mulmoterminal 4.11.0 → 4.12.0

package/bin/cli-args.d.ts

@@ -6,6 +6,8 @@ export declare function probeFailureIsPortInUse(err: { code?: string } | null |
 export declare function companionHostsFor(boundAddress: string): string[];
 export declare function launcherReachHost(bindHost: string): string | null;
 export declare function launcherUrl(reachHost: string, port: number): string;
+export declare function browserUrl(port: number): string;
+export declare function launchTarget(reachHost: string, port: number, localhostIsUnambiguous: boolean): { url: string; note: string | null };
 export declare function chooseCwd(args: string[], env: Record<string, string | undefined>): CwdChoice;
 export declare function portInUseMessage(port: number, explicit: boolean): string;
 export declare function portInUseAction(explicit: boolean, isTTY: boolean | undefined): "ask" | "stop";

package/bin/cli-args.js

@@ -156,13 +156,13 @@ export function launcherReachHost(bindHost) {
   return isIP(bindHost) ? bindHost : null;
 }
 
-/** What to PRINT for a concrete address — never `localhost`.
+/** What to name a concrete address with — never `localhost`, because this one exists to say
+ *  WHICH ADDRESS WAS CHECKED. `launcherReachHost` picks `::1` precisely so an IPv4 listener
+ *  cannot answer for us, and writing `localhost` would hand that choice straight back: measured,
+ *  `localhost` resolves to BOTH `::1` and `127.0.0.1`.
  *
- *  It did say `localhost` for the loopback cases, because that is friendlier. CodeRabbit caught
- *  what that throws away: `launcherReachHost` picks `::1` precisely so an IPv4 listener cannot
- *  answer for us, and printing `localhost` hands the choice straight back — measured, `localhost`
- *  resolves to BOTH `::1` and `127.0.0.1`, so the browser may open the very process the poll was
- *  written to avoid. A URL the user clicks has to name the address that was checked.
+ *  This is no longer what the BROWSER is sent to — see `browserUrl`, and #1889 for why those are
+ *  two different questions.
  *
  *  Built through `URL` so the platform does the escaping: an IPv6 literal has to be bracketed or
  *  `http://::1:34567` is not a URL at all. The brackets go on BEFORE the assignment because the
@@ -174,6 +174,82 @@ export function launcherUrl(reachHost, port) {
   return url.origin;
 }
 
