Commits

main · package-lock.json

proxy-addr 2.0.8 (critical GHSA-jqcg-44mw-7w3h: IP spoofing via IPv4-mapped IPv6). (#36)OpenVibers · 7 Oct 2026 198a7a7c
Stop Live through openvibe-sdk gracefulStop and pin the SDK at v0.26.0OpenVibers · 4 Oct 2026 37c2907a
Bump openvibe-shared v2.4.0 → v2.5.0 (#15)OpenVibers · 3 Oct 2026 0e9b8e4e
Build Live SEO, discovery files and cache headers with openvibe-shared (#10)OpenVibers · 2 Oct 2026 9e64b181
Merge pull request #3 from OpenVibers/agent/bump-openvibe-shared-v2.3.1-mupvaa5xOpenVibers · 1 Oct 2026 51f772be
CI green on main: openvibe-contracts v0.83.0 and a gitleaks allowlist for the site-config fixtureOpenVibers · 1 Oct 2026 325232e4
Bump openvibe-shared v1.30.1 → v2.3.1OpenVibers · 1 Oct 2026 f08ddcd5
Pin openvibe-shared to v2.3.1 to clear the pin-drift checkOpenVibers · 1 Oct 2026 c442a01c
finish-f1: test / test: Updated [package.json](/home/workstation/openvi…OpenVibers · 1 Oct 2026 e78e4f79
Add gated PostgreSQL page analytics sliceOpenVibers · 1 Oct 2026 dc6eb160
Page moves never flash unstyled: openvibe-shared v1.30.1 (from v1.29.2) inserts a route's markup once its stylesheets are in, and showPage hands the page to ov.enter(), which keeps it hidden (in its space) until the route's styles and code are ready, runs a real progress bar from the click, shows 'Loading Content…' with the phase after 150 ms, then fades the page in (opacity only). Live's own timer-based route bar and page rise (ovRouteProgress, ovAnimatePageEnter, #ov-routebar, .page.is-entering) are gone. Measured locally at 400 ms latency. npm test 151/152, 1 skipped.OpenVibers · 29 Sept 2026 c201d8c1
openvibe-shared v1.29.2 (from v1.29.1): the Go Live dropdown (Dashboard) in the navbar opens again; the links row, which scrolls sideways, was clipping it. npm test 150/151, 1 skipped.OpenVibers · 29 Sept 2026 04eb248a
Channel social links, and the offline channel page reorganized for wide screens.OpenVibers · 29 Sept 2026 14f16182
The home banner's go-live area, redesigned: a primary "Go live from your browser" button and a "How it works" button side by side (stacked full width on phones), with what you don't need as one checklist line (no OBS, no downloads, no follower minimum, Chromebook, laptop or phone). The card inside the banner is gone: on phones it wrapped its bolt icon onto a row of its own, leaving a block of empty space, and read as a box inside a box; the loose "How browser streaming works" link is now the second button. The lede is shorter and the chips smaller. openvibe-shared v1.28.1 (from v1.25.0): the account panel keeps its sections' height on phones, no empty space under the footer on phones, async Express handlers' errors reach the error handler (1.27). npm test 149/150, 1 skipped.OpenVibers · 28 Sept 2026 a825d806
Live talks to OpenRe.Stream through openvibe-sdk/openre (SDK v0.16.0, from v0.12.0) instead of its own HTTP client. server/openre/openre-client.js keeps Live's settings (OPENRE_URL, OPENRE_PUBLIC_URL, the service principal), the on/off switch and every name the rest of Live calls: streamForSlot is streams.byExternalRef, and createStreamForSlot, rotateKey, getStream, getSession and playback (cached 10 s in the SDK) are the SDK's. SDK errors keep the OpenReError shape (status, code, body) that the admin routes answer with. The client is rebuilt when OPENRE_URL changes, so unsetting it is still the rollback for every switched slot. openre-switch passes unchanged. npm test 149/150, 1 skipped.OpenVibers · 28 Sept 2026 068d5597
npm test no longer counts a skipped test as passed (roadmap WS-Q task 7; Shared v1.25.0 openvibe-shared/test-runner). test/run.js is now the shared runner (same files, parallelism, 120 s timeout and [DB] filter) with the skip rule: a test prints "<label>: skipped (<why>)" for what it could not run, and that file is listed with ○ and its reasons, not counted as passed. The four tests that skipped part of themselves in free-form words now print that line: audio-events-bad-segment (OK B without a local model), restream-manager-lifecycle (the ACK test without ffmpeg), ai-remote-only (media analysis with speech without ffmpeg) and lineage-resolver (contract validation on an older openvibe-contracts); rollback-newer-writes and transcript-ai already did. Here the run reads 149/150 test files passed, 1 skipped (no local audio model), where it said 150/150. openvibe-shared is pinned at v1.25.0 (from v1.23.1; 1.24.0 adds the readiness skip, which Live's checks do not use).OpenVibers · 28 Sept 2026 278cd404
Per-actor limits on Live's API writes (roadmap WS-R task 4; openvibe-sdk 0.11.0 -> 0.12.0 openvibe-sdk/limits). server/net/actor-limits.js counts writes by the person behind the token: their Network subject, or the person who made an hbt_ token.OpenVibers · 28 Sept 2026 85fc2faf
Live takes part in account export and deletion (roadmap WS-B task 7, ADR-033; openvibe-contracts 0.70.0 -> 0.71.0). network.account.export_requested and network.account.deleted arrive at POST /internal/network-events (the --network subscription now asks for both) and server/auth/account-data.js applies them once per export or deletion (account_data_events), answering after Network took the part or confirmation, so a failure is redelivered without erasing twice.OpenVibers · 27 Sept 2026 585428dc
