Burrow
English
1.4k Download for MacDownload

Changelog

Every version at a glance, what it added, changed, and fixed. Full notes for each live on GitHub.

26 releases · latest 0.14.0 · GitHub releases ↗

0.14.0latest

Aug 11, 2026 full notes ↗

The Touch ID helper now offers itself instead of hiding in Settings, and the reviewed clean says what it removed instead of finishing silently.

added
  • Burrow offers the privileged helper. The Touch ID helper shipped in 0.13.0 behind a single button in Settings ▸ Advanced, and nothing pointed anyone at it — upgraders learned about it from the release notes, fresh installs not at all. It is now offered from an ambient banner, at most one notice at a time, and the dismissal persists. (#379)
fixed
  • The reviewed clean reports what it removed. It deleted exactly what was ticked and then looked like it had done nothing — that path deletes each reviewed path with find, which succeeds silently, leaving the result screen with no output to show. It now reports what it was authorized to remove, which the run only claims after confirming every planned path is gone. (#380)

0.13.0

Aug 11, 2026 full notes ↗

Headings that rendered as empty boxes render as text again, the MCP server speaks the 2026-07-28 spec without dropping older clients, and the cache scan tells you when it has finished.

added
  • The scan tells you when it's done. A cache scan can run for minutes and used to end by just sitting there with a number. It now posts a completion notification saying what it found, honouring Settings ▸ Notify when long operations finish. (#377)
  • Two more agent tools. burrow_anomalies and burrow_agent_audit join the MCP surface. (#369)
changed
  • MCP now speaks the 2026-07-28 revision, including its task and cancellation semantics. Older clients are unaffected: 2025-11-25 through 2024-11-05 are still served, and a client that skips initialize entirely still works. (#369)
fixed
  • Headings rendered as empty boxes. Burrow now ships real static faces for every weight it uses instead of deriving them from a variable font at render time. (#372)
  • One bad exit no longer disables the menu bar until macOS updates. (#365)
  • The window can be made smaller again — its minimum height is derived from the sidebar rather than hardcoded. (#364)
  • “Stop after current” now responds. The stop was always queued, but nothing on screen said so until the in-flight update finished. (#377)
  • The clean review no longer promises what closing an app can't deliver. An entry the scan refused was counted in “Close X to clean another N” even though no app was holding it. (#367)
  • A cancelled app update no longer blocks later update checks for the rest of the session. (#367)
  • Root operations can't interleave their output. stdout and stderr shared one line buffer, which could splice half a line from one stream onto the other. (#367)
  • Update archives are size-capped before they're kept or expanded, and diagnostics reject more credential shapes before anything is uploaded. (#367)

0.12.0

Aug 8, 2026 full notes ↗

Admin operations can authenticate with Touch ID, through an opt-in signed helper that runs a fixed set of operations and nothing else.

added
  • Touch ID for admin operations. Install the helper in Settings ▸ Advanced ▸ Privileged helper and Burrow's elevated work authenticates through the system's normal prompt instead of the password-only dialog. That older path is password-only by construction — the system.privilege.admin right authenticates through SecurityAgent's classic mechanism, which never offers Touch ID. (#346)
  • The Login Items list is now complete. Reading the Background Task Management database needs root, so an unelevated read raised macOS's own “sfltool wants to make changes” prompt — attributed to sfltool rather than Burrow — and still returned only a partial list. Through the helper it is one authentication you recognise, and the whole list.
changed
  • Flush DNS no longer runs a root shell. It previously elevated /bin/sh -c "dscacheutil -flushcache; killall -HUP mDNSResponder", handing a command string to a shell running as root. It is now two separate processes with fixed arguments and no shell involved.
  • Removed the “Touch ID for sudo” setting. It configured pam_tid for terminal sudo and never affected Burrow's own admin prompts, which is what people expected it to do — and those prompts are exactly what the privileged helper now covers. Nothing already configured on your Mac changes by removing it; run mo touchid disable to undo it yourself.
fixed
  • A failed elevated run could report success. When an elevated operation could not start, the empty transcript was reduced to “Done — caches cleared”. Failures now say so.
security
  • The helper is opt-in and takes its own one-time macOS approval. Installing it authorizes nothing: you authenticate for each operation you start.
  • Only Burrow can talk to it — callers are pinned to the app's bundle identifier, an Apple-issued chain, and the same signing team, evaluated by the system against the real peer rather than by a PID lookup.
  • It runs the engine sealed inside the signed app plus four Apple tools by absolute path, each as a separate process. The app bundle's signature is verified before anything runs as root, which covers the engine and every library it loads.
  • One honest caveat: the credential from your authentication stays valid for ten seconds, because it has to survive the hop from the app to the helper. A second operation begun inside that window will not prompt again. Detail in SECURITY.md.

