Commits

main · package-lock.json

Pins: openvibe-shared 1.18.0 -> 1.20.0 (the update matrix and release manifest 1.2.0: client generations, the shell)OpenVibers · 26 Sept 2026 9b7da46
Pins: openvibe-shared 1.17.1 -> 1.18.0 (update telemetry: prompted count, sessions by generation)OpenVibers · 26 Sept 2026 252ac09
Pins: openvibe-shared 1.16.1 -> 1.17.1 (release notifications)OpenVibers · 26 Sept 2026 df36e31
Pins: openvibe-shared 1.16.0 -> 1.16.1 (the OV mark stops animating when idle, hidden or off-screen)OpenVibers · 26 Sept 2026 0fc8f2e
Pins: openvibe-shared 1.13.0 -> 1.16.0OpenVibers · 26 Sept 2026 15b266b
Chat rooms on the realtime plane (WS-I task 9, contracts 0.57.0): a message in a public room is announced as chat.room.message.created (visibility public) in the transaction that stores it; deleting one, or turning the room private, announces chat.room.message.deleted with a redaction so it stops being replayable; private rooms and DMs never leave Chat. Pins: openvibe-contracts 0.49.0 -> 0.57.0OpenVibers · 26 Sept 2026 593513b
Pins: openvibe-shared 1.12.0 → 1.13.0, openvibe-sdk 0.9.1 → 0.11.0OpenVibers · 25 Sept 2026 a7cfa50
Platform blocks (WS-E task 5, Contracts 0.49.0): Chat consumes network.block.changed into a newest-revision projection, and a network block counts like dm_blocks for new DMs, 1:1 messages, group invites, calls and the DM user search, both ways; scripts/migrate-dm-blocks-to-network.js exports dm_blocks as subject pairs for Network's import (dry run by default)OpenVibers · 25 Sept 2026 ea1770a
Pins: openvibe-contracts 0.42.0 → 0.44.0 (Contracts 0.43.0 and 0.44.0 were released after the previous pin commit, leaving 0.42.0 two minors behind the pin-drift limit)OpenVibers · 25 Sept 2026 c09411e
Pins: openvibe-contracts 0.41.0 → 0.42.0, openvibe-sdk 0.7.0 → 0.9.1; CI runs the pin-drift check (shared test and security workflows at 423fe51)OpenVibers · 25 Sept 2026 78ee215
Chat owns chat.tts_defaults, chat.dm_settings and chat.presence_prefs (Contracts 0.41.0, WS-B task 9): one module store per namespace (server/prefs/module-store.js), /api/chat/tts-settings, /dm-settings and /presence beside /preferences, openvibe.chat Settings edits all four; DMs honour new_conversations nobody (existing conversations stay open) and group_invites; user lists count, never name, someone hidden; network.module.updated refreshes themOpenVibers · 25 Sept 2026 2bdb0cf
Contracts 0.40.0 (the chat manifest names openvibe.chat)OpenVibers · 24 Sept 2026 3c06399
openvibe.chat, the site (WS-I task 8): global chat (server-rendered, live over /ws/chat), messages (inbox, conversations for participants only, start one by username) and settings (the chat.preferences record Live's chat reads), /updates, robots and sitemap, served by Chat itself so it works with Live down. Sign in with OpenVibe.Network (client chat, CHAT_WEB_URL/auth/callback); the Frame from this site's own /shared/ (openvibe-shared 1.12.0). Forms post without JavaScript through the same API handlers (one set of checks), only from this origin. test/web.test.jsOpenVibers · 24 Sept 2026 4937946
Revocation propagation (WS-B task 4, Contracts 0.39.0): Chat subscribes to network.user.token_valid_after, keeps the latest cutoff per subject, refuses Network tokens issued before it (locally and on the Live fallback) and closes the person's sockets opened with older tokens (4001, auth_revoked) within the event's delivery; bots' API-token sockets stay. test/revocation.test.jsOpenVibers · 24 Sept 2026 a2b12b5
One W3C trace across services (Track O): openvibe-shared v1.7.0 trace.install(app) keeps each request's traceparent and puts it on the calls made while serving it, to loopback and OpenVibe hosts only; Chat also takes the request context from openvibe-contracts http.middleware()OpenVibers · 24 Sept 2026 325f878
VIP client from openvibe-sdk/vip (v0.7.0): the copy of openvibe-vip/client is replaced by the SDK's published seam, same API and fail-closed behaviour; server/vip/vip-client.js re-exports it so callers are unchangedOpenVibers · 24 Sept 2026 4e95c11
