CHANGELOG.md

Rama main · réplica de lectura del repositorio original.

# Changelog

## 0.3.3 — 2026-11-02

- Update the locked HTTP body parser to 2.4.0 and its query-string parser to 6.17.1, including the compressed-request denial-of-service fix.
- Update the development URI resolver to `fast-uri` 3.1.9 for its scheme, host and relative-reference security fixes.
- Update compatible Zod, IP-address and MCP Node HTTP-adapter dependencies to patched versions, including Hono's static-path decoding fix. Keep the existing request limits, server authorization and shared operation contracts.
- Package Codex and Claude Code plugins 0.3.2 with the patched bundled validator. The extension remains 0.1.64.

### Upgrade from 0.3.2

No database migration or permission change is introduced. Preserve the database, organization identity, private object storage and encryption keys. Deploy the reviewed application image by digest, retain the previous image for rollback, and verify authenticated access and private screenshot readback. The public website deploys separately. Published packages, deployed installations and Store publication are separate steps.

## 0.3.2 — 2026-10-22

- Make the public website and comparison pages show the released Kanban board, project analytics, subscribed email with configurable templates, and guided connections for ten task providers.
- Keep current Feedbacks features separate from dated competitor research. Link setup and source evidence without changing unverified competitor verdicts.
- Distinguish available Codex/Claude Code MCP and direct plugin installation from official directory distribution. Label standalone Windows, Ubuntu and macOS companions and Android/iOS sharing as coming soon, with no announced release date.
- Refresh public guides and platform descriptions. Preserve the distinction between the host-app mobile SDK source, web screenshot pilot and standalone native applications.
- Isolate the public-intake quota test from previous HTTP submissions and calendar dates; production rate limits and durable counters retain their behavior.
- Package the current extension 0.1.64 and Codex/Claude Code plugins 0.3.1. This documentation and website release does not publish them to a Store or official plugin directory.

### Upgrade from 0.3.1

No database migration or permission change is introduced. Preserve the database, private object storage, organization identity, encryption keys and saved image pin. Existing 0.3.1 workflow behavior is unchanged. The public website deploys independently; the versioned application/site images include the refreshed documentation. Follow the normal backup and image-pinning procedure when upgrading a server.

Provider-account acceptance, official plugin-directory publication, Chrome Web Store review and native-device testing remain separate milestones. Upcoming native applications are not included as released clients.

## 0.3.1 — 2026-10-21

- Guide task connection setup through account access and named destinations. Reuse an existing saved provider account for another project without copying its token into the browser.
- Start Jira with consent, then choose its site, project and creatable issue type by name. Keep its refresh token in one connection and recover the same completed connection after a lost response.
- Generate connection names and keep manual configuration, status mappings and polling optional. Preserve the existing edit and recovery flow.
- Add bounded, owner-only provider discovery with encrypted credential isolation and stale-account checks.
- Make connection retries safe after a lost response. Update monday.com column discovery to current typed settings and preserve the correct text/long-text description format.
- Package Codex and Claude Code plugins 0.3.1 with the updated shared operation contracts. The extension remains 0.1.64.

### Upgrade from 0.3.0

No database migration is introduced. Preserve the existing database, private object storage, organization identity and encryption keys. Existing task connections and explicit reviewed writes retain their behavior. Pin the new application image, recreate the application container and verify account access and a named destination before creating a remote task.

First-time access still needs the provider's documented credential or a configured OAuth app. Signing into the provider in another browser tab does not grant Feedbacks API access. Account consent, provider permissions and a successful remote task remain separate acceptance gates. See [integration setup](docs/integrations.md).

Jira issue types requiring additional fields without defaults need provider-side configuration before connecting. Finish or let pending guided Jira consent flows expire before running an older application image; older builds cannot complete the new guided flow. Saved connections retain the existing format.

