Release notes

Added

• Spanish and French. Spanish comes in two versions, for Spain and for Latin America, each using the words macOS uses there (Ajustes del Sistema or Configuración del Sistema).
• The Chrome extension's options page speaks the same languages.

Changed

• The README links the website, cumbanotch.com.
• English counts read right in the singular ("1 File", "1 more request waiting").
• Turkish reads more naturally and uses the words Chrome and macOS use in Turkish (uzantı, ekran resmi, izleme dörtgeni, Oturum Açma Öğeleri).
• Short texts beside the notch and in notifications stay short in every language.

Added

• A Citrus theme: a fresh yellow-green on dark olive, with a lemon edge and rounded text.

• A new Settings window, laid out like System Settings: a searchable sidebar with pages in three groups (General, Appearance, Displays, Behavior, Indicators and Permissions; Widgets, with a page for each widget that has settings; Agents and Connections). Each page starts with its icon, title and what it's for, rows explain themselves with an ⓘ, and switches sit on the right.

• Notes is your Apple Notes: the most recent notes like Apple's Notes widget, a click opens one in Notes, and a new note can be typed in the panel. Cumba reads Notes through AppleScript (Automation access, asked once), starts Notes in the background when needed and never changes an existing note. The note kept by earlier versions moves to Apple Notes once.

• A To-dos widget for Apple Reminders: a list's open reminders with round checkboxes, overdue dates in red, and a line to add one. Ticks and new reminders sync to your other devices through Reminders.

• Widgets look like Apple's: each one's symbol and name in its own color above the content.

• Widgets are set apart by a faint line instead of cards (Appearance > Widgets: Lines or Cards).

• A tab holds as many widgets as fit on the screen: the panel grows wider instead of squeezing them, and only when the screen is full does it say there's no room, in the panel and in Settings alike. The panel also grows taller when a widget needs it, such as a long answer from an AI agent, and switching tabs animates both.

• Settings > Behavior > Opening Tab: open the panel on a tab of your choice or the one it was left on, and choose whether it opens on the agents' tab while Claude Code or Codex works.

• The first time Cumba starts, the notch opens and writes "hello" in one colorful stroke, like a new Mac, before the welcome window. Play it again from Settings > General > Hello animation. With Reduce Motion the word fades in.

• Tab bar styles (Appearance > Tabs): Compact, a bar of its own under the panel with the open tab's name; Symbols; Dots; In the Panel; and At the Top. New installations use Compact; your earlier choice carries over. Themes and tab styles are picked from cards with a small preview.

• Agent notifications: when Claude Code or Codex asks a question, wants a plan approved, needs permission, finishes or stops with an error, a notification opens under the notch. It shows the agent's mark with a badge, a title that says what happened ("Claude is asking a question"), the project, one line of detail and Open, which brings the app the agent runs in to the front (or opens the panel). It then folds into the agent's mark and a badge beside the notch; questions and requests stay there until answered. Resting the pointer on a notification keeps it open.

• Clipboard History shows your recent copies as cards, like a clipboard manager: text, links, images and files, each with the app it came from and when. Click a card to copy it again; right-click to remove it. Optionally, new screenshots are added as macOS saves them (Settings > Widgets > Clipboard History > Add new screenshots; macOS asks once for access to the screenshot folder).

• Volume and brightness levels have their own color in each theme: the theme's colors, white, blue, green, orange, pink or purple (Appearance > Colors > Volume and brightness). Classic, Glass and Midnight use white; Neon Tokyo, Sakura, Synthwave, Violet Night and Citrus use their own colors.

• A low battery (20% or less, on battery) stays beside the notch as a red ring and the percentage until the charger is plugged in. Turn it off in Settings > General > Indicators.

