T26: a release's macOS disk image is signed with the owner's Developer ID and notarized: mac-app.sh signs under the hardened runtime and notarizes and staples the image when given an identity and the App Store Connect key; the Release workflow, dispatched by hand, runs it on the macos-signing runner and puts the image on the draft through release-asset.sh

.github/workflows/release.yml

@@ -0,0 +1,33 @@
+name: Release
+
+# Dispatched once the version's draft release holds the Windows and Linux builds.
+on:
+  workflow_dispatch:
+
+jobs:
+  macos:
+    # The owner's login session, whose keychain holds the Developer ID identity.
+    runs-on: macos-signing
+    steps:
+      - uses: actions/checkout@v7
+      # The runner's PATH lacks the host's rustup.
+      - run: echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+      - run: rustup toolchain install --no-self-update
+      - name: Build, sign and notarize the disk image
+        env:
+          SIGN_IDENTITY: "Developer ID Application: Yang Zhang (9PDD8M2SMS)"
+          NOTARY_KEY: ${{ runner.temp }}/notary.p8
+          NOTARY_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+          NOTARY_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+          NOTARY_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
+        run: |
+          trap 'rm -f "$NOTARY_KEY"' EXIT
+          (umask 077 && printf '%s' "$NOTARY_KEY_P8" > "$NOTARY_KEY")
+          scripts/mac-app.sh
+      - name: Put the disk image on the release
+        env:
+          RELEASE_API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
+          RELEASE_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          version=$(cargo pkgid)
+          scripts/release-asset.sh "target/release/ELYTerminal-${version##*[#@]}.dmg"

AGENTS.md

@@ -22,9 +22,10 @@ ELYTerminal. A terminal on GPUI and Ely components. `PRD.md` says what it does;
   - mouse gestures handed to gpui's view, at points from the content's top-left, modifiers as for keys: `click@x,y`, `click2@`, `click3@`, `rclick@`, `mclick@`, `drag@x,y@x,y`, `move@x,y`, the steps `ldown@`, `lup@`, `ldrag@`, `rdown@`, `rup@`, `mdown@`, `mup@`, and `scrollup@x,y@lines`, `scrolldown@x,y@lines`.
 - `scripts/check.sh`: fmt, clippy `-D warnings`, tests, the 500-line rule.
 - `scripts/linux.sh ARGS` runs `cargo ARGS` on the working tree in a Linux container, the build kept in Docker volumes; `scripts/linux.sh test --locked` runs the tests as a user, not root, as CI does. The tree goes in as a tar stream, every file dated now: Colima's shared folder can show the VM a file as it was before an edit, and cargo judges by date, so a tree older than the last build would reuse that build. It needs a Docker daemon: on macOS, Colima (`colima start`).
-- `scripts/mac-app.sh` builds `target/release/ELYTerminal.app` from a release build, signed ad hoc, and `ELYTerminal-VERSION.dmg` beside it, the app next to a link to Applications. Its icon: `examples/icons.rs` renders `assets/icons/elyterminal-macos.svg` into an iconset, which `iconutil` packs.
+- `scripts/mac-app.sh` builds `target/release/ELYTerminal.app` from a release build, signed ad hoc, and `ELYTerminal-VERSION.dmg` beside it, the app next to a link to Applications. Given `SIGN_IDENTITY` and the App Store Connect key, `NOTARY_KEY` (its .p8 file), `NOTARY_KEY_ID` and `NOTARY_ISSUER`, it signs with that identity under the hardened runtime, then notarizes and staples the image, and it stops before building when one is missing or no keychain holds the identity. Its icon: `examples/icons.rs` renders `assets/icons/elyterminal-macos.svg` into an iconset, which `iconutil` packs.
 - `scripts/windows-zip.ps1`, on Windows with Visual Studio's C++ tools, builds `elyterminal.exe` with its icon and zips it as `ELYTerminal-VERSION-windows-ARCH.zip` in `target/release`. After an edit to the figure, `cargo run --example icons -- ico assets/icons/elyterminal.svg assets/icons/elyterminal.ico` renders the icon again.
 - `scripts/linux-tar.sh` builds the release in Docker on `rust:1.95.0-bookworm` and packs it with `com.zacharyzhang.elyterminal.desktop` and the icon as `ELYTerminal-VERSION-linux-ARCH.tar.gz` in `target/release`.
+- `scripts/release-asset.sh FILE` puts FILE on the Gitea release of this version, a draft too, in place of a file of its name; `RELEASE_API` and `RELEASE_TOKEN` say where and as whom. The Release workflow, `.github/workflows/release.yml`, dispatched by hand, builds the signed and notarized disk image on the `macos-signing` runner and puts it on the release.
 
