Loading…
Released versions only, generated at build time from the product Keep a Changelog file. Unreleased work is not listed here: if it is not in a version heading, it has not shipped.
Latest v3.23.4 · · 61 releases
Download the current build from /download. Channel and exact version always come from the live release manifest.
nala version. Installed copies no longer fall back to 3.20.0 and repeatedly offer their own release; missing build metadata is reported explicitly as 0.0.0 instead of silently impersonating an old version.nala update honor that marker after an explicit environment override, so installations from the temporary Railway hostname continue receiving preview notices without weakening origin validation.npm audit --omit=dev.nala update now consume the same strict preview/stable release manifest as the download site, pin the selected version, enforce bounded downloads plus exact byte length and SHA-256, verify Authenticode or macOS trust when the release claims a signature, and launch only the validated native artifact. Update checks stay non-blocking and installation remains an explicit two-step user action.NALA_UPDATE_ORIGIN remains available for HTTPS staging and loopback tests.nala desktop --agent as the combined Desktop-with-active-agent choice advertised by the installer.task_id path-traversal guard (ORCH-008a). taskDirLayout/taskPromptRelPath (A2A reliability file-backed task store) joined task_id into a filesystem path with no validation. The only current caller always mints a safe UUID-based id, so this was latent rather than exploitable today, but any future caller passing a raw id could have escaped .nala/tasks/ via ../path separators. Both now reject empty ids, .., path separators, and null bytes.install.ps1 printed a blank/garbled Authenticode failure reason (CLI-013). The abort path referenced $_.Status/$_.StatusMessage (unbound outside a catch block) instead of $sig.Status/$sig.StatusMessage, the actual signature-check result two lines above.readFileSync for a runtime require('../../../../package.json'), but esbuild bundles every CLI module into one file, and after bundling __dirname resolves to the bundle's own directory (dist/cli-bundle/ / resources/cli-bundle/) for every merged module, not each module's original source path — so the relative require still found nothing in a packaged install. Fixed properly by injecting the version at CLI-bundle build time via scripts/build-cli.js (new — mirrors the already-correct scripts/build-mcp.js esbuild define pattern) as process.env.NALA_VERSION; nala version / nala doctor read that first, falling back to the require only for the dev/vitest path where it's genuinely reachable. Verified against the actual bundled output copied to an unrelated directory (not just the dev tree).nala version's daemon column always showed "(unreachable)" even when the daemon answered. It read ping.version, but daemon.ping has never returned a version field — only spawnedByVersion (see src/daemon/index.ts). Now reads the field that actually exists./crew, /scout, /ship, /review, /operate, /brief, /afk, /stow, /recover; daemon MissionSupervisor + crew.* RPC; progressive skills; status-bar Crew shortcut (hide ≠ disable). Does not alter YOLO. Not always multi-agent — one worker when enough.existing_agent_subscription / byok_api / local_model / nala_managed / hybrid_with_approval), machine-enforced free-product boundary (free routes cannot open credit reservations), integer microdollar credit ledger with reserve/settle/idempotent payment grants, managed inference estimate + receipt types, offline-safe cloud control-plane stub. Core local/BYOK use stays free; NALA charges only for optional NALA-hosted services. See docs/product/NALA_FREE_PRODUCT_CONTRACT.md and src/shared/nala/managed/.nala speak, TUI /speak, bark play fallback); STT via daemon portable faster-whisper host (nala dictate --wav); cross-client speech claims; speech sanitization policy; nala voice status|test; doctor voice section; Pi nala_speak tool. Live mic capture helper and daemon Kokoro deferred (Desktop PTT/Kokoro remain for highest quality).career-profile, direct-job-search, tailored-cover-letter, application-prep) plus a Pi coordinator (/apply, /jobs, /career-profile, /application-review) and shared deterministic library under src/shared/nala/jobs. Supports resume ingest (including minimal DOCX OOXML), hard criteria vs preferences, direct-employer / ATS discovery filters (Indeed/LinkedIn excluded as final destinations when requested), cover-letter factuality gates, form field plans with voluntary demographics left blank, and a review queue that never auto-submits. Synthetic portal fixtures cover Greenhouse/Lever/Ashby/Workday-style forms, CAPTCHA blockers, and expired postings.kimi / kimi-code binary, YOLO via --yolo when NALA policy allows, optional -m model selection (including Kimi K3 when the runtime exposes it), plan mode via --plan, and Windows KIMI_SHELL_PATH injection when Git Bash is present. No second YOLO switch.docs/missions/NALA_PACKAGED_DOGFOOD_AND_RUNTIME_MISSION.md, packaged dependency map, managed Node 24.18.0 policy, Windows dogfood protocol, and Windows/macOS signing decision docs. Canonical NodeRuntimeResolver + integrity-gated managed installer (no PATH mutation). missionCapability context builder, MCP tool map, permission preview, and spawn-path enforcement via the evaluator (YOLO preserved). MCP registration writes absolute Node when resolved. nala doctor reports node source/version, capability health, and signing mode. scripts/verify-packaged-resources.mjs + packaged self-test helper. Signing modes: dogfood unsigned vs release fail-closed (NALA_SIGNING_MODE).scripts/mission-baseline-harness.mjs under docs/missions/. Runtime Mission 2: hidden-pane retention default on, leading-edge PTY/daemon batching, 15s liveness, snapshot force backstop, lazy Playwright connect, packaged hook bridge paths, detector/OSC hardening, windowed notifications. Mission 3: shared rpcHelpers, src/shared/atomicWrite, unified logSinkCore, renderer nalaRpc helper, nala method-set contract test. Mission 5.2 pure capability intersection evaluator. Mission 7.1 FanOut per-task prompts[]. SystemProfile gains agent concurrency tip, scrollback lines, watchdog RSS soft ceiling. Gate: passed with limitations; release decision: blocked pending packaging dogfood/signing (see docs/missions/08-release-decision.md).SystemProfile, F2.1/F2.2). src/shared/systemProfile.ts profiles host CPU count + total RAM once per process and derives a low/medium/high tier. PTY pool cap (PTYManager.MAX_PTY_INSTANCES), spawn-scheduler concurrency (SchedulerService.DEFAULT_LIMITS.maxConcurrent), and the default scrollback ring-buffer size (daemon/config.ts bufferSizeMb/bufferMaxMb) now scale with the tier instead of a fixed constant. Medium tier matches the prior fixed values exactly, so typical hardware sees no behavior change; a low-end device (≤2 cores or ≤4GB RAM) gets a smaller pool/buffer instead of thrashing under workstation-sized ceilings, and a high-end machine (≥8 cores and ≥16GB RAM) gets headroom to use more of it.nala on PATH after every install. The Squirrel install/update hook now writes a nala.cmd shim next to the existing wmux.cmd (<root>\bin, already PATH-registered), so nala works from any terminal and directory — bare nala opens the agent, nala desktop / nala sit open or focus the full app, exactly as the site's install one-liners advertise. Launching from the home directory, its parent, or a drive root prints a peer-CLI-style warning ("⚠︎ NALA works best when run in a project directory…") and continues.…/logs/diagnostics/diag-YYYY-MM-DD.jsonl) for boot, memory pressure, renderer-gone, child-process-gone (GPU/utility), unresponsive, and uncaughtException/unhandledRejection — with RSS/heap/free system memory, never PTY text or tokens. Complements the daily main-*.log tee so a hard kill still leaves something greppable. Heartbeat interval only logs when under memory pressure (healthy runs stay quiet).~/.wmux/tts-cache (F9.3). Kokoro / transformers.js downloads are pinned to a NALA-owned directory (instead of scattering across package-relative + HF hub caches with no ceiling). After each successful model load, stale Kokoro dtype siblings (other model_q* / model_fp* weights) are pruned when the tree exceeds ~1.5 GiB, while the active dtype is protected so the next speak does not re-download it.src/shared/safeJson.ts is the single reviver used by company templates, configIO, PipeServer, DaemonPipeServer, and DaemonClient — the CHANGELOG promise to "manage in one place" is now actually landed for the hot parse paths..buf dump when the DATA-007 canonical-path fallback was used. Previously only the persisted meta.bufferDumpPath was unlinked, so fallback-restored sessions left their scrollback dump behind on disk.0.0.0 (CLI-008). nala version and nala doctor resolved the version by reading package.json from disk relative to the bundle, which fails in packaged installs; the version is now inlined into the CLI bundle at build time.main/index.ts now also accepts nala-icon.ico when icon.ico is missing, so the taskbar icon registrars can no longer disagree.nala-agent provider button (and every other ProviderLogo render site: Settings, launch cards, approval dialog) previously drew a made-up italic "n"; it now renders the actual >n mark from the desktop/app icon (assets/icon.svg) as currentColor strokes, so it inherits the button accent in every theme.CompanyTemplateManager used readFileSync / readdirSync / writeFileSync from async pipe RPC handlers (company.save / company.restore / company.templates), so listing N templates cost N sync reads on the main process (IPC dispatch + PTY forwarding stalled for the duration). Fully async via fs/promises, with parallel load on list. Corrupt JSON is now logged instead of vanishing silently; oversized import files throw (the size guard used to collapse into a null that looked like "not found", defeating the security check).AppendOnlyLog fd; main before-quit explicitly stops DaemonNotificationRouter / RemoteInboxBridge / WorkspaceContextRouter / bark bridge (previously only cleaned via onUninstall, which DaemonRespawnController.dispose() skipped) and disposes the metrics aggregator; TUI adapter closes its poll timer after app.run().src/company/main/ and src/company/mcp/ had no live importers — the production paths are src/main/company/* + src/main/pipe/handlers/company.rpc.ts and src/mcp/index.ts. Deleting the forks ends the second CompanyTemplateManager / WorktreeManager / PID-walk that had already drifted from the real implementations.TimeLimitEnforcer.recordActivity re-armed the idle timer without the onIdleExceeded callback, so a long-running delegation could run forever once any activity was recorded. The callback is now stored on the timer and re-bound on every reset.canDelegate() now atomically claims the single half-open probe slot (previously multiple concurrent callers could all pass before startHalfOpenTest()).redeem() is now raced with a 120s timeout so inFlight always clears.resetKeys remounts cleanly; budget resets after 5s of healthy render.ptyProcess.write() in the SessionPipe input path was unguarded — an EPIPE from a dead PTY threw synchronously and could kill the daemon (taking every other session down with it). Now logs a warning and continues.registerHandlers's teardown was calling removeHandler(IPC.RPC_INVOKE), opening a gap during daemon reconnect/respawn where renderer invokes failed with "No handler registered for 'rpc:invoke'" (16 occurrences in one production log) instead of the graceful {ok:false} response the handler itself returns while the bridge is down. The register site already removeHandler-then-handle's, so re-registration never double-registers — the teardown-side removal was unnecessary and harmful.scrollback:dump wrote every open terminal's buffer synchronously (atomicWriteTextSync) on the renderer's 5-second crash-safety tick. Now writes asynchronously, with in-flight coalescing per surface so a slow disk can't stack up overlapping writes to the same file — a dump that arrives mid-write replaces the queued payload instead of racing a second concurrent write.squirrelShortcuts.ts) that retargets any NALA.lnk with a dead target, a target inside a versioned app-*\ directory, or a missing icon back to the version-independent stub launcher.registerSessionLifecycleRpc.ts's state-dir resolver and the credential vault's storage dir fell back to process.cwd() when NALA_STATE_DIR was unset; the packaged daemon can spawn with cwd=C:\WINDOWS\System32, which is not writable. Both now fall back to getWmuxHomeDir() instead.SchedulerService.tick() awaited each redeem() call inside its dequeue loop, so maxConcurrent never had any effect — the next launch couldn't start until the previous one finished. Now builds and starts every eligible proposal in a wave before awaiting any of them, so redemptions genuinely run in parallel up to the configured limit.require('./relative-module'), which is invisible to the Rollup bundler that packs the main process into a single-file bundle — the call resolved relative to the bundle's own directory in production, where the target file doesn't exist, threw MODULE_NOT_FOUND, and was swallowed by a best-effort catch. Converted to static imports (all three modules are side-effect-free at load time, so there's no added per-launch cost).dist/cli-bundle/index.js: (1) the nala banner read its wordmark .txt assets from __dirname at module load, but they were never copied next to the bundle — ENOENT killed every nala-routed command; the build now ships them and a missing asset degrades the banner instead of aborting. (2) update-signed was statically imported and its module graph requires electron, which throws under plain Node/ELECTRON_RUN_AS_NODE — now lazily imported only when update --signed actually runs.expiresAt draft/pending proposal to expired; list()/listPendingApprovals() now reap them lazily on every read.taskRuntimeSec age) rather than the full boot-time recovery path, since the latter also resets every still-alive agent's session status and would wrongly clobber a live agent if run on a plain timer with no actual restart/suspend.JsonOrchestrationStore.open() was not idempotent: a second call (as NalaOrchestrationService.start() makes, after the constructor's own lazy open) could race the debounced disk persist (F5.8) and reset already-seeded defaults back to an empty store whenever it landed inside the 50ms write window — effectively always, for synchronous construct+start. open() is now a no-op once loaded; custom-provider CRUD (add/update/remove) flushes synchronously since it's a rare admin action, not one of the hot per-tick writes the debounce targets..nala/tasks/<task_id>/ (atomic writes + checksum + events.jsonl), harness adapter contract, and a full Grok Build adapter: splash-menu detection (Grok Build Beta + New worktree/Resume/Changelog/Quit), safe bootstrap (no blind Enter on unknown screens), single-line file-pointer delivery, acceptance + start verification (token/tool activity), and idempotent retries by task_id. agent_prompt routes Grok-like peers through this path instead of silent inbox / multi-line paste. Audit: docs/agents/AUDIT_FINDINGS.md.resolveWorkspaceAgentIndicator aggregates all panes/surfaces: green = working (running), yellow = needs you (waiting / awaiting_input), blue = starting (banner only). New AgentStatus: 'starting' for gate/splash so cold boots no longer false-green.agentStatus without agentName is demoted; background-pane yellow attention bubbles up to the workspace row; AgentDetector gate match emits starting instead of running (real work still promoted by ActivityMonitor).surface_list → pane_list → a2a_whoami → a2a_discover before every peer message. MCP instructions default to a single agent_prompt({ target, message }) call: the server resolves callsign/pane/pty (with an 8s discover cache) and delivers full-body paste in one hop. a2a_discover is documented as "only when target unknown". Shared policy module a2a-fast-path.ts + local zero-MCP fleet-snapshot.ts (reads ~/.wmux/principals.json + sessions.json) for host tooling. Avoids Slate's polish/sidebar-notifications files.decideDelivery Grok branch. When harnessId: 'grok-build', splash / gate-match running / session-only states select file_pointer instead of treating the agent as deliverable via inbox-only success.running / silent A2A handoff to Grok splash (Onyx incident). Discovery-style agentStatus: "running" after a Grok startup banner no longer implies READY or TASK_STARTED. Regression tests prove splash → BOOTSTRAP_BLOCKED and force file-backed recovery.recordDetector ran after sendNotification, so hook/detector races and multi-line idle footers each announced. Ledger is checked before fire on PTYBridge + DaemonNotificationRouter; OSC 9/777/99 shares the same ledger and stamps idle-fallback suppression. Panel still collapses near-duplicates as a backstop. (Finishes Slate’s polish/sidebar-notifications ledger work on this branch.).pane-ring-glow set opacity: 0.6 on the whole pane, so a notification made the workspace look inactive/darker. Glow is border/shadow only; active focused panes never take flash/glow/unread ring chrome. Workspace-level notifies that resolve to the focused leaf now count as “active view” and skip toast/ring fan-out (previously only pty-matched surfaces did).overflow:hidden main pane. Tooltips now support align: start|center|end; left chips use start, right chips use end.--accent-blue / surface tokens so every skin stays cohesive. WebGL field sleeps when idle to keep cost low..focus() method, letting its internal focused/blurred visual state go stale even though the pane's border/tab correctly showed it as active. Added a complementary resync on window refocus that only re-affirms focus already on the right element (never steals it from a palette input, toolbar field, or another pane).tail -f, build watcher) could trip the idle-fallback notification purely from cosmetic terminal redraws, even if you'd never made it your active surface. The activity monitor now ignores non-substantive output (pure ANSI/cursor redraws), and the fallback notification itself is gated on the pane having been visited at least once — its status still updates for accuracy, but nothing pings you about work you never asked to watch. Also fixed the daemon-mode fallback showing the generic "Task may have finished" text even for a known agent, unlike the local-mode path, which correctly preserves the agent's identity.agent_prompt missing to (A2A direct inject broken). The tool passed a free-form target field into a2a.task.send, which requires to, so every call failed with a2a.task.send: missing "to" regardless of callsign or pane id. It now resolves callsign / pane / surface / pty via a2a.discover and sends to + pane anchors with full-body PTY paste (silent: false).running. Gate-only detection left sessions permanently "busy," so durable A2A tools refused injection into an idle empty prompt. Added Thinking/working and ready-for-input patterns for Devin CLI.overviewRuler.width: 6 so track metrics match the thin bar (left-split long feeds can drag-scroll again)./bark spoken summary (NALA Agent + Pi-wrapped). Put /bark as a leading command or anywhere in a prompt. When the model calls nala_submit_spoken_summary (or the host falls back to final assistant text), the summary is pre-synthesized via tts.bark.prepare so Desktop Kokoro holds audio before the turn ends. Press Enter to play. Pi-wrapped agents use @nala/pi-bridge; NALA Agent TUI arms bark + event settle hooks. /read-aloud is unchanged. Requires Desktop for real Kokoro playback.tts.bark.* RPC + Desktop bridge. prepare / play / ready / get are registered on the daemon, forwarded from the main pipe (MCP/Pi clients), broadcast for Desktop pre-synth, and play held PCM on Enter.nala_agent_send force flag. Always durable-stores; with force:true also attempts same-workspace PTY inject (skips busy/idle gates). decideDelivery honors force / skipBusyCheck.nala_search_panes / nala_events_poll tool names (legacy wmux_* kept as aliases). Agent-facing MCP instructions, A2A nudges, and channel wake lines say NALA / nala instead of "wmux".Terminal tab agent-status mark: three distinct states instead of two. Previously the tab mark only ever animated (busy) or froze in place (everything else — waiting, complete, or awaiting input all looked identical). It now shows a spinning figure-8 while the agent works, a slowly rotating ring of dots when it's idle, and the same ring pulsing gently with light when the agent is blocked on a question. The question-pulse is scoped to Claude Code for now — it's the only agent with a deterministic signal for "blocked on a question" vs. "turn just ended"; other agents fall back to the idle ring rather than risk a false pulse. The sidebar status dot also now gives "awaiting input" its own color, distinct from plain "waiting."
STT: single bottom-bar indicator + Ctrl+Shift PTT. Removed the floating listening/transcribing hover pill (VoiceStatusChip); the agent toolbar Dictate control is the only status surface and expands with label + mic level while active. Default push-to-talk is hold Ctrl+Shift together (no Space / no third key); sessions still on Space or Control+Shift+Space migrate automatically.
NALA branding: acronym slogan + naming. TUI/CLI launch banners use the acronym expansion Naturally Autonomous LLM Agents (replacing the retired SIT. STAY. SHIP. tagline). Documented naming matrix in docs/nala/NAMING.md (NALA / Nala / nala / wmux-legacy). Purged user-facing wmux product-name copy from English (and Korean) locale strings; empty-workspace copy already Nala-neutral. Locale branding guard test on en.ts.
M09-M15: Continuation repair passes (pi-missions branch). Six repair passes closing all spec compliance gaps from the fourth-set missions:
nala rollback command (M15 gate 29 → READY, 17 tests with --yes/--dry-run/--version flags). UNC path handling in workspace resolver (M15 gate 8 enhanced, 10 Windows-guarded tests covering \\server\share\project, .git walk-up, trailing backslash, forward slash, long UNC paths). Spoken summary → persistent library pipeline (spoken-summary-pipeline.ts, 11 tests). Audio device selection completion (tts-audio-output.ts AudioOutputManager, 14 tests). RPC spec expansion 210→341 methods covering all 331 daemon-registered methods (M12 gate 3 → READY). Spec validation against live registrations (rpc-spec-validation.test.ts, 13 tests). Capability key system reconciliation (capability-reconciliation.test.ts, 21 tests). Verified all 54 m09-process-lifecycle tests pass (previously 2 failing). 86 tests pass. Total project: 3,335 tests pass across 134 test files, 0 failing.nala update command (M15 gate 27 enhanced, 21 tests with --check/--dry-run/--yes/--channel flags). Chaos testing infrastructure (chaos-test-harness.ts with 4-phase execution, 12 harness tests + 12 scenario tests covering daemon crash, provider crash, socket break, disk full, network partition, concurrent modification, memory pressure, slow provider). M12/M13/M14 final evidence reports (22 + 14 + 15 sections per spec). Certification updates across 5 files: M12 gate 3 → READY (341 methods), M15 gate 29 → READY (rollback command), M15 gate 8 enhanced (UNC tests). Combined gate totals: 42 READY, 7 READY_WITH_LIMITATIONS, 3 PENDING, 0 BLOCKED. 62 tests pass.tts-daemon-service.ts with createTtsDaemonService factory, 9 methods, FIFO queue with concurrency cap and timeout, AudioOutputManager integration, 30 tests). TTS daemon extraction design document (TTS_DAEMON_EXTRACTION_DESIGN.md, 13 sections covering current/target architecture, 4-phase migration path, protocol design, security, performance, backward compatibility). Auto-updater E2E simulation (31 tests covering update detection, installation, rollback after failed update, version compatibility, channel management, update lifecycle with graceful failure, checksum verification, download retry). Dogfood scenario automation (24 tests covering 5 E2E scenarios: fresh install, update existing install, multi-workspace session, read-aloud workflow, provider crash and recovery). Cross-mission conformance report (CROSS_MISSION_CONFORMANCE_REPORT.md, 486 lines covering M09–M15 conformance, mission-by-mission analysis, cross-mission dependencies, test coverage matrix, documentation coverage, gate status summary, remaining gaps). Fixed 2 flaky performance benchmark tests in m15-performance-benchmarks.test.ts by separating library construction from the measured operation, making the 1000-clip add/delete benchmarks deterministic. 85 new tests pass across 3 test files, no regressions. Total project: 3,436 tests pass across 138 test files, 0 failing.NALA CLI/TUI Agent — Second Set Missions M01-M04 (pi-missions branch). Complete implementation of the NALA CLI/TUI as a first-class client of the shared NALA daemon, covering protocol, TUI, agent OS intelligence, and distribution.
src/cli/ with barrel exports via src/shared/nala/index.ts. Path traversal protection in resolveWorkspaceConfigPath(). All tests pass..strict() consistency (13 schemas fixed). All audit reports in docs/nala-cli/audits/.audioPlayback.ts, useReadAloud.ts, ReadAloudInput.tsx, audioPlayback.test.ts), restoring pre-buffering, flushPending(), and doReplay refactor. Full test suite: 13049 tests pass (0 failures). Comprehensive architecture, security, and quality audit completed.M01-M03: Single-engine Pi-wrapped provider runtime, product integration, and certification. Three final-integration missions implementing the complete provider-wrapping architecture:
src/shared/nala/: execution-taxonomy.ts (ReasoningOwner, Mission01ExecutionMode, CredentialOwner, BillingClass, AuthRoute, ToolLoopOwner), launch-grant.ts (WrappedLaunchGrant with HMAC signing, LaunchGrantStore with single-use redemption), provider-launch-intent.ts (ProviderLaunchPreference, ProviderLaunchIntent), recovery-states.ts (19-state RecoveryStateMachine with transition enforcement), llm-attribution.ts (LlmAttribution with verified/estimated/unavailable confidence, 30+ extended event types). Single-engine invariant test with throwing model factory.SessionHeaderStrip.tsx (compact accessible header with callsign, provider, execution mode, auth/billing, health), SessionInspector.tsx (expandable details drawer), ProviderLaunchIntentDialog.tsx (mode/profile/worktree/permission selection), NormalizedEventRenderer.tsx (renders prompts, responses, tool calls, approvals, diffs, A2A messages, errors).provider-certification.ts (ProviderCertificationSchema with 16 fields, CertificationStatusSchema), ProviderCertificationStore.ts (CRUD with atomic writes, expiry, revocation), ConformanceHarness.ts (15 standard tests: installation, auth, read-only prompt, controlled edit, MCP, A2A, artifact, permissions, cancellation, restart, quota, cleanup, fallback, single-engine, redaction), FakeAcpFixtures.ts (15+ fixture scenarios: normal, malformed, oversized, crash, canary, forged identity).DiagnosticsService.ts with configurable provider registry, content-hash caching, test impact suggestions, bounded results, graceful degradation. 21 tests. 6 new RPC methods.scripts/generateLicenseInventory.mjs reading package-lock.json, extracting license/homepage/author for all deps. 9 tests.S06: Skills manager + extension system scaffold. Two new daemon services with full CRUD, file-backed persistence, and RPC wiring: (1) SkillsManagerService (src/daemon/nala/skills/SkillsManagerService.ts) — durable CRUD for named, versioned agent skills (built-in + custom); 5 built-in skills seeded (code-review, test-runner, doc-generator, bug-triage, refactor); built-in re-merge preserves user enable/disable toggles across reopens; custom skill id collision with built-in ids rejected; 23 tests. (2) ExtensionSystem (src/daemon/nala/extensions/ExtensionSystem.ts) — isolated lifecycle management (install → enable → disable → uninstall); activation errors recorded as status='error' without crashing sibling extensions; manifest validation via Zod; upgrade-in-place preserves installedAt; 20 tests. Shared types: skill-types.ts (SkillDefinition, SkillCreateInput, SkillUpdateInput, SkillQuery) and extension-types.ts (ExtensionManifest, ExtensionRecord, ExtensionInstallInput). 13 new RPC methods (nala.skills.*, nala.extensions.*) registered via registerSkillsExtensionsRpc.ts, wired into NalaOrchestrationService, capabilities, and METHOD_CAPABILITY map. Bug fix: deriveId now uses hyphens (not dots) to match the ExtensionRecordSchema id regex; mutate() now persists draft on throw so error states are durable.
S07: Fake provider suite for CI + conformance tests. 5 new conformance modules in src/daemon/nala/conformance/: (1) FakeProviderSuite — deterministic fake provider adapters for CI (no real provider processes); 117 tests covering all fake provider behaviors. (2) CertificationRunner — runs certification suites against providers; 8 tests. (3) ChaosSuite — chaos engineering probes for failure injection; 9 tests. (4) PrivacyProbe — privacy compliance verification probes; 13 tests. (5) RoutePolicyService — route policy enforcement and validation; 15 tests. Total: 162 conformance tests, all passing.
S03: A2A end-to-end pipeline tests + worktree lease orchestrator. (1) a2aPipeline.e2e.test.ts — 11 end-to-end tests exercising the full NALA orchestration pipeline: task creation → agent assignment → A2A message exchange → delegation with cycle detection → task failure → worktree lease expiry → subtree cancellation → DAG building. Uses real JsonOrchestrationStore and NalaOrchestrationService with FakeNalaAdapter. (2) WorktreeLeaseOrchestrator (src/daemon/nala/worktrees/WorktreeLeaseOrchestrator.ts) — coordinates worktree lease lifecycle with task state; 9 tests. (3) WorktreeLeaseService + WorktreePrepService tests — 19 tests covering lease acquisition, renewal, expiry, and worktree preparation. Total: 48 worktree/orchestration tests, all passing.
S08: SBOM generation tests. 7 tests for scripts/generateSbom.mjs covering SPDX 2.3 document validity, app package version correctness, document namespace, relationships array, packages array, empty dependencies handling, and undefined field cleanup. All passing.
S02: EcosystemPanel — package catalog, review, quarantine, and safe mode UI. New renderer component (src/renderer/nala/components/EcosystemPanel.tsx) with 4 tabs: (1) Catalog — all packages (built-in + user-installed) with status badges, enable/disable/remove actions, and capability tags; (2) Review — pending intake reports for reviewer approval; (3) Quarantine — quarantined packages with release action; (4) Safe Mode — safe mode toggle with enter/exit and active status display. 8 tests covering tab rendering, RPC loading, empty states, close behavior, and tab switching. i18n keys added to en.ts and ko.ts.
Authenticode verification in install.ps1. Windows installer now verifies Authenticode signatures on downloaded binaries before installation. Verification activates automatically once signing certificates are available; gracefully skips (with warning) for unsigned dev builds.
NALA static terminal wordmark and launch banner (Mission 07). First-party checked-in banner assets (src/cli/brand/) with 4 variants (wide, standard, compact, plain) for responsive terminal widths. banner.ts module provides deterministic variant selection by terminal width, ANSI color support with NO_COLOR respect, and renderStartupBanner() composition with workspace/provider/runtime/A2A status lines. 18 tests. Phase 1 audit confirmed no superseded mascot/art code to remove.
Scrollback restore Fix B — cap-aware reconcile with promoteSession. Suspended sessions that were cap-skipped during recovery (MAX_RECOVER_SESSIONS=40) can now be promoted on demand when the renderer reconcile encounters their ptyId. New daemon.promoteSession RPC (idempotent on active, not-found for missing, resource-exhausted at MAX_SESSIONS=200) reuses the extracted promoteOneSession helper. daemon.listSessions extended with { includeSuspended?: boolean } param to merge disk-only suspended sessions into the response. AppLayout reconcile routes suspended ptyIds through promote → reconnect instead of fallback-create. 20 new tests across daemon + renderer.
Pane split max depth guard. splitPane now enforces a MAX_SPLIT_DEPTH=6 limit in addition to the existing 20-pane count cap, preventing infinitely nested splits. Depth-blocked splits set a blockedAtDepth flag and show a warning toast. 3 new tests.
TTS corrupt model recovery. On Protobuf parsing failed / corrupt Kokoro ONNX cache load, the TTS worker clears transformers.js model caches and retries once; if q4 still fails, falls back to q8. User-facing errors are marked recoverable (retry / change quality) instead of a fatal crash.
nala:rpc cold-start daemon wait. Internal nala:rpc no longer immediately throws DAEMON_DISCONNECTED before first daemon ping — waits up to ~18s with backoff for cold start. Mid-session disconnects after a successful connect still fail immediately.
STT push-to-talk default + mic sensitivity. Default PTT hotkey is Control+Shift+Space (avoids bare Space false starts). Settings → Dictation adds a mic sensitivity slider (0–100) that maps to the VAD energy floor in audioCapture (replacing the hard-coded 0.008 threshold). Preference persists in session data.
Agent idle detection + tab fig-8 freeze. Claude Code end-of-turn verbs (Cogitated for 28s, Cooked for …, etc.) now map to waiting; esc to interrupt remains non-waiting (in-flight). When ActivityMonitor goes quiet on a known agent, PTYBridge keeps waiting + agentName instead of clearing to idle. Renderer isSubstantivePtyOutput ignores pure ANSI/TUI chrome so the tab figure-8 stops spinning after a turn ends.
Workspace auto-trust for A2A / plugin-exec. User-opened and session-restored workspaces call workspaceTrust.setTrust; a one-shot ensureWorkspacesTrustedOnce on AppLayout mount also trusts the slice-init first workspace so boot agents are not stuck behind an untrusted gate (does not re-run, so a later user untrust is not clobbered).
Single-pane active border toned down. Solo leaves no longer draw a bright active accent border (shouldShowActivePaneAccent); multi-pane focus border still uses a dimmed cursor accent.
Toast duplicate suppression (stale-daemon spam guard). pushToast now suppresses exact message+level duplicates while an identical toast is still in the list, returning the existing toast's id. Prevents stale-daemon error spam from stacking to the MAX_TOASTS=10 cap when multiple components poll the same dead RPC method. Different message or level still admits; re-admits after auto-dismiss. 4 new tests.
Git-oracle test flakiness hardened. The g() helper in diff.handler.test.ts and all git calls in diffParse.test.ts now use retry (2x) with 100ms backoff and 15s per-call timeout, matching the applyPatchInRepo pattern. Eliminates bare execFileSync flakiness under heavy parallel I/O.
Mission 05 production hardening gaps closed. Three missing Mission 05 deliverables implemented: (1) ReconciliationService (src/daemon/nala/orchestration/ReconciliationService.ts) — detects ambiguous write outcomes (timeout, crash, partial response) by checking actual file/git state against expected hashes; returns APPLIED/NOT_APPLIED/AMBIGUOUS/CONFLICT verdict; bounded retry with reconciliation never auto-retries AMBIGUOUS or CONFLICT; 22 tests. (2) RemotePolicyService (src/daemon/nala/policy/RemotePolicyService.ts) — fetches signed policy manifests from NALA_POLICY_URL, verifies SHA-256 hash pin, caches with TTL (default 24h), falls back to BUNDLED_SAFE_POLICY on any failure; applies remote kill-switches to local route policy; 12 tests. (3) ProviderDriftDetector (src/daemon/nala/policy/ProviderDriftDetector.ts) — compares installed provider versions against compatibility matrix, returns drift severity (none/warning/critical), batch detection for all providers; 9 tests. (4) UninstallCleanupService (src/daemon/nala/maintenance/UninstallCleanupService.ts) — removes Pi runtime artifacts and NALA session state with dryRun default true, bounded by orchestration root and Pi home, never touches user data; 15 tests. (5) NALA model provider manifest — added nala provider to provider-manifests.ts as a first-party orchestration decision provider (not code-writing), internal transport, local_runtime auth, enabled by default false. 8 new RPC methods registered (nala.reconciliation.check/retry, nala.policy.remote.fetch/status, nala.policy.drift.detect/report, nala.maintenance.cleanup.preview/execute). 2 new capability keys (nala.policy, nala.maintenance). API reference regenerated.
i18n for NALA renderer components. All 20 new NALA renderer components (SettingsPanel, OperationsDashboard, LaunchCard, UnifiedApprovalDialog, FirstRunWizard, RepositoryMapPanel, SymbolExplorerPanel, MemoryManagerPanel, ContextPreviewPanel, OrchestrationSettingsPanel, ContextMemorySettingsPanel, ObservabilitySettingsPanel, ProfileEditor, ProfileCompareView, RoleCard, WorkflowCard, AlertList, FleetPanel, SpanTreeViewer, NalaPanelsHost) now use the useT() hook and t() translator instead of hardcoded English strings. 60+ new translation keys added to src/renderer/i18n/locales/en.ts under the nala.* namespace. Other locales fall back to English automatically for missing keys (by design).
NALA panel wiring and renderer component tests. All 12 top-level NALA panels (Settings, FirstRunWizard, OperationsDashboard, LaunchCard, UnifiedApprovalDialog, OrchestrationSettings, ContextMemory, Observability, RepositoryMap, SymbolExplorer, MemoryManager, ContextPreview) are now mounted in the app shell and reachable from three entry points: (1) Command palette — 12 new Ctrl+Shift+P entries including a launchCard sub-mode that lists each provider; (2) NalaOrchestrationBar "NALA" dropdown — 10 drawer panels; (3) Settings → NALA tab "NALA Panels" section — buttons opening all 10 drawers. Central open/close state lives in uiSlice (NalaPanelId union + openNalaPanel/closeNalaPanel actions, plus nalaLaunchCardProvider and nalaApprovalRequest slots for the modal/dialog). NalaPanelsHost is mounted in AppLayout and renders every panel conditionally. FirstRunWizard auto-opens once per profile via a localStorage marker (nala.firstRunCompleted). Added 7 new renderer test files (148 tests, all passing): SettingsPanel, OperationsDashboard, LaunchCard, UnifiedApprovalDialog, FirstRunWizard, RepositoryMapPanel, MemoryManagerPanel — covering tab rendering, RPC flows, CRUD operations, error states, and closed-state behavior using the established window.electronAPI.nala.rpc mock bridge pattern. Regenerated docs/api/reference.md to include the new Pi bridge alias RPC methods.
