変更履歴

Paneflow の公開済み全バージョンと、GitHub から直接同期したリリースノートを新しい順に表示します。

v0.11.0最新

2026年9月2日GitHub で見る

A tab is a worktree, and the terminal is faster

Paneflow 0.11.0 gives a tab a git identity. Picking a branch from the "New pane" palette or a tab's context menu creates or reuses a worktree under <workspace>.worktrees/ and starts the pane there, so a workspace of parallel agents stops fighting over one checkout. "Remove worktree" in the same menu takes it back down, with the guards that keep a checkout you still need from disappearing.

The other half of the release is the terminal pipeline. Four stages were doing redundant work, most of it invisible on Linux and very visible on Windows. On the project's eight-pane render benchmark the median input-to-frame time drops 32%, its 95th percentile 26%, and total CPU 35%. A pane sitting at its prompt wakes 9 times a second on Windows instead of 64.

No configuration key changes meaning, the session format stays at v2, and there is no breaking change in this release. Install over 0.10.x and launch.

Behavior changes

The terminal publishes frames on a display's schedule, not the PTY's

The runtime thread used to rebuild and publish a full grid snapshot for every output batch, and OUTPUT_BATCH_MAX_TIME closes a batch every millisecond. PublishGate now holds a frame back for two reasons: the program is mid-redraw under DEC 2026 synchronized output, which is the same check Ghostty's renderer makes in src/renderer/generic.zig, or another frame is already queued behind it and the last one is newer than 8 ms. A hold expires after 150 ms, so a program that opens a synchronized frame and dies cannot freeze the pane, and resizes, scrolls, the first frame of a session and the frame preceding ChildExited all bypass the gate.

Keystroke echo is untouched: with the PTY queue drained there is nothing to coalesce with, so a lone change publishes immediately. What you should see is fewer torn frames from full-screen TUIs and no delayed leading wakeup on Windows and macOS, which were holding every wakeup for an extra event-batch window precisely because ConPTY can split a synchronized-output sequence around a redraw.

Measured on the reproducible suite (scripts/bench-terminal.sh, release profile, x86_64 Windows), against the pre-work baseline 4066faf6:

Metric	Before	After
`publish_echo_220x60` median	166 us	8.3 us
`publish_scroll_220x60` median	701 us	448 us
`line_text_at_220x60` median	7.1 us	0.6 us
`pipeline_corpus_mib_s`	0.23 MiB/s	0.90 MiB/s
`idle_wakeups_shell_per_s`	64	9.0
`gate_trickle_publishes`	1000 per 1000 chunks	250

The eight-pane render benchmark, same host, moves median input-to-frame from 1827 to 1245 us, p95 from 2426 to 1804 us, and total CPU from 2531 to 1656 ms. Peak RSS goes from 36.8 to 49.8 MiB: that is the retained per-pane layout, roughly 1.6 MB per open pane, which is the one thing this release costs you.

A pane opened for an agent loads your PowerShell profile

On Windows an agent pane started PowerShell with -NoProfile. The shell you got back after the agent exited had none of your prompt, aliases, functions or PSReadLine setup: a bare PS C:\dev\project> that read as if Paneflow had launched something other than PowerShell. It also defeated Paneflow's own prompt integration, which dot-sources after $PROFILE specifically to wrap a prompt you defined rather than replace it. Windows was the only platform doing this; the zsh, bash and fish paths always loaded the user's rc files.

An agent pane now starts the same way as any other pane. If your $PROFILE is slow, an agent pane now pays that cost too. The Clear-Host already prefixed to the agent command keeps the TUI's first frame clean.

Windows holds a 1 ms timer resolution while the window is open

Windows delivers timer expirations on a 15.6 ms clock tick unless a process asks for better, and since Windows 10 2004 that default is per-process. Every short timeout in the terminal pipeline was being rounded up to it, which capped the update rate and added up to 15 ms of latency to output that had already been parsed. Paneflow now requests 1 ms for the lifetime of the window and releases it on close. There is a small battery cost to a 1 ms tick, which is why it is scoped to the window being open rather than to the process.

The shell you picked in Settings is the shell that launches, on Windows

Choosing PowerShell stored a bare pwsh.exe, resolved only through PATH. An app launched from Explorer inherits whatever environment Explorer was started with, so a stale or truncated PATH silently rejected the choice and let the fallback chain pick another shell, occasionally the Command Prompt. Each named shell now also resolves from its absolute install location, the way the unconfigured fallback already did, and Windows PowerShell 5.1 is found under System32 even when its own PATH entry is missing. Picking PowerShell no longer gets you Windows PowerShell, or the other way round.

PowerShell 7 discovery is resolved once per run instead of once per pane, so restoring a many-pane workspace no longer re-walks ProgramFiles and PATH for every pane while the disk is busy. RUST_LOG=info now reports the shell each pane actually launched next to the configured value.

Worktrees

A tab binds to its own worktree

The "New pane" palette and the tab context menu list the repository's branches. Picking one that has no worktree creates it under <workspace>.worktrees/, picking one that already has a worktree reuses it, and the pane starts there. An agent that creates a branch from inside a pane now moves that tab alone, where it used to drag every tab of the workspace with it. Refs discussion #41.

The binding is stored per tab in the session as an optional worktree path. The session schema stays at v2: the field is additive and defaulted, a file written by 0.10.x parses with no binding, and a path that no longer exists at restore is dropped rather than resurrected.

"Remove worktree" takes a checkout back down

The sidebar could create checkouts but never take one away, so <repo>.worktrees/ grew for the life of a project with no way back. A checkout prepare_branch_checkout makes is deliberately not a ManagedWorktree, so workspace-close teardown never touches it.

Removal holds the same invariants teardown holds for orchestration's own worktrees, and each refusal is a toast rather than a log line, because you asked for this one:

The branch is never deleted, only its checkout.
A checkout holding uncommitted changes is refused.
A checkout without Paneflow's owner marker is refused: it belongs to somebody else.
A checkout that is itself an open workspace is refused, because the panes over there would be left in a directory that no longer exists.

The git work runs off the render thread. Removing also invalidates the repository's Worktree-scope diff hosts, which is what makes a lane appear or disappear without a scope toggle or a restart.

Sidebar

Customize Sidebar

The rail header gains a Customize Sidebar menu with a switch per value: Branch, PR, Diffstat and the indent guide, all off by default, so the rail you have today does not change until you turn something on. A branch that already has a pull request swaps its glyph for the pull-request one, in GitHub's state colors. Below them, Expand all and Collapse all.

The fold state of each workspace row now survives a restart, through an optional sidebar_collapsed flag written only when a row is folded.

