Release v1.3.0 and publish desktop update manifest

.claude/commands/release-notes.md

@@ -1,6 +1,6 @@
 ---
 name: release-notes
-description: Draft release notes, recommend and apply a version bump, and update CHANGELOG.md for the next dormouse release by analyzing all merge commits and squash-merged PRs since the last release tag. Used as step 2 of the release checklist in docs/specs/deploy.md.
+description: Draft release notes, recommend and apply a version bump, and update CHANGELOG.md for the next dormouse release by analyzing all merge commits and squash-merged PRs since the last release tag. Used as step 3 of the release checklist in docs/specs/deploy.md.
 user-invocable: true
 ---
 

CHANGELOG.md

@@ -10,6 +10,59 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/). Release
 
 ## [Unreleased]
 
+## [1.3.0] - 2026-10-20
+### Added
+- **Built-in editors**
+  - `.md` and `.markdown` files open in a rich Markdown editor — tables, task lists, front matter, Mermaid, source mode, image paste and drop — whose relative links open in place, with `#heading` links and per-pane Back/Forward ([#929](https://github.com/diffplug/dormouse/pull/929), [#975](https://github.com/diffplug/dormouse/pull/975), [#1172](https://github.com/diffplug/dormouse/pull/1172)).
+  - A built-in PNG/JPEG image editor (markup, redact, crop, pixel tools) saves in place; Markdown images render at the size the document states, as on GitHub, with resize handles ([#1148](https://github.com/diffplug/dormouse/pull/1148), [#1174](https://github.com/diffplug/dormouse/pull/1174)).
+  - `dor o` is short for `dor open`, and a bare `dor open` opens a fuzzy file picker that shows each file's handler; `builtin:code` opens any text file in Monaco ([#930](https://github.com/diffplug/dormouse/pull/930), [#965](https://github.com/diffplug/dormouse/pull/965), [#1092](https://github.com/diffplug/dormouse/pull/1092)). Confirmed terminal file links such as `[Image #2]` open in a Dor viewer ([#953](https://github.com/diffplug/dormouse/pull/953)).
+- **Reopen** — command-mode `u` or `dor reopen` brings back closed Surfaces and Workspaces; clean viewers and untouched shells now close without a confirmation ([#967](https://github.com/diffplug/dormouse/pull/967)).
+- **Tools** — a Break button turns a Tool back into a plain terminal and moves its page into a browser pane; Tools hidden and idle for 30 minutes stop and restart when shown, restoring their state when they opt in ([#980](https://github.com/diffplug/dormouse/pull/980), [#961](https://github.com/diffplug/dormouse/pull/961)).
+- `dor` commands work from helper terminals without promoting them ([#952](https://github.com/diffplug/dormouse/pull/952)).
+- Pi agent sessions resume across app restart ([#898](https://github.com/diffplug/dormouse/pull/898)).
+- Settings → About names the exact build (official, development, or self-host) with a Copy details button; Activity settings moved under Notifications ([#1106](https://github.com/diffplug/dormouse/pull/1106)).
+- A "Copy failed" dialog appears when a clipboard write fails every way, with diagnostics to share ([#1091](https://github.com/diffplug/dormouse/pull/1091)).
+- Pocket: "Sign out and forget this phone" removes every paired computer and its push registrations ([#1251](https://github.com/diffplug/dormouse/pull/1251)).
+- 🖥️ **Workspaces** — right-click a tab to Rename, Pin right, Copy ref, Move to new window, or Close, with `dor workspace pin` / `unpin`; tabs size to their names and animate reorders; Pocket groups its session list by Workspace ([#1009](https://github.com/diffplug/dormouse/pull/1009), [#1045](https://github.com/diffplug/dormouse/pull/1045), [#956](https://github.com/diffplug/dormouse/pull/956)).
+- 🖥️ ⌘⇧T / File → Reopen Closed on macOS, including closed windows ([#967](https://github.com/diffplug/dormouse/pull/967)).
+- 🖥️ On macOS, a frozen window is sampled and restarted onto the still-running terminals ([#993](https://github.com/diffplug/dormouse/pull/993)).
+- 🖥️ Labs: "No-confirm delayed kill" replaces close confirmations with a 10-second restore window ([#969](https://github.com/diffplug/dormouse/pull/969)).
+
+### Changed
