Changelog

UI & User Experience

• Button Cursor Restoration: Added a global CSS rule to restore the standard pointer cursor to all button elements and Radix primitives (like Tabs), overriding Tailwind v4 defaults.
• Notification Settings: Refactored notification settings into a unified, select-based interface for managing both app and email preferences.
• Component Streamlining: Streamlined UI components and integrated simple-icons for cleaner SVG rendering across the app.

Security & Infrastructure

• Dependency Security Updates: Updated mermaid to 10.9.6 and applied dependency overrides for critical uuid security patches.
• SDK Hardening: Sanitized file system access in the SDK to improve build stability and overall platform compatibility.

Authentication & Email Confirmation

• Dedicated Confirmation Success State: Added a dedicated email confirmation success state and updated auth routing behavior in GlobalScene for clearer post-confirmation UX.
• Confirmation Link TTL Guard: Enforced confirmation link expiration validation in auth actions to prevent stale link acceptance.
• Rate-Limited Resend Flow: Added resend throttling and cooldown safeguards in auth flows to reduce abuse and improve delivery reliability.

Onboarding & Profile Completion

• Profile Completion Flow: Added a new complete-profile onboarding route with a dedicated profile completion form.
• Onboarding Completion Tracking: Introduced backend/profile tracking for onboarding completion, including schema support for onboarding_completed_at.
• Auth Journey Integration: Connected login and auth transitions to the new onboarding completion flow for first-time users.

Product Positioning & Marketing

• Value Proposition Realignment: Updated product messaging to better emphasize faster developer onboarding and streamlined secret management.
• Design Partner Program Refresh: Refined design partner documentation and supporting UI content to align with the updated product narrative.

Security & Encryption Documentation

• Encryption Model Clarification: Revised client-side encryption messaging and removed misleading zero-knowledge claims for clearer security expectations.
• Hybrid Agent Control and Auditability: Expanded security documentation to better explain user control boundaries, approval flow guarantees, and auditability in the hybrid model.

SDK Release Stream

• SDK Progression: Included SDK release stream updates through sdk-v1.9.0.

UI & Layout

• Authenticated Shell Layout: Implemented `AuthenticatedShell` layout and dedicated loading states across admin and dashboard pages to prevent UI flashes.
• Email Design Standardization: Standardized the email logo architecture, setting a new single permanent logo and ensuring a flush banner layout that perfectly fits all email clients.
• Font Rendering: Updated global font rendering settings for cleaner typography.

Refactors & Architecture

• React State & Auth Logic: Optimized React state initialization and consolidated authentication logic, streamlining email template redirect flows for a smoother user experience.

Infrastructure

• Email Provider Migration (Resend -> Brevo): Replaced the resend SDK with a native fetch-based wrapper using the Brevo SMTP API. Updated all 17 email functions and removed the resend package.
• Multi-Sender Test Script: Added --all flag to send-test-email.ts and a test:email:all npm script to test all configured sender domains at once.

Contact & Branding

• Unified Contact Email: Updated all public-facing contact links (legal pages, footer, support modal, SECURITY.md, feedback script) to [email protected].
• Pre-Filled mailto: Templates: Contact links now open the user's mail client with a context-specific pre-filled subject and body.

Features & SEO

• Marketing Pages & SEO: Added new features page, comparison routes, and updated SEO sitemap while cleaning up project documentation.

UI & Animations

• Project Card Animations: Integrated Framer Motion for smooth project card entry animations.
• UI Design Docs: Added UI design documentation for interfaces.

Integrations & Skills

• Envault Agent Skill: Added official Envault Agent Skill documentation and configuration files.
• MCP Registry Publishing: Added duplicate version check before publishing to MCP Registry.

Documentation

• Brevo Migration Docs: Updated configuration.mdx, initial-setup.mdx, production-deployment.mdx, and environment-variables.mdx to reflect the Resend -> Brevo migration and new BREVO_API_KEY variable.
• License Scope: Added a Section 6 to LICENSE.txt clarifying that mcp-server/ and src/lib/sdk/ are distributed under the MIT License.
• Changelog Structure: Restructured changelog categories for better readability.

Vercel Native Integration and Zero-Knowledge Token Flow

• Zero-Knowledge Token Delivery: Implemented token exchange and delivery refinements for Vercel integration with stronger secret-handling boundaries.
• CORS Validation Hardening: Added stricter CORS checks and integration route protections across Vercel status, sync, callback, token, and webhook flows.
• Environment Mapping UX: Improved Vercel project linking and environment mapping behavior in both backend routes and dashboard integration controls.

