brisk▮

Changelog

Every notable change to Brisk, newest first. Generated from CHANGELOG.md — the single source of truth — and mirrored to GitHub Releases on every tag.

Unreleased

Nothing yet.

Plugins — a curated, forkable layer of first-party features a site opts into (brisk.json "plugins": { … }), injected into served pages and driven from a generic brisk plugin CLI whose verbs load from the server. Adding a plugin in a fork is one directory under worker/src/plugins/ plus a registry line — no worker-core or CLI changes.
Comments plugin (on by default) — leave feedback on any element, marked by numbered pins (dashed = draft, blue = open, gray = resolved). Drafts are local-first (localStorage; editable, copy as markdown to hand an agent), publish to share via brisk.db with realtime + an audit trail. Resolve, reply, and soft-delete from the widget or the CLI (brisk plugin comments …), or copy the whole log as markdown. Right-click the toolbar for the command menu. Typing in the widget never triggers the host page's own shortcuts. Minimize it to a corner bubble (click to reopen); Shift+C fully hides it.

The /host page now covers the self-hosted path (Docker Compose, Kubernetes/Helm, npm create brisk, storage options) alongside Cloudflare, instead of documenting the Worker deploy only.

The /changelog page renders bold in entries instead of showing the literal asterisks.

A provider-agnostic platform abstraction (storage, database, rooms, assets, cache) behind six seams, so Brisk now runs on Node/self-host — with SQLite plus S3 or the filesystem — in addition to Cloudflare, from the same core.
Self-host packaging under deploy/: a multi-stage Dockerfile that builds and runs the Node assembly, a Docker Compose stack (filesystem + SQLite by default, optional MinIO for S3), and a Helm chart for Kubernetes.
npm create brisk — an interactive wizard that scaffolds a self-host deployment. Pick a target (Docker Compose, Kubernetes/Helm, or Cloudflare Workers), auth mode, and storage backend, and it writes the matching deployment config (docker-compose.yml + .env, brisk-values.yaml, or .dev.vars + a Cloudflare checklist) plus next steps.
The dashboard's drag-and-drop deploy takes a "deploying as" name, so a browser deploy records an owner the way brisk deploy --username already does. The name is remembered between drops. Dropping onto a site someone else owns now surfaces the same 409 the CLI does and asks you to launch again to overwrite, instead of failing with no way through.

Google sign-in works behind a TLS-terminating reverse proxy. The OAuth redirect_uri (and login URLs and the session cookie's Secure flag) were derived from the request the app received — plain http when a proxy terminates TLS and doesn't forward the scheme — which Google rejects with redirect_uri_mismatch. X-Forwarded-Proto is now honored when present, and any non-localhost host otherwise resolves as https.
Deploys are attributed to the asserted deployer, so the dashboard's "by" column matches the owner label instead of the authenticated account. On AUTH=none every request is the same Dev user, which made every deploy read as Dev no matter who shipped it.
The 404 page tells a missing path apart from a missing site. A typo'd path on a live site used to answer with brisk deploy --site <name> — instructions that would have overwritten the very site you were browsing. It now links back to the site's root, and only an unclaimed name gets the deploy hint.

Deploys record a self-asserted owner (from --username, else the profile). Overwriting a site owned by someone else now needs confirmation — the CLI prompts, or pass --force / BRISK_FORCE=1. A spoofable label and footgun guard, never access control: unowned sites and every other action stay open.
DEPLOY_HISTORY=on retains every published deploy as an immutable version in a new deploys table — version history now, rollback later. Off by default: the previous version is deleted after each atomic swap, keeping storage bounded.
A /changelog page rendered from this file and linked from the dashboard nav; tag pushes now cut their GitHub release notes from the same CHANGELOG.md.
OpenGraph image and social meta tags, so shared Brisk links unfurl with a preview card.
A room example — a Three.js isometric diorama.

Expanded the self-hosting guide with a how-it-works walkthrough, public demo mode, and an architecture diagram.
Bumped wrangler and esbuild, with a pinned undici override.

Security hardening: /auth/cli browser sessions must confirm through a CSRF-guarded consent page before a token is minted, API and dashboard responses carry nosniff and anti-framing headers, and uploads serve as attachments.
Closed a visitor cache-poisoning hole — static pages resolve the site from the host only, never a client header — and an unset AUTH on a public host now fails closed instead of serving an open backend.
Hardened the open-instance guard so only a literal AUTH=none opens a public host: AUTH is trimmed, and any other non-google value — a mis-cased Google or a misspelled googl — now fails closed with the same 503 as an unset AUTH, instead of silently serving an anonymously-writable backend.
An open (AUTH=none) public instance can no longer ship silently: the fail-closed 503 now spells out the secure setup, the worker warns once when open on purpose, and brisk deploy warns and confirms before pushing to an open host (bypass with --yes / BRISK_YES=1).
Generated assets (/brisk.js and the /changelog page) are now built during wrangler deploy, so they ship with the worker instead of 404ing.
Dashboard mobile layout: compact site rows, tighter headings, and a header that wraps instead of breaking mid-word.

Folder-to-site deploys on a single Cloudflare Worker, backed by R2, D1, and Durable Objects — atomic version swaps, first-come site names, no config files.
The brisk CLI: init, deploy, dev (watch and redeploy on every save), list, open, and pull to download any site's source. brisk login stores AWS-style per-instance profiles (whoami, profiles, profile use).
The zero-dependency browser SDK served at /brisk.js: brisk.db (schemaless collections with realtime subscriptions), brisk.fs (uploads to permanent URLs), brisk.channel (realtime messaging and presence), brisk.me (identity), and brisk.ai (LLM calls proxied through the server's Anthropic/OpenAI keys).
Realtime over one Durable Object per site — database change events, channel messages, and presence — using WebSocket hibernation so idle rooms cost nothing.
Optional Google OAuth on the apex domain with a session cookie scoped to every site subdomain, plus ALLOWED_EMAILS / ALLOWED_EMAIL_DOMAINS allowlists, personal CLI tokens, and a CI deploy token.
VISIBILITY=public demo mode: signed-out visitors get edge-cached, view-only access while every brisk.* API stays members-only.
The dashboard at the apex domain — a live list of every site, drag-and-drop deploys with a launch flow and confetti, a one-page SDK reference at /docs, and a self-hosting guide at /host.
@usebrisk/cli and @usebrisk/sdk published to npm, cut in lockstep by a tag-driven release workflow.