time: stamps cross the bridge as UTC; local time is a display concern

.github/workflows/ci.yml

@@ -23,6 +23,18 @@ jobs:
         run: python3 bridge/mac/test_app_cards.py
       - name: unsent messages are tombstones, not empty bubbles (no macOS needed)
         run: python3 bridge/mac/test_unsent.py
+      - name: conversation cluster pins (no macOS needed)
+        run: python3 bridge/mac/test_cluster.py
+      - name: the optional read-push probe stays opt-in (no macOS needed)
+        run: python3 bridge/mac/test_blip_check.py
+      - name: hide Spam / unknown senders (no macOS needed)
+        run: python3 bridge/mac/test_filtered.py
+      - name: contact review across sources (no macOS needed)
+        run: python3 bridge/mac/contacts_test.py
+      - name: imsg chat metadata (no macOS needed)
+        run: python3 bridge/mac/imsg_test.py
+      - name: stamps cross the bridge as UTC (no macOS needed)
+        run: python3 bridge/mac/test_wire_time.py
       - name: shell scripts (bash -n + shellcheck)
         run: |
           bash -n bridge/linux/blip-shim scripts/blip-setup scripts/sync-bridge.sh scripts/demo/blip-shots bridge/mac/install.sh

AGENTS.md

@@ -40,7 +40,7 @@ attempts trigger prompts on the Mac's screen.
 
 ```sh
 bun test
-cp *.qml *.ts manifest.json ~/.config/omarchy/plugins/nixfred.blip/
+cp *.qml *.ts *.mjs manifest.json ~/.config/omarchy/plugins/nixfred.blip/
 omarchy-restart-shell        # NOT a hot-reload: IPC would stay on the old instance
 qs -p /usr/share/omarchy/shell ipc call nixfred.blip status
 ```

BarWidget.qml

@@ -43,8 +43,21 @@ BarWidget {
   property int unread: 0
   property bool online: false        // the Mac is reachable
   property bool healthy: false       // last collector run parsed cleanly
+  // Which reads reach the Mac, straight from the collector (bridge.conf's
+  // push_read). "all" is the default and pushes ONLY on the mark-all gesture,
+  // so reading a conversation clears it here and leaves the phone's badge —
+  // by design, and indistinguishable from a broken push until status said so.
+  property string readPush: ""
   property string lastError: ""
   property string lastRun: ""
+  // Unsent compose text per chat id, shared by the panel and the app window.
+  // In memory only: message text never lands on disk.
+  property var draftCache: ({})
+  // Contact photo per handle (file:// url, "" = letters), shared by the panel
+  // and the app window. The window is REBUILT on every show, so a map kept in
+  // BlipView started empty on each SUPER+M and asked for every photo again.
+  // Cache paths only, never image bytes.
+  property var avatarCache: ({})
 
   readonly property bool hasUnread: unread > 0
 
@@ -75,16 +88,29 @@ BarWidget {
   implicitWidth: button.implicitWidth
   implicitHeight: button.implicitHeight
 
+  // Omarchy's panel hotkeys (`omarchy-shell shell toggle nixfred.blip`,
+  // SUPER+CTRL+<n> by bar position) find a bar widget's panel through open(),
+  // close() AND this property — without it the shell logs "summon: no live
+  // bar widget" and does nothing. Same line as Omarchy's clock widget.
+  readonly property bool opened: panelLoader.item ? panelLoader.item.opened === true : false
   function open() { if (panelLoader.item) panelLoader.item.open() }
   function close() { if (panelLoader.item) panelLoader.item.close() }
   function toggle() { if (panelLoader.item) panelLoader.item.toggle() }
+  /** Open a conversation by chat id. Returns false when the id is not one —
+   *  `goto ""` used to open a nameless thread with no header that nothing
+   *  could send to, and a script with an unset variable is how you get there.
+   *  The shape test is the one the toast's argv guard already uses; an id that
+   *  LOOKS like a handle but is unknown still opens, on purpose, so you can
+   *  start a conversation with a number you have never messaged. */
   function show(chat) {
-    if (!panelLoader.item) return
+    var raw = String(chat === undefined || chat === null ? "" : chat).trim()
+    if (raw === "" || !/^[A-Za-z0-9._@:;$-]{1,256}$/.test(raw)) return false
+    if (!panelLoader.item) return false
     panelLoader.item.open()
     // `qs ipc call` rejects a leading "+" as a flag, so accept the bare digits too.
     // Exact match FIRST, alias second: when both variants exist as threads,
     // the alias must never shadow the exact one (Codex HIGH, 1.2.0).
-    var want = String(chat)
+    var want = raw
     var t = null
     for (var i = 0; i < threads.length; i++) {
       if (String(threads[i].chat) === want) { t = threads[i]; break }
@@ -96,15 +122,18 @@ BarWidget {
     if (!t && /^[0-9]{10,}$/.test(want)) want = "+" + want
     // Unknown to the current window: still open it, with the id as the name.
     panelLoader.item.openThread(t || { chat: want, handle: want, name: want })
+    return true
   }
 
