kkaminsk · Oct 15, 2026 · Oct 15, 2026 · Oct 15, 2026 · Oct 15, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -0,0 +1,154 @@
+# Changelog
+
+All notable changes to FileCommand are listed here, newest first. Each
+release is on the [GitHub releases page](https://github.com/kkaminsk/FileCommand/releases)
+with its signed installer.
+
+## [Unreleased]
+
+### Changed
+
+- The winget manifest template's short description no longer names a
+  third-party product, matching the wording winget approved. Manifests
+  generated from the template now match what was published (#57).
+- `installer\build.ps1 -Sign` looks for the signing tooling in a
+  `CodeSigning` checkout next to the repository, instead of
+  `C:\GitHub\CodeSigning` (#57).
+- Added this changelog; the README now covers installing with winget and
+  Chocolatey, safer copies, and junction listings (#57).
+
+## [0.1.5] - 2026-10-15
+
+A large reliability and usability release: every finding from the October
+2026 code audit is fixed, plus nine usability improvements (#55, #56).
+
+### Fixed
+
+- Copying a file onto itself no longer truncates it to 0 bytes.
+- A cross-volume Move no longer deletes files inside junction or symlink
+  targets. Deleting a junction now works on Windows.
+- A failed or cancelled copy never leaves a truncated file, and a failed
+  Overwrite keeps the original: copies are written to a temporary partial
+  file and renamed into place only once complete.
+- Moves flush and verify each file before deleting the source, and a
+  source that can't be removed is reported instead of ignored.
+- Copies keep attributes, creation and modification times, and alternate
+  data streams.
+- The built-in editor sends non-UTF-8, UTF-16, and binary files to the
+  viewer instead of corrupting them on save, keeps a UTF-8 BOM, and saves
+  atomically. Save failures are now shown.
+- Shrinking the terminal below 60×16 no longer discards an unsaved editor
+  buffer, the viewer, a running copy, or an open dialog.
+- Relative F5/F6 destinations and `cd`/`del`/`rmdir` targets resolve against
+  the panel's directory, not the directory FileCommand was started in.
+- A listing the user has already moved away from can no longer leak
+  entries into the current panel or tab.
+- The quick filter never lets a command act on an entry it hides, discloses
+  hidden selections in the delete and copy/move dialogs, and matches
+  non-ASCII names correctly.
+- Ctrl+C stops only a running child command, not FileCommand.
+- A crash in a background worker no longer garbles the screen or leaves a
+  panel stuck at `Reading…`.
+- The viewer no longer locks the file it shows, so programs can truncate or
+  rotate a log while it is open.
+- Git status no longer piles up slow queries in a huge or remote repository,
+  and works in directories whose names contain `[`.
+
+### Added
+
+- Settings live in a per-user profile directory (`%APPDATA%\FileCommand`),
+  with a `--config-dir` flag and a portable mode.
+- Caret editing, Home/End, word movement and deletion, and paste in every
+  text field and the command line. Ctrl+Y clears the command line.
+- An Open entry in the file-action menu launches a file in its associated
+  application.
+- Commands → History (Alt+F8), Swap panels (Ctrl+U), and Menu file edit;
+  greyed-out pull-down items are now wired up or removed.
+- Cancel (Esc or C) in the overwrite-conflict dialog. Quitting during a copy
+  waits for its cleanup.
+- Animated splash, menus, and dialogs, with `--noanimations` and
+  `animations = false` to turn them off.
+- An optional diagnostic log via `--log <path>` or `FILECOMMAND_LOG`, and
+  error messages that name the file or folder involved.
+- The installer warns when FileCommand is already installed in the other
+  scope.
+- Continuous integration on every pull request.
+
+### Changed
+
+- Large directories stream in with a live count and stay responsive.
+- Opening, viewing, saving, and checking paths on slow or offline network
+  shares no longer freezes the screen.
+- No redraws while idle; key repeats and pastes apply in one burst; copy
+  progress updates are throttled.
+- Junctions and directory symlinks list as enterable directories, and an
+  unreadable entry no longer fails the whole listing.
+- Full mode shows Size, Date, and Time untruncated. Hidden and system
+  entries render in a dimmer colour.
+- Re-reading a directory keeps the cursor on the same entry.
+- `config.toml` and `usermenu.toml` tolerate a BOM and inline comments and
+  report mistakes at startup. `history.json` keeps recency across restarts,
+  is capped, and merges safely between two running instances.
+
+## [0.1.4] - 2026-10-05
+
+### Fixed
+
+- The `del` and `rmdir` command-line builtins reject `.` and `..` targets;
+  previously `rmdir ..` opened the delete confirmation on the panel's parent
+  directory (#46).
+- Switching to a stale background tab no longer records a fuzzy-jump visit
+  or rewrites `config.toml` (#47).
+
+### Added
+
+- A Chocolatey package channel, and README guidance on reporting issues.
+
+## [0.1.3] - 2026-09-27
+
+### Added
+
+- The Delete key opens the delete confirmation, the same as F8.
+
+## [0.1.2] - 2026-09-26
+
+### Added
+
+- `-h`, `-?`, and `--help` print usage and exit without starting the
+  interface.
+
+## [0.1.1] - 2026-09-25
+
+### Fixed
+
+- The file-action menu responds to mouse clicks.
+- The inactive panel refreshes after a delete when it shows the same
+  directory.
+
+### Changed
+
+- The command line recognizes its built-in verbs directly instead of
+  starting a shell.
+- The file-action menu lists the clipboard entries earlier.
+
+## [0.1.0] - 2026-09-03
+
+First release: a keyboard-driven, dual-panel terminal file manager.
+
+- Dual panels with Full, Brief, and Tree modes, an adjustable split, tabs,
+  quick filter, type-ahead, and fuzzy directory jump.
+- Copy, move, rename, and delete with confirmations, multi-selection,
+  clipboard export, and error recovery.
+- Command line, pull-down menus, drive selector, and a file-action menu.
+- Built-in viewer and editor, plus an external editor option.
+- Mouse support, including drag and drop between panels.
+- Switchable themes, git status in the panels, find-file, and a startup
+  splash.
+
+[Unreleased]: https://github.com/kkaminsk/FileCommand/compare/v0.1.5...HEAD
+[0.1.5]: https://github.com/kkaminsk/FileCommand/releases/tag/v0.1.5
+[0.1.4]: https://github.com/kkaminsk/FileCommand/releases/tag/v0.1.4
+[0.1.3]: https://github.com/kkaminsk/FileCommand/releases/tag/v0.1.3
+[0.1.2]: https://github.com/kkaminsk/FileCommand/releases/tag/v0.1.2
+[0.1.1]: https://github.com/kkaminsk/FileCommand/releases/tag/v0.1.1
+[0.1.0]: https://github.com/kkaminsk/FileCommand/releases/tag/v0.1.0
diff --git a/README.md b/README.md
@@ -12,6 +12,8 @@ mouse support, and switchable themes.
 The codebase stays cross-platform via `crossterm`, but only Windows is tested
 and supported.
 
