Blip 2.3.1 — it looks like Messages now

The release where Blip stops looking like a terminal widget.

The font

Omarchy resolves its font family to JetBrainsMono system-wide, so every label in Blip was monospace — and that was reading as "not Messages" harder than any spacing or width. Blip now uses SF Pro Text, the family Messages itself ships with, when this machine has it.

Qt.fontFamilies() decides, deliberately: asking for a missing family does not fail, it silently gives you some default sans, which is a worse wrong answer than your theme font. So if you do not have SF Pro, nothing changes for you. ui_font=theme in bridge.conf opts out even where it is installed.

The rest of the look

• The popout is 20% narrower (440 → 352). Messages' sidebar is a column, not a file browser.
• Previews wrap to two lines instead of eliding at one — the single most recognisable thing about the Messages sidebar.
• The name is semibold always. Unread is carried by the blue dot and the blue timestamp, not by the name changing weight under you.
• Row stamps follow Apple's rule: a clock today, then Yesterday, then the weekday for the past week, then a date. It had been printing date-plus-clock for everything older than today, which is a mail-client habit.
• No numbers under the pinned tiles, and conversation rows are left-justified again — the 1–9 hint reserved a fixed-width column at the head of every row that stayed blank once nine pins owned the digits. 1–9 still jumps.
• Slightly larger avatars, closer to Messages' proportions.

Fixes

• Green threads send on their own service. A DM carried the last bubble's service, so a failed iMessage to someone on SMS retried iMessage and failed again — the thread stuck, and stayed stuck. It now follows the last inbound message, and a failed iMessage to a phone number means SMS next. 147 of the maintainer's DM threads were affected. Thanks @lukejmorrison (#4).
• Pinned tiles no longer pop in a beat late. Pin metadata only arrives on deep polls, and every shallow poll was replacing the list with unpinned rows. The first poll after a shell restart is now deep, so the panel opens complete. Thanks @adamgamble (#22).

Upgrading

omarchy plugin update nixfred.blip

No Mac-side changes since 2.3.0. If you ran the install one-liner for that release, your gateway is already current.

294 tests. Full detail in CHANGELOG.md.

Blip 2.3.0 — the contributors' release

Six people who had never touched this repo sent 8 pull requests in 24 hours. This release is mostly theirs.

From contributors

• @adamgamble — iPhone photos land upright, and stay upright in your image viewer because the orientation is baked in at fetch rather than only honoured by Blip (#9). The bubble tail is a per-corner radius instead of a translucent rectangle stacked on itself (#10). Family Sharing child address books stop outvoting your own contacts on every name — with two kids, two cards saying "Mom" beat one saying "Monica" (#19).
• @Fileri — Messages' own announcement rows (someone joined, a rename, location sharing) stop counting as unread forever. There were 811 of them on the maintainer's Mac, the oldest from 2021 (#14). Bubble times, receipts, day dividers and the list now follow Qt format strings on the widget's shell.json entry, the way Omarchy's clock does (#15).
• @johanthoren — the app window honours n, / and Esc like the popout, both fields search as you type, conversations rank above messages (#12). A bare 1–9 jumps to that conversation (#13). The window fills like every other Omarchy window (#7).
• @ezachrisen — pinned conversations mirrored from Messages, in Messages' order, read-only (#11).
• @tolewis — one chat row per group, so a group that moved between iMessage and RCS stops failing to send with -1728 (#8).
• @dreinecke (#16) and @znayer (#17) reported two bugs with the cause already located, and both fixes are here.

Also in this release

• Reads reach the Mac, and your phone. Blip's "mark all read" cleared the badge on Linux and nothing else. This was listed as impossible, on the strength of one experiment that tested something else: open imessage://… genuinely does not flip is_read, but Messages has carried a Conversation ▸ Mark All as Read menu item since Ventura, and a menu item is scriptable. Needs Accessibility for sshd-keygen-wrapper; push_read= in bridge.conf controls it.
• Every link gets a preview card. Apple decorates some links and leaves most bare — 7 of 27 on a real Mac. Blip now fetches the page and builds the card from its Open Graph tags, with an http(s)-only, redirect-checked, private-address-refusing fetcher.
• A share sheet on any link — open, copy, a QR code your phone can scan, or send it to another device via LocalSend. It opens itself for a link you send or receive.
• Group photos, instead of a group wearing whichever member spoke last.
• A re-keyed group is one conversation again. Messages writes a new chat row when a group is re-keyed; Blip listed it twice.
• Short-code SMS threads (banks, utilities, 2FA) open instead of coming up empty.
• Multi-photo messages arrive. The auto-fetch gate measured the source bytes while the ceiling judged the converted ones, and a 5 MB HEIC becomes a 7.8 MB JPEG, so full-size photos were rejected at both ends.
• README screenshots of invented people, rendered by pointing the shipping code at a fake bridge (scripts/demo/blip-shots).

