Product Updates & Changelog
Changelog & Product History
Stay up to date with the development progress, architecture adjustments, and feature iterations on CmdVault.
v2.0.1 August 3, 2026Current Release
Chat Security, Working Direct Messages & a New First Run
A security release for team chat. Messages are now restricted to rooms you actually belong to, senders can no longer be forged, and direct messages deliver for the first time. Alongside it, a fully redesigned first-run experience.
Key changes:
- •Security: team and direct messages were readable by anyone sharing the cluster. The access control layer existed with both membership checks written, but nothing ever called it - message polling accepted any room id and returned its full contents. Every message path is now authorised.
- •Security: message senders were supplied by the client and stored verbatim, so a message could be posted under any address. The sender is now taken from your signed-in account.
- •Security: running a code snippet from a chat message went straight into your shell, bypassing the safety checker used everywhere else. It now shows the exact command and any warnings, and asks for confirmation.
- •Fixed: direct messages were never delivered - each side wrote to a room keyed by the other person's address, so the two never read the same messages.
- •Fixed: every message was attributed to "Developer", because the sender was read from a browser storage key nothing in the app ever wrote.
- •Fixed: failed sends disappeared silently; they now stay in the conversation marked as not delivered.
- •Redesigned first run: a brand introduction and feature tour, then six setup steps opening with optional GitHub or Google sign-in. Everything except AI Studio credits works fully offline.
- •The MongoDB connection test in setup now actually contacts the cluster - it previously reported success for any string beginning with "mongodb", including a wrong password or an unreachable host.
v1.3.0 August 1, 2026Past Release
Scoped Credentials Vault, Session Restore & Window Behaviour
Environment variables gain local/staging/production scoping and finally persist, plus fixes to encryption handling, the close button, and reload behaviour.
Key changes:
- •Scoped credentials vault: environment variables are stored per profile - local, staging and production - with a description per entry, and now survive restarts. The panel was previously in-memory only, so imports were lost on reload.
- •.env import: paste a file to bulk-import into the active profile. Entries update in place rather than duplicating on re-import, and keys that look like secrets are encrypted automatically.
- •Security: encrypted values were being treated as plain text. Ciphertext was written without its version tag while nine call sites tested for that tag to decide whether to decrypt - so the database URI reached the driver, and the AI key reached the API, still encrypted.
- •Security: the master password was written to the OS keyring and used to unlock automatically on every launch, leaving the vault effectively always open. Auto-unlock is now opt-in and stores a derived key instead of the password.
- •Changed: the close button now quits instead of hiding to the tray. Enable "Keep running in the system tray" in Settings to restore the old behaviour.
- •Session restore: the app reopens on the view and workspace you left instead of resetting to the dashboard.
- •Ctrl+Shift+` toggles the terminal panel. The old Ctrl+Shift+Space shortcut hid the window, which read as the app closing at random.
- •Fixed: child shells outlived the app on quit, holding their working directories.
v1.2.0 July 31, 2026Past Release
AI Studio, CmdVault Accounts & Credits
A generative media workspace, real server-issued accounts, and a credit system to go with them.
Key changes:
- •AI Studio: ten panels covering image and video generation, image editing, icon generation, classification, lip sync, stock content, image-to-prompt, prompt improvement and audio generation. Panels render from a catalog served at runtime, so new capabilities appear without shipping an app build.
- •CmdVault accounts: sign-in now produces a real server-issued session. The OAuth exchange moved server-side, so client secrets no longer ship with the app. Access tokens live only in memory; the refresh token is stored in the OS keychain and rotated on every use.
- •Credits and quota: 3 free credits a day, weighted by real generation cost and enforced server-side by a single conditional write, so two concurrent requests can never both spend the last credit. Failed generations are refunded automatically.
- •The first run of any paid-only tool is free per account, and handed back rather than burned if it fails upstream.
- •Fixed: the OAuth callback tab could hang blank because the loopback listener sent no Content-Length and never closed the connection.
v1.1.4 July 22, 2026Past Release
Code Share: Sync Text & Files Instantly
A Simple.Savr-style feature for syncing text and files across devices in real time, encrypted end-to-end entirely on the client - the server never sees a plaintext or a password.
Key changes:
- •WiFi Mode auto-joins a shared room derived from your network's public IP - anyone on the same WiFi sees the content instantly, no code or password to type.
- •Global Mode syncs across any network via a short share code, with optional password protection.
- •AES-256-GCM encryption with PBKDF2 key derivation, done entirely client-side.
- •Clickable link detection, inline image preview, and one-click "download all as .zip".
- •Live participant counter; uploaded files auto-delete after 7 days.
v1.1.3 July 21, 2026Past Release
AI Agent Launcher, CmdVault Assistant & MCP Server
CmdVault becomes AI-native: a built-in assistant, one-click launching of external coding agents, and an MCP server so any MCP client can drive the app directly.
Key changes:
- •AI Agents: detects installed agentic coding CLIs (Claude Code, Codex CLI, Gemini CLI, Aider) and launches them in an embedded terminal scoped to a chosen project folder.
