release v2.4.0

Minor release. Adds live tail inside expanded Bash activity cards
(T-325) and double-tap-modifier shortcuts with double-Shift quick-open
across all keymap presets (T-341); each spawned subagent now gets its
own activity card (T-342). Carries a large stability sweep — PTY fd
and process leaks, IPC framing, settings durability, UTF-8 decoding
across chunk boundaries, transactional extension lifecycle — plus two
security fixes: the MCP HTTP server now requires a per-start auth
token (T-362) and editor.open/save are workspace-confined (T-363).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -16,6 +16,8 @@ heading, and (b) bumping `pubspec.yaml` `version:` in the same commit.
 
 ## [Unreleased]
 
+## [2.4.0] — 2026-06-12
+
 ### Added
 
 - **Live tail inside expanded Bash activity cards.** A Bash card that follows a

assets/licenses.yaml

@@ -39,7 +39,7 @@ self:
   # Auto-synced from pubspec.yaml `version:` by `make gen-build-info`
   # (runs implicitly on every build/run/test). Don't hand-edit; bump
   # pubspec instead.
-  version: "2.3.3"
+  version: "2.4.0"
   homepage: https://github.com/postmeridiem/clide
   license: MIT
   license_file: assets/LICENSE

pubspec.yaml

@@ -13,7 +13,7 @@ description: >-
   subsystem handlers (pane, files, editor, git, pql), and the
   extension framework.
 publish_to: none
-version: 2.3.3
+version: 2.4.0
 repository: https://github.com/postmeridiem/clide
 # Short user-facing tagline (the welcome subtitle, web meta
 # description, etc.). Baked into lib/src/build_info.g.dart by