   /** Newest arriving link → the share sheet on whichever surface is open. */
   function shareArrivingLink(link) {
     if (!link || !link.url) return
+    // Every link of the message: the sheet steps through them.
+    var urls = Array.isArray(link.urls) && link.urls.length > 0 ? link.urls.map(String) : [String(link.url)]
     var w = windowLoader.item
-    if (w && root.windowVisible && typeof w.shareLink === "function") { w.shareLink(String(link.url)); return }
+    if (w && root.windowVisible && typeof w.shareLink === "function") { w.shareLink(urls); return }
     var p = panelLoader.item
-    if (p && p.opened === true && typeof p.shareLink === "function") p.shareLink(String(link.url))
+    if (p && p.opened === true && typeof p.shareLink === "function") p.shareLink(urls)
   }
 
   function injectPanel() {
@@ -157,16 +186,26 @@ BarWidget {
     }
     // A fresh BlipWindow honours window.json (which may say hidden) — this
     // call means SHOW, so make it so once its restore pass has run.
-    Qt.callLater(function() { if (windowLoader.item && !windowLoader.item.visible) windowLoader.item.visible = true })
+    Qt.callLater(function() { if (windowLoader.item) windowLoader.item.requestShow() })
   }
+  /** Toggle the app window. Returns what it just DID, not what windowVisible
+   *  says: ensureWindow() defers the actual `visible = true` to a callLater
+   *  (a fresh BlipWindow has to run its restore pass first), so reading the
+   *  property straight after showing still says hidden — IPC `window` reported
+   *  "window hidden" on both paths and could never say it had shown one. */
   function toggleWindow() {
-    if (root.windowVisible) hideWindow()
-    else ensureWindow()
+    if (root.windowVisible) { hideWindow(); return false }
+    ensureWindow()
+    return true
   }
   // Show AND focus: a window restored on another workspace is invisible to
   // the user, and a plain toggle would HIDE it ("SUPER+M doesn't load the
   // app"). Hyprland ≥0.56 dispatch takes Lua; classic focuswindow is rejected.
   function showApp() {
+    // The popout gets out of the way first: the window is the same view,
+    // larger. Here, once, so double-click, the ⇱ button and IPC `app` (a
+    // SUPER+M bind) all agree — `app` used to leave the popout open.
+    root.close()
     ensureWindow()
     if (!windowLoader.item) return
     // Fire-and-forget on purpose: a Process object silently ignores
@@ -195,7 +234,6 @@ BarWidget {
     }
     if (dblClick.running) {
       dblClick.stop()
-      root.close()
       root.showApp()
       return
     }
@@ -358,8 +396,9 @@ BarWidget {
     var p = panelLoader.item
     if (p && p.opened === true && p.inThread === true) return p
     var w = windowLoader.item
-    // the window must be FOCUSED to count as being read (war room #25)
-    if (w && w.visible === true && w.focused === true && w.inThread === true) return w
+    // the window must be FOCUSED to count as being read (war room #25), and
+    // a thread merely peeked from the sidebar cursor is not being read either
+    if (w && w.visible === true && w.focused === true && w.inThread === true && w.peeking !== true) return w
     return null
   }
   function activeReadChat() {
@@ -399,6 +438,7 @@ BarWidget {
           root.online = d.online === true
           root.lastError = String(d.error || "")
           root.lastRun = String(d.ts || "")
+          if (typeof d.readPush === "string") root.readPush = d.readPush
           if (d.ok === true) {
             // Filter through the optimistic-read ledger: a poll that was
             // already in flight when the user opened a thread must not
@@ -684,15 +724,22 @@ BarWidget {
     // one is recorded — so a body with the code put the code on disk (Astra
     // #1). The toast says a code arrived; click copies it from memory.
     var body = (pendingCode.domain !== "" ? "For " + pendingCode.domain + " · " : "")
-             + "Click to copy · Super+Shift+V types it"
