Skip to content

Changelog

All notable changes to Glassy are documented here.

Recent Updates

July 27, 2026 — Companion v2.15.0: Obsidian Vault Companion + glassy-dash v2.35.0-beta.9

Companion extension v2.15.0 — Obsidian Vault Companion: see release notes at https://github.com/0Reliance/glassy-companion/releases/tag/v2.15.0.

  • New Vault tab — browse your Obsidian vault from the extension popup. File tree with breadcrumb navigation, rendered HTML preview with backlinks/tags metadata, "Open in Obsidian" button.
  • Quick Note + Daily Note — "Notes" sub-tab inside the Vault tab. Append to today's daily note (Shift+Enter), or create new notes pushed to the vault as .md files.
  • Capture Controls — auto-push toggle + configurable clips folder in Settings → Obsidian Bridge. "Related in your vault" panel on save (debounced vault search).
  • Tag Bridge — vault tags merged into autocomplete with source badges. Nested Obsidian tags (type/reference) now preserved (was silently destroyed). Server sanitizeTags aligned.
  • Settings flyout — permanent "Browser Extension" link added → #/extension page.

glassy-dash v2.35.0-beta.9 — Obsidian Bridge SSE Auth Stabilization: see CHANGELOG.

  • SSE ticket double-consumption fix — /api/ext and /api/ext/obsidian-bridge routers ran auth twice, consuming the one-time SSE ticket on the first run. Reordered mounts + next('router') guard.
  • Plugin version parsing fix — parsePluginVersion now reads versions.self (plugin) not versions.obsidian (app).
  • Tag sanitization fix — sanitizeTags now allows / for nested Obsidian tags.

July 24, 2026 — Companion v2.14.0: Obsidian Bridge deep-fix + glassy-dash v2.35.0-beta.8

Companion extension v2.14.0 — Obsidian Bridge deep-fix: see release notes at https://github.com/0Reliance/glassy-companion/releases/tag/v2.14.0.

  • localhost host_permissions broadened — the old manifest only declared Obsidian ports (27123/27124); the offscreen doc SSE to a localhost self-host Glassy server was silently blocked by Chrome. Now declares http(s)://127.0.0.1/* and http(s)://localhost/* so any localhost Glassy server works.
  • Offscreen doc existence verified via chrome.runtime.getContexts() — stale cached flag caused silent bridge death after Chrome tore down the offscreen doc under memory pressure.
  • onSuspend no longer false-flips status — the offscreen doc owns the SSE and isn't evicted on SW suspend; flipping status caused false-negative "Disconnected" in the popup.
  • peekToken() prevents silent auth loss — getToken() called clearAuth() on JWT expiry, silently nuking the token; the offscreen doc can't re-authenticate, so the bridge died with no feedback.
  • Permission denial feedback — popup shows a warning banner when localhost host permissions are denied.
  • SSE auth migrated to one-time ticket — POST /api/ext/obsidian-bridge/ticket issues tickets; JWT no longer leaks into server logs.
  • Server-side bridge-first routing on self-host — 20 obsidian.js route guards + aiContext.js + MCP proxy all bailed before checking the bridge, making it dead code when obsidian_token is NULL (self-host). Now uses loadObsidianSettings() helper.
  • Cross-repo version sync gate — scripts/verify-companion-version-sync.js added to dev.sh deploy pre-flight to prevent the "app links to old extension" release integrity failure.
  • Gem brand assets unified across all surfaces (favicons, PWA icons, component SVGs).

July 22, 2026 — Companion v2.13.0: Obsidian Bridge MV3 reliability

Companion extension v2.13.0 — Obsidian Bridge MV3 reliability fix: see release notes at https://github.com/0Reliance/glassy-companion/releases/tag/v2.13.0.

  • SSE EventSource moved to a persistent offscreen document — Chrome MV3 evicts service workers after ~30s of inactivity, silently killing the EventSource that powers the Obsidian Bridge. The offscreen document is persistent and never evicted, so the bridge stays alive indefinitely while the browser is open. A connectSSEInServiceWorker() legacy fallback is retained for Firefox versions that lack the offscreen Documents API.
  • chrome.runtime.onSuspend handler — flips the bridge status to connected:false when the SW is evicted, so the popup never shows a stale "connected" indicator.
  • Test Connection now tests the full bridge loop — both the SSE bridge to the server and the direct extension→Obsidian fetch. A green result confirms both legs; a yellow warning surfaces if the SSE bridge is offline while the direct fetch works.
  • Settings sync to server — on SSE onopen, the extension pushes its Obsidian URL to the server's users.obsidian_url column, eliminating drift between the web-app DB and extension storage. The Obsidian API token never leaves the extension.
  • Membership gate removed from popup — the extension no longer does any client-side entitlement gating for glassy_keep. The server remains the single gatekeeper via requireKeep. This removes the "Unlock GlassyKeep" upsell wall for self-hosted admins (whose clear_lifetime tier is resolved server-side, not in entitlements_json).
  • Softer entitlement toast — a 403 from the server now reads "Save unavailable — Saving from the extension requires a Pro plan. Manage your items in your Glassy workspace." instead of "Upgrade required."

July 23, 2026 — Docs refresh pass

The docs surface (docs.glassy.today) is brought in line with shipped product state:

  • Companion page fully rewritten to document v2.13.0 (installation across Chrome / Firefox / Edge / Opera / Brave / Arc, the new release notes, and the migration from v2.12.0).
  • FAQ expanded from a stub ("being expanded") to a comprehensive reference covering pricing, privacy, AI, self-hosting, Companion, Obsidian, and security.
  • Thin pages fleshed out: content-types.md, import-export.md, search.md, webhooks.md, access-modes.md. Each now documents the current state of the feature instead of "Learn more on Glassy Learn" placeholders.
  • access-modes.md updated to document the third INSTANCE_ID value: self_hosted was missing from the table; the page now covers the full public / clear / self_hosted matrix with the recommended combinations.
  • obsidian-vault.md v3.0+ typo fixed to v2.13.0+ (Companion never shipped a v3.x line).
  • last-reviewed frontmatter refreshed across all docs pages to today.