Workspace intelligence UI (S04 WS9). 4 new renderer components + 1 shared helper: (1) RepositoryMapPanel — file inventory viewer with per-file identity (path, language, size, classification, sensitivity), summary stats, ignore-policy block, indexing controls (scan/pause/resume), and filters by path/language/classification/sensitivity; (2) SymbolExplorerPanel — two-column symbol viewer with searchable list, kind-colored badges, detail pane (signature/docs/source/confidence), and outgoing/incoming dependency edges; (3) MemoryManagerPanel — full CRUD memory manager with scope/category/state filters, inline editor, retention policy editor, and admit/reject/pin/expire actions; (4) ContextPreviewPanel — context assembly viewer with strategy selector, token budget bar, per-item cards with "why this context" selection reasons, and compact action; (5) s04Rpc.ts — shared RPC helper + useActiveWorkspaceId hook.
Pi bridge tools — task, worktree, terminal, search, trace (13 new tools). The Pi bridge extension (integrations/pi/package/src/tools/) now exposes 13 new tools beyond the existing A2A and artifact tools: (1) Task tools — nala_task_get, nala_task_update, nala_task_complete, nala_task_list; (2) Worktree tools — nala_worktree_request, nala_write_lease_status, nala_worktree_release; (3) Terminal tools — nala_terminal_list, nala_terminal_send (returns descriptive error — PTY lifecycle is owned by main process); (4) Search tools — nala_workspace_search, nala_symbol_search; (5) Trace tools — nala_trace_note, nala_progress_update. All tools use env-var identity (not model-supplied IDs), Zod input validation, and graceful error handling. 10 new daemon RPC alias handlers in registerPiBridgeAliasRpc.ts bridge tool method names to existing services.
Operations dashboard (S05 WS6). 4 new renderer components for NALA observability: (1) OperationsDashboard — 4-tab drawer (Fleet/Timeline/Alerts/Diagnostics) with live fleet view, per-run timeline with span tree, alert management with ack/resolve, and diagnostics with provider status, resource usage, and support bundle export; (2) SpanTreeViewer — expandable/collapsible span tree with color-coded status dots and detail expansion; (3) AlertList — alert list with severity badges, filters by severity/state/source, and acknowledge/resolve actions; (4) FleetPanel — agent grid with status indicators, callsign, provider, model, route, task, worktree, pending questions, and cancel/steer/open actions, auto-refreshing every 10s.
Launch card, unified approval UX, and settings panels (S06 WS4/WS6/WS7). 5 new renderer components: (1) LaunchCard — detailed provider launch card with route selector, profile summary, capability badges, billing class indicator, expandable details, compact/full modes, and changed-state indicator; (2) UnifiedApprovalDialog — comprehensive approval dialog for 9 permission types (filesystem, shell, network, git, browser, MCP, spawn, secret, external path) with risk-level color coding, 5 decision choices (deny once, allow once, allow for run, allow for workspace, allow for profile), and capability summaries; (3) OrchestrationSettingsPanel — orchestration mode, delegation limits, default roles, review rounds, supervisor questions, notification preferences; (4) ContextMemorySettingsPanel — context strategy, indexing controls, memory categories with per-category retention, secret scanning toggle, memory search interface; (5) ObservabilitySettingsPanel — trace content mode, retention by event class, exporter consent toggles, support bundle export, "what is stored" inspector.
S06 renderer UI — settings, profiles, roles, workflows, first-run wizard. 6 new renderer components in src/renderer/nala/components/: (1) SettingsPanel — tabbed drawer (Settings/Profiles/Roles/Workflows) with scope selector, effective settings list with inline edit and reset, export, migration list; profile CRUD with clone/compare/export/health; role and workflow card grids. (2) ProfileEditor — modal for creating/editing provider profiles with write-policy checkboxes. (3) ProfileCompareView — side-by-side diff modal showing field-level differences. (4) RoleCard — role display with capabilities, boundary policy, delegation rights, and signing status. (5) WorkflowCard — workflow display with ordered stages, role assignments, and parallel fan-out. (6) FirstRunWizard — 5-step wizard (welcome → provider → profile → review → done) that creates a profile and writes initial settings. All components use the established window.electronAPI.nala.rpc bridge and Tailwind CSS variable theming.
MCP pinned terminal route invalidation when workspace dies (P2). When an external MCP caller claimed a dedicated workspace and the user manually closed that workspace mid-session, the process-lifetime pin in paneResolver kept pointing at the dead PTY, causing the caller's terminal tool to permanently fail until MCP restart. invalidateWorkspaceId() (the stale-identity self-heal path in src/mcp/index.ts) only cleared the workspaceResolved verified-cache flag, not the pin. Added clearPin() export to paneResolver.ts and wired it into invalidateWorkspaceId() so both call sites in callRpc (success-path and error-path stale-result checks) now clear the pin alongside the verified cache, enabling self-healing re-claim on the next call. 4 new tests added.
Terminal DSR-CPR response leak after channel mention paste (P2). When a channel mention was pasted into a pane, the cursor position response (ESC[<row>;<col>R, e.g. ESC[40;3R) was not consumed by the TUI during rapid paste/repaint transitions and instead leaked back through the PTY output stream as literal text (e.g. ;3R40 appearing in bulk in the scrollback). This is the same class of bug as the 2026-07-04 CPR feedback storm (replay-time, fixed by replayQuerySanitizer.ts), but on LIVE output. Added a stateful CprResponseFilter (src/renderer/terminal/cprResponseFilter.ts) that strips CPR response sequences from PTY output before they reach xterm.js. The filter is per-terminal (instantiated in useTerminal's main effect) and handles chunk-boundary splits by buffering incomplete CSI prefixes. DSR queries (ESC[6n) are preserved — xterm must see those to generate the responses the TUI expects. CPR responses are terminal reports, never display content, so stripping is lossless for the user. 19 unit tests added.
METHOD_CAPABILITY map completed for all 273 nala. RPC methods.* The daemon registers 273 nala.* RPC methods via .onRpc(), but METHOD_CAPABILITY in src/main/mcp/methodCapabilityMap.ts only knew about 72 of them — leaving 201 methods ungated and absent from the RpcMethod union type and ALL_RPC_METHODS array in src/shared/rpc.ts. This caused tsc errors (Record incompleteness), 2 test failures in methodCapabilityMap.test.ts (totality + capability validity), and API reference drift. Added all 201 missing methods to rpc.ts, methodCapabilityMap.ts (all using wmux.internal capability, matching the existing substrate-internal pattern), and regenerated docs/api/reference.md. Root cause: DaemonPipeServer.onRpc() accepts an untyped string, so methods could be registered without being added to the type system.
Provider conformance, privacy, chaos, and certification lab (Mission S07). NALA now has a provider conformance lab for certifying that each provider route meets the universal agent contract before being advertised. (1) CertificationRunner (src/daemon/nala/conformance/CertificationRunner.ts) — runs 13 standard scenarios (read-only, plan, write, tool, approval, A2A, cancel, resume, model switch, error, quota, offline, cleanup) against a UniversalAgentAdapter, produces a tamper-evident CertificationReport with SHA-256 resultsHash and per-scenario pass/fail observations. Error and quota categories expect graceful failures. (2) RoutePolicyService (src/daemon/nala/conformance/RoutePolicyService.ts) — bounded JSON persistence (max 512 policies) for per-provider, per-route metadata with 5 statuses (certified, experimental, personal_only, blocked, unknown), kill-switch (disableRoute), re-certification requirement (enableRoute), version-window checking (isRouteSupported), and 30-day offline cache (cacheForOffline). (3) ChaosSuite (src/daemon/nala/conformance/ChaosSuite.ts) — 11 standard chaos scenarios (process crash, network partition, disk full, OOM, slow response, corrupted state, permission revoked, token expiry, concurrent writes, dirty git, missing files) with filesystem reconciliation that never auto-retries ambiguous writes. (4) PrivacyProbe (src/daemon/nala/conformance/PrivacyProbe.ts) — creates a synthetic repo with allowed/ignored/excluded files, nested .git, symlinks, and canary secrets in .env/secrets/node_modules/dist/nested-repo; verdict fails on canary exposure, excluded/ignored file access, or blocked network calls. (5) Shared schemas (src/shared/nala/conformance-types.ts) — Zod schemas for certification scenarios/results/reports, route policy metadata, chaos scenarios/results, and privacy probe results. (6) RPC (registerS07Rpc.ts) — 14 endpoints for scenario listing/validation, route policy CRUD, chaos scenario listing/validation, and privacy probe helpers. (7) Tests — 79 new tests (17 schema, 8 certification, 15 route policy, 9 chaos, 13 privacy, plus existing conformance kit).
Settings, profiles, and roles/workflows system (Mission S06). NALA now has a layered settings resolver, provider profile system, and signed roles/workflows for governing agent behavior across workspaces. (1) SettingsService (src/daemon/nala/settings/SettingsService.ts) — effective-settings resolver with 4-scope precedence (defaults → user → workspace → session), setting definitions with securitySensitive flag, CRUD, import preview (quarantines unknown keys), migrations with version stamps, health test, and export (never includes secrets, only secretRefs). Corruption recovery via atomic read with fallback. (2) ProfileService (src/daemon/nala/profiles/ProfileService.ts) — provider profile CRUD, clone, compare (diff of providerId, authRef, billingClass, model, mode, permissions), import preview (detects missing providers, unknown capabilities, executable resources), import (forces autoActivate: false), export (strips secrets), health test. 3 built-in profiles (full-access, supervised, read-only). Bounded to 1,000 profiles. (3) RoleService (src/daemon/nala/roles/RoleService.ts) — 7 signed built-in roles (scout, researcher, planner, implementer, reviewer, verifier, oracle) with capability sets and boundary policies; 7 built-in workflows (research-then-implement, plan-review-implement, parallel-scouts, sequential-review, verify-after-implement, oracle-consult, full-cycle); custom role/workflow creation with signing. (4) Shared schemas (src/shared/nala/settings-types.ts, src/shared/nala/profile-types.ts) — Zod schemas for settings, profiles, import previews, comparisons, migrations, and resets. (5) RPC (registerS06Rpc.ts) — 20+ endpoints for settings (resolve, update, reset, export, importPreview, importSnapshot, definitions, migrations), profiles (upsert, get, list, delete, clone, compare, importPreview, importProfile, export, healthTest), and roles/workflows (list, get, create custom). (6) Tests — 47 new tests (16 settings, 18 profiles, 13 roles).
Trace bridge wiring (Mission S05 fix). JsonOrchestrationStore now forwards every appendActivity call to TraceIngestionService via setActivityListener(). Added 30+ dotted-form event kind mappings (task.created → task_created, etc.) to TraceIngestionService. Added eventsByTrace index to TraceLedgerService for efficient trace-level queries. Relaxed AlertService and ExporterService to accept partial upserts with schema-parsed defaults.
Production packaging, updates, and release certification documentation (Mission S08). 11 new operational documentation files: (1) pi-release-dependency-graph.md — frozen dependency graph with SBOM, provenance, hashes, licenses, and scans; (2) pi-reproducible-build.md — reproducible build for all components with integrity verification; (3) pi-installer-platform-matrix.md — Windows/macOS/Linux installer integration matrix; (4) pi-data-migration-rollback.md — transactional migrations, backup, compatibility windows, rollback; (5) pi-secure-updates-remote-policy.md — TUF-inspired update metadata, channels, rollout, remote policy; (6) pi-saas-entitlements-usage.md — feature classification, entitlements, usage metering, account lifecycle; (7) pi-clean-machine-upgrade-certification.md — clean VM test matrices for all platforms; (8) pi-security-resilience-certification.md — security/chaos/soak suites with 24-hour soak plan; (9) pi-support-playbooks.md — 10 support playbooks (auth, provider drift, quarantine, etc.); (10) pi-final-release-gate-rollout.md — final gate evaluation with gradual rollout; (11) RELEASE_CERTIFICATION_REPORT.md — final certification report with S01-S08 gate verdicts (46/52 PASS, 6 EXTERNAL).
Continuation audit report (Mission S09). docs/desktop-saas/MISSION-S09/CONTINUATION_AUDIT_REPORT.md — full audit of S06-S08 with 10 findings, 5 fixes applied, gate verdicts, and final release gate verdict of READY_WITH_EXPLICIT_LIMITATIONS. All 1,014 NALA tests pass across 71 test files with 0 TypeScript errors.
Production hardening (Mission 05). NALA's orchestration layer is now hardened for production with 8 batches of security, governance, and reliability improvements. (1) Electron/IPC/process hardening (B1) — CSP now enforced in development mode with Vite HMR allowances; frame-ancestors 'none' and base-uri 'self' added to prevent clickjacking and base tag injection; shared Zod schemas (src/main/ipc/schemas.ts) for high-risk IPC handlers (pty.create, pty.resize, pty.dispose, shell.openExternal, shell.openPath, clipboard.write, diff.request, fanout.request, worktask.ref, tts.speak) with size limits, format validation, and enum constraints; pty.create handlers validate payload shape before process-spawning code runs. (2) Resource governance and emergency stop (B2) — centralized ResourceLimitsSchema with safe defaults for task runtime, idle timeout, artifact size, storage quota, tool result size, delegation depth, concurrency, message size, provider health-check interval, process count, and retry limits; all limits configurable via NALA_* environment variables; global emergency stop via NALA_EMERGENCY_STOP=1 disables all non-core features in the capability manifest; validation helpers for artifact/tool result/message/delegation depth/runtime; exponential backoff calculator. (3) Provider compatibility matrix and policy manifest (B3) — signed ProviderPolicyManifestSchema with per-provider, per-transport route status (approved, experimental, personal-only, blocked); BUNDLED_SAFE_POLICY as last-known-good fallback; ProviderCompatibilityMatrixSchema with version ranges, known limitations, fallback transports, and per-architecture certification; validateProviderVersion() returns warnings for version drift; policy evaluation helpers (isProviderBlocked, isWrappedSessionDisabled, meetsMinimumVersion). (4) Fake provider conformance kit (B4) — cross-platform fake CLI scripts simulating ACP, Codex, Claude SDK, JSONL, and hostile protocols; 9 predefined conformance scenarios (normal, malformed, oversized, protocol pollution, unauthenticated, slow response); writeConformanceKit() generates all scenario scripts for CI testing without consuming plans or secrets. (5) Diagnostics bundle and privacy controls (B5) — exportable redacted DiagnosticsBundleSchema with versions, providers, launch profiles, compatibility status, recent events, sessions, resource limits, and optional logs; secret scanner detects OpenAI/Anthropic keys, Bearer tokens, passwords, private keys; export refuses if secrets are found; PrivacySettingsSchema with telemetry disabled by default; 7 minimized telemetry event types (no prompt content, code, or terminal output). (6) Versioned state migrations (B6) — MigrationRegistry with idempotent, resumable, transactional migrations; automatic backup before destructive migrations; 3 NALA state migrations (initialize profiles, add schemaVersion, add resource governance defaults). (7) Future NALA provider seam (B7) — NALA_MANIFEST reserves the 'nala' provider ID through the normal manifest system; FakeNalaAdapter proves the seam works without UI special-casing; 'nala' added to BUILTIN_PROVIDER_IDS; nala-default environment policy added. (8) Documentation (B8) — architecture, threat model (8 threats with mitigations), runbooks (6 procedures), and release checklist. 169 new tests across 7 test files.
Unified Pi-wrapped launch UX and provider routing (Mission 04). NALA now has a versioned launch-profile and route service that governs how each provider button behaves when clicked. (1) LaunchProfileService — a daemon-side service (src/daemon/nala/providers/LaunchProfileService.ts) with profile CRUD, default route assignment, capability validation, and route resolution with fallback options. Each provider has an AgentLaunchProfile with a route (direct, pi-wrapped, ask-each-time), wrapped execution style, auth/model/mode/permission/cwd/resume policies. Default routes: Pi button → pi-wrapped, all others → direct (no silent migration). (2) Route-aware launcher — the useLaunchRoute hook resolves the route via nala.launch.resolve RPC, then dispatches to direct or pi-wrapped launch. Falls back to direct if the daemon doesn't support the route RPC. (3) LaunchRoutePicker — modal dropdown for ask-each-time route selection. (4) ProviderButtonContextMenu — right-click menu on provider buttons for quick route switching with health badges. (5) SessionRouteBadge — π badge for pi-wrapped sessions in tab titles and Fleet cards. (6) CapabilitiesDrawer — slide-out panel showing session identity, provider health, 15 capability flags, available models, and notices. (7) PiWrappedOnboarding — first-run dialog explaining NALA tools, A2A messaging, permission bridge, and session resume. (8) ProviderDoctorPanel — diagnostic panel integrating the Provider Doctor with per-provider policy status, installation, auth, transport, and model discovery. (9) SessionResumePanel — recovery panel for pi-wrapped sessions with Resume through Pi / Resume directly / Start fresh options. (10) LaunchProfileSettings — settings section in the NALA tab with per-provider route selector, profile list, and Provider Doctor inline view. (11) Feature flag — nala.launchProfiles capability with NALA_DISABLE_LAUNCH_PROFILES=1 emergency kill switch. (12) Pi-wrapped resume — ResumeBinding extended with launchRoute field; piWrappedResumeEnvPatch() re-injects NALA bridge env vars on resume. 6 new RPC methods, 31 new tests.
Universal provider adapter contracts (Mission 02). NALA now has a versioned, schema-validated contract system for universal provider adapters. (1) universal-provider-types.ts — defines ProviderManifest, UniversalAgentAdapter interface, NalaAgentEvent normalized event envelope, AuthMode (7 modes: official_cli_subscription, official_cli_api, pi_oauth, direct_api, coding_plan_key, local_runtime, unavailable), ProviderTransport (8 transports), ProviderCapabilityDeclaration (26 granular capabilities), and all associated Zod schemas with validation helpers. (2) provider-manifests.ts — manifests for all 10 supported providers: Codex, Claude, Grok, Cursor, Devin, Z.AI, OpenAI, Anthropic, Ollama, LM Studio. Each manifest declares transports, auth modes, capabilities, documentation URLs, terms URLs, minimum versions, and policy revisions. Z.AI is not enabled by default and does not claim to be keyless. (3) ProviderRegistry.ts — central registry with per-provider environment policies that prevent silent billing-mode switches. Claude subscription mode removes ANTHROPIC_API_KEY; Grok subscription removes XAI_API_KEY; Devin stored-login removes WINDSURF_API_KEY; Codex ChatGPT-plan removes OPENAI_API_KEY. The buildChildEnvironment method constructs sanitized child environments without deleting user environment variables globally. (4) SecureCredentialService.ts — stores provider API keys using Electron safeStorage (Windows DPAPI). Secrets are never returned to the renderer; only redacted metadata (last 4 characters) is exposed. Decrypted values exist only in the trusted main process for minimum time. (5) AcpAgentAdapter.ts — hardened ACP (Agent Client Protocol) client adapter with JSON-RPC 2.0 over stdio, protocol version negotiation, session management, streamed events, permission handling, cancellation, bounded line/message sizes, stderr separation, request timeouts, and process-tree cleanup. (6) StructuredCliAdapter.ts — fallback adapter for providers that don't support ACP or a dedicated SDK transport. Runs the provider CLI in one-shot or streaming-JSON mode with shell:false, prompts via stdin, bounded output, and separate stdout/stderr. (7) ProviderAdapterFactory.ts — factory that creates the appropriate adapter for each provider based on the preferred transport and fallback chain. Codex uses codex-app-server → structured-cli; Claude uses claude-agent-sdk → structured-cli; Grok/Cursor/Devin use acp-stdio → structured-cli; Z.AI uses anthropic-compatible/openai-compatible; local runtimes use local-runtime. (8) ProviderDoctor.ts — diagnostic service that reports on all providers' installation, auth, capabilities, policy status, and billing-mode conflicts. Includes Z.AI plan eligibility caution, Claude policy date notice, and Grok/Cursor collision detection. (9) Fake ACP agent test harness — a minimal ACP-compatible agent (fake-acp-agent.mjs) for contract testing with modes for normal, slow, malformed, crash, permission, and stderr-noise scenarios. 19 new tests (9 ACP contract + 10 ProviderDoctor) validate all paths. 285 total tests pass.
Pi project trust bridge (Mission 01 audit). A new PiProjectTrustBridge (src/main/pi/PiProjectTrustBridge.ts) maps NALA workspace trust to Pi project trust with explicit user approval. Unknown workspaces default to untrusted (fail-closed). Trust decisions are persisted to trust/trust-decisions.json with approver, timestamp, and workspace identity hash. Identity changes (path modification) trigger re-approval. IPC handlers pi:trust:get, pi:trust:approve, pi:trust:revoke expose trust management to the renderer. The diagnostic report now includes trust decisions.
Pi bridge /nala-doctor command and structured handshake (Mission 01 audit). The @nala/pi-bridge extension now provides a /nala-doctor slash command with full diagnostic output (protocol version, runtime version, handshake status, capabilities, PI_CODING_AGENT_DIR). The handshake protocol is now structured as a versioned NalaPiHello JSON message emitted to stderr, with protocol version negotiation and rejection of unsupported versions. The handshake includes workspace ID, agent ID, task ID, session ID, launch nonce, and capability list.
Pi agent harness integration (Mission 01). NALA now bundles and manages a Pi runtime as a sixth built-in provider. Pi (v0.80.7, MIT) is a universal agent harness that runs as an app-managed subprocess in a NALA terminal pane. (1) PiAdapter — a new BaseAdapter subclass (src/daemon/nala/providers/PiAdapter.ts) that resolves the app-managed Pi runtime (never searches PATH for a global pi), builds launch specs with node <cli.js> args, and scopes Pi's config directory to NALA's app-data via PI_CODING_AGENT_DIR. (2) PiRuntimeManager — a main-process singleton (src/main/pi/PiRuntimeManager.ts) that resolves, verifies, and manages the bundled Pi runtime. It checks required files (cli.js, rpc-entry.js, package.json), probes pi --version, and injects NALA_PI_RUNTIME_PATH and NALA_PI_HOME env vars into the daemon spawn. (3) Quick-launch button — a Pi button with a π logo appears in the NALA Orchestration Bar alongside Claude, Codex, Devin, Cursor, and Grok. Clicking it launches Pi in a terminal pane with NALA identity env vars. (4) @nala/pi-bridge extension — a first-party Pi extension (integrations/pi/package/) that injects NALA workspace context, emits lifecycle events, and provides /nala-status and /nala-workspace slash commands. (5) Integrations structure — integrations/pi/ contains the pinned provenance lock (pi-runtime.lock.json), zero-patch ledger, fetch/build/verify scripts, and the vendored runtime. (6) IPC diagnostics — pi:health, pi:diagnostics, and pi:set-dev-override IPC handlers expose runtime health to the renderer for Settings display. (7) Baseline documentation — docs/pi-integration/01-baseline.md documents the full agent launch path, Pi architecture, and ADR-001 (subprocess decision).
PiAdapter and PiRuntimeManager fail-closed security hardening (Mission 01 audit). The PiAdapter previously had dev-mode fallbacks that searched process.cwd() and __dirname for the Pi runtime, violating the fail-closed invariant (Mission 01 §2.5, §6.1). A malicious cli.js placed in the current directory could have been executed. The adapter now uses ONLY the NALA_PI_RUNTIME_PATH env var injected by PiRuntimeManager. The PiRuntimeManager's dev-mode fallback is now gated on NALA_DEV=1 so production builds never resolve a runtime from the cwd. A regression test verifies that a fake cli.js in the cwd is NOT found. The PiHome fallback was also changed from ~/.nala/pi to os.tmpdir()/nala-pi-fallback to avoid touching the user's global Pi config.
Multi-tier agent executable resolution with cross-platform support. NALA's agent launcher now uses a 4-tier fallback chain to find agent CLIs on any platform: (1) Custom path — user-specified path; bare names like claude are treated as callsigns (shell resolves via PATH), absolute paths use the full path. Stale custom paths fall through to lower tiers instead of failing. (2) PATH search — preferred tier; produces a portable callsign (devin ... instead of & 'C:\...\devin.exe' ...). (3) Platform known paths — all 5 built-in adapters (Claude, Codex, Devin, Cursor, Grok) now return per-platform install locations for Windows (AppData), macOS (homebrew, ~/.claude/bin, ~/.local/bin), and Linux (~/.local/bin, /usr/local/bin). Previously only Windows AppData paths were hardcoded — macOS/Linux only worked via PATH search. (4) Package manager dirs — checks npm global, homebrew, cargo, pipx, and volta directories as a last resort. (5) Cross-platform PATH refresh — refreshSystemPath() now spawns a login shell on macOS/Linux (/bin/zsh -l -c "echo $PATH" or $SHELL -l -c "echo $PATH") to catch agents installed via brew install, pipx install, etc. after the app launched. Windows PATH refresh (registry merge) is unchanged. (6) Generalized disambiguation — rejectPathPatterns on BaseAdapter replaces the Cursor-specific resolveExecutable override. Cursor rejects paths containing grok directories; Grok rejects paths containing cursor-agent directories. Rejected candidates are skipped and resolution continues to the next tier. (7) Version validation — each adapter declares an expectedVersionPattern regex; probe() emits a VERSION_MISMATCH notice when the binary's --version output doesn't match, catching shell aliases or wrong tools shadowing the callsign. (8) Probe result enrichment — ProviderProbeResult now includes matchedVia (which PATH entry, known path, or package-manager dir matched) for diagnostics. resolvedVia expanded from ['path','known','custom'] to include 'pkg-manager', 'bundled', 'not-found'. The nala.provider.detectAgents RPC exposes matchedVia. (9) Custom provider platform paths — CustomProviderDefinitionSchema gains optional knownPathsByPlatform ({ win32?, darwin?, linux?, other? }) for platform-specific install locations. The flat knownPaths array remains as a cross-platform fallback. 48 new tests in resolutionTiers.test.ts cover all tiers, platform paths, callsign inference, disambiguation, version patterns, and probe enrichment.
Voice dictation master toggle + configurable PTT hotkey. Users can now fully enable/disable voice dictation and customize the push-to-talk activation key from Settings → Dictation. (1) Master dictation toggle — a new "Voice dictation" on/off switch at the top of the Dictation settings tab controls all voice features. When off, the Dictate button is hidden from the toolbar, the PTT hotkey is not intercepted, and toggleDictation() shows a "Voice dictation is disabled in Settings" warning. No microphone audio is captured. (2) Configurable PTT hotkey — the push-to-talk activation key is no longer hardcoded to Space. A new "Push-to-talk hotkey" card in settings lets the user click a capture button and press any key (optionally with Ctrl/Shift/Alt/Meta modifiers) to set the activation combination. A "Reset to Space" button restores the default. The keyboard shortcuts reference card now shows the configured hotkey (e.g., "Hold Ctrl+Space") instead of a hardcoded "Hold Space". The hotkey string format is Modifier+...+KeyCode (e.g., Control+Space, Shift+Alt+KeyV); new utility functions parseHotkey, hotkeyMatches, formatHotkey, and hotkeyLabel handle parsing, matching, and display. The SttConfig type expanded from 12 to 14 fields (dictationEnabled, pttHotkey); all settings persist across sessions via session.json and are pushed to the main process via VOICE_CONFIG_UPDATE IPC. For the default Space hotkey, the existing shouldHandleSpacePtt policy (IME guard, xterm helper check, editable target check) is preserved; for custom hotkeys, a simpler "terminal must be focused" check is used. Short-tap behavior (type a space on quick Space tap) is preserved for Space only — custom hotkeys cancel silently on short tap.
Gatsby theme — 1920s Art Deco easter-egg skin. A new "Gatsby" theme in Settings → Appearance transforms the app into a Jazz Age masterpiece. The palette is drawn directly from Fitzgerald's symbolism: deep bay-black night (#0A0E08), champagne-cream text (#F4E9C1), rich gold accent (#D4AF37), and the iconic green light (#7EC8A0) as the secondary/link accent — "a single green light, minute and far away, that might have been the end of a dock." Beyond the standard color tokens, the theme layers Art Deco decorative elements throughout the UI: (1) Gold gradient headings — h1/h2 titles render with a shimmering gold gradient (Art Deco background-clip: text). (2) Gold-bordered Card surfaces — settings cards get a subtle gold border with a gradient surface fill and inset gold top highlight. (3) Green light pulse — running agent status dots (.sidebar-dot-running) pulse with a soft green glow, echoing Gatsby's eternal hope at the end of Daisy's dock. (4) Gold terminal cursor — the xterm cursor is gold (#D4AF37) via the dedicated gatsby xterm palette, with a subtle gold border framing the terminal viewport. (5) Art Deco corner ornaments — modal dialogs get geometric stepped gold corner brackets (Chrysler Building motif) via ::before/::after pseudo-elements. (6) Sunburst status bar — the status bar gets a subtle radiating-line conic gradient background (the most iconic Art Deco motif). (7) Chevron zigzag dividers — <hr> elements render as repeating zigzag patterns in dim gold. (8) Gold-on-black scrollbars — scrollbars get a gold gradient thumb on a black track. (9) Art Deco input fields — text inputs (text, number, search, password, email, textarea, select) get a gold-underlined style with a gold glow on focus. (10) Green-light toggle glow — active toggle switches emit a soft green glow. (11) Gold focus rings — all :focus-visible outlines use gold. (12) Green-light text selection — text selection uses a translucent green-light background. (13) Gold-accented active tabs — the active settings tab gets a gold left border with an inset glow. (14) Gold range sliders — slider inputs use gold accent color. (15) Subtle gold button hover glow — buttons emit a faint gold halo on hover. All animations respect prefers-reduced-motion. The theme also includes a dedicated xterm terminal palette (gatsby) with matching gold cursor, green-light ANSI greens, and champagne foreground. The theme appears as the 11th option in the theme grid — a fun easter egg for users to discover.
STT settings overhaul — microphone selection, audio processing, transcript formatting, and live audio level. The Dictation settings tab now has detailed controls organized into sections: (1) Microphone device picker — enumerate available mics via enumerateDevices, select a preferred device, or use auto-selection (best laptop mic scoring). A Refresh button re-enumerates devices after plugging in a USB mic. (2) Audio processing toggles — independently enable/disable noise suppression, echo cancellation, and auto gain control (all default on). These are passed as getUserMedia constraints so the browser's DSP handles them before audio reaches whisper. (3) Transcript formatting — capitalize first letter (default on), auto-add trailing punctuation if the transcript lacks terminal punctuation (default on), and trailing space for multi-phrase dictation flow (default on). These are pure post-processing on the transcript text before injection. (4) Live audio level indicator — the VoiceStatusChip now shows a real-time mic level bar during recording, driven by an AnalyserNode on the mic stream (RMS level at ~60fps, respects prefers-reduced-motion). (5) Keyboard shortcuts reference card — shows "Hold Space = PTT", "Click Dictate = Toggle", "Esc = Cancel" directly in settings. All new settings persist across sessions and are pushed to the main process for diagnostics via VOICE_CONFIG_UPDATE IPC. The SttConfig type expanded from 5 to 12 fields; WhisperService.reconfigure() and getConfig() handle all new fields.
Robust agent callsign resolution (PATH-first with live refresh). NALA now reliably launches agents using their bare callsign (e.g., devin --permission-mode dangerous) instead of fragile full paths (e.g., & 'C:\Users\...\devin.exe' --permission-mode dangerous). Key improvements: (1) Live PATH refresh — before each agent launch, the daemon re-reads the system PATH from the Windows registry (HKCU + HKLM), so agents installed after the app launched are detected immediately without restarting. (2) Callsign disambiguation — Cursor and Grok previously both claimed agent as a PATH callsign, causing ambiguity; Cursor now only uses cursor-agent (its dedicated callsign), while Grok uses grok. (3) Detection scan RPC — a new nala.provider.detectAgents RPC returns a summary of which agents are installed, how they were found (PATH callsign vs known path vs not found), and their version. (4) resolvedVia + callsign fields in ProviderProbeResult — the UI can now show whether each agent was found on PATH (portable callsign) or via a known install location (full path fallback). The callsign-first approach makes launches portable across machines, survives binary updates/moves, and produces readable one-liners in the terminal.
TTS pause elimination (gap trim + pre-buffer). Read Aloud no longer has mid-sentence pauses. Two new settings (Settings → Read Aloud) fix the root cause: (1) Gap trim (0–200ms, default 40ms) removes the natural silence Kokoro inserts at the start/end of each sentence chunk, tightening the gap between consecutive chunks. (2) Pre-buffer (0–500ms, default 150ms) delays the first sound slightly to build a head-start buffer, so when a long sentence takes more time to synthesize than the previous sentence took to play, there's buffered audio to fill the gap — no silence. Both settings are adjustable via sliders and persist across sessions.
STT push-to-talk toggle + smoother state. The spacebar push-to-talk can now be toggled on/off in Settings → Dictation (default: on). When off, only the Dictate button works — the spacebar is never intercepted. The hold threshold slider now ranges from 15–150ms with 5ms steps for finer control. The default hold time is reduced from 45ms to 30ms (33% shorter) so a brief press is enough to trigger dictation. The voice status chip and toolbar button no longer flash "Dictate" before "Listening…" — both show "Listening…" instantly when you hold the spacebar, with no visible state transition (entrance animation and CSS transitions removed for instant feedback).
nala update CLI command — always run the latest stable. A new nala update (also wmux update) CLI command checks GitHub Releases for a newer stable version, downloads the installer, SHA-256-verifies it, and launches it — all without needing the app or daemon to be running. On Windows, the Squirrel Setup.exe handles kill-install-restart automatically. On Linux AppImage, the downloaded AppImage replaces the running one and relaunches; deb/rpm are opened with the system package manager. Use --check to only report availability without installing, and --json for machine-readable output. This means every time you run nala update, you end up on the latest stable build.
Launch-time update check (no more 30-minute polling). The in-app auto-updater previously checked for updates 15 seconds after launch and then every 30 minutes. The periodic 30-minute check has been removed — now the app checks once on fresh launch and auto-downloads the installer if a newer stable version exists. The user gets a "Restart to update" prompt when the download is verified. This aligns with the "always latest stable on launch" goal without being disruptive mid-session.
Dictation settings tab (Settings → Dictation). STT/voice dictation can now be configured from the UI instead of environment variables only. The new Settings → Dictation tab includes: whisper model selection (tiny.en / base.en / tiny / base / small, with size and speed notes), language selection (24 common languages + auto-detect), push-to-talk hold threshold slider (30–150ms), auto-preload toggle, a live engine status indicator (idle / loading / ready / error with model name), and reset-to-defaults. Model changes restart the whisper worker automatically; language changes take effect on the next dictation (no restart needed). Settings persist across sessions via session.json.
