What changed, release by release

Fixed

• Setup could never be completed on a clean Mac. brew install httpd ships extra/httpd-ssl.conf but not the server.crt it points at. BRAMPP enabled the SSL include because the file existed, configtest failed with SSLCertificateFile: file does not exist, the write was rolled back, the Apache group never completed — and because that group is required, the Finish button never enabled. The check is no longer whether the file exists but whether every certificate it references is on disk; the include stays off until BRAMPP writes its own SSL config with mkcert certificates.
• Installs froze in the wizard with an empty console. Packages ran without a PTY, so a question brew asked never reached the console at all — brew does not end a prompt line with a newline, and the buffer holds the trailing segment. The user saw a frozen screen, a progress bar that stopped moving and no way to cancel. Installs now go through the same flow as the rest of the app: live output, the download percentage, an answerable prompt bar and its auto-confirm countdown.
• mkcert was described as optional and could not be skipped. The package was still marked required, so the packages step could not be passed, and localhost setup refused to proceed without it. A user stuck on the CA — a lost rootCA-key.pem, a declined keychain prompt — could neither finish the wizard nor reach a working HTTP setup. Without mkcert, localhost is now configured over HTTP and SSL can be added later.
• The wizard's other writer to httpd.conf had no protection. No backup, no configtest, no rollback — and what it writes rearranges every PHP handler block in the file, including ones belonging to vhosts. On a hand-rolled configuration that was unrecoverable. Now: back up, write, validate, roll back on failure.
• Installing a package without Homebrew reported an opaque command not found; it now says Homebrew is what is missing.
• A status refresh rewrote PHP-FPM configuration. On launch, under the running process, www.conf was changed from 9000 to 908X with nothing restarted: the file said one port, the process was bound to another, and vhosts proxied to the file's — every PHP site returning 502. For someone who set up brew php by hand this read as "I installed BRAMPP and it broke my working PHP". Reads no longer write, and the correction now happens together with the restart.
• A vhost was removed even when its open share could not be closed, on disable and on rename. The public address kept serving, now showing the default site — phpMyAdmin and Adminer included. All three call sites are guarded.

Fixed

• The "Check for Updates" menu item did nothing at all. The item sat in the menu, took your click, and produced not a single line in response. Two menu groups were targeting the same place: one rebuilt the app menu outright, the other anchored itself after the group that no longer existed. That is not defined behaviour — the item is drawn, but its action is never wired. Neither the compiler nor the running app said a word.
• Underneath that sat a second fault: the Settings button was silent too. Both entry points sent the same internal notification, and nothing was listening for it — so fixing the menu alone would still have produced nothing. The check is now called directly, with nothing in between.
• Update windows fell behind the main window. You started a check and then stared at a screen where nothing appeared to happen; the window had opened, it just was not visible. It now stays on top.
• The "Checking…" label in Settings was not waiting for the result, it was counting a fixed delay: on a slow connection it cleared before the check finished, on a fast one it lingered after. It now waits for the real answer.

Changed

• There is now one place to check for updates: Settings → Updates. The app-menu item is gone. Two doors to the same job ends with a behaviour fixed behind one of them and left stale behind the other.
• The check answers you now. A "checking" window opens the moment you click, and turns into a green confirmation telling you that you are up to date. Previously nothing appeared at all when there was no new version — which is exactly what made the menu item look broken.

Added

• Homebrew packages have their own tab and can be selected and upgraded individually. brew outdated counts every formula on the machine — fifty here, with httpd and php lost between cocoapods and jadx. They are split three ways: what BRAMPP manages, what those depend on, and everything else it does not touch. A running service that gets upgraded is restarted, because an upgrade replaces the binary while the running process keeps the old one.
• A manual update check answers immediately. The window opens with the click and turns into the result in place. The check at launch stays silent.

