Bolt 0.1.152

Bolt 0.1.152

Bolt has its own vault

• Bolt no longer only reads your connected password managers — it can hold secrets itself. Generate a password with =pw and save it in one step, or create an entry by hand.
• Fill from the browser. Right-click a username or password field and fill it from Bolt. It reuses the same consent, origin-check and picker machinery that already guards 2FA codes, so a page script cannot fill a field on your behalf: every fill needs a real click from you.
• Save what you just typed. When Bolt sees a login form submitted successfully, it offers to save the credential. The offer waits for the submit to actually succeed, so a rejected or mistyped password is never stored.
• Save into 1Password or Bitwarden, not just Bolt. A login you save can be written into a
  connected external vault. Bolt creates the entry through the provider's own CLI and never puts
  the password on a command line. Other connected providers stay read-only for now, and the save
  dialog says so rather than failing quietly.
• A lock. Your vaults lock on idle and unlock with a PIN, covering every connected provider rather than only Bolt's own entries — so an unattended desktop does not leave your secrets open. The PIN is hashed with Argon2id and unlock attempts are rate-limited.
• Administrators can enforce it. The idle timeout and require-a-PIN can both be set by your organisation's policy. When they are, the setting shows as managed and read-only rather than being silently overridden.
• Secrets you mark as sensitive opt into sync automatically once the device is enrolled, with per-item sync status visible.
• On Linux, Bolt now stores secrets in the system keyring through the Secret Service API, alongside the existing macOS Keychain and Windows Credential Manager support.

2FA codes

• The badge shows Bolt's instant local answer first, then visibly continues pulling from your connected vaults, so a slow vault reads as still-searching rather than as a missing code.

Bolt works from the keyboard now

• Command mode is a real mode rather than a pile of shortcuts. Press it once and letters act instead of typing; the notch tells you which mode you are in.
• It survives navigation. Moving between pages with j/k/f keeps you in command mode: Bolt distinguishes a cursor you moved from one the app moved.
• Hints stay up after you act, so opening a menu and choosing from it takes one keypress. Hint labels sit clear of what they label, short hints are prefix-free, and the alphabet is wider.
• Search your hints. Type to narrow the hints on screen, collapse a group you do not want, and move between them by direction rather than by list order. A collapsed group is still findable by its own name.
• Nothing reveals itself on its own. In command mode the only thing that opens a panel is you pressing space, so the screen holds still while you aim. The notch holds its size and place, on every route.
• Hint mode reaches controls that only appear on hover — a delete button, a row action — handled in one place rather than control by control.
• Assign your own shortcut to any tile on the rail, and see it as a key badge on /help rows.
• z toggles Zen from command mode, and the notch says what f actually does: it finds, it does not click.
• Bolt's shortcuts work while a web page has focus. Chords typed inside the in-app browser reach Bolt's own handlers.

The rail narrows, instead of a second strip of chips

• Typing / or = now narrows the utility rail in place. The old scope and utility chip strips are gone, so there is one list of things to aim at instead of two.
• The keyboard lands on the rail as soon as you start narrowing — including when nothing matches yet — and arrow keys move along it. Step out with ArrowUp and ArrowDown brings you back.
• Narrowing searches the full catalog, not just what happens to be on screen, and /cmd chips are compact enough to see at a glance.
• In the app strip, arrow keys keep the selected app in view as they move.

Settings and help, from the launcher

• /settings and /help are real launcher scopes. Search every setting and every help topic from the same bar you search everything else, with Cmd+K and Cmd+? reaching them from inside the dropdown.
• Flip a setting without leaving the launcher. A toggle found by search is switchable in place, by click or by Enter.
• Help rows carry the key badge for what they do, and selecting one enters the scope or utility.
• A bare ? opens Help, and Cmd+? reaches the shortcuts you expect.

Policy as code, from the command line

• boltctl is a new command-line tool for administrators. Keep your organisation's policy
  as a git-tracked YAML file and validate, diff, apply, list versions or rollback it,
  without opening the admin UI or waiting on a Bolt release. It talks to the same admin
  endpoints the UI uses, so nothing about how policy is enforced changes.

Note it in Bolt, from anywhere

• Select text in your browser, right-click, and it becomes a note. Select text or a file in any macOS app and do the same from the Services menu.
• The page confirms it worked, with a button to open the note in Bolt, and tells you when a capture is being held because Bolt is not reachable. Held captures land when Bolt reconnects.
• A captured note is enriched with where it came from: the page, the app you were in, what else was open. That context goes into the note body as well as its metadata, so searching for it actually finds it.

Notes

• Apply labels in the composer and filter /notes by them.
• Mine, Captured and Shared are real facets, filtered in the database rather than over one page of results, so they stay accurate at any note count.
• Metadata stored alongside a note is preserved across saves, including keys written by other tools.
• Note previews render as clean text.

