Baixar wmux 3.35.0 per a Windows

Security
- The wmux web page now ships a full Content-Security-Policy (#608). The page previously carried only frame protection. It now declares a strict policy — every inline script is allowed by its exact hash (no 'unsafe-inline'), and connect-src 'self' means that even if a rendering bug ever reintroduced an XSS, the injected script could execute but could not send the access token anywhere. The hashes are computed by the daemon from the exact page bytes it serves, so the policy can never drift out of sync with a build. Purely defense-in-depth: there is no known XSS today, and nothing changes for a working session.
Added
- The first-run wizard now offers to enable the Claude Code statusline. wmux setup-statusline — which shows model, context usage, and 5h/7d rate limits under Claude Code's input box — existed only as a CLI command, so app-only users never discovered it. The onboarding wizard now shows an opt-in "Enable statusline" step (macOS and Windows) when Claude Code is detected and at least one settings file can accept the install. It stays strictly opt-in: nothing installs at boot, an already-installed statusline shows nothing, and a user-authored statusline is never overwritten.
- In-app auto-update now works on macOS (Apple Silicon) (#609). Settings → "Check for updates" did nothing on a Mac: the whole updater was gated to Windows, so the only way to move to a new version was to notice a release, download the DMG, and drag it over the old app. macOS (arm64) now follows the same flow Windows has: wmux polls for a newer release, downloads it, pins its SHA-256 against a manifest published by the release pipeline, and installs it on restart — sessions survive, because the daemon keeps running through the swap. Nothing is installed unless the download's hash matches the manifest exactly; on any mismatch or transport error the update is refused outright and the failure is shown rather than silently retried. A build that isn't code-signed (a locally-made one) can't self-update at all, and now says so with a link to the DMG instead of failing silently. Windows behavior, its release assets, and its manifest are all untouched; Linux and Intel Macs still have no in-app updater and are unaffected.
- Pair a phone by name, and revoke that one phone. Pairing used to hand the device the server's own access token, and since that token now survives restarts, every paired device shared one secret — losing a phone meant rotating everybody. You now name a device before pairing it, and it gets a credential of its own. The daemon stores a hash and never the secret, so the roster file is worthless if it leaks or gets mirrored by a cloud-sync engine. Revoking one device cuts its live streams immediately rather than at its next reconnect, leaves every other device alone, and is honest when the write fails: it tells you it could not save the change while still severing the connections, so you know to retry before a restart. An unknown device and a wrong secret give the same answer, so a rejection never tells a guesser which half they got right. wmux web --new-token still means what it always meant — it revokes every paired device along with the old token, and refuses the rotation outright rather than reporting a half-done one if the roster cannot be written. Because a long-lived secret must never sit in a URL, a device authenticates with a header and trades it for a short-lived ticket to open a stream — your browser does this on its own, and the desktop's own token path is unchanged. Pairing is refused outright over a plaintext network bind, naming both ways out rather than just saying no. And the page itself is now served under a content security policy locked to the exact hashes of the bundle inlined into it, so a script injected into that page never executes at all.
- wmux web --tailscale sets up phone access in one command. Reaching a pane from your phone used to mean installing Tailscale, running tailscale serve, then restarting wmux web with the MagicDNS name so the server would accept it. One flag now does all of it, and wmux web --stop tears the serve config back down. It refuses rather than half-works: an existing serve config for that port is explained and never overwritten, a failed setup rolls back only what it created, and pinning --host to one non-loopback address is rejected outright — tailscale serve proxies to loopback, so that combination would look like it worked and then fail every request.
- A phone that reconnects no longer re-downloads the whole scrollback. Every time a browser opened a pane it received the entire ring buffer — 8 MB by default, up to 64 MB, and a third larger again once encoded — which on a phone that reconnects at every tunnel meant pulling that each time. The first paint is now capped to a window, never cutting a character or an escape sequence in half, and says so when there is more history above.