July 8, 2026 — Companion v2.12.0: Unified Save Card & Obsidian Bridge

Companion extension v2.12.0 — Unified Save Card & Obsidian Bridge: see release notes at https://github.com/0Reliance/glassy-companion/releases/tag/v2.12.0.

  • Unified Save Card — Quick Save and Smart Save are now merged into a single progressive-disclosure card. Type chips (Article, Video, Repo, Bookmark) re-run the page interpreter on change so metadata is always fresh before save. One card, one flow, less friction.
  • Obsidian Bridge — the extension now acts as a local proxy between the Glassy server and Obsidian Local REST API. The server pushes proxy requests to the extension via SSE; the extension calls Obsidian on 127.0.0.1:27124 and returns the result. This bypasses WSL2/Docker networking entirely. Also pushes captures to the vault as markdown files with YAML frontmatter.
  • Cloud → self-host switching — changing the server URL in extension settings now detects the change, prompts re-authentication, reconnects the Obsidian bridge SSE, and invalidates caches.
  • Optional host permissions — the extension declares optional_host_permissions for 127.0.0.1:27123/27124 so users can opt into localhost access for the Obsidian bridge without widening the base permission set.

July 8, 2026 — Obsidian Bridge: browser extension as local proxy

Dashboard + Companion Extension — Obsidian connectivity overhaul:

This release solves the fundamental WSL2/Docker networking problem: when Glassy runs in a container on Windows, the container cannot reach Obsidian on the Windows host's 127.0.0.1. The browser extension, running on the Windows host, can.

  • Browser extension Obsidian Bridge — the Glassy Companion extension now acts as a local proxy between the server and Obsidian. The server pushes proxy requests to the extension via SSE; the extension calls Obsidian on 127.0.0.1:27124 and returns the result. This bypasses WSL2/Docker networking entirely.
  • Extension settings UI — new "Obsidian Bridge" section in extension settings with URL input, API key, test connection, and connection status indicator.
  • Server bridge registry — in-memory registry tracking connected extensions per user; all Obsidian route handlers and the AI context path check the bridge first and fall back to the direct server→Obsidian path when the bridge is offline.
  • Configurable Obsidian network allowlist — new OBSIDIAN_NETWORK_ALLOWLIST env var lets self-hosted operators add internal IPs/hostnames (LAN, Tailscale, WSL2 bridge) to the Obsidian SSRF allowlist without a code change. Self-signed TLS is now tolerated for these hosts too.
  • Environment-aware diagnostics — the Obsidian diagnostics endpoint now detects WSL2/Docker deployment context and gives specific, actionable recommendations ("Install the browser extension and enable the Obsidian Bridge") instead of generic "try HTTP" messages.
  • Push-to-Obsidian from extension — captures saved via the extension can now be pushed directly to the Obsidian vault as markdown files, without a server round-trip.
  • Cloud → self-host switching — changing the server URL in extension settings now detects the change, prompts re-authentication, reconnects the Obsidian bridge SSE, and invalidates caches.
  • Core app UI bridge status — the Settings → Obsidian panel now shows "Browser extension bridge active" when connected, or "Install the Glassy Companion extension" recommendation when not connected.
  • Optional host permissions — the extension declares optional_host_permissions for 127.0.0.1:27123/27124 so users can opt into localhost access for the Obsidian bridge without widening the base permission set.

July 7, 2026 — Self-Hosted Launch Gating (beta.3) + Brand-Asset Rebuild

Dashboard v2.35.0-beta.3 — Self-Hosted Launch Gating: - Transparent sign-in panel on the appliance — explains that sign-in is temporary, tied to Kickstarter goals, and that the appliance is local-first. Links to the self-host README "Why sign in?" section. - Persistent "Local only — nothing leaves this device." badge in the authenticated chrome (LocalOnlyBadge component, isLocalDeployment()-gated). - Marketing-route short-circuit — anonymous visitors to #/about, #/security, #/guide, #/neurodiversity, #/obsidian, #/writers, #/students, #/extension, #/download on self_hosted are routed to login before any flash, not after. - LandingView fallthrough replaced on self_hosted — no marketing page exists on the appliance. - Compose env hygiene — identity vars (INSTANCE_ID, INSTANCE_ACCESS_MODE_DEFAULT) hardcoded as the privacy safeguard; operational vars (DEPLOYMENT_LOCALITY, ENABLE_MCP_SERVER, ENABLE_AGENT_GATEWAY, OBSIDIAN_HOST_OVERRIDE) now .env-overridable. - Ollama URL fix in .env.example — was confusingly localhost; now host.docker.internal.

Companion extension v2.11.2 — Self-Hosted CSP & Local Network Support: see release notes at https://github.com/0Reliance/glassy-companion/releases/tag/v2.11.2.

Marketing (glassy-www) — Brand-Asset Container Rebuild: - glassy-www-prod and glassy-learn-prod rebuilt with brand-asset ingest (cfc1a91/997480f); new logo.png (md5 07a1cc64…), og-default.png, unified favicon.svg, pwa-512.png, apple-touch-icon.png. - app.glassy.fyi already serves the new assets (baked into the f8fa465 promotion 2026-07-05). - One stale Cloudflare URL remaining: https://glassy.fyi/favicon.svg (founder dashboard purge).

