in generated CLI helpers so parallel dev instances cannot redirect a running agent.
• Make npm advisory gates tolerate slow or transient registry responses through a bounded fail-closed retry.

v10.12.4-dev: Reliable background terminal recovery

• Suspend terminal, Agent Controller, Git, Hub, and high-frequency UI streams as soon as a browser enters the background, including initially hidden PWA launches and pagehide/freeze fallbacks.
• Rebuild terminal presentation and reconnect browser-owned transports deterministically after visibility, pageshow, resume, or a detected frozen event loop, while keeping Document PiP output live only when a real PiP window exists.
• Make remote Hub terminals generation-safe and reconnectable with bounded pending input plus session-scoped resume cursors, and add mobile/background Chrome profiling with regression coverage.

v10.12.5-dev: Fix redirected web previews

• Send forwarded host and scheme from the upstream preview target so origin-aware servers redirect correctly
• Keep the visible proxied URL aligned with same-origin redirects so client-side routing and Blazor circuits initialize correctly
• Cover forwarded headers and redirect path handling with focused proxy regression tests

v10.12.6-dev: Recover terminal sessions reliably

• Resume suspended terminal transports even during rapid browser lifecycle transitions or missing resume events
• Retire obsolete recovery requests, callbacks and output batches when replacing terminal connections
• Resume from bytes actually handed to xterm so interrupted output batches cannot be skipped
• Add regression coverage and a two-session browser stress test for terminal recovery races

v10.13.0-dev: Ordered terminal transport and bounded parser recovery

• Fixed layout acknowledgement retry storms while preserving newer local edits and server revisions.
• Preserved per-session WebSocket FIFO across focus changes and replay barriers, with bounded fairness in the final writer.
• Isolated session input and recovery work in bounded lanes so slow replay or IPC does not hold up unrelated terminal input.
• Tracked outstanding xterm parser bytes across drains and reconnects; automatically replace a stalled parser and replay retained output without false acknowledgements.
• Added regression coverage for delayed ACKs, writer ordering, overload and shutdown, recovery coalescing, parser budgets and retired callbacks; verified real-browser load, background resume, reconnect and frontend reload.

v10.13.1-dev: Preserve terminal replay through resize

• Fixed a terminal startup and update recovery deadlock: synchronous xterm resize flushes now preserve empty replay-barrier writes, their callbacks and following output instead of treating an empty string as the end of the queue.
• Applied the same empty-write handling to synchronous writes and rebuilt both distributed xterm bundles.
• Added regressions against the real xterm write buffer and public terminal bundle; verified ten forced resize/replay collisions in Chrome with retained history, completed callbacks and subsequent live output.

v10.14.0-dev: Responsive mobile layouts without device detection

• Use one width-based compact layout across desktop Chrome, touch browsers and high-density displays.
• Respect display safe areas in the terminal shell and floating automation and special-key menus.
• Align Command Bay tools and attachments, preserve grouped auxiliary keys, and give the expanded mobile composer its full writing width.
• Add repeatable CLI responsive checks covering viewport bounds, safe areas, control sizes and prompt alignment.

v10.14.1-dev: Stable mobile keyboard replacement

• Replace the native keyboard with special keys below the composer while preserving terminal geometry.
• Return with ABC or dismiss the keyboard; keep symbol categories open after input.
• Remove the extra keyboard gap and protect bottom controls from rounded display corners.

v10.14.2-dev: Stable mobile terminal navigation

• Keep terminal renderers and layout stable when switching sessions or reopening the current session.
• Avoid global resize passes for unchanged size ownership, closed settings, and hidden web previews; automatic fitting no longer steals focus.
• Reuse WebGL renderers within the six-context budget and reserve full recovery for actual background or page-cache returns.

v10.14.3-dev: PWA reconnect and mobile input focus

• Retry stalled foreground state and terminal connections after 15 seconds, and recover immediately when the browser reports the network is online.
• Preserve the focused terminal or composer input when opening the mobile tools menu, avoiding an unnecessary keyboard focus switch.

v10.14.4-dev: Require authentication and explicit certificate trust

• Require owner authentication across control APIs, WebSockets, diagnostics, documentation, and loopback endpoints; missing passwords lock access.
• Show the complete SHA-256 fingerprint before login and provide mt --fingerprint plus local mt --set-password recovery.
• Enforce stronger new passwords, upgrade password hashing, and fix accumulated login throttling with bounded concurrent password work.
• Bind preview credentials to their route, reject hostile browser origins, prevent owner credentials from reaching preview upstreams, and close WebSockets when their API key is revoked.
• Require HTTPS and certificate validation for Hub and native connectors; block credential-bearing redirects and restrict the tmux bridge to HTTPS loopback.

v10.14.5-dev: Automatically optimize background images

• Background PNG and JPEG uploads are resized to at most 2048 pixels on the longest side and encoded as JPEG at quality 85, preserving aspect ratio without upscaling.
• Preserve EXIF orientation, flatten transparency onto black, and reject invalid or excessive pixel dimensions before replacing the current wallpaper.
• Use managed public-domain stb image libraries and permissively licensed metadata parsing without ImageMagick or native image-processing dependencies.

v10.14.6-dev: Automatically optimize existing backgrounds

• Previously stored PNG and JPEG backgrounds are automatically converted to the 2048-pixel JPEG quality-85 policy when first requested, including backgrounds in the legacy storage location.
• Remember the normalized encoding in the stored filename to avoid repeated recompression, preserve visibility and transparency preferences, and bypass old browser image caches.
• Serialize migration with uploads and removal; retain unreadable originals without serving oversized or invalid images to browsers.
• Allow a bounded retry for transient SQLite file handles during integration-test cleanup; persistent cleanup failures still fail verification.

v10.14.7-dev: WebP backgrounds with automatic migration

• Background uploads are now saved as WebP at quality 85, with a maximum longest edge of 2048 pixels and no upscaling. PNG, JPEG and WebP uploads are accepted.
• Previously stored backgrounds, including the earlier normalized JPEG format, migrate once to WebP while preserving visibility and transparency preferences. Browser caches refresh for the new encoding.
• SkiaSharp replaces the earlier image libraries. The permissively licensed native codec is bundled into every platform executable; no ImageMagick or separate runtime installation is required. Standalone Native AOT checks cover background migration and WebP uploads.

v10.14.8-dev: Remove obsolete sidebar repair button

• Removed the obsolete Repair display button from session sidebar actions, including its unused callback and styles.

Release integrity

Native archives have matching platform-specific SPDX SBOM assets plus GitHub build-provenance and SBOM attestations. Installers and the built-in updater additionally verify a signed manifest and all packaged-file hashes.

Verification guide · Security policy