+What changed in each release is in [CHANGELOG.md](CHANGELOG.md).
+
 ![FileCommand screenshot](Screen/deletefile.png)
 
 ## Contents
@@ -39,11 +41,25 @@ and supported.
 
 ## Installing
 
-The easiest way to get FileCommand on Windows is the bundled installer:
+The quickest way is a package manager:
+
+```powershell
+winget install BigHatGroup.FileCommand
+choco install filecommand
+```
+
+winget installs per-user by default (`--scope machine` for all users).
+Chocolatey installs machine-wide by default, following its convention;
+add `--params "'/Scope:user'"` for a per-user install. A new version can
+take a few days to appear in either catalog after its GitHub release,
+while it goes through their review.
+
+Or use the installer directly:
 
-1. Build (or download) `FileCommandSetup.exe` — see
-   [`installer/README.md`](installer/README.md) for build instructions,
-   prerequisites (Rust, .NET SDK, WiX v4/v5 CLI), and a winget manifest.
+1. Download `FileCommandSetup.exe` from the
+   [latest release](https://github.com/kkaminsk/FileCommand/releases/latest),
+   or build it — see [`installer/README.md`](installer/README.md) for build
+   instructions and prerequisites (Rust, .NET SDK, WiX v4/v5 CLI).
 2. Run it. By default it installs **per-user, with no elevation**, to
    `%LocalAppData%\Programs\BigHatGroup\FileCommand`, adds itself to your
    user `PATH`, and creates a Start Menu shortcut.
@@ -263,6 +279,12 @@ from an earlier version is migrated on first load.
   sort mode, filter, and display mode.
 - **Tab** switches which panel is active (the active panel's path renders
   inverse in its top border).
+- Large directories stream in with a live `Reading… N` count and stay
+  usable while they load.
+- Junctions and directory symlinks list and open like directories. The
+  panel keeps the link's own path, so `..` returns to the folder that
+  holds the link. An entry whose details can't be read is left out, and
+  the panel's status line says how many were skipped.
 - **The command line** sits below the panels and always shows the active
   panel's path as its prompt. It understands three built-in verbs (`cd`,
   `del`, `rmdir`) and nothing else — see [Command line](#command-line).
@@ -596,12 +618,23 @@ the hidden or system attribute; on other platforms, names beginning with
 