July 6, 2026 — Self-Hosted Blueprint (Phases A–D) + Ecosystem Cleanup

Dashboard v2.35.0-beta.1 / -beta.2 — Self-Hosted Blueprint Phases A–D: - INSTANCE_ID=self_hosted — third runtime identity (distinct from public and clear). - Owner auto-unlock — seeded admin granted clear_lifetime on first boot when isSelfHostedInstance(). All existing entitlement gates (Keep, Calc, themes, Voice Studio, KB, MCP, Agent Gateway) pass through isClearMember() so no tierPolicy.js change needed. - Registration lockdown (defense-in-depth) — authRoutes.js /register returns hard 403 REGISTRATION_DISABLED as the first check; loadAdminSettings() forces allowNewAccounts=false and instanceAccessMode='private' on every boot; admin PATCH /api/admin/settings silently ignores mutations to those fields on self_hosted. - Server-side service gating — on self_hosted: /api/commerce/*, /api/stripe/*, /api/push/* not mounted (404); Sentry not initialised; sendEmail() no-op; deductAiCredits() no-op. - BYOK-only AI on the appliance — GEMINI_API_KEY, OPENAI_API_KEY, ANTHROPIC_API_KEY not loaded from env; BYOK via Settings → API Keys and local Ollama work; no-provider path returns 402 { code: 'NO_AI_PROVIDER' } with setup guidance. - Frontend commerce hiding — 9 components migrated isClearInstance() → isBundledInstance(); App.jsx redirects #/register → #/login, #/store → #/settings, #/upgrade → #/settings on self_hosted. - AiUpgradeModal BYOK guidance — no upgrade/credits copy; shows "Add your own API key in Settings → API Keys" instead. - Self-host compose overlays — docker-compose.ollama.yml, docker-compose.https.yml (Caddy), docker-compose.watchtower.yml. - docs/SELF_HOSTED_DEPLOYMENT.md written — account management, sub-accounts, account recovery, AI providers (BYOK + Ollama), Obsidian sync, backup/restore, upgrading, security, monitoring. - Backup consolidation — server/migrations/backup.js honours BACKUP_ENCRYPTION_KEY (AES-256-GCM), BACKUP_DIR, BACKUP_RETENTION_DAYS; server/utils/backup.js fixes for .db.enc listing + cleanup double-delete.

Ecosystem Cleanup (11/11 in-scope recommendations closed): - Brand sweep — "AI-powered" and "unlimited" removed from all customer-facing surfaces (4 glassy-dash files, 4 glassy-www blog posts, 2 blog excerpts, 2 pricing surfaces). - Clear reframe — PricingTeaser reordered (community-first, Docker as a perk); FAQSection self-host rewritten; Agent Connections UI copy updated. - Bootstrap path hardened — server/utils/spaBootstrap.js extracted; refactored server/index.js. 13 new tests (was zero coverage on this CSP-critical path). - adminSettings getter closure + Stripe webhook idempotency — both now have regression tests. - Pagefind scoped to main> across all 54 glassy-www pages. - Stripe POZI account retired (dormant) — 2 test subs cancelled on acct_1RDYEPGV8GF9abap; duplicate products deactivated (prod_USsO1H1NvsB2H1, prod_USsOcvWV0YjEAk); redundant disabled webhook endpoint deleted; stray pozi100 glassy-dash-prod container (running old sk_live_51RD…) stopped; Clear test accounts (id 25, 26) removed from ~/.GLASSYDASH_CLEAR/notes.db via FK cascade. - Resend email verified — glassy.fyi sender verified; live test email delivered (id 6a4a4b74-89ce-4b04-9de7-11e14f762df0); EMAIL_FROM=Glassy <[email protected]>; [email protected]. - Test suite: 800 → 821 pass (+21 self-host gating).

July 5, 2026 — Brand-Asset Harmonization, Blog Imagery & LMS Screenshots

Brand-Asset Harmonization: - Unified lowercase "glassy" brand logo across glassy-www, glassy-learn, glassy-dash. - Unified favicon.svg and PWA icons (pwa-512.png, apple-touch-icon.png). - High-DPI Open Graph banners (og-default.png, og-dashboard.png) regenerated with clean lowercase "glassy" typography on dark aurora backgrounds. - Source committed 2026-07-05 to glassy-www (cfc1a91) and glassy-learn (997480f). Container rebuild followed 2026-07-07 (see above).

Supportive Blog Imagery (glassy-www): Premium frosted-glass screenshot panels inserted into 7 blog articles: - The inbox-zero approach to knowledge management (Today view / dashboard) - Glassy for students: lecture capture to exam prep (Voice Studio) - The research capture loop: save, index, query, cite (Knowledge Base) - MCP server showdown: Glassy vs Obsidian vs Notion (Notes Grid) - Obsidian in the browser (Synced Docs View) - Your notes are not training data (Local AI Assistant) - Sensory-friendly UIs (Theme presets)

LMS Screenshots (glassy-learn): Refreshed in getting-started and capture lessons to show the correct dashboard views, note card libraries, and settings options.

July 4, 2026 — Code-Review-Driven Cleanup (11 recommendations closed)

All 11 in-scope recommendations from the June 13 evaluation stabilization plan closed: 1. Brand sweep closed (AI-powered + unlimited removed). 2. Clear reframe in glassy-dash landing + Agent Connections UI. 3. spaBootstrap.js extracted with 13 new tests. 4. adminSettings getter closure locked with 2 regression tests. 5. Stripe webhook stripe_customer_id idempotency locked with 1 regression test. 6. Pagefind scoped to main> across all 54 glassy-www pages. 7. Bootstrap path integration tested. 8. MCP server module tests fixed (5 of 14 timeouts resolved). 9. Pre-deploy migration validator caught missing name export on migration 0083. 10. CJS→ESM conversion completed for the 5 tool modules (.mjs). 11. Real production runtime bug (top-level await in CJS) caught during live deploy and fixed with async IIFE.

Server test suite: 757 → 800 pass.

