Ordered by conviction, not by date
Roadmap
What ships today is the macOS desktop application and the recovery layer inside it: capsules, the operation model, the Operation Journal, Flight Recorder, Lost Work, Safe Mode, Doctor, and the everyday Git toolkit.
Everything on this page is work beyond that. It is ordered by how sure we are, not by when it lands, and it carries no dates at all.
No dates on this page. Items move columns when they get close, and land in the changelog on the day they ship.
Now · Next · Later
Three columns, a fixed set of themes, and no percentages. A card moves right to left as the work becomes certain; nothing on it moves because a quarter ended.
Now
3In build.
Recovery
Capsule search
Search across every capsule you hold: by path, by branch, by the content of a staged hunk, by the commit message that was about to be written. Capsules are browsable by operation and by time today. When you know you had a file and cannot remember which operation ate it, browsing is the wrong tool.
Recovery
Capsule retention policies per repository
Per-repository rules, so you can keep everything on the monorepo and a fortnight on scratch clones, with the behaviour that governs every retention rule in this product: marked expired, never deleted without asking.
Recovery
Custom repair recipes
Doctor's repairs are ours, and there are eight of them. A recipe file lets a team define its own: a precondition, the evidence to gather, the commands to run, and the capsule domains to capture first.
Next
6Designed, not yet in build.
Platform
CLI companion
gitaegis on your PATH, wrapping the same operation orchestrator the app uses: take a capsule, list capsules, restore a domain, run Doctor, and print the Operation Journal, from a terminal or a CI job. There is no CLI today, and the orchestrator has a single front end. This is a second front end onto it, not a second implementation of the recovery layer.
Platform
VS Code and JetBrains bridge
A thin extension that talks to the running desktop core over the local client contract: show the current capsule state, open the Operation Preview drawer for a mutating action started in the editor, and jump into Flight Recorder from a file. Not a port of the interface into the editor: a bridge to the app that is already running.
Integrations
GitHub and GitLab in the client
Account and host binding, pull and merge requests, build status, reviews and comments, read and write. The desktop build ships with no provider layer enabled at all, so this is the whole surface rather than an extension of one.
Cloud
Cloud capsule backup
Capsules encrypted on the device before upload, enabled per repository, and restorable onto a replacement machine. The local edition stays complete on its own and never depends on it.
Teams
Shared workspaces and Change Sets
Work grouped larger than a commit, with approvals, roles, and branch leases so two automated sessions cannot claim the same branch.
Access
Self-hosted control plane
Run the account, workspace, policy, audit and capsule storage services inside your own network, against your own object store and database, with the desktop app pointed at your host.
Later
8Committed direction, not yet designed.
Platform
Windows and Linux
GitAegis is built for macOS and ships as a signed universal binary. Windows and Linux are a port rather than a packaging exercise: Git discovery, the filesystem watcher and the credential store are each platform-specific in the current build, and none of that work has started.
Integrations
Bitbucket and Azure DevOps
Repositories, pull requests and pipeline status through the Bitbucket Cloud and Azure DevOps REST APIs, including on-premises Azure DevOps Server and Bitbucket Data Center.
Integrations
Gerrit and self-hosted Git servers
Change-based review workflows differ enough from pull requests that they need their own model rather than a shim over the GitHub one.
Cloud
Capsule storage on your own object store
Point capsule backup at a bucket you control, with client-side encryption unchanged and GitAegis holding metadata only.
Access
Regional data residency
Storage and processing regions for capsule backup and audit, selected per organisation at provisioning time. Ask sales@gitaegis.com about a region you need: a named customer moves a region up this list faster than anything else on this page.
Teams
Team analytics
Not developer productivity scoring. Recovery-shaped questions a lead actually has: which repositories generate the most blocked operations, where Safe Mode engages most often, which policies are overridden and with what evidence. Aggregated at the workspace, exportable, and readable by the people it describes.
Access
Additional interface languages
GitAegis ships in English. Translation is not a string dump: risk levels, operation names and the recovery boundary all have to survive it, and Git identifiers must never be translated. First languages follow demand: tell us yours.
Platform
Deeper LFS support
GitAegis reads LFS status, accounts for missing objects, reads locks and fetches. Taking and releasing locks, and pruning LFS objects without ever reaching for a destructive Git operation, is a larger piece of work than it looks.
What is not on this roadmap, and will not be
Not “not yet”. These five are decisions the product is built around, and a future release does not quietly reverse one.
Permanent exclusions
- git gc, git prune, and git reflog expire. They are not unimplemented pending demand. They destroy recoverable work, they are the exact operations that make the rest of this product necessary, and they will not be added.
- A guaranteed-recovery claim. No item on this page changes the boundary, and nothing above turns it into “everything, always”.
- A demonstration or fixture-data mode. If the desktop core is unavailable, the interface says so and stops. That is enforced in the release gate, not in the design review, and it stays that way.
- Running external diff and merge tools. GitAegis does not launch them in any mode. An escape hatch would quietly break the guarantee that every command it runs is one it showed you first.
- Dates. This page carries none, deliberately. A roadmap with dates on it is a forecast dressed as a commitment. Items move columns as they get closer, and the changelog records what actually shipped.
What GitAegis can put back
- If a recovery capsule was taken, you can roll the operation back.
- If a Flight Recorder event captured a state hash, you can roll back to that state.
- If any reflog entry, ref, branch, stash, or capsule references a commit, Lost Work can recover it.
- Outside those, it cannot, and GitAegis says so instead of pretending otherwise.
No item on the board above changes these four lines. If one ever would, it would be announced as a change to the boundary, not shipped inside a feature.
How to request something
Five steps, and the fourth one is the part most roadmap pages leave out.
Check the changelog first.
Some of what people ask for has already shipped. Read the changelog.Send it to us.
support@gitaegis.com, with the subject lineRoadmap:followed by the thing you want.Tell us the problem, not the feature.
“Add a button for X” is hard to prioritise. “I lost work in this specific way, and here is what I had to do to get it back” is not. The most useful request we get is a description of an operation that went wrong.What happens next.
Every request gets read. Requests that recur, and requests that describe a recovery failure, move fastest. We do not promise a reply to every message, and we will not tell you a feature is “on the roadmap” when it is not. If it is not on this page, it is not scheduled.If you need something on a date.
That is a commercial conversation rather than a support one: sales@gitaegis.com. An agreement can carry a delivery commitment. Nothing else on this page does.
Security issues do not go here.
Report them to security@gitaegis.com. A vulnerability is not a feature request and does not wait in a queue behind one.
Free edition · No account required
A recovery capsule before every risky Git operation.
You see the exact commands before they run, and the operation is refused if the capsule cannot be written.
Requires Git 2.38.0 or newer, already installed.
Every risky operation, in this order
- Previewthe exact commands, shown before anything runs
- Capsulerefs, index, staged and working changes, untracked files, operation state: written to disk first
- Executethe commands as shown, or not at all
- Journalplan, commands, capsule id, outcome