0.11.2

Aug 5, 2026 full notes ↗

A system-metrics, updater, and launch-reliability patch with accurate CPU sampling, accurate Sparkle outcomes, a settled AppKit start, and reliable hang reports.

fixed
  • CPU usage now reflects a representative sampling interval. The bundled engine keeps a tick baseline across refreshes, samples before the other collectors fan out, and derives total usage from summed tick deltas. This removes the roughly doubled readings and coarse per-core fractions reported in #335. A cold one-shot status command can take about 600 ms longer; ongoing GUI sampling reuses its existing refresh interval and adds no wait. (#340)
  • Updater failures now mean what they say. Running from a disk image or translocated location, ordinary network failures, and user cancellation remain measurable in PostHog without opening Sentry issues. Sparkle keeps ownership of its native move-to-Applications and scheduled-retry UI. Configuration, signature, installation, and unknown failures still create exactly one scrubbed Sentry diagnostic per cycle. (#339)
  • The normal menu-bar path no longer races the first AppKit launch turn. Burrow waits one second before creating its status item, then retains the existing 30-second stability window. The safeguard for macOS 27 Beta 4 build 26A5388g remains exact-build-only; a later macOS build returns to the normal guarded path automatically. (#339)
improved
  • App-hang evidence can no longer disappear at the Sentry bridge. Sampled hangs are collected into bounded weekly GitHub digests instead of being silently skipped. Cursor pagination reaches older unseen groups, full digests roll into numbered parts, and deferred groups remain eligible for the next run. (#339)
  • Launch and updater health now have explicit lifecycle outcomes. Fixed-name scheduled, stabilizing, and stable milestones include bounded app release, macOS build, launch phase, and status-item state, so future failures can be separated without collecting free text or user data.
privacy
  • Telemetry remains optional, unlinked, and non-tracking. One Settings switch disables both PostHog analytics and Sentry diagnostics. Updater diagnostics contain fixed categories and bounded error domains/codes, never descriptions, URLs, response bodies, network names, paths, screen content, or files. The privacy manifest remains unchanged and accurate.
security
  • Publishing still fails closed, including the external Homebrew tap. Before any release build begins, CI requires every signing, notarization, Sparkle, and tap credential, then proves the tap token with a reversible Git write. The tap credential is isolated from the engine checkout so a successful notarized release cannot fail at the final cask push because the wrong token was left in Git configuration.

0.11.1

Aug 3, 2026 full notes ↗

A guarded-startup and diagnostics patch for the system-wide input freeze reported on macOS 27 Beta 4, with a safer exact-build fallback and privacy-hardened hang telemetry.

fixed
  • The affected macOS 27 beta gets a safer launch path. On Beta 4 build 26A5388g, Burrow starts with a Dock icon instead of creating its menu-bar status item. The fallback is limited to that exact build; a new macOS build restores the normal guarded path. Manual update checks remain available even when automatic Sparkle startup is paused.
  • Interrupted launches recover one component at a time. A durable launch journal gives the status item and Sparkle separate 30-second stability windows. If launch is interrupted, the next run suppresses only the component whose window was active, shows a recovery alert, and offers a one-click redacted diagnostic report. (#321)
improved
  • Sentry can now explain hangs that never become crashes. Release-health sessions, hang tracking, low-memory context, fixed-name sampled performance spans, and coarse launch/updater state cover failure modes that a normal crash report misses. Outbound data is scrubbed fail closed, with no screenshots, view hierarchies, user paths, URLs, request bodies, or automatic UI, file, database, and network tracing.
  • PostHog analytics no longer bring an AppKit-facing SDK into startup. Burrow still sends the same opt-out semantic product, screen, and operation events to PostHog, but a small background HTTPS transport replaces posthog-ios. It has a bounded serialized retry queue and no session replay, autocapture, remote feature flags, AppKit timer, or main-thread disk I/O. Existing 0.11.0 anonymous identities are migrated once so release-to-release funnels remain accurate.
  • The first signed Sparkle successor passed a real update. An installed Developer ID-signed 0.11.0 copy found, downloaded, installed, and relaunched 0.11.1 through Sparkle's native UI without Terminal or Homebrew. The updated app then passed strict signing, stapler, and Gatekeeper checks, completing #281.
privacy
  • Telemetry remains optional, unlinked, and non-tracking. One Settings switch disables both PostHog analytics and Sentry diagnostics. The privacy manifest continues to declare Product Interaction, Other Usage, Crash, Performance, and Other Diagnostic data; this release adds no signing-specific telemetry and records no screen content.
security
  • The release chain remains fail closed. The tag cannot publish unless the app is Developer ID signed, notarized, stapled, accepted by Gatekeeper, and both the update archive and appcast pass Sparkle signature verification.