Reminders and Recall

• Reminders run on the same alerts backbone as everything else, with all four ways of creating one converged onto it. Duplicates are collapsed, silent reminders stay silent, and an unsynced reminder retries at startup.
• Recall can seal a day into a real note. The day's rollup becomes a note you can keep, offered once after a seal rather than interrupting mid-panel.
• Today at a glance is the first row of /recall.

Windows

• Keyboard shortcuts work immediately at launch. Ctrl+\, Ctrl+, and type-to-search no longer need a click in the window first.
• Cleaner shutdown and relaunch. The background service and the embedded database server are tied to the app's own lifetime, and Bolt waits for its port to be genuinely free before starting again — so a restart no longer meets a machine that looks busy.
• Running-app icons appear in the launcher strip, read from the executable on every path that needs them.

macOS

• Bolt asks to be moved to Applications when launched from a quarantined copy, so macOS permissions can persist.
• Bolt does not trigger system install prompts on its own.

Keyboard and screen-reader access

• The focus ring is visible on every control, including the primary sign-in button, with a check that keeps it that way.
• Every modal keeps the keyboard inside it, through one shared trap rather than per-dialog handling.
• Deleting a chat session, and other actions that appear on hover, are reachable by keyboard, and scrollable panes can be scrolled without a pointer.

Zen mode

• Zen and Full each keep their own window geometry. Switching between them restores that mode's own size and position instead of resizing the window around you, and Zen's layout is anchored to the top.
• Pinned notes open to a click and to keyboard focus, not only to a hovering pointer, and the Zen notch reveals itself on movement with the same keyboard parity — with a clearer icon and label.
• Zen Glance uses the same card treatment as everywhere else, the rail is no longer dimmed in Zen, and the rail's border no longer clips.

Speed and stability

• /apps is populated at the first frame from the warm app cache.
• Dragging the window edge to resize stays responsive, at any size and in any mode.
• The launcher's shape detection loads reliably in packaged builds, so results that depend on recognising what you typed are there from the first keystroke.
• A dialog you have closed no longer holds on to the keyboard — every keystroke routes to what is actually on screen.
• Badges re-measure against the window after you resize it.
• Visual and semantic search wait for a query long enough to be meaningful.
• Results paint once when settled rather than flickering through intermediate states, and a file preview recovers from a transient read error.
• A failure in one part of the screen is contained there, including in zen mode, and degraded areas recover on their own.
• Result identities are made unique where rows enter the interface, so no search provider can produce a collision, with a check that refuses any list keyed on something that could.
• Fixed a startup crash that could leave the app on its loading screen, and a false error flash on startup.

Privacy and security

• Scan a file for sensitive content before it leaves your machine. The browser extension's
  file guard now reaches the detection service, and it honours the same all-sites scope and
  exclude-host list the on-type guard already had, so administrators can point it at every site
  or hold it to a named set.
• Bolt's browser protection warns you, it does not stop you. A file that scans clean attaches
  automatically. A file Bolt cannot screen — an image needing OCR, or Bolt simply not running — is
  sent with a record rather than held. Anything flagged can be sent with one click, and that choice
  is always logged. Managed and enterprise block policies are unchanged.
• Local-storage encryption at rest now includes the screenshot, vector and thumbnail stores.
• Hardened connection authentication for the browser extension's sensitive operations (notes, keychain, settings).
• Personal-information detection now covers two values written with no separator between them, such as a card number immediately followed by its security code.
• AI summaries exclude model reasoning traces, and error messages name the upstream cause.

Also improved

• The network filter can be made non-removable by policy, so a managed device keeps its egress protection in place (macOS 15 and later), and a deployment guide documents what the regulated posture does and does not cover.
• Type to filter any long dropdown.
• Confirmations and alerts use Bolt's own themed dialogs throughout.
• The launcher does not open into /ai, and /ai is not the picker's default Enter target.
• =cve results keep their declared order.
• "Connecting to this device…" retries and reports a result rather than waiting indefinitely.
• Removing one attached context item leaves others that share its name in place, and duplicates are handled cleanly.
• Settings search shows each result's section path as a trailing chip, with descriptions on /settings rows.
• Zen mode: the hero card and the stats row line up correctly, and the hero keeps compacting at short window heights.

If you use the browser extension, re-load it

The extension in this release is 1.0.9 and carries the browser-protection changes above. The
desktop extension is loaded unpacked, which browsers never auto-update — so download it again from
Bolt and re-load it (brave://extensions / chrome://extensions → Reload), then refresh any
tab you had open. Managed deployments update through your own hosted .crx as usual; the extension
id is unchanged.

Install: https://sparcle.app/download