Herald v1.1.1

A maintenance release: more accurate, better-disclosed usage analytics, and one search fix.

Changed

• Usage analytics now run on swift-stats 0.3.0. Install figures carry straight across the
  upgrade (no drop, no spike of "new" installs): Herald already counted installs with a random
  per-install identifier.
• Usage reports are more accurate, and cover a few more features. Herald now reports which
  settings are changed (never what they were changed to, or for which domain), when a label is
  added or removed (never which label), when a new-mail banner is clicked, and whether macOS
  allowed notifications after you turned them on. Actions record where they were triggered
  from (toolbar, keyboard, menu…), a search is counted once per Return, and a compose window
  that closes leaving a draft is counted once. As before, nothing you type, no names, addresses
  or identifiers of your mail or accounts, and no exact counts are ever sent.
• Settings › Privacy and the README now list everything each report carries: the Herald
  version and build, macOS version, Mac model (never your Mac's name), processor type, and your
  language and region settings, alongside which features are used.
• The privacy manifest now declares the per-install identifier as Device ID (not linked to
  you, not used for tracking). Herald has always sent it; earlier builds just didn't declare it.
• Development builds never send usage reports unless explicitly turned on.

Fixed

• Automatic mail checks no longer count as using Herald. Herald used to report every
  background sync — every 15 seconds while it was in front — so a Mac left running with Herald
  open looked in use all night. Only syncs you start, the one at launch, and the moment sync
  stops working are reported now.
• A launch is counted once, not once per account, and not at all when Herald starts behind
  other apps.
• Launching Herald straight into the foreground now starts its analytics session properly
  (it previously had no "app opened" event), and quitting makes a best-effort attempt to send
  anything still queued.
• Pressing Return in the search field right after typing now searches what you typed, not the
  text from a quarter-second earlier.

Herald v1.1.0

Herald 1.1 adds one opt-in feature: AI tagging of new mail, run through your own Cloudflare AI
Gateway. It is off until you set it up, and nothing leaves your Mac for it until you do.

Added

• Classify new mail (opt-in). A domain's new Workflows page can have an AI model tag each
  new conversation with one of your existing HQBase tags, using descriptions you write for each
  tag. Requests go to your own Cloudflare AI Gateway (Settings › AI Gateway: account, gateway,
  model and a token kept in the Keychain) and only Cloudflare-hosted models are offered. Only
  the first incoming message of a conversation with no tag yet is classified, never mail that
  arrived before you turned it on, and the conversation is re-checked on the server first so a
  tagged or older conversation never costs a model call. At most 60 requests an hour.
• Recent activity on the Workflows page lists what was classified for that domain — the tag
  applied, "No tag", or why a message was skipped or failed — and which model answered.
• A gateway problem (rejected token, no credits, model not enabled) pauses classification once
  and says so on the Workflows page; saving a new token or changing the gateway settings
  resumes it.

Herald v1.0.0

Herald 1.0. The app is redesigned around domains — the way HQBase actually groups mailboxes —
with a new sidebar, a rebuilt compose window, and a Settings experience to match. Everything
else in this release is stability work: session recovery no longer traps you, sync races that
could undo your own actions are closed, and long mailboxes load as you scroll.

Added

• Domains sidebar. The sidebar now drills down by domain — an account card up top, then each
  domain's mailboxes underneath — instead of one flat mailbox list. Hidden and server-disabled
  domains stay out of the way, with a Settings page to restore or remove them.
• Split-view Settings. A new Settings shell with per-domain Overview, Mailboxes and
  Signatures pages, reachable from the domain's own row, plus a page for hiding, restoring and
  removing domains.
• Per-domain badge colour. Each domain can carry its own badge colour override, shown on
  that domain's mail in the list and reading pane.
• A dedicated Compose window with a From picker: any address you can send from is one click
  away, each domain remembers its own default From, and a reply is locked to the exact address
  the original was sent to so a reply can't drift to a different domain by accident. Recipients
  are entered as tokens (To/Cc/Bcc), and the footer validates addresses before Send is enabled.
• Attachment cards in both the reading pane and compose, with a Download All button; Herald
  now accepts attachments of any content type rather than rejecting ones the server left
  untyped or unusual.
• Long mailboxes load as you scroll. Conversation lists page in additional rows past the
  first 100 automatically, instead of stopping there, with a VoiceOver announcement while a page
  loads.
• New fonts and design tokens throughout the app — the last system text styles now come from
  Herald's own typography scale, and window titles follow whatever you're looking at (a domain,
  a mailbox, a label).