+/**
+ * The URL the BROWSER is opened at — always `localhost`, and that is a COMPATIBILITY constraint,
+ * not a preference about which spelling reads better.
+ *
+ * The grid layout (`grid_v2`), the theme, the font size and eleven other things live in
+ * `localStorage`, which is partitioned by ORIGIN. So this string is not merely an address the
+ * user is sent to; it is the key their state is filed under. Changing it silently empties the
+ * app: 4.11.0 moved it to `http://127.0.0.1:<port>` as part of #1876's review and every upgrading
+ * user's grid came up blank, with their sessions alive in tmux and nothing on screen to say the
+ * layout was one hostname away (#1889).
+ *
+ * And there is no way back for state left on the old origin. Measured on Chrome 152: a hidden
+ * iframe on the old origin reads an EMPTY store (third-party storage partitioning), and
+ * `document.requestStorageAccess()` resolving does not change that — it governs cookies. Only a
+ * TOP-LEVEL visit to the old origin can see it. A URL that has to be stable is therefore cheaper
+ * to keep stable than to migrate.
+ *
+ * Reachability is not the reason it is safe; #1834 is. `server/infra/loopback-listener.ts` makes
+ * this server serve `127.0.0.1` in EVERY configuration — as the primary bind, or as a second
+ * listener when the operator widens it — because eight local callers write that address as a
+ * literal. So `localhost` arrives here whatever `MULMOTERMINAL_HOST` says, falling back to v4
+ * when v6 refuses.
+ *
+ * What this deliberately does NOT do is decide anything about the port PROBE or the readiness
+ * POLL. Those still follow the address the child reports binding, which is what #1876 actually
+ * fixed — the second-instance guard, and a ready banner that was reporting a stranger's 200. The
+ * residual risk restored here is only the one 4.10.1 and every release before it carried: another
+ * APP holding this port on `::1` alone could answer a browser resolving `localhost` that way. A
+ * second MulmoTerminal cannot, because `companionHostsFor` requires `127.0.0.1` free for every
+ * bind before the child is ever spawned.
+ */
+export function browserUrl(port) {
+  return new URL(`http://localhost:${port}`).origin;
+}
+
+/**
+ * Where to send the browser, and what to say about it — as one decision, because the two answers
+ * have to agree.
+ *
+ * `localhostIsUnambiguous` is a MEASUREMENT, not a guess: the launcher tried to bind `[::1]:port`
+ * before spawning, so `false` means something else already answers there. That is the hole Codex
+ * flagged on this change and it is real for the DEFAULT bind, not only a widened one —
+ * `companionHostsFor` requires `127.0.0.1` free for every launch but never asks about `::1`, and
+ * `localhost` resolves to BOTH (measured). Sending the browser to `localhost` while a stranger
+ * holds the v6 loopback is exactly the case #1876's review was worried about.
+ *
+ * So the rule is: use the name the user's state is filed under WHEN NOTHING ELSE CAN ANSWER TO
+ * IT, and otherwise say plainly that we stepped aside — including where their layout went, since
+ * a silent switch here is #1889 all over again for that one user.
+ *
+ * The probe cannot close the window, only narrow it: `::1` is free when asked, and unless the
+ * server binds it (a `::1` or `::` bind), a stranger could still take it afterwards. That is the
+ * same probe/bind race `isPortFree` already documents and accepts.
+ *
+ * The loopback spellings below are compared against the address the kernel REPORTED, whose output
+ * vocabulary is finite — not against anything a user typed.
+ */
+export function launchTarget(reachHost, port, localhostIsUnambiguous) {
+  if (!localhostIsUnambiguous) {
+    const checked = launcherUrl(reachHost, port);
+    return {
+      url: checked,
+      note: `Something else is already listening on [::1]:${port}, so the browser is being sent to ${checked} — the address that was checked. If your layout and settings look empty, they are filed under http://localhost:${port}.`,
+    };
+  }
+  const bound = reachHost === V4_LOOPBACK_CLIENTS_DIAL || reachHost === "::1";
+  return {
+    url: browserUrl(port),
+    // `browserUrl` sends everyone to `localhost`, which is right for the machine the launcher runs
+    // on and useless to the operator who set `MULMOTERMINAL_HOST` so ANOTHER machine could open
+    // the app. 4.11.0 told them their address by putting it in the banner; saying it here means
+    // restoring the origin costs them nothing.
+    note: bound ? null : `Bound to ${reachHost} — reachable from another machine at ${launcherUrl(reachHost, port)}`,
+  };
+}
+
 /**
  * Which directory to run in, before it is made absolute.
  * Precedence: `--cwd` (relative allowed) > CLAUDE_CWD > the directory the launcher was run

package/bin/mulmoterminal.js

@@ -19,9 +19,9 @@ import { waitUntilReady } from "./wait-ready.js";
 import {
   bindHostFor,
   chooseCwd,
+  launchTarget,
   companionHostsFor,
   launcherReachHost,
-  launcherUrl,
   probeFailureIsPortInUse,
   parsePortArg,
   portInUseAction,
@@ -295,6 +295,24 @@ async function isPortFree(port) {
   return primary;
 }
 
+// Can `localhost` reach anything OTHER than the server this launcher is about to start? (#1889)
+//
+// The browser is sent to `localhost` so a user's saved layout stays where it has always been, and
+// `localhost` resolves to BOTH `::1` and `127.0.0.1` (measured). `isPortFree` already proves
+// `127.0.0.1` is free for every launch — `companionHostsFor` requires it — but nothing asks about
+// `::1`, so a stranger holding the v6 loopback could answer a browser that resolves that way.
+//
+// Asked by BINDING rather than by classifying the host string, which is this file's rule
+// throughout: free means nobody is there, and that is true whether the server is about to take
+// `::1` itself (a `::1` or `::` bind) or leave it empty. Both are answers the browser can only
+// reach us with. A machine with no IPv6 fails EADDRNOTAVAIL, which probeFailureIsPortInUse
+// correctly reports as "not in use" — and there `localhost` is v4-only, so it is unambiguous.
+//
+// Must run BEFORE the server is spawned, or the server's own `::1` listener answers the probe.
+async function localhostReachesOnlyUs(port) {
+  return (await canBind(port, "::1")).free;
+}
+
 function printReadyBanner(url, stopCommand) {
   const bar = "\x1b[32m" + "─".repeat(48) + "\x1b[0m";
   console.log(`\n${bar}`);
@@ -367,7 +385,7 @@ async function confirmNoRunningInstance() {
   log(SECOND_INSTANCE_NOTE);
 }
 
