v0.9.0 (bêta)

TermDevTools v0.9.0 (beta)

Version française : CHANGELOG_fr.md

In one sentence: the interface gets a look of its own — fixed colors, a header that says which cluster this is, colored methods — without losing a row on an 80×24 terminal.

What's new

• A new look: fixed colors on a dark background of their own, the same whatever the terminal's theme; a terminal without 24-bit colors gets the closest ones it has. The panel with the focus has a thick blue border.
• A header: the first line gives the product, in a badge that tells Elasticsearch from OpenSearch, the URL and the user. On a protected cluster, the whole line takes the red or the yellow of the former banner, which no longer costs a line of the panels.
• The status line and the shortcuts on one line: the message on the left, as many shortcuts as it leaves room for on the right. It no longer shares the line with the URL and the user, and the panels keep their height. At 80 columns, fewer shortcuts show at once, the ones used most first; F1 still lists them all.
• Methods colored in the editor: GET in teal, POST and PUT in blue, DELETE in red, comments dimmed.
• A ▼ says there is more below: on the bottom border of the editor, of the result and of the help screen, for as long as there is something left to scroll to.

Before upgrading from 0.8.1

• Nothing to do: the shortcuts, the configuration and the saved files don't change. The cluster and the user have moved from the bottom line to the top one, and at 80 columns fewer shortcuts show at once.

Checks

• go vet and go test ./... pass on Windows, Linux and macOS.
• Tried in a real terminal against an Elasticsearch 9.5.4 and an OpenSearch 3.9.0 actually running (lab instances, not production): the demo is recorded on them. The look was reviewed by hand in Windows Terminal.
• A review of the changes before this release found, fixed with their tests: on a very narrow panel, the coloring went past the editor, onto the result next to it; with the mouse on, a click on the header left no panel with the focus; a short URL could be dropped from the header although it fit; a message with a line break hid the shortcuts; a very long line was scanned for every row on every frame.
• Privacy: the header shows nothing the status bar didn't, nothing more is sent to the cluster, and neither the changes nor the binaries hold a local path or address.
• govulncheck: no known vulnerability, neither in the dependencies nor in the standard library of Go 1.27.3, which the binaries are built with. No independent external audit was carried out.

Known limits

• The look is dark whatever the terminal's theme, and there is no other.
• Not tried by hand in a terminal without 24-bit colors, macOS Terminal among them: the closest colors are worked out by tcell, and only that they stay distinct is tested.
• In the editor, only methods and comments are colored: the JSON of a body stays plain.
• The ▼ covers the editor, the result and the help screen, not the recipe catalog's lists.
• The limits of 0.8.0 still apply: see the changelog.

The look owes its inspiration, and its palette, to Kibanaut.

Binaries

One self-sufficient file per platform — no archive and no companion file:

• termdevtools-linux-amd64 — Linux x86-64 (static binary)
• termdevtools-windows-amd64.exe — Windows 10/11 x64
• termdevtools-darwin-arm64 — macOS Apple Silicon
• SHA256SUMS — SHA-256 checksums of the three files

Download the file for your platform and SHA256SUMS, check it (sha256sum -c SHA256SUMS --ignore-missing on Linux), make it executable (chmod +x, Linux and macOS), run it: termdevtools --version answers termdevtools v0.9.0. The binaries are not signed. Step by step, platform by platform: INSTALL.md (français). go install github.com/gnocent/termdevtools@v0.9.0 works too.

v0.8.1 (bêta)

TermDevTools v0.8.1 (beta)

Version française : CHANGELOG_fr.md

In one sentence: the help screen gives TermDevTools' version and the cluster's, and F2 and F9 copy in any terminal on a Mac.

What's new

• The help screen (F1) gives the versions: TermDevTools' own, and the connected cluster's (Elasticsearch 9.5.4, OpenSearch 2.19.6) when detected — the two things a bug report asks for first.
• F2 and F9 copy in any terminal on a Mac: outside SSH, the copy goes through the system's pasteboard (pbcopy) rather than the terminal — macOS Terminal included. The status bar then confirms the copy without reservation. Through SSH, nothing changes.

Fixes

• Which terminals copy with F2 and F9: the documentation counted GNOME Terminal among them; neither it nor the other VTE-based terminals, nor macOS Terminal, support the copy through the terminal (OSC 52). It now lists those that do, and the tmux setting it needs (set -g set-clipboard on).

