WinTUI: baixar versions anteriors

CLI Control & Status — the headless CLI becomes the day-to-day control plane: wintui config edits any global setting, wintui rules manages per-package rules, and wintui cleanup scan reports what the Cleanup tab would reclaim, all without launching the TUI and without adding destructive automation.

- wintui config list/get/set/unset over the same 16 keys the Settings tab edits: human-readable values, strict validation (a typo is an error, never silently normalized), unset restores the real default, --json returns self-describing objects.
- wintui rules list/show/set/clear: show prints the explicit rule next to the effective value so inheritance is visible; set changes only the fields you pass in one write; holds are an explicit none/all/version state and a version hold is never silently turned into a permanent one; package IDs are case-insensitive.
- wintui cleanup scan: read-only per-target sizes with honest statuses (needs_admin instead of a wrong unelevated walk, partial with a lower bound, recent with what the age floor kept); deletion stays in the TUI.
- Behavior change: the Core Temp cleanup age floor is now the cleanup_min_age setting (off/1d/3d/7d) and defaults to 1 day instead of the previous hard-coded 7 days; every surface reports what the floor kept, and a non-elevated TUI shows "needs admin" instead of 0 B for admin-only targets.
- settings.json is safe for two writers: unique temp file + rename, delta writes from the CLI and TUI write points, never overwriting a file that cannot be parsed; a running TUI re-reads external changes on refresh and doctor warns while a change is pending.
- Per-package rule keys are matched case-insensitively with one canonical key per package; conflicting hand-edited duplicates are reported by doctor.
- Dependencies: go-runewidth 0.0.28 fixes a start-up/memory regression shipped in v2.11.x; bubbletea/bubbles/lipgloss routine refresh. Go toolchain unchanged (1.26.6); the Win32 syscall symbol set is identical to v2.11.2.

Script-drop hardening — toast delivery, first-run toast shortcut setup, and the self-update handoff now pass their PowerShell commands inline. WinTUI no longer writes transient .ps1 files for these operations and no longer uses -ExecutionPolicy Bypass; the rendered command line is validated against the Windows CreateProcess length ceiling before launch.

- Process behavior is unchanged: hidden toast helper, self-update handoff console, and absolute PowerShell/winget path resolution all work exactly as before.
- Cleanup of legacy handoff-*.ps1 files created by releases before v2.11.2 remains available in the Cleanup tab, relabelled as legacy data.
- Diagnostics record a fixed operation name and transport, never command text; the self-update log still records the attempted winget command for post-mortem debugging.
- No settings, cache, history, CLI, or keybinding changes; no dependency or Go toolchain changes — the binary delta is attributable to the transport hardening alone, and the Win32 syscall symbol set is identical to v2.11.1.

Clipboard paste fix — pasting into the `/` filter and the `s` search overlay (Ctrl+V or right-click in the terminal) never worked in any prior version: the terminal delivers pastes as bracketed-paste events, which WinTUI's input routing silently discarded. Pastes now reach the focused text input, with overlays/modals correctly swallowing them, and multi-line clipboard content sanitized.

- Security: golang.org/x/text 0.40.0 fixes GO-2026-5970 (infinite loop on invalid input, reachable via the text-rendering path — defense-in-depth); built with the Go 1.26.6 security toolchain.
- Dependencies: charm.land/bubbles 2.1.1, golang.org/x/sys 0.47.0, mattn/go-runewidth 0.0.27 (terminal-accurate width for ZWJ/flag emoji and combining marks) — first dependabot-mediated refreshes, full CI validation. Zero new Win32 surface — the syscall symbol set is identical to v2.11.0.
- Supply chain: first release with GitHub build-provenance attestations — a `wintui_provenance.intoto.jsonl` bundle ships with the release, and artifacts verify via `gh attestation verify <file> --repo kts982/wintui`. Repo-side, WinTUI now runs CodeQL, OpenSSF Scorecard (published), and a golangci-lint gate.
- No breaking changes; settings.json, cache.json, and history.json are untouched.

