# Lumi changelog ## 0.3.6 - Added encrypted Domeneshop DNS-01 automation for production RTMPS certificates when OpenResty, Nginx Proxy Manager, or another HTTPS proxy owns the reserved HTTP challenge path. - Added a Lumi-styled Stream Testing setup surface that verifies DNS credentials once, creates and removes only short-lived challenge records, and supports timed destructive credential removal. - Kept HTTP-01 for installations that forward it correctly, improved proxy-specific failure guidance, and bounded authoritative DNS propagation within Companion's startup window. - Released Companion 0.2.5 as the matching Transcription compatibility release while retaining OBS Bridge 0.2.5. - Preserved all server, plugin, pairing, OBS, media, and existing certificate data; no external ACME package or certificate-path environment variable is required. ## 0.3.5 - Released Companion 0.2.4 with silent Lumi reconnect, a direct transcription on/off control, consistent collapsed plugin navigation, and a one-click route from an active Stream Test to its Lumi viewer. - Made private-test captions progressively reveal speech instead of waiting for a full utterance, retained readable multi-line captions, and kept stale words moving out naturally. - Added Lumi-managed RTMPS certificates for public production ingest while retaining HTTP and RTMP for explicit localhost/private development use. - Refreshed Song Overlay capture and delivery, shared Companion authentication across installed plugins, and completed durable redacted logging across core and bundled plugins. - Released OBS Bridge 0.2.5 and synchronized the updated Transcription and Song Overlay plugins without replacing preserved server, plugin, pairing, or OBS data. ## 0.3.4 - Fixed production Companion pairing and download generation behind Lumi's private HTTPS reverse proxy, while continuing to reject forged forwarding headers from public clients. - Reused the same guarded request-origin policy for Companion HTTP, pairing, settings, and WebSocket traffic, with explicit regression coverage for private proxy HTTPS, public spoofing, and malformed hosts. - Standardized operational failures on Lumi's durable redacting logger, removed a placeholder metrics API that silently discarded events, and documented the actual logging and feature-owned metrics boundaries. - Included the existing Lumi favicon and Qwen workspace housekeeping from the branch without changing preserved server or plugin data. ## 0.3.3 - Isolated private tests in a dedicated libobs output, bypassed account OAuth stream-key mutation, retained crash-safe exact service restoration, and corrected OBS encoder ownership so failed outputs cannot corrupt a later retry. - Replaced the Stream Testing FFmpeg listener and rendition transcoder with a checksum-pinned, Lumi-managed MediaMTX runtime that receives OBS RTMP/RTMPS and remuxes the genuine source representation to low-latency HLS without recording. - Added explicit MediaMTX install, repair, and receiver-health actions; loopback-only API, metrics, and HLS; exact per-session hashed publisher authorization; bounded supervision and diagnostics; and authenticated same-origin streaming playback. - Kept OBS on the existing paired Lumi hostname, made unencrypted RTMP private-network-only by default, removed the extra FFmpeg/package requirement, and retained crash-safe exact OBS destination restoration and private caption delivery. - Updated Stream Testing to show only real source quality, factual OBS/MediaMTX/player diagnostics, and receiver warnings while preserving overlay, update, Companion plugin, transcription, and Song Overlay behavior. - Released Companion 0.2.3 with OBS Bridge 0.2.4 so the new private-output and recovery behavior reaches installed streaming computers through the normal updater. ## 0.3.2 - Fixed an OBS crash at private Stream Test startup by respecting the OBS Frontend API's borrowed streaming-service reference instead of releasing OBS-owned memory. - Rebuilt the managed OBS Bridge with a new version so Companion clearly requires and installs the corrected integration before another Stream Test can start. ## 0.3.1 - Fixed apparently inert Stream Testing starts by surfacing the server rejection immediately in the Stream Testing panel and local diagnostic log. - Added bounded Windows FFmpeg discovery for verified WinGet and conventional installations, while preserving explicit `LUMI_FFMPEG_PATH` configuration and Linux PATH behavior. - Added explicit loaded/installed/bundled OBS Bridge version comparison, update-required notices and actions on Overview and Connection & device, and blocked Stream Testing until an outdated bridge is updated and loaded. ## 0.3.0 - Added admin-only private stream testing for the real OBS output with expiring authenticated sessions, supervised FFmpeg ingest, source/720p/480p no-upscale HLS, automatic/manual quality, audio, fullscreen, reused captions, real OBS/receiver diagnostics, bounded cleanup, and a deterministic test pattern. - Added a crash-safe