June 29, 2026 — Beta finalization: self-hosting, GHCR, download page

Dashboard v2.34.2 (unreleased) — Beta Finalization & Distribution: - GHCR image publishing — Docker images published to ghcr.io/0reliance/glassy-dash:<tag> on git tag push. Compose files now default to the GHCR image. - Self-hosted Docker recipe — one-command docker compose for self-hosters with live Obsidian sync, Ollama, and localhost integrations. Includes DEPLOYMENT_LOCALITY=local, APP_URL, ENABLE_MCP_SERVER, and OBSIDIAN_HOST_OVERRIDE. - #/download page — user-facing page with three install paths: PWA, Companion extension, and self-hosted Docker. - Deployment locality signal — DEPLOYMENT_LOCALITY env var (cloud|local) exposed to the client. Obsidian settings show a cloud-limitation banner when running on cloud, with a link to #/download. - Obsidian settings visible on all instances — the Obsidian section is no longer hidden on SaaS; instead, a banner explains the localhost limitation. Reverses the June 28 "hidden on SaaS" entry. - MCP enabled in self-host — ENABLE_MCP_SERVER=true in self-host compose; VITE_ENABLE_MCP_SERVER build arg added to Dockerfile and GHCR workflow. - Optional env vars documented — GEMINI_API_KEY, RESEND_API_KEY, EMAIL_FROM, OLLAMA_BASE_URL documented in self-host guide. - Release strategy ADR — single branch, tag-based releases, deferred branching. See docs/decisions/2026-06-29-release-strategy.md. - CI fix: buildx driver — docker/setup-buildx-action changed to driver: docker so the locally-built glassy-deps image is visible to the build-push step. - Repo + GHCR private during beta — both the GitHub repo and the GHCR Docker image are private until final release. Self-hosters need GitHub access + docker login ghcr.io. All quick start snippets updated with the login step and a beta privacy notice.

June 28, 2026 — Agent Gateway, security hardening, settings panel review

Dashboard v2.34.2 (unreleased) — Agent Gateway + Security + Settings: - Agent Gateway — dispatch tasks to AI agent frameworks (OpenClaw, Hermes, Antigravity) from a central workspace. Pluggable adapter system with status cards, dispatch panel, activity feed, and MCP config snippets. SSRF-protected, user-scoped (migration 0086), feature-flagged. 62 tests. - Infrastructure security audit — SSH hardening (no root, no password auth), fail2ban, UFW firewall, npm audit fix (41→18 vulnerabilities, 0 critical/high), apt upgrades on both production hosts. - Hosted security hardening — user isolation for agent_connections (user_id scoping), async execFile, feature-flag defence-in-depth guard, Hermes CLI argument injection guard. - SaaS/self-hosted settings consistency — local-only agent frameworks hidden on SaaS, Ollama local option hidden on SaaS, music section language made deployment-agnostic. (Note: Obsidian section was hidden on SaaS on June 28, then reversed on June 29 — see above.) - Settings panel review pass — 15 fixes: YouTube embed autoplay/playlist/thumbnail, pagehide keepalive flush, SectionShell light-mode footer, YouTubeInput debounce, accessibility (role=switch + aria-checked), stale backgrounds cleanup, announcements toggle moved, parseStartTime ?start= support, MusicSettings dead code removed. - React + TanStack audit — 14 fixes across 9 files. - npm audit fix — resolved vitest (critical), vite (high), ws (high), undici (high), uuid (moderate). 750 server tests pass.

June 25, 2026 — Account switch refactor & auth cache

Dashboard v2.34.2 — Account Switching Optimization: - Auth middleware caching — in-process short-TTL caches for user (15s) and account/primary (30s) lookups with hoisted prepared statements. Invalidation helpers wired into all write paths. - Account switch — memoized sorted accounts, explicit SSE teardown, theme_config in GET /accounts.

June 22, 2026 — Cloud AI audit & local embeddings

Dashboard v2.34.0 — Cloud AI Audit & Local Embeddings: - Gemini model catalog audited — migrated image generation off Imagen (shut down 2026-06-24) to Gemini native image gen. Corrected invalid model IDs. Default text model: gemini-3.5-flash. - Local embeddings wired — on-device Related Notes and Smart Tag Suggestions via 384-dim IndexedDB vector cache. Cloud fallback remains 768-dim Gemini.

June 13, 2026 — MCP SDK Upgrade & S2 Hardening, companion v2.11.0

Dashboard v2.33.0 — MCP SDK Upgrade & S2 Hardening: - Real MCP SDK integration — replaced hand-rolled JSON-RPC endpoint with the official @modelcontextprotocol/sdk v2. New server/mcp/index.js uses McpServer + NodeStreamableHTTPServerTransport (stateless) + createMcpExpressApp (DNS rebinding protection). All tools now use server.registerTool() with zod v4 schemas. - glassy_obsidian_proxy tool — transparent proxy to your Obsidian Local REST API's /mcp/ endpoint. SSRF-protected, TLS fallback, Docker host override. - 3 MCP prompts — glassy_summarize, glassy_capture_prompt, glassy_daily_brief. - 3 dynamic resources — glassy://kb/search/{query}, glassy://recent/{sourceType}, glassy://status. - completable() argument hints on enum fields across tools. - Tier-based KB rate limiting — free 30/hr, Pro 300/hr, via kbTierLimiter middleware.

Companion extension v2.11.0 — Store Readiness & Reliability Hardening: - Firefox CSP — content_security_policy added to manifest.firefox.json (required for AMO submission). - Storage quota monitoring — STORAGE_QUOTA_ALARM 6-hourly check; warns at 80%, auto-trims offline queue at 95% critical. - Bundle size optimization — vite.config.js uses manualChunks to split vendor libraries and UI components. - MCP bridge config snippets — Settings → Integrations shows copy-pasteable config snippets for Claude Desktop, Cursor, Windsurf, OpenCode, Hermes, Openclaw, Pi, and any MCP-compatible client with the live server URL. - Manifest version sync — both manifest.json and manifest.firefox.json bumped to 2.11.0 to match package.json. A check-version-sync.mjs prebuild guard is being added to prevent recurrence.