Instant push-to-talk (speculative capture). The mic now starts the instant you press Space — not after a hold timer. Previously, holding Space to dictate waited 100ms before even starting the microphone, then another 50-200ms for getUserMedia(), so the total press-to-dictate latency was 150-300ms. Now the mic starts on keydown, and the 60ms hold threshold only decides tap-vs-hold (if you tap, the speculative audio is discarded and a normal space is typed). A warm mic stream is also kept open between dictations to eliminate getUserMedia() latency on subsequent presses. Net effect: dictation starts capturing audio in ~0ms on warm presses (vs 150-300ms before).
Agent callsign launching (PATH-first). When you click a provider button (Claude, Codex, Devin, Cursor, Grok), NALA now launches the agent using its bare callsign (e.g., devin --permission-mode dangerous) instead of the full file path (& 'C:\Users\...\devin.exe' --permission-mode dangerous). This works because most agent CLIs install themselves on PATH. If the callsign isn't on PATH, NALA falls back to the known install location. The callsign approach is more portable (survives binary updates/moves), more readable in the terminal, and matches how users naturally launch agents. Custom providers also get callsign support via their executableNames field.
Dark window frame with white title bar symbols. The main window now uses titleBarOverlay with a dark background (#050C0E) and white min/max/close symbols, so the window frame matches the app theme instead of using the Windows system accent color (which could be orange, blue, or any color).
Release notes in Settings → About. The update widget in the About tab now shows a collapsible "Release notes" panel with the CHANGELOG excerpt for the available version, so users can read what changed before clicking "Update & Restart".
Full i18n coverage for update UI. All 23 locales now have translations for the StatusBar update keys (checkForUpdates, checking, settings, about, restartToUpdate, updateReady, upToDate) — no more English fallback for any locale.
Topbar "Restart to update" button. When an update is downloaded and SHA-256 verified, a pulsing green "↻ Restart to update" button appears in the status bar next to the settings gear — one click installs and restarts. No need to navigate to Settings.
Settings dropdown with "Check for updates". The settings gear (⚙) in the topbar now opens a dropdown menu with "Check for updates", "Settings", and "About" — so manual update checks are one click away if auto-detect fails on startup.
Agentic tools settings + MCP tools. Agents can now call 6 new MCP tools, each gated by a Settings → Tools toggle. Safe tools (on by default): agent_list_workspace (see agents in workspace), agent_prompt (send a prompt to another agent). Dangerous tools (off by default): agent_spin_up (spin up a new agent in a terminal), agent_open_window (open a new workspace window), agent_open_terminal (open a new terminal), agent_spawn_subagent (spawn a subagent for delegated work). When a tool is disabled, agents get a clear "enable in Settings → Tools" message. Settings persist across sessions with fail-closed guards on dangerous tools.
Quiet toasts by default. Most toast notifications are now suppressed — the UI already surfaces those signals inline (badges, panels, status), so the pop-ups were just noise. Only actionable error-level toasts appear by default; routine info/warn toasts ("copied!", "workspace created", "long paste truncated") are dropped at the store boundary. Settings → Notifications adds a "Toast minimum level" selector (Error / Warning / All) to dial verbosity back up, and the existing toast on/off toggle now fully silences them. The setting persists across sessions.
Read Aloud: paste text to hear it spoken. A new card at the bottom of the workspace turns a clipboard paste into spoken audio using Kokoro-82M, a fully local, open-source TTS model — no cloud calls, no Python, no GPU required. Click the card, paste (Ctrl+V or any native paste gesture), and the text is read aloud sentence-by-sentence via Web Audio, starting in well under a second on subsequent uses (streaming synthesis — the first sentence plays while later ones are still being generated). The pasted text is never rendered or stored in DOM state. A new Settings → Read Aloud tab offers voice selection (15 curated English voices across US/UK accents, grouped by accent and gender with quality grades and trait descriptions), a voice preview button to audition any voice without pasting, speed (0.75×–1.5×, Kokoro's duration-aware speed so it stays natural, with quick-select preset buttons), a fast/higher-quality toggle, volume, auto-play-on-paste, interrupt-vs-finish policy for pasting while already speaking, and a reset-to-defaults button. First use requires an internet connection to download the ~90 MB voice model; after that, it works fully offline. The model runs in a Node.js worker_thread inside the Electron main process so synthesis never stalls the UI. Pasted text is normalized (markdown fencing, headings, links, bold/italic, list markers, emoji, and smart quotes are stripped) so docs and chat read naturally. The worker auto-terminates after 5 minutes of idle to free memory. When auto-play is off, pasting "primes" the card (green indicator) and a click starts speaking. A retry button appears on error. Download progress is shown as a percentage and inline progress bar during first-run model fetch.
Agent callsigns — same-provider instances get distinct names. Launching three Devin panes used to show "Devin CLI" on every tab, sidebar row, and Fleet card with no way to tell them apart. Each agent launch now auto-assigns a short, futuristic callsign (Vega, Cipher, Onyx, …) from a ~50-entry pool, scoped per-workspace so the same name never recurs twice in one workspace at the same time. The callsign seeds Surface.title at launch, so tabs, sidebar, Fleet cards, and nala_agent_list all show it automatically. a2a_discover returns it as agentName (callsign-first) alongside a separate agentType (the detected CLI flavor), so an orchestrating agent can address "Agent Vega" by matching the callsign instead of guessing which "Devin CLI" to send to. FleetCard's display-name priority was reordered to paneLabel || title || agentName so an explicit callsign wins over the generic detected type. Manual rename (double-click a tab) still works and is never overwritten — callsigns only seed new launches. Right-click a tab for a "Reroll callsign" action that picks a fresh random name from the pool (excluding other tabs' current names). The a2a_discover and nala_agent_list MCP tool descriptions now explicitly mention the callsign field so orchestrating agents know to match it when a user says "tell Vega to…".
Agent detection for Devin CLI, Cursor CLI, and Grok Build. The agent detector now recognizes three additional CLI tools — Devin CLI (Cognition), Cursor CLI (cursor-agent), and Grok Build (xAI) — so their panes get the correct agent slug, status tracking (waiting-at-prompt detection), and signal routing. The AgentSlug union was extended in all three sync locations (AgentDetector, shared/events, integrations/shared/signal-types) per the existing contract.
Create a workspace from a folder. wmux new-workspace --cwd <dir> (also --dir/--path, or a bare directory path) opens a workspace whose terminals start in that folder and is named after the folder by default. In the UI: sidebar + → Open folder…, or the command palette Open Folder as Workspace.
Workspace isolation for agent-to-agent messaging. Agents launched inside a workspace can now only discover, message, and broadcast to agents in that same workspace — run separate multi-agent fleets on multiple projects with no bleed-through. Sibling agents stay fully addressable (discover lists every agent pane in your workspace; broadcast pings each sibling pane), replies to human-bridged cross-workspace tasks still work, and your own tools (UI, CLI) keep full cross-workspace reach.
Fan-out sub-tasks know their slice. Each spawned agent's prompt now opens with its task name, position ("sub-task 2 of 4"), the sibling task list, an only-your-slice scope rule, and a pointer to the mission channel — instead of N agents all receiving the identical prompt and colliding on the same work.
True YOLO. With YOLO on, NALA never interrupts you — agent-to-agent execute requests and spawn proposals approve automatically, even in Connect/Orchestrate modes. The only "agent needs you" moment left is an agent's own CLI asking a question in its terminal, which shows as that tab's figure-8 freezing. Settings → NALA now explains YOLO and each A2A mode in plain language.
Per-provider status-bar visibility. Settings → NALA → Providers has show/hide checkboxes for each quick-launch button (all shown by default); the row re-spaces itself automatically. Buttons are now square, logo-only marks — no more Cl/Cx/Dv/Cu/Gk letters.
Smart provider launch. Clicking a provider button with an empty, untouched terminal focused opens the agent right there — seamlessly, in the same tab position, no flash — instead of adding a new tab; any activity keeps the new-tab behavior, and clicking several provider buttons in a row spawns one terminal each.
Tab figure-8 is the agent status light. A tab hosting an agent always shows the mini figure-8: moving while the agent works, frozen and dimmed when it's idle, finished, or waiting on your input. The bell icon is gone. The motion tracks real activity — an agent parked at its prompt (or a trust dialog) freezes within ~3 seconds even if its coarse status still says running.
Close every terminal. Closing the last terminal no longer auto-respawns one — the pane shows a calm empty state (still figure-8, "All quiet here", a New Terminal button) until you start something. Restarts still boot with a fresh terminal.
Dictate into any text box. Hold Space in any input, textarea, or editable field — modals, popovers, Idea Capture, Rich Input — and speech streams in at the caret as you talk, same near-live cadence as terminal dictation. A short Space press still types a space. The target is pinned when you start talking, so slow transcription can't land in the wrong place.
Bottom-toolbar tools always work. Attach, Snippets, Rich Input, and Dictate are never greyed out by focus quirks — each resolves its terminal via a fallback chain (focused → active pane → any), and creates one if the workspace has none.
No console window in the taskbar. Launch via scripts/NALA.vbs (point the desktop shortcut there) — the launcher console runs hidden; output stays in logs/launch.log. The daemon was already windowless.
Tasks & Artifacts and Plan are now in the sidebar. The two actions that lived in a dedicated strip under the status bar moved into the sidebar (both the expanded list and the collapsed icon rail), so they're always reachable regardless of sidebar position. The panel and sheet themselves are unchanged.
pendingSamples with pendingDurationMs, computed from each chunk's actual sample rate.getConfig() hardcoded pttHoldMs: 60 instead of using the VOICE_PTT_HOLD_MS constant (now 45ms). The diagnostics config now reflects the actual default.renameSync that backs up the existing AppImage before replacing it was not wrapped in try/catch — an ENOENT or EACCES would crash with an opaque error. Now wrapped with a clear error message.xdg-open spawn calls had no error handlers — if the child process failed to start, the CLI would exit silently. All three now have .on('error') handlers that report the failure in both human and JSON mode.error handler that fails-closed.getFallbackVersion() only read package.json relative to __dirname, which fails in a Squirrel install. Now tries the running app via system.identify RPC first, then falls back to package.json, then 0.0.0 (any published release will be "newer").joinChannelDaemon() and hydrateChannelsCatalog() promise chains had no .catch() — a daemon RPC rejection (not just ok:false) would be an unhandled promise rejection. Both now have .catch().workerScriptPath() used candidates[0]! which would crash if all candidates were empty strings. Now uses candidates[0] ?? '' — the caller already checks fs.existsSync() and reports a clear error.useReadAloud.ts was missing gapTrimMs and preBufferMs fields when constructing a TtsConfig object, causing a TypeScript build failure. The fields are now read from the zustand store and included in the config sync effect's dependency array so changes to either setting propagate to the TTS worker.audioPlayback.test.ts tests were failing because the default preBufferMs=150 caused small test buffers to be queued instead of scheduled (making isPlaying() return false), and zero-filled buffers were stripped entirely by trimSilence. Tests now use non-silent test buffers and disable pre-buffering via setPreBufferMs(0) to test the scheduling logic directly.ttsConfig.test.ts expected TTS_DEFAULT_CONFIG without gapTrimMs/preBufferMs; updated to include the new default values (40ms / 150ms).update.electronjs.org, which returned 404 for private repos and required an external service. Now fetches update-manifest.json directly from GitHub Releases (same self-describing approach as Linux) — no external dependency, no 404.titleBarOverlay with a dark background (#050C0E) and white symbols to match the app theme.createWindow.ts, tray.ts, and index.ts no longer falls back to nala-icon.ico/nala-icon.png — only the standard icon.* files are used, ensuring the white-on-black NALA icon is always shown.#62C8D4) is now white (#FFFFFF) across the default Nala Stream theme — focus rings, figure-8 dots, active tabs, beam glows, and all --accent-blue references now match the white "N" branding.releaseNotes (extracted from CHANGELOG by CI), and the UpdateManifest / LinuxUpdateManifest TypeScript interfaces include the field for type safety. The Settings → About update widget captures and displays these notes in a collapsible panel.done:true, error chunk from .catch() but didn't set terminalSent = true, so .finally() sent a second redundant done:true chunk. Now the catch path sets the flag so the finally is a no-op.TtsService.onWorkerMessage for type === 'error', the error status was set unconditionally — even when the error's requestId belonged to an already-superseded request. A stale error could flip a newer request's status to error. Now only errors for the pending request (or genuine worker-level errors with no pending request) surface to the status handler.resolveAgent IPC call (during daemon handler-swap windows) had no .catch(), causing an unhandled promise rejection. Added the same best-effort catch used in AppLayout.tsx for the identical call.execFileSync('git', ...) which intermittently fails when 5960+ tests compete for temp directory I/O and process spawn slots. Added a retry wrapper (2 retries with 100-200ms backoff) and a 15s timeout to the git helper so transient git failures don't cause test failures.t('toolbar.snippetsEmpty').useRef so each SearchBar has its own independent history.t() with 11 new i18n keys.name, executableName, appBundleId, and win32metadata — the packaged executable used the internal "wmux" name instead of "NALA", and Windows metadata (Company, Product, Description) was unset. Added name: 'NALA', executableName: 'NALA', appBundleId: 'com.nala.app', and full win32metadata (CompanyName, ProductName, FileDescription, OriginalFilename) so the installer and taskbar show "NALA" correctly.src/main/index.ts had a console.log('[DEBUG] registering app.on(ready)') that printed to the console on every startup. Removed.rootPane, activePaneId, and nextPaneOrdinal before applying the grid template, and restores them on dismiss if the sample task hasn't completed. The saved layout is cleared on success so no rollback occurs after a successful sample task.t() with 18 new i18n keys.|| 'Search messages…' and || 'Type a message…' fallbacks — t() always returns a string, so the fallbacks were dead code that bypassed i18n.useT and use t('toast.dismiss'), t('toast.statusMessages'), and t('dialog.close').await destroyCompanyWithCleanup()). The stale TODOs were removed to avoid confusion.<div>/<span> elements that lacked role and tabIndex (multiview workspace tiles, department headers, PR badges, mission rows, search results) now have role="button"/role="link", tabIndex={0}, and onKeyDown handlers for Enter/Space; 13 <input> elements without labels (browser URL bar, command palette search, terminal search, pane/surface rename, settings keybinding/color/agent-command inputs, workspace profile env-var inputs) now have aria-label attributes. 9 new i18n keys added for the aria-labels.useNotificationSound.ts created a module-level AudioContext singleton that was never closed. Added disposeNotificationSound() export so the context can be explicitly closed to release audio resources.t() with new en/ko locale keys. Two variable-shadowing bugs in NalaTaskPanel (local const t = shadowing the translator t) were also fixed.animate-spin, text-only "Loading..."), plus 8 buttons that just disabled with no visual indicator. All loading states now use the same FigureEightLoader component with appropriate size variants:
FigureEightLoader size="inline"FigureEightLoader size="inline" + textFigureEightLoader size="pane" + text (centered)FigureEightLoader size="pane" + text (centered)FigureEightLoader size="inline" instead of just disabling or showing "…"FigureEightLoader size="inline"FigureEightLoader size="inline"FigureEightLoader size="inline" + textanimate-spin is intentionally kept (standard browser convention).wmux.json (the config file) and wmux mcp register (the CLI command) are intentionally kept as-is.voiceTranscribeUiTimeoutMs used Math.max(VOICE_TRANSCRIBE_MAX_MS, ...) instead of just the duration-scaled timeout + slack. A 1s clip should time out in ~22s (20s main + 2s slack), but the UI waited over 2 minutes before reporting a timeout. Now the UI timeout is voiceTranscribeTimeoutMs(duration) + 2s, so short clips fail fast and the user gets feedback in seconds, not minutes.TTS_STATUS(error) but was immediately clobbered back to idle by the late terminal done=true audio chunk (sent by the handler's finally block). Both useReadAloud and useTtsPreview now clear the requestId in the error handler so the stale done chunk is ignored, leaving the error state visible to the user.useReadAloud and useTtsPreview now call api.stop(requestId) in their cleanup effects, so closing the Settings panel mid-preview or unmounting a pane stops the worker instead of letting it synthesize audio that nobody will hear.assets/nala-icon.ico when assets/icon.ico is missing, matching the prestart script's fallback logic.prefer-const in test files, irregular whitespace in JSDoc, empty interface declarations (→ type aliases), {} type in i18n, control character in regex, and stale react-hooks/exhaustive-deps disable comments referencing an uninstalled plugin rule.SharedArrayBuffer ReferenceError in sandboxed preload. voice.transcribe() failed instantly on every call because instanceof SharedArrayBuffer throws ReferenceError in the sandboxed preload context (the global isn't defined there). Now guarded with typeof SharedArrayBuffer !== 'undefined'.useReadAloud() pipeline, just relocated and regrouped.TERM_PROGRAM=wmux and TERM_PROGRAM_VERSION, the industry-standard variables that CLI tools check to detect a capable terminal emulator. Without them, tools fell back to Windows Console Host (conhost) detection and warned about limited support. Stamped at both spawn sites (local and daemon mode), after all env filtering, so a workspace profile or replayed session can never override the terminal identity.redactionVersion on activity append + a ProviderIdSchema re-export clash), so nala.provider.* never registered and every click failed. Activity append now defaults redactionVersion, first-class provider ids are namespaced separately from agent provider ids, and a rebuilt daemon exposes the RPCs again.useVoiceController requires a parent <VoiceHost> no longer crashes the app. HMR / remount races could leave VoiceButton or VoiceStatusChip without a provider; the hook now falls back to a disabled no-op controller instead of throwing.nala.* RPCs the bundled MCP server calls (task get, agent list, message send/reply/inbox, spawn propose, artifact/claim list) were missing from the method-capability map and the first-party grant, so nala_* tools were denied in enforce mode. They now carry a2a.read/a2a.send capabilities and are first-party granted; the rest of the nala.* surface stays wmux.internal.rolloverSegment now flushes with minSec: 0 so the pending buffer is always cleared at the 45s cap, even when a recent live flush left less than 0.7s buffered. Without this, flushSegment would return null without clearing pending, while the capture loop reset its sample counter — corrupting subsequent segment tracking.nalaYoloActive, nalaA2aMode) so the settings panel and the toolbar control always agree instantly.destroyCompanyWithCleanup was fire-and-forget — the store flipped to company === null before async pty.dispose handlers finished, which could dereference the just-cleared store. The handler now awaits the cleanup Promise.all before the store mutation.getPipeName() in shared/constants.ts had a top-level require('os') that Electron's sandboxed preload require shim cannot resolve — an eager module-scope import broke preload loading entirely (silent blank-screen boot). The require is now confined to the function body, which only executes in main/daemon contexts.transcribe() IPC call could hang or throw when passed a detached ArrayBuffer or a SharedArrayBuffer view — structured-clone across IPC can't handle either. The preload now clones the audio into a standalone Uint8Array before invoking, so the renderer's audio pipeline never trips the edge case.launch-nala.cmd, not from npm start / start:fast, so running the app from the command line showed the stock Electron atom in the Windows taskbar. A new cross-platform prestart script (scripts/prestart-stamp-icon.js) stamps electron.exe with the NALA icon via rcedit AND registers the AppUserModelID with the icon in the Windows registry, so the taskbar always resolves the correct icon. The main process also registers the AUMID at boot as belt-and-suspenders.SharedArrayBuffer defensive check added to preload's voice.transcribe() (see the entry above) referenced the bare SharedArrayBuffer global directly — but it isn't defined at all in Electron's sandboxed preload context, so audio.buffer instanceof SharedArrayBuffer threw a ReferenceError synchronously on every single call, before the audio ever reached the whisper worker. Because that throw happened while building the argument to the renderer's withTimeout(...) wrapper, it landed in the same catch block as a real timeout and surfaced as "Dictation timed out — try a shorter phrase" regardless of clip length — making a 100%-reproducible crash look like an intermittent timeout. Fixed by guarding the reference with typeof SharedArrayBuffer !== 'undefined' first. Verified live: both a 3s and a 50s synthetic clip now transcribe successfully end-to-end (whisper worker → main → preload → renderer).loadModel that captured the wrong dtype on ready; (2) loadModel hanging for 120s if the worker was terminated during load (missing exit listener); (3) setConfig dtype invalidation only firing on ready state, missing downloading/loading; (4) intentional worker termination clobbering the idle status with an error; (5) ReadAloudCard missing the speaking CSS class (dead selector); (6) handlePaste not always clearing the hidden textarea; (7) worker error messages missing requestId so the service couldn't correlate errors to the pending request; (8) handleLoad not clearing the previous model before loading a new one (ONNX model leak); (9) playChunk with a zero-length buffer creating a source that never fires onended (stuck isPlaying); (10) nested bold/italic markdown (**_text_**, ***triple***) not fully stripped; (11) ensureReady not verifying loadedDtype matches config.dtype; (12) "stopped" rejection from intentional cancellation showing as an error on the Read Aloud card (now returns to idle gracefully).setInterval handles (A2A GC, WorkTask GC, resume spool drain, dead session reaper, buffer snapshot) were never cleared in shutdown(). All five used .unref() so they didn't block process exit, but they could fire mid-teardown and race with session disposal and state saves. The handles are now module-level and cleared at the start of shutdown().wmic.exe in three places (boot ID retrieval, sync boot ID, shell process verification). wmic.exe is deprecated on Windows 10/11 and may be removed in future updates. All three now use PowerShell Get-CimInstance via the shared windowsPowerShell51Path() helper.daemon.whenReady() and probeProjectConfig()) had no .catch() handler, causing unhandled rejections in the renderer. Both now have best-effort catch handlers.default case silently dropped unknown event types — now logs a warning. The browser panel's clipboard write silently swallowed errors — now logs to console.warn.portWatch.ts had its own windowsPowershellPath() function duplicating windowsPowerShell51Path() from shared/shellResolution.ts. Now imports the shared helper instead.WhisperService refactored for speed and reliability. Defaults are now sourced from shared/voiceConfig (tiny.en model, int8 compute, en language) instead of hardcoded constants, with env overrides for model, language, threads, and timeouts. CPU thread alignment between BLAS env vars (OMP/MKL/OPENBLAS) and ctranslate2's cpu_threads was fixed — previously BLAS was hardcoded to 4 while Python capped at 6, under-using available cores on higher-core machines during the latency-critical transcription path. Hard timeouts with stuck-worker kill prevent UI hangs. Tmp file pruning reduced from 1h to 20min.
Provider quick-launch buttons show real brand marks (Claude, OpenAI, Devin, Cursor, Grok — path data from lobe-icons / Simple Icons) next to the short labels.
Bottom-toolbar popovers and NALA sheets rebuilt on the shared dialog design — Rich Input, Snippets, File Explorer, Idea Capture, and the Tasks panel now use the ui primitives: 12px-radius surfaces, larger inputs, Ctrl+Enter submits, theme-token backdrops, one primary action per flow.
Bottom toolbar slimmed to icon-only chips. The agent toolbar now matches the status bar's compact density — square icon-only buttons (h-6, rounded 6px) with labels demoted to tooltips, instead of full icon+label buttons. The separate NALA chrome strip that sat between the status bar and the terminal content is gone; its Tasks & Artifacts and Plan triggers moved into the sidebar. The Dictate button was slimmed to match — icon-only with the label and Space hint in its tooltip.
Experimental: hidden panes can skip output parsing (Settings → "Skip hidden pane rendering"). Even with the shared output scheduler, hidden agents' output was still parsed eventually — and measurement showed that parsing total is what drags the visible pane once several background agents stream at once (4 hidden flooders pulled the visible pane down to ~10–20fps). With this toggle on (daemon sessions only, default off), hidden panes' output is queued but never parsed: the renderer does no parsing work for panes you aren't looking at. A pane whose backlog outgrows its cap is marked stale and transparently re-synchronized from the daemon's session buffer when revealed — the daemon replays the authoritative bytes onto a reset terminal, so what you see on reveal is the pane's true current state, never a duplicate or a half-parsed frame. Agent-facing buffer reads (wmux_search_panes, terminal_read) hydrate a stale pane before reading so orchestrating agents never see old output. If a re-sync can't complete (dead session, legacy daemon), the pane degrades to its last-known screen instead of sticking or losing its identity.
Diff comments now wake the task agent (J4). Commenting on a hunk in a fan-out task's diff surface no longer just records a note — it @-mentions the task's agents on the mission-channel post, so the existing mention→wake loop nudges them to read and act on the feedback. Every non-human member of the mission channel (excluding you, the commenter) is mentioned at the workspace level, so multiple agent panes sharing one workspace all get woken; if every agent has left the channel the comment still posts, just without a mention. The post's body also carries a [diff: <file> @ <hunk>] <comment> prefix so an agent reading the channel over the CLI or MCP (which don't render the structured anchor) still sees which file and hunk the comment is about. The success message reports how many agents were pinged.
Fleet cards surface an agent's completion evidence. A fleet card now shows a small ✓ evidence n/m badge when the pane's most recently completed A2A task carries structured completion evidence — n is how many of the m evidence items are actually verified (a passed command, or a verified inspection/artifact). It's the "trust it ran unattended" proof made legible on the card: the check reads green once at least one item is verified and stays muted when nothing is (verified is a grade, not a claim), and the task title plus the evidence summary live in the badge's tooltip so the on-card text stays a single compact token. The badge reads existing task state only (no new store or round-trip), is addressed per-pane (a pane-pinned task shows on exactly that pane; a workspace-level task shows on the workspace's active pane), and simply isn't drawn when there's no such task.
Multiple workspaces full of busy agents no longer stutter the visible terminal. Every pane used to push its PTY output straight into its own terminal the moment it arrived over IPC — including panes in hidden workspaces — so a fleet of background agents ran that many independent parse/render pipelines on the one renderer thread, and the pane you were actually typing into starved between them. Terminal output now flows through a single shared scheduler: the visible pane keeps the exact direct-write path it always had for ordinary output (zero added latency), while hidden panes' output is batched and drained cooperatively under a hard per-tick time budget, so no amount of background agent chatter can pin the UI. Even the visible pane's own output floods are chunked through that budget rather than parsed in one blocking pass, so watching a chatty agent stays responsive too. Nothing is dropped — a hidden pane's backlog is handed over in full when it becomes visible (before its reveal repaint), when a reconnect replay needs it, or if it ever exceeds the scheduler's memory cap (which simply restores the old behavior for that pane).
Diff-panel comments now actually post to the mission channel. The diff comment post omitted the sender identity the daemon requires, so every comment was rejected with a "코멘트 발사 실패" authorization error instead of being recorded. The comment now posts as the diff's owner workspace (its own mission-channel member row), which is also what lets the new @-mention wake the agent.
events.poll no longer lets an agent eavesdrop on another workspace's channels (audit B3). The event-poll RPC previously scoped its results by a caller-supplied workspaceId, so a same-user pipe/MCP client could live-subscribe to any workspace's private channel messages, channel lifecycle, and A2A task pointers just by naming that workspace's id — no pane identity required. Those confidentiality-sensitive event types are now scoped to a server-resolved workspace derived from the caller's verified senderPtyId (the same identity anchor the a2a.channel.* mutations already use), and the caller-supplied workspaceId is ignored for them; an unresolvable caller receives none of these events (fail-closed). The bundled MCP wmux_events_poll tool forwards its own PID-walked senderPtyId, so a legitimately-placed agent still sees its own channels and tasks unchanged. The first-party operator surface (the app's own renderer/plugin host) keeps scoping across the local workspaces it names. Ordinary lifecycle events (pane/process/agent/workspace metadata) are unaffected — their all-workspace firehose was already reachable by any events.subscribe subscriber, so their workspace scope was never a confidentiality boundary and external lifecycle subscribers keep working.Task lifecycle: close, one-click PR, and a cleanup list (J3). A fan-out task's diff surface now carries 닫기 (Close) and PR buttons, so you can finish a harvested task without touching the terminal. Close runs in a deliberate order — it removes the task's git worktree first and only commits the close (and archives the mission channel) once the worktree is gone, so you can never end up with a "closed" task whose output still litters disk. If the worktree is dirty, close is held: the task stays open, the output is preserved, and a toast tells you to review the diff and commit/PR or discard it. If there are committed-but-unpushed commits, close warns instead of silently dropping them. PR is one click (with a single confirm that names the branch and warns a pre-push hook may run): it gates on gh being installed and authenticated, refuses if the worktree is dirty (uncommitted work wouldn't be in the PR), pushes the branch, and opens a PR against the repo's default branch — and it's idempotent, so a second click after a half-finished attempt recovers the existing PR URL instead of erroring. The PR URL is recorded on the task and the PR-status cache is refreshed immediately. A new "태스크 정리 목록" (Task Cleanup List) command in the palette scans the dedicated worktree root against live tasks and surfaces four kinds of leftovers — unmaterialized-open, disk-missing, dirty-preserved, and orphaned directories (reverse-mapped by an on-disk task.json stamp so they're identifiable even after a closed task ages out of memory) — with an inline Close for the ones that are still open tasks. If a fan-out agent pane comes up but its prompt never fired, you now get a "프롬프트 미발사" toast with a 재발사 (re-fire) action that re-sends the task's original startup command (agent launch + prompt together, same sanitization as the normal path) after checking the prompt file still exists — it never pastes the raw prompt into a bare shell. Finally, a task workspace whose pane wanders outside its worktree boundary gets a small ⚠ 이탈 badge in the sidebar (best-effort, warning only — nothing is blocked).
Operators can now join private agent-made channels. The channels panel grows a collapsed discovery section listing every channel on the daemon — including private rooms agents created without inviting the human, and archived rooms for audit visibility — with a one-click join. Joining seats the operator as a regular member with full history, and appends a server-published, viewpoint-neutral system marker ("Operator joined this channel") to the channel as an audit row; the marker consumes a sequence number but owes no member an unread, so agents are not nudged by it. The join surface is strictly human-side: the RPC methods are unreachable from agent transports (pipe router unregistered, first-party MCP exclusion), pinned by boundary tests.
Fan-out missions are now visible in the sidebar and fleet panel. Workspaces created by a J1 fan-out now show up under a "Missions" group at the top of the sidebar (title, open/closed status, and a link into the mission's channel) — the group only appears when a workspace has fanned out, so ordinary workspaces are unaffected. The fleet panel's cards also grow a mission line when they belong to a fan-out task. The existing worktree badge (⊕) is untouched — it marks the low-level "this is a git worktree" fact, while the new Missions section marks the higher-level "this is a fan-out task" fact, and a workspace can carry both. Mission data is read-only and pulled (mount + workspace-set changes + a 15s background poll for status drift + an immediate refetch right after a fan-out completes), since the daemon doesn't push mission updates.
Fleet view is now always-on chrome instead of a full-screen modal. Ctrl+Shift+A still toggles it, but it now mounts as a fixed-width panel alongside the workspace sidebar and channel dock (mirroring the channel dock's existing flex-sibling layout) rather than a fixed overlay with a backdrop — other panes stay visible and interactive while it's open, and closing it no longer drops keyboard focus into <body>: the element that had focus when it opened is restored. The fleet/approvals/remote tabs, keyboard row-navigation, and approve/deny shortcuts are unchanged; the card grid narrows to fit the panel's width instead of a full-screen layout. Two focus bugs found in review were fixed before this landed: opening the panel now lands real DOM focus on the active card/row (not just the panel container, which used to leave keyboard users unable to reach any card when only one was present), and row shortcuts (Enter=approve, Backspace/Delete=deny) now only fire when the option row itself is focused — previously an auto-approve checkbox could steal focus and cause those keys to mis-fire as an approval/denial.
Type scale: apply the wave-1 semantic tokens to the always-visible chrome. The sidebar (WorkspaceItem, MiniSidebar), channel dock (ChannelsPanel, ChannelView, ChannelMembers), and fleet panel (FleetCard) now use .text-caption/.text-body instead of hardcoded text-[11px]/text-[13px] — swapped only where the token's actual size (caption=11px, body=13px) matches the literal exactly, so there is no size change. Elements that already carried an explicit font-*/leading-* utility are unaffected (utilities win over the token's own weight/line-height); a handful of small mono labels that had no explicit weight now pick up the caption token's weight 500 instead of the browser default 400 — a deliberate, disclosed exception, not a bug. 8px/9px/10px/12px literals in these six files are left untouched (no matching token without a size change) for a later pass.
Design tokens: promote hardcoded modal shadows, z-index literals, link accent, and typography to named tokens (visual-invariant). Internal design-system cleanup with no visual change: the six-way-duplicated 0 25px 60px rgba(0,0,0,0.75) modal shadow and the rgba(0,0,0,0.6) backdrop are now --shadow-modal/--backdrop-modal; eight ad-hoc z-[…] literals map to a named --z-* stacking scale (values and relative order unchanged); the link accent gains an accentSecondary token wired to the existing accent value across all eight built-in themes (a hook for future differentiation, currently identical); and a four-tier typography scale (--text-display/-title/-body/-caption) is defined with three representative applications. All values are byte-identical to the originals — verified against the pre-change literals by a three-model review — so themes render exactly as before. The sidebar's two bespoke "Copied!" DOM toasts (workspace-info copy and cwd copy), which each hand-built a bottom-center element and bypassed the canonical toast surface, now route through the shared toastSlice/ToastContainer so copy feedback is styled by one token-driven container instead of duplicated inline CSS (they adopt the app-wide bottom-right/5s presentation as a result). Four dark-only hardcoded hex values that broke the light themes are tokenized: the browser title bar and URL-bar resting state (#11111b → var(--bg-mantle)) and the browser-close / palette-item hovers (#3b1e1e/#2a2a3d → var(--bg-overlay)) now read correctly under hinomaru/taegeuk — these four spots intentionally normalize to the sibling components' tokens, so dark themes see a subtle shade shift there (e.g. #11111b → #181825, and the two outlier hover tints join the twenty sibling hovers already on --bg-overlay) rather than staying byte-identical. The custom-theme-editor, contrast-warning, and color-inspect chrome keep their fixed high-contrast hex by design (they must stay legible while the live theme is being edited/broken), and the webview inspector overlay keeps self-contained hex because it is injected into arbitrary guest pages that have no wmux theme variables.
workspaces tree, which is replaced on every agent-output metadata tick — and the renderer had zero React.memo barriers, so agent activity re-rendered large components continuously and clicks landed on an already-busy render thread. Subscriptions are now minimal derived selectors backed by a reference cache (unchanged projections return the same array/element references, so components only commit when a field they actually display changes), workspace list items self-subscribe by id behind React.memo, title/cwd/git-branch metadata writes are coalesced to one store write per frame, and the 1-second status-bar clock is isolated into its own tiny component. A new re-render regression suite (React Profiler commit counting + selector reference-contract tests) pins the fix: unrelated workspace churn now produces zero commits in unrelated components. (2) Main-process stall: the 5-second periodic session autosave performed a synchronous atomic write on the main event loop, delaying whatever IPC a click had just issued. The periodic path is now an async atomic write with a write-epoch guard and post-write recovery — if an in-flight async write races a newer event-driven synchronous save (the reboot-survival path), the newer snapshot is re-committed immediately, so the final on-disk state matches the latest save under any interleaving (crash-loss window unchanged at ≤5s; exit paths still flush synchronously).Diff review & hunk adoption: harvest a fan-out task's output (J2). Fan-out tasks now have a fourth surface type — a diff surface — that reads a task worktree's uncommitted changes against its merge-base and lets you review, comment, and cherry-pick them into the target repo. Fan-out's result toast gains a "diff 열기" action that opens the diff for that task's workspace. The panel shows a file tree (numstat), a unified diff (+/- coloring only — no full IDE editor, by design), per-hunk checkboxes, and an adopt button. Adoption is all-or-nothing: the selected hunks are reassembled into a single patch (file headers and hunk bodies preserved byte-for-byte, only hunk line-counts recomputed) and applied with one git apply — the target is either fully changed or fully untouched, never half-applied. Adoption is gated hard: a target snapshot (HEAD/branch/dirty set) is captured at read time and re-verified at apply time (rejects if the target moved), any selected file that is dirty in the target is refused (conflict avoidance), a combined pre-apply --check is the gate (so hunks that only apply together aren't wrongly blocked), and hunks already applied to the target are surfaced as an explicit failure so you can deselect them. Untracked files are synthesized into proper new-file patches (regular files only — symlinks/FIFOs are labeled unsupported so a symlink can't leak a file from outside the repo); rename/copy/mode/binary changes and files over the 512KB/2MB caps are display-only (adoption refused, double-checked). File names with spaces, non-ASCII, or quotes are handled correctly (-z porcelain, quotepath off). Comments post to the task's mission channel with a diff-comment anchor (file + hunk header) and render inline under the matching hunk on reload; comments whose hunk header no longer matches the current diff drop into a "위치 이동됨" group (v1 anchor precision is hunk-header granularity — line-level anchors are deferred). The whole path is backed by a validation rig that proves adoption atomicity under a mid-apply kill and catches a re-serialization corruption (dropped no-newline marker) as a shipping blocker.
