Download AppRelay

The biggest AppRelay update yet: projects now open into a full workspace with a real code editor and per-file publishing, there's a password lock over the whole app, a rebuilt Source Control, and the largest Build & Run reliability pass we've shipped.

Projects open into a workspace

• Each project now has its own window — Overview, Code, Pending Upload, and Activity under one header, with the inspector pinned alongside on every tab. No more bouncing between the grid, an external editor, and the Deployments tab and re-picking the project each time. Double-click a card or use Open Project.
• Code is a real editor. Line numbers, auto-indent, bracket pairing, block indent, comment toggle, and completion over keywords, file symbols, and buffer words. Syntax highlighting for 15 languages — including PHP islands and <style>/<script> blocks inside markup. The gutter marks each line against the deployed copy, not just HEAD, because "what differs from what's live" is the question a publishing console actually answers.
• Pending Upload replaces lftp mirror for server lanes. It fingerprints your files with SHA-256 and sends only what changed, with a real diff of the deployed copy against your working copy for any file you select. ⌘S in the Code tab stages a file. Files changed on the server since your last publish are quarantined rather than silently overwritten, deletions are grouped on their own, and approval-gated channels say so. Credentials are handled exactly as the deploy engine does — passwords never touch the command line, private keys are written owner-only and removed after.
• The workspace is a Studio feature; the Projects grid stays free.

A code editor you can live in

• Eleven themes — Relay Light, Parchment, Daylight, Meadow, and High Contrast in light; Relay Dark, Midnight, Nocturne, Ocean, Ember, and Carbon in dark. Each fully specifies all token kinds, so every language is coloured consistently. The app chrome stays light and only the code surface follows the theme (the Xcode model).
• Themed autocomplete drawn by AppRelay rather than the system, so it's legible on a dark editor — rows tinted by the token kind they'll become, with a bolded match prefix and arrow/Return/Tab navigation.
• Resizable columns (explorer · editor · details), and an options popover for indent width, text size, and invisibles.

App Lock

• A password gate over the whole app, off until you set a password (a Studio feature to enable; an existing lock keeps working at any tier). While engaged, every window wears the lock screen and every app command refuses to fire.
• Your password is never stored — only a salted PBKDF2-HMAC-SHA256 digest (310k iterations) in its own Keychain item, which deliberately never leaves the Mac and is never included in an exported .relay archive. Wrong guesses escalate a cooldown that survives quitting.
• Opt-in triggers: idle timeout (measured on your input in AppRelay), at launch, on hide-to-menu-bar, and on sleep / screen lock. Manual lock is ⌃⌘L or a tray quick action. If you forget the password, a one-time recovery code (shown once at setup) or your Studio key + purchase email gets you back in.
• The lock reaches the paired phone — it raises and drops its cover with the desktop. The CLI and MCP server are deliberately not gated, so scheduled triggers, CI steps, and agent tooling keep working while your desk is locked.

Source Control, rebuilt

• The permanent repo list is gone, replaced by a search-first project picker (⌘P), branch picker, upstream with ahead/behind, and Fetch/Pull/Push with counts — over a tab strip of Changes, History, Branches, and Pull Requests, each getting the whole window.
• Changes shows the diff inline — a filterable file list with per-file stage checkboxes, a commit composer (summary + resizable description, push-after-commit) anchored to its bottom, and the diff on the right instead of a separate window. History pairs each commit with its patch.
• An account chip surfaces who you're signed in as, the remote, and your commit identity from this repo's git config, with an amber banner when auth is broken — and a clear "not a git repo" state instead of spinning on "Checking…" forever.