+- Surface and Workspace ids are `surface:<n>` / `workspace:<n>`: unique across the app, never reused, and unchanged when a pane moves. `DORMOUSE_SURFACE_ID` carries the same string. `dor list --id-format` and the `surface_ref` / `workspace_ref` JSON keys are removed, and old forms like `3` or `pane-…` are refused. Layouts saved by older builds are discarded on the first launch after upgrading; settings, pairings, and Tool trust are kept ([#1085](https://github.com/diffplug/dormouse/pull/1085)).
+- A Tool lasts one run: when its command quits, crashes, or fails to boot, the pane becomes a plain terminal, and only the run Dormouse launched may open files ([#979](https://github.com/diffplug/dormouse/pull/979), [#1061](https://github.com/diffplug/dormouse/pull/1061)).
+- Pane drag and drop: drop on a pane's middle to swap, on its outer thirds to split, or on gutters and window edges; pause on an edge and slide along it to drop beside a group of panes (replacing scroll-wheel scope cycling); Escape cancels; Tool and browser panes drag and resize like terminals ([#1177](https://github.com/diffplug/dormouse/pull/1177), [#905](https://github.com/diffplug/dormouse/pull/905), [#1168](https://github.com/diffplug/dormouse/pull/1168)).
+- Alerts are never silently dropped: a task finishing while you watch becomes a TODO, deferral waits only while a program is confirmed busy, only output that changes the screen counts as working, and "pause" is now "defer" ([#1080](https://github.com/diffplug/dormouse/pull/1080), [#1083](https://github.com/diffplug/dormouse/pull/1083), [#1171](https://github.com/diffplug/dormouse/pull/1171), [#1107](https://github.com/diffplug/dormouse/pull/1107)).
+- The terminal context panel is denser and torn from its source pane, with the other panes dimmed behind it ([#1010](https://github.com/diffplug/dormouse/pull/1010)).
+- Browser panes nobody can see stop streaming; iframe pages keep their origin and data across Reload ([#958](https://github.com/diffplug/dormouse/pull/958)).
+- Settings → Network levels are renamed "Nowhere", "Local networks only", "Anywhere", and "Anywhere, through \<your Relay>" ([#1039](https://github.com/diffplug/dormouse/pull/1039)).
+- Pocket asks for a passkey far less often: it stays signed in across launches, and reconnects to a recently used computer within that computer's presence window ([#1044](https://github.com/diffplug/dormouse/pull/1044)).
+- Only a paired phone can register for push notifications. Phones paired before this release keep their registrations, but must pair again to re-enable push ([#1226](https://github.com/diffplug/dormouse/pull/1226)).
+- Natural Voice (formerly managed voice, still a Hosted preview) enrolls separately from remote control, offers a curated set of voices, works in VS Code, and deletes its token at Hosted when turned off ([#999](https://github.com/diffplug/dormouse/pull/999), [#1000](https://github.com/diffplug/dormouse/pull/1000), [#1191](https://github.com/diffplug/dormouse/pull/1191), [#1207](https://github.com/diffplug/dormouse/pull/1207)).
+- A terminal link that opens another app names it in a confirmation, a document link to an HTML or SVG page asks first, and dangerous Windows protocol handlers are blocked ([#1101](https://github.com/diffplug/dormouse/pull/1101), [#1201](https://github.com/diffplug/dormouse/pull/1201)).
+- The pairing approval dialog shows only the device names Pocket itself sends ([#1163](https://github.com/diffplug/dormouse/pull/1163)).
+
+### Fixed
+- Security hardening: safe path quoting for PowerShell and fish, control and bidi characters refused in Tool definitions and links, a tighter webview CSP, no repo-configured git fsmonitor, planted Windows executables and network-share browser paths refused, Playwright loaded only from its own install, owner-only logs, and stricter Local networks and passkey checks ([#1033](https://github.com/diffplug/dormouse/pull/1033), [#1065](https://github.com/diffplug/dormouse/pull/1065), [#1060](https://github.com/diffplug/dormouse/pull/1060), [#1040](https://github.com/diffplug/dormouse/pull/1040), [#1197](https://github.com/diffplug/dormouse/pull/1197), [#1162](https://github.com/diffplug/dormouse/pull/1162), [#1034](https://github.com/diffplug/dormouse/pull/1034), [#988](https://github.com/diffplug/dormouse/pull/988), [#1031](https://github.com/diffplug/dormouse/pull/1031), [#1224](https://github.com/diffplug/dormouse/pull/1224), [#1240](https://github.com/diffplug/dormouse/pull/1240), [#1223](https://github.com/diffplug/dormouse/pull/1223), [#1243](https://github.com/diffplug/dormouse/pull/1243), [#1237](https://github.com/diffplug/dormouse/pull/1237), [#1242](https://github.com/diffplug/dormouse/pull/1242)).
