rjyo/homebrew-moshi v0.4.31

moshi-hook v0.4.31

on GitHub

What's Changed

• Security fix: the daemon's local servers (the gateway and moshi-hook web) now accept requests only from your own Moshi clients. We recommend updating. The Moshi apps, the web client, and SSH port forwarding work as before.
• If you open moshi-hook web by a hostname, such as a Cloudflare Tunnel, a .local name, or a reverse proxy, run moshi-hook set allowed-hosts <name> once and restart. Until you do, the page shows a 403 that names the exact command. Opening it by an IP address, as with --listen 0.0.0.0, needs no setting. If you run the daemon as a different user than your clients, for example under sudo, use moshi-hook set allow-other-users on.
• New moshi-hook set proxy http://host:port sends the daemon's traffic to Moshi through a proxy: agent events, the phone connection, and update checks. socks5:// works too. Unlike HTTPS_PROXY, it survives brew services restart and brew upgrade. set proxy system uses the macOS system proxy, and set proxy off connects directly. moshi-hook doctor shows which proxy is in use.
• Agent events can travel over the daemon's existing connection to Moshi instead of a separate request each, once the server turns this on. Until then, and whenever that connection drops, events go over HTTP as before.
• Fixed: rewinding Claude to a prompt that included a pasted image no longer fails with "not in the agent's rewind list".
• Fixed: doctor and the Moshi app no longer report Moshi's Claude hooks as outdated when another tool added its own hook after them.
• Fixed: connecting to a machine from Machines no longer fails with "cannot bind to path" after macOS or Linux cleans up /tmp while the daemon is running.
• Fixed: a herdr pane running a tool that starts a headless agent in the background (claude -p, codex exec, opencode run) no longer shows in Workspaces and Jump To as that agent's session. Agents you start through a launcher such as clauth still show as agents.
• Removed moshi diff. The diff viewer in the Moshi app reads changes through the daemon, so the separate command is no longer needed.