Before upgrading from 0.8.0

• Nothing to do: the shortcuts, the configuration and the saved files don't change.

Checks

• go vet and go test ./... pass on Windows, Linux and macOS, including the real pbcopy on macOS, with accented text under a locale that isn't UTF-8.
• Not tried by hand: the copy in a real macOS Terminal session, nor the copy through the terminal (OSC 52) in Windows Terminal.
• govulncheck: no known vulnerability, neither in the dependencies nor in the standard library of Go 1.27.3, which the binaries are built with. No security review for this release: nothing changes in the connection, the authentication or what is sent to the cluster.

Known limits

• Through SSH, from a terminal that doesn't support the copy through the terminal (macOS Terminal among them), F2 and F9 still copy nothing: Ctrl+S exports the result to a file.
• The limits of 0.8.0 still apply: see the changelog.

Binaries

One self-sufficient file per platform — no archive and no companion file:

• termdevtools-linux-amd64 — Linux x86-64 (static binary)
• termdevtools-windows-amd64.exe — Windows 10/11 x64
• termdevtools-darwin-arm64 — macOS Apple Silicon
• SHA256SUMS — SHA-256 checksums of the three files

Download the file for your platform and SHA256SUMS, check it (sha256sum -c SHA256SUMS --ignore-missing on Linux), make it executable (chmod +x, Linux and macOS), run it: termdevtools --version answers termdevtools v0.8.1. The binaries are not signed. Step by step, platform by platform: INSTALL.md (français). go install github.com/gnocent/termdevtools@v0.8.1 works too.

v0.8.0 (bêta)

TermDevTools v0.8.0 (beta)

Version française : CHANGELOG_fr.md

In one sentence: several clusters can stay open in one session — Ctrl+O switches between them, each found again as it was left.

What's new

• Several clusters in one session (Ctrl+O, #10): the connection screen opens again in session. Each connection stays open with all its state — requests, cursor, result — until exit: a cluster already open, marked open connection, goes back to its screen as you left it, without connecting again; another one goes through the form, as at startup. Esc goes back to the cluster on screen.
• Switching cancels nothing: a request in progress, read or write, runs to completion; its answer lands in its cluster's panels, and the status bar on screen says it came.
• Exiting saves every open connection (Ctrl+C, "Quit", SIGTERM/SIGHUP), and switching saves the left panel on screen.
• A shorter README, with one line per release, and a larger demo that shows the switch and the protection.

Fixes

• The confirmation of a write no longer lets the text behind it show through: its margin, a column on either side, was never drawn. There since 0.7.3.

Before upgrading from 0.7.5

• Nothing to do: startup, the other shortcuts and the help bar don't change.

Checks

• go vet and go test ./... pass on Windows, the interface's tests on Linux too; the switch is tested on a simulated 80×24 screen against two local test servers.
• Tried by a contributor against an OpenSearch 3.9.0 and an Elasticsearch 9.5.4 actually running (lab instances, not production), with targeted race-detector tests.
• An independent security review of the switch found that a connection attempt left in progress could, once an open cluster was gone back to, take the screen over and open a second connection to that cluster, the keys then going to the one whose protection wasn't the one shown. Fixed before this release, with a test reproducing it.
• govulncheck: no known vulnerability, neither in the dependencies nor in the standard library of Go 1.27.3, which the binaries are built with. No independent external audit was carried out.

Known limits

• One connection per URL: to change the protection or the credentials of an open connection, quit and relaunch.
• Each open connection keeps its last result in memory, several times its size once displayed (a 60 MiB JSON response takes about 450 MiB); any request on that connection frees it.
• The limits of 0.7 still apply: see the changelog.

Thanks to @amineamanzou for the idea, the discussion that shaped it, and the tests.

Binaries

One self-sufficient file per platform — no archive and no companion file:

• termdevtools-linux-amd64 — Linux x86-64 (static binary)
• termdevtools-windows-amd64.exe — Windows 10/11 x64
• termdevtools-darwin-arm64 — macOS Apple Silicon
• SHA256SUMS — SHA-256 checksums of the three files

Download the file for your platform and SHA256SUMS, check it (sha256sum -c SHA256SUMS --ignore-missing on Linux), make it executable (chmod +x, Linux and macOS), run it: termdevtools --version answers termdevtools v0.8.0. The binaries are not signed. Step by step, platform by platform: INSTALL.md (français). go install github.com/gnocent/termdevtools@v0.8.0 works too.

v0.7.5 (bêta)

TermDevTools v0.7.5 (beta)

Version française : CHANGELOG_fr.md

In one sentence: a request in progress can be abandoned with Esc, and the status bar counts the seconds of the wait.