The four switches persist under a new optional sidebar_show object in paneflow.json:

{
  "sidebar_show": {
    "branch": false,
    "diffstat": false,
    "pr": false,
    "indent_guide": false
  }
}

branch and diffstat read the tab's bound worktree, or its workspace's checkout when the tab is unbound. pr needs the gh CLI and answers for GitHub remotes only.

Added

DEC 2026 synchronized output is exposed by the engine. The mode was decoded but never readable, so nothing downstream could act on a program's "do not show this yet". It is now on the snapshot, which is what lets the publish gate skip a torn frame at the source.

Fixed

The last frame of a program is no longer dropped. The publish rate limit applied unconditionally, so a change landing within 8 ms of the previous frame waited for the runtime loop, and the loop exits as soon as the child is reaped. A program's final output could disappear, and the bigger the closing burst, the more of it was lost. CI caught it on live_runtime_runs_platform_shell_and_reports_one_exit, which on Linux x86_64 saw the shell's first line but not the stty size that followed, and on the slower aarch64 runner saw an empty grid. The frame preceding ChildExited is now flushed explicitly on both the POSIX and the Windows teardown path.
The pull request marker works at all. gh has no global directory flag, so gh -C <repo> pr list exited 1 with unknown shorthand flag: 'C' on every call, and each failure blacklisted the repository for the rest of the session because is_stale never asks again. The lookup now runs with the repository as its working directory. A log::debug! on the failing path prints what gh said, since the caller turns this error into a silent blacklist entry and a wrong invocation used to look exactly like a checkout with no GitHub remote.
Windows verbatim paths no longer break worktree detection. \\?\-prefixed paths are handed to git as arguments and compared against the paths git prints, and the verbatim spelling fails at both: git worktree add cannot create leading directories under it, and it never compares equal to git's forward-slash output. "Is this checkout the repository's own?" therefore answered no for every branch on Windows. strip_verbatim_prefix now lives once in runtime_paths and workspace::git::canonicalize_or strips too; the two private copies that had grown in the IPC workspace.create path and in install-method detection call the shared helper.

Under the hood

A reproducible terminal benchmark. An ignored release-profile test measures the pipeline with no GPU and no window: snapshot plus conversion on scroll and on keystroke echo, the window-free layout pass, the per-frame render-thread lookups, the publish gate on a trickle, corpus throughput, and the idle wakeups of a display-only and of a live shell session. A counting allocator reports exact bytes and calls per iteration, and the run records its own CPU share and warns when another workload was competing. scripts/bench-terminal.sh and .ps1 build it, stamp the result, archive it under bench/results, and print a Markdown comparison against bench/baseline.json. See bench/README.md.
The pinned libghostty source bump is automated. Re-pinning libghostty-vt was a manual pass across two build hosts; a workflow now stages the manifest, regenerates the bindings, rebuilds all four reviewed targets against the staged manifest with --verify-reproducible --allow-hash-drift, writes the hashes those builds produced, and opens the pull request. Reproducibility is proven in the bump run rather than on the resulting pull request, which would be circular evidence. Two pins it refuses to move on its own, both checked before any build starts: minimum_zig_version and src/terminal/formatter.zig. #49, #50, #51.

Upgrade notes

Install over 0.10.x and launch. No manual step is required, and nothing needs to be edited in paneflow.json.

There is no breaking change and no removed setting in this release.
Two optional keys are added: sidebar_show in the config, worktree and sidebar_collapsed in the session. All default to the 0.10.x behavior when absent.
The session format stays at v2, and the packaging contract and the IPC and MCP method names are unchanged.
Downgrading to 0.10.x works. An older build ignores the three new keys, losing only the per-tab worktree binding and the remembered fold state.
If you turn on the PR switch, install the gh CLI and authenticate it. Without it the branch keeps its own glyph and nothing else changes.
Worktrees Paneflow creates live in <workspace>.worktrees/, a sibling of your repository. Add it to your global gitignore if your tooling walks siblings.

Install and validation

Download the signed artifacts from this release or use the installation instructions.

Every primary artifact carries a .sha256 sidecar and a minisign .minisig; each AppImage also ships an .AppImage.zsync for delta updates. 35 assets in total.

Pipeline: run 33609444456.

Legs that passed:

Build: x86_64-unknown-linux-gnu, aarch64-unknown-linux-gnu, aarch64-apple-darwin, x86_64-pc-windows-msvc
Release test gate on Linux x86_64: cargo fmt --check, cargo clippy --workspace --locked -- -D warnings, cargo test --workspace --locked
Package smoke tests: Debian 12 and Ubuntu 22.04 (.deb postinst), Fedora 40 and openSUSE Tumbleweed (.rpm postinst), Arch Linux (tar.gz binary), Windows MSI install and relay
Auto-update end to end on Linux x86_64

Full Changelog: v0.10.0...v0.11.0

v0.10.0

2026年8月31日GitHub で見る

One terminal engine, on every platform

Paneflow 0.10.0 makes the statically linked Ghostty engine the only terminal engine on every shipping target, macOS Apple Silicon included. The Alacritty backend and the terminal.backend setting are gone: there is no second parser and no runtime fallback left to select. With the engine settled, the release wires up everything libghostty already knew how to do and Paneflow was never asking for: Kitty graphics, desktop notifications, OSC 9;4 progress, engine-resolved selection, and a scrollback that finally honors scrollback_lines.

Two other things move. A tab now names itself after the work going on inside it instead of sitting in the sidebar as a fourth "Claude Code" row, and the Shortcuts page becomes grouped, searchable and fast.

Sessions and layouts written by 0.9.x load unchanged. The only configuration key that changes meaning is terminal.backend, which is now ignored.

Breaking changes

The Alacritty backend and `terminal.backend` are removed

The terminal.backend key in paneflow.json no longer selects anything. A file that still carries it loads fine and the key is ignored.

// paneflow.json, before
{ "terminal": { "backend": "alacritty" } }   // or "ghostty", or "auto"

// paneflow.json, after: delete the key
{ "terminal": {} }

The symptom of doing nothing is none at runtime, since the key is simply ignored. What does change is the failure mode: a Ghostty startup failure used to be able to fall back to Alacritty once before child spawn, and is now reported in the pane instead.

macOS moves onto the same engine as Linux and Windows. macOS panes were parsed by Alacritty through 0.9.x, so this is the first release where a macOS pane and a Linux pane are driven by the same code.

Two build targets can no longer be built

The --no-default-features recovery build went with the Alacritty backend. x86_64-apple-darwin (Intel Macs) and aarch64-pc-windows-msvc (Windows on ARM) have no pinned Ghostty archive in native/libghostty/manifest.toml, and src-app/build.rs now fails the build outright rather than producing a binary with no terminal. Neither target was in the release matrix, so no shipped artifact disappears. Building from source for either target is what stops working.

