Changelog

• Private vault. The owner can switch a vault between Connected and Private. Mobile, the browser extension and the CLI open Private items with a key that stays on the device, and AutoFill lists them locked and never fills them.
• Sign in with Kutrion through your browser. Kutrion Terminal, Kutrion Transfer, vt-relay and the Chrome and Edge extension approve sign-in in the browser. vt-relay renews its session silently.
• The CLI borrows the desktop app’s sign-in, and kt enroll and kt broker-ca manage broker-held SSH identity.
• A redesigned New credential screen on mobile, with password history, and Android AutoFill that updates saved logins and offers a generated password.
• Passkeys in the extension popup, with detail and delete.
• Amber vault is the default theme in every client.
• Clearer refusals. Device limits, deployment switches and platform flags now say what happened.

• Superseded by 1.1.9. 1.1.8 was prepared for Kutrion Terminal and Kutrion Transfer and never reached the downloads page or the update feeds. Everything it was meant to carry is in 1.1.9.

• Kutrion Terminal and Kutrion Transfer on macOS. Both apps now have macOS downloads for Apple silicon and Intel, next to Windows and Linux. The macOS builds are unsigned, so macOS stops them the first time you open them; the downloads page shows the one extra step.
• Terminal tabs come back after a dropped connection. A brokered tab reattaches to its shell and replays what you missed, and says Reconnected when it has.
• A first-use host key is confirmed in place. When Terminal refuses a host it has not seen before, you can check and accept its key from the refused tab.
• Replace a device at your plan’s limit. Terminal and Transfer offer to replace an existing device when signing in would go over your plan’s device limit.

• Organizations that require a compliant device work beyond the phone. The browser extension, Kutrion Terminal, Kutrion Transfer and the desktop app now report the device’s state to your server, so an organization that requires a compliant device no longer blocks reveals from them. The extension reports only your operating system and its version. The desktop apps report disk encryption, and on macOS a screen lock, only when the system confirms it.
• Certificates instead of stored keys for enrolled hosts. Connecting to a host your organization has enrolled uses a short-lived certificate made for that one connection, so no stored key or password is read.
• Secrets are filtered out of recordings. Recognized secrets are replaced with a marker before a recording is stored, and replays say when a recording was filtered.
• AI in Kutrion Terminal, on your own network. Ask for a command in plain words, explain selected output, summarize a session from its receipt, and ask the audit trail a question.
• More in Kutrion Terminal. Owners and admins see live sessions, whether each is recorded, and can end one. Access Requests shows your time-limited access requests and the ones waiting for you. The host list shows each host’s activity, and scrollback search and a Recordings view are built in.
• Shared hosts and saved commands. Hosts can be shared through a vault, and saved commands live in vaults and can be inserted or run from any terminal. Every use is recorded.
• Recording review. Organizations can turn on recording review with a retention period, and members are told when their sessions may be reviewed.
• Authenticator keys in the extension. Add or replace a login’s authenticator key from the extension. A login whose key your server keeps back shows “2FA configured”.

• Large uploads in Transfer. Uploads used to fail after 30 seconds or above about 100 MB. Large files now go up in resumable pieces, and the time limit runs on progress rather than on the whole transfer. A file too large for your instance’s content inspection is refused before anything is sent, with the limit named.
• Transfer asks before it overwrites. Copy to other pane now offers Replace, Keep both or Skip when the name already exists, in every direction. An upload in progress can be canceled.
• Transfer reorganised. Connections and Settings sit in one side panel beside your files, each connection has an Open action, Automation is its own view that keeps your place in Files, and the panes gain Refresh, Sort, Properties and Show in file manager.
• Terminal opens sessions at the right size. A brokered shell now starts at the size of its pane instead of 80x24, the host list loads as soon as you sign in, and a connection your plan has locked is marked on its row, with the reason, before you try it. Settings no longer resizes a live session, and closing Settings or Forwards returns focus to where you were.
• Kutrion API keeps your work. Saving a tab updates it in place. Closing tabs or signing out with unsaved edits asks first, and drafts survive a crash in the main panel. Settings, About has a check for updates that says plainly whether one is available.
• One sign-in across the clients. The extension, Terminal, Transfer and Kutrion API share one sign-in layout and one set of messages when a sign-in is refused. When an action needs you to confirm who you are, Kutrion API accepts a passkey or security key through your browser as well as an authenticator code.
• Links are checked before they open. A link clicked in terminal output shows its full destination and asks before opening, and only https links are offered. Kutrion API and the desktop app check where every link goes before handing it to your browser.
• Extension. Holding Enter on a code field no longer spends several verification attempts at once.
• Command line. kt mcp status reports each AI client’s connection on its own row, and when you are signed out the error names the sign-in command again.