+- Copying goes through the host's native clipboard, so copies no longer fail intermittently ([#1198](https://github.com/diffplug/dormouse/pull/1198)).
+- On Windows, WSL and Git Bash terminals start correctly again, shells stop promptly on close, typing no longer lags while ports are probed, and copy-editor keys no longer leak to the terminal ([#1253](https://github.com/diffplug/dormouse/pull/1253), [#985](https://github.com/diffplug/dormouse/pull/985), [#928](https://github.com/diffplug/dormouse/pull/928), [#951](https://github.com/diffplug/dormouse/pull/951)).
+- Agent-browser panes no longer freeze on a stale tab, hover and wheel reach unselected browser panes, and narrow viewports render cleanly and survive a provider swap; `dor agent-browser dor-diagnostics` reports on a frozen stream ([#1176](https://github.com/diffplug/dormouse/pull/1176), [#1175](https://github.com/diffplug/dormouse/pull/1175), [#1100](https://github.com/diffplug/dormouse/pull/1100), [#1124](https://github.com/diffplug/dormouse/pull/1124)).
+- App restart resumes every supported agent, including Codex 0.160, agents interrupted mid-reply, and narrow or hidden panes ([#960](https://github.com/diffplug/dormouse/pull/960)).
+- A crashed full-screen program no longer leaves mouse modes stuck, and starting Dormouse from Claude Code no longer turns off transcript saving in its panes ([#1157](https://github.com/diffplug/dormouse/pull/1157)).
+- Restarting a command in place no longer rings a spurious exit alert, and a serving Tool shows its TODO pill ([#976](https://github.com/diffplug/dormouse/pull/976)).
+- A shell displaced by session restore stops instead of streaming into the pane ([#1050](https://github.com/diffplug/dormouse/pull/1050), [#1070](https://github.com/diffplug/dormouse/pull/1070)).
+- Pane resizing follows the pointer when minimum sizes clamp the layout ([#901](https://github.com/diffplug/dormouse/pull/901)).
+- `dor ensure` and `dor tool` accept `--flag=value` before `--`, and `dor kill` / `dor reopen` help shows valid JSON ([#1116](https://github.com/diffplug/dormouse/pull/1116), [#1184](https://github.com/diffplug/dormouse/pull/1184)).
+- Enabling Pocket push no longer fails on removed or other-account computers, and a removed computer's push registration is retired ([#1095](https://github.com/diffplug/dormouse/pull/1095), [#1238](https://github.com/diffplug/dormouse/pull/1238), [#1239](https://github.com/diffplug/dormouse/pull/1239)).
+- One-time connection: a stalled attempt can be retried, and the phone page shows expiry at the deadline ([#918](https://github.com/diffplug/dormouse/pull/918), [#916](https://github.com/diffplug/dormouse/pull/916)).
+- Fixed update approval during the launch check, `dor` request routing across windows, VS Code terminal adoption on reload, and lost pairing outcomes ([#959](https://github.com/diffplug/dormouse/pull/959)).
+- 🔌 Closing VS Code shuts terminals down gracefully, and a malformed theme push no longer half-applies ([#983](https://github.com/diffplug/dormouse/pull/983)).
+- 🔌 On Windows, remote control between VS Code windows uses an unpredictable pipe name ([#1252](https://github.com/diffplug/dormouse/pull/1252)).
+- 🖥️ macOS logout or restart with Dormouse open no longer aborts ([#990](https://github.com/diffplug/dormouse/pull/990)).
+- 🖥️ On macOS, Cmd+C/X/V and undo work inside Tool editors through a native Edit menu ([#943](https://github.com/diffplug/dormouse/pull/943)).
+- 🖥️ Windows have a minimum size and reopen on screen ([#1058](https://github.com/diffplug/dormouse/pull/1058)).
+- 🖥️ Updated rustls for GHSA-2mjx-qc3c-rqvc ([#1073](https://github.com/diffplug/dormouse/pull/1073)).
+
 ## [1.2.0] - 2026-10-01
 ### Added
 - **Pairing improvements and phone connections**

