Changelog

Added

• Recovery capsules. A capsule captures six domains before a risky operation runs: refs, index, staged changes, working changes, untracked files, and operation state. Restore any single domain or all of them. If the capsule cannot be written, the operation is blocked and never runs.
• Operation model. Every mutation is a transaction carrying an intent, a risk level, its preconditions, the exact commands it will execute, a checkpoint, a rehearsal pass, and a rollback plan. Dangerous actions open the Operation Preview drawer rather than a confirmation dialog.
• Operation Journal. Every mutating operation is recorded with its plan, its commands, its checkpoint, and its outcome. recover_incomplete reconciles unfinished transactions to requires-intervention on the first launch after a crash.
• Flight Recorder. A timeline of what happened to a repository (refs created, deleted and moved, HEAD moves and retargets, index and stash changes, worktree registrations, and operation markers appearing and clearing) including the ones GitAegis did not cause. Events that captured a state hash can be rolled back to. Content edits inside the working tree are visible in status and do not produce timeline events.
• Lost Work. Finds commits nothing points at any more, scanning the HEAD reflog, the stash reflog, Flight Recorder “before” oids, refs/aegis/ recovery refs, capsule bundles, sibling worktree HEADs, and a bounded git fsck --unreachable --dangling. Offers to put a branch back on what it finds.
• Safe Mode. When the index or HEAD cannot be trusted, mutating controls lock out instead of letting you make it worse. Safe Mode additionally pins core.hooksPath=/dev/null.
• Doctor. Scans for real damage, shows the evidence behind each finding, and proposes repairs that take a capsule first. Eight repair recipes ship: index rebuild, stale-lock quarantine, interrupted merge recovery, interrupted rebase recovery, deleted-branch recovery, detached-HEAD preservation, moved-worktree repair, and invalid-upstream repair.
• Everyday Git. Repository catalogue and discovery across a folder tree; status with staged, unstaged, untracked and conflicts; hunk- and line-level staging; commit with amend safety and signing pass-through; branches, tags, remotes, refs, reflog, file history, blame; fetch, pull, push, force-push-with-lease, publish, prune; merge, rebase, cherry-pick, revert, reset, restore, clean; conflict detection with stage-1/2/3 read, resolution, and sequencer continue / skip / abort; worktrees; stashes; submodules; Git LFS status, missing-object accounting, read-only locks and fetch; commit graph, compare, search and bisect; clone with streamed cancellable progress; init with optional README, .gitignore and licence.
• Five modes. Home ⌘1, Work ⌘2, History ⌘3, Review ⌘4, Doctor ⌘5.
• Command palette. ⌘K over real intents rather than a fuzzy list of menu labels.
• Semantic Composer. Proposes commit groupings from your working changes and applies them through the operation orchestrator, so a grouping is planned, checkpointed and reversible like anything else.
• Accessibility and display. UI scale 80–200%, light, dark and system themes, and full keyboard navigation.
• Support bundles. Generated locally, scanned for secrets, and path-redactable before you send them.
• Platform. macOS 12 Monterey and later, as a signed universal binary for Apple Silicon and Intel.

Security

• Git subprocesses pin GIT_CONFIG_* and GIT_TERMINAL_PROMPT=0, so a hostile core.fsmonitor or core.pager in a cloned .git/config cannot execute and Git can never block on a hidden credential prompt. Safe Mode additionally pins core.hooksPath=/dev/null.
• External diff and merge tools are never launched, in any mode.
• Credentials are read from the system keychain, and SSH uses your own keys through your own agent. GitAegis stores neither.
• Local Git work never requires an account. If you choose to sign in, GitAegis contacts only its configured account gateway for the account features you choose.
• Support bundles are scanned for secrets before they are written.

Known limits in this version

• Rebase state is not restored from a capsule. It is recorded, not replayed.
• Configuration is not restored from a capsule; it is captured as evidence only.
• .gitattributes content filters cannot be wholesale disabled.
• Bisect and a conflicted stash apply have no generic resume.
• git gc, git prune and git reflog expire are not implemented, and will not be.
• Staged and working changes are captured as binary patches rather than as loose objects. On a repository damaged badly enough that the patch cannot be computed, those two domains are present but empty, and the capsule manifest records it.
• Optional account sign-in is available. Billing, team workspaces, provider integrations and AI assist are not available in this build.
• There is no updater. The application does not check for new versions and cannot install one.

Requires

Git 2.38.0 or newer, already installed. GitAegis does not bundle Git and never downloads one. On macOS 12, Apple's Command Line Tools ship Git 2.37.1 (below the floor) so install with brew install git.