 ## Layout
 
@@ -62,28 +63,30 @@ ELYTerminal. A terminal on GPUI and Ely components. `PRD.md` says what it does;
 - 2026-10-14: an input method's commit goes to the program as UTF-8 under every kitty flag, as kitty (`keys.c`, `GLFW_IME_COMMIT_TEXT`) and Ghostty (test `kitty: composed text with report all`) send it.
 - 2026-10-14: what gpui hides from the kitty protocol: a key alone on a modifier sends nothing (gpui reports no key event for it), and shifted punctuation reports the character it types as its key, since gpui clears Shift for it.
 - 2026-10-14: on macOS, which Option key is down and whether a key repeats come from AppKit's current event: gpui rebuilds keys AppKit routes through its commands as fresh presses. As in Ghostty, `ApplePressAndHoldEnabled` is registered off, so held keys repeat instead of opening the accent menu, and a local event monitor hands Command key-ups to the focused view, since AppKit never routes them to the window.
-- 2026-10-14: mouse reports follow Ghostty's rules: X10 tracking sends presses alone without modifiers, SGR names the released button, motion inside one cell sends nothing, Shift takes the mouse back for selecting. The tap follows modes 9, 1000, 1002, 1003, 1005 and 1006 as xterm holds them: one tracking and one format at a time, the last set wins, any reset ends it, and RIS clears both. alacritty drops 9 and keeps each mode apart, so its mouse bits go unread. The tap's scanner reads controls inside a sequence as vte does: C0 runs, DEL and high bytes are skipped, CAN and SUB cancel, ESC restarts, subparameters are skipped. Motion reports the first held button: left, right, middle.
+- 2026-10-14: mouse reports follow Ghostty's rules: X10 tracking sends presses alone without modifiers, SGR names the released button, motion inside one cell sends nothing, Shift takes the mouse back for selecting. The tap follows modes 9, 1000, 1002, 1003, 1005 and 1006 as xterm holds them: one tracking and one format at a time, the last set wins, any reset ends it, and RIS clears both. alacritty drops 9 and keeps each mode apart, so its mouse bits go unread. The tap's scanner reads controls inside a sequence as vte does: C0 runs, DEL and high bytes are skipped, CAN and SUB cancel, ESC restarts, subparameters are skipped. Motion reports the first held button: left, right, middle. The pointer over the grid is the arrow, as the owner asked, not Ghostty's I-beam.
 - 2026-10-14: a wheel notch scrolls 3 lines, as Ghostty's discrete wheel; a trackpad scrolls its pixels. The wheel reports to a program that tracks the mouse, sends arrows on the alternate screen under mode 1007, and scrolls history otherwise.
-- 2026-10-14: Cmd-C and Cmd-V copy and paste on macOS, Ctrl-Shift-C and Ctrl-Shift-V elsewhere; Cmd-press, Ctrl-press off macOS, opens an OSC 8 target or a URL Ely's `links` finds in the wrapped line. Copies drop the newline alacritty ends a whole line with, as Ghostty's do. Bracketed pastes lose ESC and Ctrl-C, as alacritty's do; plain pastes end lines with CR. Typing and pasting clear the selection. Copy on select and OSC 52 writes to `p` or `s` go to the primary selection on Linux, as Ghostty's do; macOS and Windows have none, so they go to the clipboard.
+- 2026-10-14: Cmd-C and Cmd-V copy and paste on macOS, Ctrl-Shift-C and Ctrl-Shift-V elsewhere; on Windows Ctrl-V pastes too, as in Windows Terminal, since Windows shells take it so, while on Linux it stays the program's, as in GNOME Terminal and Ghostty; Cmd-press, Ctrl-press off macOS, opens an OSC 8 target or a URL Ely's `links` finds in the wrapped line. Copies drop the newline alacritty ends a whole line with, as Ghostty's do. Bracketed pastes lose ESC and Ctrl-C, as alacritty's do; plain pastes end lines with CR. Typing and pasting clear the selection. Copy on select and OSC 52 writes to `p` or `s` go to the primary selection on Linux, as Ghostty's do; macOS and Windows have none, so they go to the clipboard.
 - 2026-10-14: a key's release goes out only when the terminal saw its press, so a key a binding takes sends no release, as in kitty.
 - 2026-10-14: find opens on Cmd-F (Ctrl-Shift-F off macOS) beside the grid, outside the `Terminal` key context, so its keys never reach the program. Matches wash in Ely's `warning` color, the current one stronger; the newest is current first, Enter steps older and Shift-Enter newer. Shift-Enter binds under `TerminalFind > ElyInput`, the context of Ely's text input, whose own Shift-Enter binding takes the key. Find reads the grid as it shows: combining marks ride their cells, hidden cells are blank, wrapped rows join, words are Unicode; alacritty's own search reads no marks and knows only ASCII word edges. New output, a resize and a settings change search again; the current match stays the same occurrence: its line kept, grown or cut at its end, held under the same line above or in its place, before such a line elsewhere, nearest where scrolling moved it; else the nearest by line, then column. Searching and following take one pass over the text and the matches.
 - 2026-10-14: the program hears focus in and out under mode 1004 when the terminal's focus or the window's activation changes. The window wears the program's title, the app's name while it names none. A bell is logged and makes no sound. A full reset, `ESC c`, empties alacritty's title and sends only `CursorBlinkingChange`, in the parser's order, synchronized updates too; on that event the view replays the title through `set_options`, which sends it.
-- 2026-10-14: the title bar is transparent, as Ghostty's: the content runs under it, Ely's column headers drag the window, and the terminal's header shows the program's title. macOS draws its traffic lights at Ely's origin; elsewhere Ely draws the controls, so windows ask for client decorations, which only Linux reads, and Ely's `ResizeBorder` gives the edges. Cmd-B and Cmd-Alt-B (Ctrl-Shift-B and Ctrl-Shift-Alt-B off macOS) toggle the sessions and right columns, kept in the settings. A button at each end of the title bar does the same: `PanelLeft` leads the first column, right after the traffic lights, and `PanelRight` ends the last, so neither moves when a column hides; its tooltip says Hide or Show.
+- 2026-10-14: the title bar is transparent, as Ghostty's: the content runs under it, Ely's column headers drag the window, and the terminal's header shows the program's title. macOS draws its traffic lights at Ely's origin; elsewhere Ely draws the controls, so windows ask for client decorations, which only Linux reads, and Ely's `ResizeBorder` gives the edges. Cmd-B and Cmd-Alt-B (Ctrl-Shift-B and Ctrl-Shift-Alt-B off macOS) toggle the sessions and right columns, kept in the settings. A button at each end of the title bar does the same: `PanelLeft` leads the first column, right after the traffic lights, and `PanelRight` ends the last, before the window buttons Ely draws on Windows and Linux, so neither moves when a column hides; its tooltip says Hide or Show. On Windows and Linux, which have no menu bar, a gear just inside `PanelRight` opens Settings, as Ctrl-, does. It sends `OpenSettings` through `Window::dispatch_action`, which waits for the click to finish: `App::dispatch_action` updates the active window at once, which fails inside that window's own handler, and only gpui's log says so. The Git and Files switch tops the right column, centered below the title bar: on Windows the caption buttons left the last header no room for it.
 - 2026-10-14: session keys are Ghostty's: Cmd-T, Cmd-W, Cmd-1 to Cmd-8, Cmd-9 for the last, Ctrl-Tab and Ctrl-Shift-Tab; off macOS Ctrl-Shift-T, Ctrl-Shift-W and Alt with the digits. A digit past the last session goes on to the program. A new session runs the Shell setting in home or in the shown session's folder, as Start in says. A session whose program ends closes its row; the last row closes the window, and with no window left the app quits. A bell in a hidden session marks its row until it is shown. A hidden terminal hears no mouse release, so hiding it ends its mouse gesture as releases would: the selection drag ends, and the program hears each held button come up. A row's title is the program's, or the app's name while it names none.
-- 2026-10-14: Files shows the shown session's folder in Ely's `Tree`, not `FileTree`, which takes every path up front and drops empty folders. A folder is read off the main thread when it first opens; the root and the open folders are read again whenever the session reports a folder, so at each prompt. Git's marks come from `git status --porcelain=v2 -z -- .`, run with `--no-optional-locks`, so it never holds `index.lock` against the user's own git, and under the user's `status.showUntrackedFiles`, so a home folder kept in git stays quick. An untracked folder marks what it holds. On macOS, whose file systems ignore Unicode forms, a name keeps its form on disk and meets Git's mark in composed form, as git's `core.precomposeunicode` writes it. A label built from a path shows each control character as its picture, `␊` for a newline: gpui shapes no newline, and a file may be named with one. A name not in UTF-8 keeps its bytes: its label shows it lossily, and its tree key adds the bytes after a NUL, which no path holds, so no two names share a key. A program without shell integration gets a line in the right column until it reports a folder. A control in a column header keeps its presses: Ely's header zooms the window on any double press.
+- 2026-10-14: Files shows the shown session's folder in Ely's `Tree`, not `FileTree`, which takes every path up front and drops empty folders. A folder is read off the main thread when it first opens; the root and the open folders are read again whenever the session reports a folder, so at each prompt. Git's marks come from `git status --porcelain=v2 -z -- .`, run with `--no-optional-locks`, so it never holds `index.lock` against the user's own git, and under the user's `status.showUntrackedFiles`, so a home folder kept in git stays quick. An untracked folder marks what it holds. On macOS, whose file systems ignore Unicode forms, a name keeps its form on disk and meets Git's mark in composed form, as git's `core.precomposeunicode` writes it. A label built from a path shows each control character as its picture, `␊` for a newline: gpui shapes no newline, and a file may be named with one. A name not in UTF-8 keeps its bytes: its label shows it lossily, and its tree key adds the bytes after a NUL, which no path holds, so no two names share a key. A program without shell integration gets a line in the right column until it reports a folder.
 - 2026-10-14: git runs in English with `--literal-pathspecs` and without optional locks. Paths stay git's bytes until shown, so a name not in UTF-8 still names its own file; off Unix git writes UTF-8. Status reads porcelain v2. Paths to stage and unstage go in on stdin, NUL-ended (`--pathspec-from-file`), so any name and any count pass; an empty list is refused, since git would take it as the whole tree. Unstaging is `git reset`, which works before the first commit, and a staged rename unstages with its old path; a copy is a new file, its source no part of it. A diff is git's own, without external tools or text converters, a conflict against HEAD, our side, so a file we deleted reads as new; it is read into Ely's stretches; a binary file has none, and an untracked folder none either. Without an index git exits 1 for a difference and a failure alike; only a difference prints. What git warns of while it works goes to the log. The log needs a commit at HEAD: git refuses it before the first.
 - 2026-10-14: the Git panel shows HEAD's branch, or its short commit while detached; Ely's `ChangesList` of conflicted, staged, unstaged and untracked files; Ely's `CommitInput`; Ely's `CommitList` of the last 50 commits. A row's press opens its diff in Ely's fullscreen `Dialog` under the title bar, in Ely's `DiffViewer`, unified or split; a binary file, an untracked folder and a change of no line say so instead. Every control Ely draws works: stage, unstage, stage all, unstage all, amend, and discard, which asks first in Ely's `ConfirmDialog`: an edit goes back to the index (`git restore`); a new file, untracked or only intended to be added, is deleted (`git clean`, `git rm -f`). Git's clean passes over a repository of its own without a word, so a clean that removed nothing is an error. Actions run off the main thread, each after the one asked before it; a failure shows in Ely's `Alert` with git's words until dismissed or the next action, and after any action Files reads its marks again. A folder change drops the open diff, and one still loading, and blanks the view unless the new folder lies inside the shown work tree, so a cd within it does not blink; no action runs until the shown folder has read, so none reaches the repository left behind. A commit empties only the fields that still hold what it committed, and only once the shown folder has read and is in the same repository: a draft typed while it ran, or while a folder read, stays. A path shows on one line and once: as it is, or quoted as git quotes a name with control characters, quotes, backslashes or bytes not in UTF-8; a folder drops git's trailing slash, since no file shares its name. A section lists 500 files at most, and a line says how many are listed: Ely's list draws every row, and gpui copies every row's hitboxes and paint each frame, so 3000 rows halved the terminal's frames. The Git body is a cached view, so a terminal's output does not draw it again; it comes back from the Files tab with its lists scrolled to the top, since a view cached while hidden drops its widgets' state. Files stays uncached, so its tree keeps its open folders: Ely's `Tree` draws only the rows in view.
