Everything that shipped.
Agent releases roll out automatically the moment they’re signed. Here’s what changed, newest first.
Every version, on record.
Local-first, credential-safe.
The desktop app now talks to the agent over a PIN-gated local WebSocket on :7684 with no round-trip to the relay when your machine is right there. And API keys never transit our infrastructure.
4 changes
Local-first, credential-safe.
The desktop app now talks to the agent over a PIN-gated local WebSocket on :7684 with no round-trip to the relay when your machine is right there. And API keys never transit our infrastructure.
Local WebSocket transport for the desktop app: direct, PIN-gated, sub-millisecond on the same machine.
Credential proxy: provider keys are brokered on-device; the relay and our servers never see them in any form.
Per-pair Phase-0 identity keys replace the legacy shared AES key for the handshake envelope.
Container attach no longer leaks a PTY when the last viewer disconnects mid-stream.
Hardened & ready to scale.
A pass of architecture hardening across the relay and agent boundary, plus the groundwork that keeps the stateless relay cheap as connection counts climb.
3 changes
Hardened & ready to scale.
A pass of architecture hardening across the relay and agent boundary, plus the groundwork that keeps the stateless relay cheap as connection counts climb.
Trust-boundary audit: every app-layer byte confirmed end-to-end encrypted with a session key the relay never holds.
Relay scalability: near-constant ~1KB of state per connection; no DB queries on the hot path.
Reconnect latency down to ~50–150ms on warm tunnels.
Clu, generally available.
The first stable release. One encrypted desktop across every machine you own: terminal, files, editor, containers and AI supervision, all E2E encrypted, for $5/month.
3 changes
Clu, generally available.
The first stable release. One encrypted desktop across every machine you own: terminal, files, editor, containers and AI supervision, all E2E encrypted, for $5/month.
Persistent tmux sessions with shared-PTY reference counting and on-attach pane replay.
X25519 ECDH + AES-256-GCM wire protocol with ephemeral per-session keys for forward secrecy.
Cross-device exec: run_on_device over relay WSS, with a feature-flagged direct UDP punch.
What we’re building next.
Updates land automatically.
Run cluterm update, or let the agent pull signed releases on its own.