v1.7.0

What's Changed

• feat(experience): micStartMode:'deferred' — connect micless, startMic() on user gesture by @zoharbabin in #114
• Bump version to 1.7.0 for deferred mic start by @zoharbabin in #115

Full Changelog: v1.6.0...v1.7.0

v1.6.0

What's Changed

• docs: split API-REFERENCE.md into an index + focused files under docs/api/ by @zoharbabin in #110
• feat: chat-only transport and mid-conversation mode switching by @zoharbabin in #111
• Bump version to 1.6.0 for chat transport and mode switching by @zoharbabin in #112

Full Changelog: v1.5.0...v1.6.0

v1.5.0

What's Changed

• docs: audit fixes — client-variables gate, recipe corrections, drift backports by @zoharbabin in #102
• docs: neutralize internal deployment reference in CLIENT-COMMANDS.md by @zoharbabin in #104
• docs: mirror the three-flows positioning (session modes rename + STV callout) by @zoharbabin in #106
• request_vars is the only context channel — deprecate legacy DPP by @zoharbabin in #108
• Bump version to 1.5.0 for the request_vars-only context channel by @zoharbabin in #109

Full Changelog: v1.4.1...v1.5.0

v1.4.1

What's Changed

• Document provision()'s personaLint field and lintPersonaIdentity by @zoharbabin in #30
• fix(prompt-lint): fire persona_name_drift off declared name alone by @zoharbabin in #34
• ci: trigger on merge_group so the merge queue can actually merge by @zoharbabin in #68
• ci: add live-verify gate (real Kaltura API smoke test) by @zoharbabin in #67
• ci: pin actions to SHA, expand SAST/secret gates, gate live-verify on merge queue by @zoharbabin in #69
• ci: DX gates, coverage floors, and CodeQL by @zoharbabin in #70
• docs: fix stale dependabot.yml comment about Actions pinning by @zoharbabin in #71
• Extract shared Teardown helper for subscribe/unsubscribe-on-destroy pattern by @zoharbabin in #72
• Bind a session to a real end-user identity (userId on session creation) by @zoharbabin in #48
• Add ./experience/chroma-key: bring-your-own transparent-background avatar compositor by @zoharbabin in #51
• chroma-key: destroy the compositor on session.disconnect()/stop(), not just 'ended' by @zoharbabin in #73
• docs: document the full sys__* reserved-variable surface (issue #37) by @zoharbabin in #50
• Flag unresolvable reserved-variable references in previewPrompt() (#45) by @zoharbabin in #49
• docs: cross-reference issue #42 on thread hard-delete blocker by @zoharbabin in #54
• docs: document unbounded thread-history growth and per-turn cost by @zoharbabin in #60
• docs: cross-reference issue #44 on thread-summarization blocker by @zoharbabin in #61
• Fix GenUI parse.js quoted-value leak and flush-left dash-list parse failure by @zoharbabin in #63
• GenUI: graded interactive-question widget (issue #39) by @zoharbabin in #52
• docs: GenUI widget-interaction analytics recipe (no double-counting) by @zoharbabin in #55
• docs: pause/resume recipe for video and interactive content (issue #40) by @zoharbabin in #57
• Fix: _coldReconnect() clears paused/_sessionReleased so resume() doesn't spuriously time out by @zoharbabin in #64
• fix(chroma-key): destroy player on mount failure, derive fatal codes from session.js by @zoharbabin in #89
• fix(prompt-lint): detect every unclosed {{, not just the last one by @zoharbabin in #90
• fix(devx): honest verify timeout, exports-derived CDN smoke test, no ghost commands by @zoharbabin in #91
• docs: fix API/wire/GenUI reference drift by @zoharbabin in #92
• fix(experience): hold cold-reconnect approve while paused, release on resume() by @zoharbabin in #93
• docs: fix § 10 cross-reference direction in GENUI-REFERENCE by @zoharbabin in #97
• fix(management): tolerate duplicate categoryEntry link under transport retry by @zoharbabin in #98
• Bump version to 1.4.1 by @zoharbabin in #99

Full Changelog: v1.4.0...v1.4.1

v1.4.0

What's Changed

• Dead-air events, avatar_filler disclosure, Presenter deckOutline (#22, #23, #24) by @zoharbabin in #26
• Fix: clone default SLIDES fixture per-test in presenter.test.js by @zoharbabin in #28

Full Changelog: v1.3.0...v1.4.0

v1.3.0

What's Changed

• Avatar visual pipeline fixes/enhancements (issues #15-#20) by @zoharbabin in #21
• Drop inert client-side entitlement guard from KalturaAvatarSession by @zoharbabin in #25

Full Changelog: v1.2.0...v1.3.0

v1.2.0

What's Changed

• Isolate Presenter plugin: remove from unintended umbrella export, add destroy()/stop() lifecycle by @zoharbabin in #13
• Correct version: 1.2.0, not 2.0.0 (Presenter export removal was never breaking) by @zoharbabin in #14

Full Changelog: v1.1.0...v1.2.0

v1.1.0

Full Changelog: v1.0.3...v1.1.0

v1.0.3

What's Changed

• Bump actions/setup-node from 4 to 7 by @dependabot[bot] in #4
• Bump actions/checkout from 4 to 7 by @dependabot[bot] in #5
• Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #6
• Add knowledge.isIndexed() as the real indexing-status check by @zoharbabin in #8

New Contributors

• @dependabot[bot] made their first contribution in #4

Full Changelog: v1.0.2...v1.0.3

v1.0.2

Security

Http.request()'s maxResponseBytes guard now enforces the limit incrementally while
streaming the response body, instead of buffering the full body via res.text() first —
closes a memory-exhaustion path for a chunked response with no honest Content-Length.

net-guard.js's SSRF host check now also blocks IPv6 unique-local (fc00::/7), IPv6
link-local (fe80::/10), and IPv4-mapped IPv6 addresses (::ffff:a.b.c.d and the
URL-normalized hex-hextet form) — closes bypasses that skipped the IPv4-only
private-range check.

safeUrl now rejects URLs carrying embedded userinfo credentials
(https://user:pass@host/...) — closes a phishing/link-spoofing vector distinct from the
existing scheme allowlist.