-- 2026-10-14: Cmd-, opens the settings window, or brings the open one forward, and Cmd-W closes it; off macOS Ctrl-, and Ctrl-Shift-W, as Ghostty's. Categories sit in Ely's `SettingsLayout`, rows in its `SettingsRow`; a category joins the list with its rows. Each change goes through `SettingsStore::update`, which checks and saves, and every view reads the global, so it applies at once. A shell saves only when it names a program the running user may run, as the system's `access` answers, ACLs too: empty for the login shell, a file at a full path, or a name found in one of `PATH`'s full folders; a relative folder counts for none, since it would hang on each session's own folder. On Windows a name without an extension means its `.exe`, as `CreateProcess` reads it; a name with one keeps it. A program whose path is not UTF-8 counts for none: a session starts its program by text. A session runs that same full path, so the check and the start agree; else the row says why and the saved one stays, since a bad shell stops the next start. The window takes focus inside when it opens, so its keys find its context. The app quits with its last terminal window: settings alone hold no terminal.
+- 2026-10-14: Cmd-, opens the settings window, or brings the open one forward, and Cmd-W closes it; off macOS Ctrl-, and Ctrl-Shift-W, as Ghostty's. Categories sit in the first of two columns of Ely's `ColumnShell`, an Ely `SelectableList` as `SettingsLayout` draws its own, and the open one's rows, Ely's `SettingsRow`, in the second; each column scrolls on its own, which `SettingsLayout`, one box for both, cannot. A category joins the list with its rows. Each change goes through `SettingsStore::update`, which checks and saves, and every view reads the global, so it applies at once. A shell saves only when it names a program the running user may run, as the system's `access` answers, ACLs too: empty for the login shell, a file at a full path, or a name found in one of `PATH`'s full folders; a relative folder counts for none, since it would hang on each session's own folder. On Windows a name without an extension means its `.exe`, as `CreateProcess` reads it; a name with one keeps it. A program whose path is not UTF-8 counts for none: a session starts its program by text. A session runs that same full path, so the check and the start agree; else the row says why and the saved one stays, since a bad shell stops the next start. The window takes focus inside when it opens, so its keys find its context. The app quits with its last terminal window: settings alone hold no terminal.
 - 2026-10-14: settings refuse unknown fields; a bad settings file stops the start and is never overwritten.
 - 2026-10-14: Appearance shows every built-in theme as Ely's `RadioCard` in a `SimpleGrid`, each over a small window in the theme's colors. Separate dark theme copies the theme into `dark_theme`, so turning it on changes nothing until a dark card is picked. A theme change re-dresses the chrome at once. Font family comes from Ely's `FontPicker`; size, line height and padding from its `NumberInput`, which saves a number on Enter, on leaving the field and on each step. A font saves, and a settings file starts, only when gpui loads it as the terminal draws it: gpui falls back to another font without a word and loads none without an `m`, so the terminal draws with no font but its own. The cursor preview is a prompt in the terminal's font and theme, its cursor drawn as the terminal draws it, blinking on the terminal's beat. Opacity moves by whole percents, so the saved fraction carries no float noise. A change the store refuses leaves the setting as it was, and the page says why at its top; a number field drops its draft, and the font picker shows the saved family again. The settings window opens at 900 by 640, room for three theme columns.
-- 2026-10-14: Terminal shows scrollback lines, Option as Alt, on macOS only, since elsewhere Alt is Alt, and copy on select. The engine reads each when it needs it, so a change applies at once to every session; a smaller scrollback drops the history past it.
+- 2026-10-14: Terminal shows the shell and where sessions start, which a General page held until the owner dropped it, then scrollback lines, Option as Alt, on macOS only, since elsewhere Alt is Alt, and copy on select, then every shortcut in Ely's `KeyboardShortcutsList`, read from the keymap: the bindings of each listed command that apply in the main window's terminal, matched at any depth of its context stack as gpui matches them, so the list cannot drift from the keys. The engine reads each when it needs it, so a change applies at once to every session; a smaller scrollback drops the history past it.
 - 2026-10-14: the main window lets the desktop through while Background opacity is under 1, blurred or clear as Background blur says, through gpui's `Blurred` (macOS's NSVisualEffectView, Windows' acrylic) or `Transparent`; at 1 it is `Opaque`. The workspace sets it as the settings change. Ely's `ColumnShell::glass`, added to Ely for this, grounds the columns in the palette's glass, which the opacity sets, so the title bar and every column let the desktop through alike; the palette's `bg` stays solid, so a dialog, the Git diff among them, hides what lies under it. The terminal paints no ground over the glass, or the two would stack; a program's own background (OSC 11) paints over it. Ely's own themes pass their palette too, Ely's colors with the glass set. The settings window stays opaque.
 - 2026-10-15: on Wayland the window asks for `ext_background_effect_v1` beside gpui's `org_kde_kwin_blur`. A guest connection on gpui's own display binds it, takes the effect for the window's surface once, and blurs the window's pane: the surface less Ely's resize margin on each free edge of a client-drawn window, worked out each frame and sent only when it changes; it goes and comes back with Blurred and lands at the surface's next commit, which every frame makes. The guest connection reads the display only while the window opens, before gpui's loop runs, and is never dropped: a drop destroys its proxies through the display, which gpui may close first. The log names what the compositor offers, so which way blur goes: `ext_background_effect_v1`, gpui's `org_kde_kwin_blur`, or none, the desktop clear. Its test runs a `wayland-server` compositor on a socket pair.
 - 2026-10-15: on a client-drawn window, so on Linux, Ely's `ResizeBorder` paints its pane solid and shadowed under the content, which kept the desktop from showing at all. `ResizeBorder::glass`, added to Ely for this, leaves the pane to the content while the window is see-through: no ground, nor the shadow gpui draws under the box, which would tint it. So the blur covers the pane alone and the resize margin stays clear. On X11 the window names its pane in `_KDE_NET_WM_BLUR_BEHIND_REGION` (CARDINAL, 32: x, y, width, height in the window's pixels), as Ghostty names its own, and drops the property when Blurred goes; KWin reads it, other compositors pass it by. It goes over a connection of ELYTerminal's own to `$DISPLAY`, which gpui opens too: a property belongs to the window, whoever sets it. gpui's own `org_kde_kwin_blur` on KDE's Wayland still covers the whole surface, margin included, beyond ELYTerminal's reach.
 - 2026-10-15: the macOS menu bar is the PRD's: ELYTerminal (Settings…, Quit), Shell (New Session, Close Session), Edit (Copy, Paste, Select All, Find), View (Toggle Sessions, Toggle Right Panel, Bigger, Smaller, Reset Size), Window (Minimize, Zoom, then the windows macOS lists). An item shows the key bound to its action, so the menus are set after the bindings; Copy, Paste and Select All go through AppKit's `copy:`, `paste:` and `selectAll:`, as gpui's `OsAction` maps them. They are Ely's text input actions, which `forms` exports for this, and the terminal handles them too: gpui sends a menu's action to what holds focus and enables the item only where a handler waits, so one action serves the terminal, find and every field. The new keys are Ghostty's: Cmd-Q, Cmd-A, Cmd-= and Cmd-+, Cmd-minus, Cmd-0, Cmd-M. Off macOS Quit and Select All take Ctrl-Shift, since Ctrl with a letter types a control byte; the font's size takes plain Ctrl with =, +, minus and 0, which type none, as in Ghostty, Alacritty and Windows Terminal; Minimize has no key there. Bigger and Smaller move every session's font a point, inside the Size range, and Reset Size goes back to the setting; nothing saves the change, as in Ghostty. Select All runs from the first character in the history to the last on the screen, the blanks around them left out, as Ghostty's, though a space under a combining mark shows a character and counts as one; copy on select takes it, and a blank grid selects nothing.
 - 2026-10-15: CI runs on self-hosted Gitea runners, each job with what its runner must hold. macOS runs on the host, with fish and PowerShell installed, or the two shell tests fail as they should. Windows runs on the host, with rustup's `cargo` and `rustc` proxies beside `rustup` and Visual Studio's C++ tools. Ubuntu (`ubuntu-24.04`) runs as root in `docker.gitea.com/runner-images:ubuntu-24.04`, installs the libraries gpui links, and runs the tests as a user it makes, since root ignores the file modes they check; its runner serves this repository alone, in a VM of its own, so a build cannot starve other containers. The Linux and Windows jobs build without debuginfo, as `scripts/linux.sh` does: with it, linking gpui's test binaries outgrew that VM's 8 GB. The macOS and Windows jobs run on the owner's own machines, so they skip `Swatinem/rust-cache`: its post step cleans `$CARGO_HOME`, which there is the owner's own, and after every job it deleted `rustup` from `~/.cargo/bin`, leaving its proxies pointing at nothing, and pruned the shared registry; the Linux job keeps it, inside its container. A run that waits on a missing runner stays queued: cancel stale ones before a new runner registers, or it runs every one. The shell tests type a line only once the line editor reads raw keys, canonical mode off: on CI, a line typed before PowerShell's first read was echoed by the terminal and never run. Every job installs the toolchain `rust-toolchain.toml` names with `rustup toolchain install --no-self-update` and never runs `rustup default`, so the owner's machines keep their own default toolchain and rustup; the macOS job puts the host's `~/.cargo/bin` on the runner's PATH, and the Linux container installs rustup first. A toolchain file's components install only with the toolchain: one already there without them makes each cargo call try to download them, so `scripts/linux.sh` and `scripts/linux-tar.sh` add them to their images.
 - 2026-10-15: on macOS 27 gpui's `Blurred` gives its NSVisualEffectView the `Selection` material, which builds no backdrop layer, so the desktop showed through sharp. `blur/macos` sets the view to `underWindowBackground` whenever the window turns Blurred: a gaussian blur of radius 30, the radius the owner's Ghostty uses; gpui's `updateLayer` still strips the material's tint and saturation. The view's presence proved nothing, so `shot` reads the radius off its backdrop layer.
-- 2026-10-15: the icon is drawn by hand in SVG, flat, so one figure serves both forms: on macOS it stands on a night-purple rounded square on Apple's grid (824 of 1024, radius 185) with sparkles, the gradient grained so it does not band; on Windows and Linux it stands alone, as Papirus draws app icons. The app is `com.zacharyzhang.elyterminal`, after the owner's domain, signed ad hoc: it opens on the Mac that built it, and Gatekeeper asks once on any other.
+- 2026-10-15: the icon is drawn by hand in SVG, flat, so one figure serves both forms: on macOS it stands on a night-purple rounded square on Apple's grid (824 of 1024, radius 185) with sparkles, the gradient grained so it does not band; on Windows and Linux it stands alone, as Papirus draws app icons. The app is `com.zacharyzhang.elyterminal`, after the owner's domain. A local build is signed ad hoc: it opens on the Mac that built it, and Gatekeeper asks once on any other; a release's is signed with the owner's Developer ID and notarized, so it opens on any Mac.
 - 2026-10-15: a release is a Gitea release tagged `vVERSION` with three builds, each from its script: the macOS disk image for Apple silicon, a Windows zip and a Linux tarball for x86_64. Each window names itself `com.zacharyzhang.elyterminal` through `Window::set_app_id` as it opens: on Linux that is Wayland's app id and X11's `WM_CLASS`, which the desktop entry's name and `StartupWMClass` match, so a dock pairs the window with the icon; gpui's X11 windows read no app id from `WindowOptions`.
 - 2026-10-15: on Windows a release build is a GUI program, so no console window opens beside it; a debug build keeps its console for the log. git then starts with `CREATE_NO_WINDOW`, or each call would open a console. Windows builds link the C runtime statically, so the executable needs no Visual C++ redistributable. gpui's build script embeds its manifest, PerMonitorV2 DPI awareness among it; `build.rs` adds the icon as resource 1, which gpui loads for each window, and stops the build when no resource compiler is found.
 - 2026-10-15: the Linux tarball builds on Debian 12, in `rust:1.95.0-bookworm`: a binary asks for the glibc symbol versions it was linked against, so it is linked against an old glibc, not the builder's. `scripts/linux-tar.sh` prints the glibc its build asks for, and the README names it: 2.35 for v0.1.0, which runs on Ubuntu 22.04.
+- 2026-10-15: on Windows gpui answers the system's hit test from the last frame: under the pointer, a `WindowControlArea::Drag` hitbox that nothing occludes makes it the caption, and Windows keeps the press, so no click reaches the app. In v0.1.0 every title bar control was dead so. Ely now occludes the drag region under its window buttons, which then answer as close, maximize and minimize, and under each column header's item row, whose controls get plain presses; the row stays the scroll container, and its title is a drag region of its own.
+- 2026-10-15: a release's macOS disk image comes from the Release workflow, dispatched once the draft holds the Windows and Linux builds. It runs on `macos-signing`, the Mac mini's runner in the owner's login session, whose keychain holds the Developer ID identity; at the owner's choice that runner moved from AgentCompany alone to the owner's level, so every repository reaches it. The job reads the App Store Connect key from the owner's user-level secrets `APPLE_API_ISSUER`, `APPLE_API_KEY_ID` and `APPLE_API_KEY_P8`, writes the .p8 into the runner's temp folder for notarytool alone, and puts the stapled image on the draft through `scripts/release-asset.sh` with the job's own token. One notarization covers the image and the app inside it; the image carries the ticket, and the app copied out finds its own online on its first open.