History tab — the action-history log introduced in v2.10.0 gets its browsing surface inside the TUI. A new History tab (4) lists every batch WinTUI has run — including headless `wintui upgrade` runs from Task Scheduler — newest first, with per-batch drill-down (per-package record, from/to versions, status, error text) and a cross-batch timeline per package. Failed-only filter on `f`, reload on `r`, and the tab re-reads the log on switch so concurrent CLI runs appear. Settings moves from key 4 to key 5.

- Cleanup: opt-in "WinTUI action history" target. A default-unchecked privacy reset that clears %APPDATA%\wintui\history.json, with an explicit warning that it erases the audit trail the History tab renders. The cleanup allowlist admits only WinTUI's own roaming dir.
- doctor: the "winget MCP" row now also detects the MCP server binary via its %LOCALAPPDATA% alias path, fixing a false "not present" on standard installs.
- Toolchain/deps: Go 1.26.5 (2026-07-07 security release; both CVEs evaluated, unreachable in WinTUI), bubbletea 2.0.8, lipgloss 2.0.5 (closed-wrap-writer crash fix), fuzzy 0.1.3 (NUL-rune panic fix), x/sys 0.46.0. Zero new Win32 surface — the syscall symbol set is identical to v2.10.0.

Action history — WinTUI now logs the install/upgrade/uninstall operations it runs, including headless `wintui upgrade` and `wintui import`, so scheduled and CLI-only runs are no longer invisible, and exposes them via a new `wintui history` command. Also adds `wintui fix --portable`, a targeted fix for a winget bug that drops portable CLIs from PATH on upgrade. Pure Go: no new Win32 imports and no new dependencies; settings.json and cache.json load unchanged.

- Action history (#4). Every batch WinTUI runs is recorded to %APPDATA%\wintui\history.json with per-package from/to versions and status. `wintui history` lists recent batches; `wintui history <id>` shows one package's timeline. Flags: --limit, --since, --failed-only, --json. Records WinTUI-originated actions only — winget exposes no event feed for external changes.
- wintui fix --portable. Pins portable winget packages to user scope (scope=user, elevate=false) so a future upgrade can't strip them from PATH (winget-cli #4044/#5099). Idempotent, with --dry-run and --json; `wintui upgrade` also nudges toward it when an at-risk portable package is about to upgrade.
- Ride-alongs. `wintui doctor` gains a neutral "winget MCP" detection row, and headless `wintui upgrade` prints a periodic "still working (Nm elapsed)" heartbeat so a slow installer isn't mistaken for a hang.

Hardening & correctness — a security and robustness pass over the paths that elevate, self-update, run external commands, and mutate shared settings. No new features and no breaking changes; settings.json and cache.json are unchanged and normal install/upgrade/uninstall behavior is identical.

- Elevated-helper hardening. The elevated helper now requires a per-session token on every request and validates winget arguments against a strict allowlist (known verb + the exact flag shapes WinTUI emits), rejecting unknown actions and installer-escalation flags (--override, --custom, --location, --manifest).
- Pinned binaries. winget and powershell.exe are resolved to absolute system paths before every spawn, with winget validated under a known WindowsApps location; the elevated path errors rather than running an unpinned binary.
- Self-update fails closed. The self-upgrade handoff aborts with an actionable error if winget can't be resolved to a trusted path, and the canary-only rehearsal override is compiled out of release builds.
- Correctness fixes. Removed a 1000-package list cap that silently truncated large inventories; settings mouse clicks route to the correct row in both header layouts; deterministic winget error messages; a new doctor "State dirs" row surfaces previously-silent config/cache directory failures.
- Internal robustness. Fixed a UI-loop vs background-refresh data race on shared settings; serialized the elevation pipe with cancellable contexts (stuck elevated actions can be cancelled; a dropped connection no longer leaks a handle); validate import ids/versions and cleanup roots before use.

CLI Polish — the headless CLI becomes a first-class, on-brand surface.

