Panebox 2.2.0

README.md

@@ -73,8 +73,15 @@ Download the build for your platform from [Releases](https://github.com/viny4/pa
 
 Builds are **not code-signed**, because signing certificates cost money this project doesn't have. That means:
 
-- **macOS** will say the app "cannot be opened because the developer cannot be verified". Right-click the app → Open → Open.
-  - If it instead says **"Panebox is damaged and can't be opened"**, that is Gatekeeper rejecting a quarantined app, not a bad download. Run `xattr -dr com.apple.quarantine /Applications/Panebox.app` and open it again.
+- **macOS** will say *"Apple could not verify Panebox.app is free of malware"*. The app is fine — macOS simply cannot check a developer it does not know.
+
+  Click **Done** (never "Move to Bin"), then open **System Settings → Privacy & Security**, scroll to the bottom, and click **Open Anyway** next to "Panebox.app was blocked".
+
+  On macOS 15 and later, right-clicking the app and choosing Open no longer works; Apple removed that shortcut. If you would rather use the terminal:
+
+  ```bash
+  xattr -dr com.apple.quarantine /Applications/Panebox.app
+  ```
 - **Windows** will show a SmartScreen warning. Click "More info" → "Run anyway".
 
 If that trade-off isn't acceptable to you, build from source — it takes two commands.

SECURITY.md

@@ -29,7 +29,9 @@ Panebox loads arbitrary third-party websites, so the boundaries matter. What's i
 
 **Custom JavaScript per service.** Panebox lets you paste JavaScript that runs inside a service, with full access to that service and your logged-in session. This is intentional, opt-in, off by default, and warned about in the UI. Only paste code you understand.
 
-**Builds are unsigned.** Releases are not code-signed on macOS or Windows, because certificates cost money this project doesn't have. Verify what you download, or build from source.
+**Builds are unsigned and un-notarized.** Releases carry only an ad-hoc signature — enough for macOS to run them at all, but not a Developer ID. macOS will say it "could not verify Panebox is free of malware", and Windows will show SmartScreen. Both are accurate: nobody has vouched for these binaries. Verify what you download, or build from source.
+
+Practically, this also means auto-update cannot install itself on macOS: Squirrel refuses to update an app without a valid signature, so macOS gets a notification and a download link instead.
 
 **No sandboxing of service content beyond Chromium's own.** Panebox is a container around real websites. If a site is malicious, Chromium's sandbox and the session isolation above are what stand between it and you — the same as any browser.
 

index.html

@@ -149,6 +149,7 @@ <h3 id="settings-title">Settings</h3>
         <button class="tab-btn" data-tab="tab-workspaces">Workspaces</button>
         <button class="tab-btn" data-tab="tab-general">General</button>
         <button class="tab-btn" data-tab="tab-data">Data</button>
+        <button class="tab-btn" data-tab="tab-shortcuts">Shortcuts</button>
       </div>
 
       <section id="tab-services" class="tab-panel active">
@@ -231,6 +232,10 @@ <h3 id="settings-title">Settings</h3>
         </div>
         <p class="hint" id="config-path"></p>
       </section>
+
+      <section id="tab-shortcuts" class="tab-panel">
+        <div id="shortcut-list"></div>
+      </section>
     </div>
   </div>
 
@@ -321,6 +326,7 @@ <h3 id="screen-title">Choose what to share</h3>
   <script src="catalog.js"></script>
   <script src="icons.js"></script>
   <script src="lib/urls.js"></script>
+  <script src="lib/shortcuts.js"></script>
   <script src="lib/badge.js"></script>
   <script src="lib/activity.js"></script>
   <script src="renderer.js"></script>