Cargo.lock

@@ -1701,7 +1701,7 @@ checksum = "0e9c71c2167ca323c882b99918929403426e2373ea17242ff5653e0d5e1058be"
 [[package]]
 name = "ely-gpui-component"
 version = "0.1.1"
-source = "git+https://git.zacharyzhang.com/ZacharyZhang-NY/Ely-GPUI-Components.git?rev=a2cb531e06e15f9e15d5b44a83f82beddb4888f9#a2cb531e06e15f9e15d5b44a83f82beddb4888f9"
+source = "git+https://git.zacharyzhang.com/ZacharyZhang-NY/Ely-GPUI-Components.git?rev=cdc5ce8247b58a876ffed9626953c3cb490a67ed#cdc5ce8247b58a876ffed9626953c3cb490a67ed"
 dependencies = [
  "alacritty_terminal",
  "anyhow",
@@ -1747,7 +1747,7 @@ dependencies = [
 
 [[package]]
 name = "elyterminal"
-version = "0.1.0"
+version = "0.1.1"
 dependencies = [
  "alacritty_terminal",
  "anyhow",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "elyterminal"
-version = "0.1.0"
+version = "0.1.1"
 edition = "2024"
 rust-version = "1.95"
 license = "MIT"
@@ -12,7 +12,7 @@ publish = false
 alacritty_terminal = { version = "=0.26.0", default-features = false }
 anyhow = "1"
 dirs = "7"
-ely-gpui-component = { git = "https://git.zacharyzhang.com/ZacharyZhang-NY/Ely-GPUI-Components.git", rev = "a2cb531e06e15f9e15d5b44a83f82beddb4888f9" }
+ely-gpui-component = { git = "https://git.zacharyzhang.com/ZacharyZhang-NY/Ely-GPUI-Components.git", rev = "cdc5ce8247b58a876ffed9626953c3cb490a67ed" }
 env_logger = "0.11"
 futures = "0.3"
 gethostname = "1.1.0"

PRD.md

@@ -60,7 +60,9 @@ Ghostty is the bar for what the terminal does. ELYTerminal owns its engine on `a
 - Ely's `ColumnShell`: sessions column, terminal column, right column. The window opens with blur when the setting is on.
 - The sessions column and the right column toggle, each by a button at its end of the title bar or by key, and keep their state in settings, so the window opens as it was left.
 - The title shows the active session's title, and no other text.
+- The pointer over the terminal is the arrow.
 - The title bar is transparent, as Ghostty's: the window's background, opacity and blur run under it, so it wears the terminal's color.
+- Every control in the title bar takes its own press on every platform, the window buttons Ely draws on Windows and Linux too.
 
 ## 7. Sessions panel
 
@@ -71,7 +73,7 @@ Ghostty is the bar for what the terminal does. ELYTerminal owns its engine on `a
 
 ## 8. Right panel: Files
 
-- A switch at the top: Git, Files.
+- A switch at the top, centered below the title bar: Git, Files.
 - Files shows the active session's working directory as a tree, folders first, Git status colors on names.
 - Double press: a folder opens, a file opens in the system's default app.
 - It reloads when the session reports a new directory and at each prompt.
@@ -87,11 +89,8 @@ Ghostty is the bar for what the terminal does. ELYTerminal owns its engine on `a
 
 ## 10. Settings window
 
-Cmd-, opens it. Categories on the left, rows on the right, Ely's settings components. Changes apply at once to every session and save.
+Cmd-, opens it; on Windows and Linux, which have no menu bar, so does a gear in the title bar. Categories on the left, rows on the right, each side scrolling on its own, Ely's components. Changes apply at once to every session and save.
 
-- General
-  - Shell: a path; empty runs the login shell.
-  - Start in: Home, or the active session's folder.
 - Appearance
   - Theme: a grid of previews.
   - Separate dark theme: a switch; when on, a second grid for dark mode.
@@ -100,9 +99,12 @@ Cmd-, opens it. Categories on the left, rows on the right, Ely's settings compon
   - Background opacity: a slider. Background blur: a switch.
   - Padding: horizontal and vertical.
 - Terminal
+  - Shell: a path; empty runs the login shell.
+  - Start in: Home, or the active session's folder.
   - Scrollback lines.
   - Option as Alt: off, left, right, both (macOS only).
   - Copy on select.
+  - Shortcuts: every shortcut, as this platform's keys, with a search.
 
 ## 11. Background blur
 
@@ -115,7 +117,7 @@ Cmd-, opens it. Categories on the left, rows on the right, Ely's settings compon
 ## 12. Menus and shortcuts
 
 - macOS menu bar: ELYTerminal (Settings, Quit), Shell (New Session, Close Session), Edit (Copy, Paste, Select All, Find), View (Toggle Sessions, Toggle Right Panel, Bigger, Smaller, Reset Size), Window.
-- The same shortcuts on Windows and Linux with Ctrl-Shift for terminal-colliding keys.
+- The same shortcuts on Windows and Linux with Ctrl-Shift for terminal-colliding keys. On Windows Ctrl-V pastes too, as in Windows Terminal.
 
 ## 13. Acceptance
 
@@ -127,13 +129,13 @@ Cmd-, opens it. Categories on the left, rows on the right, Ely's settings compon
 
 - The icon is Ely, a girl with long pink hair, holding a terminal in front of her.
 - macOS: the icon on the rounded square macOS gives app icons. Windows and Linux: the figure alone, no ground, flat, as Papirus draws.
-- `scripts/mac-app.sh` builds `ELYTerminal.app` from a release build with its icon, signed ad hoc, and a disk image holding it beside a link to Applications.
+- `scripts/mac-app.sh` builds `ELYTerminal.app` from a release build with its icon, signed ad hoc, or for a release with Developer ID and notarized, and a disk image holding it beside a link to Applications.
 
 ## 15. Release
 
-- A release on Gitea, tagged `vVERSION`, carries three builds: the macOS disk image (Apple silicon), a Windows zip (x86_64) and a Linux tarball (x86_64).
+- A release on Gitea, tagged `vVERSION`, carries three builds: the macOS disk image (Apple silicon, signed with Developer ID and notarized), a Windows zip (x86_64) and a Linux tarball (x86_64).
 - The Windows executable carries the icon. The Linux tarball carries the icon and a desktop entry, and the window names itself after it, `com.zacharyzhang.elyterminal`, as the macOS bundle does.
-- Each build comes from its platform's script: `scripts/mac-app.sh`, `scripts/windows-zip.ps1`, `scripts/linux-tar.sh`.
+- Each build comes from its platform's script: `scripts/mac-app.sh`, `scripts/windows-zip.ps1`, `scripts/linux-tar.sh`. The macOS one runs on the signing runner, through the Release workflow.
 
 ## Deferred
 

README.md

@@ -6,7 +6,7 @@ A terminal for macOS, Windows and Linux, in Rust on GPUI and Ely components. Ses
 
 A release on Gitea carries three builds.
 
