GitDesktop v0.6.0

Added

• Terminal settings gained a Custom command… mode — give a full command with a
  {path} placeholder (for example wt -d {path} or tmux new-window -c {path}) for
  multiplexers, wrappers, or any terminal the auto-detection doesn't know. The command
  runs shell-free, and macOS "Custom…" now also launches plain (non-.app) executables
  correctly.
• Explore repositories. A new full-page browser for finding a repo without knowing its
  URL, with GitHub, GitLab, and Bitbucket tabs, a search box, and a sort control
  (best match / most stars / recently updated). Before you type it shows your own
  repositories grouped by owner and a Popular star-sorted feed (GitHub & GitLab);
  typing searches all of GitHub (up to 1,000 results), all public GitLab projects, or your
  Bitbucket workspaces. Open a result for its README preview and Clone it, Fork it
  (all three providers, then clone the fork), Star / Unstar it (GitHub & GitLab), or
  view it on its host. Reachable from the welcome screen and the command palette, and fully
  keyboard-navigable.
• Per-session isolation. Pick Worktree or Container for a single agent session
  from the composer's Options, overriding your Settings → AI default for that one run
  (Best-of-N arms share the pick). Choosing a container checks readiness inline — Docker or
  Podman installed, the engine running, the agent image built — and keeps Send disabled
  until it is, naming what's missing and offering a jump to Settings where that's what it
  takes to fix it.
• Link issues when you open or edit a PR. The Create and Edit PR dialogs now have a
  Linked issues row (GitHub & GitLab, wherever the repo has an issue tracker):
  reference real repo issues that are auto-detected from your branch name and commit
  subjects, proposed for you when you Generate the description (from a grounded
  shortlist of your open issues), or added by hand. Toggle each between Closes
  (auto-closes the issue on merge) and Relates to — they're appended to the
  description as Closes #N / Relates to #N lines, and opening Edit peels any
  trailing ref lines back into chips (keyword preserved) and re-appends them on save, so
  the chips are the single editor for that block. Local PRs get the same row (create
  and edit), and their ref lines survive promotion verbatim to become real closing
  refs on the forge. On a Bitbucket repo with a linked Jira project, the row
  surfaces linked-Jira issues (KEY-123) as mention-only Relates to chips (Jira
  tickets are never closed from PR text).
• Locate a moved repository. Moved a repo on disk? The "no longer a git
  repository" notice now offers Locate… to point GitDesktop at the folder's
  new location — the entry keeps its alias, badges, and settings, and its app data
  (local PRs and issues, review history, automations, and any Jira link) follows the
  repo to its new home — alongside the existing Remove.
• Reviews you run yourself now read the author's Notes for reviewers. Until now only
  automated reviews saw them; the Review and Security audit buttons feed them to the model
  too. A new Ignore author notes toggle in the review panel sets them aside for a run,
  alongside the existing opt-outs for your previous review and external bot findings.
• Queue a second AI review. Run a code review and a security audit on the same
  pull request without waiting: start one while the other is streaming and it
  queues, then runs automatically when the first finishes. A chip shows what's
  up next (with Dismiss to drop it), and cancelling the running review still
  lets the queued one proceed.