Quit takes Ctrl+Q away from every pane

Quit now has a default binding on every platform: Ctrl+Q on Linux and Windows, Cmd+Q on macOS. It was macOS-only before, so there was no keyboard route out of Paneflow elsewhere.

Bare Ctrl+Q is XON flow control in a POSIX terminal, the key that resumes output after Ctrl+S, and readline's quoted-insert for anyone running stty -ixon. GPUI stops dispatching a keystroke once a binding handles it, so the PTY never sees the chord again. If you rely on it, rebind or unbind quit in Settings > Shortcuts.

The Attention Queue moves to Ctrl+Shift+A

open_attention_queue moves from secondary-shift-k to secondary-shift-a (Cmd+Shift+A on macOS). Ctrl+Shift+K is what kitty and Ghostty use to clear the scrollback, and that action now claims it. The queue keeps its place in the UI, so the chord it gave up is the one that was harder to discover. A custom binding you wrote yourself is untouched.

Workspaces can no longer be renamed

A workspace is named after the folder it holds. A title free to drift from that folder left the sidebar claiming a name nothing on disk answered to, with no way back. Double-clicking a folder row now selects it. Tab rename is unaffected, and a name stored by an older build is dropped on load.

The `close_window` action is removed

Paneflow only ever opens one window, and close_window ran exactly the same code as quit. No default bound it and no menu offered it. A close_window entry left in your keybindings is ignored; bind quit instead. The window's own close button and the window manager still close it.

Markdown no longer drags from the Files sidebar into a pane

Clicking a .md row in the Files sidebar opens it in the diff dock's editor as source, like every other file, rather than spawning a rendered markdown pane. The dock's highlighter already carries the block and inline markdown grammars, so the file reads with its own coloring. The drag gesture that dropped a markdown file into a pane split is removed with it; a pane accepts a session drag and a pane drag only. Rendered markdown panes still open from a terminal OSC path click and still restore from a session.

Terminal

Images render in the grid. A program transmitting through the Kitty graphics protocol gets its placements painted, cropped and scaled as it asked, under or over the text according to their z-index. Image storage is capped at 32 MiB per pane.
Desktop notifications from a program. OSC 9 and OSC 777 raise a desktop notification, suppressed while the window has focus. The title and body go through the same bidi and zero-width strip an agent question does.
Progress in the pane header. A program reporting OSC 9;4 gets a chip showing a percentage, working, paused, or error. The chip clears when the program removes the indicator or the child exits.
Selection is resolved by the engine. Double-click and triple-click selection, and the cell a drag lands on, now come from libghostty's gesture API: a drag ending past the middle of a cell includes it, as it does in every other terminal. A drag held past the edge of a pane scrolls the viewport and keeps extending, instead of stopping at the last visible row. Hold Alt for a rectangular block selection.
A reopened pane keeps its styling. Restoring a closed pane replays its scrollback with colors, styling and hyperlinks intact instead of as plain text, through libghostty's snapshot codec.
scrollback_lines is honored. The line budget reached the engine but its byte budget did not, so an 80-column pane pruned at roughly a thousand rows whatever the setting said.
OSC 4 color queries answer with the active theme. The renderer painted the theme while the engine answered from its own built-in palette, so a program asking what color 1 is got an answer the screen contradicted. Indexed colors written by a program resolve against the theme too, and follow a theme change.
XTGETTCAP for the terminal name answers xterm-256color, which is what the PTY exports as TERM, instead of failing.
CSI 0 q resets the cursor to the configured shape and blink rather than the engine's built-in default.
Mouse motion reporting no longer clears its deduplication state on every event, so a program in mouse-tracking mode stops receiving redundant motion reports.
Reads from the engine are batched and the render cycle follows libghostty's own dirty tracking.
The pinned libghostty-vt archive moves to Ghostty f2d5758f built with Zig 0.16.0 on all three platforms. OSC 7 and the clipboard protocols are decoded by libghostty itself instead of a Paneflow-side router; clipboard writes keep the same 100 KiB budget.

Tabs name themselves

A tab opened from the preset picker used to sit in the sidebar as a fourth "Claude Code" row. It now names itself after the work going on inside it, so a rail of agents says what each one is doing.

The opening words of the first prompt land immediately as a placeholder, and the title the agent's own CLI generates for its resume picker replaces it once the CLI has written one. Claude Code writes one today; Codex and Pi generate none and keep the placeholder. No model of our own is ever called.

Renaming a tab yourself turns naming off for that tab for good, since a name you typed is never overwritten. "Reset name" in the tab's context menu hands it back. A tab split between several agents is left alone, because no single one speaks for it.

Agent status without hooks

An organization can disable Claude Code's hooks wholesale from managed settings, with disableAllHooks or allowManagedHooksOnly. The sidebar then knew an agent was running and nothing else, which reads as a broken feature rather than as a blocked one.

Two sources were already reaching Paneflow with nobody listening, and both are now read: the pane itself, since Paneflow presents as Ghostty and Claude Code writes OSC 9;4 progress and OSC 777 notifications into the grid, and Claude Code's own session registry at <CLAUDE_CONFIG_DIR|~/.claude>/sessions/<pid>.json, which carries the full turn state including why a session is blocked. Both go through the same entry point as a hook frame, so they inherit the same surface binding, attention sync and auto-clear.

Three writers on one map need an order. AgentStateSource ranks them Terminal < SessionRegistry < Hook, enforced at the single existing write choke point: a weaker source never talks over a live stronger one, and takes over only after 20 seconds of its silence. Nothing changes on a machine where hooks work.

Settings, Shortcuts

The page is nine collapsible groups (Panes, Workspaces, Tabs, Terminal, Search, Diff, Markdown, Agents, Application) declared by the action registry rather than implied by table order, with an expand and collapse all control.
A text filter matches the action description and the keystroke. Since chords render as Apple HIG glyphs on macOS, every entry also carries an ASCII spelling covering both readings of GPUI's secondary, so cmd shift k and ctrl shift k both find the same row.
A key-capture toggle turns the next pressed chord into the filter, which answers "what already owns this chord?". Capture reads the keystroke through App::intercept_keystrokes, before GPUI matches it against the keymap, so pressing Cmd+Q to find Quit does not quit.
"Reset to defaults" asks before rewriting every binding.
Rebinding was broken on every platform and is fixed. A recorded chord was persisted through Keystroke::to_string(), the Display impl, rather than the --separated syntax Keystroke::parse reads back. A rebind therefore stored a chord no keypress could ever match, while displacing the default it replaced. If you rebound anything in 0.9.x or earlier and it silently stopped working, that binding is still broken in your keybindings file: rebind it once in 0.10.0 to store a parseable chord.
The page no longer lags with every section open. It laid out all ~90 rows on every repaint, offscreen ones included, and since each row highlights on hover, moving the pointer across the list redrew the whole thing. It now renders only the rows the viewport shows, and filters when the query or the fold state changes rather than once per frame. A repaint of the fully expanded page went from 6.2 ms to 0.3 ms on the development machine.