Fixed

• Uninstall claimed to have deleted files it had not. A failed removal passed silently and the script still finished with success — with MariaDB that means believing your data directory is gone while it sits on disk.
• The data directory was deleted without confirming the server had stopped. Pulling files out from under a running server leaves it inconsistent. The port is now polled for ten seconds and nothing is deleted while it is still listening.
• The install screen reported success it did not have. The outcome was inferred from any tick in the log body, so a PostgreSQL configuration that aborted still showed a green check.
• Two installs could start at once, the second overwriting the first and leaving it with a prompt nobody could answer.
• Turning the profiler off did nothing — PHP-FPM was not restarted, so the running pool stayed in profile mode and kept writing cachegrind files.
• One Save fired as many concurrent service restarts as there were changed settings, and one that lost the lock could leave PHP-FPM stopped.
• Certificate expiry was never checked. An expired certificate sat on disk unrenewed, so the browser refused the site while the app considered the certificate present.
• The diagnostics trust check passed unconditionally — it counted every certificate on the system and never looked for the one it was checking.
• An undefined directive in the php.ini panel showed its default as though it came from the file, and switching PHP version carried the previous version's values across.
• An extension registered in php.ini read as disabled; enabling it added a second registration and PHP loaded it twice.

Added

• Update and restart. The new version is copied next to the target while the app is still running, so after quitting only two same-volume renames remain — the window in which no application exists lasts milliseconds rather than seconds. The old bundle is not deleted but moved aside: it is removed once the new version has launched and stayed alive, and put back if it has not. Your Homebrew services keep running — you are updating the app, not shutting down your environment. If the target folder is not writable the button is not offered at all and dragging stays the primary action; teaching people that BRAMPP asks for their password to update itself is teaching them exactly what an attacker wants.
• Repair configuration, in Diagnostics — shown only when there is something to repair. It fixes the old Alias order in the phpMyAdmin/Adminer configuration: the file is backed up as .brampp.bak, configtest is run, and the backup is restored if it fails.

Changed

• The shared address arrives sooner. The wait polled the system resolver for a full 45 seconds. Measured on a live tunnel: dig @1.1.1.1 resolved the name in 0.02s while the system resolver could not resolve it at all. Going by dig alone would be wrong — browsers use getaddrinfo, and calling it ready on the edge's answer hands over a link that will not open. Both run together: dig only establishes that the name exists at the edge, and the moment it does, the system resolver gets six seconds instead of forty-five before the address is handed over with the warning it already carried.

Fixed

• The update window opened behind the main window. Activating the app brings its own main window forward, leaving the notice that had just been ordered front underneath it — so the window opened and the user never saw it.

Fixed

• Running the unit tests — or simply having a second copy of BRAMPP open — tore down the live environment. Cloudflare tunnels were killed, their pid and log files deleted, the MCP port was bound on top of the copy already holding it, Homebrew services were started, and the "last running services" list was overwritten. The machine-wide state BRAMPP keeps belongs to the machine, not to a process; only the primary instance touches it now (Core/ProcessRole.swift). Console lines also carry which process wrote them, because the installed app, an Xcode build, the test host and previews all append to one file — that is what made this so hard to see.
• A share kept being reported as live after its cloudflared had died. The Services row stayed green, the MCP list_shares tool still handed out the address, and Cloudflare answered Error 1033. Tunnels are now checked against reality on the refresh loop that was already running.
• Quitting a second copy of BRAMPP killed the first copy's live tunnels. A quitting process now only stops the tunnels it started itself.
• "Stop sharing" reported success while the site stayed public. There was no SIGKILL escalation and the wait was 0.4 s against cloudflared's 30-second grace period.
• Restoring a database reported success when it had failed. The script ran if psql …; then exit 0; fi and read rc=$? afterwards — in POSIX an if whose condition fails and which has no else exits 0, so the failure code was never seen. Both PostgreSQL and MariaDB.
• Uninstalling MariaDB, PostgreSQL or Python said only that "the package and its config files will be removed" — while the script deleted the data directory: every database, or the whole site-packages tree. The confirmation now names the concrete paths, separates configuration from data, says what dies, and asks you to type the service name.
• The generated phpMyAdmin and Adminer Apache configs made apachectl configtest warn AH00671. The two Alias directives were in the wrong order, so the second could never match.
• Three console lines printed their raw translation key instead of text.

Added

• An update notice on launch — the installed version, the new version, the release notes as a scrollable list, and the choice to skip that version or be reminded later.
• A dedicated Updates tab in Settings: channel, check now, automatic checking, automatic download, and what to do when one is found.
• Downloads are verified before anything opens — the checksum published in the update manifest, that the file really came from the expected release asset (re-checked after redirects), the code signature, that the Team Identifier matches the running app's own, and Gatekeeper's notarization verdict. Any failure deletes the download. BRAMPP never replaces itself: the verified disk image is handed to you.
• The manifest's blockedVersions and minimumOS are honoured, so a release that turns out to be harmful can warn the people already running it.
• A button on the cloudflared row in Services that stops every open share at once, next to the menu bar command that already did it.

