Lumi/CHANGELOG.md

Lumi changelog

0.3.6

• Added encrypted Domeneshop DNS-01 automation for production RTMPS certificates when OpenResty, Nginx Proxy Manager, or another HTTPS proxy owns the reserved HTTP challenge path.
• Added a Lumi-styled Stream Testing setup surface that verifies DNS credentials once, creates and removes only short-lived challenge records, and supports timed destructive credential removal.
• Kept HTTP-01 for installations that forward it correctly, improved proxy-specific failure guidance, and bounded authoritative DNS propagation within Companion's startup window.
• Released Companion 0.2.5 as the matching Transcription compatibility release while retaining OBS Bridge 0.2.5.
• Preserved all server, plugin, pairing, OBS, media, and existing certificate data; no external ACME package or certificate-path environment variable is required.

0.3.5

• Released Companion 0.2.4 with silent Lumi reconnect, a direct transcription on/off control, consistent collapsed plugin navigation, and a one-click route from an active Stream Test to its Lumi viewer.
• Made private-test captions progressively reveal speech instead of waiting for a full utterance, retained readable multi-line captions, and kept stale words moving out naturally.
• Added Lumi-managed RTMPS certificates for public production ingest while retaining HTTP and RTMP for explicit localhost/private development use.
• Refreshed Song Overlay capture and delivery, shared Companion authentication across installed plugins, and completed durable redacted logging across core and bundled plugins.
• Released OBS Bridge 0.2.5 and synchronized the updated Transcription and Song Overlay plugins without replacing preserved server, plugin, pairing, or OBS data.

0.3.4

• Fixed production Companion pairing and download generation behind Lumi's private HTTPS reverse proxy, while continuing to reject forged forwarding headers from public clients.
• Reused the same guarded request-origin policy for Companion HTTP, pairing, settings, and WebSocket traffic, with explicit regression coverage for private proxy HTTPS, public spoofing, and malformed hosts.
• Standardized operational failures on Lumi's durable redacting logger, removed a placeholder metrics API that silently discarded events, and documented the actual logging and feature-owned metrics boundaries.
• Included the existing Lumi favicon and Qwen workspace housekeeping from the branch without changing preserved server or plugin data.

0.3.3

• Isolated private tests in a dedicated libobs output, bypassed account OAuth stream-key mutation, retained crash-safe exact service restoration, and corrected OBS encoder ownership so failed outputs cannot corrupt a later retry.
• Replaced the Stream Testing FFmpeg listener and rendition transcoder with a checksum-pinned, Lumi-managed MediaMTX runtime that receives OBS RTMP/RTMPS and remuxes the genuine source representation to low-latency HLS without recording.
• Added explicit MediaMTX install, repair, and receiver-health actions; loopback-only API, metrics, and HLS; exact per-session hashed publisher authorization; bounded supervision and diagnostics; and authenticated same-origin streaming playback.
• Kept OBS on the existing paired Lumi hostname, made unencrypted RTMP private-network-only by default, removed the extra FFmpeg/package requirement, and retained crash-safe exact OBS destination restoration and private caption delivery.
• Updated Stream Testing to show only real source quality, factual OBS/MediaMTX/player diagnostics, and receiver warnings while preserving overlay, update, Companion plugin, transcription, and Song Overlay behavior.
• Released Companion 0.2.3 with OBS Bridge 0.2.4 so the new private-output and recovery behavior reaches installed streaming computers through the normal updater.

0.3.2

• Fixed an OBS crash at private Stream Test startup by respecting the OBS Frontend API's borrowed streaming-service reference instead of releasing OBS-owned memory.
• Rebuilt the managed OBS Bridge with a new version so Companion clearly requires and installs the corrected integration before another Stream Test can start.

0.3.1

• Fixed apparently inert Stream Testing starts by surfacing the server rejection immediately in the Stream Testing panel and local diagnostic log.
• Added bounded Windows FFmpeg discovery for verified WinGet and conventional installations, while preserving explicit LUMI_FFMPEG_PATH configuration and Linux PATH behavior.
• Added explicit loaded/installed/bundled OBS Bridge version comparison, update-required notices and actions on Overview and Connection & device, and blocked Stream Testing until an outdated bridge is updated and loaded.