Perf harness: N-pane instrumentation + boolean consistency gates (W2, dev/CI-facing). Extends the existing A1 app benchmark (scripts/perf-bench.mjs + scripts/perf-compare.mjs, driven by .github/workflows/perf.yml) rather than adding a new harness, turning the B2 engine-resume decision from an undefined "feels blocked" call into recorded numeric + pass/fail gates. Four scenarios now run by default on a dedicated bench instance (isolated from the coldStart/input/RAM numbers): (1) N-pane concurrent-streaming frame budget — the 8-pane split loop is generalized to spawnPanes(client, page, n), and at N=4/8/16 every pane's PTY is flooded with continuous output while the renderer's rAF cadence is sampled; each N is gated independently (scenarios.frameBudget.N{n}.frameDeltaMs.p95, ratio 2.0 = the strategy doc's "budget 2×"). (2) Korean IME composition — since CDP/playwright-core cannot drive a real IME, the scenario synthesizes the DOM composition contract xterm's CompositionHelper consumes (compositionstart/compositionupdate/compositionend + input + textarea.value diff) on the focused pane's hidden helper-textarea and verifies the PTY echoes the composed string (안녕하세요) back byte-for-byte; self-validating (a non-equivalent synthesis would echo nothing and fail). (3) Long scrollback — reuses the existing --scrollback-lines flag as a run combination (no new logic). (4) WebGL context-loss/restore — forces WEBGL_lose_context.loseContext()/restoreContext() on the focused pane's canvas and measures recovery via the webglcontextrestored event + !isContextLost() (plus a live-canvas re-count), recording recoveryMs. perf-compare gains a BOOL_GATES array (baseline-independent: scenarios.ime.pass / scenarios.webglContextLoss.pass FAIL immediately when present-but-not-true) alongside the three new numeric frame-budget gates; both stay record-only until an owner blesses a CI baseline (existing bench/baseline-ci.json convention). New CLI flags: --frame-budget-panes 4,8,16, --skip-frame-budget, --skip-ime, --skip-webgl-recovery. Pure logic (frame-stat summary, IME echo comparison, gate judgment) is factored into scripts/perf-scenarios.mjs and unit-tested; the CDP-driven scenario bodies are validated on the Windows CI target only (this being a macOS worktree, they cannot run locally — an honest, documented limitation). No product-code (src/) changes.
Fan-out: one prompt → N isolated agent tasks (J1). The AgentToolbar gains a fan-out entry that spawns up to 8 WorkTask missions from a single prompt, each with worktree isolation by default: a dedicated git worktree under {wmux home}/worktrees/{repoHash}/{taskSlug} on a fresh wtask/{slug} branch, a dedicated task workspace (agent pane + shell pane, startupCwd pinned to the worktree), an auto-opened private mission channel (task workspace invited as a member), and the prompt delivered via a file-backed initialCommand (prompt body lives outside the worktree so task diffs stay clean; the path is shell-quoted for POSIX and PowerShell). The whole call is idempotency-keyed end to end — double-clicks and IPC retries can never mint duplicate worktrees — and a global preflight validates the repo and every task's slug/branch before any task or channel is created (unfit input rejects the batch with zero side effects). Per-task failures compensate individually (mission closed, channel archived, any created worktree preserved — never deleted) and surface in a per-task result report (materialization / channel-link state). Worktree operations are serialized per repo (no index.lock races), dirty worktrees refuse removal (preserve-and-list; no force-delete API exists), and bare/submodule/LFS repos fail closed. The daemon activates the reserved task.update materialization path (branch/worktreePath/paneGroupId, write-once monotonic, owner-or-CEO gated) and enforces the canonical-worktree-path exclusivity invariant. A separate broadcast-only action (send text to every terminal pane in the current workspace) is deliberately kept apart from fan-out — non-isolated "fan-out" does not exist. Includes a reboot-survival demo script (single task round-trip: daemon restart → projection restored, worktree intact on disk).
WorkTask mission channels: durable task canon + minimal mission-channel lifecycle (J0, dev-facing). Introduces WorkTask — the worktree-mission unit (domain:'task' in the append-only event log) that J1 fan-out and J2 diff will build on — as a projection-first daemon service (daemon/worktask/WorkTaskService), kept deliberately distinct from the A2A Task (different lifecycle + transition graph). Two new pipe RPCs plus their thin MCP tools (channel_mission_start / channel_mission_close) create a WorkTask AND a bound private mission channel in one call, and close flips the task to closed while archiving the channel. Ownership is server-constructed and born-owned (owner = createdBy, never caller-supplied); close authz is a task-level gate (owner OR CEO), the first line of defense over the channel gate. Identity rides the same senderPtyId → verifiedWorkspaceId server stamp as a2a.channel.* mutations (fail-closed on unresolvable identity). Crash-safety is enforced end-to-end: mission channels carry a wmux:mission:{taskId} topic anchor, boot runs a fixed replay → bidirectional reconcile → closed-GC order (an orphan channel from a crash between channel-create and task-append is archived; a closed task whose channel is still active is re-archived — both idempotent no-ops when already settled), and an append-failure on start triggers an immediate compensating archive (the empty-channel reaper cannot reap it — the creator remains a member). Start/close are idempotency-keyed so a lost-response retry never creates a duplicate mission + channel, and re-closing an already-closed mission is a no-op success. Closed tasks are GC'd from the projection after 7 days (log untouched — a view bound only), with archive-unconfirmed tasks exempt. J1+ materialization fields (branch/worktreePath/paneGroupId/prUrl) and the §6.M lease / born-pending contract are schema-reserved but not yet active; task.mission.list is pipe-only in J0 (MCP exposure deferred to J1). Renderer unchanged.
E0 conformance harness: recorder + corpus + differential runner (§6.A M1/M2, dev-facing). Introduces the terminal-emulator conformance harness under top-level core/harness/, the measurement scaffolding for the future clean-room VT core. M1 (recorder + corpus): a script-driven recorder (recorder.ts) spawns a real PTY via node-pty to exercise initial geometry + resize, then emits a deterministic recording.bin (raw bytes), events.jsonl (init/resize/reflow_mode trail with monotonic byte offsets), and meta.json (seed + workload-script sha256). PTY spawn, resize, and abnormal-exit failures are escalated (thrown) rather than swallowed, so a broken geometry-exercise path fails the gate instead of silently no-op'ing. The committed corpus (corpus/) is six deterministic synthetic workloads only — scroll flood, resize roundtrip (80→79→80, an explicit non-reflow control at 40 chars where no wrap occurs), resize reflow (120 chars that wrap into two rows, so the 80→79→80 roundtrip actually exercises the rewrap path — its golden pins xterm.js's observed deterministic post-roundtrip state, not an idealized restoration), alt-screen enter/exit, CJK/emoji/VS16/ZWJ width cases, and the SGR spectrum (16/256/truecolor + attribute flags) — each carrying ≥3 golden assertions next to its definition. A companion miner (miner.ts) scrubs {stateDir}/buffers/*.buf dumps (multi-layer: api-key/token/secret key=value, AWS uppercase-snake credential envs, URL userinfo, JSON "key": "…" credentials, PEM private-key blocks, known token prefixes sk-/ghp_/gho_/xox…, Bearer headers, OSC 52 payloads, and a base64 high-entropy heuristic) to a local-only, git-ignored output whose write root is pinned to core/harness/corpus-local/ (an isolation guard rejects any in-repo non-ignored path) — .buf preserves only the ring tail (no geometry), so mined output is for mid-stream robustness and fuzzer seeds, never the deterministic corpus. M2 (differential runner): differ.ts feeds a recording into @xterm/headless@6 (with @xterm/addon-unicode11 pinned to Unicode 11 as the baseline width model) behind a Subject interface (our E1 core and a third reference plug in later), extracts a full-cell grid snapshot (char, width, fg/bg + portable color booleans, 9 style flags, cursor, active buffer), and diffs two snapshots cell-by-cell into a report whose classification schema encodes the four-way ledger (our-bug / xterm-bug / spec-ambiguous / intended) — where intended is admitted only via an explicit approval list (intended-diffs.json, loaded onto the diff path via loadIntendedDiffs), never implicitly. The diff compares the active buffer (normal vs alternate) before cell comparison and excludes xterm.js's non-portable raw color-mode integers from cross-subject comparison; before replay, the event stream is validated (first event is init, byte offsets are monotonic non-decreasing in original order and within range) and violations throw rather than being hidden by sorting; reflow_mode events encountered during replay are honestly recorded on the result. The four-part baseline gate ships as tests: determinism (two xterm.js runs identical) — including a chunk-boundary robustness check that feeds each recording one byte at a time and requires an identical layout to whole-buffer feed (a narrow, documented ZWJ-joiner-at-write-boundary char difference is the only tolerated exception; widths/cursor/colors/flags must match) — no-crash full-corpus completion, golden-assertion pass, and record→replay round-trip stability that reads the committed corpus into memory first and regenerates into a separate temp dir (the gate never writes the repo corpus, so the drift check is no longer a self-comparison). Throughput is recorded as the xterm.js baseline (steady-state feed MB/s + full-cell extraction time). Wired as a fourth vitest lane (vitest.harness.config.ts, tsconfig.harness.json, npm run test:harness). Zero product-code changes; existing test lanes and typecheck unaffected.
Append-only event log: crash-safe primitives (envelope PR1). Introduces the segmented NDJSON append-only log (daemon/eventlog/AppendOnlyLog) and the shared event-envelope schema (shared/eventlog) — the foundation for rewiring the channels and A2A canonical state to a crash-safe commit log (§6.L). Key properties: fsync coalescing (group-commit batches), single-ftruncate per-batch rollback, boot-time forward-scan recovery (trim at the first corrupt byte, no partial promotion), Lamport/seq high-watermark resume (reuse forbidden, gaps permitted), and fail-stop on truncation failure rather than silently diverging coordinates. Includes machine-id minting and recovery, and a durable option for atomicWrite (fsync sequence). No service is wired to this log yet — that lands in subsequent PRs.
Event log migration engine (envelope PR2). Adds the zero-downtime boot gate (daemon/eventlog/migrateToEventLog) that promotes legacy channels.json to log mode, plus the durable-only EventLogManifest (atomic migration-complete marker) and SnapshotStore (latest → .bak → reseed → genesis fallback chain). Detection uses three branches: inexplicable state is quarantined under quarantine/ and retried rather than silently accepted. Conversion failures leave the legacy file intact and are idempotent on retry. Downgrade detection uses a Lamport + state-hash watermark — a record of an older daemon's writes triggers a reseed snapshot. Compaction safety: no truncation before durable confirmation; genesis and reseed snapshots are never truncated. Not wired into daemon boot yet.
A2A tasks are now durable in the daemon event log (envelope PR4). Canonical A2A task state moves from the renderer's in-memory store (30-min GC, lost on restart) into A2aTaskService in the daemon, persisted as domain:'a2a' envelopes in the append-only log. Create, transition, and cancel all reach the log under fsync commits; tasks survive restarts via projection replay. VALID_TRANSITIONS is enforced daemon-side — out-of-graph transitions are rejected at the canonical source. Background ClaudeWorker transitions (working / completed / failed) now route through the daemon rather than writing directly to the renderer, carrying completion evidence along. The renderer a2aSlice is demoted to a read cache that applies daemon commits verbatim without re-validation; when the daemon is unavailable the existing renderer validation path is the automatic fallback (no degraded behavior). Workspace close force-fails in-flight tasks in the log so they do not resurrect on restart; completed tasks are periodically pruned. Daemon canonical state wins over a stale cache on reconnect, including immediately after restart.
A2A event authContext is now server-stamped; daemon.ping exposes the active log format generation (envelope PR5). The authContext.principalId in every A2A task event (create, transition, cancel) is now derived by the daemon from stored task coordinates rather than accepted from the caller's claim — actor pane for transitions (to.paneId), caller-side pane for cancel/create, workspace fallback for headless workers or unpinned tasks. principalId and trustTier are display/routing/audit fields only; the authorization anchor remains the server-pinned verifiedWorkspaceId invariant. trustTier is always 'semi-trusted', resolved unilaterally by the server (the temporary caller-override field from PR4 is removed — callers cannot claim a trust tier). daemon.ping responses now carry eventLogFormatVersion additively: present when log mode is active (value = the active format version integer), absent in the legacy fallback. Absence signals a pre-envelope daemon to the auto-replacement logic, which treats unknown format generations fail-closed.
A2A completion evidence: schema and pure validator (§6.M P1). Introduces the CompletionEvidence schema and a pure, side-effect-free validator (shared/completionEvidence.ts). Gate = structure: non-empty summary, well-formed items, sanitized paths, DoS caps on body lengths and item counts. verifiedItemCount is derived honestly — an all-unverified completion is accepted at grade 0 rather than rejected (grade is observability, not a gate requirement). Path sanitization rejects colons, leading separators, .., and C0 control characters (undecoded literals enforced). Untrusted-wire normalization: plain-object check, hasOwn gating, fresh-object copy to prevent prototype pollution. Not wired to any transition at this point — gate activation is the next PR, after envelope PR4.
A2A completion evidence: production and transport wiring (§6.M P1). ClaudeWorker now produces structured completion evidence from its Claude run results. Both success and failure paths emit inspection + unverified self-report — run-success is never promoted to verified (no laundering). MCP a2a_task_update transports evidence via a dedicated evidence parameter; the contract is fixed in the tool description and coexists with the existing artifact channel. The renderer bridge normalizes untrusted wire shapes before they reach the store: a poisoned shape is stored as completion_evidence_malformed (additive-inert — no task state change at this stage), and server-only stamps like recordedBy are stripped on ingestion. No rejection gate yet — that is the next PR.
A2A completion-evidence gate activated (§6.M P1). completed/failed A2A task transitions now require structured completion evidence: completed needs a non-empty summary plus at least one well-formed item (command/inspection/artifact), and failed needs a summary (the failure reason). The daemon A2aTaskService.transition is the single enforcement point; the renderer fallback writer applies the same gate for pane-pinned tasks driven by a pane-identity caller or when the daemon is unavailable. Rejections return actionable reason codes (completion_evidence_missing, completion_evidence_no_items, completion_evidence_empty_summary, completion_evidence_invalid_item, failure_reason_missing) and leave task state unchanged with no log append. verifiedItemCount remains an honest grade rather than a gate requirement — an all-unverified completion is still accepted (grade 0). Workspace-teardown force-fail and verbatim application of daemon commits intentionally bypass the gate to prevent split-brain.
Completion evidence grade is now observable in A2A task events (§6.M P1). a2a.task events received via wmux_events_poll now carry verifiedItemCount (count of independently-verified evidence items; 0 = unverified completion) on completed and failed transitions. Event pollers can now distinguish an unverified completion (grade 0) from a graded one without querying the task separately. The count is derived from task.status.evidence at terminal transitions only — non-terminal transitions such as working carry no count. The renderer's primary publisher emits it; workspace-teardown force-fails emit a separate grade-0 event. The trust boundary admits only non-negative integers (forged or out-of-range values are dropped silently). created and cancelled pointers carry no grade field.
Validation rig: harness core + SIM smoke (§6.G, dev-facing). Introduces the self-verifying harness under top-level rig/. Components: run isolation (isolation.ts — fresh temp home per run, 4-env wipe of HOME/USERPROFILE/APPDATA/LOCALAPPDATA, WMUX_DATA_SUFFIX='-rig-{runId}'), headless daemon wrapper (daemon.ts — dist/daemon-bundle spawn with a detached process group, daemon.ping ready-poll, group tree-kill, respawn, explicit error on missing bundle), daemon pipe client (pipe.ts — persistent-socket JSON-RPC, dual-ok-layer unwrap, G6 honest-main discipline: one workspaceId binding per persona, throws on cross-workspace impersonation or reserved identity claims), state assertion helpers (assert.ts — seq integrity, full-body cross-check, unread counts, canonical coordinate comments), and deterministic seed (seed.ts). SIM scenario S1 (flood ×8 concurrent senders → getMessages full cross-check: all-delivered, seq-continuous, no-duplicate) lands as a third vitest lane (vitest.rig.config.ts, npm run test:rig:sim, requires npm run build:daemon first). Zero product-code changes; existing two test lanes unaffected.
Validation rig: simulator scenarios S2–S8 + SIM regression-detection evidence (§6.G, dev-facing). Completes the synthetic multi-agent simulator on top of the R1 harness. The persona framework (rig/harness/persona.ts) handles identity assignment, channel preamble, seed wiring, and member lifetime; behavioral scripts are owned by each scenario. Deterministic scenarios S2–S8 each run against an isolated daemon: S2 channel integrity under ping-pong load; S3 dead-member expiry — unread, membership, and message-ledger remnants asserted against the client-side cursor only (avoids cursor-circular derivation from lastReadSeq); S4 hung-member: post commits immediately with no infinite hold, unread stays accurate; S5 deliveryStatus receipt contract pinned at current behavior (ack-only pending→delivered); S6 cap-boundary ±1 at the wire level (body 8192 B, mention cap 64, evidence item count 64 / item string 4096 B — string overflow is too_large at the gate, item-count overflow is malformed at wire normalization); S7 SIGKILL mid-flood → respawn → one-way subset assertion {ok-commits} ⊆ replay (at-least-once tail promotion: "no uncommitted resurrection" is intentionally NOT asserted); S8 full A2A lifecycle (send→working→completed, gate-rejection→retry, idempotent resend) plus detection of the #354 idempotency-authz ordering bug (non-participant key-replay is blocked after authz, not before). EPERM chaos: chmod 000 on the Unix socket → client isolation, daemon survival, and recovery confirmed; skipped under root (DAC bypass). CL7 early gate opened via stage-1 detection evidence (rig/EVIDENCE.md): #354 fix reverted on a scratch branch → S8 red confirmed → main green restored. Dogfood script catalog (rig/CATALOG.md): 29 scripts triaged — absorb 4, keep 24, retire 1 (zero physical deletions). Zero product-code changes.
w26-1(claude)), so an agent can no longer post under an arbitrary label and two Claude panes can never collapse into one indistinguishable "Claude Code". Names even follow agent swaps: replace claude with codex in a pane and its next message posts under the new name automatically.$WMUX_MEMBER_ID, wmux channel join requires an identity instead of silently defaulting, and the join reply reports the seat you actually got.wmux channel read … hint into an agent-less shell, where it ran as a stray command; it now stays silent there and leaves delivery to polling.Claude Code · w26-1(claude)) plus a per-workspace color badge (round = a human seat, square = an agent pane); human posts read "Me · ", and the roster labels only YOUR row "Me" (another workspace's human seat reads as its workspace name). Previously every Claude pane rendered as an identical "Claude Code" and every workspace's human row read "Me".@w1-2(claude) without picking it from the dropdown used to send as plain text with no warning. Typed tokens that match a live agent pane are promoted to real mentions — including when typed flush against Korean text or punctuation (확인요@…, cc:@…) — and tokens that match nobody get an inline "didn't match anyone" warning instead of a silent drop. An empty @-dropdown now says "No agents to mention" (dismissible with Escape) instead of rendering nothing.wmux channel ack <channel> <seq>), so the wake worker stops re-nudging an agent that has actually consumed the mention.%{...%} zero-width guard, so zsh's line editor miscounted the prompt width and could crash (SIGBUS in zle) during the resize sweep a split triggers. The marker is now width-guarded, matching the bash and PowerShell integrations.w8-1(claude)) as a member directly, not just a workspace. The roster reads as "you + agent panes", each agent showing a live/stale dot for whether its pane is alive. Previously every member was an anonymous local-ui row, which caused the "I added it as a member — why doesn't it hear me?" confusion.principals.json) that unifies every actor (human / pane-agent) under one address space. On daemon restart, pane-agents are backfilled to stale (the daemon cannot prove a pane is still alive) and only a renderer re-registration flips them back to live — this structurally blocks the stale-read-as-live class of state drift.w8-1(claude)) never matched the old agent-slug heuristic, so per-pane mentions now reach the exact pane.local-ui token from message senders and the roster — it now renders as "you" (the on-disk schema stays backward compatible).npm start no longer opens to a blank, flickering window on macOS. Electron loaded the renderer from http://localhost:5173, which macOS resolves to IPv6 (::1) first, while the Vite dev server listens on IPv4 (127.0.0.1) — so the load failed and Electron retried in a loop. The dev-server URL is now normalized to 127.0.0.1. No effect on packaged builds.Headline: you can now @-mention an agent running in your own workspace from a channel — the mention reaches that exact pane, while an agent still never pings its own pane in a loop.
senderPtyId). This lets the receiving side tell a legitimate sibling mention (pane 1 → pane 2 in the same workspace) apart from a true self-loop (an agent mentioning its own pane). Self-loops are dropped; a workspace-level mention with no specific pane on a self-authored post stays conservative and is not routed. Older messages without the field degrade safely.Headline: the built-in F7 shortcut that launches Claude now works out of the box on a Mac, instead of doing nothing until you dug into macOS keyboard settings.
Sessions survive a reboot
Headline: panes that were mid-conversation before an OS reboot now come back exactly as they were — same session id, same scrollback, same permission mode — instead of resetting to a blank terminal. Alongside that, an opt-in unattended supervisor lets a trusted pane restart itself after a crash and, with explicit consent, resume without stalling at a permission prompt.
unattended: true in wmux.json, which restarts it on failure (a clean exit is treated as "task finished," not a crash to relaunch) and, only with a separate explicit consent given in the trust dialog, restores the permission mode it was running under before a restart. Fleet View surfaces each pane's supervision state — armed with a restart count, or a guard-tripped marker when the runaway guard stopped it.exit — it tombstoned the session as dead, and recovery skips dead sessions, purging exactly the ones that were in use. The daemon now recognizes the Windows shutdown-teardown exit code and suspends those sessions instead, so recovery replays them under the same id after reboot.Channels become a two-way agent surface
Headline: v3.10.0 gave channels a place a human can read; v3.11.0 closes the loop on the agent side. An agent can now read a channel instead of only posting into it, discover and join public rooms, invite another workspace into a private one, and get pulled in by an @-mention that arrives as an inbox task and a one-line nudge in its terminal. The conversation view grows up alongside: markdown rendering, a scrollback window that pages older history in from the daemon, and in-channel search. Plus more accurate MCP agent identity and a batch of macOS keyboard and appearance fixes.
Channels become a two-way agent surface — read, discover, invite (#305). Until now an agent could only post into a channel; it never saw what was already there. channel_read lets an agent pull a room's recent history (capped so it doesn't blow the context window), channel_list surfaces the public rooms it can discover and join, and channel_invite lets any member add another workspace — the only way into a private channel. The conversation view gains markdown rendering (with HTML injection stripped), a "load earlier" scrollback that pages older messages in from the daemon, and in-channel message search. Panes also self-name as w<ws>-<pane>(<agent>) so a roster of agents reads clearly, with a GUI rename.
@-mentions pull an agent into a channel (#304, #305). Typing @ in the composer autocompletes the live agents in the channel; a mention of your workspace highlights the message, bumps a dock badge, and routes into the a2a task inbox. When the mentioned pane goes idle, a one-line nudge is pasted into its terminal pointing at a2a_task_query — so calling an agent in a channel actually reaches it instead of sitting unread.
Archive a channel from the header (#302). A two-click arm-then-commit archive button in the conversation header, gated to the channel's creator (the daemon enforces the same authz).
MCP resolves agent identity by walking the process tree (#301). The bundled MCP server identifies which workspace and pane a call came from by walking the caller's process tree to its owning PTY, so a2a_whoami and channel sender attribution work even when environment hints are stripped.
Agent toolbar uses line icons instead of emoji (#309). The per-agent toolbar swaps its emoji glyphs for consistent line icons that match the rest of the UI.
Channel roster shows added members and restores archive tooltips (#303). An invited workspace now appears in the roster immediately, and the archive control's tooltips are back.
Ctrl+C copies the terminal selection even when the channel composer holds focus (#311). With a channel open the composer could swallow the copy shortcut; the terminal selection now copies regardless of which surface holds focus.
macOS: Cmd drives clipboard, multiview, and shortcuts (#307). Clipboard and multiview shortcuts now use Cmd on macOS instead of Ctrl, matching platform convention.
macOS: native button appearance stripped (#308). Buttons no longer pick up the default macOS control styling that clashed with the app theme.
MCP recovers a pane's ptyId from WMUX_PTY_ID when the identity walk misses (#299). A weak environment fallback restores pane identity when the process-tree walk can't resolve it, so same-workspace A2A still addresses the right pane.
CHANNELS.TITLE, the empty-state message) instead of translated copy. They now receive the live translator, so the dock header, empty state, and labels render correctly.Channels grow a human UI
Headline: the A2A channels that agents post into now have a place a human can read and join. v3.9.0 made channels multi-party with a server-verified sender; this release gives them a UI — a collapsible right-side dock that sits beside your terminals, a member roster to see who's in a room and join or leave it, and recent history that loads when you open a channel instead of a blank pane. Alongside the channel UI: copy/paste that survives a CJK IME, live channel delivery that survives a daemon reconnect, and a fail-closed gate on private-channel joins.
Channels move into a right-side dock you can read beside your terminals (#287). A2A channels were agent-only plumbing; now there's a place for a human to watch and join them. The channel list and the active conversation live in a collapsible dock on the opposite edge from the workspace sidebar — a flex column that reflows the panes instead of the old overlay that floated over them, so opening a channel narrows the terminals rather than covering them. Toggle it from the StatusBar #, and it persists across restart. Decoupled from in-app Company mode, so it works without setting up a company first.
Channel member roster — see who's in a room, join and leave (#291). The conversation header shows a member count that opens a roster popover: the workspaces currently in the channel, a self-only leave (the ✕ next to your own row), and an add-a-workspace picker for public channels. Fully keyboard-accessible — no drag-only paths. Leaving the channel you're viewing returns you to the list.
Opening a channel loads its recent history (#293). Channels used to stay blank until a new message arrived in the current session — open a room with a backlog and you'd see nothing. Opening a channel now hydrates its recent messages from the daemon, and a daemon reconnect re-hydrates, so the conversation is there when you look.
Pane + surface lifecycle as MCP tools (#285). Five new first-class MCP tools — pane_split, pane_close, pane_focus, surface_new, surface_close — so an external/headless orchestrator (e.g. a Claude Code supervisor that spawns a worker pane per task and reaps it once committed) can manage its panes through the official MCP instead of dropping down to the raw daemon JSON-RPC. They mirror the workspace-scoped lifecycle RPCs hardened in the #236 family (#238/#256/#257): the create tools (pane_split/surface_new) take an optional workspaceId and default to the caller's own workspace (never the on-screen one), failing closed on an explicit unknown id; the address tools (pane_close/pane_focus/surface_close) take a globally-unique id resolved across all workspaces, and pane_focus is non-yank (it won't steal the user's screen). No new daemon RPC or capability — the methods existed; this surfaces them and grants them to the bundled MCP server's first-party allowlist. Requested by @zhenzoo.
Private channels are join-gated on the daemon (#292). A same-machine caller that knew a private channel's id could join it directly through the daemon and read its history — join() had no visibility check. It now fails closed: a non-member can't join (or read) a private channel it wasn't invited to. Same-machine, same-user only; never remotely reachable.
Live channel delivery survives a daemon reconnect (#290). A leaked rpc:invoke handler registration meant that after the daemon respawned or reconnected, the main process stopped teeing channel messages (and other daemon→main events) to the renderer until a manual reload — so a channel only updated when you reopened it. The handler is now removed correctly on reconnect, so messages keep flowing live.
Copy and paste survive a CJK IME (#294). With a Korean/Japanese/Chinese IME mid-composition, the key event reports keyCode 229 / key "Process", so Ctrl+C and Ctrl+V silently did nothing while composing. wmux now falls back to the physical key code (KeyC/KeyV), so copy and paste work regardless of IME state.
Agent channels, with a verified sender on every message
Headline: A2A channels grow up. The multi-party half (U2) lands, so several agents in one workspace can talk in a shared, named room instead of only the one-to-one task messages A2A started with — and every channel message now carries a server-verified sender an agent cannot forge. Building on the channel domain types and persistence from U1 (#269), agents create, join, leave, post, and archive channels; the daemon pins each message's sender, each membership, and each channel's authorship to a workspace identity that the main process resolves from the actual sending pane rather than trusting a tag the caller put on the wire. A forged verifiedWorkspaceId is rejected outright — never attributed to the workspace it tried to impersonate — and private channels stay readable only to their members. Alongside it, the bundled CLI takes a stable identity so the legacy permission grandfather can start closing.
A2A channels — multi-party rooms with a server-verified sender (U2 + D5, #280). Channels are Slack-style rooms for the agents in a workspace: a shared, named thread several agents post into, rather than the one-to-one task messages A2A began with. This release lands the multi-party operations on top of U1's domain types and persistence (#269) — create, join, leave, post, and archive — and makes caller identity server-verified end to end. Every mutating channel call is stamped with the workspace identity the main process resolves from the sender's real pane (senderPtyId), not a verifiedWorkspaceId the caller supplied:
ChannelService pins the sender on each post, the member on each join/leave, and createdBy on each channel to that resolved identity, so a forged sender, member, or author is impossible;verifiedWorkspaceId aimed at another workspace is rejected, never silently attributed to the victim;Channel access stays gated behind the existing a2a.channel.read / a2a.channel.send capabilities, so this widens no trust boundary. Channels contributed by @AnandSundar; the verified caller-identity hardening (D5) by the wmux team.
wmux CLI now reports a stable client identity, so the legacy permission grandfather can begin closing (#282). The permission enforcer historically let any caller that sent no client name through unchecked (if (!clientName) allow) — a grandfather clause the bundled CLI, the one steady-state envelope-less caller, rode on. The CLI now identifies itself as wmux-cli, and the enforcer grants that identity exactly the narrow set of methods the CLI actually calls — a separate, tighter allowlist than the bundled MCP's first-party set, pinned by a source-level test so a new CLI command can't silently fall outside it. This is additive: nothing changes for callers today and the grandfather still admits envelope-less callers — it's the groundwork for a later release to close that grandfather behind the existing enforcementMode shadow→enforce switch.LanLink: local-first cross-PC agent messaging
Headline: LanLink lets two wmux machines on the same LAN pair once with a 6-digit PIN, then exchange read-only agent messages over an authenticated, encrypted channel — no cloud, no account, off by default. The epic is built so that running commands across machines is physically impossible: the background daemon imports none of the agent-spawning code, a remote message can only ever surface as a read-only card in the renderer (never pasted into a terminal), and every internal RPC now carries a required trust-origin so the execute path fails closed for anything not provably local. Also lands A2A channels U1 (the rooms half of a future cross-PC group chat), a Fleet View sort toggle, a quieter zoom-restore button, and a keyboard-focus self-heal.
LanLink — local-first cross-PC agent messaging, off by default. Two machines on the same LAN pair with a 6-digit PIN and then exchange read-only text messages over a ChaCha20-Poly1305 channel with per-connection fresh keys. Built across five PRs, with execute excluded by construction at every layer:
net.Server bound only to a real external IPv4 on the chosen NIC (fail-closed bind guard, Windows Private-profile firewall), PIN-EKE pairing (X25519 + scrypt over the PIN, which never travels on the wire; ≤2-minute window; fail-burn after 5 wrong attempts), the AEAD channel, an allow-list router that admits only text/state messages (never execute/spawn), an ingress sanitizer, and a fail-closed per-peer store with live revoke. Per-peer random UUIDs and long-term secrets under an owner-only DACL.host:port next to the PIN so a peer can join from one screen (#277).A2A channels — domain types + persistence (U1, #269). The first half of channels — Slack-style rooms for agents: the channel domain types and a durable persistence layer, contributed by @AnandSundar. Converges with LanLink at a shared delivery seam toward a local-first cross-PC group chat.
Fleet View situational sort toggle (#268). The cockpit grid can now toggle between attention-first (blocked agents float to the top) and pure workspace order.
local vs remote), and the agent-spawning a2a.task.send path only runs when the call provably came from this machine — a positive-allow gate that fails closed for anything else, pinned by a source-level test that the background daemon can never even import the code that spawns agents. Nothing changes for same-machine multi-agent use; this is the foundation that makes cross-PC execute impossible.system.capabilities advertises only methods that are actually callable over the wire (#276). Control-pipe-only RPCs (daemon.*, lanlink.*) are dispatched by the daemon pipe and never registered on the RPC router, so they're no longer listed — a wire client gets an honest capability list instead of methods that would just return unknown-method.ZOOM badge — reusing the cursor accent, a strong red in several themes. It's now styled identically to the hover-revealed ⤢ maximize button (neutral surface, subtle border) with a ⤡ restore glyph, so maximize and restore read as a matched pair. It still stays visible while zoomed so the way back out is always obvious (#258 follow-up).<body>, leaving the terminal unable to receive input until you opened multiview. A central guard now detects orphaned focus and reasserts it onto the active pane, so input keeps working after any overlay closes.A2A execute approval hardened, and remote RPC that lands in the right workspace
Headline: the A2A execute gate — the path that lets a remote agent spawn a bypassPermissions Claude CLI in your workspace — is reworked into a renderer-driven approval flow with execute as its own dedicated capability (no longer bundled with ordinary send), an executeApproved receipt the worker can't forge, fail-closed YOLO hydration, and a queue so concurrent requests don't clobber each other. Alongside it, the #236 RPC workspace-scoping sweep is finished: surface.new, pane.close, pane.focus, and surface.focus now all act on the workspace the caller names instead of whatever happens to be on screen — so a multi-agent orchestrator's "do this in MY workspace" finally lands where it should. Plus a per-pane activity line on Fleet View cards, and a browser-pane keyboard-focus fix.