Changed

• The MCP stage_files, unstage_files and stash_push tools now read each
  entry as one exact file or directory, so an agent acting on
  src/app/[slug]/page.tsx no longer touches its neighbours alongside it — which
  for stash_push meant sweeping another file's uncommitted work out of the
  working tree. Pass literal: false on the call to use a git pathspec or glob
  such as *.log. The read-side commit_diff and working_diff tools' path
  argument now also matches exactly, as their descriptions always said.
• AI reviews converge in fewer rounds — a fuller first review, then fewer of them.
  A re-review now checks each applied fix's own hunks — and how the fixes interact — in
  the same round, and suggested fixes spell out what else they oblige you to touch, so
  one round's fix stops becoming the next round's finding. A problem repeated across
  files is reported once with every affected location, and everything the reviewer is
  confident about lands in the first review instead of trickling out over several.
• General re-reviews collect late-noticed polish in an explicitly non-blocking
  leftover list instead of letting it hold rounds open, and every re-review — general or
  security audit — wraps up in a line once nothing substantive is left. Decisions
  you recorded in the PR description or Notes for reviewers are respected for every
  kind of finding, and when a large diff crowds out GitDesktop's own earlier comments
  the review is told they were omitted rather than quietly losing the record.
• Agentic AI reviews now get 20 minutes before timing out (up from 10), and a new
  Review timeout setting under Settings → AI lets you raise or pin the limit
  for agent-CLI reviews.
• Re-reviews end with a verdict — every AI re-review, general or security audit, now
  closes with one of two explicit lines: Verdict: blocking issues remain, or
  Verdict: no blocking issues — remaining items are non-blocking; merge when ready.
  A round that resolved everything but noticed one nit used to read as another round;
  now it says which it is.
• Reviews know where your docs live. A general review is given the repository's
  documentation surfaces by path — README, changelog, changelog fragments, docs
  directories — so a user-facing change that leaves any of them stale comes back as one
  finding naming every affected surface, including ones the diff never touched, instead
  of one surface per round. Your custom instructions now reach reviews too — the
  global ones from Settings and a repo's own .gitdesktop/instructions.md — as
  conventions to judge the change against.
• The opening comment now keeps a guaranteed share of the budget, not just its
  place in the queue. Being kept rather than dropped only settles which comments
  make it in; how much of each one survives is decided earlier, and there the opening
  comment was treated as just another block — so on a long thread it was squeezed to
  the same per-comment minimum as a one-line "fixed in <sha>" reply. It is now
  allotted its share before the rest divide up what remains, and the decision-ledger
  distiller reads more of every comment on shorter threads.