Release manifest and metrics (Track R D43, Track O): openvibe-shared v1.6.0; GET /release.json (release, contracts and package versions) with POST /release-metrics, and GET /metrics (loopback only: request rates and latencies, process metrics, release_info) mounted before every routeOpenVibers · 24 Sept 2026 9ebde51
Staff gates ask the contracts staff map (D05, ADR-022): permissions.can(user, 'staff.<area>.<action>') over openvibe-contracts v0.35.0 (issued staff_caps claims win); per-IP and ban exemptions are staff.limits.exempt, chat-restriction bypass staff.moderation.bypass, purge/export/deleted-message views staff.moderation.purge, sound management staff.assets.manage, and the moderation/log helpers answer through the map. Same answers as before for every role; the one rank check left compares the target. test/staff-capabilities.test.jsOpenVibers · 24 Sept 2026 990fbd1
Sound uploads convert through OpenVibe.Tools (platform S9): the mp3 tool's run API via openvibe-sdk/tools (v0.6.0) with Chat's service token (tools.tool.run, tools.job.read), 128 kbps 44.1 kHz stereo, the result downloaded from the jobs facade; local ffmpeg whenever Tools is down, busy or refuses (CHAT_TOOLS_AUDIO=off skips it). test/tools-audio.test.jsOpenVibers · 24 Sept 2026 1d0e12a
openvibe-contracts v0.33.0OpenVibers · 23 Sept 2026 fcc824a
openvibe-contracts v0.32.0: chat.message.send is chat's own capability, checked with a literal idOpenVibers · 23 Sept 2026 4abf0fa
Events consumer (compatibility register C-84): Chat subscribes to live.release.deployed and network.module.updated and receives them at POST /internal/events (server/events/consumer.js). live.release.deployed makes the deploy card exactly as the bridge op deployNotice does (same fold: newest row in any room is a deploy card under 3 hours old; same broadcast passes and late-joiner replay), keyed by subject.id, the head commit. Both paths claim the head in the new deploy_releases table in the transaction that stores or folds the card, so while Live sends both the same head is one card whichever arrives first; the second only records bridge_at / event_at. The bridge's head is its first commit (Live sends them newest first). A retried bridge op, a redelivered event and Live re-announcing after a crash are the same card; a redeploy of an already announced head (a rollback) says nothing; a release event older than 6 hours (an operator replay) is ignored:stale. The bridge call keeps working. network.module.updated for chat.preferences goes to prefs.handleEvent(): a newer revision drops the cached copy at once instead of within CHAT_PREFS_TTL_MS, an older or equal one and other namespaces change nothing (and are not recorded). Exactly once: the openvibe-sdk inbox (chat_event_inbox, pruned after 35 days) claims (chat, event_id) in the same transaction as the change; broadcasts run after the commit; a failure is 500 and Events retries. Signature v2 only (parseDelivery requireV2, ±300 s) under CHAT_EVENTS_SECRET (comma list for rotation, 32+ characters each): bad, stale, v1-only or unsigned is 401, no secret 503, a forwarded request 403. Subscriptions are created at boot when missing (server/events/subscriptions.js: list, then create, 409 = exists; retried in the background at 10 s, 1, 5 and 15 min), an existing one is left as it is even when disabled; CHAT_EVENTS_SUBSCRIBE=0 turns it off, CHAT_EVENTS_ENDPOINT overrides http://127.0.0.1:<PORT>/internal/events. scripts/subscribe-events.js --dry-run | --disable | --enable. Needs the Network grant chat events.subscription.manage openvibe.events. /ready reports the consumer's counters under events.consumer. Adds openvibe-sdk v0.5.0. test/events-consumer.test.js: signature checks, the inbox, bridge-then-event and event-then-bridge for one head, folding and a stream message starting a new card across both paths, release validation and staleness, the preferences cache with older revisions ignored, idempotent boot subscriptions against a stub Events, inbox pruning. README (Events: Consumed), .env.example, STATUS.jsonOpenVibers · 23 Sept 2026 ed90461
openvibe-contracts v0.13.0 (chat capabilities and manifest released); contracts check is blockingOpenVibers · 23 Sept 2026 b87ea39
Chat service: Live's chat behind a service boundary (roadmap Wave 6)OpenVibers · 23 Sept 2026 abf1e4b