0.3.0

• Added admin-only private stream testing for the real OBS output with expiring authenticated sessions, supervised FFmpeg ingest, source/720p/480p no-upscale HLS, automatic/manual quality, audio, fullscreen, reused captions, real OBS/receiver diagnostics, bounded cleanup, and a deterministic test pattern.
• Added a crash-safe two-phase OBS destination handoff: Companion protects the complete prior service with current-user DPAPI before redirecting, then restores it on stop, expiry, receiver failure, WebSocket loss, Companion exit, OBS restart, or startup recovery.
• Made public video overlays pixel-only and playback-lifecycle aware, and converted audio sources from visual canvas objects into invisible managed outputs with inspector playback controls and ignored legacy layout data.
• Made Companion update checks safely repeatable after success, no-update, failure, cancellation, or rapid repeated clicks.

0.2.27

• Completed bundled-plugin synchronization automatically on the first startup after a legacy core-only update, allowing production hosts on 0.2.25 to receive the Companion transcription and Song Overlay plugins in the same update flow.
• Added a second snapshot-backed plugin synchronization boundary with automatic restoration, exact-release verification, preserved plugin data, and an idempotent completion marker.

0.2.26

• Added stable Lumi Companion distribution with a durable per-user installer, shared paired-device authentication, managed OBS integration, preserved identity, user-approved updates, complete legal notices, and matching application/tray branding.
• Added server-hosted transcription with voice-free readiness checks, dedicated confidence and latency benchmarks, resilient worker recovery, detailed WebUI analysis, and no speech inference on the streaming computer.
• Added Spotify-backed Song Overlay capture, transparent and live-updating OBS rendering, configurable announcements, and a shared-template !music command.
• Made stable core updates snapshot, synchronize, verify, and restore bundled plugins as one transaction while preserving plugin data and local-only plugins, so hosts on 0.2.25 receive the full release in one update.
• Stopped notification-area flicker by caching health icons, coalescing queued runtime state, and avoiding unchanged native icon/menu assignments.

0.2.25

• Added verified, snapshot-backed production deployment switching between main and exact experimental-* branches, including bundled plugin code, preserved plugin data, automatic failed-apply restoration, and graceful wrapper restarts.
• Added a guarded compatibility bootstrap that completes bundled-plugin synchronization if stable 0.2.24 installs an experimental branch directly; metadata checks alone cannot trigger deployment.
• Completed the DesignMotionHQ UX foundation and representative settings, navigation, theme, command, updates, resources, and OBS overlay workflows with a five-viewport browser/accessibility matrix.
• Fixed overlay editor scrolling and viewport containment, interactive pop-out preview editing, and persistent resource storage-limit saves with immediate page reconciliation.

0.2.24

• Fixed resource locking and deletion by sending the shared timed-confirmation token directly with AJAX actions, and made deletion reliable on Windows and network-backed storage.
• Added dedicated attachment downloads instead of relying on browser-player behavior.
• Reworked resource cards with contained filenames and actions, compact accurate empty/filter states, inline image previews, and fading play/stop timelines over audio and video previews.
• Moved rename and delete actions into a predictable split layout and only reveals the save-name button when the name has actually changed.
• Made saved storage and upload limits immediately visible and enforced in the current page without requiring a refresh or restart.

0.2.23

• Added an admin-only content library for verified image, audio, video, caption, document, data, and font uploads with previews, searching, storage quotas, disk reserves, and upload progress.
• Added locked resources for internal/plugin use and revocable exposed resources with encrypted high-entropy tokens, read-only URLs, CORS, ETags, and HTTP byte-range delivery suitable for OBS and streaming media.
• Added a shared global.lumiFrameworks.resources API, centralized additive storage migration, focused verification, and operator documentation.
• Fixed clean OBS Browser Source CSP rules so configured remote and blob: audio/video media can load.
• Connected resource deletion and URL revocation to Lumi's existing server-validated timed confirmation flow.

0.2.22

• Added reusable per-overlay event alerts that can queue one-shot Audio/Video playback or show Text/Image sources for a chosen duration without refreshing OBS.
• Added Twitch EventSub follow, incoming raid, subscription, and gifted-subscription inputs with server-side OAuth, token refresh, reconnect recovery, and subscription-tier filters.
• Added Discord member-join alerts through the existing bot connection, live test-delivery feedback, safe hook duplication/cleanup, and plugin event registration/emission extension points.
• Preserved all existing overlays, sources, tokens, settings, databases, plugin data, models, uploads, feedback, and secrets; the new event-hook table and Twitch event settings are additive.