openvibe-shared 1.23.0 -> 1.23.1: release-watch drops an in-place region fetched for the previous account when openvibe-auth-changed fires and fetches it again with the new session (D46 scenario 9, which Live's in-place account switch needs), and an online tab reconnects the release stream at once even while backing off (scenario 14). npm test 142/142.OpenVibers · 27 Sept 2026 0481e9ce
Live follows account merges (roadmap WS-B task 5, ADR-029; openvibe-contracts 0.68.0 -> 0.70.0). network.subject.merged arrives at POST /internal/network-events (the --network subscription now asks for it) and server/auth/subject-merge.js applies it once per merge_id (subject_merges). With a Live user for each account, the folded-in user's follows (as follower and as the channel), channel points (as viewer and as the channel; a pair both hold is summed, each move logged out and in in channel_points_log with reason account_merge) and streams move to the survivor's user in one transaction, a follow it already has or following oneself dropped and counted, and the folded-in user is marked merged_into. With only the folded-in account on Live, that user is relinked to the survivor (subject and Network user id, resolved from Network). The handler answers after the merge applied, so a failure is redelivered. test/subject-merge.test.js: moves and clashes, summed points and the balanced log, streams, the relink, redelivery, nothing-to-do and ignored cases. npm test 141/141.OpenVibers · 27 Sept 2026 4b7fa3f0
Live's feature loader runs on the network's web runtime (roadmap WS-P task 6; openvibe-shared 1.22.0 -> 1.23.0). public/js/ov-loader.js was extracted into openvibe-shared/web-runtime.js and is now a 50-line wrapper: it reads the #ov-assets registry and hashes, keeps Live's stylesheet slot (split-out rules above the ov-css-anchor, as server/web/assets.js isEarlyCss), the stub-failure toast and the route-error icon, and exposes the same window.ov, ovLoadRoute and ovPrefetchRoutes. index.html loads /shared/web-runtime.js (served and hashed like the other shared files) just before it. What Live gains: a feature whose script fails rolls back (its new stylesheets leave, the retry fetches only what is missing), route scopes refuse registrations that arrive after their route ended, scope.fetch aborts with the route, a prefetch budget, and ov.diagnostics()/ov.leaks(). Home page eager JS is 259.7 of 260 KB brotli (the runtime used the headroom; no budget raised). npm test 139/139; test/browser/smoke.js against a local drill instance passes (every route at 4 widths, no script twice, no navigation errors, no growth over laps); ov.leaks() is empty after six SPA navigations.OpenVibers · 27 Sept 2026 d4c15e17
Creator analytics through Network (roadmap WS-E task 6; Contracts v0.68.0, pinned from 0.56.0). live.stream.ended carries the stream's totals (stats: peak and average viewers, unique chatters, messages, watch minutes; counts only), computed in the transaction that ends the row. With ANALYTICS_SOURCE=network, /api/analytics/channel/:username and its dashboard read Network's creator analytics with Live's service token (network.analytics.creator.read) and merge Live's own per-stream extras (coins, new followers, clips). Unset, or with no subject or Network down, they use Live's tables as before. test/network-analytics.test.jsOpenVibers · 26 Sept 2026 83ad224f
Pins: openvibe-shared 1.20.0 -> 1.22.0 (realtime notification badge, off until a site turns it on; the unreachable-host browser check)OpenVibers · 26 Sept 2026 8caa5404
Pins: openvibe-shared 1.19.0 -> 1.20.0 (the update matrix and release manifest 1.2.0: client generations, the shell)OpenVibers · 26 Sept 2026 d1fcb692
Pins: openvibe-shared 1.18.0 -> 1.19.0 (the update matrix: ov:content-dispose before a region is replaced)OpenVibers · 26 Sept 2026 53c9abd7
Pins: openvibe-shared 1.17.1 -> 1.18.0 (update telemetry: prompted count, sessions by generation)OpenVibers · 26 Sept 2026 af826304
Pins: openvibe-shared 1.16.1 -> 1.17.1 (release notifications)OpenVibers · 26 Sept 2026 f2b8508b
Pins: openvibe-shared 1.16.0 -> 1.16.1 (the OV mark stops animating when idle, hidden or off-screen)OpenVibers · 26 Sept 2026 2514d149
Pins: openvibe-shared 1.14.0 -> 1.16.0OpenVibers · 26 Sept 2026 834d9d4b
Loyalty summary (WS-K task 9): Live writes its private live.loyalty user module on Network: channel points across channels and the top ten by points, the Arena Trash Level and XP (loyalty, never money; contracts 0.56.0). Viewers with points get it without streaming; points change while people watch, so at most one write per half hour except the daily refresh; the scan picks up changed points and Arena XP; a record whose points are gone is zeroed, not left stale. Pins: openvibe-contracts 0.52.0 -> 0.56.0OpenVibers · 26 Sept 2026 bf068778

More commits