-- macOS 11 or later, Apple silicon: open `ELYTerminal-VERSION.dmg` and drag ELYTerminal into Applications. The app is signed ad hoc, not notarized, so macOS stops its first open: in System Settings, Privacy & Security, press Open Anyway.
+- macOS 11 or later, Apple silicon: open `ELYTerminal-VERSION.dmg` and drag ELYTerminal into Applications. The app is signed with Developer ID and notarized.
 - Windows 10 or later, x86_64: unzip `ELYTerminal-VERSION-windows-x86_64.zip` and run `elyterminal.exe`. It is unsigned; if SmartScreen stops it, press More info, then Run anyway.
 - Linux, x86_64, glibc 2.35 or later, with libxkbcommon, libxkbcommon-x11 and libxcb:
 
@@ -44,7 +44,7 @@ The app writes its log to stderr. `RUST_LOG=elyterminal=debug` writes more; `tra
 - The terminal runs on `alacritty_terminal`: 256 colors and truecolor, bold, dim, italic, five underline styles, wide characters and combining marks. Box drawing, block elements and powerline shapes are drawn as geometry, so lines join across cells. Keys follow xterm and the kitty keyboard protocol; input methods compose at the cursor; programs can track the mouse; pastes are bracketed when a program asks; OSC 8 and plain links open with the link press below; find searches the scrollback.
 - Shell integration for zsh, bash, fish and PowerShell: each prompt reports its folder and title.
 - Sessions: new, close and switch. A bell marks a hidden session's row and makes no sound.
-- A button at each end of the title bar hides or shows its side column; the window opens as it was left.
+- A button at each end of the title bar hides or shows its side column; the window opens as it was left. On Windows and Linux a gear beside the right one opens Settings.
 - Files shows the session's folder as a tree with Git's marks.
 - Git shows the branch, stages, unstages, discards, commits, lists recent commits and opens diffs, all through the `git` command line.
 - Themes: Ely Dark, Ely Light, Catppuccin Mocha, Macchiato, Frappé and Latte, Tokyo Night, Dracula, Nord, Gruvbox Dark, Rosé Pine, Solarized Light, One Light and Kanagawa Wave. A second theme can take over while the system is dark.
@@ -52,6 +52,8 @@ The app writes its log to stderr. `RUST_LOG=elyterminal=debug` writes more; `tra
 
 ## Keys
 
+Settings › Terminal lists them all, as this platform binds them.
+
 | | macOS | Windows and Linux |
 |---|---|---|
 | New session | Cmd-T | Ctrl-Shift-T |
@@ -60,7 +62,7 @@ The app writes its log to stderr. `RUST_LOG=elyterminal=debug` writes more; `tra
 | Next, previous session | Ctrl-Tab, Ctrl-Shift-Tab | Ctrl-Tab, Ctrl-Shift-Tab |
 | Sessions column | Cmd-B | Ctrl-Shift-B |
 | Right column | Cmd-Alt-B | Ctrl-Shift-Alt-B |
-| Copy, paste | Cmd-C, Cmd-V | Ctrl-Shift-C, Ctrl-Shift-V |
+| Copy, paste | Cmd-C, Cmd-V | Ctrl-Shift-C, Ctrl-Shift-V; on Windows Ctrl-V pastes too |
 | Select all | Cmd-A | Ctrl-Shift-A |
 | Find | Cmd-F | Ctrl-Shift-F |
 | Bigger, smaller, reset size | Cmd-=, Cmd-minus, Cmd-0 | Ctrl-=, Ctrl-minus, Ctrl-0 |

TASKS.md

@@ -67,4 +67,8 @@ Progress truth. Top to bottom, one at a time. A task is ticked only after its co
 
 ## 15. Release
 
-- [ ] T25 Windows zip with the icon in the executable, Linux tarball with the icon and a desktop entry, the app id on Linux windows, their scripts; release v0.1.0 on Gitea with the three builds.
+- [x] T25 Windows zip with the icon in the executable, Linux tarball with the icon and a desktop entry, the app id on Linux windows, their scripts; release v0.1.0 on Gitea with the three builds.
+
+## 16. Fixes from the owner's first run
+
+- [ ] T26 On Windows every title bar control takes its press, Ely's window buttons too: in Ely, window buttons and header items occlude the drag region; the Git and Files switch moves below the title bar, centered; on Windows and Linux a gear in the title bar opens Settings; on Windows Ctrl-V pastes, as in Windows Terminal; the pointer over the terminal is the arrow; the settings window drops General, whose Shell and Start in lead Terminal, which lists every shortcut, and its categories and page scroll apart; the release's macOS disk image signed with Developer ID and notarized on the signing runner; release v0.1.1 with the three builds.

scripts/mac-app.sh

@@ -1,7 +1,18 @@
 #!/bin/sh
-# mac-app.sh: ELYTerminal.app in target/release, signed ad hoc, and its disk image.
+# mac-app.sh: ELYTerminal.app in target/release and its disk image, signed ad hoc, or by SIGN_IDENTITY and notarized.
 set -eu
 cd "$(dirname "$0")/.."
+sign=${SIGN_IDENTITY:-}
+if [ -n "$sign" ]; then
+  [ -s "${NOTARY_KEY:-}" ] && [ -n "${NOTARY_KEY_ID:-}" ] && [ -n "${NOTARY_ISSUER:-}" ] || {
+    echo "mac-app: SIGN_IDENTITY needs NOTARY_KEY (a .p8 file), NOTARY_KEY_ID and NOTARY_ISSUER" >&2
+    exit 1
+  }
+  security find-identity -v -p codesigning | grep -q -F "\"$sign\"" || {
+    echo "mac-app: no valid identity \"$sign\" in the keychains" >&2
+    exit 1
+  }
+fi
 cargo build --release --locked
 version=$(cargo pkgid)
 version=${version##*[#@]}
@@ -38,11 +49,29 @@ cat > "$app/Contents/Info.plist" <<EOF
 </plist>
 EOF
 plutil -lint -s "$app/Contents/Info.plist"
-codesign --force --sign - "$app"
+if [ -n "$sign" ]; then
+  codesign --force --options runtime --timestamp --sign "$sign" "$app"
+else
+  codesign --force --sign - "$app"
+fi
 mkdir "$work/disk"
 ditto "$app" "$work/disk/ELYTerminal.app"
 ln -s /Applications "$work/disk/Applications"
 dmg=$out/ELYTerminal-$version.dmg
 hdiutil create -quiet -volname ELYTerminal -srcfolder "$work/disk" -ov -format UDZO "$dmg"
+if [ -n "$sign" ]; then
+  codesign --force --timestamp --sign "$sign" "$dmg"
+  notary() { xcrun notarytool "$@" --key "$NOTARY_KEY" --key-id "$NOTARY_KEY_ID" --issuer "$NOTARY_ISSUER"; }
+  notary submit "$dmg" --wait --output-format json > "$work/notary.json" || true
+  status=$(plutil -extract status raw -o - "$work/notary.json" 2>/dev/null || echo none)
+  echo "mac-app: notarization $status"
+  if [ "$status" != Accepted ]; then
+    cat "$work/notary.json" >&2
+    id=$(plutil -extract id raw -o - "$work/notary.json" 2>/dev/null) && notary log "$id" >&2
+    exit 1
+  fi
+  xcrun stapler staple "$dmg"
+  spctl --assess --type open --context context:primary-signature --verbose "$dmg"
+fi
 echo "mac-app: $app"
 echo "mac-app: $dmg"

scripts/release-asset.sh

@@ -0,0 +1,32 @@
+#!/bin/sh
+# release-asset.sh FILE: puts FILE on the Gitea release of this version, a draft too, in place of one of its name.
+set -eu
+cd "$(dirname "$0")/.."
+file=$1
+[ -f "$file" ] || { echo "release-asset: no file $file" >&2; exit 1; }
+: "${RELEASE_API:?release-asset: RELEASE_API names the repository API, https://HOST/api/v1/repos/OWNER/REPO}"
+: "${RELEASE_TOKEN:?release-asset: RELEASE_TOKEN is a token that may edit the releases}"
+version=$(cargo pkgid)
+version=${version##*[#@]}
+name=$(basename "$file")
+auth="Authorization: token $RELEASE_TOKEN"
+work=$(mktemp -d)
+trap 'rm -rf "$work"' EXIT
+curl -fsS -H "$auth" "$RELEASE_API/releases?limit=50" > "$work/releases.json"
+ids=$(python3 -c '
+import json, sys
+tag, name, path = sys.argv[1:]
+found = [r for r in json.load(open(path)) if r["tag_name"] == tag]
+if len(found) != 1:
+    sys.exit(f"release-asset: {len(found)} releases tagged {tag}")
+print(found[0]["id"], *(a["id"] for a in found[0]["assets"] if a["name"] == name))
+' "v$version" "$name" "$work/releases.json")
+set -- $ids
+release=$1
+shift
+for old in "$@"; do
+  curl -fsS -X DELETE -H "$auth" "$RELEASE_API/releases/$release/assets/$old"
+  echo "release-asset: removed the old $name"
+done
+curl -fsS -H "$auth" -F "attachment=@$file" "$RELEASE_API/releases/$release/assets?name=$name" > /dev/null
+echo "release-asset: $name on release $release, v$version"

src/settings/window.rs

@@ -3,11 +3,11 @@ use std::fmt::Debug;
 use ely_gpui_component::{
     buttons::SegmentedControl,
     feedback::InlineMessage,
-    forms::{InputEvent, PathInput, Switch, TextInput},
+    forms::{InputEvent, Switch, TextInput},
-    primitives::{FocusScope, IconName, Severity},
+    lists::{ListItem, SelectableList},
-    settings::{SettingsLayout, SettingsRow, SettingsSection},
+    primitives::{FocusScope, Icon, IconName, Severity},
     shell::{ColumnShell, ResizeBorder, ShellColumn},
-    theme::{ActiveTheme, ControlSize},
+    theme::{ActiveTheme, ControlSize, IconSize},
 };
 use gpui::{
     App, AppContext, Bounds, Context, Entity, FocusHandle, InteractiveElement, IntoElement,
@@ -16,7 +16,7 @@ use gpui::{
     actions, div, prelude::FluentBuilder, px, size,
 };
 
