Phase 1 of the redesign shipped two weeks ago. This was phase 1.5: the unglamorous grind of fixing everything phase 1 revealed once real humans started clicking around in it. The nav rail's hover and pressed states got tightened up to actually match the designs. A couple of spots diverge on purpose, because pixel-perfect and usable aren't always the same thing, and we know which one we're optimizing for. The notification panel got several passes of polish, including clipping card stacks so they stop peeking out from behind the top card like a nosy coworker reading over your shoulder.

Reactions, the mention list, and chat message legibility all got real fixes instead of good-enough ones, and we finally stopped rendering post headers and name changes as monospace code. They're just text, they don't need to look like a terminal pretending to be helpful. Mobile web caught up too: group, chat, and stream settings all got their layouts fixed so they stop looking like they were designed for a much wider screen. Because, until this week, they were.

Since I teased it, Josh has kept building the desktop app. It now has light and dark mode, a real topbar with forward and back navigation — which correctly disables itself when there's nowhere left to go, a two-commit feature, because apparently knowing when you can't go back is harder than actually going back. Recording from your microphone works now. Fullscreen video works now. The macOS dock icon shows your unread count too, though per Josh's own commit message that one is “effectively untested since notif stuff doesn't work well on macOS” — his words, now yours, since I just told you.

The best change, though, is invisible. Logging in used to happen inside the app's own embedded browser, which is exactly the kind of thing that makes SSO miserable and makes anyone with security instincts side-eye a password field. Now the app hands login off to your actual browser — the one where you're probably already logged in to Slashwork, or at least to Google — and gets the session back through a small local HTTP server and a handoff token. It's a genuinely convoluted little dance of IPC calls, but the payoff is that you never have to trust a login form embedded in an app shell again. Worth every bit of plumbing it took to get there.

We turned SSO on for our own team first, on our own subdomain, which is the correct order of operations for anything you're eventually going to sell to an enterprise customer: eat your own login flow before you make someone else eat it. That surfaced a small but telling bug — two different identity providers use different words for what is, functionally, the same discovery URL field. Get that wrong and you look sloppy in front of exactly the audience you can least afford to look sloppy in front of.

We also started laying pipe for SCIM, the protocol that lets an identity provider automatically create and deprovision user accounts instead of someone in IT clicking through a spreadsheet. This week that meant a company-level config table — with a hashed token, because you never store the real one — and new columns on the user table to track who was provisioned by SCIM and when. None of it talks to an actual endpoint yet; that part is very much coming soon. But the foundation landed, and it's the kind of enterprise plumbing that makes your IT admin's life easier the day it does.

Voice messages have quietly rendered differently depending on whether you were looking at them on web or on native. Web treated the audio player as its own block, spanning the full width of the post. Native treated it as inline, like a strange little chip wedged between text. They match now — audio is a block-level element everywhere, which was already correct on web and is now correct on native too.

We also normalized waveform output so the bars you see actually reflect how loud the recording is, instead of a rough approximation, and cleaned up how those bars render on native so they look like an intentional design instead of a wireframe nobody got back to.

Links got a real pass this week, not just a bug fix here and there. On web, the composer now actually knows where you are: paste a link on its own line and you get a full preview card; paste it inline, or inside a bullet list, and you get an inline chip instead, because a full card in the middle of a list item never made sense. Links also can't sneak into code segments anymore — a blue underlined URL inside a code block is its own special kind of ugly.

On mobile, autolinking — the thing that turns a URL you type into an actual tappable link — got a debounce on both iOS and Android, along with fixes for a couple of crashes that could happen while it worked out what you'd just typed. Link previews got hardened across the board too, including a fix for occasionally grabbing the wrong canonical URL for a page entirely. None of this is glamorous. All of it is the difference between a link that works and a link that works until you look at it funny.

We also started poking at why search has felt rougher than it should for a while now. Nothing user-facing yet — this is very much step zero — but the diagnosis is done and the fixes are coming fast. More very soon.