# What's new (/docs/whats-new)

These are the notes Echolot shows in **Help › What's New in Echolot**, newest first. Every release and its downloads are also on the [releases page](https://github.com/staticdreams/echolot-public/releases).

## 0.8.0 [#080]

*November 4, 2026 · build 12*

**New**

- Echolot now speaks French, German, Spanish, Japanese, Korean, Russian and Simplified Chinese. It follows the system
  language, or pick one in Settings › General › Language.
- A guided tour on first launch, to replay from Help › Show the Tour.
- The Assistant panel resizes: drag its edge (double-click restores the default).
- Mocks answer spec operations that have no example with fresh fake data that fits each field.

**Improvements**

- Echo, the status screen in the page header, is on by default.
- In the Assistant's approval sheet, Allow for This Session now covers every change to the workspace at once; deleting
  still asks.
- The welcome window gets a sonar ping behind the app icon.

**Fixes**

- The request editor no longer draws over the response.
- Home fits a narrow window, so a wide Assistant no longer pushes it over the sidebar.
- Echo's greeting is no longer squeezed, and the Assistant's title stays on one line in every language.
- Removing a test with its minus button no longer crashes Echolot, and neither does removing an MQTT subscription or
  message, a WebSocket message or a Socket.IO emit. Thanks to Amit for reporting it.
- The minus button in the Flows list deletes the selected flow; it used to take clicks only on its thin line.

## 0.7.1 [#071]

*November 3, 2026 · build 11*

**New**

- Home's Sonar card plots every send of the last hour, 24 hours, 7 or 30 days by response time, with sends, answered
  OK, median and p95 against the period before.
- Marine, a second dark appearance in deep-water blues (Settings › General › Appearance).
- Workspace auth from any request: the Auth tab opens the folder or workspace auth a request inherits (Workspace Auth…
  for one with its own), and folder and workspace settings sign in with OAuth 2.0 once for every request that inherits.
- More auth: OAuth 1.0, OAuth 2.0's password grant and Advanced settings, and Postman's ASAP auth imported as JWT
  Bearer.
- Agents and the Assistant can give requests auth and captures (credentials only as `{{variables}}`), set a folder's
  auth, and try a flow once after you approve it; Settings › Assistant › Ask before can limit questions to deleting,
  new hosts and protected environments.
- Requests whose last call failed show a warning sign in the requests list, with what went wrong.

**Improvements**

- The Assistant's replies render as Markdown and stay smooth while they stream.
- Flow cards show what they do, conditions are edited as rules, and an Evaluate block's last expression is its result.
- Settings › Storage shows how much room response bodies take, and Remove Stored Bodies… frees it.
- On smaller screens the Assistant and pinned variables no longer push the window past the screen: the variables float
  instead.

**Fixes**

- Security fixes from two audits: OAuth tokens are kept per environment and settings and never go to another host;
  agents can't write credentials into files or send secrets to new hosts without asking; stopped mock, MCP and webhook
  servers close every connection.
- Fixed a crash on very large numbers in values, HTTPS proxies failing with HTTP/2 servers, text ending in `"""`
  changing when saved, and moves or renames wiping open tabs' undo.
- With encryption at rest on, history no longer keeps request bodies in plain text.
- Workspace and folder settings follow your appearance, Marine included, and keep one size when you switch tabs.
- The gRPC call bar fits its pane: long proto, service and method names are cut short instead of running into the
  response.

## 0.6.0 [#060]

*November 2, 2026 · build 9*

**New**

- Mocks no longer need a spec: make routes by hand (method, path with `{id}`, status, headers, body and rules on the
  request), with fake data in their bodies: `{{$randomFullName}}`, `{{request.params.id}}`, `{{#repeat
  10}}`…`{{/repeat}}`. Create Requests turns a mock's routes into requests.
- The same fake values work in requests, and echolot fake writes fake data from a template on the command line.
- Select several requests in the sidebar to put them in a new folder (New Folder with N Items) or change their
  headers, query parameters and auth at once (Edit N Requests…).
- Echo, an optional status screen in the page header (Settings › General › Echo), tells what happens in the window,
  and a click unrolls a report of the session.
- Help › Echolot Documentation (⌘?) opens the new documentation at docs.echolot.dev, and Help › Help for This Page the
  page about what you're looking at.

**Improvements**

- Echolot asks once per model provider before sending anything to it; Settings › Assistant lists what you've allowed,
  with Revoke. Apple's on-device model and servers on your Mac never ask.
- After an update nothing opens by itself: a What's New button in the page header shows the new notes.
- The command palette offers only what makes sense on the page showing.
- JSON responses show \u escapes as the characters they stand for.
- The sidebar's highlight glides from row to row, and the module switcher springs to the module you pick.

**Fixes**

- Add Rule and Add Header keep the row they add and put the cursor in it.
- The window's traffic lights no longer sit cut off when another window comes to the front.

