Highlights 🌟

• ⌨️ CrossPaste CLI Every desktop package now ships a native command-line tool, crosspaste (macOS offers a one-click terminal command install on first launch, and Windows offers one-click add-to-PATH). Copy with a pipe (echo hello | crosspaste), paste, search history with the same filters as the search window, pick entries in a full-screen fuzzy picker, edit an entry in $EDITOR, and stream new pastes live with watch — plus pair devices and run the app headless on servers, all from the terminal and your scripts. In sixel-capable terminals, clipboard images even preview inline as real pixels. See the CLI guide for every command and example (#243 [#3828] [#4769] [#4771] [#4776] [#4778] [#4780] [#4782] [#4786] [#4788] [#4790] [#4809] [#4812] [#4815] [#4817] [#4822] [#4824] [#4826] [#4828] [#4836] [#4841] [#4849] [#4850] [#4851] [#4852] [#4859] [#4893]).

• 🔐 Next-generation device pairing Device pairing now verifies a one-time 6-digit PIN — rotating every 30 seconds on the accepting device — through a SPAKE2 (RFC 9382) password-authenticated key exchange, so nothing on the network can intercept the pairing or learn anything from a wrong guess, and cumulative online PIN guesses are capped. The elliptic-curve arithmetic runs on a constant-time OpenSSL libcrypto pinned and bundled with the app, with a fail-closed startup probe. Devices on older versions keep pairing through the previous flow (#4859 [#4861] [#4863] [#4865] [#4867] [#4869] [#4875] [#4877] [#4881]).

• 🪟 More reliable Windows clipboard capture Rapid clipboard bursts are coalesced into one snapshot through a single-consumer pipeline, fixing interference with Snipping Tool's PrtScr auto-save on Windows 11; duplicate image records from a single copy are deduplicated; and SQLite's busy timeout now takes effect, fixing sporadic write failures under contention (#4737 [#4791] [#4793] [#4796] [#4798] [#4799]).

• 🎨 UI improvements The UI framework is upgraded to Compose Multiplatform 1.12, and following the system light/dark mode is now correct from the very first frame — no more flash at launch. The system tray now shares a single implementation across macOS, Windows, and Linux; the main window height is clamped to the usable screen area so the bottom of the UI can no longer end up below the screen edge; long paste titles clipped in the side panel show a tooltip on hover and title edits are committed when focus moves away; and the settings font dropdown now closes in a single click (#4759 [#4761] [#4885] [#4886] [#4887] [#4901] [#4902] [#4903]).

Bug Fixes 🐛

• :bug: Show tooltip for clipped paste title and commit title edit on focus loss (#4903)
• :bug: Trim surrounding whitespace when creating UrlPasteItem (#4899)
• :bug: Stop pushing pastes to stale disconnected sync rows (#4895)
• :bug: Drain sessions in WsSessionManager.closeAll to fix concurrent iteration flake (#4890)
• :bug: Use origin.remoteAddress instead of remoteHost in pairing v3 routes to avoid a blocking reverse DNS lookup (#4875)
• :bug: Read trust request bodies before taking the per-peer pairing lock (#4871 [#4873])
• :bug: Unwrap wrapped crypto failures so key mismatch surfaces as DECRYPT_FAIL (#4870 [#4872])
• :bug: Cap cumulative pairing v3 online PIN guesses and harden OpenSSL secret hygiene (#4867)
• :bug: Map missing native graphics library to actionable 503 in CLI image route (#4857)
• :bug: Guard cli build script host lookups on unsupported K/N hosts (#4856)
• :bug: Survive mordant's native-Windows raw-mode timeout and restore console modes on exit (#4826)
• :bug: Harden TaskExecutor: tolerate corrupt extraInfo, rethrow cancellation, no-throw submit after shutdown (#4806)
• :bug: Apply sqlite pragmas via connection properties so busy_timeout takes effect (#4799)
• :bug: Discard duplicate local image records via short-window keep-first dedup (#4798)
• :bug: Coalesce Windows clipboard bursts into one snapshot via a single-consumer pipeline (#4796)
• :bug: Harden the headless mode startup and shutdown paths for daemon use (#4782)
• :bug: Give blocked CLI config keys accurate per-key hints (#4774)
• :bug: Reject CLI config keys requiring runtime workflows (#4773)
• :bug: Reject lossy CLI config conversions (#4772)
• :bug: Clamp the main window height to the usable screen area (#4761)