Added

Help > System Info shows a bug report's environment section and copies it with one button: Paneflow version and install format, OS, display server, CPU, GPU and driver, renderer, and libghostty version. It says outright when the GPU is a software rasterizer, which is the answer to most "why is it slow" reports. The panel shows the block before you copy it, because it goes into a public issue: no project path and no environment dump. The bug templates now have a slot for it.
Default shortcuts for two actions that worked but nothing bound and no menu offered, so they were unreachable unless you bound them by hand. Clearing the scrollback is secondary-shift-k (Ctrl+Shift+K on Linux and Windows, Cmd+Shift+K on macOS, with a plain Cmd+K alias), matching kitty, Ghostty, iTerm2 and Terminal.app. reset_terminal, which is what recovers a pane wrecked by dumping a binary to it, is secondary-shift-r.

Changed

read_pane over the MCP bridge sees the screen, not just the scrollback. surface.read returned the retained history, which stops at the viewport by design. An alternate-screen program has no scrollback at all, so reading a pane running a full-screen TUI returned nothing, and that is where every agent CLI lives. The response is now the retained history followed by the screen the program is currently painting, read through libghostty's formatter so soft-wrapped lines rejoin. The two halves do not overlap.
Building from source needs Rust 1.98.0. rust-toolchain.toml pins it, so rustup picks it up automatically. Shipped binaries are unaffected.
The Files sidebar rail is scoped to the tab that opened it. It was mounted outside any mode branch, so it survived into the Review surface and into Settings where its rows open nothing, and it was a single app-level flag, so opening the tree in one workspace tab put it in front of every sibling tab.
macOS: the native window material is dropped in fullscreen. Native fullscreen moves the window onto its own Space with a black backdrop, so AppKit's behind-window material has nothing left to sample and the blur collapses into a flat, dead tint. Fullscreen falls back to the opaque theme chrome. Tiled and maximized windows stay in the desktop Space and keep a live blur, verified on macOS 15.
macOS: gpui_macos's text system is pinned to error in the default log filter. It emits per-glyph fallback warnings that flooded the default warn filter during normal rendering. RUST_LOG=info still overrides it.

Fixed

A pane no longer inherits the host terminal's identity. CommandBuilder seeds a pane's environment from Paneflow's own, and removing a key from the assembled map cannot unset an inherited name, so only an env_remove at the spawn boundary fixes it. An inherited WT_SESSION makes Claude Code disable OSC 9;4 outright, and an inherited TMUX makes it wrap notifications in multiplexer passthrough that libghostty does not unwrap. Launching Paneflow from Windows Terminal or from inside tmux silently lost both channels in every pane. The launching agent session's CLAUDE_CODE_SESSION_ID leaked the same way and is stripped too.
The detached diff dock is keyed on the tab, not the workspace. Two tabs of the same folder shared one dock, so opening it in one tab opened it in its sibling, with that sibling's tabs and last diff snapshot. Closing a background tab also leaked the parked dock and the terminals it held.
The diff dock clamps its width to the room the main panel has. Opening a right rail narrowed the main panel under a dock sized for the wide one, and the dock pushed its right edge past the panel's clip. The stored width is now a preference fitted into the live width, and nothing is written back, so the dock returns to full width when the rail closes.
The sidebar inline rename accepts keystrokes again, on every platform. Both the workspace row and the tab row host a real text field with a caret, selection, IME and clipboard, focused when the rename opens. It commits on Enter or when focus leaves, cancels on Escape, and hands focus back to the active pane. Refs #32.

Upgrade notes

Install over 0.9.x and launch. No manual step is required.

Delete terminal.backend from paneflow.json if you set it. Leaving it in place is harmless; it is ignored.
If you rebound a shortcut in 0.9.x or earlier and it stopped working, rebind it once in 0.10.0. The old value was stored in an unparseable form.
If you use bare Ctrl+Q for XON flow control or quoted-insert inside a pane, unbind quit in Settings > Shortcuts before you need it.
The session format, the packaging contract, and the IPC and MCP method names are unchanged. read_pane returns strictly more than it did.
Downgrading to 0.9.x works. The session schema stays at v2; the one field 0.10.0 adds (title_source, which records who named a tab) is optional and an older build ignores it, losing only the "a name you typed is never overwritten" memory for that tab.

Install and validation

Download the signed artifacts from this release or use the installation instructions.

Every primary artifact carries a .sha256 sidecar and a minisign .minisig; each AppImage also ships an .AppImage.zsync for delta updates. 35 assets in total.

Pipeline: run 33375013157.

Legs that passed:

Build: x86_64-unknown-linux-gnu, aarch64-unknown-linux-gnu, aarch64-apple-darwin, x86_64-pc-windows-msvc
Release test gate on Linux x86_64: cargo fmt --check, cargo clippy --workspace --locked -- -D warnings, cargo test --workspace --locked
Package smoke tests: Debian 12 and Ubuntu 22.04 (.deb postinst), Fedora 40 and openSUSE Tumbleweed (.rpm postinst), Arch Linux (tar.gz binary), Windows MSI install and relay
Auto-update end to end on Linux x86_64

Full Changelog: v0.9.0...v0.10.0

v0.9.0

2026年8月26日GitHub で見る

Workspace tabs, and a real editor in the dock

Paneflow 0.9.0 rebuilds the surface hierarchy. A workspace now owns a list of tabs instead of a single layout tree, and a pane holds exactly one surface instead of its own tab strip, so the product goes from two nested tab levels to one, as Zellij, kitty, Ghostty and WezTerm already do. The diff dock gains a File tab hosting a real editor, so a file can be read and corrected next to the agent that wrote it. The third top-level mode, Agents, is removed: its sidebar, bottom panel and project store are gone, and the mode switch drops to CLI and Review.

Sessions written by 0.8.x are migrated on load, not rejected. No manual step is required to upgrade.

Workspace tabs

A workspace row in the CLI sidebar is now a collapsible folder, and each tab is a child row with inline rename, hover actions, and reordering and reattachment by id rather than by index.
Per-tab zoom and navigation keep their 0.8 mechanics, one level down.
The activity badge drops from the workspace to the tab, computed by filtering the workspace's sessions on the tab's terminal ids. A collapsed folder re-aggregates its children, so nothing hides.
New default bindings: secondary-] for next_tab and secondary-[ for previous_tab. secondary-alt-t (new_tab) and secondary-w (close_tab) keep their meaning at the new level, and secondary-tab still cycles workspaces, not tabs. secondary is Ctrl on Linux and Windows, Cmd on macOS.
A pane header replaces the in-pane tab strip: surface name, agent pill, and the pane actions. Cross-pane tab drag gestures are removed along with the stale positional index they addressed; splitting already covers the gesture.
"New pane" opens a preset picker over the three catalogs that already exist: the default shell, the visible agents, and the workspace custom buttons. No new key in paneflow.json.
Workspace tabs are capped at 32 (MAX_SESSION_TABS). A session file above the cap is truncated on load with a logged warning rather than rejected.