## 0.5.0 [#050]

*October 31, 2026 · build 7*

**Improvements**

- Protected environments ask before more things: MCP calls, checks and watches, Get Token, schema fetches, gRPC
  reflection and messages sent on an open session after you switch environments.
- A proxy password or certificate passphrase kept as plain text now carries a warning, with Move to Keychain beside
  it; clearing one request's history asks first.
- Typing `{{` offers the request's variables again in the URL bar, and the variables a folder's or workspace's auth
  resolves with in their settings.
- The JSON tree opens large responses sooner, and the flow canvas pans more smoothly.

**Fixes**

- Secrets stay put: API key headers and headers holding a secret no longer follow a redirect to another origin,
  history no longer keeps Hawk, EdgeGrid, NTLM, proxy or certificate secrets, and with encrypted storage a response's
  text stays out of the search index.
- Agents read history with credentials masked, and a search match that touches a secret is neither counted nor shown;
  an agent's limits also hold inside the flows it runs.
- NTLM sign-in works over HTTP/1.1 without another request borrowing its connection, and a server that insists on
  HTTP/1.1 gets it. HTTP/3 tries every address of a host at once, as TCP does.
- Responses that expand absurdly (past 100 to 1 beyond 256 MB), and WebSocket and Socket.IO messages built from huge
  fragments, are cut off instead of filling memory.
- Export never writes over, into or around the workspace it comes from, sends what it replaces to the Trash, and says
  how many credentials were written in clear.
- Edits are no longer lost: folder and workspace settings, mock routes and a tab closing just before you quit are all
  written, and a failed save keeps your text.
- Closing a window stops its runs and sends. Runs with iterations side by side keep their own $response values, and
  data files of up to 100 MB load without freezing the window.
- A flow whose request script fails now takes the failure path, and background services follow a choice of no
  environment.

## 0.4.0 [#040]

*October 30, 2026 · build 6*

**New**

- Export a folder or the whole workspace (**File › Export Workspace…**, <kbd>⇧</kbd><kbd>⌘</kbd><kbd>E</kbd>, or
  **Export Folder…** on a folder) as an Echolot workspace, a Postman v2.1 collection, an Insomnia v5 file or a Bruno
  collection; each format shows which requests it carries, and secret values stay in the Keychain.
- `echolot export` writes the same formats from the command line.
- **Help › Report a Bug** and **Request a Feature** open a new GitHub issue with your Echolot and macOS versions filled
  in.

**Improvements**

- Switching between requests is faster, and the page no longer shifts as it settles.

**Fixes**

- Dragging in the sidebar puts requests into folders again; a gap opens where they will land, and resting on a closed
  folder opens it.

## 0.3.1 [#031]

*October 30, 2026 · build 4*

**New**

- Each kind of request keeps its own layout (side by side or stacked) and where you left the divider, saved on this
  Mac; **View › Panes › Reset Pane Sizes** starts over.
- <kbd>⌘</kbd><kbd>P</kbd> switches to a recent workspace from a floating list, like the command palette.
- **File › Open Recent** lists your recent workspaces.

**Improvements**

- **Echolot › About Echolot**, **Help › Echolot Website** and **Settings › About** link to echolot.dev.

**Fixes**

- **Open Workspace…** can choose `.echolot` workspaces again; they were greyed out.

## 0.3.0 [#030]

*October 30, 2026 · build 3*

**New**

- Socket.IO and MQTT requests: namespaces, events and acknowledgements; MQTT 3.1.1 and 5.0 with QoS 0–2, over TCP,
  TLS or WebSocket.
- HTTP/3 on macOS 27: pick it per request, or let Automatic switch when a server offers it.
- Install the `echolot` command-line tool on your PATH from **Settings › General**.
- This is a public beta: each build expires 30 days after release, and Echolot updates itself before then.

**Improvements**

- Protected environments ask before every send, run and connection you start, not only before agents'.
- Imported credentials go to the Keychain instead of the request files, and the import report names them.

## 0.2.0 [#020]

*October 28, 2026 · build 2*

**New**

- Send HTTP/1.1, HTTP/2, GraphQL, WebSocket, Server-Sent Events and gRPC requests, and see exactly what went over the
  wire: raw bytes, every redirect hop and a full timing breakdown.
- Workspaces are folders of readable TOML files you can keep in Git; secrets stay in the Keychain.
- Import from Postman, Insomnia, Bruno, Paw, OpenAPI, HAR and cURL, check responses with tests, and run whole folders
  in the Runner or with the `echolot` command-line tool.
- Design OpenAPI specs, serve them as local mocks, and chain requests into flows on a canvas.
- Inspect and call MCP servers, and let AI agents work in your workspace through Echolot's own MCP server.
- The Assistant, built in: it sends, tests and fixes requests with your own model keys, and asks before it changes
  anything.
- Echolot updates itself (**Echolot › Check for Updates…**), and **Help › What's New in Echolot** shows what changed.