What's new

• Abandon the request in progress: Esc closes its connection, and the result panel keeps what it showed. For a write, the status bar warns that the cluster may have carried it out anyway.
• Live timer: from the first second on, the status bar counts the seconds of the wait — request in progress... 12 s — Esc to abandon.
• A newer request cancels a read still in progress, instead of letting it run until the timeout for an answer that would be ignored: a heavy search stops loading the cluster. A write is left to finish.

Fixes

• A "New connection" typed with the URL of a known cluster no longer loses the keys written by hand on its entry (secret_env, secret_file, proxy, distribution, version): they are kept, and apply to that connection already — its proxy, its override. Known limitation of 0.7.4.

Before upgrading from 0.7.4

• Nothing to do: with no request in progress, Esc does what it did before.

Checks

• go vet and go test ./... pass, run on Windows: unit tests and tests of the interface on a simulated 80×24 screen, where a request is abandoned, superseded and timed against a local test server; the tests Windows skips pass on Linux.
• From this release on, every pull request is checked on GitHub: formatting, go vet and the unit tests, on Linux, Windows and macOS.
• govulncheck: no known vulnerability, neither in the dependencies nor in the standard library of Go 1.27.3, which the binaries are built with.
• Abandoning was not tried against a real cluster. No independent external audit was carried out.

Known limits

• Closing the connection doesn't undo what the cluster has already received: a write abandoned may have been carried out.
• The limits of 0.7 still apply: see the changelog.

Binaries

One self-sufficient file per platform — no archive and no companion file:

• termdevtools-linux-amd64 — Linux x86-64 (static binary)
• termdevtools-windows-amd64.exe — Windows 10/11 x64
• termdevtools-darwin-arm64 — macOS Apple Silicon
• SHA256SUMS — SHA-256 checksums of the three files

Download the file for your platform and SHA256SUMS, check it (sha256sum -c SHA256SUMS --ignore-missing on Linux), make it executable (chmod +x, Linux and macOS), run it: termdevtools --version answers termdevtools v0.7.5. The binaries are not signed. Step by step, platform by platform: INSTALL.md (français). go install github.com/gnocent/termdevtools@v0.7.5 works too.

v0.7.4 (bêta)

TermDevTools v0.7.4 (beta)

Version française : CHANGELOG_fr.md

In one sentence: a cluster's secret can be read from an environment variable or a file instead of being typed at every connection.

What's new

• Secret without retyping: secret_env: NAME (an environment variable) or secret_file: path (a file, absolute path or ~/), added by hand to a cluster's entry in config.yaml, say where its secret is — password, API key secret or encoded form, Bearer token, client key passphrase, whichever its authentication asks for. The form opens with the field filled in and the focus on "Connect": Enter is enough. The message area names the variable or the file.
• Never blocking: a variable unset or empty, a file missing, unreadable, empty or larger than 64 KiB, a relative path, both keys on one entry, or a file that isn't a regular UTF-8 text file (a pipe, a device, UTF-16 as > writes it in Windows PowerShell 5.1) — the field stays empty, the message says why, and the secret is typed as before. Nothing is sent before "Connect".
• The program still writes no secret: config.yaml holds where the secret is, never what it is, and F9 keeps its placeholders. The file is yours to protect: on Linux and macOS, one that other users can read is used all the same, with a warning (chmod 600).

clusters:
  - url: https://es-prod.example.com:9200
    auth_type: basic
    username: svc_devtools
    secret_env: ES_PROD_PW # or secret_file: ~/.es-prod.secret

Fixes

• Connection form on 80 columns: a new connection's URL, the paths of the client certificate, its key and the CA, and in French the passphrase, ran over the form's frame; these fields are now narrowed to fit inside it, their content scrolling.
• Secret field after switching authentication: switching to another authentication type and back left the field looking empty while the secret typed was still sent; the field now shows what it holds.
• Panel switch under PuTTY (#8): the help (F1) and the documentation said Alt+←/→ switches panels on macOS only; it does on every system, and is the way to do it where Ctrl+←/→ doesn't get through, as under PuTTY.

