Skip to content

ntm

v1.13.0 Breaking

This release includes breaking changes for platform teams planning a safe upgrade.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

ai-agents cli developer-tools go tmux

Affected surfaces

auth breaking_upgrade

Summary

AI summary

Broad release touches @Dicklesworthstone, Others, Bug Fixes, and Quick Install ```bash.

Full changelog

NTM v1.13.0

Named Tmux Manager - Orchestrate AI coding agents in tmux sessions with beautiful TUI interfaces.

Quick Install

# One-liner install (Linux/macOS)
curl -fsSL https://raw.githubusercontent.com/Dicklesworthstone/ntm/main/install.sh | bash

# Homebrew (macOS/Linux)
brew install dicklesworthstone/tap/ntm

# Go install
go install github.com/Dicklesworthstone/ntm/cmd/[email protected]

Shell Integration

Add to your shell rc file:

eval "$(ntm shell zsh)"   # for zsh
eval "$(ntm shell bash)"  # for bash
eval "$(ntm shell fish)"  # for fish

Changelog

Features

  • 111f10e636416dd20353c38d920fb852eae58d1f: feat(lifecycle): graceful goroutine shutdown across all subsystems, checkpoint restore via respawn-pane, test reliability improvements (@Dicklesworthstone)
  • 96df838688f0c29a5aff709317d3f853c0cda709: feat(scheduler): poll-based codex throttle gate for Acquire() (@Dicklesworthstone)

Bug Fixes

  • 5ba4dd1dfed53f1ba0cfc9655c75486a81892771: fix(agentmail): cap overseer response body at 10MB to prevent DoS/OOM (@Dicklesworthstone)
  • 4e8f935036a3d3591329888bb9b508408b1ed56b: fix(cli): bound response body reads with io.LimitReader (@Dicklesworthstone)
  • 7780d91a5e0a4546cf9db2670f56170e7e39e064: fix(cli): remove unused inProgress variable after stale-bead loop removal (@Dicklesworthstone)
  • 2a188ed80e3721facf48eb26dac031e1a32a3a81: fix(cli): use ResolveSessionWithOptions for JSON-aware session resolution and add input validation tests (@Dicklesworthstone)
  • dc891e6d93ab4638636d8405b8e6e57a6d8d325e: fix(concurrency): ScannerStore deep-cloning, executor snapshot race, and t.Parallel() removal across 90+ test files (@Dicklesworthstone)
  • 556c0ae52077a9fc3b0d1b96a5c2e43fa155a75e: fix(concurrency): remove t.Parallel() from 57 test files and fix three data races in production code (@Dicklesworthstone)
  • 46e42a4e0a5ed4c0f9a7b7e925dd6edf9c2fce27: fix(coordinator): add lifecycle mutex to serialize Start/Stop, eliminate shared ctx field race (@Dicklesworthstone)
  • 15379029e7405185e000aee6a6623ebd171b492e: fix(events): clear handler entry on unsubscribe to prevent closure memory leak (@Dicklesworthstone)
  • 1192ccce524ef9e1143f9aec0cbe29b58882171e: fix(http): cap HTTP JSON response bodies at 10 MiB with io.LimitReader (@Dicklesworthstone)
  • ff259a9a182870ff9e25d9365b273abc16cc6063: fix(lifecycle): add lifecycle mutex to resilience monitor, autoscanner, timeline lifecycle/persister, and supervisor to serialize Start/Stop (@Dicklesworthstone)
  • 86a9f4b0b53b7dd7ea4ab6ce13e5c43615167757: fix(lifecycle): add lifecycle mutex to serialize Start/Stop across all background subsystems, prevent concurrent lifecycle races (@Dicklesworthstone)
  • f3ac43841d16a21c2ad2f3b2922e50c7f3aa2fbf: fix(palette): use key.Matches for quit binding in edit phase instead of raw KeyCtrlC (@Dicklesworthstone)
  • 20cb58af7f31845e046da10cda43be75eb860894: fix(pipeline): surface failed-iteration errors from loops; persist parallel state outside global mutex (@Dicklesworthstone)
  • 408fa8e485fc0e5cb44390c62f067a39bf65bbda: fix(robot): thinking signals now outrank co-present idle-prompt patterns, preventing false WAITING classification (@Dicklesworthstone)
  • 17a87fb06ad1c11ec495c7be23478c592285a8ab: fix(scheduler): use a single ticker for worker periodic polling (@Dicklesworthstone)
  • 6090f1111ea233e18072e13e83404c68c719dda7: fix(serve): propagate auth claims through middleware and pick highest realm_access role (@Dicklesworthstone)
  • bd0f59cb9f657aeeb223e9b554fc2b767636cfce: fix(state): release read lock before invoking replay handler to prevent callback deadlocks (@Dicklesworthstone)
  • 382e42883324da4578ff2571737ca6445932480d: fix(swarm): log derived lastRotation instead of raw state field in cooldown warning (@Dicklesworthstone)
  • a94e68725654a64eb88a9ff6aa2473fd774745ce: fix(test): use DefaultModels() for ollama test case consistently (@Dicklesworthstone)

