openvibers/openvibe.extensions CHANGELOG.md
CHANGELOG.md
| 1 | # Changelog |
| 2 | |
| 3 | The OpenVibe Companion's releases. Each one is a `browser/manifest.json` version and a [GitHub |
| 4 | release](https://github.com/OpenVibers/OpenVibe.Extensions/releases); older entries are in the git |
| 5 | history. |
| 6 | |
| 7 | ## 0.9.2 — 2026-11-11 |
| 8 | |
| 9 | - **The side panel's Dock is OpenVibe.Shared 4.212.0** (was 4.124.0), copied from the release with the |
| 10 | Companion's own two patches kept: the read-only Dock token renders the four server controls as links |
| 11 | to openvibe.codes, and a Live frame that refuses embedding falls back to the still and a **Watch on |
| 12 | openvibe.live** link (Firefox and an unlisted Chrome id never try the frame). |
| 13 | - The newer Dock brings its **Code** and **Actor** tabs, the one window (`ov-window.js`), the composer, |
| 14 | the glyph set, the theme loader and the agent sheet/session, all bundled under `browser/shared/` |
| 15 | because the extension's CSP allows no remote script. |
| 16 | - `AGENT_EMBED_EXTENSION_ORIGINS` on OpenVibe.Live is set to the extension's fixed Chrome id |
| 17 | (`chrome-extension://bjcjcfcecpkkmfndegkjekoipdmbgakd`), so the panel can frame the agent stream. |
| 18 | |
| 19 | ## 0.9.1 — 2026-11-07 |
| 20 | |
| 21 | - **The side panel's agent view can read.** OpenVibe.Codes' two agent-view read routes now accept |
| 22 | the Companion's Dock token (Network's private `<network>/dock` issuer and keys, the new |
| 23 | `agent.view` scope only); the panel's four controls stay read-only and open openvibe.codes. |
| 24 | OpenVibe.Live's embed lists an extension origin when the owner sets |
| 25 | `AGENT_EMBED_EXTENSION_ORIGINS`. |
| 26 | - When Live's frame is refused (Firefox, whose extension id changes per install, or Chrome before the |
| 27 | owner sets the id), the panel shows the still and a plain **Watch on openvibe.live** link instead of |
| 28 | an empty frame. A rendered embed announces itself (`postMessage`, carrying nothing), so a refused |
| 29 | frame is told apart from a loaded one. |
| 30 | - The OAuth grant asks for `agent.view` alongside `dock`, `activity` and `chat.read`. |
| 31 | |
| 32 | ## 0.9.0 — 2026-11-07 |
| 33 | |
| 34 | - **The side panel's Dock is the current released one.** `browser/shared/` moves from OpenVibe.Shared |
| 35 | 4.57.0 to 4.124.0: the Vibe tab, the timer, the realtime notification feed and the Agents tab's |
| 36 | **agent view** — the person's desk stream, the task line and worked time, and the owner's |
| 37 | **Pause/Resume**, **Curtain now**, **Mute/Unmute** and **End** controls. The new files are |
| 38 | `dock-vibe.js`, `dock-agent.js`, `dock-timer.js` and `notification-live.js`; `dock.js`, |
| 39 | `action-center.js`, `notification-ui.js`, `ov-mark.js` and `kit.css` are updated in place. |
| 40 | - **Manifest:** one host permission, `https://openvibe.codes/*`, for the agent view's API and its |
| 41 | still. The CSP now allows that origin in `connect-src`, `frame-src https://openvibe.live` for the |
| 42 | embed, `img-src 'self' blob:` for the still, and `style-src 'self' 'unsafe-inline'` because the |
| 43 | Dock draws its own styles in a `<style>` element (scripts stay `'self'` only). |
| 44 | - `panel.js` passes OpenVibe.Codes' origin (`agentBase`) to the Dock; `lib/config.js` names it. |
| 45 | - `scripts/check-panel.js` and `test/panel.test.js` load the unpacked extension in headless Chrome |
| 46 | and check the Agents tab draws the agent view with its four controls, its styles and no CSP |
| 47 | refusal. |
| 48 | - Known, pending outside this repository: OpenVibe.Codes' session check refuses the Dock's |
| 49 | `<network>/dock`-issued OAuth token, and OpenVibe.Live's `frame-ancestors` does not list an |
| 50 | extension origin, so the live view stays hidden in production until one of them accepts it. |
| 51 | |
| 52 | ## 0.8.1 — 2026-11-06 |
| 53 | |
| 54 | - The side panel opens on the page's Dock state and follows it: `dock.open({ doc })` gets the tab, |
| 55 | chat, agent and unread counts the page had, and the panel re-reads them every 30 s and when it |
| 56 | comes back. |
| 57 | |
| 58 | ## 0.8.0 — 2026-11-06 |
| 59 | |
| 60 | - One-click Dock sign-in: the Network's OAuth public client `companion` (PKCE S256, no secret), |
| 61 | read-only scopes `dock`, `activity` and `chat.read`; the access token in `storage.session`, the |
| 62 | rotating refresh token in `storage.local`, and Sign out revokes the family. The 0.7.0 pasted |
| 63 | token remains a fallback. |
| 64 | |
| 65 | ## 0.7.0 — 2026-10-30 |
| 66 | |
| 67 | - The OpenVibe Dock in the side panel (Chrome `side_panel`, Firefox `sidebar_action`) on every site: |
| 68 | the released OpenVibe.Shared Dock (4.54.0, then 4.57.0), bundled because the CSP allows no remote |
| 69 | script, reading and writing the same Network state as the Dock on a site. |
| 70 |