Spagitty v4.0.1

Fixed

• Bruno collections in YAML import. Bruno now saves a collection as opencollection.yml and one .yml file per request, and Import read only the older .bru files. Both formats now import, with folders, environments, and auth inherited from the folder or the collection. Choose a Bruno folder… on Import brings in a whole collection (BUG-100).
• Edits in Calls are saved. Each save after the first said Could not save … already exists and kept nothing (BUG-101).

Downloads

• Linux, Windows and macOS (Apple silicon *-macos-arm64.dmg and Intel
  *-macos-x86_64.dmg), as in 4.0.0, each with its terminal multiplexer. The
  Mac builds are signed ad hoc and are not notarized: on first open macOS says
  the developer cannot be verified. Open the app once from the right-click
  Open menu, or allow it under System Settings › Privacy & Security ›
  Open Anyway, and macOS remembers the choice. If macOS says the app is
  damaged instead, compare the download with SHA256SUMS-*.txt: download
  it again if it differs, and open an issue if it matches.

Spagitty v4.0.0

Calls: REST and SOAP requests beside the code, on the rail as 2C after Recipes. MAJOR because a new part of Spagitty reaches the network, as the author decided for this release.

Added

• Calls (2C), a new screen after Recipes: send a REST request to the service you are working on and keep it, in a collection, in the repository under .spagitty/calls/. Requests are made by Spagitty itself, never by the window. Open calls are chips; {{variables}} are pills that say what they hold, and an unknown one stops Send and says which. JSON and XML responses are formatted, an event stream is shown as it arrives, and each send is kept in a history on this computer (FEAT-160).
• Environments, secrets and kept values in Calls. Click any value in a JSON or XML response to keep it as a variable, once or after every call, so a login's token reaches every later call without a script. Environments have a colour, Ask before sending, plain values in the repository, and secrets and kept values in this computer's keychain, never in a file. Switch with Ctrl+E (FEAT-161).
• Settings › Calls, after Behaviour: where calls live, timeouts, redirects, TLS checks, a proxy, client certificates for mutual TLS by host, the header on every call, history and more. A repository can override any of them in .spagitty/calls/settings.json, and Settings says which (FEAT-165).
• Import calls into Calls: from Spring MVC, WebFlux, JAX-RS and NestJS controllers in the repository (with example bodies from the request class or DTO), OpenAPI and Swagger files, and Postman, Insomnia, Bruno, .http, HAR and cURL. Endpoints are marked New, Changed or already in a collection, and bringing a changed one in keeps the values you typed. Collection files in the repository can be sent in place without importing, and are never rewritten (FEAT-162).
• SOAP calls in Calls, from a WSDL in the repository or at a URL, or from JAX-WS and Spring-WS services in the code. The envelope is made for you with a sample and the type of every element, the SOAPAction is set from the WSDL, WS-Security's username token is added (text or digest), and a SOAP fault is shown as an error even when the server answered 200. Rebuild from WSDL keeps what you typed (FEAT-163).
• Share a collection from Calls: as one Spagitty or Postman 2.1 file, as a zip with its environments, example responses and a README of what to fill in, or as a commit on the current branch. Secrets and kept values go in empty in every format, and Import reads the zip back (FEAT-164).
• Copy a call as cURL, and paste one in, from the request bar. A copy is resolved in the active environment and quoted for your shell; secrets stay as their names unless you tick Fill in secrets. A paste says which flags it read, and replaces the request or adds a new call (FEAT-166).

Changed

• Calls is the third part of Spagitty that reaches the network, after pull requests and model providers. It sends only what you send, follows redirects and allows plain http, because the service you work on is often on localhost. The window itself still makes no request and holds no secret.
• In the command palette, gtc finds Go to Calls: the shorter title wins a tie. gtch finds Go to Changes.

Downloads

• Linux, Windows and macOS (Apple silicon *-macos-arm64.dmg and Intel
  *-macos-x86_64.dmg), as in 3.10.1, each with its terminal multiplexer. The
  Mac builds are signed ad hoc and are not notarized: on first open macOS says
  the developer cannot be verified. Open the app once from the right-click
  Open menu, or allow it under System Settings › Privacy & Security ›
  Open Anyway, and macOS remembers the choice. If macOS says the app is
  damaged instead, compare the download with SHA256SUMS-*.txt: download
  it again if it differs, and open an issue if it matches.

Spagitty v3.10.1

Security

• Built with Bun 1.4.4, past HTTP2Shell (CVE-2026-111497, a flaw in the Brotli decompressor that Node.js and Bun bundle). Spagitty never unpacks Brotli data from the network, so the app was not exposed; this updates the tools its releases are built and checked with. The checks' own Node.js scripts now run on Node.js 22.23.4.