Before upgrading from 0.7.3

• Nothing to do: a config.yaml without secret_env or secret_file behaves as before — the secret is asked for at every connection.

Checks

• go vet and go test ./... pass, run on Windows: unit tests and tests of the interface on a simulated 80×24 screen; the secret tests also pass on Linux.
• Basic Auth, API key and Bearer token connect against a real Elasticsearch 9.5.4 with security on, each with its secret read from a variable and from a file, through the connection form.
• A security review of the secrets came before the release: no leak of the secret, nothing sent before "Connect". The two points it raised — a pipe or a terminal named by secret_file froze the interface, a UTF-16 file sent a garbled secret — are fixed and covered by tests.
• govulncheck: no known vulnerability, neither in the dependencies nor in the standard library of Go 1.27.3, which the binaries are built with.
• No independent external audit was carried out.

Known limits

• The secret is read when the form opens; F9 doesn't refer to the variable or the file. No OS keychain.
• A "New connection" typed with the URL of a known cluster replaces its entry and loses the keys written by hand (secret_env, secret_file, proxy…): pick the cluster from the list instead.
• The limits of 0.7 still apply: see the changelog.

Binaries

One self-sufficient file per platform — no archive and no companion file:

• termdevtools-linux-amd64 — Linux x86-64 (static binary)
• termdevtools-windows-amd64.exe — Windows 10/11 x64
• termdevtools-darwin-arm64 — macOS Apple Silicon
• SHA256SUMS — SHA-256 checksums of the three files

Download the file for your platform and SHA256SUMS, check it (sha256sum -c SHA256SUMS --ignore-missing on Linux), make it executable (chmod +x, Linux and macOS), run it: termdevtools --version answers termdevtools v0.7.4. The binaries are not signed. Step by step, platform by platform: INSTALL.md (français). go install github.com/gnocent/termdevtools@v0.7.4 works too.

v0.7.3 (bêta)

TermDevTools v0.7.3 (beta)

Version française : CHANGELOG_fr.md

In one sentence: a production cluster can be protected — the requests that write are confirmed or refused, and a banner says so.

What's new

• Per-cluster protection, chosen in the connection form, right under the URL, and saved in config.yaml (protection:):
  • "writes need confirmation" (confirm): a request that writes opens a popup naming the cluster and the request, with the focus on "Cancel" — Enter pressed out of habit or Esc sends nothing. "Send" sends the request as it was resolved on Ctrl+E.
  • "read-only" (read_only): a request that writes is refused, nothing is sent, and the status bar says how to allow it.
  • "none" (none), the default: nothing changes for existing clusters.
• What writes: any PUT, any DELETE, and any POST missing from a list of known reads (_search, _count, _msearch, _mget, _field_caps, _analyze, _explain, pipeline simulations…) — _bulk and _delete_by_query, but also _refresh, _flush or _forcemerge, which act on the cluster. GET requests go through, except _refresh, _flush and OpenSearch's SQL or PPL. The request is classified as it is sent, after ${name} variables are substituted.
• Banner across the top of a protected cluster's main screen: red with confirmation, yellow with read-only, with an optional label ("PROD · read-only"). A cluster without protection keeps exactly the layout of earlier versions.
• Cluster history: the protection shows under the URL of each protected cluster.

The level is set at connection: to change it, connect again. It is a safety net against slips, not security — anyone who can run the tool can remove it. To really prevent writing, use an account with no write privilege on the cluster.

Fixes

• The status bar's message is no longer cut from its first word on an 80-column terminal: a realistic URL and user name left it a few columns. It now comes first — the user gives way, then the URL is cut short, then the cluster.

Before upgrading from 0.7.2

• Nothing to do: a config.yaml without protection: loads as before, with no protection and no banner.

Checks

• go vet and go test ./... pass, run on Windows: unit tests and tests of the interface on a simulated 80×24 screen.
• The protection is checked against a real Elasticsearch 9.5.4 and OpenSearch 3.9.0: deleting an index is refused in read-only, doesn't happen while the confirmation is cancelled, and happens once confirmed.
• A security review of the protection came before the release; the bypasses it found are fixed and covered by tests.
• govulncheck: no known vulnerability, neither in the dependencies nor in the standard library of Go 1.27.3, which the binaries are built with.
• No independent external audit was carried out.