Editable file tabs in the diff dock

The dock's tab strip gains a File variant hosting a real editor. The document is a ropey::Rope loaded off-thread behind a generation guard, with guard rails on file size, giant lines, and non-textual bytes.
Highlighting is incremental and reuses the diff's own tree-sitter grammars, so a file gets the same colors in the editor and in the diff.
Editing covers native input and IME, undo and redo, clipboard, indentation, save with a modified marker, and a conflict path for the case where an agent rewrites the file underneath the cursor.
Rendering virtualizes to the visible rows, with a line-number gutter, vertical and horizontal scrolling, and no soft wrap.
File tabs cap at 8 (MAX_DIFF_FILE_TABS), evicting the oldest tab that is neither modified nor active. A modified tab asks for a second press before it closes.
New default bindings: secondary-g opens a file tab and secondary-j opens a terminal tab. Both are scoped off shells, text surfaces and the editor itself, where bare Ctrl+G means BEL and Ctrl+J means LF.
The dock is now reachable from a CLI pane. A git-pull-request button in the pane header toggles the dock on the pane's workspace root: pressing it again on the same folder closes the dock, a different folder retargets it. Previously the dock was reachable only from the Agents environment toolbar, which scoped it to a thread's working directory.

Files sidebar

Any row now opens a File tab. Previously only markdown opened and every other row was inert.
Rows the editor would refuse, because of a binary extension or a size above code::load::MAX_FILE_BYTES, stay dimmed but remain clickable, so the refusal is stated inside the tab instead of the click doing nothing.
Typing in the sidebar filters it, scored by the same matcher the agents sidebar used.

Theme presets

Themes become four presets, Paneflow, Vercel, Claude and Cursor, each in a light and a dark variant, so the identity and the light/dark axis are orthogonal. theme in paneflow.json stores the resolved variant, for example "Paneflow Dark" or "Vercel Light".
Pre-preset names keep working. One Dark, PaneFlow Light, Vercel, Claude and Cursor resolve through an alias table to the same pixels. An unknown name falls back to Paneflow Dark and logs a warning on the next parse.
The Themes settings page leads with three full-bleed window mockups for Light, Dark and System, followed by a live terminal sample painted from the active theme: prompt, build output, the ANSI swatch row, a selection run and the cursor. Switching a mode or a preset repaints the sample in place.
The shell neutrals are hue-free.
Notifications and the AI permissions cards fold into General, and the settings nav rail's first row becomes "Back to the app".

Added

reduce_motion in paneflow.json (also in Settings, Themes, Preferences). When enabled, hover transitions settle instantly and the primary sidebar toggles without the slide. Default false.
unfocused_pane_opacity in paneflow.json. Panes that do not hold focus fade to 70% opacity when a workspace holds more than one pane. Accepts 0.15 to 1.0, where 1.0 disables the dim. The tab bar, attention glow, broadcast stripe and Composer stay at full contrast.
CLI panes float as continuous-corner cards, with matching row skins and delayed tooltips across the app chrome.
A Linux-only application icon, plus a monochrome Codex mark and a leaner terminal glyph.
surface.* IPC methods export a stable workspace_id on every surface and accept an optional workspace_id parameter. A surface that does not belong to the requested workspace is rejected with an invalid_params error naming both ids. Omitting the parameter keeps the previous instance-wide behavior, and the positional index stays in the payload for older clients.
list_panes over the MCP bridge names the holding tab.
An agent session is reaped when its shell returns to the prompt.

Removed

The Agents view. The third top-level mode is gone, along with the agents sidebar, the agents bottom panel, the agents view actions, and the project store behind them. The mode switch drops to CLI and Review, and the secondary-shift-a binding for open_agents_view is removed. A session.json written by an older build restores in CLI mode with its workspaces intact. The CLI mode tab is now named "Agents".
The in-pane tab strip, replaced by the pane header described above.
The agent identity pill in the pane header, and the Files sidebar button in the pane header.
Rename from the workspace context menu.
Word-level intra-line highlighting in the diff.
The paneflow-acp crate and the Zed markdown global-theme bootstrap.

Changed

Session schema v2. A workspace session carries a list of TabSession rather than a single layout tree. v1 files are migrated on load: the legacy layout: null (one default pane) is materialized explicitly so it stops colliding with v2's layout: null (an empty tab). No action is needed on upgrade. Downgrading to 0.8.x after running 0.9.0 is not supported for session files.
BoundedOutput no longer returns partial data with a truncation flag. A run that exceeds the stdout or stderr capture limit fails with ProcError::OutputLimitExceeded, so a caller can never mistake a clipped payload for a complete one.
Editors and file managers launched from Paneflow are spawned detached, backed on Windows by a job object, so they are no longer torn down with the app.
Find-in-buffer in the terminal is chunked, cancellable and budgeted.
The agent identity is declared at launch instead of being discovered by scanning.
GPUI is pinned back to upstream zed-industries/zed and the Paneflow fork is retired. The fork carried a single additive Markdown::append patch whose only consumer was the deleted in-app chat. Only gpui and gpui_platform remain declared. The lockfile drops from 1129 to 851 packages. This affects builds from source only; shipped binaries are unaffected.

Security

Telemetry capture is gated behind a closed event schema. Call sites previously built PostHog payloads as free-form json!({...}), so nothing stopped a new event from carrying a path, a hostname, or a reserved PostHog processing key. TelemetryEvent is now the only way to name an event or attach properties, and the client owns the reserved keys outright, which turns the no-PII rule into a type-system invariant rather than a review convention. The client also gains a queue bounded on both event count and serialized bytes, and a shutdown flush with an explicit deadline.
The agent-config lease ownership bit is stored outside the locked file.

Fixed

Windows: the title bar minimum height is aligned with the Win11 caption strip.
Codex 0.149.1 user turns are read correctly, and subagent rollouts are dropped from the session list.
Synthetic Claude records no longer leak into sidebar titles, and a project slug with trailing separators is normalized.
Bound Claude sessions are resumed instead of re-minted.
The launching agent session's environment markers are stripped from child PTYs.
Every conflict-watcher wake in the code editor stays on the view's thread.
The branches popover in the diff stays anchored while its list scrolls.
The delete and clear icons paint instead of leaving blank space.
The tab-cycling chord assertion is platform-aware.

