Ironflow Desktop v0.24.0

Ironflow Desktop v0.24.0 moves Claude onto the Agent Client Protocol transport, the same seam Copilot already runs on, and turns the Files view into a working git surface: stage, unstage, discard, commit, branch, fetch, pull and push, scoped to a branch, a turn or a base branch. Workspace approval now covers Bash as well as edits, permission requests raise a notification aimed at the chat that needs it, and a new “Allow edits” checkbox on the Add workspace form grants write access before the first turn instead of after it.

Added

• Git writes in the Files view. Files is no longer read-only. Stage and unstage paths, discard a change, commit, switch or create a branch, fetch, fast-forward pull, and push with upstream setup — all from the pane, with the diff scoped to the whole branch, a single turn, or a base branch of your choosing. Every write is contained in main: the renderer hands over paths, not pathspecs, a busy guard serializes queued writes, a dirty tree blocks a branch switch, and unpushed commits are marked by SHA. Design and rationale are in ADR 0091 (#2333)
• Claude runs over the Agent Client Protocol. The direct Claude SDK seam, the legacy transport and the legacy permission seam are gone; Claude now goes through the pinned ACP adapter, the same path Copilot uses. MCP credential isolation is preserved across the cutover, and event and usage reporting keep parity with the old transport (#2322)
• Branch switcher in the workspace footer. The footer’s branch chip is a button now. It opens a popover for picking a different branch, matching the escape hatch the file row already offered for a blocked repo (#2335)
• Select-all in the Files summary. One checkbox beside the file count stages everything unstaged, or unstages everything once all files are staged. It shows indeterminate while the working tree is mixed (#2335)
• “Allow edits” on the Add workspace form. Checked by default, it writes the workspace write grant at creation time, so the agent can edit files without the first-turn grant dialog. The flag crosses the untrusted bridge, so it is validated as an optional boolean — absent or non-boolean reads as false, the fail-closed direction. The git caveat is named in the sublabel rather than gated on, because the applied-changes report comes from the worktree diff and is empty outside a git repo (#2297)
• Ask @triage sits on the run card. The row menu was the only way to carry a run into a question, at one menu open per run. The card’s heading band now carries the same action as a chat icon at its right edge: one click seeds the composer with @triage <run-id> and focuses it, cursor at the end. Both paths call the same handler, so they cannot drift apart (#2329)
• Click an attached image to see it full size. A sent image showed only as a thumbnail and the Context tab’s attachment evidence only as a 20px thumb — neither could be read. Clicking either now opens the full image in a native modal dialog: backdrop, Esc to close, focus trap, click anywhere to dismiss, and a close button top-right. In the Context tab the whole row is the trigger, because 20px is too small to aim at (#2299, #2300)
• Collapsible context file sections, remembered. Long context lists fold down section by section, and the app remembers which sections you left closed (#2314, #2317)
• HTML previews in the Files pane. HTML files get the rendered/source toggle markdown already had. The rendered side runs in a sandboxed iframe with dark preview chrome and fades in after the first paint; the source side stays escaped (#2309)
• Scroll-to-bottom control in the channel feed (#2332)

Changed

• Workspace approval covers Bash. The persisted per-workspace grant auto-allows Bash alongside Edit, Write and NotebookEdit, for Claude and every ACP harness, across chats and restarts, until you revoke it. The remembered-Bash-rules feature is removed end to end — recognizer, store helpers, IPC handlers, preload bindings, schemas, the allow-always and allow-chat card buttons, and the Settings list — so a permission decision is now just allow or deny, and every surface says the same thing: approval covers edits and commands. This amends ADR 0044 and supersedes ADR 0088 (#2313)
• The engine details popup is pinned to the window. It used to measure the workspace panel on every open, making its position and usable width a function of wherever you had dragged the nav — at the 180px panel floor it degraded to 244px wide. It now opens at one constant spot, flush with the left edge of its own trigger, at a constant 380x500, and the body absorbs the slack so the box is the same size on both tabs and in every workspace (#2327, #2326)
• Collapsed activity rows defer their bodies. Expensive tool output no longer mounts until you expand the row (#2326)
• The Ironflow Agent help copy matches the app. It named only the four API providers when Settings lists seven sources, the first three of them subscription CLIs, and it promised that switching sources does not change the experience — a CLI source hides the cost chip and the plan toggle, and prompts for reads outside the workspace. The bullet names the CLI lane and keeps the claim that is still true: one interface, whichever source runs the turn (#2323)

Fixed

• Claude turns settle on the CLI’s idle signal. Interactive turns always use streaming input so the SDK keeps stdin open, which ends the “Stream closed” failures on intermediate turns (#2313)
• Claude model discovery uses the Node adapter. Discovery was launching the interactive CLI instead of the harness’s full discovery launch, so the model list came back wrong. Copilot discovery stays covered by the same launch API (#2326)
• /name skill turns reach Claude Code. A /prototype … turn answered “Unknown command: /prototype” and ran nothing. With settingSources empty on this engine every skill arrives as a plugin, so plugin:skill is the only form the slash grammar resolves — Desktop sends the qualified name now. The composer also takes focus on every route into a chat, including the sidebar row that never got it (#2298)
• Permission requests raise a notification. One alert per batch, when the pending queue goes empty-to-one, so parallel tool calls are one banner instead of N — and only when the card is off screen, decided from the persisted content view plus window focus rather than the session’s selected chat, which stays set behind Files, the terminal or Settings. Clicking the banner opens the owning chat (#2312, #2318)
• Monitor is covered by workspace approval (#2318)
• The context percentage is measured against the model that produced the reading. The Usage tab painted the newest turn’s token count against the window of the model currently picked, not the one that answered — and a pick only applies on the next submission. A 200k reading shown against a 1M window read as a quarter of the context used. It now resolves the window from the newest usage-bearing turn’s own model, falling back to the selected model only when no such turn exists; a provider-reported window still wins first, so the ACP and Codex paths are untouched (#2297)
• Files keeps your selection and your place. The previewed file stays visible in the tree, the selected file is kept per workspace for the session, context file paths are reconciled after a turn moves them, and opening a context file lands in the Files pane (#2309, #2320, #2307)
• Streamed activity output holds its layout. Tool output in the activity feed is highlighted as source, stretches to the available width, and no longer reflows while a turn streams (#2315, #2316, #2321)
• The applied-changes diff shows a spinner while it highlights. Until Shiki resolved, the panel was an empty box with nothing to say it was working; it now reads “Loading changes…” until the highlighted diff is ready (#2319)
• Workspace switches mask their flash. Rail-panel and content-pane data — git status, skills, the native dashboard view — populated piecemeal after a switch. One spinner covers the region until the switch settles, and the native dashboard view drops for that span so it cannot paint over the overlay (#2335)

Download the latest release