Spool 0.6.2

What's new

• feat: scope spool list to current project (#469)

Install

macOS (Apple Silicon)

curl -fsSL https://spool.pro/install.sh | bash

Linux (x86_64)
Download the AppImage from the assets below.

This is an early release — feedback and bug reports welcome via Issues.

Spool 0.6.1

What's new

• fix(release): set a safe packaged executable name (#467)
• fix(release): fall back to Electron version for native ABI (#466)
• feat: add Explore discovery and shared UI (#464)
• fix(app): verify Electron before dev setup (#462)
• feat(web): refocus homepage on sharing sessions (#461)
• feat: establish the public agent Session platform (#460)
• feat: add release-all skill (#458)
• docs(skills): align spool skill with summary flow (#459)
• fix: repair local summary agents and prompt (#457)
• feat: generate share summaries with local agents (#456)
• fix: deploy web through the existing Worker route (#455)
• ci: deploy web directly to Cloudflare Workers (#454)
• chore: migrate monorepo to Vite+ (#453)
• fix: drop [triggers] block from backend Pages config (#452)
• fix: publish session-kit to npm in the release chain (#451)

Install

macOS (Apple Silicon)

curl -fsSL https://spool.pro/install.sh | bash

Linux (x86_64)
Download the AppImage from the assets below.

This is an early release — feedback and bug reports welcome via Issues.

Spool 0.6.0

What's new

• Spool v2 walking skeleton: share → hub → web reader → resume in one flow (#449)
• chore: pause Dependabot version updates (#440)
• docs: distill the optimization roadmap into a historical record (#426)
• Stacked features 7: dependency check + extra debounce search input (#418)
• Stacked features 6: package size (#417)
• Stacked features 5: search optimization (#416)
• Stacked features 4: separate builds and allow test to run standalone (#415)
• Stacked features 3: ts7 migration (#414)
• chore: replace eslint with oxlint (#413)
• Stacked features 1: add typecheck lint (#412)
• chore(share): align prod deploy config with the launch runbook (#424)
• chore(share): make share callback props required now that the flag is gone (#423)
• feat(share): promote Share out of Labs (#422)
• Extend spool projects <query> resolution to match project display paths and session cwd (#411)
• chore(app): declare SPOOL_E2E build constant so bare tsc typechecks (#421)
• feat(security): promote Security Scan out of Labs — always on, flag machinery removed (#420)
• chore(settings): move Account tab to the top, drop duplicate local-data footer (#419)
• fix(share): pre-launch hardening — PDF sandbox, publish size gate, reader performance (#410)
• fix(auth): make sign-in work across proxy configurations, desktop and local dev (#408)
• chore(share): gate the public-profile surface off for launch (#407)
• fix(e2e): widen startup-no-beachball thresholds for macOS CI runners (#409)
• feat: support new Gemini CLI JSONL format and filter metadata (#404)
• fix(terminal): quote the sh -c payload so resume survives spaces in paths (#406)
• feat(terminal): add Ghostty as a terminal choice for session resume (#405)
• feat(share): give revoked shares a way back — Open draft from the row (#401)
• perf(share-editor): merge autosave and drift-check onto one debounce window (#400)
• perf(share-editor): keep the preview responsive on multi-thousand-turn sessions (#399)
• fix(share): harden publish UX, clear token on 401, clarify unlisted visibility (#395)
• fix(share-editor): drop uppercase on draft card relative time (#398)
• fix(share-backend): harden visibility scope, og clamp, slug regex, tombstone shape (#397)
• fix(share-web): correct /me failure states, stale unpublish target, and legal-page header auth (#396)
• fix(share): stop leaking content-derived turn ids in published snapshots (#394)
• chore(share-editor): sentence-case panel section labels (#391)
• chore: vendor the spool-pro-router dispatcher; share-web deploy scripts (#393)
• ci: run share-backend and share-web suites in the unit job (#392)
• fix(markdown): align and style GFM tables across session detail and share surfaces (#390)
• feat(share-web): real Terms and Privacy pages (#389)
• feat(share-web): align /me share rows with the desktop Published tab (#388)
• docs: document the share-publish local dev stack (#387)
• feat(app,share-web)!: remove share expiry from clients (#386)
• feat(share-backend)!: remove share expiry (#385)
• feat(app): list/unlist published shares from the row menu (#384)
• feat(share-backend): PATCH /api/me/shares/:id visibility endpoint (#383)
• test(app): cover publish 429/401 error paths in e2e (#382)
• fix(app): derive renderer CSP origins from SPOOL_SHARE_BACKEND (#380)
• fix(app): localize ShareMenu trigger and tab labels (#379)
• chore(share-web): drop placeholder Terms / Privacy / Learn-more footer (#378)
• fix(share): OG image renders CJK glyphs (#377)
• perf(share): /api/meta/:id sidecar — OG Pages Function no longer pulls full snapshot (#376)
• feat(share): user-customizable display name + avatar upload (#374)
• feat(share-web): /me + /@handle polish — modals, SWR header, row redesign (#375)
• test(app): publish-flow e2e — 5 specs, in-process mock backend, real regression coverage (#373)
• feat(app): i18n share-publish surfaces — wire t() across 7 components + 6 locales (#372)
• fix(share-backend): publish-data hardening — revoke idempotency, turns/hidden_turns caps (#369)
• fix(share): response-header discipline — default no-store + HSTS/XFO (#370)
• fix(app): destructive-action confirm — focus trap + SharesPage Unpublish modal (#371)
• fix(share-backend): auth-boundary hardening — open-redirect, JWKS rotation, nonce race (#368)
• chore: launch checklist + dev script for spool share publish v0.5.0 (#367)
• chore(share-backend): security hardening — CSP, cache-control, audit endpoint, pentest (#366)
• feat(share-web): / profile + /me dashboard + sign-in (#365)
• feat(share-web): reader + tombstone + report; OG meta + CSP + noindex (#364)
• feat(app): Published tab + Settings → Account + cross-device sync (#363)
• feat(app): publish modal — PII gate, visibility, expiry, republish (#362)
• feat(app): electron loopback PKCE OAuth + safeStorage session (#361)
• feat(share-backend): OG image + scheduled deletion worker (#360)
• feat(share-backend): publish, snapshot read, revoke, republish (#359)
• feat(share-backend): handle claim + /api/me/* (require-user, schedule-delete) (#358)
• feat(share-backend): provider-agnostic OAuth + KV sessions (#357)
• feat(share-backend): cloudflare pages project + initial D1 schema (#356)
• fix: resolve CodeQL security-and-quality findings (#354)

