Added
- Org-enforced lock policy: Business team admins can set a maximum auto-lock time and require Lock vault for every member, owner and admins included. Set it from Members → Security or "Security policy…" in the vault menu (#581)
- On Android, unlocking with system authentication binds the vault key to the device hardware, so the keychain holds only a blob the OS releases after a live fingerprint or screen-lock check (#591)
- Port forwarding: choose Local tunnel, Remote tunnel or Dynamic SOCKS proxy straight from the New Rule menu, the right-click menu or the mobile Add sheet (#589)
Changed
- Terminal output streams as raw bytes over one IPC channel per session instead of JSON events per listener (#580)
- Hidden terminals stop working in the background: only visible terminals refit on window resize, hidden status bars stop their uptime timers and System Metrics streams, and a tab switch re-renders only the two tabs involved (#582, #583, #590)
- Smaller, faster startup: devicon icons are subset at build time, and non-English locales, CodeMirror and the mobile UI load on demand (#584)
- The app ships one crypto backend: aws-lc-rs is gone, and ring handles SSH ciphers and HTTPS (#585)
Fixed
- SSH tabs on hosts without tmux or screen reconnect after a dropped connection instead of closing (#586)
- Old terminal tabs no longer go blank: live WebGL contexts are capped, at up to 14 on desktop and 8 on Android (#576, #578)
- SFTP and FTP list symlinks to folders as folders. Deleting a link to a folder over FTP no longer deletes the files inside the folder it points to (#577, #579)
- App lock fails closed when its marker can't be written or read. With auto-lock set to Immediately, Android no longer shows the unlocked terminal in recents. On Android, logging out now wipes the old account's connections and lock marker (#570)
- Signing out drops the previous account's team lock policy, and the Security panel is hidden for teams you can't manage (#587)
Security
- rustls bumped to 0.23.45 for GHSA-2mjx-qc3c-rqvc (unencrypted TLS 1.3 handshake messages were accepted) (#575)