Bolt 0.1.176
This release makes downloads, notes and the browser's saved-login fills say plainly what happened, tightens who and what can reach Bolt on your computer, and keeps the embedded database safer.
What's new
- Finished downloads have Open and Show in folder buttons.
- Pages that serve a file as an attachment now download in place. Before, some of them replaced the tab you were on.
- If a note cannot be saved, Bolt keeps an encrypted recovery copy of your edit and tells you that the edit was not saved. Pending edits are also saved between an update download and the install.
- When a saved login is not filled into a page, Bolt says why. A passkey sign-in handed on to the site says so too.
- Settings asks "Leave without saving?" on Integrations when you navigate away with unsaved changes.
- You can start a new signing key for your share card from the share sheet. Bolt shows the key being retired and where the notice for it is saved.
- An AI request that Bolt refuses for privacy reasons is shown as a refusal in chat and Quick Q&A, not as a generic error.
- Hand-off to the browser extension holds up to five files per person, and the side panel verifies the page it is acting on.
- Vault: "Never" for undo is respected, and clearing the clipboard after a copy reports whether it worked.
- A long text before a | in the chat input no longer breaks the chat input. In chat, | is plain text; the pipe transforms stay in search.
- When the launcher cannot finish a search or an action, it says what failed instead of showing an empty result.
- Administrators: Force model is honored everywhere. When the forced model cannot answer, the request is refused with the reason instead of being answered by another model.
Improvements
- If Bolt's background engine exits while Bolt is starting, Bolt restarts it. It does not restart it after you quit.
- The launcher reads year-first slash dates as dates, and "join meeting" means your next meeting. =tz knows seven more zones.
- The launcher and User Apps refuse network-share and device-namespace file paths.
- The launcher's AI prefixes say plainly that they always block personal data.
- The pairing dialog shows who is asking as reported by the requester, not as verified.
- Desktop sign-in attaches a new identity to this install's owner only when the sign-in was started from the app. On Windows, sign-in waits up to 15 seconds for its local port.
- Calls from HTTP connectors go through the same network safety check as other outgoing requests, so they cannot reach internal addresses.
- User Apps run in a clean environment with a private run folder and process limits. Settings from your own shell no longer leak into them.
- Updated the bundled network and Windows libraries to patched versions.
Security and privacy
- The embedded database password is replaced with a new random one the first time Bolt starts after updating, and connections to it from this computer must use a hashed-password sign-in. Your data is not touched. If the change cannot finish, Bolt says so and how to retry.
- Empty trash and eject all disks run only when you ask for them from the launcher.
- The local connection for the browser extension gives general access only to a paired extension.
- Opening a file or program through the local connection is limited to your home folder and refuses credential locations, for callers other than Bolt itself.
Changes you will notice
- The browser extension must be paired to use the launcher features it used before pairing. In release builds pairing is strict.
Upgrading
Bolt will offer this update automatically. You can also update manually from https://sparcle.app/download/, or via the in-app "Check for Updates" option. Restarting Bolt after updating is recommended.
Thank you for using Bolt. As always, please reach out to support with any questions about this release.