Others

  • b9437ec3d2b7480d907b38df23780b3044f20b7c: chore(beads): advance migration hint timestamp (@Dicklesworthstone)
  • 27bfa62647df621e01310bf64064abacd4ee3bfa: chore(beads): advance migration hint timestamp (@Dicklesworthstone)
  • b461889906281de131d69eb0865a14720ce87628: chore(beads): advance migration-hint-ts timestamp (@Dicklesworthstone)
  • 3a1f4210d3bb18df5ccb849339a055402d77520f: chore(beads): update migration hint timestamp (@Dicklesworthstone)
  • 8dcfb67fd8ee87ac6de519a50c0843d417fa6ebb: data(beads): bump migration hint timestamp (@Dicklesworthstone)
  • 5653d1ef69ca6dc7c3631d8a925b86612236138a: data: update beads migration timestamp after pull sync (@Dicklesworthstone)
  • b62cfbc1205d0a67d087d80d1da0b4ccb7f74138: feat(assign/effectiveness): rank against all supported agent types (@Dicklesworthstone)
  • 420584ccdd5df3fac67a820598b17204affa618b: feat(cli,serve,robot): remove stubs and unimplemented features, add truthfulness tests and rate-limit detection (@Dicklesworthstone)
  • 9199bbd0accfd41dea20cb73213a47ca3418f0c6: feat(robot,cli,serve): add dashboard alerts section, expand CLI/serve test coverage (@Dicklesworthstone)
  • fbcd2e7e50bd0842504d117038740828d976880b: feat(robot,serve): expose alert Source field in all output paths and upgrade redaction config to reader locks (@Dicklesworthstone)
  • 83ba973f23e3e5540e93e2555281f669b9d2aa5a: feat(scheduler,audit): typed cap waiters with reset abort, and audit DB connection hardening (@Dicklesworthstone)
  • b385436765b29f44cb9a5bf502f5626ae2f42d11: feat(serve,tmux,state): add tmux circuit breaker, session reconciliation, and server startup hardening (@Dicklesworthstone)
  • 76ee9ad46a956fb27a7e55639bfff20e6fbdf924: fix(assign/reservation): drop trailing boundary from path extraction regexes (@Dicklesworthstone)
  • 7977f988dcc3c61860963d13d5559c3e5a1b5c0f: fix(assign/test): expect 7 agent types in TestRankAgentsForTask ranking (@Dicklesworthstone)
  • f57638fdd9d665ea52a4ffdb12690b4acf3ef5d0: fix(bv/triage): use RWMutex and double-checked locking for triage cache (@Dicklesworthstone)
  • 8e4a0b4683249311bf64a172b9315a86e24187b0: fix(cli/test): remove duplicate TestResolveEnsembleSessionRejectsInvalidSessionName (@Dicklesworthstone)
  • 0c09978f2b2ad0092c0925f2399d17d11652f49f: fix(coordinator,robot): enforce directory boundary in wildcard glob matching and fix consecutive file path extraction regex overlap (@Dicklesworthstone)
  • 89f7fe537f96cd45644737adcc73652933c144c8: fix(events/logger): rotate event log without blocking concurrent writers or losing events (@Dicklesworthstone)
  • e00f4ee5d6cbd735456ef8e467e613ec5a1f35ab: fix(metrics/collector): emit ExportCSV rows in deterministic operation-name order (@Dicklesworthstone)
  • 28042ae5282235c0db76d380e1021ae6b324ab90: fix(quota,scoring): skip redundant status fetch when commands overlap, throttle score pruning to once per 24h (@Dicklesworthstone)