Downloads

• Linux, Windows and macOS (Apple silicon *-macos-arm64.dmg and Intel
  *-macos-x86_64.dmg), as in 3.10.0, each with its terminal multiplexer. The
  Mac builds are signed ad hoc and are not notarized: on first open macOS says
  the developer cannot be verified. Open the app once from the right-click
  Open menu, or allow it under System Settings › Privacy & Security ›
  Open Anyway, and macOS remembers the choice. If macOS says the app is
  damaged instead, compare the download with SHA256SUMS-*.txt: download
  it again if it differs, and open an issue if it matches.

Spagitty v3.9.0

Added

• Pick an accent colour in Settings › Appearance: Tomato, Spagitty's own and the default, or Ocean, Violet, Jade or Graphite. It recolours buttons, selections, focus rings, tabs and the window's glow, in a shade drawn for light and one for dark. Graph lanes and the red, amber and green that mean danger, warning and success stay as they are.
• Close a terminal session. Every Terminal tab now has a close button, and the header has Close beside Detach. Spagitty asks first, then ends the session with every window in it. Detach still leaves it running.
• tmux and psmux in Spagitty's colours. The multiplexer's status line, window tabs, pane borders and messages take the theme and its accent, and change with them. Your own config's key bindings and plugins still apply; only its colours are replaced, and only in Spagitty's own sessions. Turn it off in Settings › Behaviour to keep your config's colours.

Changed

• Calmer colours. The light theme is on white and grey instead of cream, so the window no longer looks yellow. The dark theme is a little softer and less brown, and keeps its glow.
• The terminal follows the theme. An open terminal now changes colour with the theme and the accent instead of keeping the colours it opened with.

Security

• Updated the root certificate list built into Spagitty's HTTP library to drop the distrusted emSign intermediates (RUSTSEC-2026-0383). Spagitty checks certificates against your system's store, so this is a precaution.

Downloads

• Linux, Windows and macOS (Apple silicon *-macos-arm64.dmg and Intel
  *-macos-x86_64.dmg), as in 3.8.0, each with its terminal multiplexer. The
  Mac builds are signed ad hoc and are not notarized: on first open macOS says
  the developer cannot be verified. Open the app once from the right-click
  Open menu, or allow it under System Settings › Privacy & Security ›
  Open Anyway, and macOS remembers the choice. If macOS says the app is
  damaged instead, compare the download with SHA256SUMS-*.txt: download
  it again if it differs, and open an issue if it matches.

Spagitty v3.8.0

Added

• Untrack, a new screen under Tools. Choose a branch, tick the files and folders it should stop tracking, and Spagitty untracks them in a commit and pushes it. The files stay on disk. Before anything is written, the screen shows each path, the .gitignore line it gets (so the next git add . does not track it again), and the commit message. On the branch you have checked out, the commit is made in place with your hooks, and it is refused while anything else is staged. On any other branch, it is made without touching your working copy. A branch that is not on the remote yet is created there.

Fixed

• Pushing and fetching use the account you connected. With an account connected in Settings › You for a host, git signs in to that host with its token. Before this, the system's credential helper could open its own sign-in window and ask for a user name and token again, as on a first push of a new branch to GitLab. Hosts with no connected account use git's credential helpers as before. The token must be allowed to push (on GitLab, write_repository or api).
• Pull requests on a GitLab that fails to send the list. Some GitLab servers answer the merge request list with 500 Internal Server Error when they cannot send one merge request in it. Spagitty now reads the merge requests one at a time instead and shows every one the server can send. When the server fails at that too, the message says the fault is the server's.

Downloads

• Linux, Windows and macOS (Apple silicon *-macos-arm64.dmg and Intel
  *-macos-x86_64.dmg), as in 3.7.0, each with its terminal multiplexer. The
  Mac builds are signed ad hoc and are not notarized: on first open macOS says
  the developer cannot be verified. Open the app once from the right-click
  Open menu, or allow it under System Settings › Privacy & Security ›
  Open Anyway, and macOS remembers the choice. If macOS says the app is
  damaged instead, compare the download with SHA256SUMS-*.txt: download
  it again if it differs, and open an issue if it matches.

Spagitty v3.7.0

Added

• Usages in Files. Ctrl-click a name in a file (⌘-click on a Mac) — a function, a class, a method, a module — and the tree lists where it is defined, where it is used, and where it is only mentioned in comments, strings and documents, with a count of each and of the files. A click opens the place with the name marked. Holding Ctrl or ⌘ underlines what a click would look up, and Usages in the tree takes a typed name too. It works at any branch, tag or commit, and tells definitions from uses in Rust, TypeScript, JavaScript, Python, Go, Java, C, C++ and C#. It goes by name, not by type, so other things with the same name are listed as well.

