Encrypted conversations and audio calls on the Mac

The first Mac client brings encrypted conversations, organisations and channels, files, device linking, recovery kits and one-to-one audio calls. Messages get replies, reactions, formatting and search.

Also new

• Unread messages and local notifications. New messages gained local notifications, a Dock badge, an unread divider and a way to jump back to the newest message. Notification content is prepared on the device rather than put into a server push.
• Managing a conversation. People could copy a message, add participants and rename a conversation. These controls accompanied the first round of message-list polish.
• Text across writing systems. The Mac text renderer gained shaping, fallback fonts, colour emoji and right-to-left text support. Editing and word-selection refinements came later.
• Organisations and channels. An account could belong to several organisations, browse their encrypted channel directories, request to join channels and leave them. Organisation administrators and channel membership became part of the chat model.
• Replies, edits and reactions. Messages gained replies, reactions, editing and deletion for everyone, with edits and deletion restricted to the original author. The composer could enter reply or edit mode, and people could mention colleagues by name.
• Formatting and search. Messages gained bold, italic, strikethrough, code, quotes, lists and links. Search runs over the encrypted local history; opening a link asks for confirmation showing its actual address.
• Encrypted attachments. Files and pictures could be attached, sent encrypted and previewed using the client’s image decoders. Deleting for everyone and leaving a conversation gained confirmation before the action went through.
• Link another device. A new device could be linked with a code or QR code and mutual verification. Encrypted history transfer included rich messages and attachment references, with progress shown during the transfer.
• Recovery kits and encrypted backups. Account setup gained a recovery kit shown once and checked by typing it back, with an option to skip it. Encrypted backups and restore could recover history and backed-up attachments using that kit; the server alone could not restore it.
• Preferences and drafts across devices. Linked devices gained synchronisation for read markers, drafts, preferences, device names and conversations the person had left. Settings also gained device management and backup controls.
• Safer device and organisation management. Revoking a device gained a confirmation sheet, and administrators could approve or decline private-channel join requests. Leaving an organisation was added, with checks that prevent its sole administrator from abandoning it.
• One-to-one audio calls on the Mac. Direct conversations gained encrypted audio calls with call, answer, decline, mute and hang-up controls, plus a call record in the conversation. Video, screen sharing, group calls and calling on other platforms were still design work at this point.
• Calls find their own connection. Audio calls tried a direct connection and relay alternatives automatically, including relay connections over UDP, TCP and TLS. Nobody had to choose a connection mode.
• Selecting and copying message text. Messages gained text selection instead of requiring the whole message to be copied. Keyboard and multilingual word-selection gaps were addressed in later work.
• Drag, drop and paste. The Mac gained drag and drop for files and text, plus pasting, copying, Quick Look and undo. More fixes followed for keeping staged files and for exporting.
• Photo details removed before sending. Pictures had location and other photo metadata removed by default before upload, while preserving their intended orientation. Attachment names, keys and previews travelled inside the encrypted conversation, and received files stayed encrypted on disk.
• Files wait in the draft until Send. Dropped and pasted files, pictures and screenshots were staged with previews and remove controls instead of sending immediately. Dropping onto a conversation in the sidebar put the item into that conversation’s draft, while folders received a clear refusal.
• Copy and preview attachments. Pictures and files could be copied or dragged back out to other applications, with Quick Look available from the keyboard.

Fixed

• New messages arrive over the live connection. The server learned to accept the client’s authentication header when opening its live connection. This repaired the connection path used to receive new messages.
• Recipient field keeps its width when names wrap. The recipient field now uses the remaining width of a wrapping row. It no longer loses that space when the people chips wrap.
• Retrying message changes. Failed edits, reactions and deletions gained retry support. Reactions were also added to transferred history and backups so they would not disappear on another device.
• An old leave can’t remove someone who rejoined. Leaving a conversation was bound to the membership state in which it was requested, preventing an old leave from removing someone who had since rejoined. Devices also took turns adding a person’s newly linked device, and revoked-device backup objects gained cleanup.
• Message actions without moving the conversation. Message actions floated above the selected message instead of shifting the list. Reply quotes, reaction chips and attachment buttons were adjusted to fit their messages more consistently.
• First-call permissions and useful failures. The call interface handled microphone permission waits, permission refusal and a missing media component with clear status and next steps. Call controls, tones and audio-device handling also received their first polish.