# Lumi changelog

## 0.2.24

- Fixed resource locking and deletion by sending the shared timed-confirmation token directly with AJAX actions, and made deletion reliable on Windows and network-backed storage.
- Added dedicated attachment downloads instead of relying on browser-player behavior.
- Reworked resource cards with contained filenames and actions, compact accurate empty/filter states, inline image previews, and fading play/stop timelines over audio and video previews.
- Moved rename and delete actions into a predictable split layout and only reveals the save-name button when the name has actually changed.
- Made saved storage and upload limits immediately visible and enforced in the current page without requiring a refresh or restart.

## 0.2.23

- Added an admin-only content library for verified image, audio, video, caption, document, data, and font uploads with previews, searching, storage quotas, disk reserves, and upload progress.
- Added locked resources for internal/plugin use and revocable exposed resources with encrypted high-entropy tokens, read-only URLs, CORS, ETags, and HTTP byte-range delivery suitable for OBS and streaming media.
- Added a shared `global.lumiFrameworks.resources` API, centralized additive storage migration, focused verification, and operator documentation.
- Fixed clean OBS Browser Source CSP rules so configured remote and `blob:` audio/video media can load.
- Connected resource deletion and URL revocation to Lumi's existing server-validated timed confirmation flow.

## 0.2.22

- Added reusable per-overlay event alerts that can queue one-shot Audio/Video playback or show Text/Image sources for a chosen duration without refreshing OBS.
- Added Twitch EventSub follow, incoming raid, subscription, and gifted-subscription inputs with server-side OAuth, token refresh, reconnect recovery, and subscription-tier filters.
- Added Discord member-join alerts through the existing bot connection, live test-delivery feedback, safe hook duplication/cleanup, and plugin event registration/emission extension points.
- Preserved all existing overlays, sources, tokens, settings, databases, plugin data, models, uploads, feedback, and secrets; the new event-hook table and Twitch event settings are additive.

## 0.2.21

- Added cached BetterTTV global, channel, and shared emote rendering to Twitch messages in Lumi chat overlays and standalone OBS chat docks, with safe plain-text fallback during provider failures.

## 0.2.20

- Added comma-separated aliases to conditional command reply rules, allowing several keywords to return one shared response while retaining exact and fuzzy matching.

## 0.2.19

- Added a protected, implicitly inherited default command group that can be edited but not deleted.
- Replaced inherited policy inputs with accurate read-only effective summaries and made group changes recalculate those summaries live.
- Added clearer policy-section hierarchy, friendly command-source badges, fuzzy group/command suggestions, and positive-only setting/source filters.
- Replaced per-command submission with one atomic page-wide save so edits to multiple collapsed or filtered commands are retained together.

## 0.2.18

- Added centralized command groups and per-command overrides for time-window limits, crash-tolerant per-stream limits, platform roles/subscriber tiers, and Economy Framework costs with logged refunds.
- Added conditional keyword custom replies with optional conservative typo matching and shared placeholder handling.
- Added core `!clip [label]` orchestration for platform clips plus OBS replay saves through local WebSocket or the Browser Bridge, and Twitch `!raid <channel>` / `!raid cancel`.
- Added an admin command-policy page, command-list access summaries, focused verification, and operator documentation.

## 0.2.17

- Added a signed standalone OBS Custom Browser Dock page for every native Lumi chat source, with admin-only copy/open controls.
- Reused each chat source's saved filters and appearance while deliberately ignoring overlay coordinates, source dimensions, and entry/exit animations.
- Made dock chat responsive and normally scrollable at any dock size, with bottom-follow behavior that pauses when an operator scrolls up.
- Bound dock access to existing revocable overlay and scene credentials so regenerating private links or deleting the source invalidates its dock URL.
- Added shared live-event credential revalidation so already-open overlay and dock streams close after their bearer URL is revoked.

## 0.2.16

- Kept keyboard focus in source fields while server-normalized live previews rerender, preventing interrupted typing and other continuous input.
- Added cached Twitch profile-image lookup and Discord custom/animated emoji, GIF, GIFV, attachment, and sticker rendering for native chat overlays.
- Made chat alignment apply to complete message groups, made message backgrounds fit their content, and added directional entry/exit animations.
- Expanded the editor simulation to cycle realistic short, wrapped, avatar, badge, platform, arrival, and departure examples continuously.

## 0.2.15

- Fixed Lumi's own Twitch, YouTube, and Discord messages being omitted from native chat overlays and added platform-specific plus linked-Lumi-account user blocking.
- Replaced text platform/badge labels with platform artwork, official Twitch badge images where available, and image fallbacks for other badge types.
- Added server-normalized unsaved source previews, temporary website-CSS previews, visible draft/revert controls, contrast backgrounds, an alignment grid, and reachable sticky source actions.
- Hardened alert-site transparency with an optional page/root guard that remains effective when apps such as alert providers modify their document after loading.

## 0.2.14

- Added a native Lumi chat overlay source that combines live Twitch, YouTube, and Discord messages with optional per-channel filters.
- Added visual controls for typography, colors and transparency, placement, message limits, timeout removal, message details, and entry/exit animations, plus isolated custom CSS.
- Added live avatars, badges, Twitch emotes, editor preview messages, and bounded replay after temporary Browser Source connection loss.