New Features ✨

• :sparkles: Surface v3 PINs via crosspaste token with acceptance-window arming (#4893)
• :sparkles: Let clicks outside the font dropdown pass through instead of being swallowed (#4887)
• :sparkles: Add a redacted telemetry observer seam to PairingProtocolV3Service (#4881)
• :sparkles: Roll out pairing v3 by advertising PAIRING_VERSION 3 gated on the bundled backend (#4877)
• :sparkles: Add crosspaste token command for acceptor-side pairing code display (#4859)
• :sparkles: Wire sixel rendering into paste inline previews and the pick panel (#4852)
• :sparkles: Add sixel terminal capability probe with DA1 confirmation (#4851)
• :sparkles: Add raw RGBA transcode endpoint for CLI image previews (#4850)
• :sparkles: Add pure-Kotlin sixel encoder with median-cut quantization (#4845 [#4849])
• :sparkles: Let a PATH-installed CLI auto-discover a dev app instance (#4843)
• :sparkles: One-click add-to-PATH for the Windows CLI on non-MSIX installs (#4841)
• :sparkles: Show the command line extension entry on every platform and in dev runs (#4836)
• :sparkles: Make edit update the paste in place instead of copying a new entry (#4828)
• :sparkles: Add a watch command streaming new pastes over an NDJSON feed (#4824)
• :sparkles: Add an interactive pick command with a full-screen fuzzy picker (#4822)
• :sparkles: Merge the search command into history with search-window-parity filters (#4817)
• :sparkles: Add an edit command that round-trips a paste through $EDITOR (#4815)
• :sparkles: Treat piped stdin to bare crosspaste as implicit copy and add c/p/h command aliases (#4812)
• :sparkles: Support targeting a dev app instance via CROSSPASTE_USER_DATA_DIR and a :cli:run task (#4810)
• :sparkles: Fit CLI list previews to the terminal width with cell-accurate truncation (#4809)
• :sparkles: Dump image bytes and render inline terminal previews from the CLI (#4790)
• :sparkles: Launch the headless daemon from the CLI and document daemon deployment (#4788)
• :sparkles: Pair devices from the terminal via the /cli pairing API (#4786)
• :sparkles: Improve the CLI terminal experience with pipes, formats, colors, and exit codes (#4780)
• :sparkles: Offer to install the crosspaste terminal command on macOS (#4778)
• :sparkles: Probe app liveness and auto-start the desktop app from the CLI (#4771)
• :sparkles: Serve a local /cli API over a unix domain socket and make the CLI a pure HTTP client (#4769)

Multiplatform · Refactor · Code Style 🔨

• :hammer: Unify the system tray across all three platforms on ComposeNativeTray (#4902)
• :hammer: Make TokenInputRow expect/actual so mobile can provide a flicker-free input (#4900)
• :hammer: Resolve system dark theme directly in composition via dynamic isSystemInDarkTheme (#4886)
• :hammer: Restrict production libcrypto loading to the bundled library with fail-closed startup probe (#4865)
• :hammer: Replace BouncyCastle SPAKE2 EC backend with constant-time OpenSSL via JNA (#4861)
• :art: Downgrade expected heartbeat decrypt-failure logs to warn without stack trace (#4838)
• :art: Clean up Gradle 9 deprecation warnings and Kotlin compiler warnings (#4833)
• :hammer: Derive CLI version at build time and add a cli compile gate to CI (#4767)
• :art: Focus the first token input box when the pairing dialog opens (#4758)
• :art: Auto-close the v3 pairing card when the session is cancelled (#4756)
• :art: Drain the v2 token countdown bar to match v3 pairing cards (#4754)

Build & CI 👷

• :construction_worker: Auto-download the pinned libcrypto for development runs so pairing v3 loads without a system OpenSSL (#4869)
• :construction_worker: Bundle pinned OpenSSL libcrypto into desktop packages via Conveyor (#4863)
• :construction_worker: Bump Conveyor CLI in CI packaging workflows from v21.0 to v22.1 (#4839)
• :construction_worker: Split the CLI native build into a parallel path-gated CI job (#4803)
• :construction_worker: Tier the test suite so PRs run fast tests and releases run integration suites (#4801)
• :construction_worker: Suppress expected Kotlin/Native disabled-target and cinterop commonization warnings (#4784)
• :construction_worker: Ship the CLI binary in all desktop packages (#4776)
• :white_check_mark: Add an --advertise-address option to the e2e harness (#4752)

Dependencies ⬆️

• :arrow_up: Bump ComposeNativeTray from 1.3.3 to 2.1.3 for Compose 1.12 support (#4901)
• :arrow_up: Bump io.coil-kt.coil3 from 3.5.0 to 3.6.0 for Compose 1.12 support and GIF/AsyncImage rendering fixes
• :arrow_up: Bump com.mohamedrejeb.richeditor:richeditor-compose from 1.0.0 to 1.1.0 for Compose 1.12 support and a clipboard fix (#4891)
• :arrow_up: Bump gradle-wrapper from 9.7.0 to 9.7.1 (#4889)
• :arrow_up: Upgrade Compose Multiplatform to 1.12.0 (#4885)
• :arrow_up: Bump io.github.vinceglb:filekit-dialogs from 0.14.2 to 0.15.0 (#4819)
• :arrow_up: Bump ch.qos.logback:logback-classic from 1.6.1 to 1.6.3 (#4818)
• :arrow_up: Bump org.bouncycastle:bcprov-jdk18on from 1.85 to 1.85.2 (#4765)
• :arrow_up: Bump org.jetbrains.compose.hot-reload from 1.1.1 to 1.2.0 (#4764)
• :arrow_up: Bump gradle-wrapper from 9.6.1 to 9.7.0 (#4763)
• :arrow_up: Bump postcss to 8.5.26 to fix source map disclosure advisories (#4762)