Known limits

• The list of reads can't be extended: a read missing from it is confirmed, or refused in read-only, for nothing.
• The limits of 0.7 still apply: see the changelog.

Binaries

One self-sufficient file per platform — no archive and no companion file:

• termdevtools-linux-amd64 — Linux x86-64 (static binary)
• termdevtools-windows-amd64.exe — Windows 10/11 x64
• termdevtools-darwin-arm64 — macOS Apple Silicon
• SHA256SUMS — SHA-256 checksums of the three files

Download the file for your platform and SHA256SUMS, check it (sha256sum -c SHA256SUMS --ignore-missing on Linux), make it executable (chmod +x, Linux and macOS), run it: termdevtools --version answers termdevtools v0.7.3. The binaries are not signed. Step by step, platform by platform: INSTALL.md (français). go install github.com/gnocent/termdevtools@v0.7.3 works too.

v0.7.2 (bêta)

TermDevTools v0.7.2 (beta)

Version française : CHANGELOG_fr.md

In one sentence: TermDevTools installs with go install, and completion keeps the query after the cursor and accepts a leading /.

What's new

• go install github.com/gnocent/termdevtools@latest: the module now has the repository's path, and versions are tagged with three numbers (v0.7.2), the form Go recognizes. The binary goes to GOBIN, or $(go env GOPATH)/bin when it is unset. Prebuilt binaries remain the recommended way.
• --version without a stamped version: a binary installed with go install gives the version installed, and one built with a plain go build in a clone gives the version Go derives from git (v0.7.3-0.<date>-<commit>, with +dirty if files were modified) instead of dev. go run still says dev.

Completion

• Query after the cursor: completing _cat/ind in GET _cat/ind?format=json gives _cat/indices?v&format=json — the candidate's default parameters and your query under a single ? — instead of a second ?. Your query is kept as typed, and a key you set replaces the default with the same key.
• Leading /: GET /_cat/pl completed nothing; it now gives GET /_cat/plugins?v, keeping the /. A /_cat/... entry in an endpoints.txt is also recognized as a _cat command, so its columns complete too.
• A type-ahead search that matches nothing: Enter no longer inserts the entry left selected by an earlier search; it does nothing until the search is corrected (Backspace), cancelled (Esc) or replaced by an explicit choice — arrows, Tab, PgUp/PgDn, Home/End, or a click on an entry.

Development

• tools/testclusters.sh runs with the /bin/bash 3.2 of macOS, and a test rejects the Bash 4 constructs that broke it.

Thanks to @efd6 for the request (#1) and to @amineamanzou for the changes (#3, #4, #6).

Before upgrading from 0.7

• Nothing to do: config.yaml, saved requests and reference files are read as before.
• Completion: Enter right after a type-ahead search that found nothing no longer inserts anything; pick an entry with the arrows or a click.

Checks

• go vet and go test ./... pass, run on Windows: unit tests, end-to-end tests of the interface on a simulated screen — completion with both Elasticsearch's and OpenSearch's reference data — and a real go install of the module, served from a local proxy, offline.
• govulncheck: no known vulnerability, neither in the dependencies nor in the standard library of Go 1.27.2, which the binaries are built with.
• The reference data (recipes, endpoints, _cat columns) has not changed since 0.6, and its checks against eleven real clusters are those of 0.6.
• The test cluster script was not run on a Mac.
• No independent external audit was carried out.

Known limits

• go install …@v0.7.1 and earlier versions do not work: they declared another module path.
• The limits of 0.7 still apply: see the changelog.

Binaries

One self-sufficient file per platform — no archive and no companion file:

• termdevtools-linux-amd64 — Linux x86-64 (static binary)
• termdevtools-windows-amd64.exe — Windows 10/11 x64
• termdevtools-darwin-arm64 — macOS Apple Silicon
• SHA256SUMS — SHA-256 checksums of the three files

Download the file for your platform and SHA256SUMS, check it (sha256sum -c SHA256SUMS --ignore-missing on Linux), make it executable (chmod +x, Linux and macOS), run it: termdevtools --version answers termdevtools v0.7.2. The binaries are not signed. Step by step, platform by platform: INSTALL.md (français).

v0.7.1 (bêta)

TermDevTools v0.7.1 (beta)

Version française : CHANGELOG_fr.md

In one sentence: a bug-fix release — Ctrl+E on a request line still being typed no longer sends the request above it, and a new connection no longer fails on Linux because of the certificate directories (#2).