• Authenticator codes work once. A six-digit code that has just been accepted is refused if it is entered again, at sign-in, at a confirmation prompt or when adding an authenticator. Wait for the next code instead. A code refused for another reason is not used up.
• Invitation links. An invitation now arrives as a link. Opening it goes straight to registration in the web portal, and the invitation is removed from the address bar once it has been read.
• Sign-in follows the server’s signup setting. The web portal, the browser extension, Kutrion Terminal, Kutrion Transfer and Kutrion API offer “Create account” only where anyone can register. On an invitation-only server they say so and offer “Have an invitation? Register”, and where nobody registers they show no register path at all. Registration answers every address the same way.
• Transfer can cancel a download. Downloads, including whole folders, now offer Cancel. A canceled download leaves no partial file behind. Cancel keeps keyboard focus while it works.
• Command line. The CLI refuses to follow a redirect when it sends data and tells you which address to use instead. Settings saved with older VT_ environment variable names keep working alongside the KT_ names.
• Safer redirects in Terminal and Transfer. When a server answers a sign-in or an upload with a redirect, the app stops and tells you where the server has moved instead of following it. Redirects that are followed no longer carry your sign-in to another site, and a redirect from https to http is refused.
• Transfer finishes an interrupted upload. If the connection drops just as the last piece of a resumable upload lands, the retry now sees the upload as complete instead of sending the file again.
• One look across the apps. The apps share one set of icons and one theme picker. Disabled controls on Terminal’s sign-in panel stay readable in every theme.
• Clearer words in the web portal. Every sign-out control says Sign out, the organization page is Organization settings, saved workspaces are now Saved layouts, and the authenticator field is Authenticator key. Your saved layouts and links keep working.
• The site says what you can download. The home page, product pages and FAQ now list only the platforms on /downloads: no macOS desktop app or Safari extension, and the mobile app is marked as not yet published.

• 1.1.4 on the download page. The Kutrion desktop app, Kutrion Terminal and Kutrion Transfer for Windows (x64) and Linux (x86_64), Kutrion API for Linux, the browser extension for Chrome and Firefox, and the kt command line are published at 1.1.4. The desktop builds are still unsigned.
• Transfer opens a new connection on FTPS. A fresh connection form used to start on plain FTP, which sends the username and password in the clear. It now starts on FTPS, the same server and port with TLS, and lists the encrypted protocols first. Connections you have already saved are unchanged.
• Transfer’s first run no longer leaves you stuck. On a new account the form now takes you straight to Vaults in the portal to store the credential it needs. Required fields stay quiet until you have touched them, and the banner can be dismissed.
• Terminal keeps its host list usable in a short window. Below roughly 600px of height the host list used to disappear entirely. It now scrolls, and the “Open a local shell” button on the error card is always reachable. With several sessions open, each tab shows its host name again.
• Kutrion API’s portal links open the right page. Sign-in, sign-up, password recovery, Vaults and Settings each open the page their label names instead of the marketing site.
• Open in Terminal works. The extension’s Open in Terminal action now brings the saved connection into view in Kutrion Terminal and offers Connect, whether the app was already running or not. Selecting a host never starts a session by itself.

• 1.1.3 for Windows and Linux. The Kutrion desktop app, Kutrion Terminal and Kutrion Transfer are published at 1.1.3 for Windows (x64) and Linux (x86_64), and Kutrion API at 1.1.3 for Linux. Every build is still unsigned, and the download page says what each operating system does on first launch.
• The macOS downloads are withdrawn. The only macOS images ever published — the desktop app and the API client at 1.1.0 — were built under the product’s former name and install as that application, with its own identity and no updater. They have been taken off the download page rather than left there as if they were current. If you installed one, nothing will update it: remove it, and take the Kutrion build once a macOS build is published. That build installs as a separate app beside the old one — sign in again on the new app and move the old one to the Trash.
• Linux upgrades in place. The .deb declares the package name it replaces, so apt retires the package installed under the former name and installs this one in a single step.
• Windows is a first install. Nothing was published for Windows under the former name, so there is no earlier app to upgrade from or to remove.

• Marketing-matched sign-in. The login screen now carries the public site’s identity with a product showcase, and stays consistent across email verification and invite-acceptance.
• Responsive web portal. The dashboard works on small screens — the sidebar collapses to an off-canvas drawer and headers adapt down to mobile.
• Platform SSO console. Instance admins can manage shared social-login providers (including OAuth2/GitHub) from a dedicated, gated surface.

Added Urban slate, Neutral elegance, and Amber walnut to the theme picker — three new looks for the vault and terminal, alongside the existing set.

Shared vaults now show who else is active, with presence indicators and session locks so two people working in the same vault don’t clobber each other’s edits.