0.11.0

Aug 1, 2026 full notes ↗

Burrow's first Developer ID-signed and Apple-notarized release, Gatekeeper can verify the app, Full Disk Access gets a stable identity, and Sparkle establishes the signed foundation for native updates.

improved
  • Official downloads are trusted by Gatekeeper. The app and every bundled executable carry a Developer ID signature, hardened runtime, secure timestamp, and a stapled Apple notarization ticket. Direct-download users no longer need to strip quarantine or use the right-click Open workaround. (#312)
  • Full Disk Access has a stable identity. Developer ID gives macOS one consistent code identity across releases, so privacy grants can survive normal updates after the one-time transition from an older ad-hoc build. (#177, #181)
  • The signed update foundation is in place. Burrow now uses Sparkle's native UI. Automatic checks remain on by default, but downloads and installs wait for approval. The update ZIP and appcast carry Ed25519 signatures that CI and the app verify; the first live 0.11.0-to-0.11.1 upgrade later completed successfully in #281.
  • The bundled engine no longer rewrites the app. It updates only with a signed Burrow release, preserving the Developer ID resource seal. Source builds using an external engine still expose its manual updater.
privacy
  • The privacy manifest matches the shipped app. Product Interaction, Other Usage, Crash, Performance, and Other Diagnostic data are declared unlinked and non-tracking. Analytics and crash reporting remain opt-out, and signing adds no telemetry.
security
  • A tag cannot publish a partially trusted build. CI stops before publication unless signing, notarization, ticket stapling, strict code-sign verification, Gatekeeper assessment, the Sparkle keypair match, and both update signatures all succeed. (#312)
  • Delayed Apple responses stay fail closed. The release retains Apple's submission ID, waits up to 60 minutes, and checks that same submission once more at the timeout boundary; it never treats an unknown or in-progress result as accepted. (#317)
  • Homebrew keeps Apple's security checks intact. The live cask preserves quarantine, removes the old unsigned warning, and is marked auto_updates true because Sparkle owns future in-app updates.

0.10.5

Jul 25, 2026 full notes ↗

Burrow's MCP tools, tuned against real agent transcripts, one analyze call maps disk hotspots, killed runs say so instead of failing silently, and slow scans warn you up front.

improved
  • One burrow_analyze call now maps disk hotspots. The engine reports one directory level per run, which forced agents into a call per directory (a real session made 15 in a row). analyze gains depth (descend into the largest subdirectories), limit, and min_size, emits compact JSON instead of 35–60 KB pretty-printed blobs, and always reports what it pruned (entries_omitted / omitted_bytes, partial: true when the descent hits its time budget). (#303)
  • The slow tools now say they're slow. analyze, clean, purge, and installer descriptions warn that big scans take minutes, so agents scope to a specific folder instead of hanging past their client's patience and falling back to shell commands. The agent docs and the burrow-system-tools skill now lead with the low-disk emergency playbook, the pattern that actually fires in practice. (#303)
fixed
  • Killed runs no longer fail silently. A burrow_clean that hit its time limit rendered as {"exit_code": 9, "output": ""}: nothing an agent could act on. Timed-out actions (and analyze) now return timed_out: true plus a hint. (#303)
  • burrow_cleanup_history explains itself. When engine history is unavailable, the error now points at burrow_info to check whether Burrow is recording at all. (#303)

