Group calls for up to six, presence and reminders
Group and channel calls take up to six people, with video and one screen share. You can see who is active, set a status, pause notifications and get reminders about messages.
Small group and channel calls
Group and channel calls gain their shared audio and video implementation, protected participant connections and a single active screen share. They support small calls of up to six people.
A call layout that follows the participants
A call with two people uses the familiar one-to-one stage; larger calls use a grid with stable places. Participants can be pinned, with the conversation and call controls still available.
Presence, status and paused notifications
See whether someone is active or has paused notifications, their status and, where space permits, their local time. Set your own status, appear away or pause notifications; a message can offer Notify anyway when someone has paused.
Also new
- Mute a conversation. Conversations can be muted from the Mac interface, with a dimmed row and muted-bell indicator. The choice applies to this device only: mentions can still alert and desktop calls still ring.
- Invitations for more than one person. Invitation links can allow multiple uses, track accepted joins and be revoked with a verified change.
- Reminders and a Later list. Set a reminder from a message, choose a suggested or custom time, and manage it from Later with Done, Snooze, Change and Remove. Reminders sync encrypted between your devices and bring the message back when due.
- Mac reminders can fire while Lowfire is closed. The Mac can schedule reminder notifications with the system so they appear while Lowfire is quit. Linux cannot schedule them this way yet and shows a due reminder on the next launch.
- Clear controls for broadcast channels. Channels where only chosen people may post show that policy and explain it to readers in place of the composer. Admins can manage posting and reaction permissions; readers can start a private reply quoting a post.
- Keep a turned-off account as an archive. An account turned off by its server can stay as a read-only archive beside a new working account on that server. Its local history remains readable; a kit made for the working account does not also restore the archive.
- Advance warning when an update is required. The app warns before its version stops being accepted by a server and checks promptly for an update. Offered downloads can prepare quietly in the background; installing remains the person’s choice.
- A call privacy preference. Always use a relay is available as a privacy preference for calls, so the other participant does not receive a direct connection to your network address.
- Use the network’s proxy. Chat connections honor system proxy settings, including automatic proxy selection on the Mac and supported environment or desktop settings on Linux. Call relay connections can also travel over the proxy when direct network access is restricted.
- Send less audio during silence. Silent speakers use a quieter transmission mode, with comfort noise at the receiving end so silence does not sound like a broken call.
- Read long histories without loading them all. Long conversations keep only a limited working set of messages in memory and can load the area around a chosen message. Screen-reader access follows that working set, so a large history does not require keeping every row active.
- Capacity limits for hosted organisations. Server operators can set organisation limits for conversation count and stored message bytes as well as attachments. The server reports which limit was reached and keeps member-removal work bounded in large organisations.
- Sharper colour in supported Mac screen shares. Mac screen sharing can preserve full colour detail when both devices support the required codec, improving fine coloured text. It negotiates support and falls back for other devices rather than assuming every decoder can display it.
- Subscribe to changes through automation. Automation clients can subscribe to committed changes and read them through the same commands on each transport. Events carry structural information rather than message contents or keys, and a client is told to resynchronise if it falls behind.
Fixed
- Steadier scrolling through mixed messages. Scrolling and dragging the scrollbar through messages of different heights now use the same position model. Loading older rows, resizing or replacing a row is less likely to move the content unexpectedly.
- Reach controls hidden by nested scrolling. Accessibility can find controls hidden by an outer scrolling region as well as an inner one. Activating such a control scrolls it into view through the relevant regions.
- Recover camera video from lost packets. Camera video can repair some lost data and paces repeated data more carefully, reducing pauses and waiting on lossy connections. This protection starts promptly and behaves consistently across connection conditions.
- Respond sooner when bandwidth falls. Call transmission drains an overloaded connection sooner and recovers video after a sudden narrowing with less unnecessary waiting.