- Styled CLI via charmbracelet/fang. wintui --help, usage, errors, and --version are now rendered to match your active color theme. Shell completions ship via `wintui completion <bash|zsh|fish|powershell>`, and `wintui upgrade --id` / `wintui show` complete package IDs from the local cache (no winget call).
- wintui notes <id>. Fetch and render a package's release notes (markdown, themed) when the winget manifest provides them, with a URL fallback otherwise. wintui check --notes renders the notes for every pending update inline, so you can review what you're about to install before upgrading.
- wintui theme [name] [--list]. Show, list, or set the color theme from the CLI; the active theme also appears in wintui doctor.
- wintui upgrade --self. Upgrade WinTUI itself from the CLI via the startup self-update handoff — the other upgrade modes deliberately skip the running binary, so CLI-only users stay current without launching the TUI.
- wintui list [query]. Filter installed packages by name or id (like winget list); `wintui list firefox` doubles as an "is it installed?" check (exits 1 when nothing matches).
- Themed CLI output. Release notes match your theme palette; upgrade success/failure markers, per-package headers, and check/list summaries are accent-colored. All color is gated on an interactive terminal and respects NO_COLOR — piped output and --json stay plain.
- Scroll-wheel support in the package list, detail panel, and cleanup tab.

No breaking changes; settings.json is unchanged and cache.json remains backward-compatible (it gains optional truncation metadata).

- Color Theme picker. Eight curated palettes — Sweet Pink (default), WinTUI Midnight, Catppuccin (Mocha + Latte), Nord, Dracula, Tokyo Night, Ember (Dusk + Dawn), Monochrome. Cycle in Settings (Left/Right/Space). Every theme ships matching Dark and Light variants; the variant is picked automatically from the terminal's detected background color via tea.RequestBackgroundColor, so themes read correctly on both dark and light terminals without configuration.
- Theme Background setting (opt-in). When set to "theme", the active palette tints the terminal background via OSC 11. Default "terminal" leaves the terminal background untouched. Off by default because OSC 11 support varies across terminals; on unsupported terminals this setting is a no-op.
- Theme engine. A single setActiveTheme call rebinds every package-level color and rebuilds every cached lipgloss.Style. Model-held styles (spinners, text inputs, viewport border, progress bar, all six help slots) ride a themeAware interface — every screen returns an updated value via applyTheme() screen and cascades into its sub-components. A conformance test asserts every screen reachable via createScreen implements the interface. Animated header gradient now generated via lipgloss.Blend1D from two endpoint colors per theme.
- Visible polish. All six help bar slots styled (FullKey/FullDesc/FullSeparator were previously left at bubbles defaults). Help separator sources from the palette dim slot instead of hardcoded ANSI 238. Window title set to "WinTUI" via the v2 tea.View.WindowTitle field.
- No breaking changes, no new Win32 surface. settings.json gains two optional keys (theme, theme_background); both default-safe. cache.json is untouched.

- Cleanup tab now fits short terminals. The previous renderer drew every group panel at its natural height with no viewport, so any terminal shorter than the total group stack clipped the bottom panels off-screen — visible immediately after the new WinTUI group landed as a fifth panel. The renderer now lays out every group into a single line buffer and slides a window over it so the focused row is always visible. The selected-summary counter now also counts every checked row instead of only rows with non-zero scanned size, so "5 selected, 0 B" tells the user immediately that picked rows scanned empty.
- New WinTUI cleanup group. Adds a fifth Cleanup group with two glob-mode targets rooted at %LOCALAPPDATA%\wintui\self-update\: the unbounded wintui-self-update.log (the only WinTUI-owned file that grows monotonically) and handoff-*.ps1 scripts with a 24h minAge floor. Both default-unchecked, no new admin surface.
- Subtle gray tier across screens. The palette had two tiers (bright for primary text, dim for chrome) and dim was carrying six different roles, so versions, free GB, and package IDs read as background. Adds a third "subtle" tier for meaningful-but-not-headline data; applied to Settings choice chips, Health right-column detail, Workspace version columns, and the package ID under the summary detail title. Pink stays reserved for structural focus.
- Toolchain bump: Go 1.26.1 → 1.26.3 (11 stdlib security fixes). Charm: bubbletea 2.0.2 → 2.0.6, lipgloss 2.0.2 → 2.0.3, runewidth 0.0.21 → 0.0.23. golang.org/x/sys 0.42.0 → 0.44.0. Static-surface check vs the pre-bump tree: zero new syscall/windows symbols, four removed.
- No bugfixes, no breaking changes, no new Win32 surface. Settings.json and cache.json formats are unchanged.

