Sparcle Files

Bolt 0.1.178

This release fixes a launcher slowdown and keyboard-selection problems, restores the AI & Tokens dashboard numbers, keeps Esc and Cmd+R behaving inside Bolt's browser and across reloads, and tightens sign-in, audit and agent-gateway security.

What's new

• The agent gateway now serves agents over HTTPS only, with a local certificate that Bolt creates and you trust once.
• Bolt Apps can show several views and pick the right detail pane for the row you select, and a view can take the word you typed.
• Bolt Apps can declare what they need (hosts, ports, files, programs) in a permissions block, and Bolt checks the declaration against the app.
• Bolt Apps packs are validated through one path before they install. Only approved or author-signed packs install, after you confirm, and the scripts that run are the copies that were checked.
• The =sys app has richer panes: a facts grid, coloured chips, a summary tile, and a failed check reads as failed instead of as zeros.
• The launcher now understands long or misspelled sentences by repairing words against a fixed vocabulary before it interprets them.

Improvements

• App rows show an Enter marker at the end of the row, actions can carry a small icon from a neutral set, and chooser apps pre-fill Back.
• An app with an empty query now runs its next step instead of only pre-filling it.
• A detail pane can show one summary tile above its facts, and coloured chips stay readable on pale and dark label colours.
• Dashboards and reports: the ledger shows readable names and times, top users are named, usage cards say what they cover, and report wording no longer overstates coverage.
• The cost dashboard prices long prompts at the long-prompt rate where a model has one, and names the person behind each audit entry.
• The gateway row in Settings shows what the relay removed or left out of a request, and updating the local certificate asks once.
• The window behind a Zen or full-window switch now takes the page colour in light and dark themes, so the dark flash is gone.

Security and compliance

• Sign-in no longer links an account by an unverified email address. Accounts are matched on the sign-in provider and its stable account identifier.
• The audit log is now a hash chain. Gaps and edits are reported when it is verified, and sealing is bounded so a slow key service can't stall it.
• Sensitive-data screening now covers encoded text, images and attachments, masks a whole private-key block instead of only its first line, and blocks an item it could not finish checking.
• The local API's per-install token no longer reveals stored secrets or emailed one-time codes over HTTP.
• The tunnel now checks where a connection comes from before it can pair a device. Read-only and restricted tunnel modes refuse every tool that changes state.
• Commands run through the agent gateway are classified by a stricter shared policy.
• On Windows, the bundled database now lives in a private per-user folder.
• The bridge audit log is keyed, release signing keys are kept out of ordinary build steps, and one-time-code fill now goes through the desktop app instead of the page.
• An app can no longer point a command or address at Bolt's own local ports, and a command argument can no longer start with a dash.

Fixes

• Typing no longer re-runs the whole search several times per keystroke when an installed app has a recognize pattern. The second keystroke could be slow and show stale results.
• The arrow keys, the highlight, the preview pane and Enter now follow the rows you can see: no more every row highlighted, no row highlighted, skipped rows, or a preview of a result that isn't on screen.
• In clips, Alt+Enter and Tab copy the clip you highlighted, not the one below it.
• Leaving an app or its chip no longer leaves results from your earlier search behind.
• After a reload, the launcher comes back with the scope and query you last had. A scope you cleared stays cleared.
• Esc in Bolt's browser stays with the page, Cmd+Shift+N no longer opens a note from there, and Cmd+R reloads the tab you are on.
• Links to meeting rooms (Google Meet, Zoom, Teams, Webex and similar) now open in your system browser, so your camera and microphone work.
• Saving a label on a Zen timer works again.
• The AI & Tokens dashboard shows your real 30-day usage again. A database read failed and fell back to an empty copy after every restart, so tokens, spend, users and models read zero. The department panel now totals every model, and a failed read is logged and flagged.
• Bolt Apps written for the first manifest version keep showing the way they did, and a pack that would fail to install is refused before you confirm it.

Changes you will notice

• The Bolt Apps gallery ships with no apps in this release. The five sample apps are kept as demos for the website, and apps you already added stay under Installed.
• Bolt no longer opens phone and text-message links from apps in full mode.

Upgrading

• The agent gateway now accepts HTTPS only. An agent that still points at it over plain HTTP gets a clear 426 message: change its base URL to the https address and let it trust Bolt's local certificate. Terminals opened by Bolt are set up already, and Settings > AI Models shows the exact lines for Claude Code, Gemini CLI and Codex.
• Servers that sync users with SCIM need the SCIM organization domains setting filled in.
• Multi-tenant Microsoft Entra sign-in needs the verified-email claims on the account.
• Multi-provider SAML, Okta, Auth0 and generic OpenID Connect sign-in need a list of domains for automatic account relinking.
• Uploaded bundles are limited to 32 MB.

Bolt will offer this update automatically. You can also update manually from https://sparcle.app/download/, or via the in-app "Check for Updates" option. Restarting Bolt after updating is recommended.

Thank you for using Bolt. As always, please reach out to support with any questions about this release.