Diff any two imported files — plus a triage layer that stopped losing your work.
Two of this release's three headline items are corrections. The tag and bookmark layer was quietly discarding annotations in four different ways, and every DMG through 1.0.11 shipped with an unsigned disk image. Both are fixed here.
Diff Tabs
View → Diff Tabs compares any two imported files — not a Computer History special case.
Pick a baseline and a compare tab, match on auto-detected identity columns or on entire-row content, and get a result timeline of Added / Removed / Changed rows with field-level before/after, clickable status counts, and schema-delta highlighting.
Tags and bookmarks — four ways it was losing work
Every item here is a fix, not a feature.
| Symptom | Cause |
|---|---|
| A new tag landed on the whole file | Bulk Tag / Bookmark opened from the Actions menu carried no scope. It fell back to the filtered view, and on an unfiltered tab that is every row. Selecting rows first changed nothing. |
| Tagging did nothing right after an import | Writes were discarded for the duration of the deferred index/FTS build while the grid showed the tag as applied. The guard was unnecessary — the build runs on the same connection and only touches the data tables. |
| Half a selection came back untagged | Each row decided add-versus-remove for itself, so one click on a mixed selection tagged some rows and untagged others. |
| Select-all + tag marked one row | Select-all is an inverted selection whose member ids are never materialised. The row menu fell through to the single-row path while the status bar reported the full count. |
Also fixed: a filter round-trip could repaint the tag snapshot from before an edit, making a successful write look like it had reverted.
Bulk Tag / Bookmark now leads with the scope — Selected rows / Filtered view / Entire tab — defaulting to the selection whenever one exists, with each option's true row count resolved in SQLite against the exact query the write will use. An unscoped write is refused unless it is confirmed.
Manage Tags is backed by live row counts and can rename a tag (merging into the destination on collision), collapse tags that differ only by case or spacing, and actually delete a tag from the rows carrying it. Deleting previously removed only the colour swatch — every row kept the tag, still filterable, still in the report, and no longer removable from the row menu because the palette no longer listed it. Analyzer-written tags (IOC:, VT:, Sigma, Encrypted) now appear alongside manual ones.
Tags and bookmarks survive export. CSV, TSV and XLSX exports carry Tags and Bookmarked columns when the tab has any. Untriaged tabs export exactly as before.
Cmd+Shift+1–Cmd+Shift+9 apply palette tags 1–9 to the current selection, under the same scope rules as the context menu.
ChatGPT Computer History — live re-audit (16,173 events)
The 1.0.10 catalog and the 1.0.11 verification both missed a later recorder kind, and overstated how hard the 48-hour purge is.
terminal.value_changedis now parsed. Nine events on the measured host, all under Secure Input. Content is the visible iTerm2 scrollback: SSH targets,rsync/scpcommand lines, first-seen host-key acceptance. The typed password is still withheld. Previously this kind fell through to an emptyContentfield.- Visible-range truncation is labelled. Records prefixed
[truncated to visible range]are the on-screen AX slice, not full scrollback. com.openai.chat.StatsigService.plistis collected asidentity.statsig_account— email / user id / account UUID, no tokens.- Computer History plugin vs Computer Use MCP are recorded separately. They share a container; they are not the same feature.
- 48-hour purge caveat. The advertised rolling window applies while the recorder is running. A stopped recorder left 90 segment buckets on disk three days after the last write.
Hayabusa v2 / v3 / v4 compatibility
Hayabusa v4 merged csv-timeline and json-timeline into a single dfir-timeline subcommand with an explicit -t output type, and rejects the old form before scanning a single event.
The scanner now detects the installed binary's version and builds the matching command line, keeping v2 and v3 on the legacy subcommands. Follow-up fixes: the output file extension matches the requested type (json and jsonl both landed on .jsonl); version detection requires a real version token, so an unparsable string falls back to the modern CLI rather than the legacy one; and Hayabusa's abbreviated level names (crit, med) map to full severities — unmapped they became their own buckets and dropped out of the severity histogram.
Multi-tab selection controls — the Lateral Movement Tracker gains Select All and Clear for its multi-source tab list, and the Persistence Analyzer gains Clear alongside its existing Select all.
Hayabusa compatibility and the selection controls were contributed by @Yuds16 in #27 — the project's first external code contribution. Thank you.
Known limitation: the JSON output mode still cannot be read by the result parser, which is line-delimited. Use CSV or JSONL.
Signed and notarized disk image
Every release through 1.0.11 shipped a DMG that was never signed or submitted to Apple. The app inside was notarized and stapled, so it ran cleanly once installed — but the downloaded disk image itself failed Gatekeeper (no usable signature), which is the "Apple could not verify…" dialog on first open.
The build now signs, notarizes and staples the DMG itself, and asserts with spctl that Gatekeeper accepts it before the build is allowed to succeed.
Install
Download IRFlow-Timeline-1.0.12-universal.dmg (Intel + Apple Silicon), open it, and drag the app to Applications. No Gatekeeper warning.