Upgrade notes

No action is required. Install over 0.8.x and launch.

Your session.json is migrated from v1 to v2 in place on first launch. Workspaces, layouts and working directories are preserved. If you were in Agents mode, you land in CLI mode.
Your paneflow.json needs no edit. A pre-preset theme value keeps resolving to the same colors; write the explicit variant name only if you want to pin one.
Scripts driving surface.* over IPC keep working unchanged. Pass the new workspace_id parameter only if you want a call scoped to one workspace.
The terminal backend selection and the packaging contract are unchanged: libghostty on Linux and Windows x64 MSVC, Alacritty on macOS and as the explicit rollback through terminal.backend.

Install and validation

Download the signed artifacts from this release or use the installation instructions.

Every primary artifact carries a .sha256 sidecar and a minisign .minisig; each AppImage also ships an .AppImage.zsync for delta updates. 35 assets in total.

Pipeline: run 33006523043.

Legs that passed:

Build: x86_64-unknown-linux-gnu, aarch64-unknown-linux-gnu, aarch64-apple-darwin, x86_64-pc-windows-msvc
Release test gate on Linux x86_64: cargo fmt --check, cargo clippy --workspace --locked -- -D warnings, cargo test --workspace --locked
Package smoke tests: Debian 12 and Ubuntu 22.04 (.deb postinst), Fedora 40 and openSUSE Tumbleweed (.rpm postinst), Arch Linux (tar.gz binary), Windows MSI install and relay
Auto-update end to end on Linux x86_64

Full Changelog: v0.8.2...v0.9.0

v0.8.2

2026年7月21日GitHub で見る

Windows title bar material isolation

PaneFlow 0.8.2 is a focused patch release for an important Windows desktop material boundary. When the terminal enabled the host-window backdrop while the dedicated chrome material was disabled, the transparent title bar could expose terminal-only Mica instead of the configured theme background.

The Windows title bar now paints an opaque theme surface whenever its own material is disabled. It remains transparent when the chrome material is intentionally active, preserving the native backdrop. Linux and macOS keep their existing chrome behavior.

Regression coverage

Added a Windows-specific test covering both disabled and active chrome material states.
Kept the non-Windows transparency assertion explicitly scoped to Linux and macOS behavior.
Preserved the existing opaque Linux shell and native macOS/Windows sidebar material contracts.

Documentation and project state

Updated the architecture guide to describe the shipped dual terminal stack: pinned libghostty-vt by default on Linux and Windows x64 MSVC, with Alacritty on macOS and as the explicit cross-platform rollback.
Refreshed the README with the current Windows backend, installation paths, rollback setting, and a direct evaluator quick-test path.
Finalized the Build Week implementation evidence, platform matrix, validation claims, and traction copy against the shipped v0.8.1 baseline.
Removed the stale French Build Week duplicate so the English submission document remains the canonical public account.
Corrected the top-level changelog and added the final submission audit record used to verify the public claims against code and release artifacts.

No configuration, session format, terminal backend selection, or packaging contract changed in this patch.

Install and validation

Download the signed artifacts from this release or use the installation instructions.

The v0.8.2 release pipeline passed Linux x86_64 and ARM64 packaging, the signed and notarized macOS ARM64 DMG, the signed Windows x64 MSI, Ubuntu, Debian, Fedora, openSUSE and Arch smoke tests, Windows install and upgrade validation, and Linux auto-update E2E. The release contains 35 verified assets with SHA-256 sidecars and Minisign signatures where applicable.

Full Changelog: v0.8.1...v0.8.2

v0.8.1

2026年7月21日GitHub で見る

PaneFlow 0.8.1 promotes the pinned, statically linked libghostty-vt engine to the default for new terminal sessions in published Windows x64 MSVC builds. Ghostty now owns VT parsing, terminal state, snapshots, and input encoding on Windows. PaneFlow continues to host processes through ConPTY and render through GPUI, so the integration keeps PaneFlow's native desktop model while replacing the terminal engine underneath it.

Alacritty remains available as an explicit rollback with terminal.backend = "alacritty". The setting applies to new sessions only and never swaps the engine underneath a running shell. Windows ARM64 and Windows GNU targets continue to use the Alacritty backend.

Windows terminal parity and reliability

Ported the Ghostty-backed session host to ConPTY with keyboard and Kitty protocol input, mouse and focus reporting, bracketed paste, scrollback, search, selection, hyperlinks, resize, and lifecycle handling.
Preserved OSC 7 working-directory tracking, OSC 52 clipboard policy, and OSC 133 shell integration on the Windows path.
Fixed multiline Shift+Enter input through both PaneFlow's key translation and ConPTY so agents and shells receive the intended escape sequence.
Batched Ghostty redraw notifications into a 4 ms window on Windows to avoid partial ConPTY frames, cursor jumps, and wakeup storms during output-heavy sessions.
Completed ConPTY teardown before exit, joined the reader deterministically, and reaped probe descendants so shells do not leave handles or child processes behind.
Added privacy-safe backend diagnostics that identify the requested and active engine without collecting command text, working directories, usernames, or terminal contents.
Hardened Windows named-pipe IPC with overlapped I/O, bounded read and write deadlines, and a 256 KiB response cap.

Reproducible native Windows delivery

Added the Windows MSVC foundation for libghostty-vt, including pinned native sources, generated headers and Rust bindings, verified exported symbols, and deterministic archive generation.
Official MSI packages statically link the native engine. They require neither a Ghostty installation, a Ghostty DLL, nor Zig at runtime.
Added package-level provenance, third-party notices, build metadata, a native manifest, and a CycloneDX SBOM, all checked against the binary installed by the MSI.
The Windows qualification gates rebuild the native archive in a clean environment, compare reproducible output, verify hashes and symbols, exercise the terminal corpus and lifecycle, and enforce performance and handle-growth bounds.
The release pipeline validates fresh installation, upgrade from v0.8.0, Ghostty and Alacritty startup paths, static provenance, updater relay, and uninstall on the Windows runner.
Kept Windows ARM64 on the portable backend until its native Ghostty path has the same build, packaging, and runtime evidence as x64.

Desktop improvements

PaneFlow now persists the main window size across launches, with display-aware bounds and minimum dimensions when the saved geometry no longer fits the active screen.
Maximized Windows can be restored from PaneFlow's caption controls again.
Native material is clipped and masked more consistently around the sidebar cards and main panel on Windows and macOS.
macOS gains a configurable native Sidebar material in Appearance settings, with live updates and corrected backdrop alignment.
Workspace drag reordering now shows the real before or after insertion edge while preserving stable row sizing.
Agent completion dots are acknowledged after the workspace is viewed or used, instead of remaining stale in the sidebar.
Application artwork was refreshed, with separate portable and macOS icon sources and an updated README hero.