Fixes

• An incomplete request line no longer runs the request above it: Ctrl+E on a line such as GET still being typed sent the closest request above, a DELETE for instance. Nothing is sent now, and the status bar says no request was found. A blank or comment line between two requests still runs the one above.
• A new connection no longer fails on Linux because of the certificate directories: default_ca_dir and default_client_cert_dir filled the certificate fields of a new connection with a directory, which was then loaded as a file — even in http, where those fields are hidden. They now only set where the certificate picker starts.
• TLS files are only read when they are used: the CA file only for https with verification on, the client certificate only for https. A path saved for a cluster in http, or with verification off, no longer blocks the connection. The command of F9 follows the same rule.
• Two exports in the same second no longer overwrite each other: the file name now ends with a random number (YYYYMMDD-HHMMSS-<number>.json).
• F7 while the _cat columns are being fetched: an answer from before the reload no longer replaces the new columns.

Thanks to @fbaligand for the report (#2) and to @amineamanzou for the fixes (#5, #7).

Before upgrading from 0.7

• Nothing to do: config.yaml is read as before.
• New connection: the certificate fields now start empty; pick the file with the certificate picker, which opens in default_ca_dir or default_client_cert_dir. Saved connections keep their paths.
• Exports: a script that relied on the old file name (YYYYMMDD-HHMMSS.json) must allow for the new suffix.

Checks

• go vet and go test ./... pass, run on Windows: unit tests, and end-to-end tests of the interface on a simulated screen.
• The fixes were not tried against a real cluster: none of the test clusters uses TLS. The reference data (recipes, endpoints, _cat columns) has not changed since 0.6, and its checks against eleven real clusters are those of 0.6.
• govulncheck: no known vulnerability, neither in the dependencies nor in the standard library of Go 1.27.2, which the binaries are built with.
• No independent external audit was carried out.

Known limits

• go install does not work with this version: its module path is not yet the repository's. It does from v0.7.2 on (#1); with this version, use the binaries below.
• The limits of 0.7 still apply: see the changelog.

Binaries

One self-sufficient file per platform — no archive and no companion file:

• termdevtools-linux-amd64 — Linux x86-64 (static binary)
• termdevtools-windows-amd64.exe — Windows 10/11 x64
• termdevtools-darwin-arm64 — macOS Apple Silicon
• SHA256SUMS — SHA-256 checksums of the three files

Download the file for your platform and SHA256SUMS, check it (sha256sum -c SHA256SUMS --ignore-missing on Linux), make it executable (chmod +x, Linux and macOS), run it: termdevtools --version answers termdevtools v0.7.1. The binaries are not signed. Step by step, platform by platform: INSTALL.md (français).

v0.7 (bêta)

TermDevTools v0.7 (beta)

Version française : CHANGELOG_fr.md

In one sentence: TermDevTools reaches a cluster through a proxy, takes API keys the way Kibana gives them as well as Bearer tokens, and no longer writes anything next to its binary.

Why "beta": like 0.6, this version has only been used by its author so far. Going through a proxy was checked with test proxies, not with a real corporate proxy. Feedback is welcome.

What's new

• HTTP and SOCKS5 proxies: a cluster is reached through the proxy the HTTPS_PROXY / HTTP_PROXY environment variables designate, unless NO_PROXY excludes it. For one cluster in particular, proxy: on its entry in config.yaml takes precedence: a proxy URL (http://…, or socks5://… — what ssh -D opens), or none for a direct connection. F9 writes it into the curl command when config.yaml sets it.
• API key in its encoded form: the key as Kibana shows it when created is pasted straight into the secret field, with no identifier. The identifier is taken from the key and saved. Entering the identifier and the secret works as before.
• Bearer token: a new authentication type, for a service account token, an access token or a JWT. Like any secret, it is asked again on every connection and never saved.
• Exports go to your configuration directory: Ctrl+S on the result writes to ~/.config/termdevtools/exports/, no longer next to the binary. Exporting therefore also works in a shared or read-only installation, and each user has their own. The status bar still shows the path of the file written.
• The crash report (crash-<date>.log) is written to the same place: the program no longer writes anything to its binary's directory.
• Messages of the connection screen on three lines: a long error is no longer cut after the first.