docs/specs/deploy.md

@@ -25,13 +25,14 @@ A release that changes remote control or Hosted runs the red team first (`docs/s
 
 Human-driven, in order:
 
-1. **Update website snapshots** — run `node website/scripts/generate-deps.js` and `node website/scripts/generate-canary-recall.js` (on your `gh` login), review the diffs in `website/src/data/dependencies-{npm,cargo,runtime}.json` and `website/src/data/canary-recall.json`, commit if changed.
-2. **Draft release notes and bump version** — run `/release-notes` at the repo root ([.claude/commands/release-notes.md](../../.claude/commands/release-notes.md)), which owns the steps. Review the diff.
-3. **Commit and tag** — `git commit -am "Release vX.Y.Z"` then `git tag vX.Y.Z`.
-4. **Push** — `git push && git push origin vX.Y.Z`, which triggers CI (Stage 1).
-5. **Run local signing** — plug in the PIV USB key, then `./scripts/sign-and-deploy.sh all X.Y.Z`: it waits for CI, verifies and signs artifacts, writes the website update manifest, and creates the GitHub Release. Secrets follow [Environment / secrets](#environment--secrets). **Must reject a dirty tree, untracked files, or commits ahead of the configured upstream**; without an upstream the script warns that push status is unknown.
-6. **Deploy website** — commit `website/public/standalone-latest.json`. Cloudflare Pages project `mouseterm` deploys `release` to `dormouse.sh`; `main` produces previews. Promote reviewed `main` with `git fetch origin` then `git push origin origin/main:release`, without force.
-7. **Verify the release**
+1. **Start a release branch** — from the main checkout, `wt switch --create release-next --base main`, then `pnpm install` in the new worktree; every later step runs there. **A release reaches `main` through one PR, never a direct push.**
+2. **Update website snapshots** — run `node website/scripts/generate-deps.js` and `node website/scripts/generate-canary-recall.js` (on your `gh` login), review the diffs in `website/src/data/dependencies-{npm,cargo,runtime}.json` and `website/src/data/canary-recall.json`, commit if changed.
+3. **Draft release notes and bump version** — run `/release-notes` at the repo root ([.claude/commands/release-notes.md](../../.claude/commands/release-notes.md)), which owns the steps. Review the diff.
+4. **Commit and tag** — `git commit -am "Release vX.Y.Z"` then `git tag vX.Y.Z`.
+5. **Push** — `git push -u origin HEAD && git push origin vX.Y.Z`, which triggers CI (Stage 1).
+6. **Run local signing** — plug in the PIV USB key, then `./scripts/sign-and-deploy.sh all X.Y.Z`: it waits for CI, verifies and signs artifacts, writes the website update manifest, and creates the GitHub Release. Secrets follow [Environment / secrets](#environment--secrets). **Must reject a dirty tree, untracked files, or commits ahead of the configured upstream**; without an upstream the script warns that push status is unknown.
+7. **Deploy website** — commit `website/public/standalone-latest.json`, push, and open the release PR. **Must merge it with a merge commit, never a squash**, so the tag stays in `main`'s history for the [build stamp](#build-stamp). Cloudflare Pages project `mouseterm` deploys `release` to `dormouse.sh`; `main` produces previews. Promote the merged `main` with `git fetch origin` then `git push origin origin/main:release`, without force.
+8. **Verify the release**
    - GitHub Release assets are correct
    - On a Mac: extract the `.tar.gz`, open the `.app`, no Gatekeeper warning
    - On Windows: run the `.exe` installer, no SmartScreen warning
@@ -174,7 +175,7 @@ Config lives in [tauri.conf.json](../../standalone/src-tauri/tauri.conf.json) (`
 