-async function choosePort(requested, explicit) {
+async function pickPort(requested, explicit) {
   const asked = await isPortFree(requested);
   if (asked.free) return { port: requested, address: asked.address };
   // No SILENT fallback: starting a second server on another port without saying so is how
@@ -386,12 +404,39 @@ async function choosePort(requested, explicit) {
   return fallback;
 }
 
+// The port, the address a probe of it landed on, and whether `localhost` can reach anything but us
+// on it — settled together because all three have to be known BEFORE the spawn, which is the only
+// moment `::1` can be asked about honestly (see localhostReachesOnlyUs).
+async function choosePort(requested, explicit) {
+  const chosen = await pickPort(requested, explicit);
+  return { ...chosen, localhostIsUnambiguous: await localhostReachesOnlyUs(chosen.port) };
+}
+
+// What the launcher does the moment the server answers: say where it is, and open it there.
+//
+// `url` is where the BROWSER goes and `note` is what launchTarget wants said about that choice —
+// two different facts since #1889, and the note is null whenever the URL already covers it.
+function announceReady(url, note, noOpen) {
+  printReadyBanner(url, STOP_COMMAND);
+  // Either the address a widened bind serves other machines on, or why the browser was NOT sent
+  // to `localhost`. Null whenever the URL above already said everything.
+  if (note) log(note);
+  if (noOpen) return;
+  try {
+    // The command is a hardcoded literal; url is built by browserUrl from a numeric port, so it
+    // is http://localhost:<n>.
+    execSync(`${pickOpenCommand()} ${url}`, { stdio: "pipe" });
+  } catch {
+    log(`Open your browser: ${url}`);
+  }
+}
+
 // Spawn the server on `port` and report the child via `onChild` (so signal
 // handlers target the live process). Resolves only when the server exits because
 // the port was taken at bind time before it became ready — the caller then
 // reports that and stops. In every other case (clean shutdown, fatal error,
 // or the server simply running) the process exits with the server's code.
-function runServer(port, probedAddress, noOpen, cwd, onChild) {
+function runServer(port, probedAddress, localhostIsUnambiguous, noOpen, cwd, onChild) {
   return new Promise((resolveExit) => {
     log(`Starting MulmoTerminal on port ${port}...`);
     // stderr is piped (and passed through) so a fatal boot error can be inspected once the
@@ -427,26 +472,17 @@ function runServer(port, probedAddress, noOpen, cwd, onChild) {
     let readyStarted = false;
     let cancelReady = () => {};
     // Takes a CONCRETE address — callers resolve first, and a caller that cannot does not call.
+    //
+    // Two different questions, and #1889 is what happens when one answer is given to both. The
+    // POLL asks "did the server we started come up", so it uses the address the child reported
+    // binding — that is #1876's fix and it stays. The URL asks "where does this user's browser
+    // keep its state", and the only answer that does not empty the app is the one it has always
+    // been given: see browserUrl.
     const beginReady = (reachHost) => {
       if (readyStarted) return;
       readyStarted = true;
-      const url = launcherUrl(reachHost, port);
-      cancelReady = waitUntilReady(
-        port,
-        () => {
-          printReadyBanner(url, STOP_COMMAND);
-          if (noOpen) return;
-          try {
-            // The command is a hardcoded literal; url is built by launcherUrl from the address the
-            // child reported and a numeric port, so it is http://<addr>:<n> or http://[<v6>]:<n>.
-
-            execSync(`${pickOpenCommand()} ${url}`, { stdio: "pipe" });
-          } catch {
-            log(`Open your browser: ${url}`);
-          }
-        },
-        { host: reachHost },
-      );
+      const { url, note } = launchTarget(reachHost, port, localhostIsUnambiguous);
+      cancelReady = waitUntilReady(port, () => announceReady(url, note, noOpen), { host: reachHost });
     };
     server.on("message", (msg) => {
       if (!isRecordLike(msg) || msg.type !== "listening" || typeof msg.address !== "string") return;
@@ -613,12 +649,12 @@ async function main() {
   // The address comes back with the port because the PROBE learned it from the kernel, which is
   // the one answer that needs no interpreting (#1876). It is the fallback the readiness poll uses
   // when the child reports nothing.
-  const { port, address: probedAddress } = await choosePort(requestedPort, portExplicit);
+  const { port, address: probedAddress, localhostIsUnambiguous } = await choosePort(requestedPort, portExplicit);
   // Named only now, because the port is half the name — and named at all so that the user who
   // loses this terminal has something to search for (#1820). The server child names itself the
   // same, so `pkill mulmoterminal` reaches whichever half is found first.
   setProcessTitle(port);
-  await runServer(port, probedAddress, noOpen, cwd, (c) => {
+  await runServer(port, probedAddress, localhostIsUnambiguous, noOpen, cwd, (c) => {
     child = c;
   });
   error(portInUseMessage(port, portExplicit));