PostToolUse (agent.activity) hook payload for every tool an agent runs, and was discarding it at the emit-kind early-return. That payload is now summarized into a short, scannable line per pane — ✎ file for an edit, → file for a read, $ cmd for a bash run, ⌕ pattern for a search, srv:tool for an MCP call — and rendered as an accent line on the pane's Fleet card, with the raw scrollback tail kept as the fallback when there's no activity (the awaiting_input affordance still takes priority). It's derived through a pure, never-throwing helper that guards every field of the untrusted tool input, strips control characters, caps the raw input at 1 KB before any regex runs (so a multi-megabyte tool argument can't stall the main thread), and hard-truncates the result to 80 chars; delivery is a per-pane 3-second leading-edge throttle on the existing metadata funnel — no EventBus tee, no notification, no new daemon round-trip. The activity string is transient and never persisted. Now a glance at the cockpit tells you not just who is blocked but what everyone is doing.execute as its own dedicated capability (#254). The A2A execute path — a2a_task_send with execute:true, which spawns a bypassPermissions background Claude worker in the target workspace, i.e. remote code execution — was reworked into a stronger approval flow. execute is now a separate capability (a2a.execute) resolved per-call: a task send requires a2a.execute only when execute:true and the ordinary a2a.send otherwise, so granting an agent the ability to message you no longer implicitly grants it the ability to run code in your workspace. The worker is spawned only when the renderer returns executeApproved===true with a resolved target workspace — a receipt the caller cannot forge, replacing the old main-side confirm round-trip — and a denied request creates no task, pastes nothing, and emits no event. Concurrent execute requests are held in a keyed approval queue (each its own dialog, the inbox owning exactly one visible surface) so two agents asking at once can't clobber each other's prompt. A persisted "YOLO" auto-approve flag is available for trusted setups but hydrates fail-closed — only an explicit boolean true enables it, so a malformed persisted value (e.g. the string "false") can never silently turn on bypassPermissions auto-approval — and the approval label is localized. Internal follow-up cleanup (#255) removed the now-dead confirm-execute plumbing and extracted the approval gate into a standalone, unit-tested module (YOLO short-circuit, approve, deny, 30 s auto-deny, and concurrent-request independence all covered).⤢ button in its top-right corner; clicking it zooms that pane to fill the window — the same toggle as the tmux-style prefix + z, which was previously keyboard-only and undocumented. The keyboard cheat sheet (? in prefix mode) gained a Maximize pane entry. Surfaced after Reddit feedback that there was no visible fullscreen/maximize control to find (#182 follow-up).surface.new, pane.close, pane.focus, and surface.focus all act on the workspace the caller names, not the one on screen (#256, #257). After #238 made pane.split honor an explicit workspaceId, its sibling RPCs still didn't, so a multi-agent orchestrator working in a background workspace couldn't reliably operate on its own panes. surface.new dropped all of its params main-side and pinned the renderer to the active workspace, so "open a terminal in my workspace" always landed in whichever workspace the user was viewing; it now forwards workspaceId/shell/cwd, honors the target, fails closed on an explicit-but-unknown id (no active-workspace fallback), and eager-spawns the PTY into the target workspace. pane.close is a new RPC (panes carry globally-unique ids, so it's resolved across all workspaces like surface.close, disposing every PTY under the pane), filling the gap that left a worker pane created via pane.split with no way to be cleaned up — and it rejects root/non-leaf targets, since closing the root pane is a no-op that would otherwise orphan live surfaces with dead PTYs. pane.focus/surface.focus acted only on the on-screen workspace — pane.focus silently no-op'd while returning a false {ok:true}, and surface.focus errored "not found" — so a background-workspace agent couldn't focus its own pane; a dedicated focusPaneSurface store action now resolves the workspace by explicit id (no self-search, no active fallback), rejects non-leaf panes, sets the active pane and surface in one transaction, emits pane.focused honestly for a background or multiview workspace (events stay workspace-scoped, no cross-workspace leak), and surfaces a real {error} on a miss instead of the false success. Bringing a workspace on-screen remains the separate, opt-in workspace.focus RPC — these handlers never yank the user's screen.A reply finds the exact agent that asked
Headline: same-workspace agents now reply to the exact pane that asked. A task's reply returns to its originating pane instead of the workspace's active one, same-workspace history finally tells the two agents apart (sender vs receiver, per pane), and a status update is restricted to the addressed pane — completing the pane-level multi-agent mesh that #239 and #242 began. Plus a fix for the terminal+browser split that blanked its unfocused side.
to carried a pane anchor (#235) but from did not — so a reply had no pane to return to (it fell back to the workspace's active pane, or was suppressed same-workspace), and same-workspace history role collapsed to user for both parties, making the two panes' messages indistinguishable. The hardening in #242 already captured and validated the sender's pane id on the send path, then discarded it; persisting it into metadata.from opens three things with no new trust surface. (1) Symmetric reply pinning — a reply destined for the original sender now returns to that exact pane instead of the active-pane fallback, so a sender workspace running more than one agent gets the reply on the right pane (fail-closed if that pane has since closed — never a wrong-agent paste). (2) Per-pane history role — the role is computed from the caller's verified pane (user for the sender pane, agent for the receiver pane) instead of collapsing same-workspace. (3) Pane-granular status authz — a status update (a2a_task_update) on a pane-addressed task is restricted to the addressed receiver pane, not any pane in its workspace. A same-workspace reply is delivered as a one-line nudge to the addressed sibling — never a full-body paste into a live agent's prompt — and is suppressed entirely when it can't be proven a non-self target, so the #239 self-loop guard is preserved. The headless execute:true worker (which carries no sender pane id) is never locked out: an absent caller pane always falls back to workspace-level authz. Cross-workspace delivery and role are unchanged.display:none) and the unfocused pane went blank, toggling as you switched. Visibility is now decoupled from focus: both sides stay rendered, and the active-surface id only drives keyboard focus.surface_list/pane_list caller-scoping hardening (#245). An omitted-workspace surface_list/pane_list now revalidates a stale cached workspace id after a re-mint (daemon respawn / session restore) and prefers a confirmed-external caller's pinned workspace over the UI-active fallback — so a fail-soft read reports the caller's own workspace instead of an empty list or whatever the user has focused. Follow-up to the codex review on #242 (#243).Multi-agent workspaces that talk to each other
Headline: a workspace full of agents that can finally coordinate. Same-workspace agents now message each other directly (#239), every pane is individually addressable (#235), and the identity layer is hardened (#242) so a message never loops into the wrong pane or silently routes to a duplicate-named workspace. The A2A task inbox moved onto the EventBus so cross-agent delivery no longer corrupts a live terminal (#232), and Fleet View gained a unified approval inbox to clear every blocked agent from one list (#234).
a2a_task_send — previously hard-rejected as "cannot send to yourself". Addressed by pane/surface id; a true self-send (your own pane) and an ambiguous no-address send are still refused, and the cross-workspace fail-closed boundary is unchanged. The data-suffix that isolates a sandbox instance now propagates to child PTYs so an isolated instance never leaks onto the production pipe.terminal_send/terminal_send_key now refuse an agent's own omitted-ptyId call instead of looping the paste into its own (or a non-deterministic sibling) pane. a2a_whoami answers per-pane — which agent am I, not the workspace's single aggregate label — so siblings are told apart. A duplicate workspace name is refused with both ids instead of silently routing to whichever came first. surface_list/pane_list report the caller's own workspace. A rejected A2A task transition explains the allowed next states. And a mis-propagated WMUX_DATA_SUFFIX fails loud instead of silently booting an isolated instance onto production data.wmux_events_poll instead of having the message force-pasted into its terminal (which used to corrupt a running TUI's input box). The sender gets the status receipt — created → updated → cancelled — the same way. Delivery is strictly dual-party: only the two workspaces involved in a task ever see its events; a third workspace, and any workspace-less poll, see nothing. A receiver that is already running a live agent now gets a one-line nudge (a pointer to run a2a_task_query) instead of the full message body, so its prompt is never flooded — a receiver with no live agent still gets the full paste, so nothing regresses for peers that don't poll.a2a_discover liveness hint (③). Peers returned by a2a_discover now carry an advisory live/idle signal so an orchestrator can prefer an agent that is actually running. Advisory only — it never gates delivery.Ctrl+Shift+A, then the Approvals tab) is now a single inbox of every approval currently holding the fleet hostage, each resolved through its own real path: MCP plugin permission prompts (an unconfirmed plugin requesting capabilities under enforce mode — several can stack at once, keyed distinctly, each row showing the declared capabilities with a per-row risk badge), and the A2A execute gate (a remote agent asking to spawn a bypassPermissions Claude CLI in your workspace, shown with its live 30-second auto-deny countdown and the sender→receiver context). Arrow to a row and press Enter to approve, Backspace/Delete to deny — except a row carrying a critical capability (e.g. terminal-content), which Enter will never grant: those require clicking the explicit Approve button, so scrolling a dense list can't blind-grant a dangerous permission. It's the same surface the old approval modal drove, kept in lock-step: resolving a prompt in the inbox or the modal clears it in the other, and a removal signal retires the row no matter how it was answered — through the old modal, by a coalesced sibling, or by a plugin disconnecting — so there are no phantom rows. While the Approvals tab is open it is the single surface (the modal is suppressed underneath it). Only the two out-of-band-resolvable sources appear here; an approval that can only be answered by typing into the pane stays jump-only rather than growing a dead Approve button.pane.split honors an explicit workspaceId (#238). A multi-agent orchestrator can split a specific (non-active) workspace's pane, with the new pane eagerly spawning its PTY rather than waiting to be focused.Fleet View, and Claude conversations that survive a reboot
Headline: two ways to lose less time on a multi-agent day. Fleet View is the cockpit — every agent across every workspace on one screen, the blocked ones floated to the top, one click to jump to where you are needed. And X6 resume closes the loop on reboot survival: a Claude pane no longer just comes back as a shell, it comes back offering to resume the exact conversation it was running — on every pane, not just the one you were watching, with the permission mode you had set. Plus an agent toolbar, and fixes for the Windows taskbar icon and the PowerShell 5.1 prompt hook. Thanks to @matdac6 (#228, #229) and @snowyukitty (#227).
Ctrl+Shift+A (or run "Open Fleet View" from the command palette) and the whole fleet snaps into one full-screen cockpit: a card for every pane across every workspace, sorted so the agents that want you float to the top. An agent paused mid-turn on a confirmation prompt — awaiting_input, the unattended-loop money state — sorts first, gets a yellow outline and a "needs your input" affordance, and a header chip tells you how many are waiting on you ("2 need you"). Idle terminals sink to the bottom and dim. Click a card — or arrow to it and press Enter — and you are there: it switches workspace, pane, and surface in one step and lands focus exactly where the agent is, reusing the same hardened jump the OS-toast notifications use (zoom coherence included). This is the screen you keep open while loops run unattended: walk away from six agents, glance once, jump straight to the blocked one.role="dialog", roving role="option" cards). Output preview is status + workspace + path for now; a live output tail and the unified A2A + MCP approval inbox (the stubbed "Approvals" tab) are next.claude --resume <id> after a reboot — the exact conversation, on every pane (X6 ③). The resume pill now restarts the exact Claude session it was bound to (claude --resume <session-id>), with the permission mode you had set (so a --dangerously-skip-permissions workflow survives the reboot), instead of the cwd-relative --continue that could resume the wrong conversation when several panes share a directory. The binding — the pane's Claude conversation id, captured live from the hook — is persisted on the daemon session record and survives a hard SIGKILL. Crucially it works for every pane that ran Claude, not just the one whose startup banner the daemon happened to catch live: a captured hook now also lights the pill (so a pane whose banner was missed still offers a resume), each pane is attributed by its own daemon session id (so two panes in the same directory each resume their own conversation, never each other's), and a capture that couldn't reach the daemon at the moment it fired is spooled to disk and reconciled on the next boot. A purged transcript or a moved working directory degrades safely to --continue rather than a dead --resume.claude could come back from an OS reboot with no resume pill. The daemon persisted the detected-agent marker (lastDetectedAgent) on a 30s debounce, and a real reboot is a hard SIGKILL — no graceful flush runs — so a reboot inside that window dropped the marker and recovery had nothing to offer. The single idle agent pane, exactly the reboot-survival headline case, was the one most likely to hit it. Agent detection now persists immediately (saveImmediate), bounded to one write per agent transition by the existing slug guard. The same gap affected live working-directory changes, and was strictly worse: the session:cwd handler persisted nothing, so a reboot could restore a pane to a stale directory and make the cwd-scoped claude --continue resume the wrong conversation. Working directory now persists immediately on an actual cd (guarded so a per-prompt OSC 7 re-report doesn't amplify writes). The previous offer dogfood seeded the marker straight into the snapshot, bypassing the detect→persist path entirely, which is why the race went unseen; a new kill-real dogfood drives real agent detection and then SIGKILLs the daemon inside the window to prove the fix end to end. A follow-on GUI dogfood then surfaced a second, independent cause on the renderer: even with the marker persisted and delivered to the renderer, a recovered pane's xterm focus-tracking report (CSI I / CSI O) arrives through terminal.onData on mount and was mistaken for the user typing, so clearResumeHint retracted the pill the instant it hydrated — meaning the pill had effectively never rendered after a reboot at all. Focus reports are now excluded from the retract path (real keys, pastes, and IME commits still retract as intended). Both fixes are required for the pill to actually appear.[char]27, which PowerShell 5.1 passes through correctly — previously the escape was mangled on 5.1, so the hook silently did nothing and cwd/branch tracking never updated on that shell.icon.ico is now re-encoded with BMP frames so Windows draws it again.supervised agent panes, 74% faster cold start, and a lighter idle footprint
Headline: a wmux.json pane can now declare a restart policy and the daemon supervises it like an init system — auto-restarted with backoff across process exits, daemon restarts, and full reboots, with a runaway guard so a crash-loop burns backoff instead of tokens (X8). Cold start is 74% faster on the dev machine (5570 → 1176 ms; first contentful paint 5.2 → 0.65 s) after moving the auth-token ACL hardening off the boot critical path, loading the renderer in parallel with the daemon bootstrap, and adaptive readiness polling — with a new wmux doctor to diagnose a slow boot in one command. Plus a lighter idle footprint (lazy buffer allocation, visibility-gated metadata polling, pruned native prebuilds), a refined-terminal sidebar pass, and an awaiting-input signal for Claude Code's AskUserQuestion prompt. Thanks to @matdac6 for three contributions this cycle (#212, #218, #219).
AskUserQuestion prompt (#212, thanks @matdac6). When Claude Code shows its multi-line boxed question UI inside a wmux pane, the pane's sidebar dot turns yellow and the awaiting-input sound fires — the same signal you already get for single-line approval prompts. Previously "awaiting input" was detected only by the regex AgentDetector, which is anchored to single-line prompts (Do you want to proceed?) and never matched the boxed AskUserQuestion layout, so a user who looked away got no cue that the agent was blocked on them. The fix is signal-based, not another regex: a PreToolUse hook scoped to the AskUserQuestion tool maps to the existing awaiting_input status (guarded on tool_name so a future broad matcher can't tunnel spurious signals). The dot clears automatically when you answer and the agent resumes. No new UI — it reuses the existing status, sound, and dot.[boot-trace] line per boot milestone (process spawn → module eval → app-ready → plugin load → daemon bootstrap with spawn/pipe/ping sub-phases → ready end), plus a JSON summary that lands in the daily log file; the daemon exposes its own boot marks through daemon.ping. The perf bench collects both and prints a derived phase-attribution table, so a cold-start regression now points at the guilty phase instead of a single opaque number. First run of the new table immediately attributed ~70% of the measured cold start to the auth-token ACL hardening's synchronous PowerShell shell-outs (one in the main process, one in the daemon) — the optimization target for the follow-up PR. Zero telemetry: stderr and local log files only.wmux doctor — one-command diagnostics (#216). A new CLI command that turns the boot-trace instrumentation into a user-facing health check: environment (version, pipes, auth token, data suffix, app-pipe reachability), daemon status over its own control pipe (pid, uptime, sessions, event-loop lag — diagnosable even when the main process is dead), the same boot-phase attribution table the perf bench prints (main + daemon-internal phases, parsed from the daily log's boot summary with a bounded tail read), an antivirus-tax hint when a cold-rescan phase exceeds 1.5 s, and today's error/warn counts for both log files. --json for scripts; exit 1 only when something actually failed. "wmux feels slow / won't start" reports can now begin with one command instead of log archaeology.--scrollback-lines A/B seed, and a WebGL-context occupancy probe — all additive, nothing gated. First verdict from the data, recorded in bench/README.md: about half the 8-pane footprint is the user's own shells, the scrollback A/B delta on near-empty terminals is ~0 (xterm's buffer is lazily populated), and the GPU process is a single fixed cost — so the planned RAM-diet code work was cancelled by measurement before any code was written.wmux.json pane can now declare restart: on-failure | always (with an optional restartLimit), and the daemon supervises that pane the way an init system supervises a service: when the process exits it is auto-restarted with exponential backoff, and a runaway guard halts supervision after N consecutive short-lived runs (it must be manually rearmed) so a tight crash-loop burns backoff instead of tokens. Because the supervisor is the daemon — which already survives app crashes and machine reboots — supervision is sticky: a supervised loop is restarted across daemon restarts and across a full reboot, so an unattended overnight loop comes back on its own after the machine cycles. Nothing supervises until you trust the file (same wmux.json trust gate); plain panes are unaffected.daemon:connected, which previously could not fire before the renderer existed) is now gated on the pane gate, extracted, and unit-tested. Verified against the original regression scenario: 10/10 isolated cold boots with a keystroke fired the instant the terminal mounts, zero drops.execFile/spawn exclusively, so the multi-second shell-out can no longer stall the daemon's event loop either. Verified to converge to the same owner-only DACL (including removal of explicit Everyone ACEs) by the extended scripts/issue-124-acl-dynamic.mjs harness./inheritance:r strips). Overwrites of an existing file (token rotation, empty-file repair) keep the PowerShell-first DACL rebuild. Fail-closed semantics unchanged: if both primitives fail, the un-hardenable token is deleted and the write throws.RingBuffer now allocates 64 KB up front and doubles toward the configured ceiling (default 8 MB) on demand instead of committing the full ceiling per session — idle/quiet sessions hold ~64 KB, chatty ones still grow to the ceiling with no scrollback lost; the 5 s per-PTY metadata poll (git / gh / /proc work that only feeds cosmetic UI) is now gated on shouldPollMetadata() and skipped while the window is destroyed, loading, hidden, or minimized, with the next visible tick refreshing within ≤5 s so staleness stays bounded; and postPackage prunes the non-target node-pty prebuilds (the win32-x64/arm64 ConPTY binaries are ~30 MB each), reclaiming ~28 MB+ per build across both node-pty copies, while defensively keeping everything if the target dir is missing.⚙ ⧉ ✕ ▸) across workspace rows, the mini-sidebar, and settings are replaced by a shared stroke-icon SVG module (icons.tsx) so every control scales crisply; the agent-status indicator now routes through AGENT_STATUS_ICON's dotVar/glowClass/mark fields as a colored status dot with an animated glow plus a right-aligned play/pause mark; and token-derived depth, softened popover borders (rounded-lg + color-mix), row/popover enter animations, and a shared focus-ring helper round it out — every motion effect gated behind prefers-reduced-motion. Spec and plan under docs/superpowers/.PSModulePath leads with pwsh 7's Core-edition Modules directory, so the Windows PowerShell 5.1 child failed to auto-load its own Microsoft.PowerShell.Management/Security modules (CommandNotFoundException on Get-Item), and the #124 DACL rebuild — the only primitive that removes pre-existing explicit broad ACEs — never ran, falling back to icacls on every boot. The 5.1 child now gets PSModulePath stripped from its environment so it reconstructs its own default module path regardless of which shell spawned wmux. Found via the new boot traces: the measured "hardening cost" on a pwsh7-launched dev box was actually a failing PowerShell plus the fallback.AskUserQuestion awaiting-input notification (#212) — a clean signal-based fix with a root-cause writeup, a tool_name guard against spurious signals, and tests on the wmux side; the refined-terminal sidebar aesthetics pass (#218); and the lighter idle footprint across RAM, CPU, and package size (#219). Thank you!wmux CLI on your PATH, wmux.json project config, click-to-jump notifications, perf gate
Headline: every shell — inside or outside wmux — gets a wmux command with verified self-pane identity; a repo-root wmux.json turns "open this repo" into a fully arranged workspace (custom commands + declarative pane layout) behind a byte-exact trust gate; clicking a desktop toast now jumps straight to the pane that fired it; and a benchmark harness with a CI regression gate puts real numbers behind the performance story (echo p95 29.2 ms, no degradation at 8 panes). Plus cross-workspace browser-close routing, a multi-image paste fix, and Smart App Control install guidance.
wmux notify calls — carry their originating pane context. Clicking the toast restores and focuses the window, switches to the owning workspace, activates the pane and the exact surface (tab) that produced the notification, marks its unread notifications read, and clears the attention ring. Toasts from wmux notify --workspace <id> jump to that workspace; if the source terminal closed between toast and click, the click degrades to the old focus-the-window behavior.wmux setup-hooks — install Claude Code hooks without the marketplace plugin. The plugin-less path to the deterministic agent-signal bridge: wmux setup-hooks installs the same 4 hook entries (Stop, SubagentStop, SessionStart, PostToolUse) directly into Claude Code's user settings (~/.claude/settings.json) and copies the bridge to a stable, update-proof location (~/.wmux/hooks/wmux-bridge.mjs) that the settings reference — never the versioned install dir, so it survives app updates. The merge is idempotent and surgical: it preserves all your existing hooks and every other settings key, and a corrupted settings.json aborts rather than clobbering your config. --status reports which events are wired, whether the copied bridge is stale (byte-compared against the bundled source), and warns if the marketplace plugin is also installed (which would double-fire signals); --remove deletes only the wmux-owned entries.scripts/perf-bench.mjs measures what users feel against the packaged app: input latency (key→echo and key→frame, instrumented inside the renderer so CDP transport never pollutes the numbers; at 1 pane and 8 panes), cold-start milestones (spawn → pipe ready → renderer → first PTY data), and full-process-tree RAM including the detached daemon. Each run spawns the app in an isolated data namespace (WMUX_DATA_SUFFIX), so it can run alongside a live wmux, and shuts the daemon down cleanly afterwards. scripts/perf-compare.mjs gates regressions against blessed baselines (double-condition: ratio AND absolute margin) and .github/workflows/perf.yml runs the gate on PRs and appends a trend line to bench/history.ndjson on main. First measured numbers on the dev machine (i5-13420H): echo p95 29.2 ms, key→frame p95 44.1 ms, with no measurable degradation at 8 panes — baselines are descriptive measurements, never aspirational targets. See bench/README.md.wmux.json (X5). Drop a wmux.json at your repo root and wmux turns it into a per-project workspace: custom commands ({"id": "dev", "title": "Dev server", "command": "npm run dev"}) appear in the command palette and the sidebar's project dialog, and a declarative pane layout (nested panes with per-pane startup command, project-relative cwd, or a url for an embedded browser pane) is applied automatically when you open a fresh workspace in that repo — "open this repo → Claude Code + dev server + browser, arranged" with zero clicks. Discovery walks up from the workspace's live cwd and stops at the repo boundary. Nothing executes until you trust the file: wmux.json is checked into the repo, so the first discovery only displays — a review dialog shows every shell command verbatim, and the trust grant is bound to a hash of the exact bytes reviewed. Any later edit (e.g. a malicious PR changing a command) demotes the project to display-only until re-approved; "deny" is sticky until explicitly cleared.wmux CLI on your PATH, with verified self-pane identity (X4). The installer now drops a wmux command onto the user PATH (regenerated on every update, removed on uninstall), so any shell — inside or outside wmux — can script the app: wmux send "npm test" --submit, wmux read-screen, wmux notify "Done" "Build finished", wmux open http://localhost:3000, wmux split, wmux list-workspaces --json. Run inside a wmux pane, terminal commands target the pane you typed them in — identity is resolved by walking the CLI's own process tree against the PID map (the same verified identity the MCP terminal tools use, never the spoofable/stale env hint), and the zero-spawn fast path covers the common shell-direct case. --pane <ptyId> targets another pane explicitly, --active keeps the old UI-focused-pane behavior, and notifications/browser opens route to the calling workspace automatically. The CLI client also gained the TCP-localhost fallback for Windows named-pipe ACL edge cases.install.ps1 now explain how to confirm SAC is the cause (Get-MpComputerStatus | Select-Object SmartAppControlState, Code Integrity Event ID 3077) and the workarounds: winget/Chocolatey, retry later, or build from source.a2a.resolve.identity now returns pane-level entries (pid + ptyId + workspaceId) alongside the existing mappings — additive; existing MCP clients are unaffected.wmux-paste temp file, so pasting several screenshots into Claude Code left only the most recent path readable. Temp files now survive the session (a startup sweep removes stale ones older than 24h) and get a random suffix so rapid pastes can't collide.browser_close / wmux browser close can no longer tear down a browser pane the user is viewing in another workspace. browser.open was pinned to the caller's workspace in #193, but browser.close kept resolving "the browser pane" inside the UI-active workspace — an agent in workspace A issuing a close took down whatever browser the user happened to be looking at in workspace B, or got a spurious "not found" when B had none. Close now routes the same way open does: MCP resolves the calling workspace (fail-closed), the CLI uses its verified self-pane identity (with a --workspace override), and an explicit surfaceId — which is globally unique — is found across all workspaces. surface.close with an explicit id likewise no longer fails with "surface not found" when the surface lives outside the active workspace. Callers that pass no workspace at all keep the active-workspace behavior.browser pane wired into the workflow, IME input self-healing
Headline: the embedded browser pane is now reachable from where you actually work — terminal URLs route smartly, sidebar port badges open localhost in one click, and browser panes restore on the page you last visited. And the field-reported "keyboard input dies until you toggle multiview" IME failure on Korean Windows now self-heals: the suspect textarea-clearing is off by default and a storm guard detects the dead-input signature and resyncs the IME automatically.
http://localhost:<port> in that workspace's browser pane, un-zooming any pane that would hide it. target="_blank" links inside the browser pane now work and open in the same pane (popup windows stay blocked). Ctrl+Shift+L and the palette's "Open Browser" keep their always-create-a-new-pane behavior.keyCode 229) and xterm drops all of them. Two-part fix: (1) the v3.0.0 idle IME-textarea clearing (#167 protection for field-replacing voice injectors) is now off by default — its programmatic wipe of the IME-owned textarea is the prime suspect for the desync; it remains available under Settings → Terminal for AutoGLM-style tool users. (2) A new always-on storm guard detects the claim-storm signature (consecutive 229 keydowns across distinct keys with zero composition activity) and resyncs the IME with a blur/refocus — the remount cure, automated — surfacing a toast and a console diagnostic so the trigger can be confirmed in the field.<body> (typing went nowhere until a pane/workspace switch). Terminal registration now pushes a notification the focus driver subscribes to, one-shot, so late registrations still receive focus and later re-registrations can't steal it.browser.open on an existing browser surface now actually navigates the webview. The reuse path only rewrote store state, which the mounted webview never re-reads — the MCP call reported success while the page stayed put.browser.open no longer resets an unspecified partition to the default. The forced reset remounted the webview (the partition is part of its render key) and dropped the login session.UI plugin host, workspace context sidebar, terminal notifications
Headline: wmux panes and sidebars are now extensible by third-party UI plugins running in sandboxed iframes under the same permission stack as MCP plugins; the workspace sidebar shows live zero-config context (git branch, PR status, process-scoped listening ports, latest notification); and standard terminal notification escape sequences (OSC 9/777/99) are parsed into first-class events. Plus a batch of rendering and MCP-routing fixes. All features dogfood-verified on a live build.
fs.watch on .git/HEAD (no polling; linked worktrees detected and marked), the current branch's PR number/state/CI checks from a 5-minute gh cache (silently absent when gh isn't installed; click opens the PR), listening TCP ports matched against each pane's own process tree (previously the port list was machine-global — every workspace showed the same first-20 ports), and a one-line summary of the latest terminal notification. All context flows through the existing workspace.metadata.changed event, so MCP clients and plugins see the same data the sidebar does.~/.wmux/plugins/<name>/ with a manifest.json and wmux hosts its UI in a sandboxed iframe (opaque origin, no network — the postMessage bridge is the only channel out). Plugin RPCs dispatch through the same permission stack as MCP plugins (trust DB, capability enforcement, approval prompts), with new capabilities ui.sidebar / ui.statusbar / ui.pane-decoration / ui.commands / notifications.read. Includes a reference plugin under examples/plugins/hello-panel. Verified end-to-end on a live build (approval flow → mount → bridge RPC → pane badge).OSC 777;notify, and the kitty OSC 99 desktop-notification protocol (including chunked and base64 payloads) — produce a new notification.received event on the event bus (pollable via wmux_events_poll) in both daemon and local PTY modes. ConEmu's OSC 9 progress subcommands no longer trigger spurious toasts, and notification text is sanitized and length-capped. Groundwork for the attention-ring / toast-routing notification system.surface_list / pane.list no longer report a stale, workspace-wide cwd for every surface. Each surface's own live working directory (OSC 7 / prompt scrape) is now authoritative; the workspace-level metadata cwd — which is just whichever active surface last changed directory — is only a fallback. Previously that single path was stamped onto every surface in the workspace.WebglAddon.dispose() detaches the renderer but never frees the underlying WebGL2 context, so split/tab churn accumulated zombie contexts past Chromium's ~16-context cap, force-evicting a live pane's context. Every addon teardown now force-releases its GL context immediately via WEBGL_lose_context.loseContext(). (#199, resolves #197)CharAtlasCache); the focus/visible defensive repaint called clearTextureAtlas(), which empties that shared atlas and rebuilds only the newly-focused pane — the siblings kept stale per-cell texture coordinates and sampled an emptied/repositioned atlas. The repaint now does a full-range refresh() only and never touches the shared atlas; the earlier "garbled glyphs after a burst" case (#166) was already covered by the burst-path refresh, which never cleared the atlas. (#196, resolves #191)execFileSync per ancestor; it now walks the tree with async execFile, preserving the resolution result and the source invariant. (#195, resolves #194)browser.open without an explicit workspaceId opened the browser in whichever workspace happened to be active; the engine now resolves the calling session's workspace and fails closed instead of falling back to the active one. (#193, resolves #190)external-tooling foundation, PowerShell 7 by default, terminal UX, cross-workspace hardening
Milestone release. Headline: a reference plugin and workflow-friendly APIs that make wmux a foundation external tools build on, PowerShell 7 chosen as the default shell wherever it's installed (including Store builds), a batch of terminal UX (font zoom, configurable start directory, split CWD inheritance), and the close of the cross-workspace terminal read/write isolation gap. No breaking changes — this is a milestone version bump, not a wire-format or config break; existing sessions, profiles, and configs carry over untouched. All dogfood-verified on a live build before tagging.
Ctrl+= / Ctrl+- / Ctrl+0 grow, shrink, and reset the terminal font, resolved from the physical key code so it's IME-safe, clamped to 12–24px. (#172, resolves #171)existsSync alone misses the 85-byte symlink stub) and actually launchable (the stub can't be spawned directly by node-pty, so wmux resolves it to the real package target). Shell resolution is now single-sourced between the main process and the daemon, so the two can't drift. (#178, #180, #181, #186; resolves #176, #179, #183, #185)WMUX_WORKSPACE_ID to a victim workspace and, naming that workspace's ptyId, read or write its terminal — the main-side ownership assert only verified that the ptyId belonged to the (attacker-supplied) workspaceId, not that the caller was entitled to that workspace. Part 1 gave input.readScreen the assertWorkspaceOwnsPty check its sibling handlers already had (it was the one terminal-IO handler that skipped it). Part 2 removed the spoofable identity the assert trusts: terminal tools (terminal_read / terminal_read_events / terminal_send / terminal_send_key) now resolve their workspace from verified PID-mapped identity only, never the env hint — a genuine external caller gets a dedicated claimed workspace, an explicit foreign ptyId fails closed, and a boot-reconcile grace keeps a first-party caller from being misclassified during a daemon respawn. (#164 + #188, resolves #163)@electron/asar header cache is dropped after the postPackage repack, so the packaged asar can't be stale. (#161)Thanks to the external contributors and reporters in this release:
terminal fonts, color customization, settings polish
Headline: pick any installed terminal font (and ship the recommended ones so they work everywhere), a point-and-style color inspect mode for theming, and a settings UI polish pass. All dogfood-verified on a live build before tagging.
powershell.exe ENOENT (a bare-name spawn that failed to resolve under Electron) which had made the installed-font enumeration return nothing — so the feature never actually worked before this. (#155, resolves #147)\n; the keystroke was lost at xterm's keyboard layer, which derives Ctrl+<letter> from the deprecated KeyboardEvent.keyCode. With the IME enabled the keydown reports keyCode === 229 ("Process") with key !== 'j', so xterm's 65–90 branch never matched and emitted nothing. wmux now resolves the newline keys (Shift+Enter, Ctrl+J) from the physical event.code and writes the byte itself — the same IME-safe approach already used for the split shortcuts — so Ctrl+J sends \n regardless of IME state. It defers while an IME composition is active (so a preedit is never split) and when the user has bound Ctrl+J to a custom keybinding. xterm 6 has no kitty/modifyOtherKeys path, so the emitted byte matches its legacy output when no IME is active. (#153)--squirrel-firstrun no longer becomes a never-quitting zombie. On Windows the Squirrel first-run hook was misclassified, so the process neither initialized nor quit, leaving an idle GPU/network process behind after install. (#154)Thanks to the external contributors in this release:
Bundled fonts under the SIL Open Font License 1.1: JetBrains Mono (The JetBrains Mono Project Authors), Fira Code (The Fira Code Project Authors), and JetBrainsMonoHangul (Janghyub Seo).
MCP pane-lifecycle fixes
Two small MCP fixes on top of v2.17.0, both dogfood-verified on a live build before tagging.
browser_close no longer leaves an empty pane behind. The UI close path removes a pane when its last surface is closed, but the MCP mirror only closed the surface — leaving an empty leaf that the "auto-create initial surface" effect backfilled with a fresh terminal. A browser_open/browser_close loop accreted blank PowerShell panes. The handler now snapshots whether the closed surface was the pane's last one before removing it, then cascades into closePane to mirror the UI path. A browser sharing a split pane with a terminal still only loses the surface; a browser that is a workspace's only (root) pane still gets an auto-terminal, matching the UI exactly. (#144)session:died, so closing a workspace or pane through the UI (the destroySession path) leaked its anchor. Over time those stale entries could mis-resolve a ghost workspace identity. Closing now prunes the anchor immediately, in lockstep with the session teardown. (#142)security hardening sweep, packaged browser fixes, workspace UX
The big batch since v2.16.2. Headline: a security-hardening sweep across the daemon, MCP, A2A, release pipeline, and browser surfaces — most of it surfaced by an external codex security scan, with each finding triaged and adversarially verified before merge (a chunk turned out to be false-positives or duplicates and were closed rather than merged). Plus a set of fixes that make the embedded browser tools work on packaged builds, per-workspace environment/startup profiles, and the workspace-management UX that profiles implied (duplicate, per-terminal working directories). No config changes required — defaults are unchanged.
