Spool 0.5.2

What's new

• perf(security): move purge / dismiss / undismiss SQL onto a worker thread (#352)
• fix(security): smooth the scan-end visual transition (#351)
• perf(security): batch scan-worker enqueue burst into one status publish (#350)
• feat(sync): "Refresh from source" — explicit per-session rebuild action (#349)
• feat(sync): switch syncer to append-only so user-side state survives re-sync (#348)
• fix(db): dedupe (session_id, msg_uuid) and add UNIQUE INDEX (schema v14) (#347)
• fix(security): collapse bulk purge into a single transaction (#344) (#346)
• feat(security): add toggle to hide the row-level risk icon (#343)
• fix(app): keep session scrolling responsive (#321)

Install

macOS (Apple Silicon)

curl -fsSL https://spool.pro/install.sh | bash

Linux (x86_64)
Download the AppImage from the assets below.

This is an early release — feedback and bug reports welcome via Issues.

Spool 0.5.1

What's new

• fix(redact): tighten internal-host and credit-card false positives (#341)
• docs(readme): refresh for v0.5.0 + repo rename + OpenCode + Linux (#339)

Install

macOS (Apple Silicon)

curl -fsSL https://spool.pro/install.sh | bash

Linux (x86_64)
Download the AppImage from the assets below.

This is an early release — feedback and bug reports welcome via Issues.

Spool 0.5.0

Spool v0.5.0 — Security Scan

This release introduces Security Scan, an always-on local scanner that surfaces credentials, API keys, and PII that have leaked into your coding-agent sessions. Everything runs on-device — Spool never sends your session data anywhere.

What's new

Security Scan (default on)

• 30+ secret patterns — vendor API keys (OpenAI, Anthropic, Stripe, AWS, GitHub, Slack, ...), private keys, kubeconfig tokens, connection strings, env-var leaks, basic-auth, bearer tokens, JWTs, cloud credential blobs.
• Optional ML-powered PII detection — Privacy Filter, opt-in under Settings → Security → Experimental. A local ONNX model catches structured PII the regex layer misses, class-mapping tuned for precision over recall.
• Cross-session blast radius — see every place a leaked value occurs across your archive, not just the one session you're looking at.
• One-click rotate-at-source — Stripe, OpenAI, Anthropic, AWS, GitHub, Slack and more: deep-link straight to the rotation surface in the provider's dashboard.
• Purge everywhere — destructively rewrite a leaked value out of every message that contains it, with a preserved audit row.
• Allowlist review surface — per-kind and per-value, with bulk dismiss / undismiss.

Other improvements

• OpenCode session indexing — sessions captured by OpenCode CLI are now indexed alongside Claude Code, codex, and gemini.
• CLI — new spool projects, spool pin, spool unpin, spool pinned commands.
• OpenTelemetry instrumentation — pretty traces in dev, JSONL exporter in prod.
• Settings modal — larger surface; stacked sub-modals scrim correctly.
• Native menu — adapted properly on non-macOS platforms.
• npm packages — @spool-lab/redact, @spool-lab/core, @spool-lab/cli auto-publish on every release.

Behavior on upgrade from v0.4.x

When the auto-updater applies v0.5.0:

1. ~/.spool/agents.json gets "securityEnabled": true seeded automatically. Opt out any time at Settings → Labs → Security Scan.
2. A background backfill rescans every previously-indexed session with the new detector profile (regex@1 → regex@2). Worker runs in a separate thread; foreground UI stays responsive.
3. No database schema change — user_version stays at 13. The upgrade is non-destructive: downgrading back to v0.4.x is safe.

Privacy

All scanning is local. Nothing about your sessions, findings, or values leaves your device. The optional Privacy Filter ML model runs entirely on-device in a hidden inference window via onnxruntime-node.

Install

macOS (Apple Silicon)

Download Spool-0.5.0-arm64.dmg from the assets below, drag to /Applications.

Linux (x86_64)

Download the AppImage from the assets below.

