What’s new in Canv~Us
Every release, security fix, and improvement. Built fast, shipped often.
v3.6.0March 31, 2026
Phase 8 — Canvas Lock, Themed Portals & OFW Domination Pack
15 new co-parenting / family-life node types, tri-state Canvas Lock, 7 portal domain themes, and the ToneGuardian AI tone analyzer. Node count: 169.
- Canvas Lock: tri-state off/soft/hard cycling with localStorage persistence, 4 gesture guards (drag, zoom, spawn, resize blocked in hard mode), HUD button with visual feedback.
- Themed Portals: 7 domain themes (family, business, care, focus, creative, admin, archive) with live picker UI, PORTAL_DOMAIN_THEMES export, portalPreset extended to 7 values.
- OFW Domination Pack: 15 new node types across CoParentingExtNodes.tsx and FamilyLifeNodes.tsx — includes parallel parenting log, custody calendar, exchange tracker, legal vault, family mission board, and more.
- ToneGuardian API route (/api/ai/tone-analyze): scores co-parent message tone (0–100), classifies risk, and generates a kinder rewrite via Gemini 2.0 Flash.
- Gemini API key moved from URL query param to x-goog-api-key header (prevents key leakage in server logs).
- Cron auth hardened: query param secret support removed, timing-safe HMAC comparison replacing direct string equality.
- Calendar IDOR fix: Nylas PUT now verifies event ownership before update; all DELETE soft-deletes scoped to owner_id.
- Error stack traces gated behind NODE_ENV !== production in structuredLogger.
- X-Request-ID correlation header on all API responses for log tracing.
- /api/health endpoint: DB connectivity probe returning 200 ok or 503 error.
- Inbound webhook route now rejects non-JSON/non-form content types with 415 Unsupported Media Type.
- Focus rings inside canvas node cards changed from total suppression to subtle 1px outline (WCAG 2.4.7).
- Skip-to-content link in app layout for keyboard and screen reader navigation (WCAG 2.4.1).
v3.1.1March 24, 2026
Documentation Truth Refresh
141 registered node types, 8 canvas modes, 13 workspace roles, and integration docs aligned to the live runtime.
- README, manuals, product spec, and technical stack updated to the current 141-node registry.
- Role language normalized to 13 household workspace roles plus guest/token access flows and super-admin overlay.
- Integration documentation refreshed for Supabase, Gemini, Stripe, Nylas, Resend, Twilio, QuickBooks, Xero, Web Push, Firebase FCM, and optional PostHog analytics.
- Removed stale Spotify integration claims from current product documentation and replaced them with the live push/notification stack.
v2.9.0March 22, 2026
Release-Readiness Wiring Audit
Backlinks, safety check-in, orchestrator brief, and node_created automation trigger.
- node_created consequence trigger — automation rules now fire when a node is first added to the canvas.
- Bidirectional backlinks in node editor — shows reverse links (←), forward links (→), and implicit text mentions (~).
- Safety check-in wiring — CaretakerEnvironment now surfaces real-time shift snapshot stats.
- Orchestrator brief in Command Horizon — shows top 5 cross-domain priority items above the daily brief.
- SpawnRadialWheel expanded — budget, calendar, goal_tracker, countdown, assistant now spawnable.
- Ghost-monitor GitHub Actions workflow — validates secrets before curl, retries 2×, handles empty responses.
- SpawnRadialWheel phantom project type replaced with valid kanban type.
- /api/integrations/status hardened with auth gate — was previously publicly accessible.
v2.8.0March 21, 2026
Account & Notifications Settings + Full-System QA
Settings pages for account and notifications, plus a comprehensive 13-part IP-sale QA audit.
- Account settings page — edit display name, avatar, view member-since date, send password reset.
- Notifications settings page — toggle email, push, and weekly digest; stored to user_metadata.
- Settings hub wired — Account and Notifications now fully linked (no longer "Coming soon").
- AssistantNode TypeScript AuthResponse mismatch — auth.refreshSession() return type corrected.
- Display settings ESLint set-state-in-effect — replaced effect with lazy useState initializer.
- Display settings silent 403 — non-superadmin users now see a lock icon + amber banner.
v2.7.0March 21, 2026
UX Organisation, Role-Gating & 5-Department Audit
- Display & Themes settings page — color mode, accent, glass blur, dock position, feature flags.
- Settings hub entries for Display & Themes and Advanced Features.
- Tour system improvements — landscape-mobile card anchors correctly; step counter shows N / M.
- Tour steps trimmed from 17 → 6 steps; no tour exceeds 8 steps total.
- Empty-state domain buttons role-gated — Business / Care hidden for child and viewer roles.
- FamilyMemorySurface and ReassuranceFeedSurface missing LayoutGroup.
- architect/config PATCH silent error — now captured in structured logs.
v2.6.0March 21, 2026
10-Persona Audit Sprint: Security, UX, AI, Conversion
The big security hardening release — JWT, prompt injection, UUID validation, and more.
- JWT fallback return true → return false — prevented unauthenticated access to admin and billing routes.
- E2E auth bypass production guard — ?e2eAuthBypass=1 now returns false immediately in production.
- Prompt injection sanitization — transcript sanitized + capped before LLM interpolation.
- UUID validation hardened — Zod schema changed to z.string().uuid() across 47+ validators.
- Centralized Gemini key resolver — lib/server/geminiKey.ts applied to all 6 AI routes.
- Injection detection strengthened — Unicode normalization + 4 new adversarial patterns.
- Settings hub — 7-section settings page with account, notifications, billing, integrations, privacy.
- Pricing page — 3 plans (Starter free, Family $24 CAD/mo, Business $49 CAD/mo).
- About page — mission, value pillars, stats, CTAs.
- Email capture / waitlist — EmailCaptureSection on landing, /api/waitlist endpoint.
- schema.org JSON-LD SoftwareApplication structured data for rich search results.
- AnimatePresence key props — 5 canvas panels fixed to prevent DOM node reuse.
- Touch targets ≥ 44px — 8 canvas panels updated for WCAG 2.5.5 compliance.
- Text contrast — body/label text raised from text-white/20–35 to text-white/50–60.
v1.5.0March 19, 2026
v1.5 Release — Gesture & Physics Hardening, Gold Master
141/141 node types, 14 roles, all 8 canvas views, AI prompts fully covered.
- 141 node types — 100% theme and prompt coverage across all categories.
- 14 roles — admin, partner, teen, child, caregiver, guest, business_owner, and more.
- 8 canvas views — Motion canvas, Bento grid, Kanban, Fridge mode, and more.
- Real-time multiplayer — live cursors, presence, conflict-free sync via Supabase Realtime.
- Ghost Monitor escalation — 4-tier escalation ladder (in-app → notification → email → SMS).
- Morning Digest automation — daily AI briefing via SMS + in-app notification.
- Inertia FRICTION upgraded: 0.966 → 0.975 (touch), 0.920 → 0.935 (mouse); STOP_VEL 0.15 → 0.05.
- SpatialGrid culling — O(n) viewport intersection replaces O(n²) bounds scan.
- Node overflow — VideoPlayerNode, FamilyOS labels, and BusinessOS fields all truncate correctly.
Canv~Us ships weekly. More on the roadmap →