package/common/keymap.ts

@@ -18,6 +18,7 @@ export const KEYMAP_ACTIONS = [
   "zoom-prev",
   "next-attention",
   "terminal-new",
+  "terminal-new-here",
   "terminal-new-adjacent",
   "terminal-close",
   "copy",

package/common/modelPresets.ts

@@ -78,7 +78,7 @@ export const MODEL_PRESETS: readonly ModelPreset[] = [
     id: "nvidia/nemotron-3-super-120b-a12b",
     label: "Nemotron 3 Super 120B",
     contextLength: 1_000_000,
-    pricePerMTok: { input: 0.08, output: 0.45 },
+    pricePerMTok: { input: 0.085, output: 0.4 },
     trials: measured(3, 3, 18),
   },
   {
@@ -86,7 +86,7 @@ export const MODEL_PRESETS: readonly ModelPreset[] = [
     id: "qwen/qwen3-235b-a22b-2507",
     label: "Qwen3 235B A22B",
     contextLength: 262_144,
-    pricePerMTok: { input: 0.09, output: 0.55 },
+    pricePerMTok: { input: 0.0875, output: 0.35 },
     trials: measured(3, 3, 16),
   },
   {
@@ -94,7 +94,7 @@ export const MODEL_PRESETS: readonly ModelPreset[] = [
     id: "minimax/minimax-m2.7",
     label: "MiniMax M2.7",
     contextLength: 204_800,
-    pricePerMTok: { input: 0.25, output: 1.0 },
+    pricePerMTok: { input: 0.3, output: 1.2 },
     trials: measured(3, 3, 16),
   },
   {
@@ -102,7 +102,7 @@ export const MODEL_PRESETS: readonly ModelPreset[] = [
     id: "deepseek/deepseek-v3.2",
     label: "DeepSeek V3.2",
     contextLength: 163_840,
-    pricePerMTok: { input: 0.269, output: 0.4 },
+    pricePerMTok: { input: 0.26, output: 0.38 },
     trials: measured(3, 3, 42),
   },
   {
@@ -118,7 +118,7 @@ export const MODEL_PRESETS: readonly ModelPreset[] = [
     id: "deepseek/deepseek-v4-pro",
     label: "DeepSeek V4 Pro",
     contextLength: 1_048_576,
-    pricePerMTok: { input: 0.435, output: 0.87 },
+    pricePerMTok: { input: 0.87, output: 1.74 },
     trials: measured(3, 3, 20),
   },
   {
@@ -126,7 +126,7 @@ export const MODEL_PRESETS: readonly ModelPreset[] = [
     id: "deepseek/deepseek-v4-flash",
     label: "DeepSeek V4 Flash",
     contextLength: 1_048_576,
-    pricePerMTok: { input: 0.094, output: 0.188 },
+    pricePerMTok: { input: 0.088606, output: 0.177212 },
     trials: measured(3, 4, 26),
   },
   {
@@ -158,7 +158,7 @@ export const MODEL_PRESETS: readonly ModelPreset[] = [
     id: "moonshotai/kimi-k2.6",
     label: "Kimi K2.6",
     contextLength: 262_144,
-    pricePerMTok: { input: 0.684, output: 3.42 },
+    pricePerMTok: { input: 0.95, output: 4.0 },
     trials: measured(3, 3, 46),
   },
   {
@@ -166,7 +166,7 @@ export const MODEL_PRESETS: readonly ModelPreset[] = [
     id: "z-ai/glm-5.2",
     label: "GLM 5.2",
     contextLength: 1_048_576,
-    pricePerMTok: { input: 0.819, output: 2.574 },
+    pricePerMTok: { input: 1.19, output: 3.74 },
     trials: measured(3, 3, 21),
   },
   {
@@ -174,7 +174,7 @@ export const MODEL_PRESETS: readonly ModelPreset[] = [
     id: "moonshotai/kimi-k2.7-code",
     label: "Kimi K2.7 Code",
     contextLength: 262_144,
-    pricePerMTok: { input: 0.82, output: 3.75 },
+    pricePerMTok: { input: 0.66, output: 3.4 },
     trials: measured(3, 3, 14),
   },
   {
@@ -190,19 +190,35 @@ export const MODEL_PRESETS: readonly ModelPreset[] = [
     id: "tencent/hy3",
     label: "Tencent Hy3",
     contextLength: 262_144,
-    pricePerMTok: { input: 0.14, output: 0.58 },
+    pricePerMTok: { input: 0.132, output: 0.528 },
     trials: measured(3, 3, 17),
   },
   {
     provider: "openrouter",
     id: "nvidia/nemotron-3-ultra-550b-a55b",
     label: "Nemotron 3 Ultra 550B",
-    contextLength: 524_288, // 512 KiB = 512 * 1024; was 512_288 (a typo)
-    pricePerMTok: { input: 0.6, output: 3.6 },
+    contextLength: 262_144,
+    pricePerMTok: { input: 0.5, output: 2.2 },
     trials: measured(3, 3, 13),
   },
 