- Bug fix: on systems with one or two pending upgrades whose package data is short, winget pads Version/Available/Source with single spaces instead of the usual ≥2-space gaps. The v2.7.1 column-aware parser folded those three headers into one cell ("Version Available Source"), reported "3-column upgrade table is not a known shape", and refused to populate the disk cache. The Health tab then showed "no cached scan yet" even right after a successful workspace scan, and cache.json was never written.
- The header parser now subdivides any cell whose whitespace-separated tokens all resolve through the locale dictionary, so tightly-packed English upgrade tables parse correctly. Korean "장치 ID" and other localized headers with intentional internal spaces are unaffected because their tokens don't individually resolve.
- Reliability: winget list and winget upgrade no longer run in parallel on cold start. Concurrent invocations race on a winget-internal lock and one returns 0x8a150001 with empty output ~50% of the time, which masked real upgrade results. Sequential is ~1s slower on first scan and reliable; the disk cache covers restart latency afterwards.
- No setting changes, no breaking changes, no new Win32 surface.

- Bug fix: wintui list and wintui check returned "0 packages" on systems whose Windows display language is not English. The parser searched the table header for hardcoded English column names, so localized headers (Italian Nome / Versione / Disponibile / Origine, German Verfügbar / Quelle, Japanese 名前 / バージョン / ソース, etc.) were not recognised and the parser returned an empty list silently.
- The new parser recognises localized headers via a vendored dictionary built from microsoft/winget-cli's own resource files for the 11 official winget locales (en-US, de-DE, es-ES, fr-FR, it-IT, ja-JP, ko-KR, pt-BR, ru-RU, zh-CN, zh-TW), falls back to a positional schema for unknown locales, walks the header by display cells so CJK characters do not desync from ASCII rows, and surfaces a clear parse error when a table is present but no required column can be mapped.
- The same fix also unblocks WinTUI's auto-self-update path on localized systems.
- No behavior changes for English users. No setting changes, no breaking changes, no new Win32 surface.

- Cleanup tab redesign: registry-driven multi-target cleanup with grouped panels (Core Temp, Caches, Developer caches, GPU vendor caches), per-target sizing, age-aware scrubbing, and elevated-helper integration for admin-only paths (Windows Temp, system minidumps). New cleanup_auto_scan setting (safe / all / off); developer caches default off and opt-in toggles persist across sessions.
- Export / Import: new wintui export and wintui import CLI commands with versioned JSON envelope, dry-run preflight, and name-collision detection. TUI integration on the Packages tab — press e to export, Shift+I to open the import overlay (scans Desktop / home / cwd for export files, with row-level toggling).
- Bug fix: toast notifications on uninstall batches now correctly say "uninstalled" instead of "upgraded".

- UI polish: detail overlay now applies the workspace accent / muted palette to field labels, version values, and the package URL consistently. Settings detail panel hint and description word-wrap to the inner panel width on narrow terminals. New state-accent (mint-cyan, distinct from structural pink) used for intent elements like chips, establishing a consistent two-axis color system across the workspace.
- Packaging: built with -trimpath and -buildvcs=false to strip embedded local build paths and VCS metadata from the binary, reducing the static feature surface that Defender's cloud ML scored as Wacatac.C!ml on v2.6.0 for a small number of users. No runtime behavior change; version string still injected via ldflags.