-use super::{Settings, SettingsStore, StartIn};
+use super::{Settings, SettingsStore};
 use crate::{app::APP_ID, menus, term::BLINK};
 
 mod appearance;
@@ -28,8 +28,7 @@ actions!(elyterminal, [OpenSettings, CloseSettings]);
 const CONTEXT: &str = "Settings";
 
 /// Each category's key, name and icon.
-const SECTIONS: [(&str, &str, IconName); 3] = [
+const SECTIONS: [(&str, &str, IconName); 2] = [
-    ("general", "General", IconName::Settings),
     ("appearance", "Appearance", IconName::Palette),
     ("terminal", "Terminal", IconName::Terminal),
 ];
@@ -83,11 +82,13 @@ fn open_window(cx: &mut App) {
     }
 }
 
-/// The settings window: categories down the side, the open one's rows beside them.
+/// The settings window: categories in one column, the open one's rows in the next, each scrolling on its own.
 pub struct SettingsWindow {
     focus: FocusHandle,
     section: SharedString,
     shell: Entity<TextInput>,
+    /// The shortcut list's search.
+    search: Entity<TextInput>,
     /// Why the typed shell is not saved.
     refused: Option<SharedString>,
     /// Why the last change did not save.
@@ -110,6 +111,7 @@ impl SettingsWindow {
             input
         });
         let font = cx.new(|cx| TextInput::new(window, cx));
+        let search = cx.new(|cx| TextInput::new(window, cx).placeholder("Search shortcuts"));
         let typed = cx.subscribe(&shell, |this, input, event: &InputEvent, cx| {
             if let InputEvent::Changed = event {
                 let shell = input.read(cx).text().to_string();
@@ -123,6 +125,7 @@ impl SettingsWindow {
             focus,
             section: SECTIONS[0].0.into(),
             shell,
+            search,
             refused: None,
             failed: None,
             drafts: 0,
@@ -167,46 +170,36 @@ impl SettingsWindow {
         };
         cx.notify();
     }
-
-    fn general(&self, cx: &Context<Self>) -> SettingsSection {
-        let start = match SettingsStore::get(cx).start_in {
-            StartIn::Home => "home",
-            StartIn::Session => "session",
-        };
-        let shell = div()
-            .w(cx.theme().prose_width())
-            .flex()
-            .flex_col()
-            .gap_1()
-            .child(PathInput::new("settings-shell", &self.shell))
-            .children((self.refused.clone()).map(|why| InlineMessage::new(Severity::Danger, why)));
-        let start = SegmentedControl::new("settings-start-in", start)
-            .segment("home", "Home", None)
-            .segment("session", "Session's folder", None)
-            .size(ControlSize::Sm)
-            .on_change({
-                let this = cx.entity();
-                move |value, _, cx| start_in(&this, value, cx)
-            });
-        SettingsSection::new("General")
-            .row(SettingsRow::new("Shell").control(shell))
-            .row(SettingsRow::new("Start in").control(start))
-    }
 }
 
-/// Where new sessions start, as the settings keep it.
+/// The categories; a press, Up and Down, or Enter opens one.
-fn start_in(this: &Entity<SettingsWindow>, value: &SharedString, cx: &mut App) {
+fn sections(open: &SharedString, cx: &Context<SettingsWindow>) -> SelectableList {
-    let start = match value.as_ref() {
+    let muted = cx.theme().colors.fg_muted;
-        "home" => StartIn::Home,
+    let list = SECTIONS.iter().fold(
-        "session" => StartIn::Session,
+        SelectableList::new("settings-section-list").selected([open.clone()]),
-        other => unreachable!("settings: no start {other}"),
+        |list, (key, name, icon)| {
-    };
+            let item = ListItem::new(SharedString::from(format!("settings-section-{key}")), *name)
-    set(
+                .leading(Icon::new(*icon).size(IconSize::Sm).color(muted));
-        this,
+            list.row(*key, item)
-        format!("new sessions start in {start:?}"),
+        },
-        cx,
-        |settings| settings.start_in = start,
     );
+    let show = {
+        let this = cx.entity();
+        move |key: &SharedString, cx: &mut App| {
+            log::info!("settings: open {key}");
+            this.update(cx, |this, cx| {
+                this.section = key.clone();
+                cx.notify();
+            });
+        }
+    };
+    let enter = show.clone();
+    list.on_change(move |keys, _, cx| {
+        if let Some(key) = keys.first() {
+            show(key, cx);
+        }
+    })
+    .on_activate(move |key, _, cx| enter(key, cx))
 }
 
 /// A switch that saves through `put`.
@@ -289,9 +282,7 @@ fn set(
 
 impl Render for SettingsWindow {
     fn render(&mut self, window: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
-        let pick = cx.entity();
         let page = match self.section.as_ref() {
-            "general" => self.general(cx).into_any_element(),
             "appearance" => self.appearance(window, cx).into_any_element(),
             "terminal" => self.terminal(cx).into_any_element(),
             other => unreachable!("settings: no section {other}"),
@@ -302,26 +293,31 @@ impl Render for SettingsWindow {
             .gap_4()
             .children((self.failed.clone()).map(|why| InlineMessage::new(Severity::Danger, why)))
             .child(page);
-        let layout = SettingsLayout::new("settings", SECTIONS, self.section.clone(), {
+        let (_, name, _) = SECTIONS
-            move |key, _, cx| {
+            .iter()
-                pick.update(cx, |this, cx| {
+            .find(|(key, ..)| *key == self.section.as_ref())
-                    this.section = key.clone();
+            .expect("the open section is listed");
-                    cx.notify();
+        let list = div()
-                })
+            .id("settings-list")
-            }
+            .size_full()
-        })
+            .overflow_y_scroll()
-        .page(page);
+            .p_2()
+            .child(sections(&self.section, cx));
         let body = div()
             .id("settings-body")
             .size_full()
             .overflow_y_scroll()
             .p_6()
-            .child(layout);
+            .child(page);
-        let shell = ColumnShell::new("settings").column(
+        // The categories and the page scroll apart.
-            ShellColumn::new("settings-column")
+        let shell = ColumnShell::new("settings")
-                .title("Settings")
+            .column(
-                .child(body),
+                ShellColumn::new("settings-sections")
-        );
+                    .width(cx.theme().label_width() * 1.25)
+                    .title("Settings")
+                    .child(list),
+            )
+            .column(ShellColumn::new("settings-page").title(*name).child(body));
         // The context sits above the focus root, so its keys work wherever focus is.
         div()
             .size_full()

src/settings/window/terminal.rs

@@ -1,12 +1,25 @@
 use ely_gpui_component::{
-    forms::NumberInput,
+    buttons::SegmentedControl,
-    settings::{SettingsRow, SettingsSection},
+    feedback::InlineMessage,
-    theme::ControlSize,
+    forms::{Copy, NumberInput, Paste, PathInput, SelectAll},
+    primitives::Severity,
+    settings::{KeyboardShortcutsList, SettingsRow, SettingsSection, Shortcut},
+    theme::{ActiveTheme, ControlSize},
+};
+use gpui::{
+    Action, App, Context, Div, Entity, KeyContext, ParentElement, SharedString, Styled, div,
 };
-use gpui::Context;
 
-use super::{SettingsWindow, choice, set, switch};
+use super::{OpenSettings, SettingsWindow, choice, set, switch};
-use crate::settings::{OptionAsAlt, SCROLLBACK, SettingsStore};
+use crate::{
+    menus::{Bigger, Minimize, Quit, ResetSize, Smaller},
+    settings::{OptionAsAlt, SCROLLBACK, SettingsStore, StartIn},
+    term::input::{self, Find},
+    workspace::{
+        self, CloseSession, LastSession, NewSession, NextSession, PreviousSession, SelectSession,
+        TogglePanel, ToggleSessions,
+    },
+};
 
 /// Each way Option types Alt, its key and its name.
 const OPTIONS: [(OptionAsAlt, &str, &str); 4] = [
@@ -16,11 +29,42 @@ const OPTIONS: [(OptionAsAlt, &str, &str); 4] = [
     (OptionAsAlt::Both, "both", "Both"),
 ];
 