Reporting issues

This is an early release. Please report false positives, missed leaks, or any unexpected behavior via Issues. The CJK env-var false-positive someone reported on day one (#334) is exactly the kind of feedback that improves the detector.

Spool 0.4.20

What's new

• Eliminated white flash when resizing windows in dark mode (#275)
• Excluded Claude Code subagent JSONL files from the session indexer so subagent runs no longer show up as duplicate top-level sessions (#274)

Internal

• Isolated dev database to ~/.spool-dev/ so pnpm dev no longer touches your real ~/.spool/ (#255)
• Parallelized Playwright + split unit test matrix in CI (#272)
• Removed an unused share-editor toggle (#254)

Install

macOS (Apple Silicon)

curl -fsSL https://spool.pro/install.sh | bash

Linux (x86_64)
Download the AppImage from the assets below.

This is an early release — feedback and bug reports welcome via Issues.

Spool 0.4.19

What's new

• feat(app): browse all sessions in scope inside the picker (#253)
• refactor(app): unify cmdk + share picker on shared CommandPalette shell (#252)
• feat(app): filter share new-draft picker by project (#251)
• fix(app): sync sidebar fold motion across topbar bg, rail, and chrome (#250)
• fix(app): include cd prefix in Copy Resume Command everywhere (#249)
• feat(app): add Settings → Labs for early-access feature flags (#247)
• refactor(app): route share-editor shortcuts through useHotkeys (#246)
• fix(app/i18n): align zh-CN sidebar pinned label with the rest of the UI (#245)
• feat(app): add Shortcuts tab to Settings (#244)
• fix(app): expand draggable top-bar region beyond the toggle gutter (#243)

Install

macOS (Apple Silicon)

curl -fsSL https://spool.pro/install.sh | bash

Linux (x86_64)
Download the AppImage from the assets below.

This is an early release — feedback and bug reports welcome via Issues.

Spool 0.4.18

What's new

• perf(app): kill the cold-launch beachball + guards against its return (#242)
• chore(app): remove the obsolete Spool Daemon migration notice (#241)
• fix(app): no flash of English on first paint for non-English UI (#240)

Install

macOS (Apple Silicon)

curl -fsSL https://spool.pro/install.sh | bash

Linux (x86_64)
Download the AppImage from the assets below.

This is an early release — feedback and bug reports welcome via Issues.

Spool 0.4.17

What's new

• fix(core): detect agent CLIs installed via mise / interactive-rc version managers (#239)
• fix(app): keep sidebar pinned section sticky while scrolling projects (#238)
• docs: refresh README hero image (#236)
• docs: refresh README hero image

Install

macOS (Apple Silicon)

curl -fsSL https://spool.pro/install.sh | bash

Linux (x86_64)
Download the AppImage from the assets below.

This is an early release — feedback and bug reports welcome via Issues.

Spool 0.4.16

What's new

• docs(skill/launch-video): incorporate v0.5.0 production learnings (#234)
• feat(app): add undo/redo to the share editor (Cmd+Z / Cmd+Shift+Z) (#233)
• perf(app): debounce ShareEditorPage's autosave stringify (#232)
• polish(app): switch sessions icon to Layers3 and tidy zh-TW translation (#231)
• feat(app): virtualize session lists with cursor pagination (#230)

Install

macOS (Apple Silicon)

curl -fsSL https://spool.pro/install.sh | bash

Linux (x86_64)
Download the AppImage from the assets below.

This is an early release — feedback and bug reports welcome via Issues.

Spool 0.4.15

What's new

• fix(app): shorten update-banner copy so it stops truncating (#229)

Install

macOS (Apple Silicon)

curl -fsSL https://spool.pro/install.sh | bash

Linux (x86_64)
Download the AppImage from the assets below.

This is an early release — feedback and bug reports welcome via Issues.

Spool 0.4.14

What's new

• fix(app): drop leading day-divider before the first message (#228)

Install

macOS (Apple Silicon)

curl -fsSL https://spool.pro/install.sh | bash

Linux (x86_64)
Download the AppImage from the assets below.

This is an early release — feedback and bug reports welcome via Issues.