Bromure Agentic Coding 5.4.1

Highlights

• Unread marks on sessions. A session whose agent finished a turn or is asking you something gets an unread mark in the session list until you look at it. Reading is shared: what you read on the Mac, a remote client or an iPhone/iPad shows as read everywhere. Works for every agent (Claude, Codex, Grok, Kimi, omp), in rooms and on Sidecar machines.
• Restore at next start. When you quit with workspaces running, the confirmation offers "Restore these workspaces and their sessions at next start" (your last answer is remembered). At the next launch they come back one at a time, then their sessions resume, in a small panel with a progress bar and a Stop button. A start that dies while restoring never restores a second time, and a plan more than two weeks old is dropped.
• Cloud credentials the VM mints stay on the host. When a workspace calls an API that issues a credential — AWS STS (AssumeRole, GetSessionToken, GetFederationToken…), SSO, Cognito, iam CreateAccessKey, ECR login, DigitalOcean registry, Kubernetes and Spaces keys — the VM receives a fake and the real credential is kept on the host, swapped in only on its own service. docker login and SigV4 signing keep working. The credentials survive a reboot of the workspace.
• Compromised workspaces explained. The red triangle now says why the workspace was marked. From the sidebar (right-click or the "…" menu) you can Wipe and Restore… (erase without booting) or Clear Compromised Mark… for a false alarm. This also works from a remote client, which previously could miss Start's question and appear to do nothing.
• Workspace notes in markdown. The VM dashboard shows the workspace's notes rendered as markdown and lets you edit them in place: Return saves, Shift-Return or Option-Return adds a line, Esc cancels. The sidebar shows the notes' opening lines as a tooltip. Thanks to @mobalt (#60).
• Smaller homes. A new workspace's home now defaults to 16 GB instead of 64 GB, and grows on demand from the Resources pane.

GitHub issues fixed

• #56: under OpenShell + Sentry, a home resized in the Resources pane now actually grows at the next boot (the size probes ran inside the sandbox, where they were refused). The legacy-home migration's progress had the same problem and now gets its total.
• #57: a workspace whose home image doesn't exist yet (new, or just erased) can be given a home as small as 8 GB; the field used to stop at the 64 GB default. Once the image exists, its size is the floor, as before. To shrink a home: Erase home…, then pick the size — the editor now follows the erase without being reopened.

New

• VM dashboard notes: a Notes card is always there ("(empty)" when there are none), and a settings save shows on the dashboard at once, also on a remote client.
• Network tunnel (remote client): when the privileged network helper can't be reached, the alert explains why (socket owner, a job registered from another copy of the app, a job that exits at once, not loaded…) instead of a generic "check Login Items".

Security

• Minted credentials: the real secret from a credential-issuing API call no longer reaches the VM, raw or JSON-escaped; a response that can't be fully accounted for becomes a 502. Calls that set a secret the VM chose (iam CreateLoginProfile, UpdateLoginProfile, service-specific credentials) are refused in every guardrail mode. Dual-stack, other AWS partitions and public.ecr.aws are covered.
• Network tunnel helper: the privileged helper now routes only a private /24 (in 10/8, 172.16/12, 192.168/16 or 100.64/10) that no other route covers, serves only a genuine Bromure app, and holds at most 16 tunnels. Previously any process of the logged-in user could ask it to pull all of the Mac's traffic into a tunnel.
• Sign-in and OAuth callbacks:
  • A guest can no longer take over another workspace's OAuth loopback listener (e.g. Codex's fixed port 1455) and receive its sign-in code.
  • A sign-in page whose redirect port is held by another workspace is never opened; the sign-in fails visibly instead.
  • A sign-in URL that points at this Mac or its local network is refused and ends the sign-in, on the Mac and in Bromure Remote (iPhone, iPad, Vision Pro). Hosts are read the way a browser reads them: 0x, zone ids, IPv4-mapped and Unicode spellings of loopback all count.
• Automations: nothing a process in the VM sends can revive a refused run, finish a failed review, move the review mark or fire chained automations.
• Sandbox drawer: Allow grants the program the block was for, not whichever program dialed the same address later. A second program with the same file name (/usr/bin/curl vs /tmp/curl) gets its own rule. The badge counts the rows the drawer lists.
• Policy notes to the agent: a guest can no longer fill the attribution slots so that the real agent's notes and denials go unattributed.
• Sandbox apt requests: stopping an install also catches a child that daemonized itself; the install lock is no longer released while it still runs as root.
• Kubernetes trust: each API endpoint (host and port) has its own cluster CA and client certificate. A CA that fails to parse no longer republishes a removed context's CA.
• Compromise wipe: a wipe now also erases the boot checkpoints (so Rewind can't restore the contaminated disk), the EFI variable store and the saved-state fingerprint, and keeps the mark until everything is gone. A wipe and a clear running at the same time can no longer undo each other while both report success.
• Kernel sentry: sends on the obsolete SOCK_PACKET socket API are now reported, and raw-socket events name the right interface inside the VM's network namespace.
• Attestor: a self-updated agent running a deleted executable (e.g. npm Claude Code) is identified correctly instead of breaking the whole process chain.
• vm run --rm: an ephemeral workspace is marked on disk, deleted if a quit, signal or crash interrupts it, kept through a reboot, and never touched by another Bromure process.
• 1Password: a credential changed into an op:// reference no longer keeps the previous secret for the session, and a refresh writes only its own credential's entries.

Fixes

• Crash when playing a video in a session's video card: the app now links AVKit (the iOS client had the same gap for videos and the photo picker).
• show_media: a picture in the home folder or a shared folder shows again; only files in /tmp used to work. send_file had the same problem.
• Network tunnel (remote client): the privileged helper is reachable again after a reboot; it used to work only if it had started inside a login session.
• Memory: long-running relays, MITM loops and vsock bridges no longer hold on to memory for the life of a connection or VM. A slow remote client can no longer make the SSH bridge balloon (a 7.7 GB peak was seen), and the remote client's dialer no longer buffers everything when the server stops reading.
• Strict OpenShell sandbox: flows allowed by a binaries:-scoped rule work again. Brought up to OpenShell v0.1.5 (path selectors, refused upgrades on inspected routes, OCSF fields).
• Kubernetes: bearer and exec tokens for an API server on a non-443 port are swapped again (the server answered 401).
• 1Password: a failing reference is reported once, not again on every credential save.
• Detectors (PromptGuard, rules model, PII): loading a model no longer ties up the app's shared threads. While a model is loading, the proxy asks the agent to retry for the first 30 s, then waits.
• Session cards show "now" only while the agent is working; Sidecar sessions count from their last turn, not from when they were created.
• Workspace notes: a settings save no longer overwrites notes edited on the dashboard meanwhile (nor the Squelch switch), a save that lost to a newer one shows the notes that won, and a remote client's saves go in order.
• Sign-in: a refused workspace sign-in ends at once instead of blocking a retry for five minutes; a stopped VM frees its sign-in port.
• Worktrees: the "Worktree action failed" sheet appears only for a refusal that stands.

Full changelog: agentic-coding-v5.4.0...agentic-coding-v5.4.1