   // ── Frontier vendors: cheapest first ─────────────────────────────────────────
+  {
+    provider: "openrouter",
+    id: "openai/gpt-5.6-luna",
+    label: "GPT-5.6 Luna",
+    contextLength: 1_050_000,
+    pricePerMTok: { input: 0.2, output: 1.2 },
+    trials: measured(3, 3, 27),
+  },
+  {
+    provider: "openrouter",
+    id: "openai/gpt-5.6-luna-pro",
+    label: "GPT-5.6 Luna Pro",
+    contextLength: 1_050_000,
+    pricePerMTok: { input: 0.2, output: 1.2 },
+    trials: measured(3, 3, 69),
+  },
   {
     provider: "openrouter",
     id: "google/gemini-3.5-flash-lite",
@@ -219,28 +235,12 @@ export const MODEL_PRESETS: readonly ModelPreset[] = [
     pricePerMTok: { input: 0.3, output: 2.5 },
     trials: measured(2, 3, 20),
   },
-  {
-    provider: "openrouter",
-    id: "openai/gpt-5.6-luna",
-    label: "GPT-5.6 Luna",
-    contextLength: 1_050_000,
-    pricePerMTok: { input: 1.0, output: 6.0 },
-    trials: measured(3, 3, 27),
-  },
-  {
-    provider: "openrouter",
-    id: "openai/gpt-5.6-luna-pro",
-    label: "GPT-5.6 Luna Pro",
-    contextLength: 1_050_000,
-    pricePerMTok: { input: 1.0, output: 6.0 },
-    trials: measured(3, 3, 69),
-  },
   {
     provider: "openrouter",
     id: "google/gemini-3.6-flash",
     label: "Gemini 3.6 Flash",
     contextLength: 1_048_576,
-    pricePerMTok: { input: 1.5, output: 7.5 },
+    pricePerMTok: { input: 0.75, output: 3.75 },
     trials: measured(3, 3, 16),
   },
   {
@@ -256,7 +256,7 @@ export const MODEL_PRESETS: readonly ModelPreset[] = [
     id: "openai/gpt-5.6-terra-pro",
     label: "GPT-5.6 Terra Pro",
     contextLength: 1_050_000,
-    pricePerMTok: { input: 2.5, output: 15.0 },
+    pricePerMTok: { input: 2.0, output: 12.0 },
     trials: measured(3, 3, 38),
   },
 
@@ -303,7 +303,7 @@ export const MODEL_PRESETS: readonly ModelPreset[] = [
     id: "mistralai/devstral-2512",
     label: "Devstral 2512",
     contextLength: 262_144,
-    pricePerMTok: { input: 0.4, output: 2.0 },
+    pricePerMTok: { input: 0.44, output: 2.2 },
     trials: unreachable(ACCOUNT_PRIVACY),
   },
 ];