Skip to content

cmux

v0.64.13 Feature

This release adds 3 notable features for engineering teams evaluating rollout.

Published 1mo CLI & Terminal
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

amp claude-code cli codex coding-agents gemini
+11 more
ghostty macos multiplexer multitasking opencode organization parallel-agents programmability terminal-multiplexer tmux workspace-manager

Affected surfaces

crypto_tls

ReleasePort's take

Moderate signal
editorial:auto 1mo

The release hardens production security headers in the web component and fixes several critical bugs across CLI, settings, macOS agent, SSH file browser, terminal UI, keyboard shortcuts, and binary execution.

Why it matters: Hardened web security headers mitigate header‑related attacks; a bug causing heap growth to 4.4 GB over ~23 hours is resolved (severity 60).

Summary

AI summary

Web APNs backend hardening, Sparkle self‑update refactor into CmuxUpdater (WIP), and modular markdown viewer file watcher extraction.

Changes in this release

Security High

Hardens production security headers in the web component.

Hardens production security headers in the web component.

Source: llm_adapter@2026-06-04

Confidence: high

Feature Medium

Adds SSH agent forwarding support for cmux ssh.

Adds SSH agent forwarding support for cmux ssh.

Source: llm_adapter@2026-06-04

Confidence: high

Feature Medium

Adds browser focus mode.

Adds browser focus mode.

Source: llm_adapter@2026-06-04

Confidence: high

Feature Medium

Adds Open Current Directory in Devin Command.

Adds Open Current Directory in Devin Command.

Source: llm_adapter@2026-06-04

Confidence: high

Bugfix Medium

Fixes leaked settings observation tasks that caused heap growth to 4.4 GB over ~23 hours.

Fixes leaked settings observation tasks that caused heap growth to 4.4 GB over ~23 hours.

Source: llm_adapter@2026-06-04

Confidence: high

Bugfix Medium

Fixes macOS “access data from other apps” prompt on agent session start/quit.

Fixes macOS “access data from other apps” prompt on agent session start/quit.

Source: llm_adapter@2026-06-04

Confidence: high

Bugfix Medium

Fixes remote SSH file browser opening.

Fixes remote SSH file browser opening.

Source: llm_adapter@2026-06-04

Confidence: high

Bugfix Medium

Fixes terminal selection mouse‑up with find overlay.

Fixes terminal selection mouse‑up with find overlay.

Source: llm_adapter@2026-06-04

Confidence: high

Bugfix Medium

Fixes printable Option key shortcut routing.

Fixes printable Option key shortcut routing.

Source: llm_adapter@2026-06-04

Confidence: high

Bugfix Medium

Fixes cmux launching under Rosetta on Apple Silicon.

Fixes cmux launching under Rosetta on Apple Silicon.