June 12, 2026 — Second Brain P1–P3, companion v2.10.0

Dashboard v2.32.0 — Second Brain P1–P3: - MCP Key Settings UI — Settings → Integrations panel for generating, displaying, copying, and regenerating MCP API keys. Shows config snippets for Claude Desktop, Cursor, Windsurf, OpenCode, Hermes, Openclaw, Pi, and other MCP-compatible clients. Lists all available MCP tools. Gated behind ENABLE_MCP_SERVER. - 4 additional MCP tools — glassy_add_capture, glassy_get_recent, glassy_obsidian_query, glassy_note_create. - Second Brain feature flags — ENABLE_MCP_SERVER, ENABLE_CORPUS_INDEXER, ENABLE_KB_QUERY, ENABLE_KB_UI, ENABLE_HYBRID_SEARCH, ENABLE_MCP_BRIDGE, ENABLE_OBSIDIAN_MCP_PROXY. All default to false.

Companion extension v2.10.0 — Knowledge Base Search: - KB tab and search view — new "KB 🧠" tab in the popup for searching the Glassy Knowledge Base (bookmarks, notes, vault files). Debounced search, source filter tabs, corpus status banner, result items with source badges and relevance scores.

June 11, 2026 — Free Tier Navigation Fix

Dashboard v2.31.0 — Sidebar Navigation Gating: - Recording and Keep nav items are now hidden from the sidebar when the user lacks the corresponding entitlement. A new Store card directs free users to the marketplace. - The Upgrade card is hidden when the Store card is shown to avoid two competing monetization CTAs.

June 9, 2026 — Structured capture reception, type-aware reader & companion v2.9.0

Dashboard v2.29.0 — Structured Capture Reception & Type-Aware Reader: - structured_data column (migration 0081) — SQLite TEXT column on bookmarks stores type-specific capture metadata as JSON (max 8 kB). - Video embed in Keep reader — captures of type video with a YouTube videoId render an embedded player (youtube-nocookie.com) instead of prose. - Repo card in Keep reader — captures of type repo render a structured header card (owner/repo, ★ stars, language pill, license, topics tags) above the README prose. - 4 content types consolidated — article, video, repo, bookmark. Old research/product captures display as article/bookmark labels.

Dashboard v2.28.0 — GlassyKeep Immersive Reader: - Full-window two-pane reading experience — rebuilt from a 672 px glass card. Ambient backdrop (OG image fills window), hero image strip, left-rail Table of Contents with IntersectionObserver scrollspy, in-reader text highlights (yellow/green/blue/pink, persisted via highlight API), reading-progress bar. - Keyboard shortcuts: Esc close; +/- font size; j/k scroll; [ toggle rail. - Font-size control (5 steps, 13–21 px). framer-motion animations respect prefers-reduced-motion.

Dashboard v2.27.0 — GlassyKeep Reader Access + Animation Polish: - Reader now accessible via a BookText icon in each bookmark card's action bar. Cards with captured content show icon in amber; without show dimmed teal. Clicking the card body on a captured bookmark also opens the reader directly. - Removed layout-reflow animations from bookmark grid (simple 120ms fade only).

Dashboard v2.26.0 — Sidebar Restructure + Pro Entitlement Gate Fixes: - Sidebar restructured into two sections: Views and Organize. GlassyKeep is now a first-class sidebar destination. - Pro entitlement gate fixes for GlassyKeep access.

Companion v2.9.0 — Structured Capture & Reliable Execution: - Two-button main bar — Save Page and Screenshot. Four first-class content types: article, video, repo, bookmark. - Screenshot via direct SW routing — captureVisibleTab no longer requires a content-script relay. Works on restricted URLs, PDFs, and stale tabs. - Structured capture pipeline — typed structuredData per content type (video: videoId/provider/channel/duration; repo: owner/repo/stars/language/topics; article: abstract/doi/language). Interpreter re-runs on type change. - ensureContentScript() fallback eliminates “Could not establish connection” errors. - Fixed: interpreter-enriched fields silently dropped; screenshot non-functional on restricted pages; Smart Save chips had no effect on scraping behavior.

June 7–8, 2026 — Workspace performance, rich image viewer, capture quality & extension release

Dashboard v2.24.0 — Rich image lightbox: - Zoom + pan image viewer replaces the basic full-screen overlay. Scroll or pinch to zoom toward the cursor (up to 6×), drag to pan when zoomed, double-click to toggle 1×↔2.5×, and use +/−/0 keyboard shortcuts. A live zoom-percent readout and a download button sit in the toolbar. Works for screenshot, element-capture, and image notes.

Dashboard v2.25.0 — Workspace load & switching speed: - ~3 second notes-appear delay eliminated. The app was firing 6 non-critical API requests at startup (documents list, documents trash/archived, voice recordings, voice trash/archived) in parallel with the critical notes list, saturating the browser's HTTP/1.1 connection pool. The /api/documents call alone could take 2.8 s, stalling everything behind it. - Non-critical queries (Documents and Voice subsystems) now defer until the browser main thread goes idle via requestIdleCallback. Data still loads promptly after first paint and is fully available for search, the Trash view, and all other features. - Account switching also benefits — the idle gate resets on each account change so the incoming account's notes list always gets priority over the connection pool.

Companion v2.7.0 — Multi-account capture & frictionless server setup: - Account picker — choose which account a capture is written to directly in the popup. Captures no longer silently land in the wrong profile when you work across multiple accounts. - Pre-login server selection — point the extension at your server (or self-hosted instance) before authenticating, removing the login-logout dance. - Unsavable-URL guard — friendly warning shown for pages that can't be saved (chrome://, localhost, private IP ranges) instead of an opaque error.

Companion v2.8.0 — Screenshot UX & capture quality: - Screenshot → immediate Smart Save — clicking the screenshot button now opens Smart Save with the image pre-loaded instead of storing silently and requiring a second popup open. - SPA / app-page quality gate — the extractor now rejects pages that yield fewer than 200 meaningful characters (navigation-heavy shells, SPA dashboards) and falls back to a clean bookmark, eliminating junk captures. - Decorative image filtering — aria-hidden, role="presentation", and sub-pixel tracking images are now skipped during extraction.

