Added
- Share a terminal with anyone, not just teammates. The share menu's new People
tab finds teammates as you type, and anyone else by their @handle or full
email address. The invite is the request: the person gets a notification
with Join, Decline and Block permanently, and joining is one tap. A host can
withdraw a pending invite — which frees the guest seat instead of holding it
until the session ends — and the guest cap is visible while inviting. People
you invited recently are remembered across your devices, carried in your
encrypted sync blob rather than stored on the server. - Every account has an @handle. It shows in the account menu with a copy
button, avatars fall back to two-letter initials from it, and Settings can
claim or rename a custom one — all it takes is a verified email address.
Choosing a custom handle is what makes you findable by people outside your
teams; the handle you start with already works for anyone you give it to. A
toggle controls whether people outside your teams may invite you at all. - The MCP server gained the settings, account, plugin-management and
marketplace domains: an agent can read and change settings, read your
subscription, install and manage plugins, browse marketplace sources, export
and import vault objects, and read a team's server-side audit log. Each
domain sits behind its own permission and writes audit rows. The ssh-config
sync is now exposed as an MCP tool. - Terminal appearance gained line-height, cursor-style and cursor-blink
settings, and they sync across devices.
Removed
- The display-name editor is gone. A handle is the single name Voltius shows
for a person, everywhere.
Fixed
- Sharing a local shell relayed nothing — guests joined a permanently blank
terminal. Input and output now flow both ways. - Your email address is no longer sent over the session WebSocket, where every
participant could read it; a stranger admitted by a knock previously learned
everyone's real address. - A stranger sees no session name until they accept, so a mis-aimed invite
leaks a handle rather than a hostname, and a knock is labelled from the
server's record of who sent it rather than a name the sender chose. - Session and vault keys are wrapped to the recipient's current public key,
fixing invites that failed for someone who had signed in on another device. - A rate-limited sign-in reported "Account not found", sending people off to
create a second account they did not need. - Settings pulled from another device no longer bounce straight back as a push.
- Closing the window during a shutdown sync could cancel the exit, or close a
window you had just reopened. - The cursor keeps blinking under persistent tmux and screen sessions, and the
GNU screen fallback gets TrueColor. - The account dropdown no longer waits on a network handle lookup before it
opens, and signing out clears the cached handle. - The session guest cap is applied consistently — in the invite-to-session
menu, in the direct-invite roster, and across the setup-to-active flip. - Numerous MCP corrections: tighter permission gates on the settings, account
and team-audit surfaces, audit rows that no longer carry more than they
should, and stores refreshed before an export reads them.