SimplexityAI v5.1.0

A security and packaging release. Notification content is now sanitised before rendering, Intel Macs get a build for the first time since v5.0.0, the macOS tray icon works at all, and the second sidebar tab is back as a proper second Perplexity workspace.

Security

Notification content is sanitised

Reported by @anupamme in #49. Notification markdown is fetched from a remote feed and was being passed straight to innerHTML without sanitisation, along with the feed-supplied title. Both are now run through DOMPurify, which strips javascript: links and dangerous attributes while leaving normal formatting intact.

Impact was bounded — the notification window runs with contextIsolation: true and nodeIntegration: false, so a payload had no access to Node or the filesystem — but it was a real cross-site scripting hole and worth updating for.

No more scripts loaded from a CDN at runtime

marked and DOMPurify were being pulled from jsDelivr on every launch, at an unpinned latest version. They now ship with the app, which removes a supply-chain exposure and means markdown renders correctly offline.

Content-Security-Policy

All three internal pages — update, notification and notification panel — now declare a CSP. Only the update page may reach the network, and only to raw.githubusercontent.com for release notes.

macOS

The tray icon now works

The macOS tray was broken: the .icns file contained only a 1024px entry, which Electron could not load, so creating the tray threw and took tray mode, Quick Search and tray autostart down with it silently. The tray now uses a correctly sized icon and is sharp on Retina displays.

Intel Macs are supported again

The macOS build had no architecture specified, so it was built as Apple Silicon only and Intel Macs had nothing to download. The macOS release is now a universal build that runs natively on both.

The download is larger as a result (166 MB, up from 92 MB), but there is only one macOS download and it works everywhere.

Correct entitlements

The app's entitlements file was in the wrong directory and had never been applied — the build was silently falling back to a default template. It is now used, with the sandbox entitlement removed so it is correct for a directly distributed app.

Changed

AI Labs is now a second tab

Perplexity retired the Labs destination. labs.perplexity.ai no longer resolves, and perplexity.ai/labs now lands on a product page rather than an app, so the AI Labs button had been quietly loading the same site as AI Search.

Since that button was mostly being used as a second tab, that's what it now is. Second Tab opens an independent Perplexity workspace: its own conversation, history and scroll position, switchable from the sidebar or with Cmd/Ctrl+2. Both tabs share your login, so signing in once covers both.

If AI Labs was your default view, the app switches you to AI Search rather than opening a dead page. You can set either tab as your startup view in Settings.

Background tabs no longer lose their state

An inactive view was being destroyed roughly five minutes after you switched away from it, so returning to it meant starting over. This affected AI Labs too. Both tabs now stay alive for as long as the app is running.

The app reopens where you left off

Nothing was remembering the page you were on, so every launch loaded perplexity.ai and the site decided where that landed — which for a signed-in user is Computer, even if you were last on Search. Each tab now reopens on the page you left it on. There's a new Reopen where I left off setting if you'd rather always start on your default.

macOS keyboard shortcut defaults were inconsistent

The defaults were defined in three places and had drifted apart, so Restore Defaults handed you bindings the app didn't actually register. There is now one definition. Two macOS defaults also changed, because global shortcuts shadow the binding in every application: Send to Tray moves from Cmd+W (Close Window) to Cmd+Shift+W, and Restore from Tray from Cmd+Shift+Q (macOS Log Out) to Cmd+Shift+T. Shortcuts you have already customised are untouched.

The Settings "Shortcuts" link works

It previously opened the repository home page instead of the shortcuts documentation.

macOS .zip download removed

The .zip existed only to support an auto-updater this app does not use. The .dmg is unaffected.

Build and release

• Release artifacts are no longer uploaded twice. The build tool had been publishing its own copies of every file alongside the intended ones, which is why release assets needed manual cleanup after every release.

• Every artifact now carries build provenance you can verify yourself:

  gh attestation verify <file> -R inulute/simplexity-ai-app
  

• Dead GPG signing code removed — it was never wired to anything and had never produced a signature.

• CI actions updated off the deprecated Node 20 runtime.

Known limitations

• macOS and Windows builds are not code-signed. Gatekeeper and SmartScreen will warn on first launch; on macOS, right-click the app and choose Open the first time. The signing path is wired and will activate once certificates are in place.

Thanks

• @anupamme — reported the cross-site scripting issue in notification rendering (#49). The fix shipped here is broader than the original patch, but the report is what surfaced it.
• @Rustlyr — reported that the app reopened on Computer instead of where you left it (#51), which turned out to be a complete absence of session persistence.