two-phase OBS destination handoff: Companion protects the complete prior service with current-user DPAPI before redirecting, then restores it on stop, expiry, receiver failure, WebSocket loss, Companion exit, OBS restart, or startup recovery. - Made public video overlays pixel-only and playback-lifecycle aware, and converted audio sources from visual canvas objects into invisible managed outputs with inspector playback controls and ignored legacy layout data. - Made Companion update checks safely repeatable after success, no-update, failure, cancellation, or rapid repeated clicks. ## 0.2.27 - Completed bundled-plugin synchronization automatically on the first startup after a legacy core-only update, allowing production hosts on 0.2.25 to receive the Companion transcription and Song Overlay plugins in the same update flow. - Added a second snapshot-backed plugin synchronization boundary with automatic restoration, exact-release verification, preserved plugin data, and an idempotent completion marker. ## 0.2.26 - Added stable Lumi Companion distribution with a durable per-user installer, shared paired-device authentication, managed OBS integration, preserved identity, user-approved updates, complete legal notices, and matching application/tray branding. - Added server-hosted transcription with voice-free readiness checks, dedicated confidence and latency benchmarks, resilient worker recovery, detailed WebUI analysis, and no speech inference on the streaming computer. - Added Spotify-backed Song Overlay capture, transparent and live-updating OBS rendering, configurable announcements, and a shared-template `!music` command. - Made stable core updates snapshot, synchronize, verify, and restore bundled plugins as one transaction while preserving plugin data and local-only plugins, so hosts on `0.2.25` receive the full release in one update. - Stopped notification-area flicker by caching health icons, coalescing queued runtime state, and avoiding unchanged native icon/menu assignments. ## 0.2.25 - Added verified, snapshot-backed production deployment switching between `main` and exact `experimental-*` branches, including bundled plugin code, preserved plugin data, automatic failed-apply restoration, and graceful wrapper restarts. - Added a guarded compatibility bootstrap that completes bundled-plugin synchronization if stable `0.2.24` installs an experimental branch directly; metadata checks alone cannot trigger deployment. - Completed the DesignMotionHQ UX foundation and representative settings, navigation, theme, command, updates, resources, and OBS overlay workflows with a five-viewport browser/accessibility matrix. - Fixed overlay editor scrolling and viewport containment, interactive pop-out preview editing, and persistent resource storage-limit saves with immediate page reconciliation. ## 0.2.24 - Fixed resource locking and deletion by sending the shared timed-confirmation token directly with AJAX actions, and made deletion reliable on Windows and network-backed storage. - Added dedicated attachment downloads instead of relying on browser-player behavior. - Reworked resource cards with contained filenames and actions, compact accurate empty/filter states, inline image previews, and fading play/stop timelines over audio and video previews. - Moved rename and delete actions into a predictable split layout and only reveals the save-name button when the name has actually changed. - Made saved storage and upload limits immediately visible and enforced in the current page without requiring a refresh or restart. ## 0.2.23 - Added an admin-only content library for verified image, audio, video, caption, document, data, and font uploads with previews, searching, storage quotas, disk reserves, and upload progress. - Added locked resources for internal/plugin use and revocable exposed resources with encrypted high-entropy tokens, read-only URLs, CORS, ETags, and HTTP byte-range delivery suitable for OBS and streaming media. - Added a shared `global.lumiFrameworks.resources` API, centralized additive storage migration, focused verification, and operator documentation. - Fixed clean OBS Browser Source CSP rules so configured remote and `blob:` audio/video media can load. - Connected resource deletion and URL revocation to Lumi's existing server-validated timed confirmation flow. ## 0.2.22 - Added reusable per-overlay event alerts that can queue one-shot Audio/Video playback or show Text/Image sources for a chosen duration without refreshing OBS. - Added Twitch EventSub follow, incoming raid, subscription, and gifted-subscription inputs with server-side OAuth, token refresh, reconnect recovery, and subscription-tier filters. - Added Discord member-join alerts through the existing bot connection, live test-delivery feedback, safe hook duplication/cleanup, and plugin event registration/emission extension points. - Preserved all existing overlays, sources, tokens, settings, databases, plugin data, models, uploads, feedback, and secrets; the new event-hook