tuios v0.8.1 is a security release. Some commands and configs that worked in v0.8.0 are refused now. This page lists each change and what to do.

The full release notes are at tuios.dev/releases/v0-8-1. The security advisory is GHSA-jf76-3ff5-gjjv.

tuios ssh

• tuios ssh does not start when there is no keys file. This applies to localhost too. Before, a server on localhost with no keys file let every connection in.
• If your key is only in ~/.ssh/authorized_keys, tuios ssh does not use it now. Do one of these:

  • Add your public key to ~/.config/tuios/authorized_keys:

    mkdir -p ~/.config/tuios
    cat ~/.ssh/id_ed25519.pub >> ~/.config/tuios/authorized_keys
    

    Use your public key file if it has a different name.

  • Start with --authorized-keys ~/.ssh/authorized_keys. tuios does not apply the rules in sshd_config to these keys.

  • Start with --no-auth. Then every user on this machine can connect, or everyone who reaches the port on a network address.

• A key with options in the keys file is not accepted. Add the key again with no options if it must open a tuios session.

tuios-web

• A bind to an address other than localhost needs a password. --auto-tls or --cert alone is not enough, because TLS does not check who connects. Add --random-password or --password-file, or add --no-auth on a network you trust.
• --allow-host needs a password or --no-auth. It works only with a loopback --host. Give the host name with no port.
• On localhost with no password, tuios-web still starts. It prints one line to say that other users on this machine can connect.
• The password file must belong to you, with mode 600 or 400.

Pane grants

• Prompts. A pane that types into another pane's prompt needs the respond grant. admin does not include it. To give it to one pane, use tuios set-pane-grants or --grants.

• send-keys with PREFIX. A script in a pane that sends PREFIX fails now. Use the tuios command for the action instead, such as focus-window, new-window or split-window.

• send-keys with no window. From a pane, send-keys with no window types into the focused pane. tuios does not read these keys as key bindings.

• run-command. From a pane without respond, run-command cannot type or press keys. Use send-keys or send-text with -w.

• Config changes that widen. A change that widens [agents.permissions], [hosts] or a link policy waits. Run this from a terminal outside tuios:

  tuios config apply
  

  tuios hosts add from a pane also waits for it.

ssh_options

• Look in the Inbox or run tuios hosts after the upgrade. A host with a refused option is dropped.
• Move a refused option, such as ProxyCommand or LocalForward, into ~/.ssh/config. Then name that host in addr.
• Keep port forwards (-L, -R, -D) in ~/.ssh/config.
• Write each option as -o Keyword=value, with one value and no quotes.

Clipboard and folders

• OSC 52. A program in a background pane cannot set the host clipboard without a click. To get the v0.8.0 behaviour, set appearance.selection.osc52_write = "on".
• "cd here" and layout load. tuios types no cd into a pane that runs a program. Go back to the shell prompt and try again.
• Mixed versions. A v0.8.1 client with a v0.8.0 daemon types no cd into a daemon pane. To start a v0.8.1 daemon, run tuios kill-server after the upgrade. This closes every pane in every session, so save your work first.

Related

• Web Terminal: passwords and the Host check
• CLI Reference: tuios ssh keys
• Agents: pane grants and tuios config apply
• Configuration: the ssh_options rules and osc52_write
• Sessions & Daemon Mode: nested attach