Pin today's GitHub behaviour before adding GitLab

.claude/skills/bloom-dev-build/SKILL.md

@@ -41,9 +41,9 @@ changes merely to try them locally. Fast mode cannot be combined with a revision
    `xcode-select -p` and `xcrun swift --version` when setup is uncertain. Signing is ad hoc by default;
    no release certificate or notarisation credentials are needed. Running App Intents through
    Shortcuts requires a real signing identity.
-3. Run the selected command. Only restart the dev app when authorised. `make dev-fast` and
-   `make dev` both quit and relaunch the dev copy. `--no-launch` still replaces the installed bundle;
-   an already running copy does not switch to the new code until restarted.
+3. Run the selected command. Bloom Dev may be restarted as needed, as described in `CLAUDE.md`.
+   `make dev-fast` and `make dev` both quit and relaunch the dev copy. `--no-launch` still replaces
+   the installed bundle; an already running copy does not switch to the new code until restarted.
 4. Verify the bundle at the path printed by the script. With `--no-install`, use that build path;
    otherwise use `~/Applications/Bloom Dev.app`. Check its `Contents/Info.plist` and signature:
    - `CFBundleIdentifier` is `be.spatie.bloom.dev`.

.github/workflows/test.yml

@@ -107,6 +107,9 @@ jobs:
       - name: Check the house rules
         run: ./Tools/house-rules.sh
 
+      - name: Check the browser client script
+        run: node Tools/check-local-web-client.mjs
+
       # And the rules that are the language's rather than ours, which is the other half.
       # `.swiftlint.yml` is tuned rather than default: the head of that file has the counts every
       # disabled rule produced and why each one is off.

CLAUDE.md

@@ -324,16 +324,17 @@ have to, and names the file and line.
 The owner is sitting at this Mac, working, while you run. Anything that takes focus, moves the
 pointer, opens or closes a window, launches or quits an application, or puts a window in front of
 what he is reading is an interruption to a person, not a step in a task. **Ask before doing any of
-it.**
+it, except for restarting Bloom Dev as described below.**
 
 Needs permission every time: launching an app in a way that activates it (`open -g` does not, and
 is the one to reach for), `NSApp.activate` or anything that makes a process frontmost, quitting or
-signalling any application, sending a keystroke or a click or any synthetic event, capturing or
-recording the **display**, changing a system setting including the appearance, and opening a
-browser or an editor.
+signalling an application other than Bloom Dev, sending a keystroke or a click or any synthetic
+event, capturing or recording the **display**, changing a system setting including the appearance,
+and opening a browser or an editor.
 
 Needs no permission: offscreen rendering, anything headless, and capturing **your own** window by
-its window id after opening it with `open -g`.
+its window id after opening it with `open -g`. Agents may quit and relaunch Bloom Dev as needed for
+development. Relaunch it with `open -g` so it does not take focus.
 
 If a piece of work cannot be verified without one of these, say so and stop. An honest "I could
 not photograph this" is a better outcome than an interruption, and it is what several agents have
@@ -356,7 +357,7 @@ existing dev data, and restart only the dev copy. Fast mode cannot be combined w
 
 For agent verification without installation or launch, use
 `./Tools/dev-build.sh --fast --no-install`. To install without restarting, use
-`./Tools/dev-build.sh --fast --no-launch`. Restarting the dev app still needs authorisation.
+`./Tools/dev-build.sh --fast --no-launch`.
 See `.claude/skills/bloom-dev-build/SKILL.md` for the full workflow.
 
 **Bloom Dev has its own identity:** bundle id `be.spatie.bloom.dev`, and with it its own

README.md

@@ -40,11 +40,42 @@ account. Agent CLIs use their own authentication and provider connections.
 