 Copy (F5), Move/Rename (F6), Mkdir (F7), and Delete (F8) run as cancellable
 background jobs with a progress dialog (file/byte counts, a cancel button).
-Overwrite conflicts prompt Overwrite/Skip/Rename/Overwrite All/Skip All;
+Overwrite conflicts prompt Overwrite/Skip/Rename/Overwrite All/Skip All, or
+Cancel (Esc or C) to stop the whole job;
 errors (permission denied, path too long, disk full, sharing violation)
 pause the job for Retry/Skip/Skip All/Abort, and skipped files are listed in
-a summary at the end. Same-volume moves are instant renames; cross-volume
-moves copy then delete only after the copy verifies. There is no recycle
-bin — deletes are permanent, and the confirmation dialog says so.
+a summary at the end. Quitting while a job runs cancels it and waits briefly
+for its cleanup before exiting.
+
+Copies are written to a temporary `<name>.~fc-partial` file next to the
+target and renamed into place only once complete, so a failed or cancelled
+copy never leaves a truncated file, and a failed Overwrite keeps the
+original. Copies keep attributes, timestamps, and alternate data streams.
+Copying a file onto itself is skipped rather than truncating it.
+Same-volume moves are instant renames. Cross-volume moves flush and verify
+each copied file before deleting its source, and never delete anything
+inside a junction or symlink target: only the link itself is removed.
+There is no recycle bin — deletes are permanent, and the confirmation
+dialog says so.
 
 ### Viewer (F3) and editor (F4)
 

diff --git a/installer/README.md b/installer/README.md
@@ -251,8 +251,10 @@ validate.
   `BHGPublic/private-mcp` profile.
 - A local checkout of the CodeSigning repo, for
   `Azure.CodeSigning.Dlib.dll` and the Trusted Signing metadata JSON.
-  Defaults to `C:\GitHub\CodeSigning`; override with `-CodeSigningDlib`
-  and `-CodeSigningMetadata` if it lives elsewhere.
+  Defaults to a `CodeSigning` checkout next to this repo (for example
+  `C:\Temp\tsscat\CodeSigning` beside `C:\Temp\tsscat\FileCommand`);
+  override with `-CodeSigningDlib` and `-CodeSigningMetadata` if it lives
+  elsewhere.
 - A Windows SDK signtool (10.0.26100.0+ recommended); auto-detected, or
   pass `-SignToolPath` explicitly.
 

diff --git a/installer/build.ps1 b/installer/build.ps1
@@ -35,12 +35,13 @@
 
 .PARAMETER CodeSigningDlib
     Path to Azure.CodeSigning.Dlib.dll. Defaults to the CodeSigning repo
-    checkout at C:\GitHub\CodeSigning. Only used with -Sign.
+    checked out next to this repo (for example C:\Temp\tsscat\CodeSigning
+    beside C:\Temp\tsscat\FileCommand). Only used with -Sign.
 
 .PARAMETER CodeSigningMetadata
     Path to the Trusted Signing metadata JSON (endpoint, account, cert
-    profile). Defaults to metadata-packager-mcp-cli.json in the
-    CodeSigning repo checkout. Only used with -Sign.
+    profile). Defaults to metadata-packager-mcp-cli.json in that sibling
+    CodeSigning checkout. Only used with -Sign.
 
 .PARAMETER SignToolPath
     Path to signtool.exe. Defaults to auto-detecting the newest Windows
@@ -61,8 +62,9 @@ param(
     [string]$OutDir = (Join-Path $PSScriptRoot 'out'),
     [switch]$SkipCargoBuild,
     [switch]$Sign,
-    [string]$CodeSigningDlib = 'C:\GitHub\CodeSigning\Microsoft.Trusted.Signing.Client.1.0.95\bin\x64\Azure.CodeSigning.Dlib.dll',
-    [string]$CodeSigningMetadata = 'C:\GitHub\CodeSigning\metadata-packager-mcp-cli.json',
+    # The CodeSigning repo is expected as a sibling of this repo's root.
+    [string]$CodeSigningDlib = (Join-Path (Split-Path -Parent (Split-Path -Parent $PSScriptRoot)) 'CodeSigning\Microsoft.Trusted.Signing.Client.1.0.95\bin\x64\Azure.CodeSigning.Dlib.dll'),
+    [string]$CodeSigningMetadata = (Join-Path (Split-Path -Parent (Split-Path -Parent $PSScriptRoot)) 'CodeSigning\metadata-packager-mcp-cli.json'),
     [string]$SignToolPath,
     [string]$TimestampServer = 'http://timestamp.acs.microsoft.com'
 )

diff --git a/installer/winget/BigHatGroup.FileCommand.locale.en-US.yaml b/installer/winget/BigHatGroup.FileCommand.locale.en-US.yaml
@@ -6,9 +6,10 @@ PackageLocale: en-US
 Publisher: BigHatGroup
 PackageName: FileCommand
 License: MIT OR Apache-2.0
-ShortDescription: >-
-  A keyboard-driven, dual-panel file manager for the terminal, recreating
-  the Norton Commander 5.5 workflow with modern extras.
+# Keep third-party brand names out of ShortDescription: winget-pkgs
+# policy 1.2 flagged the original wording on the 0.1.0 submission
+# (microsoft/winget-pkgs#429006), and this is the approved replacement.
+ShortDescription: A keyboard-driven dual-panel terminal file manager with a classic dual-pane workflow and modern extras.
 Moniker: filecommand
 Tags:
   - file-manager