Install

macOS (Apple Silicon)

curl -fsSL https://spool.pro/install.sh | bash

Linux (x86_64)
Download the AppImage from the assets below.

This is an early release — feedback and bug reports welcome via Issues.

Spool 0.5.2

What's new

• perf(security): move purge / dismiss / undismiss SQL onto a worker thread (#352)
• fix(security): smooth the scan-end visual transition (#351)
• perf(security): batch scan-worker enqueue burst into one status publish (#350)
• feat(sync): "Refresh from source" — explicit per-session rebuild action (#349)
• feat(sync): switch syncer to append-only so user-side state survives re-sync (#348)
• fix(db): dedupe (session_id, msg_uuid) and add UNIQUE INDEX (schema v14) (#347)
• fix(security): collapse bulk purge into a single transaction (#344) (#346)
• feat(security): add toggle to hide the row-level risk icon (#343)
• fix(app): keep session scrolling responsive (#321)

Install

macOS (Apple Silicon)

curl -fsSL https://spool.pro/install.sh | bash

Linux (x86_64)
Download the AppImage from the assets below.

This is an early release — feedback and bug reports welcome via Issues.

Spool 0.5.1

What's new

• fix(redact): tighten internal-host and credit-card false positives (#341)
• docs(readme): refresh for v0.5.0 + repo rename + OpenCode + Linux (#339)

Install

macOS (Apple Silicon)

curl -fsSL https://spool.pro/install.sh | bash

Linux (x86_64)
Download the AppImage from the assets below.

This is an early release — feedback and bug reports welcome via Issues.

Spool 0.5.0

Spool v0.5.0 — Security Scan

This release introduces Security Scan, an always-on local scanner that surfaces credentials, API keys, and PII that have leaked into your coding-agent sessions. Everything runs on-device — Spool never sends your session data anywhere.

What's new

Security Scan (default on)

• 30+ secret patterns — vendor API keys (OpenAI, Anthropic, Stripe, AWS, GitHub, Slack, ...), private keys, kubeconfig tokens, connection strings, env-var leaks, basic-auth, bearer tokens, JWTs, cloud credential blobs.
• Optional ML-powered PII detection — Privacy Filter, opt-in under Settings → Security → Experimental. A local ONNX model catches structured PII the regex layer misses, class-mapping tuned for precision over recall.
• Cross-session blast radius — see every place a leaked value occurs across your archive, not just the one session you're looking at.
• One-click rotate-at-source — Stripe, OpenAI, Anthropic, AWS, GitHub, Slack and more: deep-link straight to the rotation surface in the provider's dashboard.
• Purge everywhere — destructively rewrite a leaked value out of every message that contains it, with a preserved audit row.
• Allowlist review surface — per-kind and per-value, with bulk dismiss / undismiss.