 Workspaces live under `~/bloom/workspaces.noindex` by default. The `.noindex` suffix keeps Spotlight
 from indexing every worktree. Bloom also supports multiple chats in one workspace, reusable quick
-prompts and subagents that work in the same branch. **Ask Bloom** is a separate conversation area
-for questions that do not need a worktree.
-
-Useful shortcuts include Cmd+N for a new workspace, Cmd+P to search files in the current workspace
-and Cmd+T for a new conversation. See [the menu reference](docs/MENUS.md) for the full list.
+prompts and subagents that work in the same branch. Conversation workspaces appear below projects
+in the sidebar and need no project, Git repository or worktree.
+
+Useful shortcuts include Cmd+N for a new workspace, Cmd+J for a project-free conversation and
+Cmd+P to search files in the current project workspace. See [the menu reference](docs/MENUS.md)
+for the full list.
+
+### Browser access (alpha)
+
+Browser access is in alpha and may change or be removed at any time. Bloom can show conversations
+in a browser while the Mac app is running. The browser can send
+prompts, create projects and workspaces, and inspect transcripts and file references. Some Mac
+features, including native diff review and terminal panes, are not available there yet.
+
+On the same Mac, open **Settings > Browser Access**, enable **Allow browser access**, then choose
+**Open in Browser**. Bloom opens a one-use link, so you do not need to type an access code. Bloom Dev
+also accepts direct connections to `http://127.0.0.1:53544` on the host Mac without a code.
+
+To open Bloom from a phone or another computer through Tailscale:
+
+1. Install [Tailscale](https://tailscale.com/docs/install) on both devices and sign in to the same
+   tailnet. Keep Bloom running on the Mac.
+2. In Bloom's Browser Access settings, enable access and expand **Manual connection**. Note the
+   port in the address and use **Copy Code** for the access code.
+3. In Terminal on the Mac, run `tailscale serve --bg PORT`, replacing `PORT` with the port from
+   Bloom. For example, Bloom Dev uses `tailscale serve --bg 53544`.
+4. Tailscale prints a private HTTPS address such as `https://your-mac.your-tailnet.ts.net`. Open
+   it on the other device and enter Bloom's access code. [Tailscale Serve](https://tailscale.com/docs/features/tailscale-serve)
+   keeps this address within your tailnet.
+
+The hostname names your Mac in Tailscale, not a separate Bloom account. You can [rename the Mac in
+Tailscale](https://tailscale.com/docs/concepts/machine-names) if you want a shorter hostname. The
+regular Bloom app chooses a new browser port and access code when it restarts. If the port changes,
+run `tailscale serve --bg PORT` again with the new port and use the new access code. Bloom Dev keeps
+port 53544, but its remote connections still require the code. To stop remote access, run
+`tailscale serve off` on the Mac or turn off browser access in Bloom.
 
 ### Repository settings
 

RELEASING.md

@@ -73,9 +73,9 @@ you ticked the box on. Either one puts the item on Sparkle's `beta` channel,
 which nobody sees unless the app asks for that channel.
 
 The version in the bundle comes from the tag, not from `Resources/Info.plist`.
-The build number is 2132 plus the number of commits reachable from the tag. The
-offset preserves update order after the repository history was reset. Sparkle
-compares that number, which is why the workflow checks out with full history.
+The build number is the number of commits reachable from the tag, including the
+restored release history. Sparkle compares that number, which is why the workflow
+checks out with full history.
 
 To retry a release, prefer rerunning its original release-event workflow with
 `gh run rerun <run-id>`. This preserves the GitHub prerelease flag and asset attachment step.

Sources/Bloom/BloomApp.swift

@@ -83,6 +83,7 @@ struct BloomApp: App {
         // resize. It is how somebody finally watches the transcript go blank. See `ComposerProbe`.
         if ComposerProbe.isRequested { ComposerProbe.schedule() }
         if TranscriptLayoutProbe.isRequested { TranscriptLayoutProbe.schedule() }
+        if TranscriptAppendProbe.isRequested { TranscriptAppendProbe.schedule() }
         if CommentFocusProbe.isRequested { CommentFocusProbe.schedule() }
         if MessageArrivalProbe.isRequested { MessageArrivalProbe.schedule() }
         if ArchiveFailureProbe.isRequested { ArchiveFailureProbe.schedule() }

Sources/Bloom/Design/ComposerPickerGallery.swift

@@ -66,7 +66,7 @@ struct ComposerPickerGallery: View {
 
             VStack(alignment: .leading, spacing: Metrics.pane) {
                 panel(
-                    "Ask Bloom, where the footnote is the one thing left in it",
+                    "A conversation, where the footnote is the one thing left in it",
                     options: permissionOptions(on: .claudeCode),
                     selection: PermissionMode.auto.rawValue,
                     heading: "Permission mode",

Sources/Bloom/Design/Confirmation.swift

@@ -12,6 +12,8 @@ struct ConfirmationSheet: View {
     let confirmation: Confirmation
     let onConfirm: () -> Void
     let onCancel: () -> Void
+    /// Shown only when the question has a third answer, such as trying a failed step again.
+    var onAlternative: (() -> Void)?
 