Changed

• Analytics: mailbox_color_changed is gone along with per-mailbox colours; a new
  scope_changed event records moving between all-domains, a single domain, and a single
  mailbox.
• Save dialogs for attachments open in Downloads.

Fixed

• Session recovery no longer traps you in a consent loop, and a dead session now heals
  itself with a re-auth banner rather than getting stuck. A refresh token is never re-spent: if
  saving a freshly refreshed token to the Keychain fails, Herald uses the new token for that request
  instead of replaying the refresh, which HQBase answers by ending the session. A brief Keychain read/write hiccup
  no longer costs you a sign-in later.
• A concurrent sync pass can no longer undo an action you just took. Archiving, trashing,
  starring or marking read is now fenced against an in-flight sync, so a page landing mid-action
  can't roll your change back.
• A draft autosave that lands after you hit Send no longer resurrects the message. A stray
  autosave answer arriving late is now ignored once the send has gone out.
• Quick Look previews of attachments no longer break when the cached file was cleared from
  under them; attachments are now cached in Application Support.

Removed

• Per-mailbox colours. Colour is now set per domain instead (see Added, above); the
  mailbox_color_changed analytics event goes with it.

Herald v0.5.1

Fixed

• ⌘N now opens a new message. It used to open a second main window on the Inbox, because the
  system's built-in New Window command also owns ⌘N and won the tie. New Window is gone: Herald
  has one mailbox view, so a second window was only ever a mirror of the first. Herald #10.
• A Compose button in the toolbar. New Message was reachable only from the File menu; it now
  leads the window toolbar, where Mail puts it. Herald #10.

Added

• Reply, Reply All and Forward in the row context menu, ahead of the triage actions and in the
  same order as the Message menu. They act on the row you right-clicked, not the selection, and are
  dimmed for multiple selections. Herald #11.

Herald v0.5.0

Adopts HQBase 1.4.0–1.4.2. Everything new switches itself on by what the server answers, so
Herald keeps working unchanged on 1.3.4 and 1.4.0 instances.

Added

• Signatures in Settings (HQBase 1.4.2). A new Settings ▸ Signatures tab lists the signatures
  you may manage, grouped by personal, mailbox and domain, with create, edit, delete, default flag
  and a live preview rendered with the same protections as the reading pane. On an older server
  the tab says so instead of failing; an account signed in before this release needs one fresh
  sign-in to grant the new permission, and the tab tells you that too.
• Reply-To is honoured when a message names preferred reply addresses (HQBase 1.4.0): Reply
  pre-fills them instead of the sender.

Changed

• Labels update immediately on HQBase 1.4.2. Label membership now arrives on every message row
  and every change-journal entry, so a label applied in the web app shows on the row within one
  sync pass instead of waiting for the two-minute sweep. The per-label sweep now runs every thirty
  minutes as a safety net (and immediately when the label list changes). Older servers keep the
  previous cadence.
• Sending is retry-safe (HQBase 1.4.0). Every send, reply and forward carries a stable retry
  identity, so clicking Send again after a timeout replays the original delivery instead of
  sending a second copy. Forwards had no such identity before. If the server reports that a send
  is still being recovered, Herald says so and does not let you resend it.
• Sign-ins outlive the browser session on HQBase 1.4.2: signing out of the web app or letting
  its session expire no longer signs Herald out. The automatic re-sign-in stays for revocation and
  password resets.
• Herald now asks the server only for the permissions it actually uses, so a future server release
  cannot widen the consent screen on its own.

Fixed

• A label you just applied could disappear for up to one sweep if a sync pass was already in
  flight; in-flight label changes are now fenced from that pass.
• A sync pass that failed part-way through after writing label changes left the chips stale until
  the next label edit.
• A held Send button now states why it is held, and ⌘⇧D still announces the reason instead of
  doing nothing.
• The signature preview no longer opens blank for a quarter of a second, announces errors to
  VoiceOver, and fits the Settings window at every text size.
• Signing out of one account while another was still restoring at launch could bring the signed-out
  account back.
• A Keychain read failure during a token refresh is now reported and aborts the refresh, rather
  than being mistaken for "nothing stored" and spending a token another Herald process may have
  already rotated.
• Server error text is never written to the system log from the signatures pane.
• The flaky new-mail notification test had a wait that could never fail; fixed at the cause.