lib/shortcuts.js

@@ -0,0 +1,102 @@
+/**
+ * Every shortcut and gesture in the app, in one place.
+ *
+ * This is what the Settings → Shortcuts tab renders. A test checks that every
+ * accelerator declared in the application menu appears here, so the list
+ * cannot quietly fall out of date with the real bindings.
+ *
+ * Keys are tokens rather than rendered strings: "mod" becomes ⌘ on macOS and
+ * Ctrl everywhere else.
+ */
+(function (root, factory) {
+  if (typeof module === 'object' && module.exports) module.exports = factory();
+  else root.SHORTCUTS = factory();
+})(typeof self !== 'undefined' ? self : this, function () {
+  const SECTIONS = [
+    {
+      title: 'Services',
+      items: [
+        { keys: ['mod', '1'], label: 'Jump to the first service (1–9)' },
+        { keys: ['mod', 'Tab'], label: 'Next service' },
+        { keys: ['mod', 'shift', 'Tab'], label: 'Previous service' },
+        { keys: ['mod', 'N'], label: 'Add a service' },
+        { keys: ['mod', 'R'], label: 'Reload the current service' },
+      ],
+    },
+    {
+      title: 'Layout',
+      items: [
+        { keys: ['mod', 'shift', 'S'], label: 'Split view — several services at once' },
+        { keys: ['mod', 'B'], label: 'Show or hide the sidebar' },
+        { keys: ['mod', 'T'], label: 'Todo panel' },
+        { keys: ['Esc'], label: 'Step back: close a menu, then the spotlight, then the grid' },
+      ],
+    },
+    {
+      title: 'Window',
+      items: [
+        { keys: ['mod', 'F'], label: 'Find in page' },
+        { keys: ['mod', ','], label: 'Settings' },
+        { keys: ['mod', 'shift', 'M'], label: 'Task manager' },
+        { keys: ['mod', 'shift', 'R'], label: 'Restart Panebox' },
+        // These differ per platform rather than being a plain "mod" swap.
+        { mac: ['alt', 'cmd', 'I'], win: ['ctrl', 'shift', 'I'], label: 'Developer tools' },
+        { mac: ['ctrl', 'cmd', 'F'], win: ['F11'], label: 'Full screen' },
+        // Electron's quit role registers no accelerator on Windows or Linux;
+        // Alt+F4 closes the window there. Saying "Ctrl+Q" would be a guess.
+        { mac: ['cmd', 'Q'], win: null, label: 'Quit' },
+      ],
+    },
+    {
+      title: 'Mouse',
+      mouse: true,
+      items: [
+        { gesture: 'Right-click a sidebar icon', label: 'Configure that service' },
+        { gesture: 'Drag a sidebar icon', label: 'Reorder your services' },
+        { gesture: 'Drag a sidebar icon onto the grid', label: 'Add it as a pane' },
+        { gesture: 'Click a sidebar icon while in split view', label: 'Add or remove that pane' },
+        { gesture: 'Double-click a pane header', label: 'Expand that pane' },
+        { gesture: 'Triple-click a pane header', label: 'Open that service on its own' },
+        { gesture: 'Drag the ⠿ handle in Settings → Services', label: 'Reorder your services' },
+      ],
+    },
+  ];
+
+  const MAC_SYMBOLS = { mod: '⌘', cmd: '⌘', shift: '⇧', alt: '⌥', ctrl: '⌃', Esc: 'esc', Tab: '⇥' };
+  const PC_SYMBOLS = { mod: 'Ctrl', cmd: 'Ctrl', shift: 'Shift', alt: 'Alt', ctrl: 'Ctrl', Esc: 'Esc', Tab: 'Tab' };
+
+  /** Renders one key token for the given platform. */
+  function keyLabel(token, isMac) {
+    const table = isMac ? MAC_SYMBOLS : PC_SYMBOLS;
+    return table[token] || token;
+  }
+
+  /**
+   * Both platforms for every row, so the list works as documentation and not
+   * only as a reminder for whatever machine you happen to be on.
+   *
+   * `keys` means the same combination on both, with "mod" resolving to ⌘ or
+   * Ctrl. `mac` and `win` are for the cases where they genuinely differ, and a
+   * null side means there is no binding on that platform.
+   */
+  function rows() {
+    return SECTIONS.map((section) => ({
+      title: section.title,
+      mouse: !!section.mouse,
+      items: section.items.map((item) => ({
+        label: item.label,
+        gesture: item.gesture || null,
+        mac: item.gesture ? null : (item.mac || item.keys || null),
+        win: item.gesture ? null : (item.win !== undefined ? item.win : item.keys || null),
+      })),
+    }));
+  }
+
+  /** Renders one side of a row: ["⌘","⇧","S"] or null when unbound. */
+  function render(keys, isMac) {
+    if (!keys) return null;
+    return keys.map((k) => keyLabel(k, isMac));
+  }
+
+  return { SECTIONS, rows, render, keyLabel };
+});

package.json

@@ -1,7 +1,7 @@
 {
   "name": "panebox",
   "productName": "Panebox",
-  "version": "2.1.1",
+  "version": "2.2.0",
   "description": "A small, private, open-source desktop deck for your web apps — AI tools, chat, mail and more in one window.",
   "main": "main.js",
   "license": "MIT",