## 0.3.0 — 2026-10-21

- Add a configurable project Kanban board with shared thread filters, keyboard controls and atomic batch status, assignment and archive changes.
- Add permission-scoped analytics with separate Overview, Trends and Explore tabs. Visual counts and project charts show pending, overdue and high-priority tasks with exact drilldowns; activity charts and completed response/triage/resolution distributions support planning. CSV and print keep aggregate totals.
- Preserve keyboard focus when a reviewer enters a detail control before the panel's deferred navigation finishes.
- Organize project integrations into focused provider tabs, including project-scoped task connections, with preserved drafts, compact forms and optional setup/activity details.
- Keep Mailjet correlation IDs within its provider limit, including worker message IDs on long installation hostnames.
- Add subscribed email for feedback, discussion, mentions, work status and assignment changes. Configure SMTP (including Google), Mailjet or Amazon SES, server defaults, project senders and safe text templates. Delivery history distinguishes accepted and uncertain sends.
- Add explicit tracker connections for Jira, Linear, Asana, ClickUp, Monday, Trello, Productive, Teamwork, Firmao CRM and OpenProject, with reviewed writes, status mappings, encrypted credentials and reconciliation. Jira OAuth uses a separately operated confidential broker.
- Add explicit reviewed GitHub Issue comments with bounded remote discussion readback, durable reservations and uncertain-write reconciliation.
- Add Slack/Teams channels, reviewed FullStory/LogRocket session links, explicit Harvest/Time Doctor time entries and versioned automation webhook tests.
- Add permanent project website intake with exact approved origins, Turnstile, bounded abuse controls and optional contact consent. Existing expiring review links remain available.
- Package Codex/Claude Code plugins 0.3.0 and extension 0.1.64. The extension retains the current server-selection behavior and capture improvements, and includes the updated project-wide dependency notices.

### Upgrade from 0.2.3

Back up PostgreSQL and private object storage together and verify recovery before upgrading. Preserve organization identity, volumes, encryption keys and storage prefixes. Additive migrations create workflow, subscription, queue and integration tables without rewriting applied migrations. Existing installations send no email until configured and members subscribe. Optional email environment values seed only an absent server configuration; saved settings take precedence.

Pin the published image digest and use the existing private environment. Verify sign-in, a synthetic screenshot readback, project access and a subscribed test event after startup. Retain a compatible database/storage backup and previous image; use a forward fix if an older build cannot safely understand the new integration state.

### Provider acceptance and limits

Provider request and failure tests use synthetic transports. Individual provider account permissions, consent, quotas, sender-domain verification, inbox placement, CMS deployment policies and production Turnstile configuration require live acceptance. No marketplace listing or Store update is implied. Local tracker writes use outbound calls and polling; Jira OAuth additionally needs the separately operated broker. Firmao creates reviewed CRM tasks in an explicitly configured project; task comments remain unavailable through the documented API. See [integrations](docs/integrations.md), [email](docs/email-notifications.md), [board](docs/project-board.md) and [analytics](docs/analytics.md).

## 0.2.3 — 2026-10-21

- Refresh the locked MCP server/client SDK and Vite build tooling to patched compatible versions; the current lockfile passes `npm audit`.
- Package the current application with extension 0.1.60 and Claude Code/Codex plugins 0.2.3, including context-efficient task reads and updated review guidance.
- Recover task handoff with a manual-copy dialog when a browser clipboard permission request never completes.
- Repair review controls inside native modal previews and clarify stale project access and General-project fallback.
- Add optional browser sign-in for HTTP MCP clients with own-server OAuth; local stdio plugins and personal project-scoped keys remain supported.
- Keep recording, diagnostic and public-website documentation aligned with the current review workflow. State official plugin-directory review status separately from direct installation.

### Upgrade from 0.2.1 or the unpublished 0.2.2 preparation

Back up PostgreSQL and private object storage, and verify a restore before upgrading. Preserve the database volume, `ORGANIZATION_ID`, storage bucket/prefix and existing encryption secrets. Pin the new application image by its published digest; pull it and run `docker compose up -d --wait` using the existing private environment. Startup applies pending migrations. Verify sign-in, one synthetic screenshot upload/readback and an allowed agent read before handing the server back to the team. Do not use `docker compose down -v`.

OAuth is opt-in (`MCP_OAUTH_ENABLED=true`) and requires your own HTTPS deployment; existing URL/key connections continue to work. Existing personal keys retain their original projects and scopes. The extension retains saved server connections. This application release does not submit or publish an extension to the Chrome Web Store or a plugin to an official directory.

### Compatibility and known limits

One installation serves one organization; public registration, billing, SSO and shared-database customer tenancy are not included. Recording coverage depends on the explicitly enabled channels and browser support. Keep the previous image digest and a compatible database/storage backup pair for recovery; an older image is not guaranteed to understand a migrated database. See [operations](docs/operations.md), [self-hosting](docs/self-hosting.md) and [release guidance](docs/releasing.md).

