Blip 2.0.0
2.0.0 — 2026-08-31
The "complete for Fred" release: everything on the roadmap that makes Blip
feel like Messages, plus the hardening a stranger needs.
Added
- Contact photos in the sidebar (
imsg avatarstreams the Contacts
thumbnail; cached 7 days under~/.cache/blip/avatars, negative-cached). - Rich-link cards: URL messages render title / summary / preview image /
host, click opens the link; a message that is only the URL shows just the card. - Unread count in the app window title (
Blip (3)). - App window: real gutters, no hero chip, looser sidebar (1.9.3, 1.10.1).
- Dedicated ssh key confined on the Mac to the five bridge tools
(blip-dispatch), with its own ControlMaster socket (1.10.0). automation=switch inbridge.confgating IPC send/read (1.10.0).blip-checkon the Mac + honest failure states in the panel (1.9.0).- Sent files are kept in
~/.blip/sentso your own photos stay showable (1.11.0).
Security / privacy (Codex audit, docs/SECURITY.md)
- Message text never travels in argv on either machine (
--text-stdin,
--text-stdin-bytes,osascriptscript on stdin) (1.9.4, 1.11.0). bridge.confis parsed, never sourced; host validated;ssh --(1.9.4).- Only media/pdf/text attachments reach
xdg-open; auto-fetch has a hard
transfer cap; cache refuses symlinks; catch-up fetch bounded (1.9.4). - Contact names keyed by the last ten digits never pick the wrong person (1.9.4).
Fixed
- SUPER+M dying after every plugin update: Omarchy hot-reload leaves the
old widget answeringqs ipc(reported upstream, omacom/omarchy#9533);
the keybind now decides from Hyprland's client list (1.10.1). - A hidden FloatingWindow is recreated, never re-shown (Quickshell never
re-maps it) (1.8.3, 1.10.1). - Four QML-invariant tests had silently failed since 1.8.0 (1.11.0).