Downloads

• Linux, Windows and macOS (Apple silicon *-macos-arm64.dmg and Intel
  *-macos-x86_64.dmg), as in 3.6.0, each with its terminal multiplexer. The
  Mac builds are signed ad hoc and are not notarized: on first open macOS says
  the developer cannot be verified. Open the app once from the right-click
  Open menu, or allow it under System Settings › Privacy & Security ›
  Open Anyway, and macOS remembers the choice. If macOS says the app is
  damaged instead, compare the download with SHA256SUMS-*.txt: download
  it again if it differs, and open an issue if it matches.

Spagitty v3.5.0

Added

• The Files tree can be widened. Drag the divider between the tree and the file; a double-click puts it back.
• Right-click a file in the Files tree to copy its name, its path from the top of the repository, or its content at the branch, tag or commit Files shows. A folder copies its name or path.

Fixed

• Selecting more of a file than fits on screen keeps the whole selection. Lines that scrolled out of view dropped out of the selection, so only what was on screen was copied.

Downloads

• Linux, Windows and macOS (Apple silicon *-macos-arm64.dmg and Intel
  *-macos-x86_64.dmg), as in 3.4.0, each with its terminal multiplexer. The
  Mac builds are signed ad hoc and are not notarized: on first open macOS says
  the developer cannot be verified. Open the app once from the right-click
  Open menu, or allow it under System Settings › Privacy & Security ›
  Open Anyway, and macOS remembers the choice. If macOS says the app is
  damaged instead, compare the download with SHA256SUMS-*.txt: download
  it again if it differs, and open an issue if it matches.

Spagitty v3.4.0

Added

• Search in files. Files can look for text in every file at the branch, tag or commit it shows: switch the tree's field from Names to Text. Matching lines are listed under their files with the match marked, and a click opens the file there. The search in a file (/) and the search in files both take a regular expression (.*, Alt+R), a whole word (W, Alt+W) and match case (Aa, Alt+C).

Changed

• Screens no longer wait for each other. Every command used to queue behind the slowest one reading the repository, so selecting a commit while a long file was being blamed waited for the blame. Reads now run side by side, and only changes to the repository take turns.
• Create pull request and Add worktree choose a branch from the list the toolbar uses, which can be searched, instead of a plain drop-down of every branch.

Fixed

• Assigning an agent twice in quick succession starts one agent. Two clicks on Assign, or a click and a resume, could each start an agent on the same pull request or merge while the first was still being set up, spending tokens twice. The second is now told An agent is already assigned to this.
• A remote agent's limits hold inside a step. Tokens per run, tokens per day and minutes were checked only between steps, and one step can make forty exchanges with the model, so a large file could cost several times the limit. The agent now stops after the exchange that reaches it, keeps what it found, and says which limit it reached. Stop and the minutes limit also end a step that is waiting for the model to answer.
• Resuming an agent after the pull request or branch moved starts it over. It used to carry on from the files it had finished, at code that was no longer there, and keep its findings against the old commit.
• The Terminal's + brings a session back after its last shell has exited, instead of saying no server running on session.
• A model's reply that cannot be read says so. A reply cut off by the connection, larger than 8 MB, or not text was taken as an empty answer, so the agent reported that the model said nothing. It now says which of the three happened.

Downloads

• Linux, Windows and macOS (Apple silicon *-macos-arm64.dmg and Intel
  *-macos-x86_64.dmg), as in 3.3.0, each with its terminal multiplexer. The
  Mac builds are signed ad hoc and are not notarized: on first open macOS says
  the developer cannot be verified. Open the app once from the right-click
  Open menu, or allow it under System Settings › Privacy & Security ›
  Open Anyway, and macOS remembers the choice. If macOS says the app is
  damaged instead, compare the download with SHA256SUMS-*.txt: download
  it again if it differs, and open an issue if it matches.