- Slim Health tab: a flat 7-row WinTUI / winget readiness panel that loads instantly. Drops RAM, uptime, Defender, extra fixed drives, generic ping, PowerShell 7, and the f / d toggle panels. Adds Sources cache age, Updates buckets (visible / auto / held) from the cache, and a neutral Settings summary line.
- wintui doctor: verdict-first headless health subcommand. Prints OK / WARN: N issues / FAIL: N issues with exit codes 0 / 1 / 2. Flags: --verbose adds the per-row table beneath the verdict; --full re-adds the trimmed system-diagnostics rows (RAM, Defender, internet ping, extra drives, OS / uptime, PATH, Windows PowerShell); --dev-tools appends a developer-tools detection group; --json emits structured output. Shares the check engine with the Health tab.
- Auto-self-update on by default (folded in from the v2.5.1 plan). Pre-TUI startup runs winget list --upgrade-available --id kts982.WinTUI with an 8-second timeout; on a hit, fires the existing PowerShell handoff and exits cleanly so winget can replace the released binary. Removes the admin-gated Ctrl+A self-upgrade relaunch path; manual self-upgrade now uses Enter-to-close + detached winget handoff. Addresses cross-PC reliability seen on family machines.
- Opt-in toast notifications: new toast_notifications setting (default off). Single Windows toast on TUI batch finish, on wintui upgrade --auto / --all / --id finish, and when wintui check finds updates. AUMID-attributed as WinTUI via a one-time Start Menu shortcut drop on first toast; self-heals if a previous run crashed between Save and SetAppId. Skipped when CI or WINTUI_DISABLE_TOAST is set.
- Bug fix: broken winget shims (App Installer alias on PATH but unable to start) now report as FAIL in Health and wintui doctor instead of falling through to PASS via swallowed exec errors. Pending self-upgrade items are surfaced explicitly in the batch-finish toast (X awaiting restart) so a mixed batch doesn't claim success while one item still needs Enter handoff.

- Per-package update policy: Ask / Auto / Hold. Press `t` on a focused winget/msstore row to cycle the policy, or use the Package Rules editor (`p`) on the detail view. Existing ignore / ignore_version settings keep working — the planner treats them as Hold, so settings.json stays backward compatible.
- wintui upgrade --auto: upgrade only Auto-policy packages from the headless CLI. Lower blast radius than --all for cron jobs and scheduled tasks. Mutually exclusive with --all.
- wintui upgrade --id <pkg> [--id <pkg>...]: upgrade named packages from a pipeline. Held IDs error out (exit 1), unknown IDs are no-ops, the running WinTUI binary is skipped.
- On-launch auto-update: if any Auto package has an update available, a 5-second cancelable countdown modal appears before the upgrade batch starts. Enter to start now, Esc to cancel for the session. The WinTUI self-package is deferred to the regular Updates flow with a banner explaining why.
- Removed: deprecated root flags wintui --check / --list (deprecation promised in v2.4.0). Use wintui check / wintui list.
- Bug fix: refresh no longer stalls on packages with long winget IDs. Truncated-ID recovery now runs lazily at action time instead of during every listing, so launch and `r` no longer pay a per-row cost for IDs that winget abbreviated with `…` in its table output.

- Headless CLI: hybrid root + subcommands shape. New commands: wintui check, wintui list, wintui show <id> [--source winget|msstore] [--json], wintui upgrade --all. Old root flags --check / --list still work for one minor release with a deprecation warning. wintui show is read-only and prints the install/upgrade args WinTUI would pass to winget plus any per-package overrides.
- wintui upgrade --all honors per-package ignore rules and skips the running WinTUI binary (use the TUI for self-upgrade, where the v2.3.x handoff is verified).
- Package list navigation: PgUp / PgDn jump 10 rows; Home / End jump to top / bottom of the cursor's current section (Updates or Installed).
- Bug fix: cursor no longer jumps to the upgraded package after a batch completes; lands on the next remaining update or the top of Installed.
- Bug fix: wintui check / --check now honor per-package ignore rules, matching the TUI; a hidden package no longer flips the exit code.
- Internal: shared upgrade planner extracted (selectUpgrades) so the TUI and headless CLI never disagree on "which upgrades count?"; --check/--list mutual-exclusion uses Cobra's MarkFlagsMutuallyExclusive.