June 1, 2026 — Web capture, reliability & privacy hardening

The Glassy Companion browser extension's full capture pipeline is now live, and this update focuses on making it dependable end to end.

Web capture (Companion 2.5.0): - Save anything from the web — pages, snippets, page elements, and full screenshots flow straight into your knowledge base. Screenshots and element captures now render as proper notes so they read the way you expect. - Screenshots embed your own instance — captured images point at the server you actually use (glassy.fyi or your self-hosted instance), and an image is only saved when you save the capture, so cancelling never leaves stray files. - Nothing gets dropped offline — a failed save while offline is now reliably queued and retried instead of being lost, and the retry queue stays fast even when it's full.

Privacy & reliability (server — Dashboard 2.22.0): - Per-account screenshot storage limits keep shared capture storage fair and prevent any single account from filling it. - Obsidian import is safer and idempotent — re-importing a vault no longer duplicates notes, and malicious archives can no longer exhaust server memory. - Storage usage counting now self-heals after a transient database hiccup.

Companion v2.4.0 — May 30, 2026 — Element picker persistence & URL canonicalization

Companion 2.4.0 only (extension update):

Added: - Element picker state persists across panels — the CSS selector you used to capture a page element is remembered; re-opening the popup pre-selects the same element so you can capture the same section from updated pages without re-clicking. - URL canonicalization — urlUtils.js now normalises captured URLs: tracking parameters (utm_*, fbclid, etc.) are stripped, www. variants are unified, and hash fragments are removed before saving. Deduplication logic benefits from cleaner canonical keys. - Rule Engine: element-pick preset — you can now assign the Element Picker as the default preset for a URL pattern in the Rule Engine (Settings → Rules).

Fixed: - Screenshot capture on Firefox no longer fails silently when the tab is in a reader-mode overlay.

Companion v2.3.2 — May 29, 2026 — Offline queue hardening

Companion 2.3.2 only (extension update):

Fixed: - Queue flush is now O(n) — previously each queued item required a separate storage round-trip; large queues could time out. The flush now processes all items in parallel and commits in a single read-modify-write, so a queue of 50 items flushes as fast as a queue of 1. - No captures lost during a flush — items enqueued while a flush is in progress are now correctly preserved (the apply step re-reads storage at commit time instead of relying on a stale snapshot). - Screenshot uploads retry independently — a failed image upload no longer blocks the queued text capture from syncing.

v2.19.0 — May 11, 2026 — Remove legacy interval→plan shim

Removed: - LEGACY_INTERVAL_TO_PLAN shim — the server no longer accepts a bare interval field on subscription checkout requests. All clients must send plan directly (e.g. pro_monthly, pro_yearly). Sending only interval now returns 400 Invalid or missing subscription plan. No customer migration required — zero active users on the old path.

v2.18.1 — May 10, 2026 — P0 marketing copy pass (landing)

Changed: - Landing page copy overhaul — Hero, Problem, Neurodiversity Highlight, and Pricing Teaser sections refreshed with calm, precise, ND-affirming voice. New H1 "Keep it / Glassy.", capability-led body copy, and a micro-FAQ ("One Pro price · Your data on cancel · Cloud AI is optional"). Pricing SSOT preserved verbatim throughout.

Added: - docs/MARKETING_COPY_PASS_PLAN.md — v1 roadmap covering this P0 pass plus upcoming P1 (AudienceCards / FeatureBentoGrid / TestimonialsSection / LocalAIShowcase / FAQ), P2 (SEO/meta + footer + public/glassy-landing.html), and P3 (Jekyll docs pass).

v2.17.1 — May 10, 2026 — Pricing copy fix

Fixed: - Corrected GlassyKeep / GlassyCalc pricing copy across surfaces — both are bundled into every Pro plan (not sold separately). Any copy describing them as à la carte sidecars has been corrected.

v2.17.0 — May 10, 2026 — Pro entitlement bundle + tier cleanup

Changed: - GlassyKeep and GlassyCalc are now included in all Pro plans — both sidecars are bundled into every Pro tier (monthly, yearly, and lifetime) at no extra cost. Existing separate add-on purchases are honoured; members who paid for either sidecar retain full access and will not be charged again. - pro_quarterly soft-retired — quarterly Pro subscriptions are no longer offered to new signups. All existing quarterly members are grandfathered with no change to their access or billing cycle. - Tier constants consolidated — PRO_INCLUDED_ENTITLEMENTS, CLEAR_TIERS, and PRO_TIERS are now declared as frozen constants in the server, providing a single source of truth for entitlement logic across all tier checks.

Internal: - clear_lifetime scaffolded in the tier registry to support a future Clear lifetime offering. Not publicly listed or sold at this time.

v2.16.1 — May 9, 2026 — Clear instance separation

Added: - Clear instance gating — when Glassy is deployed as a Clear instance (INSTANCE_ID=clear), Pro upsells, marketing surfaces, and Pro-only checkout flows are hidden end-to-end. Clear plans and the GlassyCalc sidecar remain available. The public Glassy instance is unchanged. - Clear self-hosted deploy bundle — production docker-compose and operator README under deploy/clear/ for organizations running their own Clear instance. See Clear self-hosted.

Changed: - Pricing copy reconciled across landing page, in-app help, FAQ, and the AI assistant's knowledge base. Single source of truth: Pro $17/mo or $100/yr · Clear $80/mo or $300/yr · AI top-up packs $10 / $20 / $50 (100k / 200k / 500k credits, never expire). Cloud AI continues to be described as a generous monthly allotment. - Pro Lifetime is fully retired for new signups; existing Pro Lifetime members remain grandfathered forever. The GlassyCalc sidecar was available as a one-time add-on for Pro users. (Superseded: GlassyCalc is bundled into all Pro plans from v2.17.0.)

v2.16.0 — May 8, 2026 — Public Window goes Pro + Settings v2

Changed: - Public Window publishing now requires Glassy Pro. Free accounts can still view Public Windows, but claiming a slug, editing the bio/tagline/social links/banner/theme/layout/accent color now requires a Pro subscription. The Account HUD Window button still works — non-Pro users see a glassy upsell card on the Public Window page and in profile settings. - Settings panel refactor — the unified Settings UI is now built from modular sections with lazy loading and per-section dirty tracking. Behavior is preserved; the structure is now extensible so new settings can ship without bloating the panel. - Deploy hardening — the production deploy pipeline gained a concurrent-deploy lock, a fast-fail check when local main is behind origin/main, a heartbeat indicator during long builds, and an automatic build log captured to /tmp/glassy-dash-deploy-<sha>.log.