Source: llm_adapter@2026-06-04

Confidence: high

Full changelog

What's Changed

  • Add browser focus mode by @lawrencecchen in https://github.com/manaflow-ai/cmux/pull/4573
  • Fix Claude hook transcript scaling and Sparkle update packaging by @lawrencecchen in https://github.com/manaflow-ai/cmux/pull/5202
  • Tighten localization audit instructions by @lawrencecchen in https://github.com/manaflow-ai/cmux/pull/5217
  • Support browser mouse back and forward buttons by @lawrencecchen in https://github.com/manaflow-ai/cmux/pull/5197
  • Mark markdown-viewer bundles as vendored/generated for Linguist by @lawrencecchen in https://github.com/manaflow-ai/cmux/pull/5212
  • Reject workspace socket window alias params by @lawrencecchen in https://github.com/manaflow-ai/cmux/pull/5195
  • Markdown viewer: font-size popover controls by @lawrencecchen in https://github.com/manaflow-ai/cmux/pull/5168
  • Revert terminal text context menu by @azooz2003-bit in https://github.com/manaflow-ai/cmux/pull/5230
  • Organize extension SDK boundaries by @azooz2003-bit in https://github.com/manaflow-ai/cmux/pull/5085
  • Refactor: extract Sparkle self-update into CmuxUpdater package (WIP) by @azooz2003-bit in https://github.com/manaflow-ai/cmux/pull/5132
  • Inject FocusLogStore instead of a shared singleton by @azooz2003-bit in https://github.com/manaflow-ai/cmux/pull/5239
  • Isolate browser WebKit process pools by @lawrencecchen in https://github.com/manaflow-ai/cmux/pull/4987
  • Share bounded transcript tail reads across agent hooks by @lawrencecchen in https://github.com/manaflow-ai/cmux/pull/5218
  • Fix file-editor arrow-key navigation and add a word-wrap setting (#5227) by @austinywang in https://github.com/manaflow-ai/cmux/pull/5247
  • Fix workspace-group "Delete Group" context-menu no-op by @austinywang in https://github.com/manaflow-ai/cmux/pull/5253
  • Web: APNs push notification backend hardening by @lawrencecchen in https://github.com/manaflow-ai/cmux/pull/5215
  • Render diff viewer empty state instead of raw error (issue #5246) by @austinywang in https://github.com/manaflow-ai/cmux/pull/5252
  • Open group config in the user's configured editor by @austinywang in https://github.com/manaflow-ai/cmux/pull/5250
  • Move v2 read-text scrollback work off main actor by @azooz2003-bit in https://github.com/manaflow-ai/cmux/pull/5243
  • Fix Claude workflow resume transcript resolution by @azooz2003-bit in https://github.com/manaflow-ai/cmux/pull/5242
  • Fix remote SSH file browser opening by @azooz2003-bit in https://github.com/manaflow-ai/cmux/pull/5241
  • Fix tagged sidebar extension discovery by @azooz2003-bit in https://github.com/manaflow-ai/cmux/pull/5267
  • Extract CmuxFileWatch and consolidate file watchers (modular refactor, wave 2) by @azooz2003-bit in https://github.com/manaflow-ai/cmux/pull/5244
  • Fix browser address bar: single click places caret instead of selecting all (#5268) by @austinywang in https://github.com/manaflow-ai/cmux/pull/5270
  • Fix #5255: shared markdown/file-preview text editor hang (force TextKit 1) by @austinywang in https://github.com/manaflow-ai/cmux/pull/5257
  • Fix macOS "access data from other apps" prompt on agent session start/quit (#5146) by @austinywang in https://github.com/manaflow-ai/cmux/pull/5176
  • Fix Codex auto-resume emitting invalid -s disabled (#5262) by @austinywang in https://github.com/manaflow-ai/cmux/pull/5276
  • Vibe-codable custom sidebars (runtime Swift interpreter), behind a beta flag by @azooz2003-bit in https://github.com/manaflow-ai/cmux/pull/5254
  • Fix copy-mode vim keys swallowed under non-ASCII input sources (Korean, Japanese Kana, Zhuyin) by @pstanton237 in https://github.com/manaflow-ai/cmux/pull/5292
  • Fix #5269: recover terminal focus when first responder is stranded in another window by @lawrencecchen in https://github.com/manaflow-ai/cmux/pull/5296
  • Add Open Current Directory in Devin Command by @MaxiAschenbrenner in https://github.com/manaflow-ai/cmux/pull/5288
  • Fix stale sidebar git branch after cd out of a repo into a non-git dir by @austinywang in https://github.com/manaflow-ai/cmux/pull/5279
  • Web: send APNs host groups concurrently by @lawrencecchen in https://github.com/manaflow-ai/cmux/pull/5258
