CHANGELOG.md

Changelog

What changed in OpenVibe.Surf, newest first. Each site also publishes its patch notes at /updates.

Unreleased — one Computer

• The task card shows the Computer (plan 2026-11-07: "Surf, Computer and Actor are one experience"): the card
  reads the task's computer (session_id, machine, where, cost_hint, driving) and puts the machine and the
  cost where it says where the work happens. While the task runs it shows the Computer's newest frame as an
  <img class="ov-task-still">, refreshed every 2 s only while the page is visible, stopping when the task ends or
  the tab is hidden. It is a same-origin proxy (GET /api/v1/web/tasks/:id/still) so the person's token stays in its
  cookie; Actor answers 404 for another person's task, and the picture is Cache-Control: private, no-store.
• Take over / Give it back are now one API on the task: the card's button posts to Actor (/takeover,
  /giveback) through this site (POST /api/v1/web/tasks/:id/takeover and …/giveback, same-origin only). Take over
  goes to the desk's own page; Give it back returns to the card, which then says so. No new layout: the existing
  Take over control and one .ov-task-still size rule.
• The Dock's step carries the same computer (server/web/agent-step.js).

Unreleased — watch together

• Home Watch scene (server/views/index.js, server/http/pages.js): the home no longer shows the written-in
  goosely · Night owls: Seattle walk card. It fetches the head of the real GET /api/v1/watch/feed server-side
  (the feed's own 30 s cache) and renders the live, clip or AI moment cards, each linked to its Live or Video page.
  With no live streams it says "Nobody is live right now" over the latest clip; with no source at all it says so.
• Tests: test/pages.test.js pins the real card/link, the no-live state and the all-empty state.
• Watch together (server/watch/party.js, server/http/party.js, server/views/index.js,
  public/js/surf.js): a signed-in person opens a party (POST /watch/party) and shares an unguessable
  /watch/p/<id> link. The page reuses the TV markup with a sf-party- bar (members, host, Share, Leave); the
  host commands { channel_key, position_s, playing, at } from this site only, members follow over SSE
  (GET /watch/p/<id>/events) and correct drift over 2 s, and anyone can leave. State is one in-process Map,
  capped at 200 parties and 50 members each; an empty party ends 30 minutes after its last member leaves, and a
  restart ends every party. The optional chat room is a validated https://openvibe.chat/... link (no chat in
  Surf). nginx gets an unbuffered SSE location with a 1-hour read timeout.
• Tests: test/party.test.js covers create/join/leave, host-only and cross-site commands, SSE delivery, the
  30-minute TTL and the lowered caps.

0.1.0 — 2026-10-28

The service skeleton: three surfs, one room.

• Sign-in with OpenVibe.Network (server/auth/sso.js, OAuth client surf): authorization code with PKCE
  S256, a state check, a server-side code exchange, httpOnly surf_at and surf_rt cookies (SameSite=Lax,
  Secure in production), the surf_oauth flow cookie, and sanitizeNext (this site's own origin only, no
  control characters or backslashes). /auth/login, /auth/callback, /auth/logout, /auth/me.
• Watch (server/watch/feed.js, GET /api/v1/watch/feed): OpenVibe.Live's live streams
  (GET /api/streams), clips (GET /api/content/feed?type=clips&sort=new&window=week) and AI moments
  (GET /api/content/moments?type=clips&sort=top&window=week) merged into one item shape. Live streams first by
  viewers, then moments and clips interleaved by freshness, never two cards from the same channel in a row. The
  merged feed is cached 30 s; each Live source gets 2 s and a failing one is left out and named in sources. The
  topic filter, an opaque per-source cursor and public, max-age=30 are included.
• Ride (server/ride/games.js, GET /api/v1/ride/maps, /api/v1/ride/maps/:id): a proxy to OpenVibe.Games'
  /api/surf/maps routes, cached 60 s, each map carrying its
  https://openvibe.games/play/surf?map=<id>&embed=1 embed URL. While Games' new routes answer 404 the list is
  empty and games is 'not_ready'; a Games failure is a 502 and is never cached.
• Web (server/web/tasks.js, POST /api/v1/web/tasks, GET /web/go): Surf with Vibe. A signed-in,
  same-origin request creates one OpenVibe.Actor task with the person's own Network token from surf_at as a
  Bearer, an Idempotency-Key, and a short browsing brief (search_web, read_page, a desk when a page needs one,
  keep sources, finish with a cited report). Answers { task_id, page }; Actor's 4xx refusal keeps its status
  and words. POST /web/go is the same task as a no-JavaScript form (this site only) that 303s to the Actor task page.
• Pages (server/http/pages.js, server/views/index.js): /, /ride, /ride/:map, /watch, /web,
  /developers and a 404, all server-rendered through the OpenVibe Frame and complete without JavaScript, with
  stable sf- ids and classes. Public pages are public, max-age=60 with Vary: Cookie; a page rendered for a
  signed-in person is private, no-store. The room is designed: the run motif and three tiles on the home page, the
  Watch TV with its guide (clips and moments play in the page over HLS), the maps, and the Web form.
• Plumbing (server/app.js): helmet with the network's CSP (the Games embed, a possible Live player, the
  media edge for HLS), content-hashed /css and /js, /api/health, /api/ready (degraded, never 503, when an
  optional upstream is down), /release.json, /release-metrics, /shared/*, /robots.txt, /sitemap.xml and
  /llms.txt, a 120/min per-IP limit on /api and /auth, and a graceful stop.
• Deploy: deploy/systemd/openvibe-surf.service (port 5110, /etc/openvibe/surf.env) and
  deploy/nginx/openvibe.surf.conf (TLS for openvibe.surf, www → apex, the Watch/Ride read zone, the forms zone
  for /web/go and /api/v1/web/, /auth/me on the API zone, /internal and /metrics 404).
• Tests: test/feed.test.js, test/ride.test.js, test/web.test.js, test/sso.test.js,
  test/pages.test.js and test/discovery.test.js, each against in-process Network/Live/Games/Actor stand-ins.