     /// Which button the keyboard is on. It starts on the safe one, and `Keys` says why that is
     /// not a detail.
@@ -61,6 +63,7 @@ struct ConfirmationSheet: View {
         case .standard:
             VStack(spacing: Layout.betweenButtons) {
                 confirmButton
+                alternativeButton
                 cancelButton
             }
             .padding(.horizontal, Layout.buttonInset)
@@ -102,6 +105,17 @@ struct ConfirmationSheet: View {
         .focused($focus, equals: .confirm)
     }
 
+    @ViewBuilder
+    private var alternativeButton: some View {
+        if let label = confirmation.alternativeLabel, let onAlternative {
+            Button { onAlternative() } label: {
+                Text(label).frame(maxWidth: .infinity)
+            }
+            .buttonStyle(.bordered)
+            .controlSize(.large)
+        }
+    }
+
     /// The answer that changes nothing, and the one Escape is wired to.
     private var cancelButton: some View {
         Button { onCancel() } label: {
@@ -249,6 +263,8 @@ struct Confirmation: Equatable, Sendable {
     var cancelLabel: String
     var tone: ConfirmationTone = .destructive
     var layout: ConfirmationLayout = .standard
+    /// A third answer between confirming and cancelling. Drawn by the standard layout only.
+    var alternativeLabel: String?
 }
 
 enum ConfirmationLayout: Equatable, Sendable {
@@ -301,6 +317,7 @@ extension View {
         _ item: Binding<Item?>,
         _ question: @escaping (Item) -> Confirmation,
         onConfirm: @escaping (Item) -> Void,
+        onAlternative: ((Item) -> Void)? = nil,
         onCancel: @escaping () -> Void = {}
     ) -> some View {
         sheet(isPresented: item.isPresent()) {
@@ -314,6 +331,12 @@ extension View {
                     onCancel: {
                         item.wrappedValue = nil
                         onCancel()
+                    },
+                    onAlternative: onAlternative.map { alternative in
+                        {
+                            item.wrappedValue = nil
+                            alternative(value)
+                        }
                     }
                 )
             }

Sources/Bloom/Design/JumpProbe.swift

@@ -8,14 +8,9 @@ import BloomCore
 ///
 /// The sixth of the family, and the only one that is not about frame times. The others ask what a
 /// gesture COST; this one asks whether a gesture DID WHAT IT SAID, because the bug it was written
-/// for was not slow, it was wrong. The jump pill scrolled one frame, that frame posted
-/// `boundsDidChange`, the coordinator read its own write as the reader taking hold, and the glide
-/// stopped itself at nothing. With Reduce Motion on it worked, because that path jumps rather than
-/// glides, which is exactly the kind of fault that survives a hand test: whoever checks it once,
-/// in the wrong accessibility setting, comes away satisfied.
-///
-/// `TranscriptModel.submit` bumps the same counter, so "the chat does not scroll down when I say
-/// something" was the same bug wearing different clothes. Both are covered here.
+/// for was not slow, it was wrong. The jump pill once scrolled one frame, that frame posted
+/// `boundsDidChange`, and the glide stopped short. The pill now places the table at its end
+/// immediately, and this probe checks that the placement remains correct as heights change.
 ///
 ///     Bloom --jump-probe /tmp/jump.json --jump-workspace <id>
 ///           [--jump-settle 2500] [--window-size 1440x900]
@@ -42,10 +37,8 @@ enum JumpProbe {
 
     /// How long a jump is given before it is judged, in milliseconds.
     ///
-    /// Generous on purpose. The glide is a display link over a fixed duration, and the standing
-    /// instruction it hands over to is re-asserted on the next run loop turn and again on every
-    /// height correction, so the honest question is where the view came to rest rather than where
-    /// it was a frame after the request.
+    /// Generous on purpose. The standing instruction is re-asserted on the next run loop turn and
+    /// again on every height correction, so this checks that the instant placement stays put.
     private static var settle: Duration {
         .milliseconds(ProbeHarness.count("--jump-settle", or: 2_500))
     }

Sources/Bloom/Design/MenuProbe.swift

@@ -264,6 +264,7 @@ enum MenuProbe {
             NSHostingMenu(rootView: SidebarFilterMenuItems(
                 filter: .constant(.all),
                 showsHiddenProjects: .constant(true),
+                showsEmptyProjects: .constant(true),
                 hiddenCount: 2,
                 grouping: .constant(SidebarGrouping.fallback.rawValue)
             ))

Sources/Bloom/Design/MessageArrivalEffect.swift

@@ -7,34 +7,49 @@ extension View {
     }
 }
 
-/// Time belongs to the message, not the hosting cell. This survives the instant-to-saved handoff
-/// and ignores the table's animation-free layout transaction. Only these drawing attributes tick;
-/// the supplied content is not rebuilt or re-parsed by the timeline closure.
+/// Fades a reply in as it starts to stream. Time belongs to the message, not the hosting cell, so
+/// a new view for an arrival already under way picks up where it is and survives the handoff from
+/// the streaming slot to the stored row.
+///
+/// One structure and one explicit animation. This was an `if let` around a
+/// `TimelineView(.animation)`, which could rebuild the whole reply on its second token while its
+/// markdown `VStack` was growing, and crashed inside SwiftUI's stack layout. Explicit, as in
+/// `ArrivingRow`, because the cell root clears implicit animation.
 private struct MessageArrivalEffect: ViewModifier {
     let arrival: MessageArrival?
     @Environment(\.accessibilityReduceMotion) private var reduceMotion
-    @State private var finishedArrival: MessageArrival?
+
+    /// Taken once, when this view is made. Reduce Motion is applied in `settle`, because the
+    /// environment cannot be read here.
+    @State private var opacity: Double
+
+    init(arrival: MessageArrival?) {
+        self.arrival = arrival
+        _opacity = State(initialValue: Self.opacity(of: arrival, at: Date()))
+    }
 