Changed

• Update checking reads the published manifest for the version and the checksum, and GitHub only for the release notes — so the host that serves the file is not also the host that vouches for it. When the manifest lags behind, the check falls back to GitHub and offers the release page instead of an unverifiable download.
• The release script publishes that manifest itself, with the real checksum, and only for a build that was actually notarized.
• The unused project framework detector was removed.

Added

• Services can be installed from the assistant too — install_service, limited to BRAMPP's own catalogue so an arbitrary formula name is refused.
• Project actions on the domain row — open the folder in an installed editor, open a terminal there, run composer or npm. Nothing appears unless it applies: no composer.json means no composer entry, and npm scripts are read from package.json. A menu item that errors on click is worse than no menu item. Editors are found by their .app bundle rather than their command, because a perfectly normal install can leave the CLI off PATH.
• Mailpit, as a real brew service — unlike cloudflared it is a proper daemon. Mail sent to 127.0.0.1:1025 stays on the machine, and there is a button to open the mailbox once it is running.
• An environment diagnostics panel. The port-ownership, config-syntax and mkcert trust-store checks now run together, on demand, from the Services tab, rather than surfacing as log lines after something has already failed. A port finding names the process and PID holding it rather than saying "in use", because which one it is decides what you do next.
• A brampp.yml project manifest, carrying a domain's settings in the project folder so cloning the repo on another Mac sets the environment up the same way, alongside framework detection that names what it finds in a project. (Both removed in 1.5 and 1.6.)
• Static update manifests for all three platforms were published. The ones without a release carry a null version, so a client can tell "nothing released" apart from "could not check".

Changed

• A shared site no longer pays for name resolution on every request. The tunnel used to point at the domain, which on a .local name goes to Multicast DNS and times out after five seconds before falling back to the hosts file — measured on a real site: 5.01s with the name, 0.012s straight to the address. It now connects to 127.0.0.1 and carries the domain in both the Host header and the TLS server name, so the vhost and the certificate still match. Sending only the header returns 421.
• The address is not handed to you until it resolves. It was reported the moment it appeared in cloudflared's log, while the DNS record was not yet visible to the machine — open it then and you get ERR_NAME_NOT_RESOLVED. The wait now goes through getaddrinfo, the same path the browser takes. dig was the wrong check: it queries the server in resolv.conf directly and can succeed while the system resolver still fails. Measured against a fresh tunnel name: Google DNS answered 1 of 6 attempts, Cloudflare's own resolver 6 of 6. If the wait runs out the address is still returned, with a console line naming the cause.

Fixed

• cloudflared reported as not installed while sitting in /opt/homebrew/bin. Install detection for runtime services switches on category, and the sharing category fell through to the default branch that returns nothing — so it could never report as present, whatever was on disk.
• A real Apache warning was reported as all-clear. Apache tags warnings by module — [alias:warn] — with the word "warning" never appearing, so a check matching only on that word missed a genuine warning on this machine.

Added

• Database backup and restore over MCP — db_export and db_import. MariaDB/MySQL uses mysqldump --single-transaction --routines --triggers, a consistent snapshot that does not lock InnoDB tables. A failed export deletes its partial file, because a corrupt backup is worse than none.
• Update check — Settings asks GitHub for the latest release on request. It never self-updates and the download stays in your browser.
• A second skill file, brampp_mysql, covering the database tools and their safety rules.

Fixed

• Nginx was never detected as running. Its master process rewrites its own title to nginx: master process …, so a pgrep -x nginx check could never match. This was also why a newly added domain seemed to need a stop and start before it appeared.
• The installer could hang forever. Homebrew's confirmation prompt ends in a carriage return, and the code that flushed the buffer discarded the prompt along with it — so the countdown waited for something it had already thrown away.
• "Open Main Window" did nothing from the menu bar, because the panel holds key-window status at click time and only gives it up after the action returns.
• The web server joined the dependency chain. Starting an ASP.NET Core, Node or Python app behind Apache or Nginx now starts that server too, and a dependency that is not installed is reported rather than silently skipped.