  • Fix #5302: leaked settings observation tasks grow heap to 4.4 GB over ~23h by @austinywang in https://github.com/manaflow-ai/cmux/pull/5310
  • Add SSH agent forwarding support for cmux ssh by @austinywang in https://github.com/manaflow-ai/cmux/pull/5301
  • Fix restored cwd bindings after reboot by @austinywang in https://github.com/manaflow-ai/cmux/pull/5307
  • Anchor textbox autocomplete to the cursor by @lawrencecchen in https://github.com/manaflow-ai/cmux/pull/5021
  • Showcase awesome-cmux projects on community page by @lawrencecchen in https://github.com/manaflow-ai/cmux/pull/4905
  • Fix TextBox teardown crash when toggling sidebar background by @austinywang in https://github.com/manaflow-ai/cmux/pull/5317
  • [codex] Fix nonblocking workspace close teardown by @azooz2003-bit in https://github.com/manaflow-ai/cmux/pull/5316
  • Fix #5303: stop browser pane re-running one-time setup on every CoreAnimation commit by @austinywang in https://github.com/manaflow-ai/cmux/pull/5311
  • web: download confirmation page + shared same-tab download CTA by @austinywang in https://github.com/manaflow-ai/cmux/pull/5319
  • Add brand assets page by @lawrencecchen in https://github.com/manaflow-ai/cmux/pull/5256
  • Web: harden production security headers by @lawrencecchen in https://github.com/manaflow-ai/cmux/pull/5334
  • Add CLI validation and reload for custom sidebars by @lawrencecchen in https://github.com/manaflow-ai/cmux/pull/5327
  • Fix WebKit post-wake crash: sleep/wake-aware hidden-webview discard scheduling by @azooz2003-bit in https://github.com/manaflow-ai/cmux/pull/5315
  • Fix terminal selection mouse-up with find overlay by @lawrencecchen in https://github.com/manaflow-ai/cmux/pull/5335
  • Fix TextBox IME and input-source handling by @lawrencecchen in https://github.com/manaflow-ai/cmux/pull/5340
  • Lazy load file explorer roots by @lawrencecchen in https://github.com/manaflow-ai/cmux/pull/5342
  • Fix agent session resume: cwd-drift + post-kill cwd, DRY resume engine, lifecycle/fork tests by @lawrencecchen in https://github.com/manaflow-ai/cmux/pull/5312
  • Fix session restore resuming agents in the wrong directory (drifted cwd) by @lawrencecchen in https://github.com/manaflow-ai/cmux/pull/5300
  • Tighten community project listing by @lawrencecchen in https://github.com/manaflow-ai/cmux/pull/5324
  • Add live status reporting to the Amp Neo session plugin by @HamptonMakes in https://github.com/manaflow-ai/cmux/pull/5235
  • Fix #753: stop cmux launching under Rosetta on Apple Silicon by @austinywang in https://github.com/manaflow-ai/cmux/pull/5306
  • Fix sidebar workspace frame collection virtualization by @austinywang in https://github.com/manaflow-ai/cmux/pull/5325
  • Fix terminal copy mode cursor navigation by @austinywang in https://github.com/manaflow-ai/cmux/pull/5328
  • Fix printable Option key shortcut routing by @austinywang in https://github.com/manaflow-ai/cmux/pull/3981
  • Make agent hook feed telemetry nonblocking by @lawrencecchen in https://github.com/manaflow-ai/cmux/pull/5320
  • Fix release appcast R2 upload: provide GH_TOKEN to gh release list by @austinywang in https://github.com/manaflow-ai/cmux/pull/5116
  • Release v0.64.13 by @austinywang in https://github.com/manaflow-ai/cmux/pull/5354
  • Respect transparent Ghostty backgrounds in browser blank tabs by @lawrencecchen in https://github.com/manaflow-ai/cmux/pull/5203
  • Revert "fix(release): set GH_TOKEN on appcast R2 upload step" by @austinywang in https://github.com/manaflow-ai/cmux/pull/5355

New Contributors

  • @MaxiAschenbrenner made their first contribution in https://github.com/manaflow-ai/cmux/pull/5288
  • @HamptonMakes made their first contribution in https://github.com/manaflow-ai/cmux/pull/5235

Full Changelog: https://github.com/manaflow-ai/cmux/compare/v0.64.12...v0.64.13

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track cmux

Get notified when new releases ship.

Sign up free

About cmux

Ghostty-based macOS terminal with vertical tabs and notifications for AI coding agents

All releases →

Related context

Earlier breaking changes

  • v0.64.15 Stop blocking merges in CodeRabbit (request_changes_workflow=false).

Beta — feedback welcome: [email protected]