Fixes and engineering hardening

Made OSC 7 assertions and Windows-only helpers platform-aware so portable builds and tests stay warning-free.
Stabilized native code generation for formatter tables, empty headers, and Windows point maps, and normalized patch line endings across Windows builds.
Canonicalized Linux native archive ordering and strengthened reproducibility evidence across both Linux and Windows Ghostty builds.
Hardened PTY resize probes, updater retry tests, terminal handle-growth diagnostics, and final-output cleanup.
Pinned the Windows native toolchain and ConPTY qualification runner, while extending MSVC CI to compile, lint, test, and build the Ghostty feature.
Updated release provenance checks for generated application icons and downloaded packaging assets without widening the runtime payload contract.
Documented Windows backend selection, automatic promotion, rollback, diagnostics, qualification scope, and the bilingual Build Week implementation story.

Install and validation

Download the signed artifacts from this release or use the installation instructions.

The v0.8.1 release pipeline passed Linux x86_64 and ARM64 packaging, the notarized macOS ARM64 DMG, the signed Windows x64 MSI, five Linux distribution smokes, Windows install and upgrade behavior, static Ghostty provenance, and auto-update E2E before publishing 35 release assets with checksums and Minisign signatures.

Full Changelog: v0.8.0...v0.8.1

v0.8.0

2026年7月18日GitHub で見る

PaneFlow 0.8.0 moves the default path for new terminal sessions in standard Linux builds from Alacritty to a pinned, statically linked libghostty-vt engine. Parsing, terminal state, input, snapshots, search, selection, mouse reporting, clipboard handling, hyperlinks, prompt marks, scrollback, resize, and shutdown now run through the Ghostty-backed session path.

Alacritty remains available on Linux as an explicit rollback with terminal.backend = "alacritty". The setting applies to new sessions only. macOS and Windows continue to use Alacritty.

Native and reproducible Linux delivery

Added dedicated FFI, safe Rust wrapper, terminal engine, and smoke-test crates around libghostty-vt.
Pinned Ghostty to commit ae52f97d, Zig to 0.15.2, the native ABI to 0.1.0, and verified the generated headers, bindings, build metadata, static archives, and third-party notices.
Bundled verified static archives for Linux x86_64 and ARM64. Normal development builds require neither a Ghostty checkout nor Zig, and official packages have no runtime libghostty dependency.
The release workflow regenerates the native archive from the reviewed source pin, verifies static linkage, and packages the same engine into AppImage, .deb, .rpm, and .tar.gz artifacts.
Added bounded worker queues and owned snapshots around the native engine so the GPUI thread never owns raw Ghostty handles.

Terminal behavior and reliability

Added a 130-case Alacritty/Ghostty differential corpus: 115 cases require exact parity and 15 documented semantic differences are pinned explicitly.
Added parser and snapshot fuzz targets, chunk-boundary checks, ABI/layout validation, PTY stress coverage, callback panic containment, archive metadata checks, and release-size gates.
Preserved search, selection, OSC 8 links, OSC 52 clipboard, OSC 133 prompt marks, bracketed paste, mouse reporting, alternate screen behavior, resize, final-output draining, and child teardown on the new path.
Added previous/next prompt navigation actions backed by prompt marks.
Improved terminal text hierarchy with the real bright foreground, stronger SGR bold handling, and corrected glyph alignment under the block cursor.
Replaced the one-cell terminal gutter with a fixed 3 px inset so the grid, tabs, and scrollbar align consistently.
Terminal scrollback is now process-local and is no longer serialized as raw output in session.json. Restored workspaces keep their layout, cwd, and metadata, while historical terminal output starts fresh.

Interface polish

Added reversible 120 ms hover feedback across Settings, pane tabs, Review, Agents, broadcast controls, sidebars, custom buttons, terminal search, scrollbars, utility actions, and window controls.
Added fixed navigation headers for Agents, Changes, and Settings. Changes now exposes added/deleted totals, tree/list switching, and collapse controls in one stable header.
Unified cockpit geometry, title-bar controls, inset cards, client-side chrome, resize hitboxes, and terminal alignment.
Standardized desktop cursor behavior so interactive rows and buttons keep a normal pointer while text and resize surfaces retain specialized cursors.
Memoized bundled AI-hook binary verification after the first successful process-local checksum.

Removed and hardened

Removed the experimental Rosetta status surface, its title-bar toggle, runtime state, runbook, and the rosetta_enabled / rosetta_show_passive settings. Agent attention remains available through the sidebar, desktop notifications, tab indicators, and Attention Queue.
Hardened dependency review with immutable Git revisions, per-source allow rules, and a verified resolved commit for tagged sources.
Stabilized generated Ghostty bindings and validated prepared archive target, source SHA, Zig version, optimization mode, normalization, and exported symbols.
Added complete native license notices to every Linux package and verified them on minimal Ubuntu, Debian, Fedora, openSUSE, and Arch installations.
Fixed the terminal grid test helper for Windows and pruned superseded internal product plans.
Added the complete OpenAI Build Week engineering story in English and French, covering the migration decisions, implementation, failures, and lessons.

Install and validation

Download the signed artifacts from this release or use the installation instructions.

The v0.8.0 release pipeline passed the Linux x86_64 and ARM64 builds, macOS ARM64 notarized DMG, Windows x64 signed MSI, multi-distribution package smokes, and auto-update E2E. The dedicated libghostty Linux qualification passed ABI regeneration, native builds, differential tests, fuzzing, supply-chain checks, static-link verification, and package smokes.

Full Changelog: v0.7.11...v0.8.0

v0.7.11

2026年7月14日GitHub で見る

PaneFlow 0.7.11 makes workspace state faster to scan, brings local services into the sidebar, and ships a more legible terminal baseline across Linux, macOS, and Windows.

Workspace navigation

Rebuilt workspace cards around a compact title row and a single metadata row for the Git branch, changed files, and detected services.
Consolidated multi-agent state into a prioritized indicator for agents that need input, errored, stalled, or are still thinking.
Added a persistent completion indicator after an agent finishes. It stays visible until that workspace is opened, so completed work is harder to miss.
Made detected frontend services directly clickable from the workspace card. Additional and non-frontend services remain visible through the workspace context menu.
Consolidated rename, workflow, local service, editor, reveal, and close actions into the workspace context menu. Workspace titles can also be renamed with a double-click.
Simplified workspace creation with a dedicated header action and a clearer empty state.

Terminal rendering

Bundled JetBrainsMono Nerd Font Mono in regular, medium, semibold, bold, and matching italic styles, and made it the cross-platform terminal default.
Added built-in Nerd Font glyph coverage for shells and prompts while keeping explicit Geist Mono and custom system font configurations supported.
Refined the One Dark and Cursor ANSI palettes with softer foregrounds and more restrained normal, bright, and dim colors.
Changed SGR bold rendering to advance one weight from the configured base instead of forcing weight 700, preserving emphasis without overpowering colored terminal output.