Herald v0.4.1

Fixed

• Sign-in can no longer trap you. A sign-in that stops making progress — most often because macOS
  never opens the browser window it was asked for — now shows a Cancel button on both the
  first-run screen and the Add Account sheet, and Cancel abandons the sign-in itself rather than
  just closing the window over it. The screen is usable again immediately and a second attempt
  works — and a cancelled sign-in is really cancelled: the account it had already stored is
  removed and its token revoked, rather than quietly reappearing at the next launch. The re-auth
  banner offers the same Cancel while it is signing you back in. Herald #9.
• The spinner now says what it is waiting for: contacting your server, checking this Mac's
  registration, registering, waiting for the sign-in window, completing sign-in, saving
  credentials, setting up your mailbox. Each step is logged too, so a stuck sign-in names its
  location instead of just spinning.
• A browser sign-in that never reports back no longer waits forever: it is noted in the log after
  45 seconds and fails with an explanation after ten minutes. The deadline is deliberately long —
  macOS gives Herald no signal that the window actually opened, so a shorter one would close a
  consent page you were still typing into. Cancel is the fast way out.
• Sign-in and token requests have real deadlines (15s per request, 30s overall). They previously
  inherited the system default of seven days, so a server that accepted the connection and then
  went quiet could hang the sign-in indefinitely.
• Keychain reads and writes during sign-in and at launch no longer run on the main thread, so a
  stalled system keychain leaves Herald responsive — and cancellable — instead of frozen.
• Signing out now clears the cached server discovery for that address. Signing back into a server
  that was reinstalled in the meantime, without quitting Herald, could previously reuse the old
  install's endpoints.

Herald v0.4.0

Herald now targets HQBase 1.3.4 or newer: forwarding and message rendering use API surfaces that
older servers don't have.

Added

• Put Back. Trashed conversations can be restored ("Put Back") and archived ones moved back to
  the inbox — toolbar, context menu, ⌘⇧A, the e key and VoiceOver all follow one folder rule,
  so no more silent no-op archive from the Trash.
• Labels. Workspace labels sync into a sidebar section with per-label listings, colored name
  chips on rows and in the reading pane, and add/remove from the context menu, the reading-pane
  header, and the Message menu. Label colors match the web app.
• Signatures. Compose shows the signatures usable from the sending address, picks the address's
  default automatically, and lets you switch (or send with none). The server appends the
  signature, and a read-only preview shows exactly what will go out. A draft's saved signature is
  kept when you reopen it.
• Quoted-thread preview in compose. Reply and forward windows show a collapsed, read-only preview
  of the original the server will quote below your text.
• Instant sync. Herald now holds a lightweight wake connection to the server and refreshes the
  moment something changes, instead of waiting for the next poll. Polling remains as a fallback,
  stretched while the connection is healthy.
• Automatic sign-in repair. When a session expires while your HQBase web session is still alive,
  Herald re-runs the sign-in by itself the next time it's frontmost — the window flashes once and
  syncing resumes. The banner stays as a fallback and shows progress.

Changed

• Forwarding uses the server's dedicated forward route, so the forwarded message can no longer be
  lost by sending before an autosave; the original's attachments ride along.
• Message rendering: text a sender wrote below the quoted history is now shown (it was silently
  dropped); quoted history collapses behind "Show quoted history"; nested quotes get per-level
  bars; plain-text mail renders in the system font with clickable links and tinted quote lines;
  wide tables scroll inside the message instead of the whole pane; dark mode no longer glares on
  unstyled light emails, and Increase Contrast is honored inside the message view.
• Attachments: downloads carry their real file type (previews and Quick Look work for files the
  server sends untyped or misnamed), inline-vs-attachment now follows the server's intent, the
  attachment bar survives offline reads, saving reuses the already-downloaded file, and a file
  being previewed or dragged can no longer be evicted mid-use. Failed inline images are called
  out instead of leaving silent holes.
• Sending marks messages read/unread, stars, archives and trashes more reliably from the Trash
  and Archive scopes, which the server treats specially.
• The Privacy pane's usage-statistics toggle now says when analytics aren't included in a build
  (dev copies) instead of rendering a switch that snaps back, and confirms opt-out in real builds.
• Accessibility: selection state in the signature menu, contrast-safe label chips, VoiceOver
  announcements for session-repair and blocked/failed image banners, and a Labels submenu in the
  Message menu.

Fixed

• Sessions no longer log out when two Herald copies share one account (server-side fix Herald
  asked for in HQBase 1.3.x, plus client-side hardening).
• A rejected sync cursor now recovers by re-syncing instead of failing forever.
• Cached data written by an older Herald can no longer crash the app on read; the cache degrades
  and heals on the next sync.

