v0.2.26 — Desktop black-screen fix, Electron 43, faster terminals

Release date: 2026-07-03
Previous version: v0.2.25

TL;DR

v0.2.25 desktop builds could show a black window on launch — this release fixes that regression, so updating is strongly recommended. It also moves the desktop app to Electron 43 (Chromium 150 / Node 24), makes terminals noticeably snappier (keystroke echo, re-opening long sessions, initial page load), and clears all known npm audit vulnerabilities.

Highlights

Fixed: black screen on desktop app launch (v0.2.25 regression)

The v0.2.25 security hardening tightened CORS, but same-origin requests that carry an Origin header (the SPA's own script/style tags) were rejected with a 500 — the desktop app's dynamic port was not in the allowlist, so the UI assets never loaded and the window stayed black. The server now recognizes same-origin requests by matching the Origin header against the request host, which also covers LAN access on any port. Rejected cross-origin requests now simply omit CORS headers instead of failing the request.

Electron 43 upgrade

The desktop stack moves from Electron 33 (EOL) to Electron 43 — Chromium 150 and Node 24 — along with electron-builder 26 and rebuilt native modules (better-sqlite3, node-pty).

Faster terminals

• Keystroke latency: terminal input no longer performs a synchronous database lookup per keystroke; the PTY route is resolved from an in-memory cache.
• Re-opening sessions: terminal replay used to send one WebSocket frame per stored output row (tens of thousands for a long session). Rows are now coalesced into 256 KB frames — a 17k-row session replays in a handful of frames instead of 17k.
• Heavy output: the rolling output-history cap is now enforced every 256 KB instead of on every 100 ms flush, and trimming uses a single ranged delete — removing periodic event-loop stalls during large TUI redraws.

Faster initial load

The web UI's main bundle shrank from 4.1 MB to 1.6 MB (-60%). Analytics charts, the planner rich-text editor, the vault file viewer, and the task graph now load on first use of their tabs instead of up front.

Security

• npm audit vulnerabilities resolved: 15 → 0 (simple-git RCE, path-to-regexp ReDoS, express/qs DoS, and others).
• Google Fonts were unintentionally blocked by the v0.2.25 CSP; the intended fonts (Inter / JetBrains Mono) render again.

Install / Update

npm i -g [email protected]

Desktop app — pick the right asset:

• Windows (recommended): CLITrigger-Setup-0.2.26.exe — installer with Start Menu shortcut, uninstaller, and auto-update.
• Windows (portable): CLITrigger-0.2.26.exe — run directly, no install; no shortcuts and no auto-update (grab new versions manually).
• macOS: .dmg / Linux: .AppImage

Auto-update from v0.2.25 works once this release is published (installer builds only).

Full commit list

• 9b20e5d perf(app): 세션 replay 프레임 병합 + 번들 코드 스플리팅 + 중복 인덱스 제거
• 647cab4 perf(terminal): 키 입력·PTY flush 핫패스에서 동기 DB 작업 제거
• f89c70b docs(readme): 문서→계획→터미널→자동작업→형상관리 파이프라인 중심으로 재구성
• f5c7510 fix(server): same-origin 요청의 Origin 헤더가 CORS에서 거부돼 데스크톱 앱 검은 화면
• 07bbf32 fix(deps): npm audit 취약점 일괄 해소 (15개 → 0개)
• f03a127 chore(electron): Electron 33 → 43 스택 최신화

Related docs

• Detailed changelog — per-date technical decision records

Full Changelog: https://github.com/HyperAITeam/CLITrigger/compare/v0.2.25...v0.2.26