 Shape: `version`, `notes`, `pub_date`, and a `platforms` map keyed `darwin-aarch64` / `windows-x86_64` / `linux-x86_64`, each with `url` and `signature` (that bundle's `.sig`, verbatim). **The script fails rather than emit a platform with an empty signature.**
 
-Manifest URLs carry the version in the *path* (`/v0.1.0/`) while the *filenames* stay stable. **The homepage's download buttons read their URLs from this same committed manifest**, so a release is only downloadable once step 6 has deployed it (`website/src/pages/Home.tsx`).
+Manifest URLs carry the version in the *path* (`/v0.1.0/`) while the *filenames* stay stable. **The homepage's download buttons read their URLs from this same committed manifest**, so a release is only downloadable once step 7 has deployed it (`website/src/pages/Home.tsx`).
 
 Source of truth: `sign_updates` in `scripts/sign-and-deploy.sh`; `plugins.updater` in `standalone/src-tauri/tauri.conf.json`.
 

lib/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dormouse-lib",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "license": "FSL-1.1-MIT",
   "private": true,
   "type": "module",

scripts/spec-word-budgets.json

@@ -5,7 +5,7 @@
   "docs/compatible-agents.md": 1800,
   "docs/specs/alert.md": 7100,
   "docs/specs/auto-update.md": 1000,
-  "docs/specs/deploy.md": 2250,
+  "docs/specs/deploy.md": 2300,
   "docs/specs/dor-browser.md": 5800,
   "docs/specs/dor-cli.md": 5150,
   "docs/specs/dor-tool.md": 6550,

standalone/src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "dormouse"
-version = "1.2.0"
+version = "1.3.0"
 description = "Persistent multitasking terminal for mice (and hotkey wizards too)"
 authors = ["DiffPlug"]
 license = "FSL-1.1-MIT"

standalone/src-tauri/tauri.conf.json

@@ -2,7 +2,7 @@
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "Dormouse Terminal",
   "mainBinaryName": "dormouse",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "identifier": "sh.dormouse.standalone",
   "build": {
     "beforeDevCommand": "pnpm dev",

vscode-ext/package.json

@@ -2,7 +2,7 @@
   "name": "dormouse",
   "displayName": "Dormouse — Terminal Multiplexer",
   "description": "A persistent multitasking terminal — a real tiling layout, tmux keybindings, mouse support, browser panes your agents can drive, and alerts when a task needs you.",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "publisher": "diffplug",
   "license": "FSL-1.1-MIT",
   "icon": "icon.png",