## 0.2.13

- Changed external overlay Website CSS from frame-only styling to document-level injection, matching OBS Browser Source Custom CSS behavior.
- Applied OBS's transparent body stylesheet inside alert websites by default while allowing administrators to add selectors for provider-specific elements.
- Added scoped revocable website-render tickets, opaque sandboxing, no-referrer handling, bounded public document retrieval, private-network blocking, and a direct compatibility fallback.

## 0.2.12

- Fixed OBS Browser Source transparency by applying OBS's standard transparent-page CSS to clean overlay pages and embedded frame surfaces.
- Made the management preview and public OBS output share one fixed full-resolution canvas, preventing responsive alert pages from changing text size or position in the smaller editor preview.
- Added clear, copyable OBS Browser Source width, height, and default Custom CSS guidance to each overlay.

## 0.2.11

- Added structured component, activity, event, and request metadata across Core, plugins, platforms, commands, webhooks, diagnostics, and WebUI administrator actions.
- Added recursive credential redaction, bounded log payloads, automatic age/count retention, and a scoped logger supplied to plugins.
- Upgraded Admin Logs with full server-side search and filters, filtered totals, live entries, clearer metadata, configurable retention, and text or JSON Lines downloads.

## 0.2.10

- Fixed local Windows startup under Node.js 24 by invoking npm through its JavaScript CLI instead of directly spawning `npm.cmd`.
- Added a safe command-shell fallback and focused Windows dependency-launch regression coverage.

## 0.2.9

- Fixed forms containing fields named `action` or `method` being able to shadow their own submission endpoint and send requests to an invalid URL.
- Added a shared clobber-safe form action/method resolver and reused it in update, settings, and Lumi AI feedback workflows.

## 0.2.8

- Fixed Lumi AI Improvement Center actions that could return an unhelpful generic failure for no-change, dismiss, edit, and restore operations.
- Added an explicit feedback-action response contract, actionable permission/session/not-found errors, and safe production diagnostics without changing existing feedback data.

## 0.2.7

- Reworked the Lumi AI Improvement Center into a live review queue with one-step apply, dismiss, and no-change outcomes.
- Added searchable finalized-feedback history with restore, edit, and permanent-delete controls while preserving existing feedback data.

## 0.2.6

- Fixed plugin updates on Windows and network shares when a running plugin keeps its preserved `data` directory open.
- Plugin updates and automatic restores now leave preserved data in place while transactionally replacing only plugin code, with rollback if a code-file replacement fails.

## 0.2.5

- Fixed diagnostics behind local/private reverse proxies by accepting forwarded HTTPS only from loopback, RFC1918/link-local IPv4, or private/link-local IPv6 proxy addresses.
- Updated the local diagnostics client to read either JSON or env-style `.secrets` files, including `LUMI_PROD_URL` and `LUMI_DIAG_KEY` aliases.

## 0.2.4

- Changed the production diagnostics endpoint, cURL example, and local-client configuration example to use the actual URL from which the administrator opened Lumi, including trusted reverse-proxy HTTPS handling.

## 0.2.3

- Fixed shared form action resolution so submit buttons without a `formaction` use their parent form's endpoint, restoring timed confirmations such as diagnostics-key creation.
- Fixed the same browser behavior in asynchronous core/plugin update forms, which could submit to the Updates page itself and report a context-free failure without running the update.

## 0.2.2

- Added stage-specific plugin update failures beside the affected plugin and persisted the production failure stage in update state.
- Validated the selected repository plugin before creating a rollback snapshot and removed the generic, context-free failed result.
- Added an optional admin-controlled production diagnostics endpoint with fixed read-only checks, one-time hashed access keys, HTTPS enforcement, redaction, rate limiting, and audited access.

## 0.2.1

- Fixed repository update checks being handled twice and incorrectly ending in a failed button state after a successful result.
- Simplified update-result wording and moved exact core/plugin version selection into collapsed, module-specific advanced sections.

## 0.2.0

- Added the OBS overlay management and Browser Source system, including scenes, live updates, visual editing, multimedia, external web sources, and OBS bridge extension points.
- Added the role-gated Open Knowledge Foundation plugin with file-backed community/correction knowledge, generated reference material, administration workflows, and Lumi AI retrieval.
- Made Lumi AI OKF-first, improved conversational grounding and fast replies, hardened read-only web-search sourcing, and expanded controller, diagnostics, feedback, and runtime management behavior.
- Added shared placeholder, upload-security, WebUI authentication, destructive-confirmation, safe-file, feedback, and user-lookup capabilities reused across core and plugins.
- Improved update safety with compressed snapshots, model/runtime exclusions, retention controls, transactional replacement, rollback recovery, and preserved local data.
- Added the OBS, OKF, command-list, update, settings, feedback, and repository-wide responsive UI/UX improvements included in this release.
- Added focused verification for WebUI, authentication, feedback, placeholders, uploads, updates, OKF, Lumi AI, destructive actions, overlays, and webhooks.
- Corrected the mistakenly published `1.2.0` version to `0.2.0` and added a data-preserving repair path for affected installations.
- Repaired core-only upgrades that failed when the independently managed OKF plugin or optional OBS package was absent, and added exact tagged core/plugin installs with locked dependency synchronization.