- •CmdVault Assistant: a built-in Claude-powered chat panel that can search/create recipes, list active ports, and vet shell commands - the API key is AES-256-GCM encrypted and never touches the webview.
- •MCP Server: ships a standalone cmdvault_mcp binary exposing the same safe tool set over the Model Context Protocol, so Claude Code, Claude Desktop, or any MCP client can drive CmdVault directly.
- •Sidebar reorganized into four collapsible groups: AI, Library, Collaboration, and System Tools.
- •Fixed: Multi-Device Control input reaching the network but not visibly moving the cursor on non-100%-scaled displays.
v1.1.2 July 20, 2026Past Release
Multi-Device Control ("Borders")
Control a second computer on the same network with one mouse and keyboard - push the cursor off a screen edge to hand off control, the same experience as Mouse Without Borders/Synergy.
Key changes:
- •Direct, AES-256-GCM encrypted TCP connection between the two machines - no cloud relay, no internet dependency.
- •Friendlier pairing UI: LAN IP/computer name shown up front, masked Security Key with show/hide, plain-language setup steps.
- •Ctrl+Shift+Esc panic hotkey and an automatic stuck-session watchdog that restores local input after 8 seconds of silence.
- •Fixed: a Live Relay WebRTC signaling race that could leave sessions stuck disconnected, plus hardened the licensing/invite endpoints and OAuth loopback flow against CSRF.
v1.1.1 July 19, 2026Past Release
Force-Update Enforcement & Remote Desktop HUD
Server-enforced minimum version checks, plus a much richer heads-up display for Live Relay remote desktop sessions.
Key changes:
- •Mandatory force-update enforcement against a server-defined minimum required version.
- •Server-side connection gating for the sync database URI, verified against client version and user email.
- •Cybernetic remote desktop HUD overlay: live latency ping tracker, FPS counter, CRT scanlines, click ripple effects.
- •Live Relay dashboard telemetry: uptime clock, signal waveform, and a guest action log feed.
- •Fixed: a WebRTC parameter-casing mismatch that broke handshakes, and duplicate login inputs.
v1.1.0 July 16, 2026Past Release
OS Keychain Integration & Execution Safety Controls
Seamless zero-config vault unlock via the OS keychain, and finer-grained control over which commands the executor is allowed to run.
Key changes:
- •OS-level credential keychain integration for seamless, zero-config vault auto-unlock on startup.
- •User-defined custom blocked-command policy, plus sudo/unsafe-command interceptor toggles in Settings.
- •Non-blocking MongoDB TTL index sweeps to auto-expire transient signaling documents after 2 hours.
- •Fixed: tightened the CSP connect-src whitelist and a DNS/template placeholder resolution bug.
v1.0.2 July 15, 2026Past Release
Terminal & Secrets Storage Hardening
Stability and security follow-up to the v1.0.1 Developer Suite release.
Key changes:
- •Modularized terminal PTY process spawning with directory-fallback validation to prevent shell crashes.
- •Moved MongoDB URIs, DB connection profiles, and SSH credentials out of localStorage into vault-managed SQLite storage, with reveal/hide toggles.
v1.0.1 July 14, 2026Past Release
Release v1.0.1: Port Analyzer, Env Syncer, Log Streamer & Workspaces
Introducing the first official major release of CmdVault containing the Developer Suite utility toolbox (Port Analyzer, Environment Manager, Live Log Streamer) and customizable multi-project workspace runners.
Key changes:
- •Integrated Port Analyzer to scan active socket connections and terminate locked PIDs natively.
- •Combined static Vault credentials and dynamic local .env syncing under a tabbed panel.
- •Created a real-time tail logger with log-level syntax color coding and keywords filtering.
- •Developed a multi-workspace project launcher allowing custom accent colors, logo emojis, and lockfile auto-detection.
- •Built a glassmorphic floating toast notification hub with framer motion entry animations.
- •Enabled native Windows dark titlebar styling in the Rust configuration setup.
v0.1.0 July 12, 2026Legacy Release
Initial Release: The Developer's Command Vault
Introducing the first official pre-release of CmdVault Desktop. Secure, zero-knowledge local vaults, cross-device synchronization relay networks, and clean environmental parameter injection.
Key changes:
- •Local SQLite storage encrypted using hardware-backed AES-256 keys.
- •Dynamic parameter substitution for confidential keys (e.g. {{DB_PASSWORD}}).
- •Cross-platform desktop application built on Tauri & Rust.
- •Zero-knowledge optional cloud synchronization using custom metadata hashing.
- •Collaborator invite dispatcher and signature-checked relays.
v0.0.8-beta June 28, 2026Legacy Beta
Private Beta Integration & Client Core tests
Early prototype verification of the Rust backend core command parser and cross-platform native execution context libraries.
Key changes:
- •Implemented the SQLite cipher database creation hooks.
- •Completed basic integration suite testing for CLI command inputs.
- •Added shell autocompletion recipes for Zsh and Bash.