v0.6.0

Paneflow 0.6.0

Paneflow Conductor. Paneflow is now a control plane for a fleet of CLI coding agents running side by side in its panes: discover them, read their live state, dispatch prompts, and wait on their events, all from one public CLI and never by scraping the screen.

Highlights

• One CLI drives the whole fleet. The new public paneflow command talks to a running instance over its local IPC socket. paneflow ps / ls discover the agents and panes; status / read / search inspect one agent's live state and scrollback; send dispatches a prompt; up spawns agents from a declarative paneflow.workspace.toml; and flow run executes a full spawn -> wait -> feed -> review pipeline. It works the same whether the conductor is Claude Code, Codex, OpenCode, or Gemini.
• Wait on events, never poll. An outbound IPC event bus streams every ai.* transition and surface change. paneflow watch renders them as one JSON event per line with a heartbeat; paneflow wait --idle blocks until a pane goes quiet; wait --pattern blocks on a baseline-aware sentinel across one pane or many (--all / --any). No busy loops, no timer guessing.
• Hooked agents with a real state machine. Agents launched through up / flow are tracked turn by turn: their state (thinking, waiting_for_input, finished, ...) is authoritative, their ai.stop events fire, and their last message is captured off-screen in last_result, even for full-screen TUIs. A self-diagnosing hook installer reports exactly which agents are hooked and why, so an unhooked agent never fakes a state.
• The Paneflow conductor skill. A harness-agnostic, shell-only playbook ships so any agent can drive the others (discover -> read -> wait -> dispatch -> hand back), with a committed cross-vendor implement -> review pipeline at examples/review-pipeline.flow.toml to copy from.

Also in this release

• Deterministic auto-submit. paneflow send --submit wraps the prompt in bracketed paste, sends the carriage return as a separate calibrated write, and confirms the turn actually started before returning, instead of reporting a false submitted:true. --report-file appends a precise file contract so an agent writes its complete report to disk and prints REPORT_DONE.
• AI access controls. New toggles under Settings > AI Agent: a free-access mode that sanctions CLI auto-submit and traced writes, and an injection fence that wraps read output in an <untrusted_terminal_output> boundary. Both are off by default; writes are refused with an actionable error unless you opt in.
• Cross-platform from the first frame. The event bus streams over Windows named pipes through a PeekNamedPipe liveness guard (with a bounded fallback clock), the macOS parent-death reaper is guarded against PID reuse, the shim adds an orphan guard, and the workspace test suite passes natively on Windows.
• Inter-agent context blobs are written owner-only, pane labels are applied atomically at spawn, and the Agents environment toolbar no longer covers the embedded CLI.

Full Changelog: v0.5.9...v0.6.0