     func body(content: Content) -> some View {
-        // Sent bubbles enter through the composer's occlusion as the transcript scrolls.
-        // A second fade, scale and offset on the row made that one movement look disconnected.
-        if let arrival, arrival.style == .reply {
-            let finished = finishedArrival == arrival
-            TimelineView(.animation(paused: finished || reduceMotion)) { context in
-                let pose = finished ? .settled : arrival.pose(at: context.date, reduceMotion: reduceMotion)
-                content
-                    .opacity(pose.opacity)
-                    .scaleEffect(pose.scale, anchor: .bottomTrailing)
-                    .offset(y: pose.rise)
-            }
-            .task(id: arrival) {
-                let remaining = arrival.remaining(at: Date())
-                if remaining > 0 { try? await Task.sleep(for: .seconds(remaining)) }
-                guard !Task.isCancelled else { return }
-                finishedArrival = arrival
-            }
-        } else {
-            content
+        content
+            .opacity(opacity)
+            .onChange(of: arrival, initial: true) { _, arrival in settle(arrival) }
+    }
+
+    private func settle(_ arrival: MessageArrival?) {
+        // Text the reader can already see is not faded again.
+        guard opacity < 1 else { return }
+        let remaining = arrival?.remaining(at: Date()) ?? 0
+        guard arrival?.style == .reply, !reduceMotion, remaining > 0 else {
+            opacity = 1
+            return
         }
+        // The cubic ease out `MessageArrival.pose` describes.
+        withAnimation(.timingCurve(0.33, 1, 0.68, 1, duration: remaining)) { opacity = 1 }
+    }
+
+    /// Only a reply fades. Sent bubbles already move in behind the composer, and a second fade
+    /// made that look disconnected.
+    private static func opacity(of arrival: MessageArrival?, at date: Date) -> Double {
+        guard let arrival, arrival.style == .reply else { return 1 }
+        return arrival.pose(at: date, reduceMotion: false).opacity
     }
 }

Sources/Bloom/Design/SidebarIndentGallery.swift

@@ -117,6 +117,7 @@ struct SidebarIndentGallery: View {
     private func header(count: Int) -> some View {
         RepoHeaderRow(
             repo: Self.repo,
+            isFirstProject: true,
             hasUnreadWork: count > 0,
             workspaceCount: count,
             onCreateWorkspace: { _ in }

Sources/Bloom/Design/SwitchProbe.swift

@@ -81,6 +81,7 @@ enum SwitchProbe {
         let ticker = Ticker(view: contentView)
         ticker.start()
         SwitchTrace.isEnabled = true
+        harness.markStarted()
 
         var runs: [JSONValue] = []
 
@@ -117,6 +118,19 @@ enum SwitchProbe {
             }
         }
 
+        // A focused performance run ends here. The position, rapid-switch and background-update
+        // checks below answer separate correctness questions and extend a timed run by minutes.
+        if ProbeHarness.isPresent("--switch-timing-only") {
+            SwitchTrace.isEnabled = false
+            ticker.stop()
+            harness.write(.object([
+                "driver": .string(driver),
+                "order": .strings(order.map(\.rawValue)),
+                "runs": .array(runs),
+            ].merging(harness.conditions(window: window)) { mine, _ in mine }))
+            exit(0)
+        }
+
         // Whether a reader who was NOT at the live end is put back where they were, which is the
         // half of `TranscriptResume` the runs above cannot reach: a probe that only ever sits at
         // the end measures the flag, never the anchor.
@@ -154,6 +168,7 @@ enum SwitchProbe {
             return [:]
         }
         ticker.beginRun()
+        let cpuBefore = ProbeHarness.mainThreadCPUSeconds()
         // Which pane's layout the freeze is in. `FrameProbe` uses the same counters for the same
         // reason: "the window stood still for 300ms" is not an answer until it says which of the
         // two columns stood still.
@@ -203,6 +218,7 @@ enum SwitchProbe {
             "panePasses": .map(PaneLayoutTiming.timeline()),
             "transcriptHold": .map(TranscriptHoldCensus.summary()),
             "worstFrameMs": .number(ticker.intervalsMs.max() ?? 0),
+            "mainThreadCpuMs": .number((ProbeHarness.mainThreadCPUSeconds() - cpuBefore) * 1_000),
         ]
     }