Changed

• The README's title and banner show the name written in script, as on the website, in the light or dark version that fits GitHub's theme.
• The repository moved to github.com/LJASP-studio/Cumba, the home of LJASP's projects. Old links redirect, and the update check uses the new address.
• Tabs slide like pages: a two-finger swipe drags the open tab with your fingers while the next one comes in beside it, the page being left fades, and letting go far enough opens the next tab. Clicking a tab slides the pages the same way.
• The closed notch reaches a little past the camera housing, so you can see it's there. Set how far in Appearance > Panel Size (Closed notch width and height); the panel closes while you drag them, so you see the result. Music, timers and other things beside the notch are as tall as the closed notch, and at zero both are exactly the size of the camera housing.
• Built-in themes can be changed again (material, colors, font, shape, animation). They keep their names, your changes are saved with them, and Restore Defaults brings back the original. They can't be deleted.
• Volume and brightness changes beside the notch use a larger symbol and a longer bar.
• Claude Code's pixel mascot replaces the sparkle for Claude sessions.
• Hooks now also send the bundle identifier of the app the agent runs in. Installed hooks show as out of date once; Settings opens on Agents at launch, where Update fixes them.
• When macOS asks for access to Desktop, Documents or Downloads (screenshots in Clipboard History, files on the Tray), it now says why.
• The notch works in full screen apps too. Hiding it there is now off by default; turn on Hide in full screen apps in Settings > Displays to keep the old behavior. A choice you made earlier stays.
• Allow from the notch now covers everything except shell commands by default (Claude Code's Bash and Codex's shell tools); choose All requests in Settings > Agents to allow those too. A choice you made earlier stays.

Fixed

• The notch no longer spins on for a Claude Code turn you interrupted with Esc, which sends no Stop, or for one that went silent for half an hour. The session says Stopped.
• A second copy of Cumba (a test run, or another build) no longer takes the Claude Code socket from the one you use, which left the notch frozen on the last step. It waits until the first copy quits.
• In full screen apps the notch no longer hides behind the app's title bar when the menu bar slides down.
• Live streams (a YouTube live broadcast, say) no longer stop Now Playing: their endless duration crashed the helper, and the media widget stayed empty until Cumba was restarted.
• Opening the gallery or editing a tab no longer makes the panel narrower, which could leave the pointer outside and close it. The panel keeps its width until it closes or you switch tabs.
• The Weather widget no longer asks for a forecast at launch when the panel is closed; it fetches only while it's on screen.
• The backup of Codex's hooks is named hooks.json.bak-… instead of settings.json.bak-….
• The permission badge beside the closed notch shows again; it was drawn black on black.
• In a narrow AI Agents widget, In Terminal moves to a second row instead of being cut off, and Progress no longer wraps.
• The Turkish translation addresses you the same way everywhere.

Security

• The Chrome extension's connection now runs on Apple's Network framework. With the previous HTTP library, the time to read a request grew with the square of its longest line, so one long request from an app on this Mac or a web page could keep a CPU core busy for minutes. Such requests are now dropped at once, messages are capped at 64 KB, and connections that don't finish the handshake and say hello within 2 seconds are closed.
• When a permission request is longer than the card's box, Allow waits until you've scrolled to its end, and the scroll bar always shows.
• Out-of-date hooks open Settings > Agents at launch. The HTTP hooks of v0.6.0 and v0.7.0 post to a local port another app could take and answer in Cumba's place, so they should be updated.
• A permission request whose command hides behind a run of blank lines shows the run as "⟨n line breaks⟩" and can only be answered with Deny or In Terminal, like long runs of spaces. The project and tool names above the request are checked the same way.
• The update check skips release tags that aren't versions; a mistyped tag would have crashed Cumba at launch.
• A Reminders list name is shown as written, so a name that looks like a Markdown link doesn't become one.
• Now Playing titles from other apps and web pages are cut at 300 characters, like the extension's.
• Clipboard History also skips copies that password managers mark with older markers (1Password's and others).
• Errors of the local servers no longer write the path of your home folder to the system log.

