Bandura is at 1.0.0-rc.8. Windows and Linux builds are on the download page, and macOS follows once the builds are signed and notarized. The long-form tour of the current release is What's new; this page is the dated list.
Prefer a feed? bandura.dev/rss.xml carries all 8 entries
in the same order, generated from the same file this page is. Every page on the site
advertises it in its head, so a reader handed any Bandura URL finds the feed without
visiting this one.
Twenty things the editor could not do, most of them about reading a project rather than writing one: moving around it, seeing what a reference points at, and what git thinks you have changed. Nothing about the flow format changes.
This is the build the download page serves. Windows and Linux
today, and macOS follows once the builds are signed and notarized.
Move around a project the way you move around code. Back and forward through the places you have been, an Open Editors list above the file tree, jump to the definition of a routing target, and find a node by name across every flow rather than only the open one. Read Keyboard shortcuts →
The editor explains what it is showing. Hover a node id for its type and label, or a reference for where its value comes from, and see what an environment value resolves to inline beside the reference that reads it. A value whose name looks like a credential reports that it is set rather than printing it. Read Graph & code views →
Source control caught up: change markers in the gutter, a branch switcher, who last changed the line you are on, and undo last commit. Separately, compare the working copy against what is saved, which works on a file that was never committed. Read Share flows with Git →
Search can exclude files as well as include them, recall earlier queries with the up arrow, and carry each match's own capitalisation onto its replacement. Read Command palette & quick open →
Turn every breakpoint off without deleting them, pause only on the Nth time a node runs, and clear the terminal's scrollback. Release notes are in the app now, under Help. Read Run a flow & debug failures →
Correctness and speed, plus two changes to how your stored credentials are protected that are worth reading even if you skip the rest. Nothing about flows, projects or settings changes.
Your stored API keys are no longer readable by other accounts on the machine, and an existing file is tightened the first time this version opens it. On Linux without a system keyring, Bandura now says the keys are only weakly protected instead of implying a keychain is holding them. Read Connect an AI provider →
Repeated HTTPS requests reuse their connection instead of handshaking every time, and subflows, gRPC schemas and streaming predicates stop repeating work they already did. Flows that hit one host many times, or loop over a subflow, finish noticeably sooner. Read Performance: measured, not promised →
The AI assistant no longer sees credentials written into a URL, and saved conversations can no longer be mixed together when chat history is turned off and back on. Read AI chat & ai-action nodes →
AWS SigV4 signs file uploads and binary bodies correctly, and covers the x-amz-* headers DynamoDB and S3 require. Cookies can no longer widen past the host that set them. Read Authentication & cookies →
Installers are about 21 MB smaller on every platform, and Linux builds run on Ubuntu 22.04, Debian 12 and anything newer again. Read the download page →
A hardening release: security fixes, a production build that is compiled rather than shipped in readable form, and a considerably smaller install. Nothing about flows, projects or settings changes.
Security fixes, including tighter handling of the file paths the AI assistant is allowed to reach inside your workspace. Worth taking if you ever point the assistant at a repository you did not write yourself. Read AI chat & ai-action nodes →
Installed builds are compiled and carry no developer tools. If a support session needs them, BANDURA_ENABLE_DEVTOOLS=1 turns them back on for that launch.
The download and the installed app are both markedly smaller, because the package now contains only what the app actually loads. Install time and disk use drop with it.
The AI assistant became a harness rather than a text box: conversations that survive a restart, a context budget that summarizes instead of forgetting, local workspace search, and tools that let it check this build's schema instead of recalling one.
Conversations are saved locally and listed behind a History control, scoped to the folder you have open. Past a token budget the oldest turns are replaced by a summary rather than dropped, and if the summarizing request fails the chat carries on anyway. Read AI chat & ai-action nodes →
The assistant can search your workspace by relevance for questions like 'how do we handle pagination'. It is a local SQLite full-text index, with no embedding service and no extra network request, and credential-shaped text is never indexed. Read AI chat & ai-action nodes →
Fourteen tools, four of which exist so the assistant can check rather than recall: the .aether schema this build actually implements, walked from the parser's own validator, plus flow search, linting and project status. It can also read the run history every run already writes, so you can ask why a run failed an hour ago instead of re-running a flow with side effects. Read AI chat & ai-action nodes →
A script node's code and a lifecycle hook's code can each live in their own file, so one signing hook is the same hook in every flow that points at it and your editor treats it as JavaScript rather than a string inside YAML. Read Node reference →
Lifecycle hooks are editable from the inspector: with no node selected, the flow panel writes before, after and onError inline or points a phase at a file. Previously the only way to add one was to type it into the YAML. Read The node inspector →
The chat had been re-paying for its own prompt on every message, because the open flow was appended to the cached part of the request and every keystroke invalidated it. Assistant replies were also arriving double-spaced, from rendered markdown inheriting the container's pre-wrap. Read AI chat & ai-action nodes →
The app now tells you when a new version is out, Settings became a page that saves on your say-so, and the graph canvas can be driven entirely from the keyboard.
Bandura asks its public releases list once a day whether a newer build exists and says so, with a link to the download page. It installs nothing, it sends no identifier, and one switch turns it off. A Help menu and a palette command run the same check on demand. Read What's new →
Settings is a page with a category rail rather than one long column that wrote to disk on every keystroke. Edits collect in a draft, a footer counts them, and nothing is written until you press Save. Read Settings & appearance →
The graph canvas is keyboard-drivable: arrows move between nodes spatially, Tab walks reading order, Enter opens the inspector. It also gained a minimap, alignment guides with snapping, box selection, and edges labelled with the routing field they write. Read Keyboard shortcuts →
Completions in the .aether editor and in the inspector panels: node ids after a routing field, and variable names inside ${{ }}, read from the buffer so they still work while the file is mid-edit. Read Graph & code views →
Google Gemini as a third AI provider, native rather than through a compatibility shim, on every AI surface: chat, the agent loop, flow generation and ai-action nodes. Read Connect an AI provider →
A structured auth block with OAuth2 and AWS SigV4, an automatic cookie jar, request codegen in six languages, and roughly a hundred usability, accessibility and keyboard fixes.