0.2.21

• Added cached BetterTTV global, channel, and shared emote rendering to Twitch messages in Lumi chat overlays and standalone OBS chat docks, with safe plain-text fallback during provider failures.

0.2.20

• Added comma-separated aliases to conditional command reply rules, allowing several keywords to return one shared response while retaining exact and fuzzy matching.

0.2.19

• Added a protected, implicitly inherited default command group that can be edited but not deleted.
• Replaced inherited policy inputs with accurate read-only effective summaries and made group changes recalculate those summaries live.
• Added clearer policy-section hierarchy, friendly command-source badges, fuzzy group/command suggestions, and positive-only setting/source filters.
• Replaced per-command submission with one atomic page-wide save so edits to multiple collapsed or filtered commands are retained together.

0.2.18

• Added centralized command groups and per-command overrides for time-window limits, crash-tolerant per-stream limits, platform roles/subscriber tiers, and Economy Framework costs with logged refunds.
• Added conditional keyword custom replies with optional conservative typo matching and shared placeholder handling.
• Added core !clip [label] orchestration for platform clips plus OBS replay saves through local WebSocket or the Browser Bridge, and Twitch !raid <channel> / !raid cancel.
• Added an admin command-policy page, command-list access summaries, focused verification, and operator documentation.

0.2.17

• Added a signed standalone OBS Custom Browser Dock page for every native Lumi chat source, with admin-only copy/open controls.
• Reused each chat source's saved filters and appearance while deliberately ignoring overlay coordinates, source dimensions, and entry/exit animations.
• Made dock chat responsive and normally scrollable at any dock size, with bottom-follow behavior that pauses when an operator scrolls up.
• Bound dock access to existing revocable overlay and scene credentials so regenerating private links or deleting the source invalidates its dock URL.
• Added shared live-event credential revalidation so already-open overlay and dock streams close after their bearer URL is revoked.

0.2.16

• Kept keyboard focus in source fields while server-normalized live previews rerender, preventing interrupted typing and other continuous input.
• Added cached Twitch profile-image lookup and Discord custom/animated emoji, GIF, GIFV, attachment, and sticker rendering for native chat overlays.
• Made chat alignment apply to complete message groups, made message backgrounds fit their content, and added directional entry/exit animations.
• Expanded the editor simulation to cycle realistic short, wrapped, avatar, badge, platform, arrival, and departure examples continuously.

0.2.15

• Fixed Lumi's own Twitch, YouTube, and Discord messages being omitted from native chat overlays and added platform-specific plus linked-Lumi-account user blocking.
• Replaced text platform/badge labels with platform artwork, official Twitch badge images where available, and image fallbacks for other badge types.
• Added server-normalized unsaved source previews, temporary website-CSS previews, visible draft/revert controls, contrast backgrounds, an alignment grid, and reachable sticky source actions.
• Hardened alert-site transparency with an optional page/root guard that remains effective when apps such as alert providers modify their document after loading.

0.2.14

• Added a native Lumi chat overlay source that combines live Twitch, YouTube, and Discord messages with optional per-channel filters.
• Added visual controls for typography, colors and transparency, placement, message limits, timeout removal, message details, and entry/exit animations, plus isolated custom CSS.
• Added live avatars, badges, Twitch emotes, editor preview messages, and bounded replay after temporary Browser Source connection loss.

0.2.13

• Changed external overlay Website CSS from frame-only styling to document-level injection, matching OBS Browser Source Custom CSS behavior.
• Applied OBS's transparent body stylesheet inside alert websites by default while allowing administrators to add selectors for provider-specific elements.
• Added scoped revocable website-render tickets, opaque sandboxing, no-referrer handling, bounded public document retrieval, private-network blocking, and a direct compatibility fallback.

0.2.12

• Fixed OBS Browser Source transparency by applying OBS's standard transparent-page CSS to clean overlay pages and embedded frame surfaces.
• Made the management preview and public OBS output share one fixed full-resolution canvas, preventing responsive alert pages from changing text size or position in the smaller editor preview.
• Added clear, copyable OBS Browser Source width, height, and default Custom CSS guidance to each overlay.