CLAUDE_CONFIG_DIR, CODEX_HOME, SSH wrappers, etc. at different accounts per workspace. This is environment separation, not an OS-level security sandbox. See docs/workspace-profiles.md for setup and multi-account recipes. (#101, #103)<name> (copy N). A new Working directories menu lists each terminal's live cwd with copy; every terminal now tracks its own cwd (shown in the tab tooltip), terminal tabs can be renamed (double-click), and an accidental workspace close is guarded by a confirmation. New-pane semantics throughout, consistent with the profile contract. (#141)getCurrentUserSid parsed the first SID-shaped substring of whoami output, so a SID-shaped account or machine name (e.g. S-1-1-0 = Everyone) could be granted the auth-token ACL instead of the real owner, leaving the token world-readable. It now parses the explicit SID: field. (#118)icacls /grant:r … /inheritance:r only replaced the named principal's ACE and stripped inherited ACEs, so a pre-existing explicit broad ACE (e.g. Everyone:(R) from a redirected/roamed/MDM profile) survived and left the token world-readable. The DACL is now rebuilt with a .NET DACL-only primitive (no owner/group/SACL writes, so it needs no privilege and succeeds on the upgrade-from-icacls state), with icacls as a fail-closed fallback when PowerShell is blocked. (#140)WMUX_WORKSPACE_ID env hint or a failed workspace claim could fall back to the user's active pane, i.e. cross-workspace keystroke injection/read. Terminal tools now require a verified, PID-mapped identity and refuse the env hint, throwing rather than touching the focused pane. (#125)send/broadcast no longer accept a caller-supplied from; the sender is derived from the authenticated workspace, so one agent can't impersonate another (or the CEO) when delivering a message into a peer's terminal. (#129)login session store (reading its cookies over CDP). Profile names are now validated and RPC selection is restricted to a safe allowlist. (#133)browser_tabs new-tab path. (#137)env: instead of being interpolated into a shell run: block (Actions script-injection); the SignPath token is scoped to the signing step instead of the whole job; third-party release actions are pinned to immutable commit SHAs; WinGet publishing moved to a least-privilege job; and the installer fails closed when the checksum manifest is missing or invalid. (#119, #120, #121, #126, #135)pty:create can never leak into args_summary. Profile env is also kept out of the copy-session-info / drag-export markdown, and reserved WMUX_* keys are rejected so a profile can't spoof workspace identity. (#103)npm start while dogfooding) inherited the parent pane's WMUX_WORKSPACE_ID / WMUX_SURFACE_ID / WMUX_SOCKET_PATH in its own environment, which could survive into freshly created child shells. The whole reserved WMUX_* namespace is now cleared from the spawn baseline before identity is forced, so a child's identity is only ever what wmux explicitly sets — the spoofing guarantee is now unconditional, not profile-only. (#141)getPage() can't surface the <webview> guest as a Playwright Page, so a swath of browser tools failed with No browser page available. They now fall back to the main-process CDP/RPC channel: DOM tools read the real webview instead of the wmux app shell (#104), extraction/snapshot (#105), console/network/response-body capture (#106), browser_extract_data field mapping (#110), cookies/storage/emulate/resize (#111), geolocation grants + reset semantics (#112), and browser_wait (#114). browser_open/session_start route through requireWorkspaceId so the browser opens in the calling workspace, not the active one (#96).C:\Users\me) for every PowerShell regardless of where it had cd'd. Two compounding parser bugs are fixed: OSC 7 left Windows paths as /C:/Users/me (leading slash, forward slashes), and prompt detection matched the stale echoed prompt and froze the reported cwd at startup. Parsing is extracted into a unit-tested cwdDetect module (shared by both spawn paths) that normalizes the OSC 7 URI to a native path — including UNC shares — and reads the live (last) prompt. Daemon mode additionally never forwarded its detected cwd to the renderer; a new session:cwd event now closes that gap so daemon-backed panes live-update like local ones. (#141)This release leaned on the community — two external contributors landed real features and fixes, not just reports.
@junbeom09 (조준범) carried forward the packaged-build hardening he started in 2.16.2. Dogfooding the packaged app, he found the browser DOM tools were silently reading the wmux app shell instead of the embedded <webview> — a bug that never reproduces in a dev build — and contributed the runtime shell-detection fix (#104). He then verified the CDP capture and geolocation fallbacks (#108/#112) on a real install, confirming the exact paths CI can't prove. Fixes and reports from real-world setups a single maintainer never sees are how wmux gets more robust.
@snowyukitty had the busiest release of anyone. He built per-workspace process profiles end to end (#101), then followed up after review with path-pointer credential-var allowlisting and non-destructive profile loading so an existing profile is never clobbered on load (#103). He shipped the workspace-management UX that profiles implied — duplicate workspace, the working-directories menu, per-terminal cwd tracking, tab rename, and close confirmation — and fixed the OSC 7 / prompt-detection cwd bugs and the child-shell identity-inheritance leak along the way (#141). He also split the Vitest runtime lane (#97) so timing-sensitive tests run serially instead of flaking under parallel load.
The security-hardening sweep (#118–#137) was surfaced by an external codex security scan; each of the 20-plus findings was triaged and adversarially verified before landing, with false-positives and duplicates closed rather than merged. The token-file ACL rebuild (#118 plus the DACL-only primitive in #140) was additionally dogfooded against a real %USERPROFILE%\.wmux descriptor — a directory that grants SYSTEM and Administrators inherited FullControl — to confirm the hardened token comes out owner-only with no self-lockout.
Maintained by @openwong2kim, with engineering and code-review pairing by Claude (Anthropic). Thanks to everyone filing issues and dogfooding. 🙏
daemon hardening: security, split-brain fix, configurable lifecycle
Bundles everything merged since v2.16.1: a token-file permission hardening (security), the duplicate-daemon / split-brain fix behind the "relaunch resets my terminals" bug, configurable daemon lifecycle thresholds, and idle-reap diagnostics. No config changes are required — defaults are unchanged.
icacls, which mojibakes under the OEM codepage for non-ASCII (e.g. Korean) usernames and could lock the owner out of their own token. The ACL is now keyed by the owner's SID, with an ASCII-only fallback guard. (#90)-N-suffixed pipe, leaving the first daemon's session pipe in EADDRINUSE and the UI unable to reattach — terminals appeared to reset. A three-defect chain is closed: isProcessAlive swallowing its probe error into false, the canonical-pipe reclaim conflating a live owner with a zombie, and the -N fallback itself. A confirmed live owner on the canonical pipe now makes the redundant daemon exit cleanly so the launcher reconnects to the existing one. (#93)maxSessions counts only live sessions. Dead tombstones no longer occupy slots against the cap, so a low maxSessions won't be exhausted by sessions that have already exited. (#92)maxSessions (200), the memory warn/reap/block triple (500/750/1024 MB), and suspendedTtlHours (7d). Out-of-range or malformed values are clamped per-field — not whole-file reset — with a startup warning, so a single bad value can't brick the daemon. maxRecoverSessions is derived from maxSessions rather than configured separately. Documented in PROTOCOL.md §7–§8. (#92)Special thanks to @junbeom09 (조준범) for the token-file ACL hardening (#90). He hit the non-ASCII-username lockout firsthand: a Korean account name turned the icacls principal into mojibake under the Windows OEM codepage and locked the owner out of their own auth token. He traced the root cause and contributed the SID-based fix that makes the hardening codepage-proof for every user. Reports like this, from real-world setups a single maintainer never sees, are exactly how wmux gets more robust. 🙏
Maintained by @openwong2kim, with engineering and code-review pairing by Claude (Anthropic). Thanks as always to everyone filing issues and dogfooding the daemon-lifecycle work.
daemon false-death fix, resize console-spam fix
A stability patch. The headline: on slow or loaded machines the daemon's process monitor could mistake a probe timeout for a dead process and reap a session that was actually alive, so sessions appeared to close on their own. That's fixed. It also quiets an Uncaught (in promise) console flood on relaunch and adds session-death logging so future "why did my session close" reports are diagnosable.
tasklist probe as proof the process had died and reaped the still-alive session — the cause behind sessions closing by themselves under CPU contention or a Defender scan. It now reaps only on positive confirmation of death; a probe that fails or times out defers instead of killing.Uncaught (in promise) flood on relaunch. A burst of terminal resizes during reconnect could exceed the daemon's per-socket rate limit, and the renderer never caught the rejection, spamming the console. Resize calls now swallow the transient rejection and re-send the live geometry once after the rate window clears, so a resize dropped during the burst self-heals instead of leaving the terminal stuck at the wrong size.tmux-style persistence, blank-relaunch fix, multiline-paste fix, stability batch
Bundles everything merged since v2.15.0 (#81, #84). The headline is tmux-style persistence — closing the window now keeps your daemon and sessions alive and reattaches them on next launch — plus the fix for recovered sessions rendering blank on relaunch, a multiline-paste fix for PowerShell, and a batch of dogfood-driven stability and UX changes.
Ctrl+Shift+Arrow moves focus between panes (and between grid tiles in multiview) in all four directions. Bare Ctrl+Arrow is intentionally unbound.prefers-reduced-motion.before-quit previously tried to shut the daemon down on every quit (the opposite of tmux), and a hung handler could orphan it. The default quit now only detaches; full shutdown is explicit and guaranteed to exit.app.getAppMetrics working-set sum) instead of the renderer's JS heap, so the StatusBar number reflects actual process memory.isCurrent guard evaluated before the effect assigned the terminal ref, so pty.reconnect never fired (live daemon sessions, zero attach). Reattach moved to a dedicated effect that runs after the ref is set and also fires on daemon:connected (late-connect / respawn).before-quit pipe-close could leave wmux.exe running after the window closed; full shutdown now force-exits within a bounded timer.normalizePasteText collapsed every newline to a lone CR, but inside a bracketed-paste body PSReadLine treats CR as Enter and misplaces the cursor (PSReadLine #3939, #417, which both recommend LF). It now emits LF as the in-body separator when bracketed (CR otherwise), fixing all four paste paths (Ctrl+V, Ctrl+Shift+V, right-click, Shift+Insert / onData). Verified against real pwsh 7.6 / PSReadLine 2.4.5.prefix + arrow keys. Session load now merges the saved prefix config over the defaults instead of replacing it wholesale, so arrow-key pane-focus bindings survive a reload.U+241B, so pasted text can no longer forge the ESC[201~ close marker and run trailing bytes as a command.Ctrl+Up/Down scroll-bookmark jump shortcut from the README. Ctrl+M marking and the gutter indicators still work.Hook-RPC flood fix, view-switch perf, install/updater hardening
Fixes the user-reported "freezing under load" and view-switch lag found via a dogfood-log RCA, finishes the remaining session-reliability hardening from the v2.14.0 RCA, makes the installer and auto-updater integrity-safe, and wires (inert) OSS code signing.
hooks.signal no longer does a renderer workspace.list round-trip on every signal. A 2s-TTL coalescing cache collapses a tool-heavy turn's bursts into ~1 round-trip and serves the last-known list when the renderer is throttled — stopping the PostToolUse timeout floods that froze the UI and, at worst, blocked the daemon event loop into a forced respawn.ptyId absent from a non-empty session list (2-strike guard), closing the last destructive-session-loss path the v2.14.0 RCA left open.daemon.ping reports event-loop lag, thresholds raised to 5 strikes / 5s — instead of mistaking load for a hang and force-respawning.DaemonClient.connect retries transient named-pipe errors (EPERM/ECONNRESET) with backoff; ENOENT still fails fast.EADDRINUSE, so a pane no longer dies when a prior pipe has not yet released its name.Setup.exe and verifies a CI-published SHA-256 (update-manifest.json) before launching it; a tampered or unverifiable artifact is never run. Previously it opened an unverified URL.workspace.list resolutions is logged (escalating to a warning on a flood), so degradation is visible without hand-tallying bridge.log.install.ps1 now downloads the prebuilt, SHA-256-verified Setup.exe by default instead of always compiling from source. Build-from-source is opt-in (-FromSource / WMUX_FROM_SOURCE=1).SECURITY.md / PROTOCOL.md with the actual code (token entropy, icacls behavior, intentionally-disabled asar-integrity fuse). Removed the permanently-disabled EditorPanel "Save" affordance.release.yml is wired for SignPath Foundation (OSS) Authenticode signing of the installer, gated on a signing secret so it is a no-op until configured. Binaries remain unsigned (SmartScreen "unknown publisher") until the certificate is provisioned.Session-replacement fix + lifecycle observability + token ACL hardening
Fixes the reported instability where, while running several Claude Code windows, "the daemon resets and sessions get replaced by new empty windows." Root-caused via a multi-expert review (see plans/RCA-daemon-session-replacement-2026-05-29.md): the daemon process never actually dies (uptime is monotonic). The renderer's reconnect/reconcile path could not distinguish a transient failure from a permanent one and destructively cleared live ptyIds, making Terminal self-create empty sessions while the daemon still held the originals.
pty.reconnect now tags failures transient (pipe-not-writable / RPC threw during handler swap) vs permanent (session dead). useTerminal retries transient failures with short backoff instead of immediately clearing the surface — a live session no longer gets discarded on a momentary blip.AppLayout reconcile preserves all ptyIds when the daemon returns an empty session list (almost always "not ready yet", not "all dead"). The late-reconnect (daemon:connected) path is now abort/timeout/catch guarded and never falls through to clearAllPtyState.RECONCILE_TIMEOUT_MS is now derived from DAEMON_RPC_TIMEOUT_MS in shared/timeouts.ts (15s > 10s), removing the asymmetry that let a slow-but-successful pty.list trip the destructive startup fallback.[lifecycle] logging on daemon attachSession/detachSession, main daemon:connected emit, DaemonClient.connect error codes (EPERM etc.), pty.list live-session count, and the renderer's destructive ptyId-clear decisions (mirrored into the main log). Reconnect/session-replacement events are now diagnosable post-hoc instead of invisible.secureWriteTokenFile only locked permissions when a token was freshly written; a token loaded from disk kept whatever (possibly broad, inherited) ACL it had. New reHardenTokenFileAcl() re-applies a restrictive ACL (Windows icacls) / chmod 0600 (POSIX) on the existing daemon-auth-token and ~/.wmux-auth-token at load time. Best-effort: never crashes a live daemon.OSC 133 EventBus tee + agent.awaiting_input lifecycle
Extends the agent.lifecycle event in wmux_events_poll with two new substrate signals so orchestrator SDKs and any MCP consumer can react to shell command lifecycle and agent approval prompts without polling terminal_read_events. Both signals are wired BOTH on the local-mode PTYBridge path AND on the daemon-mode DaemonNotificationRouter path (the default production path).
Minor version bump (v2.12.0 → v2.13.0) because the AgentLifecycleEvent payload gains a new source: 'osc133' enum value, a new kind: 'agent.awaiting_input' enum value, a nullable agent field (only null when source === 'osc133'), and an optional exitCode field. The AgentStatus union also gains 'awaiting_input'. All additive — existing v2.12.x consumers that switch on the previous enum values keep working unchanged.
source: 'osc133' — every OSC 133 D shell-integration marker (e.g. from PowerShell, bash with VS Code shell integration, Ghostty, any CLI wrapped with prompt instrumentation) now tees onto the EventBus as kind: 'agent.stop' with the parsed exitCode. Latency-zero, shell-agnostic: orchestrators waiting on npm install / pytest / make / any CLI no longer need a heuristic detector. agent is set to the AgentDetector last-known slug when one is gated, otherwise null. OSC 133 events bypass the HookSignalRouter dedup ledger (always decision: 'emit') — they represent shell command lifecycle, not agent-turn boundaries.
kind: 'agent.awaiting_input' — AgentDetector now emits a distinct lifecycle kind when an agent surfaces a y/N or approval prompt mid-turn (Claude Code patterns Do you want to proceed? and Allow tool use for <Tool>). Distinct from agent.stop: orchestrators that auto-approve trusted operations can react to this kind to feed pre-approved answers without waiting for the turn to end. Routed through the same dedup ledger used for agent.stop.
AgentLifecycleEvent.source enum — 'hook' | 'detector' | 'osc133'.AgentLifecycleEvent.kind enum — 'agent.stop' | 'agent.subagent_stop' | 'agent.awaiting_input'.AgentLifecycleEvent.exitCode?: number | null — present on source: 'osc133' events; absent on hook / detector sources.AgentStatus = … | 'awaiting_input' — sidebar renders the new state as a yellow dot with the workspace.agentAwaitingInput label (en + ko translated; 21 other locales fall through Partial<TranslationMap> to en).AgentSignalKind = … | 'agent.awaiting_input' — detector-only kind today; hook bridges are not expected to emit it but the union now admits it so dedup ledger entries share one shape.scripts/osc133-awaiting-input-dynamic.mjs — end-to-end verification that spawns the packaged Electron app, exercises the daemon-mode path (the default production path), and asserts the new EventBus tee signals show up via wmux_events_poll. Result on this branch: 15/15 checks pass with a daemon--prefixed ptyId, confirming the daemon-path emit reaches the main process EventBus.PTYBridge (the local-mode path). Daemon-backed PTYs — the default production path — parsed OSC 133 markers in DaemonPTYBridge and appended them to PromptEventLog but never forwarded them up to the main process, so consumers saw source: 'osc133' events in tests but never in real-world sessions. DaemonNotificationRouter now subscribes to a new session:prompt daemon broadcast and emits the EventBus tee from the production path. The awaiting_input lifecycle had the same gap; both are fixed together. Caught by Codex round-1 P1 review and verified end-to-end against the packaged build.emitOsc133Lifecycle now snapshots the cached agent slug before awaiting workspace.list. The shell can emit OSC 133;D and then redraw the prompt in the same burst (firing a new session:agent event); without the pre-await snapshot, the OSC 133 emit would carry the next turn's agent slug. Matches the PTYBridge local-mode case 133 path, which reads agentDetector.getLastAgent() synchronously before any emit. Caught by Codex round-2 P2.Do you want to proceed? and Allow tool use for <Tool> are now anchored at both ends of the line, with only whitespace and Claude TUI box-drawing glyphs (│ ║ ┃ ═ ━ ─ ┄ ┅ ┆ ┇ ┈ ┉ ╭ ╮ ╯ ╰ ╔ ╗ ╝ ╚ ┌ ┐ ┘ └ ·) admitted as padding. Conversational mentions in agent output such as Answer Do you want to proceed? with caution or Please click Allow tool use for Bash no longer emit agent.awaiting_input — false positives are costly here because orchestrators may auto-feed approval responses. Codex rounds 1 → 5 progressively tightened this from an unanchored phrase match to a full-line anchor with canonical MCP tool-name grammar mcp__<server>__<tool> (two __ separators required, hyphens permitted, single-underscore identifiers rejected).WmuxEventType is unchanged; agent.lifecycle was already present in v2.12.x. Only the payload shape grows.wmux_events_poll MCP tool description updated to enumerate the three sources, new kind, and exitCode field so MCP-aware orchestrators discover the surface from introspection alone.DaemonEvent.type gains a 'prompt.event' variant — the daemon-side broadcast carrying parsed OSC 133 PromptEvents to the main process.DaemonNotificationRouter.lifecycle.test.ts (10 cases) covering detector awaiting_input emit, regression on waiting / complete, OSC 133 exitCode parsing, missing-suffix path, non-D ignore, agent slug cache, HookSignalRouter bypass for OSC 133, and session:died cache invalidation. Plus a race-fix test that mocks a deferred workspace.list and verifies the OSC 133 emit carries the pre-await snapshot, not the post-burst cache value.PTYBridge.lifecycle.test.ts covering local-mode OSC 133 (exit code 0 / 1, no-suffix, A/B/C ignore, workspaceId gate, gated agent slug, dedup bypass), local-mode awaiting_input detection, regex false-positive immunity for mid-line Do you want to proceed? and Allow tool use for, regex true-positive on boxed prompts including corner glyphs (╮, ─), canonical MCP tool name matching (mcp__github__create_issue, mcp__context7__get-library-docs), and rejection of non-canonical single-underscore names.StateWriter.test.ts:102 — the known cross-OS runner-load timeout flake first observed during v2.12.0 ship, independent of this PR; passes cleanly on rerun).MCP plugin permission enforcement + daemon lifecycle hardening
Lands the active enforcement layer for the Phase 2.1 MCP plugin substrate (PR #71) alongside a wave of lifecycle, identity, and UX hardening (PR #72/#74/#75). Plugins now have their declared capabilities verified on every RPC; the daemon self-shuts when idle and recovers from AV-blocked PID verification; a frozen WMUX_WORKSPACE_ID env can no longer leave in-pane MCP servers permanently stuck on a stale identity; xterm light themes are now WCAG-AA legible for true-color RGB white output; and keyboard pane/surface navigation finally moves DOM focus along with the visual marker.
Minor version bump (v2.11.0 → v2.12.0) because Phase 2.2 adds the RpcRejection discriminated union to RpcResponse's failure arm, the daemon.idleShutdownMinutes config, and the mcp.mode config flag. All additive; existing v2.11.x callers keep working.
Closes four gaps in the wmux daemon lifecycle: an orphan daemon that survives forever in RAM after a forced wmux quit, a boot-block when anti-virus prevents PID verification, an opaque "daemon could not start" error after the respawn budget exhausts, and a transient first-ping race during cold-boot. Combined effect: the "1 wmux ≙ 1 daemon" invariant is now self-healing instead of relying on the next clean shutdown.
daemon.idleShutdownMinutes in ~/.wmux/config.json; set to 0 to keep the legacy "alive forever" behavior). Routes through the same shutdown() body used by SIGTERM / SIGINT / daemon.shutdown RPC, so the existing phase instrumentation and re-entry guard apply. Logs [shutdown.phase] idle.timeout idleMs=… cfgMs=….DaemonPipeServer.getConnectionCount() / getLastDisconnectAt() — public accessors for the Watchdog idle predicate. The disconnect anchor is stamped only on the 0-edge (last socket closing), so a flapping reconnect cycle resets the idle deadline forward instead of accumulating stale idle time.Watchdog idle-check hook — opt-in callbacks onIdleCheck / onIdleShutdown evaluated on every health tick. Decision logic exposed as evaluateIdle() so unit tests drive it without timers. Single state machine: idleMs = now − (lastDisconnectAt ?? startTime). Grace window and idle window are independently configurable.scripts/daemon-idle-shutdown-dynamic.mjs — end-to-end verification that spawns the bundled daemon in an isolated tmp WMUX_DIR with WMUX_IDLE_SHUTDOWN_MS / WMUX_IDLE_GRACE_MS / WMUX_WATCHDOG_TICK_MS env overrides, connects, disconnects, and asserts the daemon exits cleanly with the idle.timeout breadcrumb. Runs in ~5s.ensureDaemon now retries the first daemon.ping once with a 250ms delay before declaring the existing daemon unresponsive. Absorbs the cold-boot race where Defender realtime scan, ConPTY cold-init, or a large recovery loop makes the daemon miss the first 3-second ping window. Total worst case 6.25s, still well under the 15s spawn budget.tasklist.exe / Get-CimInstance and the launcher cannot confirm what owns daemon.pid, it now prompts the user with an Electron dialog offering "Clean up and start fresh" instead of refusing to boot. Cancel re-throws the legacy error, now annotated with the exact elevated-PowerShell taskkill /F /PID … command for manual recovery.DaemonRespawnController now captures the latest error message from the bootstrap or respawn loop and ships it on the respawn-exhausted event. main surfaces it via a native dialog.showErrorBox plus the existing renderer IPC channel, with concrete recovery steps. lastError is cleared on successful install so future exhaustions don't echo stale diagnostics.taskkill /F /PID … invocation the user needs in an elevated PowerShell. No silent taskkill fallback because process.kill('SIGKILL') already walks the same TerminateProcess path with the same user token; embedding the hint is more honest than retrying.DaemonRespawnController.RespawnEvent — the respawn-exhausted variant now carries an optional lastError field. Additive change; existing consumers that ignore the field still type-check.WMUX_NO_DIALOG=1 bypasses both the launcher recovery dialog and the respawn-exhausted dialog for automated runs.idleShutdown.test.ts (source-level invariants for the daemon main wiring), new idle-flow test cases in Watchdog.test.ts, new getConnectionCount / getLastDisconnectAt lifecycle test in DaemonPipeServer.test.ts, new lastError propagation test in DaemonRespawnController.test.ts, and scripts/daemon-idle-shutdown-dynamic.mjs for the end-to-end path.Fixes a serious multi-agent bug: an in-pane MCP server (e.g. Claude Code) could get permanently stuck reporting a workspace id that no longer exists — a2a.whoami returning no workspace found for ws-… and terminal_send rejecting with not owned by workspace … (actual owner: …). Every identity-gated MCP call (A2A, terminal_*, browser routing) failed until the MCP server was restarted. Triggered when a workspace id is re-minted (daemon respawn / session restore) while the shell process — and its frozen WMUX_WORKSPACE_ID env — lives on.
ptyId, not a frozen workspace id. The on-disk PID map (~/.wmux/pid-map/<pid>) stores the ptyId; a2a.resolve.identity resolves the current owning workspace live from the renderer (input.findOwnerWorkspace) on every call. A re-minted workspace id can no longer produce a stale identity. The map is also re-anchored on pty.reconnect, so a surviving shell re-adopted after a respawn resolves correctly without a restart.src/mcp, src/company/mcp) no longer permanently trust the env hint. WMUX_WORKSPACE_ID is demoted to a last-resort fallback behind the live PID-walk; an RPC that reports a stale identity (no workspace found / not owned by workspace) invalidates the in-process cache so the next call self-heals.a2a.resolve.identity returns PID → current workspaceId (resolved live), legacy ws--prefixed pid-map entries pass through for one cycle, and ptyIds with no live owner are omitted (no phantom mappings).docs/PROTOCOL.md §6.1 reordered: path B (live PID-walk) is now preferred over path A (stale-prone env hint); added the ptyId-anchor and self-heal notes.Lands the active enforcement layer on top of the Phase 2.1 record-only identity + grammar substrate (PR #48) and the spec-side default rules (PR #68). Plugins that declare a capability set via mcp.declarePermissions now have those declarations verified against every RPC they issue; mismatches return a structured RpcRejection describing the per-path failure, and unconfirmed declarations surface a user-approval prompt before the call can proceed.
PermissionEnforcer substrate (src/main/mcp/PermissionEnforcer.ts) — pure-function permission gate. Given a method, params, request context, and trust record, returns allow, reject, or partial. Same function runs in both shadow and enforce modes; only the dispatcher's reaction changes.methodCapabilityMap — Record<RpcMethod, RequiredCapability> covering the full 96-method RPC surface. tsc --noEmit enforces totality so a new method without a gate entry fails the build. Identity bootstrap (mcp.identify, mcp.declarePermissions, system.identify, system.capabilities) is capability: null. Internal surfaces (daemon, company, surface, hooks) map to the reserved wmux.internal capability that no plugin can declare.RpcRejection discriminated union on RpcResponse's failure arm — capability-not-declared, path-not-allowed, paths-partially-allowed (with {allowed, rejected[]}), and identity-status (with optional pendingApproval.promptId). Additive on the existing {ok:false; error} arm; every switch (r.ok) site keeps narrowing.ShadowRejectionLogger + JSONL audit log at ~/.wmux/shadow-rejections.log — discriminated entries (rejection / legacy-traffic). 1 MiB cap with single-generation rotation. Sync writes wrapped in try/catch — telemetry must never affect RPC throughput.LegacyTrafficCounter — per-method milestones (1st / 10th / 100th / 1000th / 10000th call) for envelope-less RPCs, flushed to the shadow log. Replaces the previous process-once trust-DB write for accurate v3.1 surfacing data.ApprovalQueue — (clientName, hash(declaredCapabilities)) dedupe key, synchronous promptId minting + async resolution. On approve/deny, writes through PluginTrustStore.setUserDecision. Multiple inflight RPCs from the same plugin during a prompt coalesce onto one modal.PermissionApprovalDialog — risk-class-grouped capability list with asymmetric wording. Terminal-content (terminal.read, pane.search) and terminal-input (terminal.send) get critical-severity copy that names the concrete privilege ("can read what's on your screen, including secrets"); metadata / events / pane-lifecycle / workspace get neutral copy. Browser and A2A get caution.mcp.mode config flag in ~/.wmux/config.json — shadow or enforce. Production wmux defaults to enforce; dev (electron-forge start / NODE_ENV=test) defaults to shadow for dogfood rollback safety.PluginTrustStore.setUserDecision(name, 'trusted' | 'denied') — explicit user-decision write path. Seeds a fresh record when a prompt fires before mcp.identify lands.meta.write:custom.foo ≠ custom.foo.bar without trailing * or **).inventory.md Phase 2.2 capability map — per-method capability + path-source + risk-class column.RpcRouter.dispatch now calls the enforcer before invoking the handler. In shadow mode, the would-be rejection is logged and the handler still runs (no behavior change for v2.x callers). In enforce mode, a non-allow outcome returns the RpcResponse failure WITHOUT calling the handler. legacy callers (no clientName envelope) and identity-bootstrap RPCs are always allowed.ApprovalQueue.requestApproval returns { promptId, resolution } — the promptId is available synchronously so the dispatcher can thread it into the rejection without awaiting the user's decision.src/renderer/hooks/useActivePaneFocus.ts). Switching panes with the tmux prefix arrows, Alt+Ctrl+Arrow, Ctrl+Tab, the RPC pane.focus bridge, or keyboard tab-switching moved the red active border (driven by ws.activePaneId) but left DOM focus on the previously focused pane's xterm — so keystrokes still landed in the old pane. xterm routes input from whichever textarea holds DOM focus, and no navigation path ever called terminal.focus(). A central useActivePaneFocus hook now pulls DOM focus onto the resolved active terminal whenever the target workspace/pane/surface changes, covering every state-only switch path in one place. Mouse clicks were unaffected (the click focuses the target xterm for free) and remain so.rejection.pendingApproval.promptId with 1–5 s backoff. The substrate doesn't pin a socket waiting for the user (50-connection cap; OAuth authorization_pending precedent).meta.write:custom.foo matches the EXACT path custom.foo. Declare meta.write:custom.foo.* or meta.write:custom.foo.** to cover the subtree.events.poll is partial-mode multi-path: subscribing to mixed-allowed topics returns the allowed subset with a paths-partially-allowed rejection on the failure arm carrying both allowed and rejected lists. pane.setMetadata and pane.clearMetadata are all-or-nothing.Claude Code (and several other TUI apps) emit foreground text as true-color RGB white (#FFFFFF). Those escape sequences bypass our sandstone-light / paper-light xterm palettes, so the literal white rendered directly on hinomaru's cream background (#FAF8F5) and read as invisible — users could not see Claude Code's output at all on hinomaru/taegeuk.
minimumContrastRatio set to 4.5 (WCAG AA) on light themes. Detected via isLight(background) on the resolved palette; covers built-in light themes and any custom palette a user configures to a light tone. Dark themes keep the default ratio of 1 so intentionally subtle dimmed foregrounds (e.g. catppuccin-mocha's text-muted) remain unmodified.new Terminal({...}) site and the runtime theme-switch effect, so toggling between themes inside a live session takes effect without remounting the terminal.Switching panes with the keyboard moved the red active border but typing still landed in the previously focused pane. xterm routes keystrokes from whichever <textarea> currently holds DOM focus; navigation paths (focusPaneDirection, cyclePane, surface-tab switches, RPC pane.focus) only updated state, never called terminal.focus(). Mouse clicks were unaffected because the click focuses the target xterm DOM for free — so only keyboard paths were broken.
useActivePaneFocus central hook (src/renderer/hooks/useActivePaneFocus.ts) — subscribes to the resolved active terminal (workspace + pane + surface) and pulls DOM focus onto that xterm whenever the target changes, closing every state-only switch path in one place rather than patching four call sites. Retries across a few animation frames so a freshly split pane's xterm still gets focus once useTerminal registers it. Declines non-terminal surfaces (browser/editor).src/renderer/hooks/__tests__/useActivePaneFocus.test.ts — 11 cases on the pure resolution logic (resolveActivePanePtyId), including pane-switch and same-pane tab-switch coverage that directly pins this bug, plus browser/editor/empty-ptyId rejection. The DOM-focus application half (terminal.focus() + rAF retry) needs a browser harness the node-env vitest lacks and is verified by dogfood.Orchestrator substrate + Claude Code hook plugin
Lands the substrate piece that the new @wmux/orchestrator npm SDK consumes, plus the Claude Code hook plugin integration that delivers sub-200ms agent-completion signals (vs the heuristic regex detector). Minor version bump because the new agent.lifecycle event type is additive — no breaking changes vs v2.10.x clients.
agent.lifecycle EventBus tee from hook + detector sources (#63). New WmuxEventType agent.lifecycle streams whenever a supported inner agent (Claude Code today; others via the integrations/<slug> bridge later) finishes a turn or subagent span. Tee sites:
hooks.rpc.ts — Claude Code Stop / SubagentStop hooks fire RPCs that emit the event with source: 'hook'. Sub-200ms, deterministic. Both emit and dedup decisions stream so observers can compare.PTYBridge.ts AgentDetector — regex-based fallback for any agent, emits with source: 'detector' (~1-2s lag).DaemonNotificationRouter.emitDetectorLifecycle — daemon-backed PTYs (the default production path) — sync recordDetector call before async workspace.list resolution so dedup timing matches local-mode.
Carries ptyId, kind (agent.stop | agent.subagent_stop), source, agent slug, decision (emit | dedup). Polled via the existing wmux_events_poll MCP tool with the type filter extended.Claude Code hook plugin Phase 1 integration backbone (#60). Adds the integrations/claude-code/hook-plugin/ directory that bridges Claude Code's hook events into wmux's signal pipeline. Foundation for the structured agent observability surface.
Phase 1.5 signal-health + Phase 2 usage-meter + env-first routing (#61). Per-pane signal-health plumbing (~140 LOC across substrate only — proxy metric layers like cumulative / percent / banner were dropped after the Codex review). 5-hour and 7-day usage windows. Env-first hook routing fix so WMUX_HOOK_TARGET overrides config-derived destinations.
@wmux/orchestrator SDK in the MCP integration section (#67).agent.lifecycle event type is additive — clients that don't filter for it won't see it.@wmux/orchestrator v0.1.x requires wmux ≥ 2.11.0 (the version this agent.lifecycle tee actually ships in — the SDK README mention of "≥ 2.10" was off by one).First-launch input race fix + helper-orphan cleanup
Two prod-only bugs surfaced during fresh-PC dogfood of v2.10.1. Neither
reproduced under dev (npm start) because the vite dev-server load delay
hides the underlying daemon-bootstrap timing.