Herald v0.3.0

Added

• Multiple accounts. Add more than one HQBase account; every signed-in account keeps syncing in
  the background, so unread counts stay live while you read another. An account switcher sits at
  the top of the sidebar. Sign-out and re-authentication apply to one account at a time, and a
  composer keeps sending through the account it was opened from.
• Drafts folder. Drafts are cached locally and shown as a sidebar item with a count; double-click
  or Return reopens one in the composer with no round trip, Delete removes it. A draft with a
  composer open is protected from being overwritten or removed by a poll.
• Search, in two tiers. Typing filters instantly across subject, sender, recipients and the cached
  body text of each row; Return (or a thin local result) also asks the server for the current
  mailbox and folder, with a status line showing progress, count, or an offline notice. Matches
  are highlighted in subject and snippet; ⌘F focuses the search field. Server-only results can be
  opened and acted on (archive, trash, star, read) like any other row.
• New-mail notifications. Optional local banners for inbound, unread inbox mail (never on first
  sign-in or a first mailbox listing), grouped when many arrive at once; clicking one switches to
  the right account and opens the conversation. A Dock badge shows the unread total across all
  accounts. Both switches live in Settings → Notifications.
• Attachments in compose: drag-and-drop anywhere on the window, or ⌘V a file or copied image;
  uploads show as chips with a spinner and cancel; Send waits for queued uploads. Limits now match
  the server exactly (25 MiB per file, 25 MiB per draft, 20 files). In the reading pane, Quick Look
  previews an attachment and you can drag it out to Finder.
• Anonymous, opt-out usage analytics (Settings → Privacy) — see README for exactly what is and
  isn't sent. Herald never sends mail content, subjects, addresses, search text, mailbox names,
  account details, file names, or anything you type.

Fixed

• Clearing the search field takes effect immediately instead of after the typing delay.
• A body just opened in the reading pane is searchable at once, even during a sync burst.
• Clicking a new-mail banner while the Drafts folder is open now actually leaves Drafts.

Changed

• Analytics client updated to swift-stats 0.2.0: usage batches are held (not sent) while Low Data
  Mode is on, requests time out instead of hanging, and the local queue survives a full disk by
  falling back to memory. No change to what is collected.

Herald v0.2.1

Fixed

• Some newly arrived messages could still show as a clipped, one-line row until the list was
  scrolled or re-measured — a stubborn case the earlier row-height fix missed. Freshly inserted
  rows now reserve their full height immediately, so new mail always lands at the right size.

Changed

• A development build now runs side by side with the released app without the two signing each
  other out: debug builds use their own Keychain namespace and local cache. Only relevant if you
  run a build from source alongside a released copy.
• Internal quality work with no change to how Herald behaves: spacing, corner radii, and the two
  display glyphs are now design tokens instead of scattered literals; the two largest source
  files were split under the project's size limit; the account store's index lock moved from
  NSLock to os_unfair_lock; and a handful of ignorable error paths are now documented or logged.

Herald v0.2.0

Added

• Delta sync. On HQBase servers that publish the new changes feed (GET /api/v1/changes, shipped
  upstream on 2026-08-18), Herald takes a checkpoint, lists each mailbox once using the new
  paginated GET /api/v1/messages, and from then on applies only what changed — including
  deletions and moves made by other clients — instead of re-listing every folder every 15
  seconds. The sync cursor is saved after every applied page, so an interrupted sync resumes
  where it stopped. Older servers keep the previous behaviour automatically.
• Mailbox access changes are honoured each sync: mail from a mailbox you can no longer read is
  removed from the local cache; a newly readable mailbox is fully listed before its changes are
  applied.

Fixed

• Triage actions can no longer be undone by a stale update arriving from the server while the
  action is still being sent; the server's confirmed state is applied once it answers.
• On servers with pagination, folders with more than 100 messages are now listed completely.

Fixed (continued)

• Signing in no longer expires after a few hours when two copies of Herald share one account
  (for example a released build and a development build): Herald now treats the Keychain as the
  source of truth — it re-checks stored tokens before refreshing or retrying, adopts tokens another
  process already rotated, and only signs you out when the server has genuinely rejected the
  refresh token. Refresh timing is jittered so shared tokens don't collide. (Herald #1 follow-up;
  upstream HQBase/hqbase#41 asks for a server-side reuse window.)
• Deleting a message no longer opens the thread below it; the selection just moves on. (#5)
• A just-deleted (or archived) message appears in Trash/Archived immediately, and the toolbar
  Refresh reloads the view you're looking at. (#6)
• In Trash, "Move to Archive" now works per message (the only way out of Trash the API offers)
  and Herald no longer sends the conversation-level archive/trash actions the server ignores
  there; if the server reports an action affected nothing, the optimistic change is reverted at
  once. A proper "Put back" needs a server action — upstream HQBase/hqbase#42. (#7, #8)