- Fixed: "Include Unknown Versions" setting no longer empties the package lists. WinTUI was passing --include-unknown to winget list and winget search, but that flag is only valid for winget upgrade; winget rejected it with a usage error and the parser saw no rows. The flag is now only attached to upgrade scans, matching the setting's UI copy.

- Self-upgrade no longer drops an EXE into %TEMP%; handoff now runs from a short-lived PowerShell script under %LOCALAPPDATA%\wintui\self-update\ that waits for the parent to exit, runs winget, and self-deletes. Fewer AV false positives.
- Self-upgrade now requires an already elevated WinTUI session; non-admin sessions show Ctrl+A to relaunch as admin, with a manual administrator PowerShell command fallback when UAC relaunch is blocked. After the handoff finishes, WinTUI no longer reopens itself automatically.
- Atomic settings persistence: settings.json is now written via temp file + rename so a crash mid-save cannot leave a partial JSON file.
- Settings > Default Source detail text corrected: the setting affects searches and installs, not upgrade queries.
- Documentation: docs/elevation.md now correctly describes four elevation paths.

- Live execution feedback: running batch items now show the latest winget output line and elapsed time instead of just a spinner.
- Progress bar when winget emits explicit percentages.
- Process-in-use failures are detected and the result modal advises closing the app and pressing Ctrl+E to retry.
- Ctrl+E retry now covers process-blocked items (no UAC required when only those need retrying).
- Fixed blank terminal window during portable-package self-upgrade, including the elevated-helper path.
- 0x8A150066 now shows a friendly "one or more versions failed to uninstall" message.

- Visual override indicator: packages with per-package rules show a gear glyph in the list and summary panel.
- Multi-version uninstall: packages with multiple installed versions are now handled with --all-versions.
- Search results can be dismissed with Esc.
- Fixed stale search error banner persisting after a successful search.
- Workspace split into five focused files and string dispatches converted to typed enums.
- 30+ new tests covering batch lifecycle, search/queue flows, and navigation.
- Test suite no longer overwrites user settings or cache files.

- Fixed the self-upgrade completion modal so `Enter` now exits WinTUI and launches the temporary helper reliably.
- Detached the self-upgrade helper from the caller's console and relaunches WinTUI in a new console window after the portable-package upgrade completes.
- Cleared stale package cache after successful self-upgrade so WinTUI does not reopen still showing itself as upgradeable.
- Added helper-side logging and regression coverage for the self-upgrade handoff path.

- Added per-package rules editor (`p` in the detail view) with scope, architecture, and elevate overrides, saved atomically under source-qualified keys.
- Added ignore toggle (`i` in the detail view) that hides a package or a specific version from the Updates list; the Updates header shows a `(N hidden)` count and stale version-ignores expire automatically.
- Added live command preview in the detail view showing the exact winget command that would run with active overrides applied.
- Added `?` in the batch confirm modal to expand the same per-item command preview for every staged package.
- Made the batch modal body scrollable with `↑↓`, `PgUp/PgDn`, `Home/End` so large batches no longer push the actions line or bottom border off-screen.

- Added a unified apply flow (`g`) so staged installs, upgrades, and uninstalls can run in one mixed batch.
- Normalized Packages screen actions: `Space` stages items, while `i`, `u`, and `x` remain direct accelerators.
- Added self-upgrade handoff for the installed WinGet build of WinTUI so the running portable executable can be replaced cleanly.
- Improved package details with target-aware "What's New" headings, release-notes links (`n`), and a small-terminal scroll fix.