Added

• Volume and brightness changes show in the notch, on by default (Settings > General > Indicators). Either can also replace the system indicator, which needs Accessibility. Brightness uses the private DisplayServices framework, since Apple silicon has no public brightness API.
• New widgets in the gallery: Notes (one quick note, saved as plain text), Clipboard History (last 20 copied texts, in memory only, passwords skipped), Keep Awake, Pomodoro and Teleprompter (scrolls a script under the camera and can hide the panel from screen sharing).
• Calendar: a Join button for Zoom, Meet, Teams, Webex, FaceTime, Whereby and Jitsi links, and an optional countdown before the next event.
• Settings > General: show the panel on the display with a notch, the main display or the display with the pointer; a dot while the microphone or camera is in use; and the app's own CPU and memory use.
• Media sources can be turned off one by one.
• Script activities (Settings > Connections > Scripts): your own scripts can show a status or progress beside the notch through the private socket, with their own token.
• Right-click the notch for Settings, Reset Panel and Quit, so they're reachable even when the menu bar icon hides behind the notch.
• A widget gallery in Settings > Widgets: every widget with a short description and an Add or Remove button. Widgets in a tab reorder by dragging.
• Settings > Permissions shows the live state of every permission, with one button to ask or to open System Settings.
• Swipe sideways with two fingers on the open panel to move between tabs. A swipe over something that scrolls sideways, like the calendar's days, scrolls that instead.
• Calendar: scroll the days or click one to see that day's events; alone in its tab, scroll up and down through the months and click a day. Click the month to go back to today. Resting the pointer on an event shows its location and notes, and events that are over are dimmed.
• Weather: click one of the coming days to see it, and click it again to go back to now; alone in its tab, the hours scroll sideways through the next day or the day you picked.
• AI Agents: with several sessions, click "+N" to step through them.
• Four new built-in themes: Neon Tokyo (deep indigo with a pink to cyan neon edge and monospaced text), Sakura, Synthwave and Violet Night. Themes can now fade the background into a second color (Appearance > Material > Gradient) and draw a glowing neon edge around the open panel (Appearance > Colors > Neon edge).
• A welcome window on first launch: how to open the panel, where Settings are, how to connect apps, and a Launch at login switch. It asks you to move the app to Applications when it runs from somewhere else.
• Releases include a .dmg with an Applications shortcut next to the .zip.
• README sections on uninstalling.
• Release downloads carry signed build provenance; check them with gh attestation verify. Releases are immutable once published.
• README banner, also used as the GitHub social preview.
• Settings > Claude Code: choose what can be allowed from the notch (everything, everything except shell commands, or nothing), and copy the hook token for manual setup.
• README sections on project status, verifying a download before opening it, and the permissions the app uses and when; SECURITY.md explains how releases are built and maps the security-relevant code.

Changed

• cumbaNotch is now Cumba, made by LJASP. The app, the disk image, the Chrome extension and the repository use the new name; the bundle identifier stays, so settings and Keychain tokens carry over. The app moves its folder in Application Support from cumbaNotch to Cumba on first launch. Claude Code hooks from earlier versions show as out of date: click Update… once in Settings > Claude Code. Load the Chrome extension again from the new app. The hook and script token header is now X-Cumba-Token.
• New app icon and menu bar icon: the notch resting on the brackets of a cumba, gold on deep navy.
• Tabs sit at the bottom of the panel by default (Settings > General > Tabs: at the bottom or at the top), with "+" to add a widget from a gallery and an Edit button. Editing a tab in the panel renames it, picks its symbol, moves it, adds or deletes tabs, and reorders or removes its widgets. Right-click a widget to remove it.
• The panel's width follows the open tab: as wide as its widgets, with room for a detailed view when a tab has one widget.
• The Claude Code widget is now AI Agents and also follows Codex (through its hooks in ~/.codex/hooks.json; trust them once with /hooks in Codex). It shows the session's title, what it's doing now ("Editing Notch.swift", "Running tests"), its last answer, and on a second page how full its context window is, read locally from the session transcript. While an agent works, a turning ring sits beside the closed notch, opening the panel shows the agent's tab, and a line under the notch shows the answer when it finishes. Installed Claude Code hooks show as out of date once, since two tool events were added; click Update in Settings > Agents.
• Widgets alone in a tab show a detailed view, and a compact one beside others. Weather looks like Apple's widget (sky colors, place, high and low, the next days, and the next hours when alone) and is now two units wide. Calendar shows the month with a week strip and the next events, or the whole month beside the list when alone. Media shows large artwork with the title and controls when alone.
• While something plays, the closed notch shows larger artwork and a larger waveform, sized to the notch. The Mirror widget turns the camera on only when you click it.
• Text size for the panel (Appearance > Panel Size > Text size), larger by default.
• A widget can be in several tabs; adding it to one tab no longer takes it out of another.
• The closed notch is always black over the hardware notch, whatever the theme's background color.
• The panel's width, height, indicator width and text size are set once in Appearance > Panel Size and stay when you switch themes; a theme sets only the look (material, colors, font, corner radius, shadow and animation). The size saved in an older custom theme carries over once, and theme files no longer store sizes.
• Weather shows the weather where you are by default (Location Services, rounded to about 10 km); choosing a city still works. Calendar and Weather ask for access with one click right in the widget.
• Built-in themes keep their names and settings. New Theme… in Appearance makes your own theme from the selected one under a name you choose, and your themes can be renamed any time. The Settings window shows the open pane's name as its title.
• Media reads whatever any app plays from the system's Now Playing: Safari, Chrome, YouTube, Spotify, Music, podcasts and more, with no extension or Automation access. This uses the private MediaRemote framework through a small helper run by the system's perl; the README explains it. Turn off "Read media from every app" for the previous behavior. The YouTube extension is now optional.
• New installations start with Media, Calendar and Timer; the other widgets, and widgets added in later versions, wait in the gallery. Installing the Claude Code hooks adds the Claude Code widget.
• Dragging a window or a browser tab past the notch no longer opens the panel; dragging files still does.
• Settings has no minimize button, reopens on the last pane and shows the pane's name as its title.
• Calmer motion: the lowest spring damping a theme can use is 0.7. Increase Contrast draws a clear panel rim, and Reduce Transparency replaces glass with an opaque fill.
• Empty and error states in widgets open the Settings pane that fixes them. The welcome window starts with a live "try it" step.
• The Chrome extension connection is off until you turn it on in Settings > Connections; if you use the extension, turn it on and paste the new extension token into its options.
• With Reduce Motion turned on in System Settings, the panel opens and closes with a short ease instead of a spring.
• Questions and ideas go to GitHub Discussions; issues are for bugs and concrete feature requests.