Security

• A proxy is never used without being shown: while connecting, at the head of the message if the connection fails, and in the status bar once connected. Its credentials, for their part, are never displayed nor copied, and are sent to it alone.
• A proxy reached over TLS (https://proxy…) is refused: the cluster's TLS settings — its client certificate, a verification turned off — would apply to the proxy as well.
• Nothing secret in config.yaml, as before: credentials in proxy: are refused, and a Bearer token is never saved.
• An API key secret with no identifier is refused before anything is sent, with a message saying what to enter.
• Binaries built with Go 1.27.2. That version of Go fixes flaws of its standard library published since 0.6, two of which concern a client like this one: the desynchronization of an HTTP/1 connection after a proxy rejects a CONNECT tunnel (GO-2026-6605) and the bypass of a memory limit when parsing headers (GO-2026-6608). go.mod now asks for that version.

Before upgrading from 0.6

• Proxy: 0.6 ignored HTTPS_PROXY and HTTP_PROXY. If either is set on your machine, a cluster reached directly so far will go through that proxy. If it must not, add it to NO_PROXY, or set proxy: none on its entry in config.yaml. On failure, the message starts with the proxy gone through and recalls both remedies.
• Exports: an exports/ directory left next to the binary is neither moved nor deleted; take your files from it if you need them.
• API keys: nothing to do. Existing entries keep their identifier; only the label of the secret field changes.

Checks

• Password, API key (in both forms) and Bearer token: checked against a real Elasticsearch 9.5.4 with security on — accepted with the right secret, turned down with a wrong one.
• Proxy: checked with a test HTTP proxy and a test SOCKS5 server — a tunnel to a cluster in https with its certificate verified end to end, each side's credentials kept to itself.
• govulncheck: no known vulnerability, neither in the dependencies nor in the standard library of Go 1.27.2. With Go 1.27.1, it reported eight in the standard library.
• The reference data (recipes, endpoints, _cat columns) has not changed since 0.6: its checks against eleven real clusters are those of 0.6 and were not run again.
• No independent external audit was carried out.

Known limits

• OpenSearch managed by AWS with IAM authentication (SigV4) is not supported.
• Proxy: its credentials are only given through the environment variable, with Basic authentication; NTLM, Kerberos, PAC files and Windows' proxy settings are not supported. No real corporate proxy was tried.
• Bearer token: only an Elasticsearch service account token was tried; Elasticsearch and OpenSearch JWTs were not. The program doesn't renew an expired token.
• The demo animation of the README was recorded with 0.5: it shows neither the recipe catalog nor these additions.

Binaries

One self-sufficient file per platform — no archive and no companion file:

• termdevtools-linux-amd64 — Linux x86-64 (static binary)
• termdevtools-windows-amd64.exe — Windows 10/11 x64
• termdevtools-darwin-arm64 — macOS Apple Silicon
• SHA256SUMS — SHA-256 checksums of the three files

Download the file for your platform and SHA256SUMS, check it (sha256sum -c SHA256SUMS --ignore-missing on Linux), make it executable (chmod +x, Linux and macOS), run it: termdevtools --version answers termdevtools v0.7. The binaries are not signed. Step by step, platform by platform: INSTALL.md (français).

v0.6 (bêta)

TermDevTools v0.6 (beta)

Version française : CHANGELOG_fr.md

In one sentence: TermDevTools now needs nothing but its binary, recognizes Elasticsearch and OpenSearch and their version, and offers a catalog of ready-made requests suited to the cluster.

Why "beta": the recipe catalog, OpenSearch support and the selection by version are new. They were checked against eleven real clusters (see below), but not yet by users other than their author. Feedback is welcome.

