changelog

What shipped.

mtmux is young and the version number says so. Releases are listed here when they are on npm — nothing is dated before it exists.

0.12.1current release on npm

fixA completed pairing says paired; only a socket that has actually arrived says connected. Both printed the same sentence, which made a normal reconnect prompt read as the machine approving things behind your back.

0.12.02026-09-23

fixThe routes that hand over files were the one way past the approval model. GET /file and GET /recording authenticated a token and then served bytes off the machine's disk without asking anybody — while the same token on the websocket put a question on the owner's screen. Both now cross the same gate.

breakAsking is the default everywhere, terminal or not. It used to depend on whether a terminal was attached, so a machine started by systemd or nohup trusted silently — the deployments least likely to be watched were the ones that quietly stopped asking. A headless machine can still be asked: mtmux approve in any other shell, or the app on a phone that is already connected.

breaktrust no longer covers a device the machine has never recorded. It is a reconnect policy, and nothing about a stolen token is a reconnect. It waives the question for devices on your own list and nothing else.

fixSigning in with a token no longer throws that token away because nobody has approved the connection yet. Being slow to reach the laptop used to mean going and finding the token again.

0.11.02026-09-23

newA valid token is no longer permission. Approval is asked per connection — loopback, LAN and tunnelled alike — not once per credential, and nothing about the machine is sent before the answer.

newOne answer covers a device while it stays connected and for two minutes after its last socket closes, so tabs and a reconnect on a train are one act of connecting rather than a prompt every few minutes.

newx in the live panel removes every device at once, in one question that names the count.

newThe panel says what the tunnel is doing — connecting, up, or down and retrying — instead of only whether it is up.

fix--confirm-reconnect and --trust-reconnect were parsed and then ignored; the stored policy decided every run whatever was typed.

fixA refusal no longer wipes a healthy pairing. The browser used to read any auth failure as “you have been forgotten” and send you back to pairing from scratch.

fixA spent code is replaced with a live QR rather than an offer to press a key nobody had been told about.

0.10.02026-09-22

newThe live panel carries the code that is claimable right now, so it survives the banner scrolling away.

newmtmux devices remove, which is what the panel’s r already called it. revoke stays as an alias.

fixNothing the panel draws can be wider than the terminal. The approval screen’s answer line used to wrap off the bottom of a short one — the line telling you how to say no.

fixTwo tabs of one browser are two rows again; both used to share a key, so every lookup matched the first.

fixA live local code is taken down when a tunnel opens, instead of staying claimable for 24 hours with nothing on screen showing it.

0.9.02026-09-22

newOne key gets rid of a device and means it: the credential dies, the socket closes, and it must pair again.

fixA removed device loses its tunnel keys, not just its token.

fixA new code no longer reprints the whole banner, and the log stopped repeating what the panel already shows.

0.8.02026-09-22

newSix digits to type in local mode, so “I cannot scan that” has an answer short of copying a 64-character token.

newEvery path asks before it lets a device in — scanning the QR on your own wifi included. A network is not a person.

newThe device list is every device this machine trusts, not only the connected ones, with e to rename and a to flip whether a known device is asked about.

newPress t in a running mtmux start to open the tunnel without restarting.

fixThe local pairing code has a guess budget, and the endpoint has the same per-address backoff as token auth.

fixThe offer is burned before the human is asked, not after — a correct code left live while a question sits on screen is a code an attacker can retry.

0.7.02026-09-20

newA live device panel in mtmux start: who is connected, what they may do, and the keys to act on them.

newRecording with mtmux record — asciinema v2 casts on your own disk, shareable as their own scope.

fixPeer-supplied names are stripped at every terminal render site, not only at ingress.

0.4.02026-09

newHosted pairing: mtmux opens a sealed tunnel and prints a QR and a pairing code, so a phone anywhere can attach without port forwarding.

newThe pairing handshake is a CPace PAKE over ristretto255. The broker routes on two digits and never receives the other four.

newSealed transport: HKDF-SHA256 key schedule, AES-256-GCM frames, per-direction nonces and a counter that rejects replays.

newDevice keys. A paired browser reconnects with a signed challenge, so the code is needed exactly once and mtmux devices can revoke it.

newOptional accounts via OAuth device authorization — mtmux login, whoami, servers — plus multi-server and the Pro plan.

newmtmux doctor, status and stop, and --local for a run that contacts no broker at all.

0.3.0pre-0.4.0 · current

newBinds the LAN by default when there is one, and prints a scannable sign-in code instead of asking you to copy a token.

newScoped session tokens and throttling on failed authentication in the relay.

fixWeb and relay are served from one port, with dev and production behaving the same way.

fixReconnect robustness, authenticated media requests, and sign-in via the URL fragment.

fixThe file browser now opens at the directory the relay actually allows, rather than failing at the root.

0.2.0pre-0.3.0

newThe mtmux CLI itself: one npm package that bundles the web client and the relay into a single process on one port.

fixSecurity and resource-lifecycle hardening in the relay, and a clean error when the port is already in use.

0.1.0pre-0.3.0 · first published release

newAttach to a running tmux server from a browser: real panes, scrollback, and a modifier row built for a phone.

newSession, window and pane management, a file browser, and a terminal view that survives reattaching.

Releases are published to GitHub and to npm. mtmux version prints what you have installed; upgrading is npm i -g mtmux like any other package.