Engineering

Removed the experimental Hera shadow-terminal integration, diagnostic side-by-side renderer, and dogfood crates, simplifying the production PTY and terminal rendering paths.
Updated the pinned GPUI/Zed fork to a newer upstream base while retaining PaneFlow's streamed Markdown append optimization, with the required layout and input compatibility adaptations.
Documented the implementation path for the planned Linux libghostty terminal backend.

Full Changelog: v0.7.10...v0.7.11

v0.7.10

2026年7月10日GitHub で見る

PaneFlow 0.7.10 fixes long workspace titles overflowing their sidebar cards.

What changed

Long workspace names are truncated cleanly inside the available card width.
The active-session indicator remains visible instead of being pushed outside the row.
Rename fields and horizontal scrolling stay contained within the sidebar.

v0.7.9

2026年7月7日GitHub で見る

Paneflow 0.7.9 fixes a Windows self-update regression introduced in 0.7.7.
Older Windows clients pinned the MSI publisher as O=Strivex, while the signed MSI certificate is O=StriveX. The MSI was valid, but the client rejected it after download and surfaced the misleading "corrupt or tampered" update error.

What changed

Corrected the Windows MSI publisher pin to StriveX.
Added a Windows release smoke check that compares the pinned publisher in Rust with the actual Authenticode subject on the signed MSI.
Changed release publishing so GitHub Releases stay draft-only until every signed asset has been uploaded and verified.

Windows upgrade note

If you are already on Paneflow 0.7.7 or 0.7.8 on Windows and the in-app updater reports a corrupt or tampered download, install 0.7.9 manually from the MSI once. After 0.7.9 is installed, future Windows updates should use the in-app updater normally again.

Full Changelog: v0.7.8...v0.7.9

v0.7.8

2026年7月7日GitHub で見る

Paneflow v0.7.8

Paneflow v0.7.8 is a focused theme, Windows reliability, and interface polish release. It adds branded presets and makes typography consistent across platforms, while hardening the Windows paths that open browsers, folders, editors, notifications, and taskbar shortcuts.

The release covers 9 commits since v0.7.7, including the final version bump.

Highlights

Theme presets: Vercel, Claude, and Cursor now ship as bundled presets with their own UI tokens, terminal palettes, and syntax colors.
Typography: fresh installs now default to bundled Geist for app UI and Geist Mono for terminals, instead of depending on a host-installed preferred font.
Windows launch reliability: external URLs, editor launches, folder opens, taskbar identity, Start Menu shortcut behavior, and notifications were tightened for packaged installs.
Daily polish: terminal hyperlink hover no longer paints a large URL tooltip, and sidebar diff stats no longer show meaningless +0 -0 counters.

Themes And Typography

Added three branded dark presets: Vercel, Claude, and Cursor.
The Appearance settings page now has preset tiles with logos, palette previews, selected-state checks, and click-to-apply behavior.
Each preset can define app-wide UI colors, not just terminal ANSI colors, so sidebars, settings, diff surfaces, syntax highlighting, status colors, and terminal chrome stay coherent.
One Dark received a warmer foreground tuning to match the new font and palette direction.
Bundled Geist and Geist Mono font families were added under the SIL Open Font License.
The UI font now uses Geist; the default terminal font now uses Geist Mono on every platform.
.PaneflowMono now resolves to Geist Mono; .PaneflowSans now resolves to Geist.
Legacy explicit font names remain supported: Lilex, IBM Plex Sans, and IBM Plex Mono still resolve when users have them in config.
Config docs, the public JSON schema, theme docs, and troubleshooting docs now list the new presets and updated font defaults.
Terminal frame goldens were updated for the new theme/font output.

Windows Launch, Taskbar, And Notifications

External URLs now open through a private helper subcommand that breaks away from Paneflow's kill-on-close Windows Job Object. Browser windows opened from help links, update toasts, release-page fallbacks, sidebar links, profile links, and terminal hyperlinks should survive Paneflow exit.
Folder opens now use explicit platform file-manager commands instead of the generic open crate path: xdg-open on Linux, open on macOS, and explorer on Windows.
Editor launches on Windows now normalize extensionless shims to native .exe, .cmd, .bat, or .com siblings where needed.
The editor resolver now searches common Windows install roots for Zed, Cursor, VS Code, VS Code Insiders, and Windsurf under %LOCALAPPDATA%\Programs, %ProgramFiles%, and %ProgramFiles(x86)%.
Editor failure toasts now avoid labels like Open in Open in ...; they use the cleaner editor name.
Windows AppUserModelID is centralized as Strivex.PaneFlow and set at process startup, so notifications, taskbar grouping, and installer metadata share the same identity.
The WiX Start Menu shortcut now lets Explorer use paneflow.exe's embedded icon instead of an MSI Icon table path, reducing stale taskbar icon risk across major upgrades.
CI visibility for the shared Windows identity was fixed so test builds can assert the WiX shortcut contract.

Terminal And Sidebar Polish

Ctrl-hovered terminal links still underline, but Paneflow no longer paints the full URL tooltip over terminal content.
Sidebar diff stats now hide zero-count sides. Insertion-only and deletion-only changes show only the meaningful side.
Binary-only or unmeasured changes now show a compact N changed file count instead of +0 -0.
The sidebar diff summary path is now covered by focused regression tests.

Release Metadata

Workspace package version bumped to 0.7.8.
Cargo.lock workspace package entries regenerated to 0.7.8.
AppStream top release entry added for 0.7.8.
Debian changelog top entry added for 0.7.8-1.

Validation

Local validation before tagging:

cargo fmt --check
cargo metadata --locked --format-version 1
git diff --check
AppStream XML parsed locally and Debian changelog top entry checked
cargo test --workspace --locked
cargo clippy --workspace --locked -- -D warnings

GitHub validation and publish:

Release workflow: https://github.com/arthjean/paneflow/actions/runs/28856648773, succeeded across Linux x86_64, Linux aarch64, macOS aarch64, Windows x86_64, distro smokes, Windows MSI relay smoke, auto-update e2e, and GitHub Release publish.
Repository publish workflow: https://github.com/arthjean/paneflow/actions/runs/28859008537, succeeded.
Homebrew cask update workflow: https://github.com/arthjean/paneflow/actions/runs/28859008558, succeeded.
Release assets: 32 GitHub assets published, including Linux AppImage/deb/rpm/tar.gz for x86_64 and aarch64, macOS aarch64 DMG, Windows x86_64 MSI, SHA256/minisig sidecars, and AppImage zsync files.