First-launch keystroke loss on fresh installs. v2.10.1's
DaemonRespawnController introduced a race between renderer mount and
the LOCAL→DAEMON IPC handler swap. On cold-start PCs the daemon spawn
stretches into hundreds of ms (Defender realtime scan + ASAR cold cache
pty.write that carried a LOCAL-prefix
id (pty-N) into the DAEMON handler was silently dropped because
sessionPipes.get('pty-N') is undefined — manifesting as "the first
keystroke does not register" or "only the first keystroke registers"
on the very first session. Fix splits renderer navigation out of
createWindow() into a standalone loadMainRenderer() export and
defers the call until after bootstrap() returns and
markDaemonReady() has unblocked daemon.whenReady(). Every
pty.create from the renderer now hits a stable handler topology and
produces a correctly-prefixed id. The macOS app.on('activate')
re-open path keeps the immediate-load default because the daemon is
already healthy by then.Helper-orphan zombies on quit. before-quit has five awaits
(renderer save, sleep, daemon shutdown race up to 8s, disconnect,
cleanup) before app.quit(). Any hang (stuck pipeServer.stop(),
detached webview blocking will-quit, ConPTY/OSC 7 finalization
stall) leaves Electron's renderer / GPU / utility helpers as orphans.
On Windows the dev npm start Ctrl+C path also leaks helpers because
SIGINT only reaches npm.exe, not the electron tree. Reproduced
locally as 20-helper orphan buildup spanning days. Add a 1.5s
setTimeout after app.quit() that calls app.exit(0) if the
graceful path has not finalized; unref() keeps the timer
non-blocking so a normal sub-second quit isn't held open. The
graceful path is unchanged — this only fires on hang.
.team/ added to .gitignore so worktree coordination metadata
cannot leak into future commits — matches the existing .claude/ /
.gstack/ exclusions (Codex /codex review P2 finding).Notification system expansion + CI hardening
Five-surface notification system (StatusBar bell, pane border ring, Windows taskbar flash, in-app toast, sidebar dot) with per-workspace mute, four new user settings, and a pure-function policy refactor of the notification dispatcher. Two CI hardening fixes also land.
● {unreadCount} element is
now a clickable accessible button (native <button>, dynamic aria-label,
focus-visible outline, 24x24 minimum click area, 999+ clipping). Click opens
the notification panel.prefers-reduced-motion (instant
transitions) and forced-colors: active (Windows high-contrast 2px border).hh:mm with
just now / Xm ago / Xh ago / Xd ago / local date. Future-skew safe.BrowserWindow.isDestroyed() guard prevents Electron throw.markAllRead() global + jumpToUnread() selector. Global mark-all
button in NotificationPanel (separate from the existing per-workspace one).
jumpToUnread navigates to the most recent unread workspace without
marking read.role="dialog", initial focus on first unread,
Esc closes, Tab cycles, screen-reader announces "{type}, {title},
{timeAgo}, {read|unread}" per row.Pane.handleClick, markAllRead,
setActiveWorkspace, removeWorkspace) so panes can no longer get stuck
in 'glow' after the user already handled the notification.useNotificationListener is now a thin IPC
dispatcher that delegates decisions to useNotificationPolicy (pure
function, testable in isolation). Replaces the module-scope mutable
lastSoundTime map with createThrottler(ms) closures (per-NotificationType
for sound, global 500ms for flashFrame burst protection).runSnapshotOnce test 7-day time bomb. The test used a hardcoded
lastActivity: '2026-05-15T00:00:00Z' for a suspended session, which
SUSPENDED_TTL_HOURS = 168 pruned exactly 7 days later. Test now uses a
dynamic Date.now() - 1h so the fixture never expires.ProcessMonitor CI flake. watch() left the first probe to the first
setInterval tick; under CI CPU contention two tasklist execs could
exceed the test's 5s timeout. watch() now triggers an immediate first
probe (production benefit: dead-PID detection is no longer up-to-5s
delayed). Test timeout bumped to 20s with documented latency reasoning.tmux prefix expansion + 16 new locales
This release rounds out the tmux-style prefix layer with pass-through and three new bindings, fixes a long-standing dead-event handler on the workspace rename shortcut, and ships UI translations for 16 additional locales.
Ctrl+B Ctrl+B by default)
now forwards a literal Ctrl+B byte to the active terminal, so a nested tmux/screen
session running inside a wmux pane receives its own prefix instead of being
swallowed by wmux., opens inline rename for the active workspace,
& closes the workspace (disposing every PTY in its tree first), ? redisplays
the keyboard cheat sheet even after it has been permanently dismissed.Ctrl+B , prefix action and
the existing Ctrl+Shift+R shortcut previously dispatched a custom event that no
component was listening for, so neither path opened the inline rename input. The
sidebar's WorkspaceItem now subscribes to the event on the active workspace.? prefix re-opens the cheat sheet after permanent dismissal. The AppLayout
mount gate previously prevented the cheat sheet from rendering at all once the user
clicked "Don't show again", so the one-shot force-show flag had nothing to react to.
The gate now honors the override.? prefix works after a previous cheat sheet auto-expired. The 30-second
countdown now clears the force-show flag when it hits zero, so the next ? press
flips the selector and re-triggers the show effect.createPrefixActions factory. The prefix-mode action registry in
useKeyboard.ts is now an exported factory taking {store, electronAPI, doc}, so
unit tests can drive every action with mocks instead of needing a DOM harness.
32 new unit tests cover every action plus the ctrlByteForKeyCode pass-through
helper.Scrollback restore hotfix
v2.8.x 이후 silently broken 이었던 scrollback restore 를 살리는 hotfix release. tray Quit → restart 시 모든 pane 이 fresh empty terminal 로 뜨던 증상의 진짜 root cause 3개를 모두 잡았다 (다층 race). 사용자 dogfood 로 end-to-end 검증 완료.
업그레이드 영향:
scripts/scrollback-reset.mjs 한방 cleanup util 제공 (백업 후 정리, 비파괴).uiSlice.scrollbackRestoreEnabled, default true) — Settings → Terminal 에서 끌 수 있음. OFF 시 startup 에 clearAllPtyState() 로 모든 pane fresh 시작. daemon 은 ringBuffer dump 계속 (renderer 가 안 읽어서 orphan .buf 는 다음 launch cleanOrphanedBuffers 가 청소). en/ko/ja/zh i18n.main/util/logSink.ts, daemon/util/logSink.ts) — 14일 이상 된 daily log 파일 startup 시 자동 삭제. 이전엔 retention 정책 없어 무제한 누적.scripts/scrollback-reset.mjs — 비파괴 cleanup util. ~/.wmux/buffers/, sessions.json*, %APPDATA%/wmux/session.json* 를 ~/.wmux/backup-<timestamp>/ 로 이동 (삭제 아님). 사용자가 session.json ↔ daemon dump mismatch 누적된 상태를 한 번에 청소할 수 있음.scripts/scrollback-restore-test.mjs — bundled daemon subprocess + RPC probe 기반 dynamic test. recovery + flush bytes contract regression 가드.workspaceSlice.loadSession ptyId wipe 제거. 매 startup 마다 모든 surface.ptyId 를 "" 로 force-clear 하던 코드가 reconcile 의 reconnect 경로 진입 자체를 막고 있었다. saved ptyId 는 이제 보존된다. 대신 AppLayout 이 paneGate ('pending' | 'ready') render gate 로 PaneContainer mount 를 reconcile 완료 이후로 미뤄서 옛 propagation race 를 원천 봉쇄한다. 추가로 clearAllPtyState cross-slice atomic clear action 이 reconcile 실패/timeout 시 explicit fallback.BEFORE_QUIT_TIMEOUT_MS 4s → 8s (cherry-picked from fix/daemon-shutdown-phase-instrumentation #45). 50-pane daemon 에서 4초로는 buffer dump 가 못 끝나 다음 launch 가 recovery 할 게 없던 상태. 동시에 daemon-side logSink (daemon/util/logSink.ts) + [shutdown.phase] per-phase 지표 + [recovery] session X bytes=N 가시화 도구 도입 — 이게 없었으면 다음 layer 진단 자체가 불가능했다.pty.reconnect race-free 재구성. AppLayout.reconcilePtys 는 이제 sync liveness check 만 (dead ptyId clear, live 는 그대로). 실제 reconnect 호출은 useTerminal mount 안에서 모든 listener 등록 후 발생. 이전 구조는 daemon SessionPipe replay (10KB+) 가 win.webContents.send(PTY_DATA, …) 로 forward 됐을 때 renderer ipcRenderer.on(PTY_DATA) listener 가 아직 없어 Electron IPC 가 silently drop 하던 게 진짜 사용자 가시 root cause 였다.pty.reconnect failure 처리 — {success: false} 응답을 더 이상 swallow 하지 않는다 (useTerminal 가 clearSurfacePtyIdByPty 호출 → Terminal self-create fallback). 이전엔 dead session 이 stale ptyId 로 input-mute 영구 유지될 수 있었음 — 정확히 Fix 0 이 없애려던 클래스.daemonMode flag race — isDaemonModeActive 를 startup IIFE 안에서 paneGate 가 ready 로 바뀌기 전 에 명시 set. 이전엔 별도 effect 가 set 해서 Terminal 이 daemonModeAtMount=false 로 mount 되고 reconnect 자체를 안 부르던 케이스 가능.session.load() rejection 이 .then 안의 try 를 우회해서 paneGate 가 영구 pending 으로 갇히던 edge 봉쇄.useRpcBridge startup-window 가드 — external RPC (MCP, A2A) 가 startup 중에 stale ptyId 로 write 들어오는 걸 {error: 'wmux is still starting', retryable: true} 로 차단.main/util/logSink.ts stdout tee — 이전엔 stderr 만 tee 해서 console.log 결과가 disk 에 안 남았다 (console.warn/error 만 capture). renderer 진단 라인이 main log file 에 같이 누적되도록 console-message level<2 return 필터도 제거.MAX_RECOVER_SESSIONS=40 초과 session 은 여전히 복원 못 함. design doc docs/internal/scrollback-restore-design.md §5 에 spec. TODOS.md 에 항목 등록. 50-pane thundering herd (codex P1#3) 와 함께 처리.AppLayout.gate integration test — vitest config 가 현재 environment: 'node' 라 jsdom + RTL setup 필요. follow-up.PR: #46 (path-D inventory, docs), #45 (daemon instrumentation + before-quit timeout 8s), #47 (Fix 0 — three-layer race fix + toggle + log prune).
Substrate 3.0 — Phase 0 + M0
wmux의 substrate identity 를 v3.0 으로 끌고 가기 위한 첫 번째 ship unit. v2.8.x 에서 이미 50% 가 출하돼 있던 substrate 표면 (PaneMetadata, EventBus, bootId, asOfSeq, f), (c) v2.8.x dogfood 중 노출된 스크롤백 손상 + reconcile race + logSink durable write 안정성 픽스를 한꺼번에 ship. 메인 PR 은 #34 (Substrate 3.0 — Phase 0 + M0, v2.9.0 ship unit) 이고 후속 마이그레이션 도구는 #35 (chopped-dump recovery tool) 로 따라간다. 외부 RFC 협의는 #15 (@alphabeen) 에서 진행됐고 그 OCC + system.capabilities, MCP host, mcp.claimWorkspace) 위에 (a) 그 표면의 contract 를 명문화한 Phase 0 문서, (b) main process 측 metadata authority 인 MetadataStore 와 그 wire 통합 (M0-amergeMode 디자인이 코드로 착지.
업그레이드 영향:
expectedVersion, mergeMode, pane.metadata.changed 의 version 모두 additive optional).userData/wmux/scrollback/corrupted/ 와 scrollback/*.txt.bak[.1..3] 회전 슬롯. 둘 다 자동 관리.scripts/recover-scrollback.mjs 로 사람이 읽을 수 있는 텍스트로 복원 가능. 자세한 가이드는 docs/upgrade-v2.9.0.md 참조.docs/PROTOCOL.md (substrate wire contract: layered status, namespacing, optimistic concurrency, mergeMode, cursor opaqueness, snapshot reconciliation, permission enforcement sketch, Named Pipe token security model), docs/api/{inventory,versioning,stability}.md (모든 RPC/MCP/event 의 stability tier + semver + 자동 업데이트 호환 정책), docs/internal/{m0-design,paneSlice-callsite-inventory}.md (M0 race specs + paneSlice 변경 blast-radius).MetadataStore 모듈 (M0-a) — main process 의 PaneMetadata authority. get / set / clear / snapshot / hydrate / serialize / migrate / onPaneDeleted, per-pane monotonic version, expectedVersion 기반 OCC, 세 가지 mergeMode (merge / replace / replaceShared). 31 unit test 가 CRUD + version + mergeMode 트랜잭션 + OCC + 검증 + snapshot + persistence + EventBus emission 을 cover, codex full-stack review 가 catch 한 3건 (replaceShared 의 custom 보호, 누적 size cap, updatedAt 추가 후 cap 적용) regression test 포함.pane.resolveActiveLeaf IPC 채널 (M0-b) — caller 가 paneId 를 생략하면 main 이 renderer 에 active leaf id 를 query (read-only, paneSlice 쓰기 0) 한 뒤 MetadataStore 에 commit. codex P1 review 가 잡은 split-store read-after-write 구멍 닫힘.MetadataStore.snapshot() ↔ pane.list 통합 (M0-c) — pane.list envelope 가 store snapshot 으로 anchored, asOfSeq 가 snapshot lineage 를 반영. renderer 가 더 이상 metadata 를 자체 합성하지 않음.SessionManager.saveMetadataSync 와이어 (M0-e) — MetadataStore 의 persist callback 이 metadata.json 에 atomic write, launch 시 store 가 그 파일에서 hydrate. codex P2 review 가 잡은 strict field validation 포함.pane.setMetadata 가 optional expectedVersion + mergeMode, reply / event / list 가 optional version 필드. v2.x subscriber 영향 없음 (모두 additive).version 필드 on pane.metadata.changed events.atomicWriteText / atomicReadText (sync + async) — core.ts 의 JSON 변종과 짝이 되는 텍스트 변종. rotation chain + quarantine 파이프라인 공유. JSON 변종이 parseable payload 를 전제하기 때문에 raw-bytes contract 가 필요한 스크롤백을 위해 sibling 으로 분리.src/main/scrollback/corruption.ts) — chopped dump 의 on-disk 시그니처 (median 비공백 행 길이 ≤ 3자, CRLF 바이트 비율 ≥ 0.3) 휴리스틱 검출기. 단일 패스 스캔, allocation 최소. 15 unit test 가 production v2.8.4 fixture (median=1, max=60 까지 outlier 살아남은 chopped 파일) 와 false-positive 저항 (정상 출력, sparse 세션, narrow pane, ANSI-rich 로그, 단일 긴 줄) cover.scrollbackDump util 모듈 (src/renderer/utils/scrollbackDump.ts) — renderer 의 dump serializer 를 AppLayout.tsx 에서 분리. eligibility 가드 (cols < 12 / rows ≤ 0 / terminal.element.offsetWidth === 0 / detached) 가 unit-testable. 13 test 가 각 가드 branch + happy path 를 pin.scripts/recover-scrollback.mjs (#35) — read-only 마이그레이션 CLI. v2.8.x → v2.9.0 첫 부팅에서 corrupted/ 로 격리된 chopped dump 를 reverse-reflow 로 사람이 읽을 수 있는 텍스트로 복원. node:util parseArgs 기반, dry-run / verbose / 입출력 dir 오버라이드 지원. 19 unit test (detector parity + 순수 transform + processFile e2e + CLI plumbing). 출력은 별도 폴더로만 쓰고 격리 원본은 절대 수정하지 않음.docs/upgrade-v2.9.0.md (#35) — v2.8.x → v2.9.0 사용자 마이그레이션 가이드. corrupted/ 폴더의 의미, 첫 부팅 시 무엇을 보게 되는지, 복원 스크립트 사용법, 복원 한계, 롤백 절차, FAQ.pane.{set,get,clear}Metadata 핸들러 (M0-b) 가 MetadataStore 로 라우팅. paneSlice 는 더 이상 RPC metadata path 에 의해 mutate 되지 않음.pane.list envelope (M0-c) 가 MetadataStore.snapshot() 으로 anchored. snapshot lineage 를 asOfSeq 가 반영.SessionManager (M0-e) 가 metadata.json 을 MetadataStore persist callback 으로 atomic write, launch 시 store 를 그 파일에서 hydrate.SCROLLBACK_DUMP IPC 핸들러 가 직접 writeFileSync 대신 atomicWriteTextSync 사용. rotation chain (.bak / .bak.1 / .bak.2 / .bak.3) 활성화. pre-write corruption 시그니처 검출 시 payload 거부 (defense in depth — renderer 가드 회귀 대비).SCROLLBACK_LOAD IPC 핸들러 가 atomicReadTextSync + validate hook 으로 load. chopped 시그니처 매칭 시 primary 를 corrupted/{ts}.bak 으로 격리 후 .bak 체인 fallback 으로 시도. 구조화 CORRUPT_FILE 로그를 stderr 로 emit. 손상 파일이 fresh xterm 에 복원돼서 다음 5초 dump 가 chopped 상태를 다시 디스크에 쓰는 자기증식 루프를 끊음.vitest.config.ts 가 scripts/__tests__/**/*.test.mjs 도 include — 운영 도구 (마이그레이션 스크립트 등) 가 같은 test runner 아래에서 회귀 보호됨.replaceShared mergeMode 가 caller 의 custom patch 를 덮어쓰던 결함 (codex full-stack review P2) — patch.custom 을 silently ignore 해 tool-namespace clobber 방지. substrate 의 namespace boundary guarantee.PANE_METADATA_MAX_BYTES) 이 updatedAt 추가 전에 검증되던 결함 (codex P2) — 최종 저장 shape (updatedAt 포함) 에 대해 검증. boundary 안전.custom entry cap 이 patch 에만 적용되던 결함 (codex P2) — 누적 merge 가 cap 을 우회하지 못하도록 post-merge shape 에 대해 검증.pane.resolveActiveLeaf 로 통일.workspaceId ?? '' 가 기억된 scope 를 덮어쓰던 결함 (M0-b codex P2) — coercion 제거; MetadataStore 의 기존 fallback 이 정상 동작.fit() 이 cols 를 ~2 로 collapse 시키면, renderer 의 5초 autosave 가 그 reflowed 버퍼를 캡처해 column-of-chars 로 디스크에 dump. 다음 부팅에 fresh xterm 에 복원되고 또 다시 5초 후에 dump 되며 영구적 손상 루프. 픽스는 네 층: (a) dump-time eligibility 가드 (cols < 12 / rows ≤ 0 / offsetWidth === 0 / detached element), (b) font/theme-change fit() 의 visibility 가드 (마지막 unguarded fit 사이트 닫힘), (c) IPC SCROLLBACK_DUMP 의 시그니처 거부, (d) IPC SCROLLBACK_LOAD 의 시그니처 검출 + 격리 + .bak 회전 체인 fallback. 시각 증상은 "재부팅하면 일부 패널 스크롤백이 비어 보임". 자세한 forensic 은 PR #34 참조.daemon.whenReady() 와 daemon.onConnected 가 첫 연결에 같은 reconcile 을 동시에 trigger, 두 walk 가 같은 session 에 대해 race 하면서 한쪽이 ptyId 를 clear. 사용자 증상: 부팅 후 워크스페이스 전환을 한 번 해야 일부 패널이 살아남. 픽스: reconcileInFlightRef 가 중복 trigger 를 drop, workspace snapshot 을 walk 마다 다시 읽어 동시 spawn 이 frozen view 에 가려지지 않음.pty:resize 가 recovery PTY mute race 를 유발하던 결함 — daemon 이 아직 session 을 publish 하기 전에 renderer 가 보낸 pty:resize 가 "session not found" 로 실패하고 recovery PTY 가 muted 상태로 남던 결함. 50 × 20ms retry budget + 진단 로그 추가.session + scrollback 핸들러가 daemon-connect handler-swap cycle 의 unregister 윈도우에 떨어지던 결함 — cold boot 시 scrollback:load 가 "No handler registered" 로 거부되고 다음 5초 autosave 가 빈 버퍼를 디스크에 덮어쓰던 결함. session + scrollback 핸들러를 swap cycle 밖으로 이동.orig() try/catch 추가. appendFileSync 사용으로 로그가 디스크에 durable.node scripts/recover-scrollback.mjs --verbose 로 가능 (자세한 가이드는 docs/upgrade-v2.9.0.md).corrupted/ 폴더: 30 일 / 폴더당 10 파일까지 자동 정리. 수동 삭제도 안전.pane.metadata.changed event subscriber: optional version 필드가 추가됐다. 무시해도 v2.x 와 동일 동작.Agent Notification Pipeline Restoration
사용자가 보고한 "Claude 가 작업을 끝내도 사이드바 dot, unread 배지, OS 토스트 — 3가지 신호 전부 안 뜬다" 결함을 root-cause 수준에서 복구. main 의 감지 레이어 (PTYBridge, AgentDetector, ActivityMonitor) 가 emit 하는 신호를 renderer UI 까지 연결하는 wiring 이 4 군데 끊겨 있었고, wmux production 인 daemon mode 에서는 PTYBridge 가 아예 우회되어 본 fix 가 0 효과 라는 더 큰 결함도 포함. 메인은 PR #30 (4 commits, +1579/-141, 29 files) 이고, 같은 릴리즈에 두 개의 다른 PR — #28 (@dev-minggyu, workspace drag reorder 복구 — 외부 기여 첫 컨트리뷰션) 과 #29 (multiview sticky group + MiniSidebar feature parity) — 도 함께 ship 됐다.
move 드래그가 충돌해 정렬이 막혀 있었다. 신규 src/shared/dragDrop.ts 헬퍼가 DataTransfer 가 실제 OS 파일 드래그인지 판별, 전역 드롭 핸들러와 오버레이가 파일 드래그에만 반응하도록 제한. 내부 text/plain 드래그 회귀 테스트 21 라인 추가.AppLayout 이 multiviewIds 자체를 iterate 해서 Ctrl-click 순서 보존. (b) 그룹 밖 workspace 를 plain-click 하면 그룹이 통째로 사라지던 결함 → setActiveWorkspace 가 multiviewIds clear 안 함 + activeWorkspaceId ∈ multiviewIds 일 때만 grid 렌더 (그룹 외부 클릭 시엔 단일 view, 멤버 재클릭 시 grid 복구). (c) 접힌 사이드바 (MiniSidebar) 가 multiview indicator / drag-reorder / W1·W2 라벨 / unread 배지 / agent dot 전부 없던 결함 → 펼친 사이드바와 동일 기능 부여, AGENT_STATUS_ICON 을 Sidebar/agentStatusIcon.ts 로 추출해 두 사이드바 lockstep. Codex review 가 잡은 reseed 결함 (stale 그룹에서 새 multiview 시작 시 Ctrl-click 무반응) 도 함께 수정. +5 multiview 회귀 테스트.src/main/pty/PTYBridge.ts:207 가 agentDetector.onCritical 만 구독하고 onEvent 는 dead code. Claude/Codex/Aider 의 "esc to interrupt" / "shift+tab to cycle" / "Applied edit to" 같은 정확한 prompt 패턴은 감지되어 emit 되었지만 호출되는 콜백이 0 개라 사이드바 dot 이 영영 켜지지 않았다. PTYBridge 가 onEvent 도 구독하도록 추가, IPC.METADATA_UPDATE 로 agentStatus/agentName broadcast + sendNotification 호출.IPC.NOTIFICATION payload shape 가 sender 마다 달라서 외부 RPC 알림이 깨지던 결함 — PTYBridge 는 (channel, ptyId, notification) 3-arg, notify.rpc.ts 는 (channel, { title, body, type }) 1-arg. preload notification.onNew 는 3-arg signature 라 RPC path 의 첫 인자가 ptyId 자리로 들어가 payload 가 silent 하게 깨졌다. 새 sendNotification utility (src/main/notification/sendNotification.ts) 가 단일 (window, ptyId|null, payload) contract 로 통일.IPC.METADATA_UPDATE 가 두 sender 사이에 shape 불일치였던 결함 — metadata.handler 는 (ptyId, data) 2-arg, meta.rpc 는 (payload) 1-arg 로 같은 채널에 송신. 한 path 가 정상 동작하는 동안 다른 path 가 silent 하게 깨졌다. MetadataUpdatePayload (src/shared/types.ts) 를 단일 discriminated payload 로 정의, broadcastMetadataUpdate utility 로 모든 sender 통일. meta.rpc 의 {kind: 'status'|'progress'} discriminator 폐기, workspace-level field 로 직접 매핑.'waiting'/'complete'/'running' 이 한 번 set 되면 lifecycle reset 없음. 사용자 입력 후 agent 가 다시 실행되어도 dot 은 'waiting', PTY 가 죽어도 dot 은 'running' 으로 남는 거짓말 발생. ActivityMonitor 의 새 onActive 콜백이 burst 진입 시점에 'running' 설정, PTYBridge.onExit 가 'idle' broadcast, cleanupInstance 도 dispose path 에서 동일하게 broadcast (idempotent). renderer 의 AppLayout 가 session restore 직후 모든 workspace 의 stale agentStatus 를 sanitize.DaemonPTYBridge 를 통과하고 PTYBridge 는 우회된다. DaemonPTYBridge 가 이미 'agent'/'critical'/'idle' event 를 emit 하고 있었지만 DaemonSessionManager 는 'idle' 만 forward, daemon/index.ts 는 'activity.idle' 만 broadcast, DaemonClient 는 'session.died' 만 specific emit. 즉 local mode fix 만으로는 사용자 환경에서 0 효과. 신규 DaemonNotificationRouter (src/main/notification/DaemonNotificationRouter.ts) 가 daemon broadcast event 5 종 (session:agent/active/critical/idle/died/destroyed) 을 listen 해서 PTYBridge 와 동일한 로직 실행. DaemonEvent type 에 'activity.active' + 'session.destroyed' 추가, daemon/index.ts 가 신규 type 모두 broadcast, DaemonClient 가 specific emit. daemon 측 AgentDetector 의 dedup state 도 onActive burst 시점에 in-process 로 reset (main 에서 daemon process 의 detector 에 접근 불가하기 때문).FitAddon.fit() → IPC.PTY_RESIZE → SIGWINCH → TUI agent 의 full-screen redraw 가 active 진입 → 5s 후 idle timer 발화. 신규 idleSuppression 모듈 (src/main/notification/idleSuppression.ts) 이 lastResizeAt/lastUserWriteAt 을 per-ptyId 로 추적, 30 s window 내면 activity-fallback 알림 suppress. AgentDetector 의 precise event 는 gate 안 함 (정확한 신호이므로). pty.handler.ts 의 4 path (write × 2 + resize × 2) 가 markResize/markUserWrite 호출. 사용자가 보고한 "타자 치는 중 알람" + "워크스페이스만 눌렀다가 다른 곳 가면 +1" 두 시나리오 모두 해결.useNotificationListener 가 active workspace 의 active surface 일치 여부 체크 없이 무조건 addNotification + pushToast 호출. 사용자가 직접 보고 있는 곳은 알림 의미 0 인데 unread 배지가 계속 올라갔다. 알림 발생 직전 isActivePtySurface 체크 → 일치하면 in-app surface (addNotification + pushToast) skip. OS toast 는 ToastManager 가 자체 focus gate 가지고 있어 변경 없음.workspaceSlice.setActiveWorkspace action 이 해당 workspace 의 모든 unread 를 read 로 자동 처리하도록 변경. Array.isArray(state.notifications) 가드로 workspaceSlice 단독 테스트 호환.useNotificationListener 가 settings 의 toastEnabled 무시하고 매번 in-app overlay 띄움. 사용자가 "Toast notifications" 끄면 OS toast 만 suppress, in-app 은 그대로 표시되던 결함. state.toastEnabled gate 추가 (sound playback 패턴과 동일).esc to interrupt 가 false-positive 'waiting' — 실제로는 "지금 response 가 진행 중, ESC 로 중단 가능" 힌트이지 idle 신호가 아니다. 패턴 제거. mid-turn 에 잘못된 알림 fire 차단.AgentEvent.status: 'completed' vs WorkspaceMetadata.agentStatus: 'complete'. AgentStatus enum 으로 통일 (Aider 패턴 'completed' → 'complete' 텍스트 변경 포함). 외부 consumer 없어 안전.lastEmittedKey 가 single global string 이라 한 번 emit 한 prompt 는 다시 emit 안 됨 → 사용자가 추가 입력해도 사이드바 dot 갱신 0. lastEmittedFor Map 으로 per-(agent:status) 분리 + resetEmissionState() method 추가, ActivityMonitor 의 새 active burst 시점에 reset (turn boundary). local mode 는 PTYBridge 가 직접 호출, daemon mode 는 DaemonPTYBridge.onActive 콜백이 in-process 에서 호출.\x1b[?25h 같은 cursor visibility 시퀀스 (? 포함) 가 [0-9;]*[a-zA-Z] regex 와 안 맞아 clean 에 잔존, gate 매칭 실패 가능. [0-9;?<=>]*[a-zA-Z@] 로 확장.\r redraw 를 한 라인으로 처리하던 결함 — Claude/Codex TUI footer 는 CR 단독으로 redraw. split(/\r?\n/) 가 통째로 묶어 line-anchored regex 가 매칭 실패. split(/\r?\n|\r(?!\n)/) 로 확장.void 반환이라 PTY recycle 시마다 listener 누적. v2.7.2 의 PlaywrightEngine CDP 세션 누수와 동일 카테고리. unsubscribe 함수 반환으로 변경, PTYBridge cleanupInstance + DaemonPTYBridge cleanup 에서 호출. ActivityMonitor 의 onActiveToIdle/onActive 도 같은 패턴.AGENT_EVENT_SUPPRESSION_MS 로 ActivityMonitor 의 fallback 알림 dedup — AgentDetector 가 precise event emit 직후 ActivityMonitor 가 또 idle 발화하면 같은 turn 에 알림 2 회. PTYBridge / DaemonNotificationRouter 가 lastAgentEventAt 추적, 10 s 이내면 fallback skip.notify RPC 가 workspaceId 없이는 깨지던 결함 — preload signature 가 ptyId: string 강제, addNotification 이 surfaceId 강제. RPC path 는 ptyId 가 없어 silent drop 되거나 type error. workspaceId optional 로 변경 (CLI wmux notify backward compat 유지), Notification.surfaceId optional, useNotificationListener 가 null ptyId 면 workspaceId 로 active surface resolve (or active workspace fallback).sendNotification utility (src/main/notification/sendNotification.ts) — 모든 IPC.NOTIFICATION 송신의 단일 entry point. window null/destroyed 가드 + (ptyId | null, payload) 시그니처 통일. PTYBridge 4 호출 지점 + notify.rpc + DaemonNotificationRouter 모두 import.broadcastMetadataUpdate utility (src/main/ipc/handlers/metadata.handler.ts) — 모든 IPC.METADATA_UPDATE 송신의 단일 entry point. MetadataUpdatePayload 단일 shape.idleSuppression 모듈 (src/main/notification/idleSuppression.ts) — per-PTY resize/user-write 시점 추적. 30 s suppression window 로 ActivityMonitor 의 byte-count heuristic false-positive 차단.DaemonNotificationRouter (src/main/notification/DaemonNotificationRouter.ts) — daemon mode 에서 PTYBridge 의 알림 라우팅 역할 대체. DaemonClient event 5 종 listen → sendNotification + broadcastMetadataUpdate + toast.getActiveAgents() / getLastAgent() / resetEmissionState() public method 추가. PTYBridge 가 lastAgent name 을 onActive metadata 에 채워 넣을 수 있게.AgentDetector.test.ts (18, enum/unsubscribe/dedup/\r split/ANSI strip/getters/critical), ActivityMonitor.test.ts (+4, onActive cycle dedup), sendNotification.test.ts (4, null/destroyed/ptyId 분기), PTYBridge.notify.test.ts (5, METADATA_UPDATE + NOTIFICATION + try/catch + cleanup unsub), notify.rpc.test.ts (6, workspaceId optional + MCP path + type fallback + toast). IRON RULE 7 regression 중 6 cover, R7 (pushToast in renderer) 는 jsdom 필요해 manual.Notification.surfaceId 를 optional 로 변경 — Pane.tsx 의 surfaceIds.has(n.surfaceId) 에 undefined guard 추가됨. 다른 consumer 없음.AgentEvent.status enum 변경 ('completed' → 'complete') — wmux 내부에서 PTYBridge onCritical 만 consume 했고 onEvent 는 dead code 였으므로 외부 영향 없음.IPC.METADATA_UPDATE payload shape 통일 — preload metadata.onUpdate 시그니처가 (payload) 단일 인자로 변경. renderer 의 useNotificationListener 가 호환 처리. 외부 MCP / CLI consumer 영향 없음.notify RPC 의 workspaceId 는 optional 신규 param. CLI wmux notify --title X --body Y 는 그대로 동작. MCP 클라이언트가 mcp.claimWorkspace 의 workspaceId 를 함께 보내면 precise routing (active surface auto-select).DaemonNotificationRouter regression test suite — manual verification 으로 cover, daemon IPty pipeline mock 은 별도 작업.onExit elapsed=0 cosmetic (cleanupInstance 가 ptyCreatedAt 먼저 wipe 하는 path) — purely message-text, behavioural 영향 0.DaemonClient.removeAllListeners on disconnect — pre-existing, 본 PR 범위 외.TODOS.md 에 cherry-picked deferral 추가: E3 (transient dot flash animation, P3), E4 (per-workspace notification mute, P2), E5 (tray icon unread badge — cross-platform, P2), Phase 2 Eureka (Claude Code stop-hook → OSC 9 BEL emit, P3).| Pass | Reviewer | Findings | Status |
|---|---|---|---|
| Plan 1 | /plan-ceo-review |
5 proposals | SELECTIVE_EXPANSION, 2 accepted |
| Plan 1 | Codex round 1 | 10 | all addressed |
| Plan 1 | /plan-eng-review |
11, 1 critical | all addressed |
| Plan 1 | Codex round 2 | 8 | all addressed (daemon mode wiring 6 파일 추가) |
| Code 2 | Codex round 3 | 2 (P1+P2) | all addressed in 5aee27f |
| Code 3 | Codex round 4 | 3 (P2+P2+P3) | all addressed in cddd3bd |
| Code 3 | Claude subagent | 7 (P2+P2+P3×5) | 2 addressed, 5 deferred |
| Code 4 | 사용자 manual test | 2 (resize/typing FP) | addressed in 42f5bd3 |
7-round review pipeline 의 한계: AI review 가 PTY echo / SIGWINCH redraw 같은 runtime 동작 은 코드만 보고 모델링하기 어렵다. 사용자 manual test 가 마지막 안전망이 됐다는 점이 기록 가치 있음.
