No releases yet. Here's the honest ledger.

Unreleased candidate

in progress · the current release-candidate line

Everything between the v0.1.0 foundation and a public release lives here. Highlights, condensed:

Live terminal, end to end

• The browser attaches to real tmux sessions: PWA to a same-origin /ws gateway with one-time attach tickets and a single-controller lease, through the external cmuxd-remote sidecar, into tmux. Proven by live end-to-end tests against a real sidecar and real tmux.
• The npm tarball now includes the static browser app plus a hash-manifested macOS pane launcher, and a required smoke test installs that exact tarball into an empty prefix and drives login, real PTY input and output, resize, reload and reconnect, explicit kill, and full cleanup.

Hardening

• Hostile terminal-output policy: title, hyperlink, clipboard, and bell side effects are bounded or suppressed before the renderer sees output. Renderer code, types, and WASM are hash-pinned, and the browser queue fails visibly at fixed limits.
• Security headers on every daemon response, including CSP, nosniff, frame denial, opener and resource isolation policies, and no-store on API responses.
• Reconnects fail closed after eight full-jitter attempts. The disconnected input queue is bounded at 256 frames and 1 MiB, and controller-authority edge cases around takeover, revocation, and slow clients were reworked to fail closed.
• Fixed a tmux 3.4+ control-plane break, where modern tmux rewrote the adapter's field separator and collapsed every record. The parser now uses a separator tmux leaves intact, with a regression test.

Deliberate removals

• Transcript capture, persistence, search, purge, and notification surfaces are absent from the v0.1 product graph. Renderer scrollback is memory-only.
• Production mock fallback is gone. The browser shows explicit unavailable, auth, protocol, and tmux failure states instead of pretending.
• The old dangerous network-bind override was removed entirely; the daemon accepts literal 127.0.0.1 only.

Release engineering

• The real tarball is extracted and checked against an explicit file allowlist, with malicious fixtures for secrets, databases, logs, keys, local paths, symlinks, unsafe modes, and source maps.
• Each release build emits a license inventory, CycloneDX SBOM, in-toto provenance statement, checksums, and pinned OSV Scanner and gitleaks results.

v0.1.0 · Foundation

2026-06-17 · internal, never published

The pre-release foundation: control plane and UI complete, live terminal streaming not yet built.

• pnpm monorepo with the Next.js PWA shell, local daemon, and supporting packages: protocol, terminal client, terminal renderer, tmux adapter, CMUX adapter, auth, and CLI.
• Local daemon HTTP API for health, login and logout, device pairing and revocation, and tmux-backed workspace, tab, and pane management.
• Auth and hardening baseline: loopback bind by default, HS256 device tokens, timing-safe comparison, 0600 secret storage, rate limiting, and strict Host and Origin validation.
• tmux adapter using argv-only spawn with strict name and path validation, so user input is never shell-interpolated.
• VibeTunnel-compatible WS v3 protocol codec, typed browser client, and ghostty-web renderer adapter.
• Vitest unit and integration suites, Playwright end-to-end tests, protocol fuzzing, and a CI gate across platforms and Node versions.

What still blocks a public release

the project's own words, not ours

The README is blunt: the project is still not release-ready. The remaining gates are evidence work, not features:

• Clean-machine validation of the exact packaged candidate.
• Real-device mobile checks and real terminal-app compatibility, beyond emulated coverage.
• Private Tailscale Serve verification from a genuinely separate device.
• A consolidated model review plus an external human security review.
• Owner publication approval, which is withheld until the release checklist passes.

When those checks pass, this page will record public releases. Until then it remains a status report. The guide covers setup for readers who already have source access.