## 0.2.1 — 2026-10-01

- Build native Claude Code and Codex plugin packages from the same MCP adapter and skills, with independent platform manifests and versioned release checksums.
- Add a gated Docker Hub publication workflow with native AMD64/ARM64 container tests, SBOM/provenance attestations and registry Compose installation.
- Add an illustrated storage/prerequisites guide with configuration mapping, private bucket provisioning and recovery checks. Correct the application storage policy to include object deletion used by cleanup.

No database migration or extension change is introduced by this release. Preserve the existing database volume, organization ID and private storage when updating.

## 0.2.0 — 2026-09-30

- Capture video and browser sessions with a shared activity, console, network and performance timeline; retain screenshot diagnostics and downloadable debugging evidence.
- Copy task context into coding agents, including discussion, assignments, priority and project/reviewer guidance through MCP.
- Support multiple GitHub Apps through Integrations, and improve thread navigation, image review and annotation editing.
- Refresh visual guides and category-based comparisons. Keep animation inspection local, explicit playback global, and load the hero without waiting for unrelated fonts or deferred scripts.
- Ship Chrome extension 0.1.56, Codex plugin 0.2.0, reviewed source, checksums and a CycloneDX dependency inventory. The Chrome Web Store release is separate.

### Upgrade from 0.1.0

Back up PostgreSQL and object storage first. Preserve `ORGANIZATION_ID`, database configuration, object-storage prefix and encryption secrets. Startup applies pending migrations; validate a restored backup before production upgrade. Use a database/image backup pair for rollback rather than running an older image against upgraded data. See [operations](docs/operations.md) and [release guidance](docs/releasing.md).

### Changes since the initial preparation

- In extension 0.1.55, keep stable recording-event rows during playback so Following playback scrolls smoothly through media updates.
- Use one cursor walkthrough player across the landing page, public guides and app help, with the actual recording inspector and an in-page expanded viewer.

- Prepare an Apache-2.0 source release, contributor/governance/security guidance and generic self-hosting configuration.
- Add filtered next/previous thread navigation, keyboard shortcuts, optional tags and personal saved review views.
- Add attachment comparison and reviewer-selected, opt-in console/resource diagnostics in extension 0.1.8.
- Package the existing MCP adapter and review skill as a standalone Codex plugin with portable and compatibility manifests.
- Replace the public landing with concise visual examples, a pencil interaction, self-hosting links and agent context.
- Add human review rounds and a scoped MCP Issue draft for an agent using separately authorized GitHub access.
- Reduce opt-in diagnostic URLs to origins and clarify that screenshots cover the visible browser area in extension 0.1.12.
- In extension 0.1.19, fit optional combined full-page images to upload limits, repair oversized combined images on Retry Send, and show page-by-page annotation more clearly.
- In extension 0.1.20, preview the full page as one scrollable image before sending, add annotation tool icons, and show confirmed image-upload progress by count and percentage.

## Initial preparation baseline

Application 0.1.0 and Chrome extension 0.1.7 formed the initial preparation baseline; this release packages extension 0.1.56. The Chrome Web Store updates separately.

- Apache-2.0 licensing, contributor and security reporting guidance, and source-only release archives.
- Independent public website with self-hosting documentation and GitHub access.
- User-selected extension server; server permission during pairing and separate optional all-sites access.
- Production configuration validation, bounded connection pools, serialized migrations and graceful shutdown.
- Persistent export request and snapshot budgets, content limits and expiry cleanup. Migration 5 adds accounting for existing snapshots.
- CI for Node.js 22/24, native PostgreSQL concurrency, secret/dependency checks and container builds.

### Upgrade notes

Back up the database before deploying. Keep `ORGANIZATION_ID`, the database and existing object-storage prefix unchanged during upgrades. Set reverse-proxy trust to match the actual ingress. The CLI now requires an explicit server URL. Extension updates retain saved server connections.

Export pages remain valid until their original expiry, subject to current access. Reuse `snapshotId` for pagination and use `context.changes` for projects beyond the documented export limits. Do not roll back to an application version without export accounting; use a compatible forward fix.

Hosted customer organizations require separate deployments and databases. Public registration, billing, SSO and shared-database tenancy are not included in this release.