Security: - Server-side enforcement of the Public Window tier gate — the profile API now rejects writes to Public Window fields (slug, bio, tagline, social_links, public_theme, public_layout, accent_color, banner_url) from non-paid accounts with 403 PUBLIC_SHARE_NOT_ALLOWED. display_name, avatar_url, and Obsidian settings remain writable for free accounts.

Fixed: - Account HUD — Archive now opens the real notes archive view, outside-clicks reliably close the panel, and short browser viewports no longer cause the HUD to overflow above the screen. - Extension page — the authenticated #/extension route now renders inside the workspace shell (matching #/store); release links point at the published Glassy Companion v2.2.2 packages.

v2.15.2 — May 7, 2026

Added: - Instance-wide private mode — self-hosted deployments can set Admin → Instance Access to Private, hiding the entire site from logged-out visitors with deep-link stashing and post-login resume.

Fixed: - Global search now crosses all sub-accounts — results from every workspace surface in one overlay, each tagged with an account pill badge. - Account HUD: archive action now opens the real notes archive view, outside clicks reliably close the panel, and the panel scrolls internally on short screens instead of overflowing. - Authenticated #/extension route now renders inside the workspace shell (like #/store) for logged-in users.

Companion: - Glassy Companion v2.2.2 — JWT token now persists in chrome.storage.local so users stay signed in across browser restarts.

v2.15.1 — May 6, 2026

Fixed / verified: - Global page-glass controls and ephemeral per-page glass previews are live in production. - App release metadata is aligned across GitHub, the repository, the live production container, and public health output. - Production is verified at commit 9672b3eccc3c51bebfca3a4869b36615d93ca84a, with v2.15.1 marked as the latest GitHub release. - Glassy Companion v2.2.1 is published with both Chrome .zip and Firefox .xpi packages.

v2.15.0 — May 6, 2026 — Pricing Relaunch

Changed: - Glassy Pro is now $17/month or $100/year. - Glassy Clear is now available at $80/month or $300/year, bundling every current and future sidecar/theme add-on. - Lifetime is retired for new purchases; existing lifetime members remain grandfathered. - Paid users can extend cloud AI usage with $10 / $20 / $50 top-up packs that never expire. - Public pricing and AI copy now describe a generous included monthly cloud AI allotment instead of exposing the internal cap amount.

v2.14.5 — May 5, 2026

Fixed: - Outbound network calls now fail fast across AI providers, icon/RSS lookups, music proxy paths, and Obsidian integration requests, reducing idle timeout noise and hung upstream sockets. - Local AI downloads and format-polish flows are more reliable: WebLLM downloads use a dedicated cancellation worker, stale cancel state is cleared before downloads, JSON schema response formats are passed correctly, and rich-text block boundaries are preserved when generating plain-text formatting plans. - Session and account switching are safer: sliding auth refreshes use atomic expiry guards, account unlock token rotation is transactional, and AI/embedding/HUD state is reset during account switches. - Production-only React regressions were cleaned up, including the EmojiSuggestion require() crash and a tag-filter feedback loop that could trigger React error #185. - Search snippets now highlight every match, and delete confirmations clarify the 30-day auto-purge window.

Companion: - Glassy Companion v2.2.1 is the current extension line, adding Firefox packaging from v2.2.0 plus a 429 retry fix that honors Retry-After headers.

v2.14.4 — May 3, 2026

Added: - AI Assistant workspace context broker — /api/ai/ask and /api/ai/ask-stream now search notes, documents, voice transcripts, bookmarks, and help articles in the active account scope and return citation-ready context. - Obsidian Docker host bridge — containerized server can now reach the host's Obsidian Local REST API via host.docker.internal while users continue entering https://127.0.0.1:27124.

Fixed: - Obsidian search now uses the correct POST /search/simple/?query=... endpoint. - Obsidian setting now defaults to HTTPS (https://127.0.0.1:27124). - NoteCard delete confirmation no longer renders behind the card backdrop — portaled to document.body so the dim layer covers the viewport. - Account switch is faster: account-scoped query keys (including unified tags) are namespaced by active account, so switch-back uses isolated cache buckets without cross-account bleed.

v2.14.3 — May 2, 2026

Fixed: - Service Worker bad-precaching-response loops resolved — large media directories (backgrounds/**, note-backgrounds/**, avatars/**, uploads/**, images/**, guide-assets/**, wasm/**) are no longer baked into the precache manifest, eliminating the post-deploy reload-and-wipe loop. Matching NetworkFirst runtime caching keeps these assets available offline.

Added: - scripts/disable-2fa.js admin recovery script for locked-out 2FA users (referenced by the troubleshooting doc; the file is now actually present).

