Changelog

Unreleased

Nothing yet.

0.4.2 2026-08-30

Fixed

• Comments — a pin now hides while the element it marks is hidden. Stacked slides, tabs and accordions keep laying their hidden panels out on screen, so every comment on the page used to pin itself over whatever you were actually looking at. Pins follow the page as it swaps panels, with no reload.

Changed

• Comments — pins number per author: yours count 1, 2, 3 whatever anyone else leaves alongside them, and a draft keeps its number when you publish it. The pin's tooltip and the panel row name whose a comment is.

0.4.1 2026-08-11

Added

• Deploy a single HTML file. brisk deploy report.html (and brisk dev) publishes a one-page site named after the file, and dropping one file on the dashboard names the site the same way. A deploy whose only top-level page is one HTML file serves it at / as well as under its own name, instead of landing on "there's no page at /". Two or more top-level pages stay a 404 — which one is home would be a guess. Deploying a single file that isn't a page links to the file itself and says so, rather than pointing at a root that has nothing to serve.

Fixed

• .htm pages are served as text/html instead of application/octet-stream, so browsers render them (and plugin widgets load on them) rather than downloading the file.
• Dismissing the dashboard's deploy overlay clears the pending overwrite, so a later drop can no longer replace a site someone else owns without the "belongs to …" confirmation.
• Site URLs (the link the CLI prints after a deploy, the dashboard's live link, and /api/sites) are https:// on an instance behind a TLS-terminating proxy, instead of the plain-http scheme the request reached the server with. X-Forwarded-Proto decides it when a proxy sends one, but only when it carries http or https, and the visitor cache varies by the result — so no single visitor's header can rewrite the links everyone else is handed. The guess is made against the host each URL actually names, so a proxy that rewrites Host to a backend address no longer produces an http:// OAuth redirect_uri for an https instance. Where a public certificate can't reach — loopback, bare IPs, and the private-use TLDs .internal, .local, .home.arpa — links stay on http. deploy/README.md documents the order and the one case that still needs X-Forwarded-Proto.

0.4.0 2026-07-29

Added

• Plugins — a curated, forkable layer of first-party features a site opts into (brisk.json "plugins": { … }), injected into served pages and driven from a generic brisk plugin CLI whose verbs load from the server. Adding a plugin in a fork is one directory under worker/src/plugins/ plus a registry line — no worker-core or CLI changes.
• Comments plugin (on by default) — leave feedback on any element, marked by numbered pins (dashed = draft, blue = open, gray = resolved). Drafts are local-first (localStorage; editable, copy as markdown to hand an agent), publish to share via brisk.db with realtime + an audit trail. Resolve, reply, and soft-delete from the widget or the CLI (brisk plugin comments …), or copy the whole log as markdown. Right-click the toolbar for the command menu. Typing in the widget never triggers the host page's own shortcuts. Minimize it to a corner bubble (click to reopen); Shift+C fully hides it.

Changed

• The /host page now covers the self-hosted path (Docker Compose, Kubernetes/Helm, npm create brisk, storage options) alongside Cloudflare, instead of documenting the Worker deploy only.

Fixed

• The /changelog page renders bold in entries instead of showing the literal asterisks.

0.3.0 2026-07-13

Added

• A provider-agnostic platform abstraction (storage, database, rooms, assets, cache) behind six seams, so Brisk now runs on Node/self-host — with SQLite plus S3 or the filesystem — in addition to Cloudflare, from the same core.
• Self-host packaging under deploy/: a multi-stage Dockerfile that builds and runs the Node assembly, a Docker Compose stack (filesystem + SQLite by default, optional MinIO for S3), and a Helm chart for Kubernetes.
• npm create brisk — an interactive wizard that scaffolds a self-host deployment. Pick a target (Docker Compose, Kubernetes/Helm, or Cloudflare Workers), auth mode, and storage backend, and it writes the matching deployment config (docker-compose.yml + .env, brisk-values.yaml, or .dev.vars + a Cloudflare checklist) plus next steps.
• The dashboard's drag-and-drop deploy takes a "deploying as" name, so a browser deploy records an owner the way brisk deploy --username already does. The name is remembered between drops. Dropping onto a site someone else owns now surfaces the same 409 the CLI does and asks you to launch again to overwrite, instead of failing with no way through.