0.10.2

Jul 24, 2026 full notes ↗

A fix release, three crashes squashed (the menu-bar popover, the streaming task report, and a nil-font HUD metric), and the in-app updater no longer silently reopens the same build.

fixed
  • No more menu-bar popover or streaming-report crashes. Two EXC_BAD_ACCESS faults inside SwiftUI's view graph, one in the popover header button, one in the live task report/ticker as a job streamed, are fixed by keeping those view subtrees structurally stable across snapshot and scroll updates instead of restructuring them mid-update. (#299)
  • The menu-bar metric no longer crashes on a nil font. NSFont.monospacedSystemFont is declared non-null but can transiently return nil under memory pressure; that null reached CoreText and crashed at draw time (Sentry BURROW-8Y). The metric widgets now fall back to the plain system font, cosmetic at worst, never a crash. (#290)
  • In-app update actually updates. When the cask “cannot be upgraded as-is,” Homebrew prints a warning but exits 0, so the one-click updater reported success and reopened the same build. It now detects the refusal by message and runs the brew reinstall --force Homebrew recommends. (#287)

0.10.1

Jul 13, 2026 full notes ↗

Three new panes, Leftovers, Similar Photos, and Network, and Duplicates now works out of the box, plus menu-bar HUD and HEIC fixes.

New
  • Leftovers pane: find and clear the caches, preferences, and support files an app leaves behind
  • Similar Photos pane: cluster near-duplicate images by perceptual hash, reveal in Finder
  • Network pane: per-app bandwidth
Fixes
  • Duplicates works with zero install, the fclones sidecar is now bundled universal
  • Similar Photos reports HEIC it can't decode (“N HEIC couldn't be read”) instead of a bare empty result
  • Menu-bar HUD popover no longer shifts sideways and clips; the tool strip wraps instead of overflowing
  • Tool panes mount lazily, no more ~2-second layout hang on open or pane switch
  • Finder-launched app augments its PATH with the Homebrew bins so installed helpers resolve

0.10.0

Jul 12, 2026 full notes ↗

The conductor release, Burrow ships its own command layer, a brand-new Duplicates pane, and the sudo, uninstall, and Tune-Up fixes you reported.

New
  • Duplicates pane: scan, review checklist-style with a keep-one guard, move extras to the Trash or reclaim via APFS clones
  • Bundled burrow conductor (universal): analysis, status, history, clean, and optimize route through one stable JSON contract with direct-engine fallback
  • 7 read-only MCP tools through the conductor, 21 total for agents
Fixes
  • Admin password dialog appears again for root-owned app uninstalls (the engine now opens /dev/tty instead of permission-testing it)
  • Failed uninstalls keep the list and selection and surface the engine's error
  • Tune-Up reclaim sizes no longer show raw ANSI color codes
  • Analyze bounds per-child scans so a huge cache folder can't freeze the scan
  • Menu-bar popover no longer rubber-bands into empty space
  • Self-update refreshes Homebrew before upgrading
Also
  • Per-metric menu-bar text sizing, stable widths, flipped net in/out ordering
  • HUD popover re-pins when the menu bar auto-hides
windows
  • Downloadable at last: BurrowWin-0.10.0-win-x64.zip ships on this release, the unpackaged app with burrow.exe and the engine bundled (unzip, run BurrowWin.exe; Windows 10/11)
  • Agent-triggered clean/optimize route through burrow.exe with the same envelope contract as macOS
  • burrow.exe grew real Windows powers: Recycle-Bin safe delete, guarded BCU uninstalls, czkawka duplicates + similar photos, provider-aware OneDrive eviction, IP Helper network attribution

0.9.2

Jul 8, 2026 full notes ↗

A stability and battery release, fixes to Cleanup, Analyze, and the menu bar, plus performance work that makes Burrow noticeably lighter while it sits idle.

