Claude Studio v1.18.8

"Not secure", even after the certificate is installed

Chrome remembers a Proceed anyway for an address. Once you have tapped through the warning — which anyone does while the certificate really is broken — the page keeps its degraded state afterwards: no padlock, no service worker, no Install app, and Add to Home screen can only make a shortcut. Nothing tells you that the state is a memory rather than a fact, so every fix aimed at the certificate appears to change nothing.

The setup page now explains it and gives the test that tells the two apart:

• Open the page in an Incognito tab — it carries none of that memory. A padlock there means the setup is sound.
• Then clear the old decision: address-bar warning → Site settings → Clear & reset, and come back through the QR code (the reset takes the token cookie with it).

Claude Studio v1.18.7

Fixes the phone app being completely dead in v1.18.6

v1.18.6 introduced a function whose name the file already used. Duplicate top-level declarations are legal in a classic script and a SyntaxError in a module — and the phone's app.js is loaded as a module, so nothing in it ran. The page loaded its stylesheet, painted an empty shell, requested no sessions, and looked exactly like a certificate, network or cache problem.

• Fixed: the phone app loads again.
• The build now checks it. Every JavaScript file the bridge ships is parsed in the right mode before packaging — node --check parses modules as classic scripts, which is precisely why this shipped.
• The app reports its own errors to the Mac's bridge log, registered before anything else runs, so a failure during startup says what it was instead of leaving a blank screen.

Claude Studio v1.18.6

It was never the certificate

Chrome verified the issuer and still called the page insecure — because the page contained resources loaded over plain http. Mixed content withdraws precisely what the certificate was installed for: no service worker, no Install app, no notifications, and a missing padlock as the only visible symptom.

• The secure listener now sends upgrade-insecure-requests, so a stray http subresource is fetched over https instead of poisoning the page — whatever wrote the URL.
• The app reports any resource it loaded over http to the Mac's bridge log. The browser knows which one it was; a phone has no console to ask it from.

Claude Studio v1.18.5

The certificate fix now reaches existing installs

v1.18.4 changed how certificates are issued — and changed nothing on any Mac that already had one. The reissue test only asked whether the address had changed, so the improved script sat next to the old certificate and every symptom survived the update meant to end it.

• An issue policy is stamped beside the TLS material; when it changes, the certificate is reissued.
• The certificate's subject now names the server rather than repeating the root's own name. A leaf whose subject looks like its issuer's is what a path builder treats as self-signed — and the chain it then fails to build is reported as nothing more specific than "not trusted".

After updating, the bridge restarts and issues the new certificate by itself. On the phone: reload the page; it should show a padlock, and Install app appears in Chrome's menu.

Claude Studio v1.18.4

When Chrome says "Not secure", nothing else can work

That one fact explains the whole chain: a page the browser distrusts registers no service worker and installs no app, so Add to Home screen can only ever produce a Chrome shortcut. No amount of tapping turns it into an app.

• The certificate is now issued the way a strict validator wants it: keyUsage, a subject key identifier, and a 397-day life instead of 800. The 398-day ceiling is written for publicly trusted certificates and a local root should be exempt — but that is not worth betting on when the failure mode is silent. It is reissued automatically within a month of expiry.
• The setup page stops pretending it can tell. A trusted certificate and one waved through with Proceed anyway both open the connection, and the page could not distinguish them. The certificate download now stays available even on the "trusted" screen.
• It names the trap: Android also offers to install certificates for Wi-Fi, and one filed there is invisible to Chrome. The page says to check Settings → Security → Encryption & credentials → Trusted credentials → User for "Claude Studio Bridge".

Claude Studio v1.18.3

Better answers when the phone will not cooperate

• The setup page's connection test no longer reports a CORS failure as if it were a certificate problem. The page is served over http and the target is https, so a readable cross-origin answer was never possible; one no-cors probe answers the real question — reachable and trusted, or not.
• The app now reports the origin it loaded from to the Mac's bridge log, once per load. A page over https with no address bar (an installed app — correct) looks exactly like a page over http (a dead end where nothing can be installed and no notification is delivered). The log tells them apart.

Claude Studio v1.18.2

When the secure version will not open

The setup page can now test the secure connection and say what actually happened, instead of leaving you with "it does not work". The same answer is written to the Mac's bridge log, so it can be read afterwards.

It also names the trap that looks like a bug: if that address is already installed on the Home Screen, Android hands the link to the installed app — which opens with no address bar and reads exactly like "it opened the plain version". Chrome then offers no Install entry either, because there is nothing left to install. Remove the icon and install again.

Typing the address by hand needs the port (:7443); the page prints it.

Claude Studio v1.18.1

The setup page was unusable on a phone

• It could not scroll. The shared stylesheet locks the page for the app shell; the setup page inherited it, so its lower half was unreachable.
• The link at the bottom edge was the wrong one. "Skip — just open the terminal" is relative, so it opens over plain http — the one page that can never install an app or deliver a notification. It now disappears as soon as the certificate is trusted.
• The button says where it goes. The secure address is printed under it. This page exists to move the phone from http to https; that should not require trust.
• One thing to do at a time, and the page names the Mac it belongs to.

Update the Mac, then reload the setup page on the phone (the QR code opens it).

Claude Studio v1.18.0

Which phones get your notifications

Settings → Phone now lists every device subscribed to notifications — what it is, which address it subscribed from, when it was added — with a Revoke button next to each.

This exists because a subscription outlives the app that created it:

• Deleting the web app from your Home Screen tells the Mac nothing. The browser keeps the service worker, so notifications keep arriving from an app you think you removed.
• Installing from two addresses (the old IP, the new mesh name) means two subscriptions — and two of every notification.

Neither is fixable from the phone. Revoking here stops the next notification immediately; the phone can always subscribe again by reopening the app.

Devices that subscribed before this release show "origin unknown" — the address was not recorded until now. New subscriptions name theirs.

Claude Studio v1.17.0

Phone access installs itself

No repository, no terminal. Settings → Phone → Install now does the whole thing on this Mac: it installs what the bridge needs (node, ttyd, tmux) through Homebrew with the output on screen, generates the access token, and registers a background service that starts with the Mac. The bridge ships inside the app and runs from a copy in Application Support, so moving or deleting a git checkout no longer kills it — and an app installed from a release can offer the feature at all.

• Check answers instead of recomputing silently: "Netbird is up at (), and the bridge is listening", or exactly why it is not.
• Updating Claude Studio refreshes an installed bridge by itself.

One phone, two Macs

The phone is now pointed at the mesh hostname rather than the IP address. An installed web app is bound to its origin and the address is the part that changes — when it did, the icon on the Home Screen died with no address bar to fix it from.

Each Mac therefore publishes its own origin, and installs as its own app: named after that machine, with a differently tinted icon and a root certificate that says which Mac it belongs to.

Upgrading: press Install once (your token and certificate root are kept — no phone has to trust anything again), then scan the QR code and add it to the Home Screen one more time, because the address moved from the IP to the name.

Answer from the notification

When a session hands the turn back on a numbered choice — "1. Yes 2. Yes, and don't ask again 3. No" — the notification now carries those choices as buttons. Tapping one sends the answer straight to the session: no app launch, no terminal, no keyboard. Android shows two (the first option and the last); on iOS the notification still opens the session as before.