Fixed

• Google sign-in works behind a TLS-terminating reverse proxy. The OAuth redirect_uri (and login URLs and the session cookie's Secure flag) were derived from the request the app received — plain http when a proxy terminates TLS and doesn't forward the scheme — which Google rejects with redirect_uri_mismatch. X-Forwarded-Proto is now honored when present, and any non-localhost host otherwise resolves as https.
• Deploys are attributed to the asserted deployer, so the dashboard's "by" column matches the owner label instead of the authenticated account. On AUTH=none every request is the same Dev user, which made every deploy read as Dev no matter who shipped it.
• The 404 page tells a missing path apart from a missing site. A typo'd path on a live site used to answer with brisk deploy --site <name> — instructions that would have overwritten the very site you were browsing. It now links back to the site's root, and only an unclaimed name gets the deploy hint.

0.2.0 2026-07-06

Added

• Deploys record a self-asserted owner (from --username, else the profile). Overwriting a site owned by someone else now needs confirmation — the CLI prompts, or pass --force / BRISK_FORCE=1. A spoofable label and footgun guard, never access control: unowned sites and every other action stay open.
• DEPLOY_HISTORY=on retains every published deploy as an immutable version in a new deploys table — version history now, rollback later. Off by default: the previous version is deleted after each atomic swap, keeping storage bounded.
• A /changelog page rendered from this file and linked from the dashboard nav; tag pushes now cut their GitHub release notes from the same CHANGELOG.md.
• OpenGraph image and social meta tags, so shared Brisk links unfurl with a preview card.
• A room example — a Three.js isometric diorama.

Changed

• Expanded the self-hosting guide with a how-it-works walkthrough, public demo mode, and an architecture diagram.
• Bumped wrangler and esbuild, with a pinned undici override.

Fixed

• Security hardening: /auth/cli browser sessions must confirm through a CSRF-guarded consent page before a token is minted, API and dashboard responses carry nosniff and anti-framing headers, and uploads serve as attachments.
• Closed a visitor cache-poisoning hole — static pages resolve the site from the host only, never a client header — and an unset AUTH on a public host now fails closed instead of serving an open backend.
• Hardened the open-instance guard so only a literal AUTH=none opens a public host: AUTH is trimmed, and any other non-google value — a mis-cased Google or a misspelled googl — now fails closed with the same 503 as an unset AUTH, instead of silently serving an anonymously-writable backend.
• An open (AUTH=none) public instance can no longer ship silently: the fail-closed 503 now spells out the secure setup, the worker warns once when open on purpose, and brisk deploy warns and confirms before pushing to an open host (bypass with --yes / BRISK_YES=1).
• Generated assets (/brisk.js and the /changelog page) are now built during wrangler deploy, so they ship with the worker instead of 404ing.
• Dashboard mobile layout: compact site rows, tighter headings, and a header that wraps instead of breaking mid-word.

0.1.0 2026-06-14

Added

• Folder-to-site deploys on a single Cloudflare Worker, backed by R2, D1, and Durable Objects — atomic version swaps, first-come site names, no config files.
• The brisk CLI: init, deploy, dev (watch and redeploy on every save), list, open, and pull to download any site's source. brisk login stores AWS-style per-instance profiles (whoami, profiles, profile use).
• The zero-dependency browser SDK served at /brisk.js: brisk.db (schemaless collections with realtime subscriptions), brisk.fs (uploads to permanent URLs), brisk.channel (realtime messaging and presence), brisk.me (identity), and brisk.ai (LLM calls proxied through the server's Anthropic/OpenAI keys).
• Realtime over one Durable Object per site — database change events, channel messages, and presence — using WebSocket hibernation so idle rooms cost nothing.
• Optional Google OAuth on the apex domain with a session cookie scoped to every site subdomain, plus ALLOWED_EMAILS / ALLOWED_EMAIL_DOMAINS allowlists, personal CLI tokens, and a CI deploy token.
• VISIBILITY=public demo mode: signed-out visitors get edge-cached, view-only access while every brisk.* API stays members-only.
• The dashboard at the apex domain — a live list of every site, drag-and-drop deploys with a launch flow and confetti, a one-page SDK reference at /docs, and a self-hosting guide at /host.
• @usebrisk/cli and @usebrisk/sdk published to npm, cut in lockstep by a tag-driven release workflow.