# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 64 → 60 (-4.4)

## Lenses

- Code Health 89 → 55 (-34.1)
- Architecture 93 → 93 (-0.2)
- Maturity 73 → 75 (+2.8)
- Readiness 56 → 55 (-0.9)
- Security 58 → 55 (-2.3)
- Domain Modelling 100 → 100 (+0.0)
- Event Sourcing 100 → 100 (+0.0)
- Performance 100 → 100 (+0.0)

## Resolved (19)

- Ambiguous method naming: 'rules' (plural) and 'rule' (singular) are overloaded in intent. 'rules' likely returns all rules for an owner, while 'rule' computes a specific rule for a request. The naming is confusingly similar and doesn't clearly distinguish between 'list' and 'compute/resolve'.
- Documentation: no project overview (docs/tech/README.md)
- Duplicated block (8 lines × 2) (crates/muxy-app/src/model/activity.rs)
- Duplicated block (8 lines × 2) (crates/muxy-ui/src/components.rs)
- High: security finding (details withheld)
- High: security finding (details withheld)
- Inconsistent parameter naming for lookup methods: Most use 'id' (command, tab_type, panel, popover), but 'setting' uses 'key'. While technically correct (settings are keyed), it breaks the uniform 'id' pattern for entity lookup in the Manifest API.
- Inconsistent parameter usage in server management: 'add' and 'update' take a 'ServerEntry' and a 'path', while 'remove' takes an 'id' and a 'path'. The 'path' parameter is redundant in 'add'/'update' if the entry contains the path, or inconsistent in 'remove' where only an ID is needed. It's unclear if 'path' refers to the settings file path or the server's directory.
- Inconsistent return types for draft access: 'draft' returns a value (or reference, signature unclear but likely value copy or ref), while 'drafts' returns references. If 'draft' returns a copy, it breaks the value semantics expected in a store; if it returns a ref, it should be named 'get_draft' or similar to distinguish from the iterator.
- Low cohesion: Settings (LCOM4 7) (crates/muxy-app-core/src/extensions/storage.rs)
- Members sharing a duplicated core (4 members, 50+ identical tokens) (crates/muxy-app/src/views/confirm.rs)
- Progress::feed (cognitive 16) (crates/muxy-terminal/src/progress.rs)
- Repeated repair: crates/muxy-app/src/views/settings/extensions.rs (crates/muxy-app/src/views/settings/extensions.rs)
- Repeated repair: crates/muxy-app/src/views/terminal/scroll.rs (crates/muxy-app/src/views/terminal/scroll.rs)
- Repeated repair: crates/muxy-ui/src/quick_terminal/platform/macos.rs (crates/muxy-ui/src/quick_terminal/platform/macos.rs)
- Semantic mismatch in 'Request' type: The constructor creates a request with arguments (likely for RPC/Call), but the 'read' method implies reading a response or body from a stream. This conflates request creation with response handling or body consumption without clear naming distinction (e.g., 'from_stream' vs 'new').
- Split crates/muxy-app
- Split crates/muxy-protocol
- Split crates/muxy-ui

## New (74)

- (anonymous) (cyclomatic 32) (crates/muxy-app-core/src/browser/element_picker.js)
- (anonymous)::restore (cognitive 19) (crates/muxy-app-core/src/browser/element_picker.js)
- AppModel::perform_server_menu (cognitive 16) (crates/muxy-app/src/views/server_menu.rs)
- AppModel::perform_server_menu (cyclomatic 23) (crates/muxy-app/src/views/server_menu.rs)
- AppModel::running_agents (cognitive 25) (crates/muxy-app/src/model/agents_panel.rs)
- BrowserView::handle (cyclomatic 20) (crates/muxy-app/src/views/browser/mod.rs)
- Cache::snapshot (cyclomatic 16) (crates/muxy-terminal/src/graphics.rs)
- Catalog::scan (cognitive 30) (crates/muxy-app-core/src/agent_sessions/files.rs)
- Critical CVE: [GHSA redacted] (Cargo.lock)
- Dependency source pinned to a moving git ref
- Dialog::render (cognitive 17) (crates/muxy-ui/src/dialog/view.rs)
- Duplicated block (10 lines × 2) (crates/muxy-app/src/views/browser/mod.rs)
- Duplicated block (14 lines × 2) (crates/muxy-app/src/views/agent_sessions.rs)
- Duplicated block (5 lines × 2) (crates/muxy-ui/src/voice/linux.rs)
- Duplicated block (5–6 lines × 2) (crates/muxy-app/src/updater/linux.rs)
- Duplicated block (6 lines × 2) (crates/muxy-app/src/views/browser/mod.rs)
- Duplicated block (8 lines × 2) (crates/muxy-app/src/proxy.rs)
- Duplicated block (9 lines × 2) (crates/muxy-app/src/views/proxy.rs)
- FileTooLong: browsers/mod.rs (crates/muxy-app/src/model/browsers/mod.rs)
- FileTooLong: linux/page.rs (crates/muxy-ui/src/webview/linux/page.rs)
- …and 54 more

## Changes since last survey

- 39 commits — 33 feature/other, 6 fixes

## By area

- crates/muxy-app — 20 commits
- (root) — 5 commits
- crates/muxy-server — 3 commits
- crates/muxy-ui — 2 commits
- vendor/libghostty-vt-sys — 2 commits
- (repo) — 1 commit
- crates/muxy-app-core — 1 commit
- crates/muxy-cli — 1 commit
- docs/user-guide — 1 commit
- packaging/linux — 1 commit
- scripts/linux_packages.py — 1 commit
- vendor/libghostty-vt — 1 commit

## Notable commits

- fix: Fix macOS webview file drops and terminal focus (#1222)
- fix: Fix macOS webview keyboard routing (#1240)
- fix: Fix new-tab button spacing in crowded tab strips (#1212)
- fix: Fix popover occlusion bounds for webviews (#1234)
- fix: Fix terminal emoji widths with default grapheme clustering (#1213)
- fix: Track polybrowser main branch instead of a fixed revision (#1211)
- change: Add AppImage and Debian packages for Linux desktop (#1210)
- change: Add DOM element copying for improved agent context (#1221)
- change: Add Linux support (#1199)
- change: Add a Remote Servers tab with server groups and multi-select actions (#1237)
- change: Add an app-wide HTTP/SOCKS5 proxy for terminals, downloads, and SSH (#1239)
- change: Add client-side window decorations on Linux (#1207)
- change: Add project-scoped agent session browsing and resume support (#1225)
- change: Add right-side docking for the agents panel (#1216)
- change: Agents panel project context (#1233)
- change: Allow agents to run visual tests and test UI regressions
- change: Bump BETA_VERSION to 2.3.0
- change: Consolidate Linux setup docs into the getting started guide
- change: Disable hardware acceleration for offscreen Linux webviews (#1208)
- change: Expand project sorting with recent activity and date added (#1231)
- …and 19 more