Floorplan 0.6.0

• Health catches the classic mistakes in AI-built apps. Five new checks, each in plain words with a fix to paste:
  • Secret keys sent to the browser: an OpenAI, Stripe or Supabase service-role key (and others) in a NEXT_PUBLIC_, VITE_, REACT_APP_ or similar variable, which every visitor can read. Keys that are public by design, like Supabase's anon key or Stripe's publishable key, are left alone.
  • Supabase tables anyone can read and change: tables whose row-level security is never switched on (or is switched off), worked out by replaying the migrations in order, so a table locked later or dropped doesn't count. Policies that let anyone add, change or delete rows are flagged too, as worth a look.
  • Firebase rules that let anyone in: Firestore, Storage and Realtime Database rules open to anyone, including "test mode" rules, with the date they stop working (or stopped).
  • Stripe webhooks anyone could fake: code that acts on events like checkout.session.completed without checking Stripe's signature, so anyone could send a fake "payment succeeded".
  • Servers that let any website call them (CORS): a small note on its own, and worth fixing when login cookies are allowed along with it.
• No more false alarm on Supabase's config.toml: values like "env(S3_SECRET_KEY)" read a setting from the environment, so they're no longer reported as a key written into the code.

Floorplan 0.5.0

• Fits phones and tablets: the top bar wraps instead of running off the screen, the details open as a sheet at the bottom of a phone (tap a box to see them), the long description under the title folds to a line with More / Less, and every control is at least 44 px to tap. Nothing changes with a mouse at 1000 px and wider. Requested in #18 and built by @menachem-kurkus in #19.
• Touch gestures on the map: dragging or pinching on a phone or tablet made the map jump to unexpected places. A drag now follows only the finger that started it and ends when the browser takes over the touch (before, the drag stayed switched on and followed any later movement); a second finger starts a pinch instead of restarting the drag, and a third finger is ignored; two fingers zoom around the point between them and moving both pans; the first tap after a drag is no longer swallowed; and the browser no longer zooms or bounces the page under the map, or re-fits the map when a phone's address bar slides in and out. A mouse, a trackpad and the wheel work exactly as before. Built by @menachem-kurkus in #24.
• No hover tooltip after a tap: a tap also sends the browser's hover event, so a card's tooltip popped up over the details sheet. Tooltips now show only for a mouse, and a tooltip stays inside a narrow window.

Floorplan 0.4.4

• The note for future sessions is now your choice: in Claude Code, Floorplan no longer adds its section to CLAUDE.local.md on its own. After your first map, Claude asks whether future sessions in the project should use it, and adds the note only if you say yes. A note you already have is kept up to date; delete it to remove it.
• Pre-approved commands named one by one: the skill now lists each of its eight scripts by name, instead of approving anything in its scripts folder.

Floorplan 0.4.3

• Links for the Claude plugin directory: the Claude Code manifest now points to the documentation, the privacy and security page, and GitHub issues for support, so a directory listing shows the right links. Nothing else changed.

Floorplan 0.4.2

• Is it safe to install? A new page lists everything Floorplan does on your computer: no hooks, MCP servers, dependencies or downloads, its one outbound request, and every program it runs. A test enforces it on every change, and each release now includes CHECKSUMS.txt, so you can confirm your installed copy matches it (node tools/checksums.mjs --check <folder>).
• Checked by GitHub's code scanner: CodeQL now scans every change. Its first scan found six spots to tighten, all fixed: complete escaping in three places, the "Made with Floorplan" link built without reusing page text as HTML, and plain error messages on the map when Undo or Export fails, with the details in the map server's output.

Read it here: Is it safe to install?

Floorplan 0.4.1

• Exported copies say where they came from: a small "Made with Floorplan" link at the bottom of an exported map leads to the project, so whoever receives one can make their own.

Floorplan 0.4.0

• Export a copy to share: the map's new Export button saves one HTML file anyone can open in a browser, with nothing to install. It has the whole map without the Ask bar, your folder path or git remotes. Flows and notes go in by default; recent work and the health check (or a blueprint's design review) only if you tick them. Ask Claude or Codex to "export the floorplan", or run node floorplan/serve.mjs --export.

Floorplan 0.3.2

• The map's server answers only to this computer's own addresses: it refuses requests under any other host name, so a website that points its domain at 127.0.0.1 (DNS rebinding) can't load the map, read its token and ask questions about your code.

Floorplan 0.3.1

• Asking on a map works again on Windows with the current Claude Code install: the map's server found only the shell shim of an npm install and failed with spawn ...\claude ENOENT; it now finds the real claude.exe inside the package. Reported and fixed by @menachem-kurkus in #20 and #21.
• Fewer false Health alarms on FastAPI: a check added where a router is included, like app.include_router(admin.router, dependencies=[Depends(require_admin)]), now protects every endpoint of that router, as app.use('/admin', requireStaff, adminRouter) already did on Express. A database session added there still doesn't count as a sign-in check. Fixed by @stevensiht in #15.
• FastAPI routers found by the name they're imported under: a router imported under another name (from app.routes import campaigns as campaign_routes) gets its prefix and its checks, and a package that shares a router's name (from app.platform import pricing beside a platform router) is no longer mistaken for it. Fixed by @stevensiht in #15.
• No more false alarm for analytics and map tokens: Health no longer calls Cloudflare Web Analytics' beacon token or a Mapbox public token (pk.…) a leaked secret. Both are public by design: the page has to send them for analytics or maps to work. Reported by @CplSyx in #23.
• Big files no longer vanish from the map: files up to 2 MB are now read in full (up from 512 KB). A file over the limit still appears with its line count, the scan lists it, Health includes it among the very large files, and its card says its connections and secrets weren't checked. Reported by @Rasherb69 in #16.

Floorplan 0.3.0

• Blueprints: plan it before you build it. Floorplan still maps the code you have; now it can also start from no code at all. Share a PRD, a spec or a description of something you want to build, and Floorplan draws the map of what it would take: every part, file, endpoint and screen, how they connect, and the outside services they rely on. It's marked as planned (dashed cards and a Blueprint label), Health becomes a design review of the plan (endpoints anyone could use, decisions the PRD leaves open, loose ends), and each part has Build this with Claude (or Codex), a ready request to build it as planned. Switch the Ask bar to Change to shape the plan from the map ("also plan out refunds"): the map redraws with the new and changed pieces highlighted, and Undo puts it back. Design review items can be settled the same way with Resolve on the map: an open question just needs your answer. Once the code exists, the map can switch to the real code.
• Bracketed folder names like Next.js' [id] and [...slug] can be written as they are in architecture.json path patterns; they match that folder exactly.