Authentication is a block in the file rather than an Authorization header you assemble by hand: basic, bearer, API key, OAuth2 (client-credentials and password grants, with the token fetched once per run and refreshed before it expires) and AWS SigV4, which signs the request after any before-hook has finished rewriting it. Read Authentication & cookies →
Cookies are captured and replayed automatically, scoped by domain, path, Secure and expiry, so a log-in-then-use-the-session flow needs no Cookie header at all. An explicit header still wins, and cookies: false opts a single request out. Read Authentication & cookies →
Copy any request as working code in six languages: cURL, JavaScript fetch, Node axios, Python requests, Go and HTTPie. It is generated from the resolved request with variables already substituted, so what you paste is what ran. Read The node inspector →
A JSONPath box under the response body, and a Save response button that writes the body to disk exactly as it came off the wire, to anywhere you can write rather than only inside the workspace. Read The node inspector →
Roughly a hundred usability and accessibility fixes across eight surfaces, several of them silent data loss rather than polish: inspector panels leaked half-typed drafts between nodes, Search's Replace All left the panel looking empty, and comma-separated fields deleted the comma you had just typed. Read What's new →
Keyboard work: Shift+F5 stops a run, F9, F10 and F8 toggle a breakpoint, step and continue, Cmd+Alt+S saves every dirty file, tabs gained a context menu, and the zoom shortcuts work now that the native View menu no longer swallows them. F5 also stops firing while you are typing in a field. Read Keyboard shortcuts →
An Import button in the flow editor toolbar, so pulling in a curl command or a Postman, Insomnia, OpenAPI, Bruno or HAR source is one click from the flow you are looking at. Read Import Postman, Insomnia, OpenAPI & curl →
A second AI provider, preferences in a hand-editable settings.json, topology editing on the graph, and failures that name the node that broke.
AI is no longer Anthropic-only. Every AI surface (chat, the agentic tool loop, flow generation, and ai-action nodes) also speaks to any OpenAI-compatible /chat/completions endpoint. Local runtimes like Ollama and LM Studio need no API key at all. Read Connect an AI provider →
Preferences moved to a real settings.json you can edit by hand: comments allowed, changes applied live by a file watch, an invalid value falling back to its default without rewriting your file. It also carries settings the UI has no control for, including 22 individually overridable colour tokens. Read settings.json →
The graph edits the flow now. Drag between ports to connect nodes, Backspace or Delete to remove one behind a confirm that names what is going, Duplicate in the right-click menu. Read Graph & code views →
A transient parse error no longer blanks the canvas. The last graph that parsed stays on screen, dimmed and marked stale, with topology edits disabled until the YAML is valid again. Read Graph & code views →
Request nodes have a structured Params editor: method, URL, headers, path and query params, capture expressions, timeout, and the retry/poll-until policy. The graphql and sse blocks are still edited as YAML. Read The node inspector →
Import shows what it is about to write before a file is created: the detected format, each flow's name and node count, the environment variables it found, a checkbox per flow, and the destination folder. Read Import Postman, Insomnia, OpenAPI & curl →
A failed run names the failing node and the reason: an assertion's expected-vs-actual, the HTTP status, or the unwrapped transport cause instead of “fetch failed”. Node results also carry how long each node took, and how big the response was. Read Run a flow & debug failures →
The first public build: Windows and Linux installers, macOS held back until the builds were signed and notarized. Its assets are not on the public releases repo, which starts at rc.2; this entry is the record of what shipped.
Windows (.exe) and Linux (.AppImage, .deb) installers published, built from the same release pipeline every later build uses. Read the download page →
The builds are unsigned, so Windows SmartScreen shows a warning the first time: More info → Run anyway. It installs per-user and needs no admin rights. Read the download page →
The CLI is versioned separately
@bandura/cli is published to npm on its own schedule, so
its number rarely matches the desktop build above: the current CLI is
1.0.0-rc.6. A plain npm i -g @bandura/cli installs it, because
latest tracks the newest release rather than the first one. Pin a version in CI if
you want a build that cannot move under you.
1.0.0 is reserved for the launch build, on npm and on the download page alike.
Nothing carries that number yet.
How a new release reaches you
Since 1.0.0-rc.4 the app can tell you a newer build exists: it asks the public
releases list at most once a day and shows a notification. It sends no identifier, and a
single setting turns the automatic half off while leaving the Help menu's manual check
working. Since 1.0.0-rc.7 it can also install that build for you on Windows and
on the Linux AppImage, and only when you ask: automatic downloads ship off. A
.deb and macOS keep the notification and the link to this site, because neither
has an in-place update path. Security and privacy lists
both requests in full, alongside the only other one the app makes on its own behalf.
No entry here is written ahead of its release. One exists only for a release tag that
exists, and its date is that tag's commit date rather than the day the note was typed, so a
quiet month reads as a quiet month instead of being padded out.
Paying for the releases
Commercial use is what funds this: one payment per seat, after thirty
days. Personal, learning and open-source use is free for good and always will be. If you are
in that second group and these releases are worth something to you, there is a
Patreon.
It buys nothing the free build does not already give you. Nothing here ships to supporters first.