Fixed

• AI ignore patterns now follow .gitignore's matching rules. A bare name
  matches at any depth (secrets.env also covers config/secrets.env), a bare
  folder name hides that folder's contents wherever it sits (node_modules), a
  leading / anchors a pattern to the repo root, and * stops at a /, so
  docs/*.log covers docs/a.log but not docs/sub/b.log. Patterns you
  already have may hide more than they did: saved lines carry no anchor —
  including every one Exclude from AI added — so a stored notes.md now hides
  each file of that name rather than only the copy at the root, and a stored
  build or node_modules now hides those folders instead of nothing at all.
  That only ever withholds more from a model, never less, but it's worth a look
  at your lists. Exclude from AI now writes anchored lines
  (/src/config.ts, /vendor/) that mean the one file or folder you picked,
  matching what Ignore writes to .gitignore. ! re-include lines aren't
  supported.
• Files with unusual names survive diff parsing. git escapes a non-ASCII path
  like café.txt when it writes a diff, and GitDesktop skipped those files when
  splitting a combined diff into per-file sections — so such a file showed no
  diff in a pull-request or commit view, and was dropped from the diff sent for
  an AI review or a generated description rather than being weighed against your
  ignore patterns.
• Your AI ignore patterns are now honored by AI reviews — the ones you start
  from the PR panel and the automated ones alike, including the "changes since
  your last review" delta they build on — where the whole diff previously
  reached the provider. The prompt states how many files were held back rather
  than passing the diff off as complete, and if every changed file is excluded,
  nothing is sent at all. As everywhere else, a model that reads your repository
  itself isn't limited by these patterns — that's what Agentic review on a
  pull request turns on.
• An automation review claim left behind by a crashed or outdated app instance no
  longer blocks that pull request's review for other instances — a stale claim is
  reclaimed after 30 minutes instead of waiting for the 30-day sweep. The
  missed-review catch-up now works per review mode, so a failed general review is
  retried even when the security audit already ran.
• Your AI ignore patterns are now honored when generating the description
  for a pull request you're creating (local PRs included, and the MCP
  generate_pr_description tool), when generating a squashed commit's message,
  and when generating a reworded commit's message in Edit history — those paths
  previously sent the whole branch diff to the provider. The prompt states how
  many files were held back rather than passing the diff off as complete.
• Generate from changes now works on a branch whose work is already
  committed. Whenever the working tree can't describe the branch being named —
  it's clean, or you're renaming a branch you aren't on — it names the branch
  from that branch's own committed work instead: the diff and commit subjects
  vs. the default branch. That's exactly the case a rename usually needs.
  Applies in the app and to the MCP generate_branch_name tool and prompt, and
  when the button is disabled it now says why.
• Editing or deleting a commit comment while viewing a fork through the
  parent-repository (upstream) lens now targets the same repository the comment
  was created on, instead of failing against the fork.
• External AI-reviewer findings now fair-share the review-context budget instead of each
  being cut at a small fixed size, a trimmed finding says so explicitly, and the Review
  context size setting now reaches that section of the prompt.
• File actions and views now use exactly the file you picked when its path
  contains [, * or ?. On a dynamic route like src/app/[slug]/page.tsx,
  staging, unstaging, discarding, stashing, ignoring, untracking, force-adding
  and taking one side of a conflict all act on that file alone. Those paths used
  to be handled as match patterns, so a neighbouring file could be swept in
  alongside the one you chose — most seriously, discarding changes could throw
  away another file's uncommitted work, and resolving a conflict could silently
  resolve a second file the same way. Reading is exact too: a file's history, and
  its diff in the working tree, in a commit, in a stash, or against another
  branch, no longer fold in a neighbour's commits and hunks. Ignore and
  Exclude from AI also write a working pattern for a name that ends in a
  space, which previously matched a different file and left the one you picked
  alone.
• Jira estimate fields no longer keep showing the "Enter a Jira duration" warning
  after the value refreshes from the server.
• AI re-reviews now read long GitDesktop-posted PR comments (context briefs, triage
  summaries) in full when the review-context budget has room — previously every such comment
  was silently cut to 1,500 characters no matter how much budget was free, so a reviewer
  could be handed a numbered list that stopped after item 2. A comment that still has to be
  trimmed now says so explicitly in the prompt instead of trailing off in a bare ellipsis.
• Long review threads keep their recorded decisions. When GitDesktop's own comments
  on a pull request substantially outgrow the review-context budget, the AI review now
  reliably distills them into a compact decision ledger — reading the complete comments
  rather than the already-trimmed ones, and giving an agent-CLI generation model the time
  it needs to finish — so refutations and "fixed in <sha>" notes survive a long thread
  instead of being cut away with the text.
• When a PR's own-comments context outgrows its budget, the opening context comment is now
  kept alongside the newest follow-ups instead of being the first thing dropped.
• Merging a repository's old app data — on relocate, or when older path-keyed
  records are folded onto its stable identity — no longer lets duplicate legacy
  records (including records without ids) through.
• Your AI ignore patterns now apply when you regenerate the description of an
  already-open pull request or merge request, not only when you create one.
  Excluded files are dropped from the forge's own diff before it reaches the
  provider, and the prompt states how many were held back rather than passing the
  diff off as complete; if every changed file is excluded, nothing is sent at all.
• The error shown when a history-rewrite operation is blocked by uncommitted
  changes no longer contains garbled characters — the dash renders properly.
• Security audits no longer assume GitDesktop's own tech stack. The audit prompt told the
  model, as fact, that the code in front of it was Rust and React, and applied exemptions
  written for that stack to every repository you audit. Anything reachable through
  environment variables or command-line flags was trusted outright (untrue for a server, a
  container, or a shared CI runner), and missing authorization was waved off in frontend code on
  the assumption that a separate backend was re-checking it. Each of those rules is now judged
  against the code actually under review, and an audit sizes up the change's own language, trust
  boundary, and existing validators first. Prototype pollution is now a named category too.
• More vulnerability classes can actually be reported. The audit's list of risk categories
  read as closed, so a real issue that fit none of its buckets — cross-site request forgery or a
  missing origin check, over-permissive CORS, clickjacking — had nowhere to be filed; the list is
  now explicitly open-ended. Memory-safety problems are also caught in the unsafe corners of
  otherwise-managed languages (Java's sun.misc.Unsafe, Swift's Unsafe*Pointer, a Kotlin/JNI
  boundary), and a value read from a cloned repository's own content and passed to a spawned
  command is no longer treated as trusted just because the tool runs on your machine.
• Sharper severity and confidence on security findings. Critical is now a severity that a
  finding can actually carry — remote code execution, code execution triggered by content you
  merely clone or open, full system compromise, or a mass data breach — where before it was
  referenced by the reporting rules but never defined, so the worst issues had nowhere to go but
  High. Confidence is now calibrated by what the reviewer actually saw, and the flat
  ">80% confident" rule that contradicted the severity-scaled thresholds is gone.
• Updating a single submodule whose path contains [, * or ? now updates
  that submodule. It previously initialized and checked out a different one
  whose path happened to match, and left the one you asked for untouched.