Fixes
  • Purge (Cleanup → Project build artifacts) applies your selection instead of aborting with “Couldn't confirm the selection safely”
  • Analyze cancels superseded scans and caps engine concurrency, no more runaway pile of processes
  • Camera/mic in-use indicator ignores virtual audio/video devices and clears when capture ends
  • Menu-bar popover no longer flies to a screen edge or mis-sizes on multi-display setups
  • Fewer spurious “App Hang” reports
Performance & battery
  • Metrics engine caches slow SMC/GPU sensor reads and skips idle stream frames when no window is open
  • Analyze walk and icon caches are now bounded (evict under memory pressure)
  • Live sparklines window their data instead of scanning the full history each frame
  • Doctor security/SMART/backup probes are timeout-guarded and cached across reopens
  • Network-usage views share one sample instead of each running a 1-second scan
Under the hood
  • Dead-code prune
  • Homebrew cask no longer depends on a system engine (engine bundled since 0.9.0)

0.9.0

Jun 30, 2026 full notes ↗

Burrow's biggest release, it now bundles its own engine (no separate install), and adds an Activity-Monitor-class process inspector, a Get Online connectivity companion, and a security-aware Doctor.

engine
  • Burrow bundles its own engine now. The app ships an MIT-licensed burrow-engine (forked at its last MIT release) inside Burrow.app and runs it directly, so a fresh install needs no separate engine install. Burrow prefers the bundled engine, then an installed burrow-engine, then a legacy system engine for existing setups.
process inspector
  • Per-process inspector: click any process for a structured panel: identity (path, code signature, Mach-O architecture), live CPU/memory, runtime, and the process's open network connections.
  • Process tree: the parent/child hierarchy around any process.
  • CPU watchdog: set per-process CPU thresholds and get notified when something runs hot, with an editor in Settings.
  • Filter, suspend/resume, export: a typed predicate filter over the process table, suspend or resume a process, and export the table.
get online
  • On-demand speed test: measure real down/up throughput.
  • Nearby Wi-Fi scan: surrounding networks and channel congestion (Home mode), so you can pick a clearer channel.
  • Venue captive-portal tips: venue-specific help for hotel/airport/café portals that won't load.
  • Connection history: a log of connectivity events (SSID changes, drops).
doctor
  • Security posture: SIP, Gatekeeper, FileVault, and firewall at a glance, plus a high-CPU check and one-click Copy diagnostics.
  • Battery health: capacity % and condition (omitted on desktops).
  • More context: display, external-volume, and network context.
clean, software & analyze
  • Clean now sorts the review by reclaimable impact and flags sensitive paths (keychain/credential locations) before you delete; the done screen shows your all-time cleaned total.
  • Software: App Store updates that need a newer macOS are hidden; ⌘R refreshes with a cache bypass; app search is alias-aware.
  • Uninstall: a Clear-Data-only subset, plus an input-method leftover warning.
  • Analyze: one-tap whole-disk scan, and a treemap “Other” fold for tiny entries.
  • Optimize: a pre-run safety banner when a VPN or external display is active.
  • Login items: modern Login (BTM) items appear in the startup inventory; a LaunchAgent on an unplugged drive is no longer flagged broken.
  • Keep Screen On keeps working with the lid closed.
fixed
  • Three main-thread hangs on the new process/parity surfaces (suspend/resume, inspector, tree).
  • A missing paths: label on a data-only uninstall plan.
windows
  • Windows preview: version-aligned to 0.9.0; no Windows-specific changes this release.

0.8.3

Jun 25, 2026 full notes ↗

A metrics & menu-bar release, real memory-pressure reporting, a power-draw widget, a live menu-bar preview, and a snappier popover.

added
  • Power-draw widget: live system wattage (W) as a menu-bar metric.
  • Real memory pressure. “By pressure” now reads actual macOS memory pressure, (wired + compressed) / total via host_statistics64, the same figure Activity Monitor reports, instead of reusing the CPU-style utilization ramp. Shown as a percentage on the memory tiles, colored green ≤59% / orange 60–79% / red ≥80%.
  • Memory detail card: the Status dashboard breaks memory down into used / free / cached / swap.
  • Live menu-bar preview + layout presets: Settings previews your real metrics as you configure them, with one-tap layout presets.
  • Two new runner animations: Wave and Bars.
changed
  • Consistent pressure coloring across the dashboard tile, popover, memory-detail card, and menu bar.
  • Live popover sparklines: CPU / memory / GPU tick every second (about a minute of history).
  • Honest color picker: “By pressure” is offered only where it applies (memory); the temperature color ramp was corrected.
fixed
  • Brewfile import/export pickers no longer trip the hang detector (ANR false-positives).
  • App-Hang reports from memory-starved machines are dropped before sending, they were environmental, not Burrow bugs.
performance
  • Snappier popover: the metric grid no longer re-renders on unrelated state changes.
windows
  • Windows preview: a version-aligned 0.8.3 build is attached (BurrowWin-0.8.3-win-x64.zip). No Windows-specific changes this release.

