1.0.0-rc.8 adds twenty things the editor could not do, most of them about READING a project rather than writing one: moving around it, seeing what a reference points at, and what git thinks you have changed. Nothing about the flow format changes, so a flow written on any earlier build runs unchanged.
For the dated list of every build instead (one entry per release, oldest still listed), see the changelog, which is also available by RSS.
Everything down to the horizontal rule is new in 1.0.0-rc.8. Below it is rc.7, the release before it.
Moving around a project
Back and forward walk the places you have been, on Alt and the arrow keys, which is what you
want after following a subflow reference or a search hit. An Open Editors list sits above the
file tree: the tab strip scrolls once a few files are open, and this is the whole set, with each
file’s folder beside its name, which is what tells two flows called create.aether apart.
Go to node in any flow finds a node by name across the workspace. The existing node navigator searches the flow you have open; this one is for when you remember the name and not the file.
Reading what a reference points at
Press F12 on a routing target and the editor jumps to that node. Hover a node id for its type and
label, or hover a ${{ }} reference to see where the value comes from.
A resolved env. value now appears inline, greyed, beside the reference that reads it. A value
whose name looks like a credential is not printed: the hint says the name is set instead. That is
deliberate, and it errs toward hiding, because an inlay hint is on screen in every screenshot and
every shared window.
What git thinks you changed
Change markers in the editor gutter show which lines you have touched since the last stage. The status bar names who last changed the line the caret is on. A branch switcher replaces reading the branch name off the strip and reaching for a terminal, and the last commit can be undone without leaving the app.
Separately, and not a git feature at all: compare the working copy with what is saved. The dirty dot said a file had changed and nothing said how. This works on a file that was never committed and in a folder that is not a repository.
Search, debugging and the terminal
Search can now exclude files by suffix as well as include them, which is how you say “every flow except the generated ones”. The up arrow recalls earlier queries. Replace can carry each match’s own capitalisation onto its replacement.
Every breakpoint can be turned off without deleting them, and a breakpoint can pause only on the Nth time its node runs. The terminal can clear its scrollback.
Release notes are in the app, under Help. They come from the same check that already looks for updates, so nothing new is sent anywhere.
Two settings, both off by default
Column selection makes Alt-drag select a rectangle, so a column of values can be edited in
one gesture. Format on paste re-indents pasted text. The second is off for a reason particular
to this format rather than caution: a pasted code: | block is JavaScript whose indentation is
content, and re-indenting it would change what the flow runs.
Fixed
The status bar’s line and column, indentation and line ending readouts now appear. All three had been in the strip for some time without ever rendering.
Your stored keys, and how honest we are about them
Two changes, and they are the reason to take this release rather than skip it.
The file holding your API keys was created readable by every account on the machine. It is owner-only now, and an existing file is tightened the first time this version opens it, so the fix reaches installs that already exist rather than only new ones.
The second is a correction to something Bandura used to claim. On Linux with no system keyring installed, the operating system reports encryption as available while actually encrypting with a key that is published in Chromium’s own source. Bandura took that at face value and told you your keys were in the OS keychain. It now detects that configuration and records a warning instead. It still stores the key, because refusing would break every machine without gnome-keyring or kwallet, but it no longer implies a protection that is not there. If that describes your machine, installing a keyring is the fix. See connecting your AI key.
Flows that repeat work now finish sooner
Every HTTPS request used to open its own connection and pay for a fresh TLS handshake. Connections are now reused per distinct TLS configuration, so a flow hitting one host a hundred times performs one handshake rather than a hundred: 113 ms to 15 ms in a local measurement. A request that turns certificate checking off can never share a connection with one that leaves it on.
Three other repeated costs went with it. A subflow inside a loop re-read, re-parsed and re-validated
its file on every iteration; a .proto was re-linked on every gRPC call; and every Server-Sent Event
and WebSocket frame built a fresh JavaScript sandbox to evaluate one condition. Two thousand SSE
frames went from 358 ms to 74 ms.
Installers are also about 21 MB smaller on every platform, having stopped carrying the C source code and build files of a compiled dependency.
Correctness
The fixes worth naming, because each produced a wrong result rather than an error:
- AWS SigV4 signed a description of the body rather than the body itself when that body was a
multipart upload or raw binary, so AWS rejected the request. Signing now also covers the
x-amz-*headers that DynamoDB and S3 require. See authentication. - Cookies could widen past the host that set them, and a malformed
Max-Age=deleted the cookie the response was setting. - Saved AI conversations could be mixed together: turning chat history off and back on could attach new messages to an unrelated saved conversation, which then went to your provider as that conversation’s history.
- The AI assistant was shown credentials written into a URL, from live runs and replayed history alike.
- Updates offered the version you had downloaded earlier rather than the newer one you had just been offered, so Restart installed the older build.
- Linux builds run on Ubuntu 22.04, Debian 12 and anything newer again.
A hardening release
rc.6 changes nothing about flows, projects or settings. It is security fixes and a tighter production build, and it is worth taking rather than skipping.
The security half is chiefly about the file paths the AI assistant may reach. Paths are now checked
after symbolic links have been resolved rather than before, so a path that merely looks like it sits
inside the folder you have open cannot end up pointing somewhere else. That matters most if you
point the assistant at a repository you did not write yourself, a clone being the ordinary case. The
YAML parser also picked up an upstream fix, which covers the app and the CI runner alike, since both
read .aether files from repositories.
Installed builds are now compiled rather than shipped in readable form, and they carry no developer
tools. If a support conversation ever needs them, launching with BANDURA_ENABLE_DEVTOOLS=1 turns
them back on for that run. Development builds are unaffected.
The last part you will notice without being told: the download and the installed app are both markedly smaller, because the package now contains only what the app actually loads. Install time and disk use come down with it.
Older releases are on the changelog.