Upgrading

omarchy plugin update nixfred.blip

Mac side: re-run the install one-liner. imsg, contacts and blip-check all changed, and there is a new tool, imsg-read.

282 tests. Full detail in CHANGELOG.md.

Blip 2.2.0 — verified fixes

The war-room judge panel re-ran against 2.1.6 (three lenses per finding):
11 earlier fixes confirmed closed, 17 findings confirmed open. This release
fixes 13 of them; the rest stay listed in ROADMAP.md.

Multi-monitor. Omarchy builds one bar — and one Blip widget — per
screen. Only the widget on the first screen now polls, watches, toasts,
owns the app window and answers IPC; the others show the badge from
state.json and forward clicks to it. (Previously: N pollers, N ssh
watchers, duplicate toasts and windows.)

Sends. SMS/RCS conversations go out on their own service instead of
silently as iMessage (text and files). A refused send now shows the Mac's
reason ("message too long", "not authorized"…) instead of "exit 1".

Reads. The app window marks a conversation read only while it is the
focused window — visible on another workspace no longer clears dots.
Mark-all-read / middle-click / IPC refresh keep the full list when a
surface is open (a shallow run used to collapse it to the preview window).

Correctness. A DM loads by exact chat id (thread --chat) so a
contact's group posts no longer eat the history window. A DM is persisted
as a "self chat" only after two independent same-second twins, not one
coincidence. Failed-send toasts fired every poll for 15 minutes because the
dedupe ring dropped their fail: prefix on load.

Robustness. A bun that cannot start is reported as such (not "Mac
unreachable"); the offline poll backs off to 30 s; the push watcher's
liveness timer arms at start.

Config. country_code= in bridge.conf for numbers typed without a
country code outside North America.

Docs. README no longer promises a headless Mac without a logged-in
session; the last real-looking number left the code; a duplicated README
block removed.

Blip 2.1.6

Duplicate desktop notifications for one message fixed: the bridge now emits each message's ROWID and the toast key no longer depends on the message text. Re-run scripts/blip-setup (or copy bridge/mac/imsg to the Mac) so the Mac side updates too.

Blip 2.1.5 — hotfix

2.1.4 shipped a QML syntax error in the new link-opening code that broke both the popout and the app window. Fixed. If you installed 2.1.4: omarchy plugin update nixfred.blip && omarchy-restart-shell.

Blip 2.1.4

• Clicking a link opens it AND brings the browser to the front (Omarchy runs focus_on_activate=false; tabs were opening on another workspace).
• Text selection + Ctrl+C in bubbles (2.1.1); contact-name regression fixed (2.1.2); repo scrubbed of maintainer identifiers (2.1.3).
• README Install rewritten around omarchy plugin add … --enable, with notes for humans and for AI agents; AGENTS.md added.

Full notes: CHANGELOG.md

Blip 2.1.0 — war room

Ten expert-lens reviewers swept the repo after the DHH retweet; 114
findings, the clear ones fixed here, the rest on the roadmap.

Fixed — correctness

• Attachment-cache eviction had silently never run since 1.9.4 (a missing
  statSync import threw inside the LRU). 500 MB cap is real again.
• A DM thread admitted that person's messages from group chats.
• Catch-up fetches could exceed Bun's default 1 MB spawnSync buffer and
  fail sticky; all bridge calls now allow 64 MB.
• A timed-out imsg (Mac asleep behind a live ssh mux) read as a bridge
  bug; it now reads as "Mac asleep" and greys the icon.
• Bridge errors show the last stderr line (Python puts the cause last),
  not "Traceback (most recent call last):".
• state.json is fsync'd before rename (a power cut no longer resets every
  read mark). Cache temp names carry entropy (no EEXIST after pid reuse).
• Link cards: $null titles, URLs with (…) (Wikipedia), and userinfo
  host-spoofing handled. Inline-reply snippets respect Recently Deleted.
• macOS 12 and earlier: imsg no longer dies on the missing
  Recently-Deleted table.
• Avatar initials for whitespace-only names; non-ASCII attachment names
  survive sanitizing; sent files keep their extension.
• wait_for_copy matches only attachment rows newer than the send
  (same-name re-sends no longer confuse it); a send whose copy was never
  observed is kept in ~/.blip/sent instead of deleted an hour later.