Spagitty v3.3.0

Added

• Settings › Home arranges Home's cards: show or hide each one, and drag it, or move it with Alt and the arrows, into the order you want. Needs you keeps its double width wherever it goes.
• Files tags each file with its kind: a small coloured TS, RS, {}, MD and so on in front of its name, and a folder for each folder, so the tree is quicker to scan.
• A copy per task. A farm can give each task a repository of its own instead of a worktree: a local clone with no remote, so the agent cannot push or move your branches. When it finishes, Spagitty takes its commits and checks them first: they must start where the task started, change only the paths the task may touch, leave CI files, submodules and hooks alone unless the task names them, and add no file over 5 MB. Work that fails is held with the reason; work that passes is checked and reviewed as usual. Chosen in the farm's Rules, as Where each task works.
• Who resolves a conflict is a farm rule: you, in Merger (as before, and the default), the agent that wrote the task, or a command such as mergiraf solve. An agent or a command works in the task's own workspace, never yours, and the resolution is checked and reviewed again before it is merged.
• History tools for agents. Claude Code and Codex, run by the farm, can ask Spagitty for blame, a file's history, a search of commits or code, and a file at a commit, instead of reading the history themselves. Answers are kept per commit, so the next agent to ask gets them at once.
• Open any file from anywhere. Double-click a file, or Ctrl-click it (⌘ on a Mac), on any screen to open it in Files at the version that screen shows. Where clicking a file name did nothing before — Home's working copy, an agent's plan, CodeRabbit's findings, search results, a farm task's changes — a plain click opens it.

Fixed

• Dragging rows into place works on Windows: the Rail in Settings, the rebase plan, Hooks' blocks and the Graph's column headings. Dropping did nothing there before; Alt with the arrows was the only way.
• Starting a farm: the issue search box is one field again, and the steps at the top show their numbers in rings instead of spilling them under tiny dots.
• A fetch or push no longer leaves git's line beside the branch. It used to stay there, two hashes and an arrow, until the next one. A notice now says what happened in words, such as Pushed chore/fix-sonar-scan, and goes away. A failed fetch or push still says why beside the branch.

Downloads

• Linux, Windows and macOS (Apple silicon *-macos-arm64.dmg and Intel
  *-macos-x86_64.dmg), as in 3.2.0, each with its terminal multiplexer. The
  Mac builds are signed ad hoc and are not notarized: on first open macOS says
  the developer cannot be verified. Open the app once from the right-click
  Open menu, or allow it under System Settings › Privacy & Security ›
  Open Anyway, and macOS remembers the choice. If macOS says the app is
  damaged instead, compare the download with SHA256SUMS-*.txt: download
  it again if it differs, and open an issue if it matches.

Spagitty v3.2.0

Added

• Home is the new top of the rail and the screen Spagitty opens on. Needs you lists what is waiting on you in this repository, most urgent first: farm tasks ready to merge or stuck, review requests, failed checks on your branches, changes asked for on your pull requests, and issues assigned to you. Below it are the farm, the working copy, recent branches, open pull requests, the latest commits, sixteen weeks of commits, pipelines and releases.
• Starting a farm is one step at a time: the goal, anything to start from, the crew and rules, and how the tasks are made. Only a one-line goal is required. The crew and rules come back as the last farm in the repository had them, and earlier farms can be resumed or used as a starting point. A farm can start from issues, Markdown briefs and a branch in progress; the planner is given all of them, the repository's rules and a map of the repository, and can be replaced by one task per issue or an empty plan. Once the farm exists, the tracker reads Plan, Build and Wrap up.
• A slice per task. A farm can give each task a worktree holding only the repository's top-level files and the paths the task may touch or must read. The checks still run on the whole tree. Tasks gain Reads, paths they need but may not change, which the planner can fill in. Chosen in the farm's Rules, as Where each task works.
• Notifications are kept. The bell in the title bar opens a drawer with everything Spagitty has told you, across repositories, grouped by day, with search, filters and one action per item. Pull request news, the farm, failed or recovered checks, failed fetches, pulls and pushes, and published releases all land there. Settings › Notifications can clear the ones older than 90 days.

Changed

• The farm merges without touching your working copy. When it merges a task by itself, it builds the merge commit on the side, runs the task's checks on it again if the branch moved since the task started, and moves the branch only if it is still where it was. You can be on any branch. A conflict blocks the task and writes nothing; a merge result that fails its checks goes back to the agent. Every branch move is recorded with who made the work and who passed it, and Activity lists them.
• Spagitty opens on Home. The last session's tab and selected commit still come back.
• The farm's Setup page is gone, replaced by the steps above. Its rules sheet shows the autonomy levels as one row, with where you come in under it.

Fixed

• Security gate records the three unmaintained notices for the zbus 5 notification dependencies by advisory ID, with the upstream migration needed to remove them. Other advisories remain blocking.

Downloads

• Linux, Windows and macOS (Apple silicon *-macos-arm64.dmg and Intel
  *-macos-x86_64.dmg), as in 3.1.1, each with its terminal multiplexer. The
  Mac builds are signed ad hoc and are not notarized: on first open macOS says
  the developer cannot be verified. Open the app once from the right-click
  Open menu, or allow it under System Settings › Privacy & Security ›
  Open Anyway, and macOS remembers the choice. If macOS says the app is
  damaged instead, compare the download with SHA256SUMS-*.txt: download
  it again if it differs, and open an issue if it matches.