openvibers/openvibe.connect CHANGELOG.md
CHANGELOG.md
| 1 | # Changelog |
| 2 | |
| 3 | What changed in OpenVibe Connect, newest first. |
| 4 | |
| 5 | ## Unreleased — 2026-11-03 |
| 6 | |
| 7 | - Durable webhooks, hardened (CON-15): a share holds at most 1,000 waiting webhooks for 72 hours, every body is |
| 8 | sealed at rest with a key derived from the session secret, and the app gets `x-openvibe-received-at` so it keeps the |
| 9 | original arrival time. The owner gets a delivery log (page and `GET /api/v1/shares/:id/hooks/:hook/deliveries`). |
| 10 | Events' retries now span the same 72 hours. Migration `0012_hook_deliveries`. |
| 11 | |
| 12 | - MCP OAuth 2.1 (CON-16): a share's address works as a connector in Claude or any MCP client. The client is sent to |
| 13 | Connect to sign the person in with OpenVibe: protected-resource metadata on the share, then registration, authorize |
| 14 | with PKCE S256 and consent, then tokens bound to that share and rotated on refresh. The owner sees and signs out each |
| 15 | app (`server/oauth.js`, `server/http/oauth-routes.js`, migration `0010_share_oauth`). |
| 16 | |
| 17 | - API keys, v1 (CON-16): a key may have a daily quota (`per_day`, UTC days, kept across restarts; over it, 429 |
| 18 | `key_daily_quota` until midnight UTC), and the share page shows what each key did today: its requests, the MCP tools |
| 19 | it called and the models it asked for, by name and count (migration `0009_share_api_key_usage`). |
| 20 | |
| 21 | ## 0.1.0 — 2026-11-02 |
| 22 | |
| 23 | The first version (Website Connect v0, plan 2026-10-28 §5.9b; ADR-057 as reviewed 2026-11-02, OQ-13): your |
| 24 | computer, on the web, privately. |
| 25 | |
| 26 | - **Shares.** A person makes a share (a name and a local port) and it answers at |
| 27 | `https://<name>--<user>.openvibe.website`. OpenVibe.Space's site names can never contain "--", so the two never |
| 28 | meet. Five open shares per person; a closed share keeps its address. |
| 29 | - **The client.** `public/ov-connect.js`: one file, Link 22+, no dependencies. It opens one outgoing WebSocket to |
| 30 | `wss://connect.openvibe.website/tunnel` (through Cloudflare on 443), says hello with the share's key, and carries |
| 31 | requests to `localhost:<port>`: HTTP with streaming bodies both ways, server-sent events, and WebSocket upgrades as a |
| 32 | byte pipe. It reconnects after sleep, stops on a wrong key or a closed share, and a newer client takes over. |
| 33 | - **The gate.** Every visitor signs in with OpenVibe: `/grant` checks the share's policy (only me, me and named |
| 34 | people, anyone signed in) and hands the share host a one-time code; the host sets its own `__Host-ovc` cookie. |
| 35 | Changing who may open it signs everyone out of that share. |
| 36 | - **What the app gets.** Host `localhost:<port>`, the share's host in X-Forwarded-Host, the visitor in |
| 37 | X-OpenVibe-User and X-OpenVibe-Subject; never the gate's cookie. Set-Cookie loses its Domain; nothing is cached by |
| 38 | Cloudflare. |
| 39 | - **Pages and API.** The front door (sc.room), your shares and the form, a share's page (connected or not, who may |
| 40 | open it, who did in 7 days, a new key, closing), and `/api/v1/shares` for a person's token. |
| 41 | - **Account export and deletion** (ADR-033): shares (without the key hash) and visits. |
| 42 | - **Checks:** the pure rules, the pages, sign-in, account data, and a share end to end through a real client and a |
| 43 | real local app. |
| 44 |