table and Twitch event settings are additive. ## 0.2.21 - Added cached BetterTTV global, channel, and shared emote rendering to Twitch messages in Lumi chat overlays and standalone OBS chat docks, with safe plain-text fallback during provider failures. ## 0.2.20 - Added comma-separated aliases to conditional command reply rules, allowing several keywords to return one shared response while retaining exact and fuzzy matching. ## 0.2.19 - Added a protected, implicitly inherited default command group that can be edited but not deleted. - Replaced inherited policy inputs with accurate read-only effective summaries and made group changes recalculate those summaries live. - Added clearer policy-section hierarchy, friendly command-source badges, fuzzy group/command suggestions, and positive-only setting/source filters. - Replaced per-command submission with one atomic page-wide save so edits to multiple collapsed or filtered commands are retained together. ## 0.2.18 - Added centralized command groups and per-command overrides for time-window limits, crash-tolerant per-stream limits, platform roles/subscriber tiers, and Economy Framework costs with logged refunds. - Added conditional keyword custom replies with optional conservative typo matching and shared placeholder handling. - Added core `!clip [label]` orchestration for platform clips plus OBS replay saves through local WebSocket or the Browser Bridge, and Twitch `!raid ` / `!raid cancel`. - Added an admin command-policy page, command-list access summaries, focused verification, and operator documentation. ## 0.2.17 - Added a signed standalone OBS Custom Browser Dock page for every native Lumi chat source, with admin-only copy/open controls. - Reused each chat source's saved filters and appearance while deliberately ignoring overlay coordinates, source dimensions, and entry/exit animations. - Made dock chat responsive and normally scrollable at any dock size, with bottom-follow behavior that pauses when an operator scrolls up. - Bound dock access to existing revocable overlay and scene credentials so regenerating private links or deleting the source invalidates its dock URL. - Added shared live-event credential revalidation so already-open overlay and dock streams close after their bearer URL is revoked. ## 0.2.16 - Kept keyboard focus in source fields while server-normalized live previews rerender, preventing interrupted typing and other continuous input. - Added cached Twitch profile-image lookup and Discord custom/animated emoji, GIF, GIFV, attachment, and sticker rendering for native chat overlays. - Made chat alignment apply to complete message groups, made message backgrounds fit their content, and added directional entry/exit animations. - Expanded the editor simulation to cycle realistic short, wrapped, avatar, badge, platform, arrival, and departure examples continuously. ## 0.2.15 - Fixed Lumi's own Twitch, YouTube, and Discord messages being omitted from native chat overlays and added platform-specific plus linked-Lumi-account user blocking. - Replaced text platform/badge labels with platform artwork, official Twitch badge images where available, and image fallbacks for other badge types. - Added server-normalized unsaved source previews, temporary website-CSS previews, visible draft/revert controls, contrast backgrounds, an alignment grid, and reachable sticky source actions. - Hardened alert-site transparency with an optional page/root guard that remains effective when apps such as alert providers modify their document after loading. ## 0.2.14 - Added a native Lumi chat overlay source that combines live Twitch, YouTube, and Discord messages with optional per-channel filters. - Added visual controls for typography, colors and transparency, placement, message limits, timeout removal, message details, and entry/exit animations, plus isolated custom CSS. - Added live avatars, badges, Twitch emotes, editor preview messages, and bounded replay after temporary Browser Source connection loss. ## 0.2.13 - Changed external overlay Website CSS from frame-only styling to document-level injection, matching OBS Browser Source Custom CSS behavior. - Applied OBS's transparent body stylesheet inside alert websites by default while allowing administrators to add selectors for provider-specific elements. - Added scoped revocable website-render tickets, opaque sandboxing, no-referrer handling, bounded public document retrieval, private-network blocking, and a direct compatibility fallback. ## 0.2.12 - Fixed OBS Browser Source transparency by applying OBS's standard transparent-page CSS to clean overlay pages and embedded frame surfaces. - Made the management preview and public OBS output share one fixed full-resolution canvas, preventing responsive alert pages from changing text size or position in the smaller editor preview. - Added clear, copyable OBS Browser Source width, height, and default Custom CSS guidance to each overlay. ## 0.2.11 - Added structured component, activity, event, and