0.8.2

Jun 23, 2026 full notes ↗

A fix release, a Full Disk Access grant now actually takes effect, and Burrow asks for notification permission up front.

fixed
  • Full Disk Access is honored again. The shipped app's embedded framework signatures were malformed (codesign --verify --strict failed on Sentry.framework), so macOS couldn't validate Burrow's identity and silently ignored a Full Disk Access grant, turning it on in System Settings appeared to do nothing. The release now re-signs the app and every nested framework inside-out so the signature is valid and the grant takes effect. After updating, toggle Full Disk Access off and back on once. _(Burrow is still ad-hoc-signed, so a re-grant is needed after each update until it ships with a Developer ID signature.)_
changed
  • Notification permission is requested up front: Burrow now asks once, when you finish onboarding or first enable a notifying feature, instead of springing the system prompt the moment a notification tries to fire.

0.8.1

Jun 23, 2026 full notes ↗

A stability release, no more dashboard freezes, live status now streams, a one-click Homebrew update, and the Windows preview's review closeout.

fixed
  • No more App-Hang freezes. The Overview dashboard re-rendered its whole grid, every chart tile and the full process table, once a second; now only the small Disk / Network tiles update that often, the rest on the snapshot.
  • Opening Settings and the About panel no longer blocks the main thread (login-item status, metrics-folder sizing, and the engine-version lookup moved off it).
  • PostHog telemetry now flushes off the main thread instead of on a main-run-loop timer.
changed
  • Live status streams by default: with engine 1.44+, Burrow streams the engine's streaming status command (NDJSON) instead of polling the engine's one-shot status command: lower latency and less subprocess churn. Falls back to polling on an older engine or a dropped stream.
added
  • Update with Homebrew: for cask installs, the update prompt has a one-click button that runs brew upgrade --cask burrow and relaunches.
windows preview
  • Closed out the port review: MCP tool parity with macOS (burrow_list_apps, burrow_purge, burrow_installer: preview-only over MCP), stdio MCP that survives the HTTP toggle, brand assets / palette / fonts / icon aligned to the Mac, honest docs, and MCP + deletion-guard tests. Earlier rounds added Recycle-Bin routing, a drive-root guard, and SHA-256 verification of the bundled engine. Still an unsigned, build-from-source preview.

0.8.0

Jun 20, 2026 full notes ↗

A top-to-bottom visual redesign, a wave of new tools, a deeper agent surface, and an early Windows preview.

added
  • Ports: live connections, bandwidth, reverse-DNS peers, service labels, conflicts, sortable columns, and a per-connection detail view.
  • Get Online: MDM and gateway checks, the active-interface IP, captive-portal and device-side rescue, and one-click fixes.
  • Tune-Up: a Smart-Care flow (scan → results → run) that auto-scans the moment you open it.
  • Homebrew: Services (start / stop / restart), Brewfile snapshots (export / restore), and live brew upgrade progress in Updates.
  • Menu bar: a customizable popup, Stats-depth widgets, a RunCat-style runner, and live metric widgets in the status item.
  • Disk now forecasts when you'll run out of space (“Full in ~N”); Doctor gains SMART-health and backup-awareness checks with overdue reminders, multi-select bulk reclaim, and a git purge-safety badge.
  • For your agent: a deeper MCP surface: a token-gated /events SSE stream and burrow_diff, so an agent can watch and compare your machine over time.
changed
  • A warm, tactile redesign, a warm-coffee adaptive palette, film grain over a soft gradient, a floating icon rail in place of the top tabs, borderless cards, and the Geist / Cal Sans type system.
  • Overview: Health pulled up into an open hero band over a cleaner three-up vitals grid.
  • History: a focal hero chart with a selectable metric strip; drag-select a span to surface the top processes for that spike.
  • Menu-bar HUD: borderless tiles on the same warm ground, with Doctor and Restore reskinned to match and edge-fade scrollers throughout.
performance
  • Killed several main-thread app-hangs, the process table, sort, ICU on the render path, app icons, clean reports, and the software list.
  • Onboarding now auto-detects the engine.
windows preview
  • An early native WinUI 3 / .NET 8 app now lives under windows/: Status, History, Analyze, Apps, a tray HUD, local telemetry/history, and an MCP stdio bridge. Build from source; unsigned preview.
under the hood
  • The repo is now a monorepo (macos/ + windows/), with inside-out framework signing for notarization and an automated upstream engine release watcher.