What's new

• Recipe catalog (F8): about a hundred ready-made requests, filed by theme — overview, shards and allocation, nodes and resources, indices, tasks, snapshots, index lifecycle, upgrade and maintenance, search. Filter by typing, preview, Enter inserts the recipe at the end of the editor, cursor on its request. Recipes are written in English.
• Elasticsearch and OpenSearch, by version: the distribution and version of the cluster are detected at connection and shown in the status bar (ES 9.5.4, OS 2.19.6). Only the recipes and endpoints that exist on that cluster are offered. Coverage: Elasticsearch 7.17 to 9.x, self-managed OpenSearch 2.x and 3.x.
• No file to install next to the binary anymore: recipes, endpoints and _cat columns are built in. Releases are plain binaries, with their SHA-256 checksums.
• Your own recipes and endpoints: plain text files in ~/.config/termdevtools/ (or next to the binary, to share them), added to the built-in ones without replacing them. F7 reloads them; a mistake in a file is reported with the file and the line.
• _cat columns asked from the cluster: completion of the h= and s= parameters queries the cluster itself, so it is exact whatever its version.
• Client keys encrypted in the PKCS#8 format (mTLS): the format OpenSSL writes by default is now read, in addition to the older encrypted PEM format.
• termdevtools --version and termdevtools --export-defaults <directory> (writes the built-in recipes and endpoints out as files, to read them or start from them).

Security and reliability

• HTTP redirections are no longer followed. A redirection is displayed as it is. Previously, a 302 answer silently turned a DELETE or a POST into a GET of the new address.
• A URL carrying credentials is refused (https://user:password@host): the URL is saved in config.yaml, where the password would have ended up.
• Ctrl+C always saves before quitting, including when the help, the search bar or a list is open. If the save fails, the program says so and waits for a second Ctrl+C.
• Atomic saves: a full disk or an interruption during a write no longer destroys the previous content (requests, config.yaml).
• config.yaml keeps its comments after every connection, as well as the keys this version doesn't know and a default directory deliberately left empty.
• A response larger than 64 MB is no longer loaded: the request is reported as failed, with the advice to narrow it down.
• Fixes: crash of the search in the result after a shorter result; a slow connection given up on can no longer replace the session opened since; only the answer to the last request sent is displayed; with the mouse enabled, the focus follows clicks.

Before upgrading from 0.5

• Companion files: cat_columns.txt is no longer read and can be deleted. endpoints.txt, if left next to the binary, is read as an addition to the built-in list: delete it unless you had added endpoints of your own to it. cheatsheet.txt keeps its role; delete it to get the built-in starting content.
• Starting content of the editor: a few universal requests instead of a long cheatsheet, whose content is now in the catalog (F8). Requests you already saved don't change.
• An http:// address that redirected to https://: the connection now fails, naming the new address; correct the URL.
• Credentials in the URL: such an entry in config.yaml is refused at connection; remove them from the URL and choose Basic Auth.
• F7 now reloads all your files (variables, recipes, endpoints), not only the variables.
• Interface in English by default: the program starts in English as long as no language was chosen; F3 switches to French and remembers that choice. This also applies to an existing installation where F3 was never used (0.5 didn't durably record the language until it had been changed): press F3 once. A language already chosen with F3 is kept.
• Generated files are in English: the comments of a new config.yaml and of a new variables file are in English. Existing files are not rewritten.

Checks

• Detection, endpoints, _cat columns and every request of every recipe run against eleven real clusters: Elasticsearch 7.17.29, 8.0.1, 8.11.4, 8.19.22, 9.0.8, 9.5.4; OpenSearch 2.0.1, 2.11.1, 2.19.6, 3.0.0, 3.9.0.
• PKCS#8 keys: checked against keys written by OpenSSL and through a full mTLS connection.
• govulncheck: no known vulnerability in the dependencies.
• No independent external audit was carried out.

Known limits

• OpenSearch managed by AWS with IAM authentication (SigV4) is not supported.
• No HTTP(S) proxy: HTTPS_PROXY is not honored.
• API keys are entered as identifier + secret, not in their encoded form.
• Exports (Ctrl+S on the result) are written next to the binary: in a shared or read-only installation, exporting fails.
• The demo animation of the README was recorded with 0.5: it doesn't show the recipe catalog.

Binaries

One self-sufficient file per platform — no archive and no companion file anymore:

• termdevtools-linux-amd64 — Linux x86-64 (static binary)
• termdevtools-windows-amd64.exe — Windows 10/11 x64
• termdevtools-darwin-arm64 — macOS Apple Silicon
• SHA256SUMS — SHA-256 checksums of the three files

Download the file for your platform and SHA256SUMS, check it (sha256sum -c SHA256SUMS --ignore-missing on Linux), make it executable (chmod +x, Linux and macOS), run it: termdevtools --version answers termdevtools v0.6. The binaries are not signed. Step by step, platform by platform: INSTALL.md (français).