Docs: - Troubleshooting doc accuracy fixes: real 2FA column names (totp_enabled / totp_secret / totp_recovery_codes), real uploads path derivation, real per-tier file size limits, corrected WAL checkpoint snippet.

v2.14.2 — April 29, 2026

Improvements: - Streak meter fully rewritten — client-timezone bucketing, 90-day tracking window, edit-only days now count toward your streak, shield peek bug fixed - Note bottom toolbar polish (transparency promotion, cleaner button states) - ExtensionView scroll area fixed

v2.14.1 — April 28, 2026

Bug Fixes: - AI providers no longer crash on tool-augmented prompts (Anthropic and Ollama providers fixed) - Two flaky tests stabilised - ESLint brought to 0 errors (warnings only) - npm audit: 5 → 3 moderate vulnerabilities

v2.14.0 — April 28, 2026 — Tier Restructure

Changes: - Voice Studio is now Pro+ only — Free accounts are redirected to the store when accessing voice features - Storage caps introduced — Free: 10 MB total / 2 MB per file; Pro & Lifetime: 200 MB / 25 MB per file - Free accounts cannot create new public shares — existing public shares remain accessible - À la carte sidecars — GlassyKeep, GlassyCalc, and theme packs are now individually purchasable by Pro users; Lifetime includes all sidecars bundled - Inactivity sweeper — Free accounts inactive for 90+ days with under 1 MB of data enter a 30-day recovery window, after which data is permanently deleted. Pro and Lifetime are exempt - Lifetime subscription now clearly offers 3 years of included cloud AI, then unlimited local AI forever

v2.13.1 — April 26, 2026 — Security Hardening

Security Fixes: - Google OAuth sign-in fully restored (async DB calls were silently broken) - 2FA TOTP enrollment and recovery code regeneration now correctly persisted - AI tool responses (NAVIGATE, OPEN_NOTE, OPEN_HELP) validated against allowlists before executing - Streaming AI calls now properly abort at the provider when the browser tab closes, stopping billing - In-flight API requests now abort during account switch, preventing cross-account data writes - Cross-tab account switching detection — switching in one tab now updates other tabs automatically - Migration 0076: historical negative AI credit balances clamped to 0; future negative writes blocked

v2.13.0 — April 26, 2026

New Features: - Chrome Prompt API (Tier-0 Local AI) — Uses Gemini Nano built into Chrome for zero-download local AI; automatically preferred when no WebLLM model is loaded - Account reordering — drag and drop accounts into your preferred order - Per-account custom backgrounds — upload your own background image for each account - Live theme preview in appearance settings - PIN prompt modal — clicking a locked account now opens a modal instead of showing a toast

Bug Fixes: - AI BubbleMenu now shows a loading toast during generation (no more silent 10-second waits) - Drawing canvas v2: coordinates no longer distort on window resize, theme-default color swaps correctly on dark/light toggle, recent colors persisted across sessions - Account switch latency reduced from ~3s to ~1s

v2.12.2 — April 25, 2026

Bug Fixes: - Drawing notes now open in draw mode by default (previously required an extra click) - Mode toggle button labels corrected — shows current state (Drawing/Viewing) not the action - Per-account theme no longer dropped on rapid account switching

v2.12.1 — April 24, 2026

New Features: - Per-page glass override system — Override glassmorphism settings for individual pages without changing your global theme

Bug Fixes: - Various note background and rendering polish

v2.12.0 — April 23, 2026 — AI Access Overhaul

New Features: - Cloud AI now metered by cost, not credits — Pro users get up to $2/month of Gemini 2.5 Flash usage included - AI Usage Meter — Spending progress bar in Settings → Billing and the Platform Store - Z.AI removed — Fully replaced by Gemini 2.5 Flash as the cloud provider - Pricing rebalanced — Pro monthly: $8.99 → $7. Quarterly: $19.99, Annual: $68.99, Lifetime: $189.99

v2.11.1 — April 22, 2026

Bug Fixes: - Glassy Companion extension: SAVE_PAGE now works on SPAs, auth-gated pages, and Cloudflare-protected sites - Landing page footer links fixed - In-page anchor scroll on cross-page navigation fixed

v2.11.0 — April 21, 2026

New Features: - Account reordering — Drag and drop your accounts into any order - Per-account custom backgrounds — Each account can have its own background image - PIN prompt modal — Locked accounts show a PIN entry modal rather than a toast - Hourly unlock-token cleanup — Expired account unlock tokens are now cleaned up automatically

Security: - Rate limiters on account unlock/lock/link-verify endpoints - inactivity_timeout validated server-side (60–86400 s)

v2.10.6 — April 21, 2026

Bug Fixes: - Today page streak, reminder reconciliation, and UUID handling hardened - AI Morning Briefing citations now resolve correctly - Streak shield no longer shows a false-positive badge for inactive users

v2.10.5 — April 21, 2026

New Features: - Writers landing page (#/writers) — dedicated feature overview for writers - Students/Researchers landing page (#/students) — dedicated feature overview for students

Bug Fixes: - Trust proxy configuration fixed — real client IPs now used for rate limiting - i18n packages removed (unused; ~80KB bundle savings) - Extension API CORS hardening

v2.10.4 — April 21, 2026

Bug Fixes: - GlassyKeep share-to-public 500 error fixed (missing is_public column restored by migration 0070)

v2.10.3 — April 20, 2026

New Features: - Today page summary with migration safety for last_login_at - Version history async/await fix (resolves "fire-and-forget" bug) - SSE reliability improvements with Alt-Svc header

Improvements: - AI engine transition from json_object to json_schema for Gemini and OpenAI - glassySchema.js now source of truth for AI tool definitions - Gemma2 support for local/Ollama path

Security: - SSRF protection for Obsidian integration - JWT enforcement with algorithm pinning

v2.9.13 — April 14, 2026

New Features: - Account HUD (glassmorphic slide-up panel) - Document Icon Picker (emoji/Lucide icons) - TOTP Two-Factor Authentication - Web Push Notifications

Improvements: - 13 new slash commands - 4 callout block types (info/warning/success/error) - Progressive rendering / virtual scroll

v2.9.0 — March 2026

New Features: - Obsidian Vault Integration (full launch) - BYOK providers (OpenAI, Anthropic, Ollama, Perplexity, Groq) - Collaboration permissions model

Older Versions

For full changelog history, see the CHANGELOG.md on GitHub.

Filing Issues

Found a bug? Please report it on our GitHub Issues page with: - Version number - Steps to reproduce - Expected vs actual behavior - Browser and OS information