+             + "Click to copy"
     fireToasts([{ chat: "", name: "Security code from " + who, text: body, ts: pendingCode.ts, key: "", code: pendingCode.code, at: Date.now() }])
   }
-  // sh reads the code from its environment, hands it to the tool on stdin.
+  // The code goes straight to wl-copy on stdin. An environment variable
+  // outlived the copy: wl-copy stays resident to serve the selection, so the
+  // code sat readable in /proc/<wl-copy>/environ for as long as the clipboard
+  // held it -- past the five minutes copyCode() enforces, and past the toast
+  // that offered it. stdin is read once and closed.
   property string copyValue: ""          // what the NEXT copy hands to wl-copy
   Process {
     id: codeCopyProc
-    environment: ({ BLIP_CODE: root.copyValue })
-    command: ["sh", "-c", "printf %s \"$BLIP_CODE\" | wl-copy"]
+    command: ["wl-copy"]
+    onStarted: {
+      write(root.copyValue)
+      stdinEnabled = false
+    }
     onExited: root.copyValue = ""
   }
   /** Copy a code. A toast passes the code it DISPLAYED, so clicking an older
@@ -703,6 +750,7 @@ BarWidget {
     // An older toast's code is copied only within ITS five minutes (Astra A#9).
     if (code && String(code) !== pendingCode.code && Date.now() - notifyProc.toastCodeAt > 300000) return "code expired"
     copyValue = String(code || pendingCode.code)
+    codeCopyProc.stdinEnabled = true
     codeCopyProc.running = true
     return "copied"
   }
@@ -795,7 +843,8 @@ BarWidget {
       return "online=" + root.online + " unread=" + root.unread + " leader=" + root.leader
         + " window=" + (w && w.visible ? (w.focused ? "focused" : "unfocused") : "hidden")
         + " threads=" + root.threads.length + " healthy=" + root.healthy
-        + " push=" + root.watchAlive
+        + " watch=" + root.watchAlive
+        + " read_push=" + (root.readPush !== "" ? root.readPush : "?")
         + (root.lastError !== "" ? " error=" + root.lastError : "")
     }
     function threads(): string { return root.automationOn ? JSON.stringify(root.threads) : root.automationOff }
@@ -804,15 +853,15 @@ BarWidget {
     function open(): void { root.open() }
     function close(): void { root.close() }
     function toggle(): void { root.toggle() }
-    function goto(chat: string): string { if (!root.automationOn) return root.automationOff; root.show(chat); return "shown" }
+    function goto(chat: string): string { if (!root.automationOn) return root.automationOff; return root.show(chat) ? "shown" : "not a conversation id" }
     function copycode(): string { if (!root.automationOn) return root.automationOff; return root.copyCode() }
     function typecode(): string { if (!root.automationOn) return root.automationOff; return root.typeCode() }
     function share(url: string): string { if (!root.automationOn) return root.automationOff; root.open(); return panelLoader.item ? panelLoader.item.shareLink(url) : "no panel" }
     function compose(text: string): string { if (!root.automationOn) return root.automationOff; return panelLoader.item ? panelLoader.item.composeAndSend(text) : "no panel" }
     function bubbles(): string { if (!root.automationOn) return root.automationOff; return panelLoader.item ? panelLoader.item.bubbleModel() : "[]" }
     function find(query: string): string { if (!root.automationOn) return root.automationOff; return panelLoader.item ? panelLoader.item.searchFor(query) : "no panel" }
     function newchat(query: string): string { if (!root.automationOn) return root.automationOff; return panelLoader.item ? panelLoader.item.newChatFor(query) : "no panel" }
-    function window(): string { root.toggleWindow(); return root.windowVisible ? "window shown" : "window hidden" }
+    function window(): string { return root.toggleWindow() ? "window shown" : "window hidden" }
     function app(): string { root.showApp(); return "app shown + focused" }
     function windowgoto(chat: string): string {
       if (!root.automationOn) return root.automationOff