0.2.11

• Added structured component, activity, event, and request metadata across Core, plugins, platforms, commands, webhooks, diagnostics, and WebUI administrator actions.
• Added recursive credential redaction, bounded log payloads, automatic age/count retention, and a scoped logger supplied to plugins.
• Upgraded Admin Logs with full server-side search and filters, filtered totals, live entries, clearer metadata, configurable retention, and text or JSON Lines downloads.

0.2.10

• Fixed local Windows startup under Node.js 24 by invoking npm through its JavaScript CLI instead of directly spawning npm.cmd.
• Added a safe command-shell fallback and focused Windows dependency-launch regression coverage.

0.2.9

• Fixed forms containing fields named action or method being able to shadow their own submission endpoint and send requests to an invalid URL.
• Added a shared clobber-safe form action/method resolver and reused it in update, settings, and Lumi AI feedback workflows.

0.2.8

• Fixed Lumi AI Improvement Center actions that could return an unhelpful generic failure for no-change, dismiss, edit, and restore operations.
• Added an explicit feedback-action response contract, actionable permission/session/not-found errors, and safe production diagnostics without changing existing feedback data.

0.2.7

• Reworked the Lumi AI Improvement Center into a live review queue with one-step apply, dismiss, and no-change outcomes.
• Added searchable finalized-feedback history with restore, edit, and permanent-delete controls while preserving existing feedback data.

0.2.6

• Fixed plugin updates on Windows and network shares when a running plugin keeps its preserved data directory open.
• Plugin updates and automatic restores now leave preserved data in place while transactionally replacing only plugin code, with rollback if a code-file replacement fails.

0.2.5

• Fixed diagnostics behind local/private reverse proxies by accepting forwarded HTTPS only from loopback, RFC1918/link-local IPv4, or private/link-local IPv6 proxy addresses.
• Updated the local diagnostics client to read either JSON or env-style .secrets files, including LUMI_PROD_URL and LUMI_DIAG_KEY aliases.

0.2.4

• Changed the production diagnostics endpoint, cURL example, and local-client configuration example to use the actual URL from which the administrator opened Lumi, including trusted reverse-proxy HTTPS handling.

0.2.3

• Fixed shared form action resolution so submit buttons without a formaction use their parent form's endpoint, restoring timed confirmations such as diagnostics-key creation.
• Fixed the same browser behavior in asynchronous core/plugin update forms, which could submit to the Updates page itself and report a context-free failure without running the update.

0.2.2

• Added stage-specific plugin update failures beside the affected plugin and persisted the production failure stage in update state.
• Validated the selected repository plugin before creating a rollback snapshot and removed the generic, context-free failed result.
• Added an optional admin-controlled production diagnostics endpoint with fixed read-only checks, one-time hashed access keys, HTTPS enforcement, redaction, rate limiting, and audited access.

0.2.1

• Fixed repository update checks being handled twice and incorrectly ending in a failed button state after a successful result.
• Simplified update-result wording and moved exact core/plugin version selection into collapsed, module-specific advanced sections.

0.2.0

• Added the OBS overlay management and Browser Source system, including scenes, live updates, visual editing, multimedia, external web sources, and OBS bridge extension points.
• Added the role-gated Open Knowledge Foundation plugin with file-backed community/correction knowledge, generated reference material, administration workflows, and Lumi AI retrieval.
• Made Lumi AI OKF-first, improved conversational grounding and fast replies, hardened read-only web-search sourcing, and expanded controller, diagnostics, feedback, and runtime management behavior.
• Added shared placeholder, upload-security, WebUI authentication, destructive-confirmation, safe-file, feedback, and user-lookup capabilities reused across core and plugins.
• Improved update safety with compressed snapshots, model/runtime exclusions, retention controls, transactional replacement, rollback recovery, and preserved local data.
• Added the OBS, OKF, command-list, update, settings, feedback, and repository-wide responsive UI/UX improvements included in this release.
• Added focused verification for WebUI, authentication, feedback, placeholders, uploads, updates, OKF, Lumi AI, destructive actions, overlays, and webhooks.
• Corrected the mistakenly published 1.2.0 version to 0.2.0 and added a data-preserving repair path for affected installations.
• Repaired core-only upgrades that failed when the independently managed OKF plugin or optional OBS package was absent, and added exact tagged core/plugin installs with locked dependency synchronization.