Fixed — security / privacy

• File-send captions no longer appear in any process's argv
  (--caption-stdin). A cut ssh stream can no longer deliver a truncated
  file (--file-bytes N is enforced on the Mac).
• Cache file extensions follow the gated MIME type, not the sender's
  filename (xdg-open dispatches on extension).
• tcc-check removed from the confined key's allowlist.
• blip-setup no longer sources bridge.conf, no longer echoes a message
  body into the terminal, guards the authorized_keys append with a
  newline, keeps a hand-set automation= on re-run, drops the ssh master
  before re-checking grants, and names a missing Xcode CLT instead of
  misdiagnosing Full Disk Access. install.sh fails loudly on the CLT stub.
• Consent banner prints only on a TTY (recipients no longer reach journald).
• A real phone number and email were removed from a public test fixture.
• Transient bridge failures no longer write a 7-day "no photo" marker.

Changed

• Users' dashes are sent as typed (--keep-dashes everywhere).
• xdg-open and the window-state writer run detached (a blocking handler
  or a mid-write hide could swallow later clicks / the hidden state).
• IPC compose refuses when the popout is closed.
• The shim's offline message includes the ssh reason.
• sync-bridge.sh stages upstream copies beside locally-modified tools
  instead of overwriting them.
• Tests are isolated from the developer's real caches (bunfig.toml
  preload sets XDG_CACHE_HOME).

Blip 2.0.4

Fixed

• blip-check probed a single, unordered Contacts source; a stale CardDAV
  .abcddb sorting first produced a false "contacts ❌ — grant Full Disk
  Access" during blip-setup even though contacts and avatars worked. It now
  probes every source like the contacts tool does and fails only when none
  opens. First outside contribution — @jethrojones (#2). Thank you.

Repo

• CI on every push and PR (bun test, Mac tools byte-compile, shellcheck),
  CONTRIBUTING, issue/PR templates, security policy, GitHub Releases.

Blip 2.0.3

• 2.0.1 — contact photos resolve for everyone (a person in several Contacts sources is one person, not ambiguity)
• 2.0.2 / 2.0.3 — translucent app window (70% backdrop; Hyprland blur shows through)

Full notes: CHANGELOG.md

Blip 2.0.0

2.0.0 — 2026-08-31

The "complete for Fred" release: everything on the roadmap that makes Blip
feel like Messages, plus the hardening a stranger needs.

Added

• Contact photos in the sidebar (imsg avatar streams the Contacts
  thumbnail; cached 7 days under ~/.cache/blip/avatars, negative-cached).
• Rich-link cards: URL messages render title / summary / preview image /
  host, click opens the link; a message that is only the URL shows just the card.
• Unread count in the app window title (Blip (3)).
• App window: real gutters, no hero chip, looser sidebar (1.9.3, 1.10.1).
• Dedicated ssh key confined on the Mac to the five bridge tools
  (blip-dispatch), with its own ControlMaster socket (1.10.0).
• automation= switch in bridge.conf gating IPC send/read (1.10.0).
• blip-check on the Mac + honest failure states in the panel (1.9.0).
• Sent files are kept in ~/.blip/sent so your own photos stay showable (1.11.0).

Security / privacy (Codex audit, docs/SECURITY.md)

• Message text never travels in argv on either machine (--text-stdin,
  --text-stdin-bytes, osascript script on stdin) (1.9.4, 1.11.0).
• bridge.conf is parsed, never sourced; host validated; ssh -- (1.9.4).
• Only media/pdf/text attachments reach xdg-open; auto-fetch has a hard
  transfer cap; cache refuses symlinks; catch-up fetch bounded (1.9.4).
• Contact names keyed by the last ten digits never pick the wrong person (1.9.4).

Fixed

• SUPER+M dying after every plugin update: Omarchy hot-reload leaves the
  old widget answering qs ipc (reported upstream, omacom/omarchy#9533);
  the keybind now decides from Hyprland's client list (1.10.1).
• A hidden FloatingWindow is recreated, never re-shown (Quickshell never
  re-maps it) (1.8.3, 1.10.1).
• Four QML-invariant tests had silently failed since 1.8.0 (1.11.0).