# Lumi changelog

## 0.2.11

- Added structured component, activity, event, and request metadata across Core, plugins, platforms, commands, webhooks, diagnostics, and WebUI administrator actions.
- Added recursive credential redaction, bounded log payloads, automatic age/count retention, and a scoped logger supplied to plugins.
- Upgraded Admin Logs with full server-side search and filters, filtered totals, live entries, clearer metadata, configurable retention, and text or JSON Lines downloads.

## 0.2.10

- Fixed local Windows startup under Node.js 24 by invoking npm through its JavaScript CLI instead of directly spawning `npm.cmd`.
- Added a safe command-shell fallback and focused Windows dependency-launch regression coverage.

## 0.2.9

- Fixed forms containing fields named `action` or `method` being able to shadow their own submission endpoint and send requests to an invalid URL.
- Added a shared clobber-safe form action/method resolver and reused it in update, settings, and Lumi AI feedback workflows.

## 0.2.8

- Fixed Lumi AI Improvement Center actions that could return an unhelpful generic failure for no-change, dismiss, edit, and restore operations.
- Added an explicit feedback-action response contract, actionable permission/session/not-found errors, and safe production diagnostics without changing existing feedback data.

## 0.2.7

- Reworked the Lumi AI Improvement Center into a live review queue with one-step apply, dismiss, and no-change outcomes.
- Added searchable finalized-feedback history with restore, edit, and permanent-delete controls while preserving existing feedback data.

## 0.2.6

- Fixed plugin updates on Windows and network shares when a running plugin keeps its preserved `data` directory open.
- Plugin updates and automatic restores now leave preserved data in place while transactionally replacing only plugin code, with rollback if a code-file replacement fails.

## 0.2.5

- Fixed diagnostics behind local/private reverse proxies by accepting forwarded HTTPS only from loopback, RFC1918/link-local IPv4, or private/link-local IPv6 proxy addresses.
- Updated the local diagnostics client to read either JSON or env-style `.secrets` files, including `LUMI_PROD_URL` and `LUMI_DIAG_KEY` aliases.

## 0.2.4

- Changed the production diagnostics endpoint, cURL example, and local-client configuration example to use the actual URL from which the administrator opened Lumi, including trusted reverse-proxy HTTPS handling.

## 0.2.3

- Fixed shared form action resolution so submit buttons without a `formaction` use their parent form's endpoint, restoring timed confirmations such as diagnostics-key creation.
- Fixed the same browser behavior in asynchronous core/plugin update forms, which could submit to the Updates page itself and report a context-free failure without running the update.

## 0.2.2

- Added stage-specific plugin update failures beside the affected plugin and persisted the production failure stage in update state.
- Validated the selected repository plugin before creating a rollback snapshot and removed the generic, context-free failed result.
- Added an optional admin-controlled production diagnostics endpoint with fixed read-only checks, one-time hashed access keys, HTTPS enforcement, redaction, rate limiting, and audited access.

## 0.2.1

- Fixed repository update checks being handled twice and incorrectly ending in a failed button state after a successful result.
- Simplified update-result wording and moved exact core/plugin version selection into collapsed, module-specific advanced sections.

## 0.2.0

- Added the OBS overlay management and Browser Source system, including scenes, live updates, visual editing, multimedia, external web sources, and OBS bridge extension points.
- Added the role-gated Open Knowledge Foundation plugin with file-backed community/correction knowledge, generated reference material, administration workflows, and Lumi AI retrieval.
- Made Lumi AI OKF-first, improved conversational grounding and fast replies, hardened read-only web-search sourcing, and expanded controller, diagnostics, feedback, and runtime management behavior.
- Added shared placeholder, upload-security, WebUI authentication, destructive-confirmation, safe-file, feedback, and user-lookup capabilities reused across core and plugins.
- Improved update safety with compressed snapshots, model/runtime exclusions, retention controls, transactional replacement, rollback recovery, and preserved local data.
- Added the OBS, OKF, command-list, update, settings, feedback, and repository-wide responsive UI/UX improvements included in this release.
- Added focused verification for WebUI, authentication, feedback, placeholders, uploads, updates, OKF, Lumi AI, destructive actions, overlays, and webhooks.
- Corrected the mistakenly published `1.2.0` version to `0.2.0` and added a data-preserving repair path for affected installations.
- Repaired core-only upgrades that failed when the independently managed OKF plugin or optional OBS package was absent, and added exact tagged core/plugin installs with locked dependency synchronization.