+/// The names of the sessions a digit shows.
+const PLACES: [&str; 8] = [
+    "Session 1",
+    "Session 2",
+    "Session 3",
+    "Session 4",
+    "Session 5",
+    "Session 6",
+    "Session 7",
+    "Session 8",
+];
+
 impl SettingsWindow {
-    /// Scrollback, Option as Alt on macOS, and copy on select.
+    /// Shell, start in, scrollback, Option as Alt on macOS and copy on select, then the shortcuts.
-    pub(super) fn terminal(&self, cx: &Context<Self>) -> SettingsSection {
+    pub(super) fn terminal(&self, cx: &Context<Self>) -> Div {
         let settings = SettingsStore::get(cx);
         let this = cx.entity();
+        let shell = div()
+            .w(cx.theme().prose_width())
+            .flex()
+            .flex_col()
+            .gap_1()
+            .child(PathInput::new("settings-shell", &self.shell))
+            .children((self.refused.clone()).map(|why| InlineMessage::new(Severity::Danger, why)));
+        let start = match settings.start_in {
+            StartIn::Home => "home",
+            StartIn::Session => "session",
+        };
+        let start = SegmentedControl::new("settings-start-in", start)
+            .segment("home", "Home", None)
+            .segment("session", "Session's folder", None)
+            .size(ControlSize::Sm)
+            .on_change({
+                let this = this.clone();
+                move |value, _, cx| start_in(&this, value, cx)
+            });
         let lines = NumberInput::new(("scrollback", self.drafts), f64::from(settings.scrollback))
             .range(f64::from(*SCROLLBACK.start()), f64::from(*SCROLLBACK.end()))
             .step(1000.)
@@ -35,6 +79,8 @@ impl SettingsWindow {
                 }
             });
         let mut section = SettingsSection::new("Terminal")
+            .row(SettingsRow::new("Shell").control(shell))
+            .row(SettingsRow::new("Start in").control(start))
             .row(SettingsRow::new("Scrollback lines").control(lines));
         // Off macOS, Alt is always Alt.
         if cfg!(target_os = "macos") {
@@ -53,6 +99,86 @@ impl SettingsWindow {
             settings.copy_on_select,
             |settings, on| settings.copy_on_select = on,
         );
-        section.row(SettingsRow::new("Copy on select").control(copy))
+        let section = section.row(SettingsRow::new("Copy on select").control(copy));
+        let keys = SettingsSection::new("Shortcuts")
+            .row(KeyboardShortcutsList::new(shortcuts(cx), &self.search));
+        div().flex().flex_col().gap_6().child(section).child(keys)
     }
 }
+
+/// Where new sessions start, as the settings keep it.
+fn start_in(this: &Entity<SettingsWindow>, value: &SharedString, cx: &mut App) {
+    let start = match value.as_ref() {
+        "home" => StartIn::Home,
+        "session" => StartIn::Session,
+        other => unreachable!("settings: no start {other}"),
+    };
+    set(
+        this,
+        format!("new sessions start in {start:?}"),
+        cx,
+        |settings| settings.start_in = start,
+    );
+}
+
+/// The listed commands, in order: group, name and action.
+fn listed() -> Vec<(&'static str, &'static str, Box<dyn Action>)> {
+    let mut listed = vec![
+        ("Sessions", "New session", NewSession.boxed_clone()),
+        ("Sessions", "Close session", CloseSession.boxed_clone()),
+        ("Sessions", "Next session", NextSession.boxed_clone()),
+        (
+            "Sessions",
+            "Previous session",
+            PreviousSession.boxed_clone(),
+        ),
+    ];
+    let places = PLACES.iter().enumerate();
+    listed.extend(places.map(|(ix, name)| ("Sessions", *name, SelectSession(ix).boxed_clone())));
+    listed.extend([
+        ("Sessions", "Last session", LastSession.boxed_clone()),
+        ("Edit", "Copy", Copy.boxed_clone()),
+        ("Edit", "Paste", Paste.boxed_clone()),
+        ("Edit", "Select all", SelectAll.boxed_clone()),
+        ("Edit", "Find", Find.boxed_clone()),
+        ("View", "Toggle sessions", ToggleSessions.boxed_clone()),
+        ("View", "Toggle right panel", TogglePanel.boxed_clone()),
+        ("View", "Bigger", Bigger.boxed_clone()),
+        ("View", "Smaller", Smaller.boxed_clone()),
+        ("View", "Reset size", ResetSize.boxed_clone()),
+        ("App", "Settings", OpenSettings.boxed_clone()),
+        ("App", "Minimize", Minimize.boxed_clone()),
+        ("App", "Quit", Quit.boxed_clone()),
+    ]);
+    listed
+}
+
+/// Each listed command's keys in the main window's terminal, a line per binding, from the keymap.
+fn shortcuts(cx: &App) -> Vec<Shortcut> {
+    let stack = [workspace::CONTEXT, input::CONTEXT]
+        .map(|name| KeyContext::parse(name).expect("a context name parses"));
+    let keymap = cx.key_bindings();
+    let keymap = keymap.borrow();
+    let mut shortcuts = Vec::new();
+    for (group, name, action) in listed() {
+        for binding in keymap.bindings_for_action(action.as_ref()) {
+            // gpui matches a binding at any depth of the context stack.
+            let applies = binding.predicate().is_none_or(|predicate| {
+                (1..=stack.len()).any(|depth| predicate.eval(&stack[..depth]))
+            });
+            if applies {
+                let strokes: Vec<String> = binding
+                    .keystrokes()
+                    .iter()
+                    .map(|key| key.unparse())
+                    .collect();
+                shortcuts.push(Shortcut {
+                    group: group.into(),
+                    name: name.into(),
+                    keys: strokes.join(" ").into(),
+                });
+            }
+        }
+    }
+    shortcuts
+}

src/term/input.rs

@@ -47,6 +47,10 @@ pub fn bind_keys(cx: &mut App) {
         ["tab", "shift-tab", "f6", "shift-f6"]
             .map(|key| KeyBinding::new(key, NoAction, Some(CONTEXT))),
     );
+    // Windows pastes on Ctrl-V too, as Windows Terminal does.
+    if cfg!(windows) {
+        cx.bind_keys([KeyBinding::new("ctrl-v", Paste, Some(CONTEXT))]);
+    }
 }
 
 impl TerminalView {

src/term/view.rs

@@ -360,7 +360,6 @@ impl Render for TerminalView {
             .on_any_mouse_down(cx.listener(Self::mouse_down))
             .on_mouse_move(cx.listener(Self::mouse_move))
             .on_scroll_wheel(cx.listener(Self::wheel))
-            .cursor_text()
             .size_full()
             .px(px(settings.padding_x))
             .py(px(settings.padding_y))

src/workspace.rs

@@ -18,7 +18,7 @@ use crate::{
     git::panel::{Acted, GitPanel},
     menus,
     sessions::{self, Session},
-    settings::{PanelTab, Settings, SettingsStore, StartIn},
+    settings::{PanelTab, Settings, SettingsStore, StartIn, window::OpenSettings},
     term::{
         Events, Launch, Pty, TerminalEvent, TerminalView, config,
         shell::{ShellIntegration, launch},
@@ -45,7 +45,7 @@ actions!(
 pub struct SelectSession(pub usize);
 
 /// The key context of the main window's content.
-const CONTEXT: &str = "Workspace";
+pub const CONTEXT: &str = "Workspace";
 
 /// The window's title while the program names none.
 pub const TITLE: &str = "ELYTerminal";
@@ -332,10 +332,7 @@ fn column_toggle(
         .variant(ButtonVariant::Ghost)
         .size(ControlSize::Sm)
         .tooltip(tip)
-        .on_click(move |_, _, cx| {
+        .on_click(move |_, _, cx| workspace.update(cx, |this, cx| this.toggle(flip, cx)))
-            cx.stop_propagation();
-            workspace.update(cx, |this, cx| this.toggle(flip, cx));
-        })
 }
 
 impl Render for Workspace {
@@ -359,6 +356,20 @@ impl Render for Workspace {
             tip(settings.show_panel, "Git and Files"),
             |settings| settings.show_panel = !settings.show_panel,
         );
+        // No menu bar off macOS: a gear opens Settings.
+        let gear = (!cfg!(target_os = "macos")).then(|| {
+            IconButton::new("open-settings", IconName::Settings)
+                .variant(ButtonVariant::Ghost)
+                .size(ControlSize::Sm)
+                .tooltip("Settings")
+                .on_click(|_, window, cx| window.dispatch_action(Box::new(OpenSettings), cx))
+        });
+        let end = div()
+            .flex()
+            .items_center()
+            .gap_2()
+            .children(gear)
+            .child(right);
         let mut shell = ColumnShell::new("workspace").glass();
         let shown = self
             .sessions
@@ -379,7 +390,6 @@ impl Render for Workspace {
                 .size(ControlSize::Sm)
                 .tooltip("New session")
                 .on_click(move |_, window, cx| {
-                    cx.stop_propagation();
                     workspace.update(cx, |this, cx| this.new_session(window, cx))
                 });
             shell = shell.column(
@@ -410,11 +420,6 @@ impl Render for Workspace {
                 .segment("files", "Files", None)
                 .size(ControlSize::Sm)
                 .on_change(|value, _, cx| show_tab(value, cx));
-            // Its presses stay off the header, whose double press zooms.
-            let switch = div()
-                .id("panel-switch")
-                .on_click(|_, _, cx| cx.stop_propagation())
-                .child(switch);
             let quiet = self
                 .sessions
                 .get(self.active)
@@ -433,14 +438,15 @@ impl Render for Workspace {
             shell = shell.column(terminal).column(
                 ShellColumn::new("panel")
                     .width(width)
-                    .leading(switch)
+                    .action(end)
-                    .action(right)
+                    // Below the title bar, clear of Windows' caption buttons.
+                    .child(div().flex().justify_center().px_2().pt_2().child(switch))
                     .children(quiet.then(caption))
                     .child(body(tab == PanelTab::Git).child(self.git.clone().cached(fill())))
                     .child(body(tab == PanelTab::Files).child(self.files.clone())),
             );
         } else {
-            shell = shell.column(terminal.action(right));
+            shell = shell.column(terminal.action(end));
         }
         // The context sits above the focus root, so its keys work wherever focus is.
         div()

