Skip to content

Wmux

v2.8.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo CLI & Terminal
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

agentic-ai ai-agent ai-agents ai-coding browser-automation claude
+12 more
claude-code coding-agent developer-tools electron gemini mcp-server multi-agent powershell terminal-multiplexer tmux tmux-alternative windows

Affected surfaces

auth rbac

Summary

AI summary

Broad release touches What's in, Stats, Migration Notes, and RPC.

Full changelog

External AI 도구 (Claude Code, third-party MCP) 가 wmux 위에 워크플로우를 빌드할 수 있도록 세 개 신규 surface 동시 도입한 minor 릴리스. @alphabeen 의 RFC #15 가 직접 트리거.

What's in

🧩 Pane Metadata API (#16)

PaneLeaf 에 optional {label, role, status, custom} 부착. 외부 MCP 가 pane 별로 워크플로우 상태 (예: "Backend (running-tests)") 를 적을 수 있음. 두 도구가 같은 custom 키를 따로 쓰면 deep-merge 로 충돌 회피.

  • RPC: pane.setMetadata / getMetadata / clearMetadata
  • MCP: pane_set_metadata, pane_get_metadata
  • 8 KB 직렬화 캡, label ≤ 64, role ≤ 64, status ≤ 128, custom ≤ 32 entries

🔔 JSON-RPC Event Bus (#21, originally #17)

1024-event ring + cursor-based polling. 외부 도구가 pane 생성 / 종료 / 포커스 변경, process 시작 / 종료, metadata 변경, workspace 상태 변경을 자율 구독 가능.

  • RPC: events.poll(cursor, types?, max?)
  • MCP: wmux_events_poll
  • bootId 로 데몬 재시작 시 클라이언트 캐시 깨끗 무효화
  • pane.list envelope 변경 → {asOfSeq, bootId, panes} (resync 후 reconcile 명확)

🔍 Cross-Pane Search (#20) — wmux 첫 cross-pane primitive

Ctrl+F → "All Panes" 토글 → 모든 live pane 한 번에 grep. 결과 ≤ 10 dropdown, > 10 progressive panel 자동 확장 (hysteresis + sticky bit). 클릭 → 해당 pane focus + scroll-to-line. regex 모드 + 잘못된 패턴 visual error.

  • RPC: pane.search
  • MCP: wmux_search_panes — AI 에이전트가 "JWT 에러 단 pane" 같은 자율 추론 가능
  • 200-result cap, 20k lines/pane scan cap, 500-char line truncation
  • v1 = 현재 워크스페이스만 (cross-ws v2 deferred)

🩹 Clipboard Fix (#19) — v2.7.4 잔존 버그

v2.7.4 의 selection-preserving fit 가드가 isVisible useEffect + document.fonts.ready 두 곳에 누락. PR #19 가 두 가드 추가 + selection 자동 복사 (150 ms debounce, main-IPC 경유로 size cap·lock retry·error toast 보존).

Security

  • Cross-workspace 누출 차단: pane.search / pane.setMetadata 핸들러가 caller workspaceId 우선 사용. 외부 MCP 가 자기 ws 만 검색·작성. v2.7.2 mcp.claimWorkspace fix 와 동일 클래스 패턴.

Migration Notes

  • 외부 MCP 통합 코드: 신규 surface 감지는 system.capabilities().features.{paneMetadata, events} 키로.
  • pane.list 호출자: 응답이 envelope {asOfSeq, bootId, panes} 로 변경. result.panes[0] 으로 인덱싱.
  • 이벤트 폴링 클라이언트: 매 응답의 bootId 비교, 변경 시 cached pane id / pty id / cursor 모두 폐기 + pane.list 로 reconcile.
  • 데이터 마이그레이션 없음. 모든 신규 필드 optional.

Tests

911 passing across 79 test files (이전 baseline 776 → +135). tsc + MCP build clean.

v2 deferred

Cross-workspace search/metadata, push/SSE event delivery, dead-session scrollback dump 검색, optimistic concurrency (expectedVersion) on meta.set. 트래킹 #18 .

Stats

  • 4 PRs merged today (#16, #19, #20, #21)
  • 14 commits beyond v2.7.4 baseline
  • ~3,800 lines added across feature code + tests + i18n
  • 1 fixed: terminal clipboard intermittent failure

🤖 Generated with Claude Code — team mode

What's Changed

  • fix(terminal): close remaining clipboard-copy gaps after v2.7.4 by @openwong2kim in https://github.com/openwong2kim/wmux/pull/19
  • feat(pane): optional pane metadata API for external tooling (PR 1/2) by @openwong2kim in https://github.com/openwong2kim/wmux/pull/16
  • feat(events): cursor-based JSON-RPC event bus (resubmit after #16 merged) by @openwong2kim in https://github.com/openwong2kim/wmux/pull/21
  • feat(search): cross-pane search with progressive disclosure UI + MCP tool by @openwong2kim in https://github.com/openwong2kim/wmux/pull/20

Full Changelog: https://github.com/openwong2kim/wmux/compare/v2.7.4...v2.8.0

Security Fixes

  • Enforced caller workspaceId in `pane.search` and `pane.setMetadata`, preventing cross‑workspace data leakage (mirroring the fix from v2.7.2).

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Wmux

Get notified when new releases ship.

Sign up free

Beta — feedback welcome: [email protected]