0.7.2

Jun 15, 2026 full notes ↗

A feature pass on the redesign, cleanup, software and the live dashboard get more capable, with opt-in update and privacy surfaces.

added
  • Cleanup, unified: Purge and Installers fold into Clean as category cards, each with a real result screen and the raw log tucked behind a View Log toggle.
  • Self-update: Burrow checks itself for new versions (opt-in, default on) and shows a banner plus a menu-bar dot. It never installs on its own.
  • Homebrew updates appear the moment you open the Apps tab, and your own login items get on/off toggles.
  • An optional camera & mic in-use indicator in the menu-bar popover (off by default), reading the same signal as Control Center.
  • About and Check for Updates now live in Settings too.
changed
  • Network charts in Status and History draw download and upload as two separate lines.
  • Analyze shows live per-folder progress on the first scan.
  • A View Log toggle on every result screen, Clean, Optimize, Purge, and Installers.
fixed
  • Confirm dialogs and Touch ID are no longer reported as app-hangs.
  • Live App Store / Sparkle update checks stay click-gated, no silent network.

0.7.1

Jun 14, 2026 full notes ↗

A stability pass, every freeze and the crash reported since the 0.7.0 redesign, fixed.

fixed
  • The History view no longer freezes on wide time ranges.
  • Typing in Uninstall and Purge is smooth again.
  • Fixed a crash opening the menu-bar popover charts, it and the Status mini-charts could segfault on a transition, and now draw as one stable shape.
  • GPU history bars draw again on Apple Silicon.
performance
  • Faster launch, engine discovery moved off the main thread.
  • The HUD, Status, and Activity panels share one refresh pump now.
  • The process-row Quit / Force-Kill menu is no longer rebuilt on every refresh.

0.7.0

Jun 13, 2026 full notes ↗

The big one, every tool redesigned, a real Clean review pipeline, a new Software tab, and notifications when work finishes.

added
  • New Software tab: per-app uninstall review, a unified Updates list with source badges, and a startup inventory.
  • Review before you clean: Scan streams a live count-up into a per-item review screen, and deselected paths are protected for exactly one run.
  • Finish-line alerts: get notified when a clean, optimize, or uninstall finishes, plus opt-in low-disk and Trash reminders.
  • Keep Screen On, Clean Screen, and global shortcuts.
changed
  • Every tool redesigned, Onboarding, Clean, Software, Status, the menu-bar popover, Analyze, and Settings, all rebuilt.
  • History CPU, GPU, and health render as bars, and GPU usage is read natively on Apple Silicon.
  • A compact, scrollable process table.
  • MCP cleanup tools share the app's gate, return structured summaries, and surface data-freshness on a stable contract.
  • ~230 strings localized in 简体中文 / 繁體中文.
fixed
  • One-click relaunch the moment Full Disk Access is granted.
  • First-run onboarding checks the engine and version.
  • Truthful Touch ID copy.
  • The dashboard survives a bad metrics sample (skipped and counted) instead of stalling.
performance
  • History auto-refresh is demand-driven, no idle timer.
  • A deepened, test-covered engine runner / metrics / actions core.

0.6.7

Jun 11, 2026 full notes ↗

The biggest release yet, one Home dashboard, 繁體中文, native sensors, live 1-second charts.

added
  • One Home dashboard: Status, History, and Activity fold into a single live view: vitals, charts, and recent jobs in one place.
  • 繁體中文: Traditional Chinese joins English and 简体, with an in-app switch, so you're not tied to the system language.
  • Real fans & temps: fan RPM and CPU/GPU die temperatures, read straight from the SMC, the gaps the engine leaves on Apple Silicon, filled.
  • 1-second live charts: net and disk sampled every second, so bursts show up instead of being averaged away.
  • Trash from the treemap: spot a forgotten folder in Analyze and send it to the Trash right there, no detour to Finder.
  • Sharper AI Explain: it briefs the whole picture now: the current snapshot, the recent trend, and your recent cleanups, in your language.
changed
  • Opt-out anonymous telemetry, one switch, listed in TELEMETRY.md.
  • AI keys moved to the Keychain.
  • Deletes and uninstalls need a second agent opt-in.
fixed
  • The loopback API is hardened, no CORS grant.
  • Treemap hover and breadcrumb fixed.
  • Tests grew 124 → 244.