tasks/acceptance.md

@@ -69,7 +69,9 @@ What no check reached: no one has looked at the window on Windows, which CI buil
 | `ColumnShell` with three columns; blur when the setting is on | T11, T19 | `shot` names a `BlurredView` under the window | Pass |
 | Columns toggle and keep their state | T11, T23 | a click on each title bar button hid its column and saved it, and a restart opened the window with both hidden (147 columns against 87); Cmd-B with the app active; Ctrl-Shift-B on a real X11 window | Pass |
 | The title shows the session's title, nothing else | T11 | log: "the title is", per session shown | Pass |
+| The pointer over the terminal is the arrow | T26 | the terminal sets no pointer, so gpui's arrow shows; on X11 with the pointer over the grid, gpui asked for no I-beam ("text"), which it had asked for, and failed to load under Xvfb, before | Pass |
 | The title bar is transparent | T11, T19 | T19 review | Pass |
+| Every title bar control takes its press, Ely's window buttons on Windows and Linux too | T26 | Ely `cdc5ce8`: `window_controls_occlude_what_lies_under` (each style; before, the box under Windows' caption buttons took the press), `a_wobbling_press_on_a_slot_moves_no_window` (before, the window moved), `a_wobbling_press_on_a_column_title_moves_the_window`; on the owner's PC, window messages asked the app for Windows' hit test along the title bar: v0.1.0 answered caption from end to end, T26's build answers client over the toggles and +, caption over the titles, min, max and close over Ely's buttons, and a press on close closed the app; the owner has not yet clicked it | Partial |
 
 ## 7. Sessions panel
 
@@ -84,7 +86,7 @@ What no check reached: no one has looked at the window on Windows, which CI buil
 
 | PRD line | Task | Evidence | Status |
 |---|---|---|---|
-| Git and Files switch | T13 | T13 review | Pass |
+| A switch at the top, centered below the title bar: Git, Files | T13, T26 | T13 review; a capture on X11 shows it centered below the title bar, the right toggle and Ely's window buttons in the bar above | Pass |
 | The session's folder as a tree, folders first, Git colors | T13 | `files::tests` | Pass |
 | Double press opens a folder, or a file in the default app | T13 | T13 review, with a logging `open` stub | Pass |
 | Reloads on a new folder and at each prompt | T13 | log: "the tree shows", per folder reported | Pass |
@@ -104,10 +106,12 @@ What no check reached: no one has looked at the window on Windows, which CI buil
 
 | PRD line | Task | Evidence | Status |
 |---|---|---|---|
-| Cmd-, opens it; categories left, rows right; changes apply at once and save | T16 | T16 review | Pass |
+| Cmd-, opens it; categories left, rows right, each scrolling on its own; changes apply at once and save | T16, T26 | T16 review; on X11, eight wheel notches over the Terminal page carried it down to its Edit and View shortcuts while the category column and both headers stayed | Pass |
-| General: Shell, Start in | T16 | `settings::tests` | Pass |
+| On Windows and Linux, a gear in the title bar opens it too | T26 | on X11 under Xvfb with xfwm4, xdotool's click on the gear, just inside the right toggle, opened the 900×640 Settings window ("settings: the window opens"), after a click on + opened a session; sent through `App::dispatch_action`, the same click had opened nothing; the owner has not yet clicked it on Windows | Partial |
+| Terminal: Shell, Start in | T16, T26 | `settings::tests`; the General page is gone, and a capture on X11 shows its two rows leading Terminal | Pass |
 | Appearance: theme grids, dark theme, font, size, line height, ligatures, cursor and preview, opacity, blur, padding | T17 | T17 review | Pass |
 | Terminal: scrollback, Option as Alt (macOS), copy on select | T18 | T18 review | Pass |
+| Terminal: every shortcut, with a search | T26 | read from the keymap, the bindings that apply in the main window's terminal; on X11 the list showed this platform's keys (Ctrl+Shift+T, Alt+1 and on), and typing "paste" left Edit's Paste, Ctrl+Shift+V | Pass |
 
 ## 11. Background blur
 
@@ -125,6 +129,7 @@ What no check reached: no one has looked at the window on Windows, which CI buil
 |---|---|---|---|
 | The macOS menu bar | T22 | `shot` lists every item with its key | Pass |
 | The same shortcuts off macOS, Ctrl-Shift where they collide | T22 | xdotool on a real X11 window: select all, size, toggle, find, quit | Pass |
+| On Windows Ctrl-V pastes too, as in Windows Terminal | T26 | the binding is Windows' alone; on a real X11 window, with a command on the clipboard through xclip, Ctrl-Shift-V pasted its 33 characters and the shell ran it, and Ctrl-V pasted nothing, as Linux keeps it for programs; the owner has not yet pressed Ctrl-V on Windows | Partial |
 
 ## 13. Acceptance
 
@@ -132,7 +137,7 @@ What no check reached: no one has looked at the window on Windows, which CI buil
 |---|---|---|
 | Each task ticked with a passing review | each task is ticked only after its review, as `tasks/reviews.md` records; T04 and T10 reached the three-round cap without a passing round, their last fixes standing on red-green tests | Partial |
 | `scripts/check.sh` passes | macOS: 135 tests, clippy, fmt, 500 lines; Linux through `scripts/linux.sh`: 138 tests, clippy, on aarch64 in Colima and on x86_64 in WSL's Docker | Pass |
-| CI green on macOS, Ubuntu and Windows | run 926 on `65bb4d3`: all three jobs pass; see the CI notes below | Pass |
+| CI green on macOS, Ubuntu and Windows | run 934 on `0075667`: all three jobs pass; see the CI notes below | Pass |
 
 ## 14. Icon and the macOS app
 
@@ -146,7 +151,7 @@ What no check reached: no one has looked at the window on Windows, which CI buil
 
 | PRD line | Task | Evidence | Status |
 |---|---|---|---|
-| A Gitea release, `vVERSION`, with the macOS disk image, a Windows zip and a Linux tarball | T25 | published after T25's review | Open |
+| A Gitea release, `vVERSION`, with the macOS disk image, a Windows zip and a Linux tarball | T25 | `v0.1.0` at `0075667`, its three files built from that commit by their scripts and checked again: the disk image verifies and its app passes `codesign --verify --strict`; the zip's executable has the icon and no C runtime DLL; the tarball opens its window on Ubuntu 22.04; each file downloaded back matches the SHA-256 in the release notes | Pass |
 | The Windows executable carries the icon | T25 | its resources: icon group 1 with the seven images of `elyterminal.ico`, 16 to 256 px, and gpui's manifest (PerMonitorV2); a GUI program, importing no C runtime DLL; not yet seen on a Windows screen | Pass |
 | The Linux tarball carries the icon and a desktop entry; the window names itself `com.zacharyzhang.elyterminal` | T25 | on Ubuntu 22.04: `desktop-file-validate` reports nothing, every library resolves, glibc 2.35; under Xvfb `WM_CLASS` reads `com.zacharyzhang.elyterminal` twice, and under headless sway the window's `app_id` reads the same | Pass |
 | Each build comes from its script | T25 | `scripts/mac-app.sh` on macOS, `scripts/windows-zip.ps1` on the owner's Windows PC, `scripts/linux-tar.sh` in the owner's WSL | Pass |
@@ -165,6 +170,8 @@ Run 907 then failed the PowerShell test on macOS: it typed its probe right after
 
 Run 926, on `65bb4d3`, passed all three jobs: macOS ran `scripts/check.sh` (135 tests, the fonts check, clippy, fmt, the 500-line rule) and the build; Ubuntu ran 138 tests and the build; Windows ran 113 tests and the build, without the Unix-only pty and shell tests.
 
+After run 928 cargo failed on the Windows PC: `Swatinem/rust-cache`'s post step had deleted `rustup` from the host's `~/.cargo/bin`, on the Mac mini too, leaving the proxies pointing at nothing. The cache step now runs only in the Linux container. On the hosts, `rustup toolchain install --no-self-update` reads `rust-toolchain.toml` in place of dtolnay's action, which ran `rustup default`, so CI leaves their default toolchain alone. Run 934, on `0075667`, passed all three jobs, each on 1.95.0 "overridden by rust-toolchain.toml".
+
 ## The owner's checks
 
 On 2026-10-15 the owner ran the app on macOS and found three faults, now fixed:

tasks/reviews.md

@@ -120,3 +120,8 @@ Each task gets at most three codex rounds. Each round: the commit, the verdict,
 ## T24
 
 - Round 1, c0a9eb3..65bb4d3: PASS. Before the review, 65bb4d3 named the icon's parts as SVG groups instead of comments, drawing the same pixels, and made mac-app.sh read the version in a clone named elyterminal. CI run 926 on 65bb4d3 passed on macOS, Ubuntu and Windows.
+
+## T25
+
+- Round 1, 2b8ae5d and 0075667: FAIL. The v0.1.0 release was not yet on Gitea, so the task line's release stood open.
+- Round 2, 59e41ea: PASS. v0.1.0 at 0075667 carries the disk image, the Windows zip and the Linux tarball; the reviewer downloaded each and found its SHA-256, signature, icon, manifest and glibc as recorded. CI run 934 on 0075667 passed on macOS, Ubuntu and Windows.