- Avoid unnecessary bandwidth reductions. Connection estimates no longer drop just because a growth cap is reached. Starting probes can establish a narrow connection’s real limit before a share begins, and continue while they are still learning more capacity.
- Sound delay settles after congestion. After network congestion eases, the audio buffer comes back down rather than leaving the call with unnecessary delay.
- Avoid redundant call setup messages. Call connection setup no longer repeats messages already acknowledged or sends rounds that are not needed.
- Keep an active call connected while paths change. A call can continue on its working path while one side searches for a replacement, avoiding an incorrect Reconnecting state or hang-up while media still flows. Checks also wake an exhausted path search when verified progress arrives.
- One slow participant does not freeze the others. A group-call connection left behind at one picture size no longer holds up the other participants receiving that size.
- Explain a group call’s missing relay. When a group call cannot start because the required relay is unavailable, it gives one clear explanation as a one-to-one call does.
- A floating call window that fits. Status pills and controls fit the mini call window at its supported sizes. Overlays fade when the pointer leaves, and the top bar no longer leaves an unnecessary empty area.
- Explain limits before adding people. Add is dimmed when a group is full, with a reason before it is pressed. Device-limit explanations keep their reserved space in the Add People interface.
- Keep notices and invitation actions in bounds. An invitation footer wraps when it does not fit, and banner buttons move together below the words in narrow columns. Refused-account banners center their text and narrow update notices stay clear of the whole account footer.
- Close a reaction picker when focus moves. The emoji field for a reaction closes when it loses the keyboard or its message scrolls away.
- Automatically retry after an older server refusal. Existing accounts retry automatically after a refusal caused by an older server. Creating a conversation just after joining an organisation also waits for the membership prerequisites to arrive.
- Joining and leaving settle consistently. Joining and leaving an organisation reconcile the account and organisation records. Direct conversations remember when their other member has left and refuse further use accordingly.
- Recover a rejoin whose reply was lost. If the server accepted a rejoin but its answer was lost, the client can discover and settle the accepted change. It avoids confusing later or obsolete membership changes with the one it owns.
- Keep asking for missing channel history. Missing history remains owed until records actually cover it. A storage failure no longer silently clears the need to fetch those records.
- Recover from a lost message event. The chat core recovers when it cannot allocate a message event and distinguishes certificate failures more accurately, rather than losing the event without a useful recovery path.
- Recover an organisation change nobody could open. The client can move past an organisation-key period whose key reached nobody. Admins receive a neutral explanation and repeat notice instead of a permanently stuck organisation.
- Track all restored conversations. Restoring more than 64 conversations no longer leaves later ones out of the idle-work tracking.
- More stable text layout under growth. Editable text reuses storage for exact wrapping, and retained text layouts survive growth of their backing pool. Wrapping also reuses scanned prefixes in very long words instead of repeatedly scanning them.
- Even translucent line joins. A translucent line’s join is drawn once, preventing visibly darker overlap at the corner.
- Give back unused graphics resources. Idle spare drawables are released rather than kept indefinitely, reducing graphics resources retained after activity.
- Bound memory during backup and restore. Backup, restore and history handover process messages in bounded batches, with indexed message lookups. Linking also spools history through encrypted pages.
- Avoid opening every old group at launch. Connecting and listing conversations no longer eagerly open idle encrypted groups, and unconditional history scans are removed. These are steps toward keeping startup work independent of history size.
- Let another process read without blocking normal chat. A second process can briefly borrow the encrypted store and return what it read to the app. When a chat action needs the store back, it waits briefly and reclaims it instead of simply refusing the action.
- Explain outdated update information. Signed update information gains an expiry, and the app explains when the feed is stale instead of silently trusting an old listing. Compatibility handling includes a dated transition for feeds without the new expiry.
In the works 7 changes · designs and groundwork
- A relay for private wake notifications. The push relay implementation can open sealed registrations and send content-free requests to Apple and Google notification services. Provider stand-ins and real clients exercise it.