0.6.5

Jun 9, 2026 full notes ↗

A reliability release, the selection flows stop hanging, and the engine integration is now driven by tests.

fixed
  • Installers and Purge no longer freeze when the engine finds nothing, or on a second scan, the “Scanning…” hang is gone.
changed
  • The “remove exactly what you picked, or nothing” flow is now a pure state machine, verified in CI.
  • One ANSI cleaner, one typed client, one snapshot store.
  • Tests grew 90 → 124.

0.6.0

Jun 8, 2026 full notes ↗

Fix-and-polish, cleanup flows actually complete, and the trackers show real data.

fixed
  • Installer & Uninstall complete: the confirm-screen timeout and the silent [y/N] hang are gone; both flows finish now.
  • Settings flush immediately.
added
  • Native disk I/O & GPU: read natively where the engine reports zero on Apple Silicon, so charts show real numbers.
  • Purge → Show all: pull in the complete find list and pick from everything, not just the ~50 biggest.
  • More history charts: Battery, GPU, and Fans join the lineup; Top Processes ranks by CPU or RAM.
  • The thermal chart plots a real temperature.
performance
  • Faster live sampling catches short spikes.

0.5.5

Jun 8, 2026 full notes ↗

Two new cleanup tools, an AI lens on Status, and agents that can act, safely.

added
  • Purge: find and clear old build artifacts (node_modules, target/, build/), ticking exactly what goes.
  • Installers: sweep leftover .dmg / .pkg / .iso / .zip with the same pick-what-to-remove flow.
  • Explain (AI), opt-in: a lens that reads one snapshot and explains it in plain English; local Ollama by default, nothing leaves the Mac.
  • Agents can act over MCP: burrow_clean, _optimize, _uninstall and friends, each dry-running unless you flip the real-cleanups switch.
changed
  • Every agent action defaults to --dry-run.
  • LM Studio and OpenAI-compatible backends are supported.

0.5.1

Jun 8, 2026 full notes ↗

Maintenance, Full Disk Access actually sticks now.

fixed
  • Full Disk Access works: ad-hoc signing gives the app a stable code identity, so the TCC grant finally binds.
  • A Quit & Reopen path after granting Full Disk Access.
added
  • New read-only MCP tools: burrow_cleanup_history and burrow_deleted_files.
performance
  • Less energy in Software, dropped the per-app Spotlight query that kept mds and mdworker awake.

0.5.0

Jun 8, 2026 full notes ↗

Burrow grows up, Touch ID, a live menu-bar HUD, an MCP server, 简体中文, and a one-command install.

added
  • Touch ID for sudo: cleanups that need admin rights authenticate with a fingerprint, via the engine's Touch ID support.
  • Menu-bar HUD: live job status from the menu bar, or run without the icon entirely in Dock mode.
  • MCP server: ask Claude Code about your Mac through a read-only stdio server, including burrow_process_usage.
  • 简体中文: Simplified Chinese localization.
  • History: long-range charts, five minutes out to ninety days, over a local SQLite store.
  • Homebrew cask: brew install --cask caezium/tap/burrow: one command, engine included, quarantine cleared.
  • An Activity pane with cleanup history in-app.
changed
  • A Full Disk Access gate stops the per-folder permission flood.
  • Guided engine setup on first run.

0.4.0

Jun 4, 2026 full notes ↗

First public release, five tools, one native window, built on a bundled CLI engine.

added
  • Five tools, one window: Status, Analyze, Software, Clean, and Optimize: a native macOS GUI for the audited engine.
  • Status + History: a live dashboard with per-metric sparklines, and long-range charts on a local store.
  • MCP server, day one: HTTP + stdio endpoints so Claude Code can ask what's happening on this Mac.
notes
  • macOS 14+; requires a separate engine install; unsigned, pre-1.0.