renderer.js

@@ -1147,6 +1147,72 @@ function commitManageOrder() {
   }
 }
 
+/** Settings → Shortcuts. Both platforms, so the list doubles as documentation. */
+function renderShortcuts() {
+  const root = $('shortcut-list');
+  root.textContent = '';
+  const isMac = window.panebox.platform === 'darwin';
+
+  const legend = document.createElement('div');
+  legend.className = 'shortcut-legend';
+  const spacer = document.createElement('span');
+  const macCol = document.createElement('span');
+  macCol.textContent = 'macOS';
+  macCol.className = isMac ? 'current' : '';
+  const winCol = document.createElement('span');
+  winCol.textContent = 'Windows / Linux';
+  winCol.className = isMac ? '' : 'current';
+  legend.append(spacer, macCol, winCol);
+  root.appendChild(legend);
+
+  const keyGroup = (keys, current) => {
+    const cell = document.createElement('span');
+    cell.className = 'shortcut-keys' + (current ? ' current' : '');
+    if (!keys) {
+      const dash = document.createElement('span');
+      dash.className = 'shortcut-none';
+      dash.textContent = '—';
+      cell.appendChild(dash);
+      return cell;
+    }
+    for (const k of keys) {
+      const kbd = document.createElement('kbd');
+      kbd.textContent = k;
+      cell.appendChild(kbd);
+    }
+    return cell;
+  };
+
+  for (const section of window.SHORTCUTS.rows()) {
+    const heading = document.createElement('h4');
+    heading.className = 'shortcut-heading';
+    heading.textContent = section.title;
+    root.appendChild(heading);
+
+    for (const item of section.items) {
+      const row = document.createElement('div');
+      row.className = 'shortcut-row' + (section.mouse ? ' gesture-row' : '');
+
+      const label = document.createElement('span');
+      label.className = 'shortcut-label';
+      label.textContent = item.label;
+      row.appendChild(label);
+
+      if (item.gesture) {
+        const g = document.createElement('span');
+        g.className = 'shortcut-gesture';
+        g.textContent = item.gesture;
+        row.appendChild(g);
+      } else {
+        row.appendChild(keyGroup(window.SHORTCUTS.render(item.mac, true), isMac));
+        row.appendChild(keyGroup(window.SHORTCUTS.render(item.win, false), !isMac));
+      }
+
+      root.appendChild(row);
+    }
+  }
+}
+
 function renderWorkspaceList() {
   const list = $('workspace-list');
   list.textContent = '';
@@ -1904,6 +1970,7 @@ document.addEventListener('DOMContentLoaded', () => {
     fillSettingsForm();
     renderManageList();
     renderWorkspaceList();
+    renderShortcuts();
     openModal('settings-modal');
   });
   $('btn-workspace').addEventListener('click', (e) => {
@@ -2070,6 +2137,7 @@ document.addEventListener('DOMContentLoaded', () => {
     fillSettingsForm();
     renderManageList();
     renderWorkspaceList();
+    renderShortcuts();
     openModal('settings-modal');
   });
   window.panebox.menu.onOpenAdd(() => {

styles.css

@@ -732,3 +732,45 @@ body.reordering webview { pointer-events: none; }
   width: 18px; height: 18px; flex-shrink: 0; border-radius: 4px; font-size: 8px;
 }
 #split-menu { max-height: 320px; overflow-y: auto; }
+
+/* ---------------------------------------------------------- shortcuts tab */
+
+.shortcut-heading {
+  font-size: 11px; font-weight: 600; text-transform: uppercase;
+  letter-spacing: .05em; color: var(--text-dim);
+  margin: 18px 0 6px; padding-bottom: 5px; border-bottom: 1px solid var(--border);
+}
+.shortcut-heading:first-child { margin-top: 0; }
+
+/* Three columns: what it does, the macOS keys, the Windows/Linux keys. */
+.shortcut-legend,
+.shortcut-row {
+  display: grid;
+  grid-template-columns: minmax(0, 1fr) 118px 148px;
+  align-items: center; gap: 12px; padding: 8px 0;
+}
+.shortcut-legend {
+  padding: 0 0 4px; font-size: 10px; text-transform: uppercase;
+  letter-spacing: .05em; color: var(--text-dim);
+}
+.shortcut-legend .current { color: var(--accent); font-weight: 600; }
+
+/* A gesture spans both key columns. */
+.shortcut-row.gesture-row { grid-template-columns: minmax(0, 1fr) 278px; }
+
+.shortcut-label { font-size: 13px; color: var(--text); }
+.shortcut-keys { display: flex; align-items: center; gap: 4px; flex-shrink: 0; }
+.shortcut-keys:not(.current) { opacity: .5; }
+.shortcut-none { font-size: 12px; color: var(--text-dim); }
+
+.shortcut-keys kbd {
+  display: inline-flex; align-items: center; justify-content: center;
+  min-width: 24px; height: 24px; padding: 0 7px;
+  background: var(--bg-sunken); border: 1px solid var(--border);
+  border-bottom-width: 2px; border-radius: 6px;
+  font-family: inherit; font-size: 12px; color: var(--text);
+}
+.shortcut-gesture {
+  font-size: 11.5px; color: var(--text-muted); text-align: right;
+  max-width: 260px; line-height: 1.35;
+}