- Plan for larger and web calls. The roadmap routes future larger calls and web calling through a forwarding server.
- Third-party plugins will run sandboxed. Future third-party plugins will run in a sandboxed format. Existing native plugins are trusted first-party code.
- Decisions on threads and organisation emoji. The owner’s decisions specify Messages-style threads, reject shared channels between organisations and accept the organisation emoji design.
- Groundwork for the next security workflows. Stored security state gains limits, and the connections later security workflows will use are added.
- Prepare to read large messages in small pieces. New internal readers and writers can process large structured messages without loading every repeated part at once. Account, linking and reminder features still need to adopt these building blocks.
- Recovery groundwork for larger groups. Periodic account-key updates and authenticated large-group bootstrap improve the foundations of self-rejoining and recovery.
Under the hood 17 changes · tests, tools and the server
- Use indexes for common message reads. Message-id and sequence lookups use their database indexes. A separate index covers this device’s queued and refused outgoing messages.
- Stronger checks around joining. Requests for joining material are restricted to the named organisation’s members. A join request can carry its own verified device material, while client and server rules check authenticated posting rights for live signals and transferred history.
- Keep membership handshakes private. Membership handshakes are required to use the encrypted message form on both client and server, and the server refuses member sends in an inappropriate form.
- Check recovery and ordering records before keeping them. Organisation fork-recovery and message-ordering records are authenticated before acceptance. Claims about another device, including those in handed-over history, need attribution and corroboration before becoming permanent explanatory lines.
- Refuse unprotected remote server traffic. Plain HTTP server addresses are accepted only for local loopback development, including the development attachment routes. Remote traffic must use a protected connection.
- Safer keys and device-history processing. Random key generation stops safely on failure, and temporary cryptographic buffers are wiped during growth. Device histories are bounded and verified linking authority is streamed, with additional groundwork for protected large-group recovery.
- Safer processing of call data. Call decoder input is bounded before conversion writes, with smaller network and media safety fixes. These changes strengthen handling of data received from outside the device.
- Keep rosters intact on allocation failure. Array growth is checked and a failed allocation preserves the existing roster instead of leaving a partly replaced list.
- Keep typing signals out of history. Authenticated typing signals stay transient instead of being stored as conversation history.
- Safer completion and reset lifetimes. Chat completion callbacks wait until core operations release their ownership. Validation and test teardown release their resources correctly, and automated interface reset preserves launch preferences and reports failed barriers.
- Deeper call quality and fallback checks. Call tests cover group outcomes, relay fallback, audio-device reopening and screen sharing’s main-window fallback on Linux. Revised timing and frame checks separate simulated connection behavior from host scheduling and retain known quality shortfalls.
- Faster, isolated server and interface checks. Server checks reuse safe setup, split long suites and limit parallelism. Interface tests wait for import readiness, isolate image fixtures and use accurate right clicks; alarm, presence, revocation and push checks observe their own events rather than racing automatic delivery.
- Tools for testing large organisations. A reference organisation and smaller comparison profile support measurements of memory at scale. Presence test fixtures observe delivery directly, and conformance tests can target an external server.
- More precise build and test accounting. Build checks count shared preparation once, preserve performance coverage and reject truncated command buffers. Compiler caching, release size optimisation, native fixtures, Linux arm64 builds and source checks are made more accurate and reproducible.
- Check encrypted profiles across library updates. The encryption library is updated to a pinned version, with saved encrypted profiles and regression fixtures to check compatibility. Network and call parsers gain additional seeded fuzz targets, and application builds use locked dependency resolution.
- Keep architecture and security documentation accurate. The security review, current limits, expiry rules and architectural records are updated to match the implementation. Shared command metadata and runtime boundaries are clarified, and landing instructions require cleanup after merges.
- Check disabled-member removal in real conversations. An end-to-end check verifies that a disabled account leaves an organisation’s direct conversation through the signed membership change, rather than an unchecked server hint.