License Bundling + Third-Party Notices Attribution
wmux 빌드 산출물에 부족했던 attribution 의무를 정리한 patch. THIRD_PARTY_NOTICES 가 Playwright 하나만 적혀 있었지만 실제 runtime 번들은 110 packages (16 직접 deps + Electron + ~93 transitive) 를 포함하고 있었다. MIT/ISC/BSD/Apache-2.0 의 "all copies or substantial portions" 조항을 모두 충족하도록 재구성. 코드 동작 변경 없음 — 사용자 가시 변경은 tray 메뉴에 라이선스 진입점 3 개 신설.
scripts/generate-notices.mjs — npm run notices 로 production deps tree 전체를 walk 해서 THIRD_PARTY_NOTICES 를 재생성한다. 외부 의존성 0 개 (npm ls --prod --all --json + node:fs 만 사용). 추가 install 없이 CI 에서도 그대로 실행 가능. dependency 변경 시 즉시 갱신.About wmux (네이티브 About 패널), License (wmux) (MIT 본문 직접 열기), Third-party licenses (THIRD_PARTY_NOTICES 직접 열기). shell.openPath 로 OS 기본 텍스트 앱에서 열고, 연결된 앱 없으면 showItemInFolder fallback. 그동안 wmux 는 application menu 자체가 없어서 사용자가 라이선스 파일에 도달할 경로가 0 이었다.app.setAboutPanelOptions — 네이티브 About 다이얼로그에 wmux 버전 / MIT copyright pointer / project URL metadata 설정. macOS 는 앱 메뉴에서 자동 표시, Windows/Linux 는 신규 tray 항목 "About wmux" 가 트리거.THIRD_PARTY_NOTICES 의 109 packages 누락 — 이전 파일은 Playwright 1 개만 적혀 있어 사실상 MIT/ISC/BSD/Apache-2.0 attribution 의무 (carry copyright notice in "all copies") 가 부분 미준수 상태였다. 자동 생성으로 110 packages 모두 채움. 라이선스 분포: 98 MIT, 7 ISC, 2 Apache-2.0 (electron-squirrel-startup, playwright-core), 2 BSD-3-Clause, 1 BSD-2-Clause. Zero copyleft, zero unknown — 재배포 권리 위험 0.LICENSE 가 빌드 산출물에 누락 — forge.config.ts 의 extraResource 에 ./LICENSE 추가. 빌드 후 <install>/resources/LICENSE 에 위치하여 wmux 의 MIT 본문도 exe distribution 과 함께 carry. (Electron 본체 LICENSE — Chromium / V8 / Node 커버 — 는 electron-packager 가 install root 의 wmux.exe 옆에 자동 emit, 이미 충족됨.)Session Cap Headroom + Silent-Failure Fix
@alphabeen 이 v2.8.1 출시 직후 PR #25 로 보고한 두 문제를 한 patch 에 묶는다. v2.8.1 의 startup brick 픽스 이후에도 runtime accumulation 시나리오 (X close 후 daemon 이 유지하는 detached 세션이 며칠에 걸쳐 누적) 에서는 hard cap 50 에 다시 도달했고, 더 나쁜 건 cap throw 가 renderer 의 Ctrl+T 핸들러에서 silent 하게 묻혀 단축키가 무반응처럼 보이던 결함이다. v2.8.1 사용자는 즉시 업그레이드 권장.
src/daemon/DaemonSessionManager.ts, src/daemon/index.ts 주석 동기화.pty.create rejection 이 묻혀 단축키 무반응처럼 보이던 회귀 — @alphabeen 이 PR #25 description 에서 짚어준 두 번째 문제. cap 도달 시 daemon 이 actionable 에러 (Cannot create new terminal: 200 active sessions already running. Close some panes (or restart wmux) and try again.) 를 throw 하는데 renderer 의 세 호출 지점 (useKeyboard Ctrl+T 핸들러 / AppLayout empty-leaf 자동 PTY / FloatingPane 첫 열림) 모두 .then() 만 달고 .catch() 누락 (또는 silent catch) 이라 rejection 이 묻히고 단축키가 무반응처럼 보였다. v2.8.1 Bug 1 의 actionable error 의도가 무력화되던 결함.
RESOURCE_EXHAUSTED — wrapHandler 의 classifyError 가 cap 메시지 패턴 (cannot create new terminal + active sessions already running) 을 감지해 분류. 메시지에 [RESOURCE_EXHAUSTED] prefix 가 stamp 되어 renderer 가 분기 가능.useIpc 매핑 — DEFAULT_MESSAGES['RESOURCE_EXHAUSTED'] = "터미널 세션 한도에 도달했습니다. 일부 pane을 닫거나 wmux를 재시작한 뒤 다시 시도해주세요.", level 'warn'. UNKNOWN 으로 매핑되어 generic "알 수 없는 오류" 토스트가 뜨던 path 차단.ipcInvoke wrap 으로 통일 — useKeyboard Ctrl+T (ref 패턴으로 once-on-mount effect 안에서 사용), AppLayout empty-leaf 자동 PTY effect, FloatingPane 첫 PTY 생성. 모두 result.ok 분기 + 실패 시 toast 자동 게재.ipcRenderer.invoke 가 main side 에러를 renderer 로 전달할 때 메시지를 Error invoking remote method 'X': Error: <orig> 형태로 감싸서, useIpc 의 MESSAGE_CODE_PREFIX 가 ^ anchor 였던 탓에 [RESOURCE_EXHAUSTED] stamp 가 envelope 뒤로 밀려 매칭 실패 → 모든 coded error 가 다시 UNKNOWN 으로 떨어지던 path 차단. renderer regex 만 anchor 제거 (main side 는 자기 raw output 매칭이라 anchor 유지). 알phabeen 이 PR #25 description 에서 짚어준 결함이 두 번 일어나지 않도록 회귀 테스트 추가.src/main/ipc/wrapHandler.ts, src/renderer/hooks/useIpc.ts, src/renderer/hooks/useKeyboard.ts, src/renderer/components/Layout/AppLayout.tsx, src/renderer/components/Terminal/FloatingPane.tsx. 6 unit tests 추가 (wrapHandler RESOURCE_EXHAUSTED classification + message prefix stamping + useIpc default 매핑 + Electron-wrapped envelope classification).RESOURCE_EXHAUSTED 코드는 내부 IPC 경계 안쪽에서만 사용 (renderer ↔ main).Session Recovery Stability Hotfix
@alphabeen 이 v2.8.0 출시 직후 보고한 세 가지 회귀 — 시간이 갈수록 wmux 가 사용 불가 상태로 빠지던 critical, recovered pane 출력이 깨지던 high, 매 시작마다 generic 에러 토스트가 뜨던 medium — 을 한 릴리스에 묶어 수정한다. v2.8.0 사용자는 즉시 업그레이드 권장 — 자동 마이그레이션이 누적된 sessions.json 을 첫 실행 시 정리한다.
세션 누적으로 인한 brick 상태 (Critical) — v2.8.0 에서 도입된 데몬 세션 영속화는 사용자가 X 로 종료한 모든 live pane 을 suspended 로 저장하고 다음 시작 시 복구한다. 그런데 (1) 복구 횟수에 상한이 없었고, (2) 종료 시점에 사용자가 명시적으로 닫지 않은 세션은 영원히 sessions.json 에 남아 누적됐다. 4–5 회 재시작이면 데몬의 하드 PTY 캡 (MAX_SESSIONS=50) 을 모두 소진하여 startup recovery 가 새 pane 슬롯을 못 만들고, UI 는 Ctrl+T 도 안 먹히고 generic "알 수 없는 오류" 토스트만 도배되는 상태에 빠진다. 자가복구 불가능 (재시작해도 같은 시나리오 반복).
StateWriter.load 가 이제 dead 세션뿐 아니라 7 일 이상 inactive 한 suspended 도 함께 prune. v2.8.0 에서 누적된 기존 sessions.json 도 첫 v2.8.1 실행 시 자동 정리된다.MAX_RECOVER_SESSIONS=40. 복구 후보를 lastActivity 내림차순 정렬해 상위 40 개만 PTY 로 재생성하고 나머지는 그대로 suspended 로 남는다. 다음 launch 에서 활성 카운트가 줄면 자동으로 복구 후보에 다시 들어오며, 7 일 TTL 이 그래도 정체된 것을 reap. 이로써 hard cap 50 에 도달해도 항상 신규 pane 헤드룸 10 슬롯이 보장된다.createSession 에러 메시지 사용자 친화적 변경 — Maximum session limit (50) reached → Cannot create new terminal: 50 active sessions already running. Close some panes (or restart wmux) and try again.. RPC 응답으로 그대로 노출되어 향후 토스트가 generic 이 아닌 actionable 메시지로 보임.src/daemon/StateWriter.ts, src/daemon/index.ts, src/daemon/DaemonSessionManager.ts, src/daemon/recoverySelector.ts (신규 — pure 함수로 cap 정책을 분리해 unit-test 가능). 9 unit tests 추가.복구된 pane 출력 interleave (High) — v2.8.0 은 종료 시점의 PTY cols/rows 를 저장하고 복구 시 그 값으로 ConPTY 를 spawn 한다. 사용자가 윈도우 사이즈를 바꾸고 재시작하면 ConPTY 는 옛 geometry 로 출력하는데 xterm 은 새 geometry 로 그려서 같은 줄에 두 paint 의 문자가 interleave 된다 (예: Accessing workspace: → Accessingwworkspace:).
DaemonPTYBridge 에 setMuted(bool) 추가. recovery 경로에서 createSession({deferOutput: true}) 면 bridge 가 muted 로 시작하여 PTY 데이터 path 가 ring buffer 에 쓰지 않는다 (exit 알림은 muted 와 무관하게 정상 동작). renderer 가 첫 daemon.resizeSession 을 호출하면 PTY 가 진짜 geometry 로 resize 되고 DEFERRED_UNMUTE_DELAY_MS=100 후 자동 unmute. ConPTY 가 옛 geometry 에서 큐잉했던 출력은 100 ms 동안 drain 되고 버려진다. 저장된 scrollback (buffer dump) 은 ring buffer 에 직접 pre-fill 되므로 muted path 와 무관하게 보존된다.src/daemon/DaemonPTYBridge.ts, src/daemon/DaemonSessionManager.ts, src/daemon/index.ts (recoverSessions 의 createSession 호출 3 곳 모두 deferOutput: true). 5 unit tests 추가 (drop while muted / scrollback 보존 / resize-then-unmute / 비-deferred regression / muted 중 exit 발화).시작 시 generic 에러 토스트 폭주 (Medium) — main process 가 daemon connect 를 비동기로 시도하는 동안 renderer 가 이미 IPC 호출을 던져, handler swap (cleanupHandlers() → registerAllHandlers(...)) 의 sub-millisecond 무등록 윈도우에 떨어진 호출이 No handler registered for ... 로 실패해 useIpc 가 UNKNOWN → "알 수 없는 오류가 발생했습니다." 토스트를 5–10 회 띄우던 문제.
daemon:get-ready-state 를 등록 (registerAllHandlers swap cycle 바깥이라 무등록 race 불가). connect 시도가 끝나면 markDaemonReady() 가 그동안 큐잉된 invoke 를 해제. 이후 invoke 는 즉시 현재 daemonClient 상태로 응답.electronAPI.daemon.whenReady() 가 ipcRenderer.invoke('daemon:get-ready-state') 를 호출 (one-shot event 가 아니라 query). renderer crash recovery 의 mainWindow.reload() 로 새로 로드된 preload 인스턴스도 정상 응답을 받아 deadlock 안 됨 (codex review fix — 초기 event-based 설계의 P2 결함 보강).AppLayout 의 첫 reconcile 이 daemon.whenReady() 를 await 하여 handler 가 안정된 뒤에야 pty.list / pty.reconnect 를 호출. 토스트 폭주 사라짐.src/main/index.ts, src/preload/preload.ts, src/renderer/components/Layout/AppLayout.tsx.Split 후 빈 pane 이 영구 placeholder 로 남던 문제 — AppLayout 의 auto-PTY effect 가 activeWorkspace.id 만 deps 로 가져 split 으로 추가된 새 leaf 가 surfaces=[] 인 채 effect 재실행을 유발하지 못했다. 결과적으로 분할된 새 pane 이 "빈 창" placeholder 로 굳어 PTY 가 영영 안 붙었다. collectEmptyLeaves 를 effect 바깥으로 끌어올리고 빈 leaf id 들의 join 키를 deps 에 추가해 split 이 즉시 PTY 생성을 트리거하도록 수정. paneSlice 에 회귀 테스트 추가 (src/renderer/stores/slices/__tests__/paneSlice.test.ts).
한글 IME 상태에서 Ctrl+D / Ctrl+Shift+D split 단축키 미작동 — Hangul 레이아웃에서 e.key 가 'ㅇ' 또는 'Process' 가 되어 useKeyboard 의 key === 'd' 매칭이 빗나가고, useTerminal 의 xterm allowlist 도 같은 이유로 빠져 단축키가 xterm 에 흘러갔다. 두 곳 모두 e.code === 'KeyD' (물리 키 코드) 도 함께 매칭하도록 수정 — 기존 Ctrl+B / Ctrl+M 등의 cross-layout 패턴과 일관. 구현: src/renderer/hooks/useKeyboard.ts, src/renderer/hooks/useTerminal.ts.
분할 pane 을 키보드/마우스로 닫을 수 없던 문제 — Ctrl+W 가 closeSurface 만 호출해 마지막 surface 닫혀도 pane 이 collapse 안 되고, 단일 surface pane 에서는 SurfaceTabs 가 strip 자체를 숨겨 X 버튼도 없었다. (1) Ctrl+W 가 마지막 surface 닫힐 때 closePane cascade 호출 (Pane.tsx X-button 동작 미러), (2) SurfaceTabs 가 surfaces.length === 1 이어도 strip 렌더, (3) 신규 Ctrl+Shift+Q (tmux kill-pane equivalent) 추가 + BUILTIN_KEYS 로 보호, (4) SettingsPanel 의 Ctrl+W 라벨이 실제 동작과 어긋났던 것을 closeSurface / closePane 두 줄로 분리해 i18n 4개 로케일 (en/ko/ja/zh) 모두 수정. 구현: src/renderer/hooks/useKeyboard.ts, src/renderer/components/Pane/SurfaceTabs.tsx, src/renderer/components/Settings/SettingsPanel.tsx.
Reconnect 후 출력이 두 줄로 중복되던 문제 — pty.handler.ts 의 PTY_CREATE 와 PTY_RECONNECT 가 매번 새 daemonClient.on('session:data', listener) 를 등록하면서 이전 listener 를 떼지 않아 누적됐다. 한 세션을 reconnect 한번만 해도 두 listener 가 같은 chunk 를 두 번 forward 해 renderer xterm 에 중복 출력. per-session listener map 으로 분리하여 같은 ptyId 의 이전 listener 를 항상 정리한 뒤에만 새 listener 등록. 구현: src/main/ipc/handlers/pty.handler.ts.
StateWriter.load 가 7 일 이상 묵힌 suspended 세션을 prune 한다. 추가 액션 불필요. v2.8.0 에서 이미 brick 된 사용자도 업그레이드 후 첫 실행에서 정상 복구된다 (alphabeen 이 가이드한 수동 sessions.json/daemon-pipe/daemon.lock/daemon.pid 삭제 절차는 더 이상 필요 없음).External Tooling Surface + Cross-Pane Search
외부 AI 도구(Claude Code, 서드파티 MCP)가 wmux 위에 워크플로우를 빌드할 수 있도록 세 개의 신규 surface를 동시 도입한 minor 릴리스다. @alphabeen 의 RFC #15 가 직접적인 트리거이며, 그 결과로 (1) pane 단위 metadata API, (2) cursor 기반 JSON-RPC event bus, (3) cross-pane search 가 묶음으로 들어온다. 모든 신규 필드는 optional 이라 기존 클라이언트는 영향 없으며, system.capabilities().features 의 새 키 (paneMetadata, events) 로 신규 표면을 감지할 수 있다.
릴리스 본문이 큰 만큼 데이터 마이그레이션은 없다. 다만 외부 MCP 통합 코드를 작성한 사람은 "Migration Notes" 의 bootId / asOfSeq 항목을 한 번 읽고 캐시 무효화 경로를 확인할 것.
Pane metadata API — #16. PaneLeaf 에 optional PaneMetadata { label?, role?, status?, custom?: Record<string,string>, updatedAt? } 부착. RPC 3 개 (pane.setMetadata/getMetadata/clearMetadata) + MCP tool 2 개 (pane_set_metadata, pane_get_metadata). 8 KB 직렬화 캡, label ≤ 64, role ≤ 64, status ≤ 128, custom ≤ 32 entries × 64-char keys. 외부 MCP 의 cross-workspace 하이재킹은 workspaceId 자동 스코프 + slice 레벨 검증으로 차단 (v2.7.2 mcp.claimWorkspace fix 와 같은 클래스 패턴). custom 맵은 merge=true 일 때 1 단계 deep-merge — 협력하는 두 MCP 가 서로의 키를 덮어쓰지 않는다.
구현: src/shared/types.ts, src/shared/rpc.ts, src/main/pipe/handlers/pane.rpc.ts, src/renderer/stores/slices/paneSlice.ts, src/renderer/hooks/useRpcBridge.ts, src/mcp/index.ts.
JSON-RPC event bus — #21 (resubmit of #17, base-deleted artifact). WmuxEventType union: pane.created / pane.closed / pane.focused / pane.metadata.changed / workspace.metadata.changed / process.started / process.exited. In-memory ring (1024 events) + monotonic seq cursor. RPC events.poll({cursor, types?, workspaceId?, max?}) + MCP tool wmux_events_poll. 외부 도구는 자기 워크스페이스 이벤트만 자동 스코프. bootId (UUIDv4 / EventBus 인스턴스마다 변경) 가 events.poll / system.capabilities / pane.list 응답에 모두 노출되어 데몬 재시작 시 클라이언트 캐시(pane id, pty id, cursor) 를 깨끗이 무효화할 수 있다. pane.list 는 envelope {asOfSeq, bootId, panes} 로 변경되어 resync 후 reconcile 의 frame of reference 를 명확히 한다. polling 만 — push/SSE 는 stdio MCP transport 와 안 맞아 deferred.
구현: src/shared/events.ts, src/main/events/EventBus.ts, src/main/pipe/handlers/events.rpc.ts, src/renderer/events/publisher.ts, src/renderer/stores/slices/searchSlice.ts.
Cross-pane search — #20. wmux 의 첫 cross-pane primitive. Ctrl+F 의 "All Panes" 토글로 현재 워크스페이스 모든 live pane 의 xterm.js 버퍼를 on-demand grep 한다. 결과 ≤ 10 개는 search bar dropdown, > 10 개는 하단 panel 자동 확장 (progressive disclosure UX with hysteresis: open at > 10, close at ≤ 5, sticky bit until session reset). 결과 클릭 → 해당 pane focus + scrollToLine(physicalBaseY) 로 wrapped line 까지 정확히 jump. regex 모드 + 잘못된 패턴 visual error (red border + tooltip, no toast). MCP tool wmux_search_panes(query, regex?) 로 외부 AI 도 자율 추론 가능 ("JWT 에러 단 pane" 같은). 200-result cap, 20k lines/pane scan cap, 500-char line truncation. cross-workspace 검색은 v2 deferred (RPC-layer caller-identity gate 추가 설계 필요).
구현: src/renderer/utils/searchEngine.ts, src/renderer/components/Terminal/SearchBar.tsx, src/renderer/components/Search/SearchResultsPanel.tsx, src/renderer/stores/slices/searchSlice.ts, src/mcp/index.ts. i18n: en/ko/ja/zh 4 locale 모두 신규 키 추가.
pane.list 응답 형태 — PaneListEntry[] → {asOfSeq: number, bootId: string, panes: PaneListEntry[]} envelope. resync 시 클라이언트가 "이 스냅샷 이후 events" 를 정확히 결정할 수 있다. panes[] 는 기존 키 그대로 + 새 metadata?: PaneMetadata 필드 추가. 기존 클라이언트는 envelope unwrap 후 .panes 만 사용하면 되며, metadata 는 optional 이라 무시해도 됨.
system.capabilities 응답 확장 — methods: RpcMethod[] 만 있던 응답에 features: { paneMetadata: true, events: { types, maxRingSize, bootId } } 추가. 기존 methods 배열은 변경 없이 신규 method 들이 자동 추가된다 ('pane.setMetadata', 'pane.getMetadata', 'pane.clearMetadata', 'pane.search', 'events.poll').
workspaceId 를 우선 사용하고 fallback 으로만 active workspace 를 쓴다. 외부 MCP 가 자기 ws 컨텍스트로 검색 호출 시, 사용자가 다른 ws 를 보고 있어도 caller 의 ws 결과만 받는다. v2.7.2 mcp.claimWorkspace fix 와 동일 클래스의 보안 게이트.pane.setMetadata / pane.clearMetadata 도 workspaceId 스코프 강제. 외부 MCP 가 사용자 보는 ws 에 임의 metadata 작성 불가.isVisible useEffect 와 document.fonts.ready 콜백 두 곳에 누락돼 워크스페이스 전환 직후나 폰트 로드 직후 selection 이 wipe 되던 문제. 또 selection 후 명시적 Ctrl+C 사이에 PTY 출력으로 selection 이 자연 클리어되어 SIGINT 가 가던 문제. fix: 두 가드 추가 + terminal.onSelectionChange 기반 자동 복사 (150 ms debounce, main-IPC 경유로 1 MB cap·Win32 lock retry·error toast 모두 보존). 해당 layer 9 unit tests 추가.
구현: src/renderer/hooks/useTerminal.ts, src/renderer/utils/autoSelectionCopy.ts (신규).wmux_search_panes / wmux_events_poll / pane_get_metadata 등 신규 도구를 즉시 사용할 수 있다. 신규 surface 감지는 system.capabilities().features.paneMetadata 와 features.events 키로.pane.list 호출자 는 응답이 envelope 으로 바뀐 점을 반영해야 한다. 기존 코드가 panes[0].id 처럼 직접 인덱싱했다면 result.panes[0].id 로. 단, MCP pane_list tool 은 envelope 그대로 반환하므로 AI 에이전트는 자연어로 처리 가능.bootId 를 비교하고, 변경됐다면 cached pane id / pty id / cursor 를 모두 폐기하고 pane.list 로 reconcile. cursor > latestSeq() 또는 resync: true 도 동일하게 처리.다음 항목들은 본 릴리스 범위 밖으로 명시 deferred — 트래킹 #18 :
expectedVersion) on meta.set — 다중 도구 contention 시 last-writer-wins 를 깨끗이 분리Terminal Stability (4-bug Fix)
v2.7.0 의 UI 확장 후 누적된 터미널 안정성 4 건을 묶은 patch. 모두 사용자 가시 회귀라 우선 ship. 데이터 마이그레이션 없음.
PTYBridge.ts onData 에 8 ms micro-batch 도입. OscParser.ts 가 slice 기반(O(n²) → O(n)). ActivityMonitor.ts 가 100 ms 타임스탬프 가드.useTerminal.ts 의 Ctrl+V / Ctrl+Shift+V 핸들러에 4096 청킹 추가 (우클릭 path 와 동일). pty.handler.ts 100 K silent drop backstop 은 유지하되 console.warn 추가.clipboard.handler.ts silent return 3 건을 typed throw (CLIPBOARD_INVALID_TYPE / CLIPBOARD_TOO_LARGE / CLIPBOARD_WRITE_FAILED) 로 변환. 4 호출부 (useTerminal ×3 + Terminal.tsx) 가 await + try/catch, 실패 시 selection 유지 + showCopyErrorToast (i18n 4 locale).useTerminal.ts ResizeObserver / font-theme effect 에 hasSelection() 가드 + windowsPty: { backend: 'conpty', buildNumber: 21376 } 옵션으로 ConPTY reflow 활성화 (xterm.js 6 의 SelectionService unconditional clear 우회).IPC.CLIPBOARD_WRITE invoke 가 실패 시 throw — renderer 는 await + try/catch 필수.IPC.PTY_DATA 송신 빈도가 청크 단위 → 8 ms batch 단위 (데이터 내용 / 순서 동일).IPC.PTY_WRITE 100K 초과 silent drop backstop 은 유지 — renderer 가 청킹으로 회피해야 함.스키마 변경 없음. clipboardAPI.writeText 를 호출하는 신규 코드는 await + try/catch 필수.
A2A Execute Approval Gate
외부 MCP 호출자가 a2a_task_send 의 execute:true 한 줄로 사용자의
워크스페이스에서 --permission-mode bypassPermissions 모드의 Claude
CLI 를 무인 실행할 수 있던 표면을 차단한 보안 patch. 단일 항목이지만
RCE 급 표면이라 즉시 출하한다. 데이터 마이그레이션 없음.
execute:true 사용자 승인 게이트 — 1cd5ab3. 신규 task 가
execute:true 로 들어오면 ClaudeWorker spawn 직전에 사용자에게
확인 다이얼로그를 띄운다 — 발신/수신 워크스페이스, 작업 cwd, 메시지
500 자 미리보기, 30 초 자동 거부 카운트다운. 거부 또는 타임아웃 시
task 가 canceled 로 마크되어 발신자가 a2a_task_query 로 거부를
확인할 수 있다. cancelTask 권한이 발신자에서 발신자/수신자로
완화돼, 수신자가 들어오는 task 를 deny 할 수 있다.
구현: src/main/pipe/handlers/a2a.rpc.ts,
src/main/pipe/handlers/_bridge.ts,
src/renderer/components/A2a/ExecuteApprovalDialog.tsx,
src/renderer/utils/executeApproval.ts,
src/renderer/hooks/useRpcBridge.ts,
src/renderer/stores/slices/a2aSlice.ts.스키마 변경 없음. 자동 마이그레이션 없음. execute:true 를 사용하는
기존 자동화는 이제 사람의 승인 없이는 실행되지 않으므로, 신뢰된
caller 가 무인 실행을 기대했다면 향후 도입될 autoApproveExecute
설정 토글을 기다리거나 execute 없이 호출하도록 조정한다.
Stability & MCP Hardening
v2.7.1 이후 누적된 안정성·보안 하드닝을 묶은 patch 릴리스다. 신규 사용자 대상 UI 기능은 없고, 데이터 마이그레이션도 필요 없다. MCP 통합을 사용하는 외부 클라이언트는 워크스페이스 점유 동작이 바뀌었으니 "Changed" 항목을 한 번 확인할 것.
src/daemon/SessionManager.ts, src/daemon/PtySupervisor.ts.mcp__wmux__browser_*
툴 호출 후 CDP 세션이 detach 되지 않아 장시간 사용 시 RAM 이 단조
증가하던 문제. 페이지 lifecycle 에 detach 를 묶었다.
구현: src/main/browser/PlaywrightEngine.ts.$LASTEXITCODE 폴백을 추가했다.
구현: src/main/pty/shell-hooks/pwsh.ps1.src/renderer/store/uiSlice.ts.src/renderer/hooks/useTerminal.ts,
src/main/clipboard/ImagePaste.ts.fs.writeFile), A2A CR/LF/ANSI 인젝션
(safeName/safeBody 가 ESC CSI 와 개행을 strip), StateWriter
saveImmediate race(immediateEpoch 스냅샷 보존), Squirrel 설치 파일명
pin (wmux-{version}.Setup.exe) 등.
구현: src/company/core/SoulLoader.ts,
src/main/a2a/envelope.ts, src/daemon/StateWriter.ts,
forge.config.ts.window.electronAPI.fs 가 옵셔널인데 가드
없이 접근하던 부분으로 strict TS 체크가 깨져 CI 가 레드였던 문제.
fs 가 없으면 false 를 반환하도록 정리.
구현: src/company/core/SoulLoader.ts.mcp.claimWorkspace).
다중 MCP 클라이언트가 한 wmux 인스턴스에 붙는 시나리오에서 키 입력
충돌을 제거한다. 기존 클라이언트는 자동 폴백.
구현: src/mcp/server.ts, src/daemon/WorkspaceClaim.ts.src/main/pty/envFilter.ts,
src/main/browser/exportPaths.ts.cmux for Windows 포지셔닝 강화, 설치 가이드에
winget·choco 명령 추가 (0fbbe43, 5f89c0e).스키마 변경 없음. 자동 마이그레이션도 필요 없다. MCP 통합을 사용하는 외부 클라이언트만 워크스페이스 점유 동작 변화를 확인할 것.
Constrained Language Mode Hotfix
PowerShell Constrained Language Mode (AppLocker / WDAC가 적용된 회사·학교 PC)
환경에서 v2.7.0 사용 시 사용자 지정 키 처리기에서 예외가 발생했습니다
오류가 매 Enter / 매 prompt 렌더마다 발생하던 회귀를 수정한다. 다른
변경 사항은 없으며 데이터 마이그레이션도 필요 없다.
Set-PSReadLineKeyHandler의
Enter 핸들러가 [Microsoft.PowerShell.PSConsoleReadLine]::AcceptLine() /
[Console]::Write()를 호출하던 부분이 Constrained Mode에서 메서드 호출
금지 정책에 걸려 PSReadLine이 매 키스트로크마다 예외를 노출했다. 이제
init 스크립트가 시작 시 $ExecutionContext.SessionState.LanguageMode를
검사해 FullLanguage가 아니면 통합 자체를 건너뛰고, 핸들러 본문도
try/catch로 감싸 런타임 실패 시 plain AcceptLine으로 폴백한다.
구현: src/daemon/shell-integration.ts, INTEGRATION_VERSION 1 → 2로
bump하여 디스크에 캐시된 옛 스크립트가 자동으로 재생성된다.[System.Net.Dns]::GetHostName()
과 [Console]::Write()가 Constrained Mode에서 매 prompt 렌더 시 예외를
던지던 문제. 이제 LanguageMode 게이트 + try/catch + $env:COMPUTERNAME
치환으로 안전하다.
구현: src/main/pty/shell-hooks/pwsh.ps1.src/renderer/hooks/useTerminal.ts,
src/renderer/components/Terminal/ContextMenu.tsx.companySlice에 taskHistory / waitGraph /
createCompany의 workDir 누락, IPC.FS_WRITE_FILE 상수 미정의,
OnboardingOverlay의 옛 필드명 참조 등 27건의 TypeScript 오류를 해결해
PR CI가 다시 녹색이 된다. 런타임 동작 변화는 없다.Terminal UX Expansion
Terminal 사용성에 집중한 피처 릴리스다. 데몬/세션 영속성 계층 변경은 없으며, 업그레이드 시 추가 조치는 필요 없다. 키 바인딩 기본값이 추가·변경되었으므로 기존 커스텀 바인딩과 충돌이 없는지 한 번 확인해 두면 좋다.
src/renderer/components/Terminal/FloatingPane.tsx, uiSlice의
floatingPaneVisible/floatingPanePtyId.src/renderer/components/Terminal/ContextMenu.tsx.BookmarkIndicator.tsx, paneSlice의 bookmarks 필드.Ctrl + <prefix key> 입력 후 다음 단일 키로 동작을
발동. 분할(가로/세로), 팬 닫기, 워크스페이스 순회, 포커스 이동, 팔레트 호출,
플로팅 팬 토글 등 13종의 액션을 제공하며 사용자 바인딩 커스터마이즈 및 기본값
초기화 지원.
구현: useKeyboard.ts, SettingsPanel prefix 섹션, uiSlice prefix 상태.CommandPalette, workspaceSlice / paneSlice.SearchAddon의 regex 옵션 전달.@xterm/addon-unicode11 추가 후
terminal.unicode.activeVersion = '11' 활성화. CJK/이모지 width 산정을 v11 기준으로
맞춰 TUI 앱(특히 Claude Code)의 cursor positioning과 한글 glyph 폭이 일치한다.useTerminal hook — scrollback 복원·컨텍스트 메뉴 이벤트·right-click paste
fallback 경로가 정리되었고, WebGL 컨텍스트 수명관리(가시성 기반 dispose/reload)
로직이 명확해졌다.window.electronAPI.shell.openExternal / 클립보드 IPC 노출 경로가
컨텍스트 메뉴와 링크 오픈 플로우에 맞춰 소폭 확장되었다.스키마 변경은 없다. 기존 데이터·세션·워크스페이스는 그대로 로드된다. 기본 prefix 키는 비활성 상태로 출발하므로 사용자가 활성화하기 전까지는 기존 단축키 동작에 영향이 없다.
Stability & Persistence Hardening
이번 릴리스는 daemon 안정성과 세션 영속성을 강화하는 방어·복원 작업이다. 사용자 데이터 파일 포맷 자체는 동일하되, 저장 경로와 에러 처리에 내부 변화가 있다. 업그레이드 시 추가로 할 일은 없다. 자동 마이그레이션으로 처리된다.
src/daemon/util/atomicWrite/ — 공통 atomic-write 모듈. tmp→bak→rename 순서와
__proto__/constructor/prototype sanitizer를 한 곳에서 관리한다. SessionManager와
StateWriter의 중복 구현이 이 모듈로 통합된다.src/daemon/util/AsyncQueue.ts — 30~50줄 수준의 자체 Promise 큐. saveDebounced
경로에서 concurrent write 경합을 제거한다. flushSync() 메서드로 종료 시점의
synchronous drain을 보장한다.src/main/ipc/wrapHandler.ts — ipcMain.handle 전용 래퍼. 핸들러 예외를
구조화 JSON 로그({ts, level, event, channel, error_code, stack})로 메인 프로세스
stderr에 기록하고, 에러에 code 속성을 부여한다..bak rotation chain — save 성공 시 .bak.2→.bak.3, .bak.1→.bak.2, .bak→.bak.1
rename 체인이 실행되어 최근 3개 스냅샷이 유지된다. 읽기 경로는
primary → .bak → .bak.1 → .bak.2 → .bak.3 순서로 fallback한다.src/daemon/migrations/. load 시점에 스키마 버전을
확인하고 메모리에서만 체이닝 변환한다. 새 포맷 기록은 다음 save에서 이루어진다.
프로덕션 레지스트리는 CURRENT_VERSION=1로 identity 유지 상태다.{userData}/corrupted/ 서브디렉토리로
이동하고 CORRUPT_FILE 이벤트를 JSON 로그로 남긴다. 30일 경과 또는 10개 초과 시
오래된 격리 파일이 자동 정리된다.{basename}.v{N}.premigrate.bak로 일회성 보존한다. 롤백 자료로 사용된다.code 속성이 붙는다. 사용 가능한 코드는
DAEMON_DISCONNECTED, VALIDATION_ERROR, NOT_FOUND, PERMISSION_DENIED,
UNKNOWN이다. renderer 호출부의 응답 값 자체는 그대로 raw value를 반환한다
(정규화는 후속 작업인 T4 useIpc 훅에서 수용 예정).StateWriter와 SessionManager의 내부 구조 — atomic-write 중복 경로를 공통
모듈 호출로 치환했다. 외부 API 시그니처는 변경 없다. saveImmediate는 기존 동기
시그니처를 유지한다(shutdown/suspend emergency sync 경로 호환).^sessions\.json\.bak(\.[123])?$ 패턴에 한정된다.
corrupted/ 디렉토리와 *.premigrate.bak 파일은 rotation 대상에서 제외된다.wrapHandler가 전 핸들러
공통 try/catch 경로로 흡수하고 stderr JSON 로그로 기록한다.사용자 데이터 손실은 발생하지 않는다. 업그레이드 절차에서 수동 작업은 없다.
다만 {userData} 디렉토리 내부에 다음 두 종류의 새 경로가 등장한다.
{userData}/corrupted/ — validate 실패로 격리된 파일의 보관소. 30일 경과 또는
10개 초과 시 자동 정리된다.{basename}.premigrate.bak — 스키마 업그레이드 load 시점에 생성되는 원본
스냅샷. 자동 정리 대상이 아니다. 수동 삭제 가능(향후 릴리스에서 자동 정리 검토).플랫폼별 {userData} 경로와 롤백 절차는
docs/upgrade-2026-04-17.md를 참고한다.