Other improvements

• OpenCode session indexing — sessions captured by OpenCode CLI are now indexed alongside Claude Code, codex, and gemini.
• CLI — new spool projects, spool pin, spool unpin, spool pinned commands.
• OpenTelemetry instrumentation — pretty traces in dev, JSONL exporter in prod.
• Settings modal — larger surface; stacked sub-modals scrim correctly.
• Native menu — adapted properly on non-macOS platforms.
• npm packages — @spool-lab/redact, @spool-lab/core, @spool-lab/cli auto-publish on every release.

Behavior on upgrade from v0.4.x

When the auto-updater applies v0.5.0:

1. ~/.spool/agents.json gets "securityEnabled": true seeded automatically. Opt out any time at Settings → Labs → Security Scan.
2. A background backfill rescans every previously-indexed session with the new detector profile (regex@1 → regex@2). Worker runs in a separate thread; foreground UI stays responsive.
3. No database schema change — user_version stays at 13. The upgrade is non-destructive: downgrading back to v0.4.x is safe.

Privacy

All scanning is local. Nothing about your sessions, findings, or values leaves your device. The optional Privacy Filter ML model runs entirely on-device in a hidden inference window via onnxruntime-node.

Install

macOS (Apple Silicon)

Download Spool-0.5.0-arm64.dmg from the assets below, drag to /Applications.

Linux (x86_64)

Download the AppImage from the assets below.

Reporting issues

This is an early release. Please report false positives, missed leaks, or any unexpected behavior via Issues. The CJK env-var false-positive someone reported on day one (#334) is exactly the kind of feedback that improves the detector.

Spool 0.4.20

What's new

• Eliminated white flash when resizing windows in dark mode (#275)
• Excluded Claude Code subagent JSONL files from the session indexer so subagent runs no longer show up as duplicate top-level sessions (#274)

Internal

• Isolated dev database to ~/.spool-dev/ so pnpm dev no longer touches your real ~/.spool/ (#255)
• Parallelized Playwright + split unit test matrix in CI (#272)
• Removed an unused share-editor toggle (#254)

Install

macOS (Apple Silicon)

curl -fsSL https://spool.pro/install.sh | bash

Linux (x86_64)
Download the AppImage from the assets below.

This is an early release — feedback and bug reports welcome via Issues.

Spool 0.4.19

What's new

• feat(app): browse all sessions in scope inside the picker (#253)
• refactor(app): unify cmdk + share picker on shared CommandPalette shell (#252)
• feat(app): filter share new-draft picker by project (#251)
• fix(app): sync sidebar fold motion across topbar bg, rail, and chrome (#250)
• fix(app): include cd prefix in Copy Resume Command everywhere (#249)
• feat(app): add Settings → Labs for early-access feature flags (#247)
• refactor(app): route share-editor shortcuts through useHotkeys (#246)
• fix(app/i18n): align zh-CN sidebar pinned label with the rest of the UI (#245)
• feat(app): add Shortcuts tab to Settings (#244)
• fix(app): expand draggable top-bar region beyond the toggle gutter (#243)

Install

macOS (Apple Silicon)

curl -fsSL https://spool.pro/install.sh | bash

Linux (x86_64)
Download the AppImage from the assets below.

This is an early release — feedback and bug reports welcome via Issues.

Spool 0.4.18

What's new

• perf(app): kill the cold-launch beachball + guards against its return (#242)
• chore(app): remove the obsolete Spool Daemon migration notice (#241)
• fix(app): no flash of English on first paint for non-English UI (#240)

Install

macOS (Apple Silicon)

curl -fsSL https://spool.pro/install.sh | bash

Linux (x86_64)
Download the AppImage from the assets below.

This is an early release — feedback and bug reports welcome via Issues.

Spool 0.4.17

What's new

• fix(core): detect agent CLIs installed via mise / interactive-rc version managers (#239)
• fix(app): keep sidebar pinned section sticky while scrolling projects (#238)
• docs: refresh README hero image (#236)
• docs: refresh README hero image

Install

macOS (Apple Silicon)

curl -fsSL https://spool.pro/install.sh | bash

Linux (x86_64)
Download the AppImage from the assets below.

This is an early release — feedback and bug reports welcome via Issues.