  • b5e7315a273108abfa71817c7c95fd34a26ae2cd: fix(serve,robot): session name validation, race-safe config endpoints, policy check error logging, and alert tracker cleanup (@Dicklesworthstone)
  • e04472ff01aab0811409c6d0f8d3e29622bd896c: fix(serve/checkpoints): stream checkpoint export bodies instead of buffering in memory (@Dicklesworthstone)
  • 53c70daae25d0a6ab7852eeadffd28c8781ebddc: fix(serve/test): align TestParseJWT variants with new 5-value parseJWT signature (@Dicklesworthstone)
  • f2567387e2711f9ad574cf424acf47043ed67b4e: fix(serve/test): seed robot-API contract state with wall-clock now instead of a frozen 2026-03-26 date (@Dicklesworthstone)
  • be31536bfc28375066024a9a343ecaf8b9fbcac5: fix(serve/test,tui/dashboard): align OIDC test harness with (claims, err) return + add missing io import (@Dicklesworthstone)
  • d7700b8fe4b7264f07cf0788491051abf404c2e5: fix(tmux,state): distinguish infrastructure errors from application errors in circuit breaker and skip reconciliation when breaker is open (@Dicklesworthstone)
  • 6021c8e40b3f764decc19eb8718bce332d1f84c5: fix(tui,tests): migrate deprecated viewport API and replace nil contexts across test suite (@Dicklesworthstone)
  • cdebcc2703788ab117c2888d57a216823b351c1c: perf(cli,context): hoist runtime regex compilation to package-level vars (@Dicklesworthstone)
  • 62654f3cbffa0e4ccaedad3bf69e4242057f6dba: refactor(robot): use global alert tracker from alerts package and add DashboardAlertsData type (@Dicklesworthstone)
  • ad7b1809ca98045940dd0d86efe7336cab59ce08: refactor(scheduler): simplify CancelSession/CancelBatch with single-pass retain pattern (@Dicklesworthstone)
  • 947fedc650809df01a479162dba8cb06cf68461a: test(assign/capability): extend TestDefaultCapabilities to cover all seven agent types (@Dicklesworthstone)
  • 8b69e32af0ce33aaf153f426a5cfdae269e0c21a: test(pipeline): add explicit RetryDelay to retry-policy tests to prevent slow execution (@Dicklesworthstone)
  • f2b440c4b4b1539a47e6d7adbf0b9a197a800671: test(robot): add validation contract tests for section schema compliance (bd-j9jo3.9.7) (@Dicklesworthstone)
  • e3d26d6db9f1156b64bc9f5cbbd8c0b3fb689149: test(serve/parity): seed RuntimeSession rows alongside Sessions for robot-API contract state (@Dicklesworthstone)

Full Changelog: https://github.com/Dicklesworthstone/ntm/compare/v1.12.1...v1.13.0

Container Image: ghcr.io/dicklesworthstone/ntm:v1.13.0

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track ntm

Get notified when new releases ship.

Sign up free

About ntm

Named Tmux Manager — spawn, tile, and coordinate multiple AI coding agents (Claude, Codex, Gemini) across tmux panes with a TUI command palette.

All releases →

Beta — feedback welcome: [email protected]