- Groundwork for phone notifications: a relay that cannot read them. Delivering an alert to a locked phone means going through Apple, and Apple only accepts pushes signed with a key that can never ship inside your daemon — so those pushes will travel through one small service this project runs. It is written so the promise is checkable rather than claimed: notifications are sealed with a key derived from your device's own pairing secret before they leave your machine, the service forwards an opaque blob it has no way to open, and its logging is typed so a payload cannot reach a log line even by accident. It holds no database and no accounts, and the sealed blob hides which device an alert is even for. Nothing sends yet — this lands the relay, the sealed-message format, and the byte-exact spec the phone app will implement.
- Answer an agent's question from your phone — even with the desktop closed. When a Claude Code pane raises an AskUserQuestion prompt, the daemon now records it as a first-class pending request and any paired surface can answer it. GET /api/approvals lists what is waiting — including the question text and the option labels, sanitized and capped, so you are never offered a blind button — and POST /api/approvals/<id> answers it. Approve selects the highlighted option; deny sends escape; the daemon re-reads the pane first and refuses (prompt-gone) rather than typing into a screen that moved on. One pending request per pane (a re-prompt supersedes the old one; the pane finishing or dying expires it), racing answers settle cleanly (the loser learns who won), a daemon restart invalidates everything pending (a recovered pane is a new process — a stale approval must never type into it), and only hook-delivered signals can create a request: screen-scraping heuristics never can, which is the same bar the orchestrator already holds itself to. Deliberate and documented: answering a specific daemon-raised request is allowed on a read-only wmux web server, because it is a strictly narrower grant than --allow-input — typing stays blocked there, pinned by a paired test on the same server instance. Approval nudges ride the existing replayable /api/events channel for clients that watch it — the browser page does not surface them yet, so for now this is the interface the phone app will use rather than a button already sitting in your browser. A successful answer also reports whether it was written down: the keystroke reaches the terminal either way, so the call succeeds, but if the daemon could not save the record it says so (durable: false) rather than letting you find out after a restart that the history has no trace of the decision. Agents other than Claude Code get a clean "unsupported" instead of guessed keystrokes. Verified end-to-end by a live-daemon harness with no GUI running, including the real ❯ prompt glyph through ConPTY, under concurrent load.
- Agent hook signals now survive the GUI being closed — the daemon receives them directly. The hook bridge every agent CLI calls (Claude Code, Codex, OpenClaude) used to deliver its signals — "the turn ended", "the agent is waiting on you", token stamps — to the desktop app's pipe, so closing the GUI silently killed the authoritative signal path and left only the daemon's screen-scraping heuristics. The bridge now targets the always-on daemon first (reading the daemon's pipe name and token from disk) and falls back to the desktop pipe only when the daemon is unreachable; an old bridge that still calls the desktop keeps working through a one-hop relay. The hook-beats-detector arbitration (the 10-second dedup window and the authority veto) moved into the daemon with the signals, so both sources are now arbitrated in one process, and every emitted event carries the daemon's verdict — downstream consumers can tell an authoritative hook event from a heuristic one. Desktop behavior is preserved by replaying the GUI-side effects (fleet activity line, question-pending clears, the turn's closing message, per-turn accounting) off the daemon's events, with tests pinning that each signal runs its side effects on exactly one path — never zero, never two. A signal fired mid-fallback can never double-deliver: the bridge only tries the next pipe when a request provably never reached a server. WMUX_HOOKS_TO_MAIN=1 restores the old targeting as an escape hatch. Verified end-to-end by a live-daemon harness (GUI closed): hook authority, dedup ordering, a 100-signal flood with the daemon staying responsive, and a daemon restart mid-stream. This is the foundation for remote surfaces that must act on agent signals while the desktop is closed — wmux web today, the planned phone app next.
Fixed
- "Check for updates" no longer spins forever on a platform without an in-app updater (#609). On Linux (and, before this release, on macOS) pressing the button left the Settings row stuck on "Checking for updates…" indefinitely, because the answer came back as a direct reply the panel wasn't reading. It now settles on "Up to date" like it always should have.