request metadata across Core, plugins, platforms, commands, webhooks, diagnostics, and WebUI administrator actions. - Added recursive credential redaction, bounded log payloads, automatic age/count retention, and a scoped logger supplied to plugins. - Upgraded Admin Logs with full server-side search and filters, filtered totals, live entries, clearer metadata, configurable retention, and text or JSON Lines downloads. ## 0.2.10 - Fixed local Windows startup under Node.js 24 by invoking npm through its JavaScript CLI instead of directly spawning `npm.cmd`. - Added a safe command-shell fallback and focused Windows dependency-launch regression coverage. ## 0.2.9 - Fixed forms containing fields named `action` or `method` being able to shadow their own submission endpoint and send requests to an invalid URL. - Added a shared clobber-safe form action/method resolver and reused it in update, settings, and Lumi AI feedback workflows. ## 0.2.8 - Fixed Lumi AI Improvement Center actions that could return an unhelpful generic failure for no-change, dismiss, edit, and restore operations. - Added an explicit feedback-action response contract, actionable permission/session/not-found errors, and safe production diagnostics without changing existing feedback data. ## 0.2.7 - Reworked the Lumi AI Improvement Center into a live review queue with one-step apply, dismiss, and no-change outcomes. - Added searchable finalized-feedback history with restore, edit, and permanent-delete controls while preserving existing feedback data. ## 0.2.6 - Fixed plugin updates on Windows and network shares when a running plugin keeps its preserved `data` directory open. - Plugin updates and automatic restores now leave preserved data in place while transactionally replacing only plugin code, with rollback if a code-file replacement fails. ## 0.2.5 - Fixed diagnostics behind local/private reverse proxies by accepting forwarded HTTPS only from loopback, RFC1918/link-local IPv4, or private/link-local IPv6 proxy addresses. - Updated the local diagnostics client to read either JSON or env-style `.secrets` files, including `LUMI_PROD_URL` and `LUMI_DIAG_KEY` aliases. ## 0.2.4 - Changed the production diagnostics endpoint, cURL example, and local-client configuration example to use the actual URL from which the administrator opened Lumi, including trusted reverse-proxy HTTPS handling. ## 0.2.3 - Fixed shared form action resolution so submit buttons without a `formaction` use their parent form's endpoint, restoring timed confirmations such as diagnostics-key creation. - Fixed the same browser behavior in asynchronous core/plugin update forms, which could submit to the Updates page itself and report a context-free failure without running the update. ## 0.2.2 - Added stage-specific plugin update failures beside the affected plugin and persisted the production failure stage in update state. - Validated the selected repository plugin before creating a rollback snapshot and removed the generic, context-free failed result. - Added an optional admin-controlled production diagnostics endpoint with fixed read-only checks, one-time hashed access keys, HTTPS enforcement, redaction, rate limiting, and audited access. ## 0.2.1 - Fixed repository update checks being handled twice and incorrectly ending in a failed button state after a successful result. - Simplified update-result wording and moved exact core/plugin version selection into collapsed, module-specific advanced sections. ## 0.2.0 - Added the OBS overlay management and Browser Source system, including scenes, live updates, visual editing, multimedia, external web sources, and OBS bridge extension points. - Added the role-gated Open Knowledge Foundation plugin with file-backed community/correction knowledge, generated reference material, administration workflows, and Lumi AI retrieval. - Made Lumi AI OKF-first, improved conversational grounding and fast replies, hardened read-only web-search sourcing, and expanded controller, diagnostics, feedback, and runtime management behavior. - Added shared placeholder, upload-security, WebUI authentication, destructive-confirmation, safe-file, feedback, and user-lookup capabilities reused across core and plugins. - Improved update safety with compressed snapshots, model/runtime exclusions, retention controls, transactional replacement, rollback recovery, and preserved local data. - Added the OBS, OKF, command-list, update, settings, feedback, and repository-wide responsive UI/UX improvements included in this release. - Added focused verification for WebUI, authentication, feedback, placeholders, uploads, updates, OKF, Lumi AI, destructive actions, overlays, and webhooks. - Corrected the mistakenly published `1.2.0` version to `0.2.0` and added a data-preserving repair path for affected installations. - Repaired core-only upgrades that failed when the independently managed OKF plugin or optional OBS package was absent, and added exact tagged core/plugin installs with locked dependency synchronization.