v0.4.0

Added

• Plugins — a curated, forkable layer of first-party features a site opts
  into (brisk.json "plugins": { … }), injected into served pages and driven
  from a generic brisk plugin CLI whose verbs load from the server. Adding a
  plugin in a fork is one directory under worker/src/plugins/ plus a registry
  line — no worker-core or CLI changes.
• Comments plugin (on by default) — leave feedback on any element, marked
  by numbered pins (dashed = draft, blue = open, gray = resolved). Drafts are
  local-first (localStorage; editable, copy as markdown to hand an agent),
  publish to share via brisk.db with realtime + an audit trail. Resolve,
  reply, and soft-delete from the widget or the CLI
  (brisk plugin comments …), or copy the whole log as markdown. Right-click
  the toolbar for the command menu. Typing in the widget never triggers the
  host page's own shortcuts. Minimize it to a corner bubble (click to reopen);
  Shift+C fully hides it.

Changed

• The /host page now covers the self-hosted path (Docker Compose,
  Kubernetes/Helm, npm create brisk, storage options) alongside Cloudflare,
  instead of documenting the Worker deploy only.

Fixed

• The /changelog page renders **bold** in entries instead of showing the
  literal asterisks.

v0.3.0

Added

• A provider-agnostic platform abstraction (storage, database, rooms, assets,
  cache) behind six seams, so Brisk now runs on Node/self-host — with SQLite
  plus S3 or the filesystem — in addition to Cloudflare, from the same core.
• Self-host packaging under deploy/: a multi-stage Dockerfile that builds and
  runs the Node assembly, a Docker Compose stack (filesystem + SQLite by
  default, optional MinIO for S3), and a Helm chart for Kubernetes.
• npm create brisk — an interactive wizard that scaffolds a self-host
  deployment. Pick a target (Docker Compose, Kubernetes/Helm, or Cloudflare
  Workers), auth mode, and storage backend, and it writes the matching
  deployment config (docker-compose.yml + .env, brisk-values.yaml, or
  .dev.vars + a Cloudflare checklist) plus next steps.
• The dashboard's drag-and-drop deploy takes a "deploying as" name, so a browser
  deploy records an owner the way brisk deploy --username already does. The
  name is remembered between drops. Dropping onto a site someone else owns now
  surfaces the same 409 the CLI does and asks you to launch again to overwrite,
  instead of failing with no way through.

Fixed

• Google sign-in works behind a TLS-terminating reverse proxy. The OAuth
  redirect_uri (and login URLs and the session cookie's Secure flag) were
  derived from the request the app received — plain http when a proxy
  terminates TLS and doesn't forward the scheme — which Google rejects with
  redirect_uri_mismatch. X-Forwarded-Proto is now honored when present, and
  any non-localhost host otherwise resolves as https.
• Deploys are attributed to the asserted deployer, so the dashboard's "by"
  column matches the owner label instead of the authenticated account. On
  AUTH=none every request is the same Dev user, which made every deploy read
  as Dev no matter who shipped it.
• The 404 page tells a missing path apart from a missing site. A typo'd path on
  a live site used to answer with brisk deploy --site <name> — instructions
  that would have overwritten the very site you were browsing. It now links back
  to the site's root, and only an unclaimed name gets the deploy hint.

v0.2.0

Added

• Deploys record a self-asserted owner (from --username, else the profile).
  Overwriting a site owned by someone else now needs confirmation — the CLI
  prompts, or pass --force / BRISK_FORCE=1. A spoofable label and footgun
  guard, never access control: unowned sites and every other action stay open.
• DEPLOY_HISTORY=on retains every published deploy as an immutable version
  in a new deploys table — version history now, rollback later. Off by
  default: the previous version is deleted after each atomic swap, keeping
  storage bounded.
• A /changelog page rendered from this file and linked from the dashboard
  nav; tag pushes now cut their GitHub release notes from the same
  CHANGELOG.md.
• OpenGraph image and social meta tags, so shared Brisk links unfurl with a
  preview card.
• A room example — a Three.js isometric diorama.

Changed

• Expanded the self-hosting guide with a how-it-works walkthrough, public
  demo mode, and an architecture diagram.
• Bumped wrangler and esbuild, with a pinned undici override.

Fixed

• Security hardening: /auth/cli browser sessions must confirm through a
  CSRF-guarded consent page before a token is minted, API and dashboard
  responses carry nosniff and anti-framing headers, and uploads serve as
  attachments.
• Closed a visitor cache-poisoning hole — static pages resolve the site from
  the host only, never a client header — and an unset AUTH on a public host
  now fails closed instead of serving an open backend.
• Hardened the open-instance guard so only a literal AUTH=none opens a public
  host: AUTH is trimmed, and any other non-google value — a mis-cased
  Google or a misspelled googl — now fails closed with the same 503 as an
  unset AUTH, instead of silently serving an anonymously-writable backend.
• An open (AUTH=none) public instance can no longer ship silently: the
  fail-closed 503 now spells out the secure setup, the worker warns once when
  open on purpose, and brisk deploy warns and confirms before pushing to an
  open host (bypass with --yes / BRISK_YES=1).
• Generated assets (/brisk.js and the /changelog page) are now built
  during wrangler deploy, so they ship with the worker instead of 404ing.
• Dashboard mobile layout: compact site rows, tighter headings, and a header
  that wraps instead of breaking mid-word.

v0.1.0

Full Changelog: https://github.com/tomperi/brisk/commits/v0.1.0