Fixed

• When Claude Code asks a question or wants a plan approved, the notch no longer shows it as a permission request with Allow and Deny; Claude Code asks it itself, and the notch shows that the session is waiting, with the question under the notch.
• Long tool and project names, and the edges of icons, beside the closed notch are no longer cut off.
• Notes were never saved: macOS 26.6 refuses writes with complete file protection. The note is now written atomically and readable only by you.
• Context menus inside the panel (e.g. on files in the tray) now open; the notch's own menu used to replace them.

Security

• Script activities are off by default, use their own token on the private socket, are escaped like permission requests and can't be clicked. The volume key handling sees only media key events, never typing, and is off by default.
• Nothing listens unless you use it: the extension server runs only while the extension connection is on, the hook socket only while hooks are installed.
• The hooks and the extension have separate tokens, so the hook token in ~/.claude/settings.json can't be used on the extension's port.
• Allow from the notch can be limited, and the limit is enforced when the answer is sent, not only in the UI.
• The hook installer refuses to save if the settings file changed in any byte since the review, and says when saving will also reformat it.
• The release build uses a pinned, checksummed XcodeGen instead of the latest Homebrew version.

Added

• Update check against GitHub Releases at launch and once a day, with an optional pre-release channel and a menu bar item when a newer version exists.
• Copy Diagnostics in Settings > General for bug reports, without tokens, paths or personal data.
• Optional haptic tap when the panel opens.
• Manual test checklist in docs/manual-tests.md.

Changed

• Panel polish: content materializes from a slight blur, a hairline edge, hover and press feedback on every control, animated tab and pin symbols, and an album-art glow on the media card.
• Artwork is decoded once per track off the main thread.
• README rewritten for the first stable release.

Security

Fixes from an independent security review:

• Claude Code hooks now reach the app through a Unix socket in a folder only your account can open, using command hooks with curl, instead of HTTP on a TCP port. Another user or a sandboxed app could otherwise have taken the port while the app was closed and approved commands. Update the hooks in Settings > Claude Code.
• The permission card shows the full request, makes control, direction and zero-width characters and long space runs visible, offers no Allow button for suspicious requests, and arms its buttons only after a short delay.
• The extension socket accepts only the cumbaNotch extension (fixed extension ID) and closes on anything but a valid hello; the extension keeps the token away from content scripts.
• Both local servers restart after a failure.
• The hook installer recognizes only its own entries, resolves symlinks, refuses to touch a settings file it can't read, keeps backups private and masks the token in the diff.
• The token is copied as concealed and cleared from the clipboard after a minute.
• Artwork is fetched only from Spotify and YouTube image hosts, streamed with a size cap.
• Release builds run without write access; only the publish step can write. FlyingFox and all actions are pinned to commits; checkout without persisted credentials; Dependabot for actions.