Build & Run — a major reliability pass

Dozens of fixes so a project that builds in your IDE or terminal builds in AppRelay too, and so a failure explains itself instead of surfacing a raw tool error:

• Smarter project detection. Backend frameworks (Laravel, Rails, Django, Flask, Phoenix) are no longer misread as plain Node projects; .NET recognizes the new .slnx solution format and .vbproj; modern Bun projects (text bun.lock) and plain JVM/Kotlin Gradle libraries are recognized; and a Mac app that ships an iOS companion (like AppRelay itself) detects correctly.
• The right package manager and toolchain. JS recipes pick pnpm, Yarn, or npm from your lockfile instead of forcing npm (which corrupted pnpm/Yarn projects). Deploy steps use each framework's real output directory (.next, .output, SvelteKit/Remix/CRA build) rather than a wrong default. Switching a lane's toolchain now re-scopes its run recipe too.
• Android builds that just work. The JDK is probed properly (any vendor, not only Android Studio's), a developer's exported ANDROID_HOME is respected, adb and emulator are declared as requirements, and an AVD is booted and waited for before a run instead of failing with a raw error.
• Your shell's toolchain is the one used. The login shell's PATH now takes precedence (so an nvm/asdf/mise version isn't shadowed by a system copy), with the probe bounded so a slow profile can't hang the UI.
• Run targets are honored. Expo, React Native, and Capacitor now launch on the device you picked instead of ignoring it or opening a menu and hanging. A failed Xcode destination query no longer offers an iOS scheme a "This Mac" target it can't build.
• Clearer failures. An empty run-target list names the actual cause (SDK not on PATH, no device connected, an unevaluable scheme). Missing tools are flagged up front on the Projects list with an amber chip. Steps now list any placeholder that resolved to nothing, so docker build -t app: or -scheme '' is traceable. Docker recipes fall back to a :latest tag when no version is set.
• No more silent success on failure. Build & Run enforces the same preflight checks Release does; a step whose artifact check ignored the exit code can no longer pass a failed build; and the OUTPUT console now auto-scrolls to follow the newest line (and re-attaches when you scroll back to the bottom).
• Cleaner cancel and quit. Cancelling a queued or in-flight run no longer orphans build processes or leaves a caller hung, quitting prompts for every kind of running work (not just some), and the .env editor reports a real error instead of a false "Saved".

Security hardening

• Remote version writes are confined to the project root. A crafted request from a paired phone could previously overwrite an arbitrary file on your Mac — a path to code execution at the next build. Version writes now resolve strictly inside the project, refusing .. segments and symlink escapes.
• Imported and shared projects can't inject commands. The Xcode container setting — which also arrives from a .relay archive, the remote API, and the CLI/MCP — is now re-emitted from parsed tokens and rejected if it carries shell metacharacters, closing an RCE vector in downloaded or shared project bundles.
• A lane's working directory can't escape the project root, on macOS or Windows.

Smaller improvements

• License keys are masked as ••••-XXXX everywhere the app shows them, with an eye toggle to reveal (never persisted, so it can't leak into a screenshot or screen share) and a copy button that always copies the real key.
• A Keyboard Shortcuts reference — a filterable sheet of every chord grouped by screen, from Help ▸ Keyboard Shortcuts, About, and Settings.
• Settings uses a side rail instead of a jump-to menu, matching the Windows build and the per-project settings layout, and About renders inline.
• Dispatch says it's checking for Claude Code instead of briefly claiming it's not installed while the check runs, and Project Settings opens on the page the button names (e.g. "Add a lane…" lands on Lanes).
• Relay Monitor spells uptime out — "2d 16h 9m 15s" instead of a raw hour count.

For automation — the MCP bridge now ships inside the app

• The AppRelay MCP server is bundled in the app, at Contents/Resources/apprelay-mcp.mjs, sealed by the app's own signature. There is no second download and no path to get wrong — point Claude Code or Claude Desktop at that file and it drives the AppRelay it lives inside. (Requires Node 18+.)
• The apprelay CLI now covers the full surface the bridge wraps — run logs, version/bump, channels, deployments, rollback, environments, secrets, targets, recipes, license, groups, and doctor — so an agent can read and drive everything the desktop can.