# Changelog

What changed in OpenVibe Connect, newest first.

## Unreleased — 2026-11-03

- Durable webhooks, hardened (CON-15): a share holds at most 1,000 waiting webhooks for 72 hours, every body is
  sealed at rest with a key derived from the session secret, and the app gets `x-openvibe-received-at` so it keeps the
  original arrival time. The owner gets a delivery log (page and `GET /api/v1/shares/:id/hooks/:hook/deliveries`).
  Events' retries now span the same 72 hours. Migration `0012_hook_deliveries`.

- MCP OAuth 2.1 (CON-16): a share's address works as a connector in Claude or any MCP client. The client is sent to
  Connect to sign the person in with OpenVibe: protected-resource metadata on the share, then registration, authorize
  with PKCE S256 and consent, then tokens bound to that share and rotated on refresh. The owner sees and signs out each
  app (`server/oauth.js`, `server/http/oauth-routes.js`, migration `0010_share_oauth`).

- API keys, v1 (CON-16): a key may have a daily quota (`per_day`, UTC days, kept across restarts; over it, 429
  `key_daily_quota` until midnight UTC), and the share page shows what each key did today: its requests, the MCP tools
  it called and the models it asked for, by name and count (migration `0009_share_api_key_usage`).

## 0.1.0 — 2026-11-02

The first version (Website Connect v0, plan 2026-10-28 §5.9b; ADR-057 as reviewed 2026-11-02, OQ-13): your
computer, on the web, privately.

- **Shares.** A person makes a share (a name and a local port) and it answers at
  `https://<name>--<user>.openvibe.website`. OpenVibe.Space's site names can never contain "--", so the two never
  meet. Five open shares per person; a closed share keeps its address.
- **The client.** `public/ov-connect.js`: one file, Link 22+, no dependencies. It opens one outgoing WebSocket to
  `wss://connect.openvibe.website/tunnel` (through Cloudflare on 443), says hello with the share's key, and carries
  requests to `localhost:<port>`: HTTP with streaming bodies both ways, server-sent events, and WebSocket upgrades as a
  byte pipe. It reconnects after sleep, stops on a wrong key or a closed share, and a newer client takes over.
- **The gate.** Every visitor signs in with OpenVibe: `/grant` checks the share's policy (only me, me and named
  people, anyone signed in) and hands the share host a one-time code; the host sets its own `__Host-ovc` cookie.
  Changing who may open it signs everyone out of that share.
- **What the app gets.** Host `localhost:<port>`, the share's host in X-Forwarded-Host, the visitor in
  X-OpenVibe-User and X-OpenVibe-Subject; never the gate's cookie. Set-Cookie loses its Domain; nothing is cached by
  Cloudflare.
- **Pages and API.** The front door (sc.room), your shares and the form, a share's page (connected or not, who may
  open it, who did in 7 days, a new key, closing), and `/api/v1/shares` for a person's token.
- **Account export and deletion** (ADR-033): shares (without the key hash) and visits.
- **Checks:** the pure rules, the pages, sign-in, account data, and a share end to end through a real client and a
  real local app.