MCP Registry, HITL Security, and Operational Reliability

• Official MCP Registry Publishing: Added automated MCP Registry publication workflow with server.json metadata and GitHub Actions OIDC login flow.
• HITL Enforcement for Standalone Mutations: Routed standalone MCP mutation paths through the HITL SDK pipeline for non-bypassable approval semantics.
• MCP Runtime Stability: Improved MCP module path resolution and release pipeline test signaling; added a macOS-safe HITL verification script for staging checks.
• MCP Security Docs Expansion: Expanded MCP server security and contributor documentation to clarify HITL behavior, auth expectations, and release workflows.

Licensing and Documentation Alignment

• License Scope Clarification: Updated repository license scope and exceptions, explicitly carving out mcp-server/ and src/lib/sdk/ paths.
• Deployment and CI/CD Guidance: Refined internal and platform docs for Vercel-native sync, CI runtime wrapper usage, and MCP operational guidance.

Build and Release Stream Updates

• Build Script Reliability: Reverted app build execution path to native next build for more predictable Vercel deployment behavior.
• SDK/MCP Stream Progression: Included coordinated SDK and MCP package stream bumps (sdk-v1.6.0 -> sdk-v1.7.0, mcp-v1.10.0 -> mcp-v1.12.0) with matching release automation updates.

Service Tokens, Decryption & Email Templates

• Service Token Management: Enhanced CI/CD integration and comprehensive pipeline token access.
• Client-Side Decryption: Refactored secret handling to transition towards secure client-side AES-GCM decryption.
• Email Customization: Added dark and light mode logo support to email templates, dynamically utilizing EMAIL_PUBLIC_APP_URL.

Ecosystem & Developer Tooling

• Envault CLI (v1.36.1): Fixed decryption fallbacks allowing legacy plaintext structure usage explicitly; enhanced notification suppression logic.
• Envault SDK (v1.5.0): Ecosystem bump reflecting backend architectural enhancements and CI integrations.

User Flows & Local Provisioning

• Email Validation Links: Substantially improved user flows handling invalid or expired confirmation links.
• Local Dev vs Prod Build Setup: Enhanced configuration for cleaner, secure secret provisioning locally.

Theme Toggle Stability

• Added animated theme toggle transition flow with lifecycle hardening, keypress locking, and safer cleanup timing.
• Introduced capability-gated browser handling with fallback paths for Safari, DuckDuckGo, and Edge to prevent rebound/flicker artifacts.

UI and Platform Updates

• Added global shortcut provider and landing interaction refinements, including transition/animation tuning.
• Expanded dashboard/auth surface work and refreshed Open Graph + favicon/PWA assets.

Branding, Typography and Governance

• Refined font handling with new layout/tailwind font variables for more consistent typography behavior across surfaces.
• Updated licensing terms and supporting documentation to align legal/policy messaging across the project.

Open Graph and Metadata Reliability

• Static Open Graph Coverage: Added static Open Graph assets across route pages to reduce runtime dependency on dynamic OG generation.
• Platform Compatibility Improvement: Updated Open Graph metadata references from .svg to .png across marketing, dashboard, auth, docs, and global layouts for broader crawler/client compatibility.

CLI UX and Developer Tooling

• Animated CLI Loaders: Added branded, consistent animated loaders across key CLI commands (approve, deploy, pull, run, audit, doctor, env, init, mcp, sdk) with proper stop/cleanup behavior on error paths.
• Loader Preview Command: Added hidden __loader-preview command for visual QA and loader theme validation.
• Command Robustness: Refined command utility behavior to improve loader lifecycle handling and error propagation.

Skills and Documentation System

• View Transitions Skill Pack: Added a complete Vercel React View Transitions skill package with implementation guidance, CSS recipes, Next.js integration notes, and supporting metadata/references.
• Skill Dependency Locking: Added skills lock tracking to keep agent skill dependencies consistent.

Release Stream Updates

• SDK Stream: Published sdk-v1.3.0 release stream updates tied to the new view transitions skill artifacts.
• CLI Stream: Published v1.33.0 CLI release stream updates including loader and related enhancements.

MCP Security, Lifecycle & Agent Reliability

• MCP Token Lifecycle Management: Added full MCP token lifecycle support with creation, regeneration, revocation, expiration handling, and lifecycle notifications.
• Automated Token Cleanup: Added cron-backed cleanup flow for expired MCP tokens, including supporting security logic and lifecycle test coverage.
• Standalone MCP Mode: Enhanced MCP server behavior with standalone mode support for broader integration scenarios.
• Context Retrieval Expansion: Added new context retrieval tooling for improved MCP agent workflows and runtime introspection.
• Cross-Platform MCP Setup Stability: Improved platform-specific command handling and MCP config/postinstall behavior for more reliable installation and execution across environments.

Secrets API, Error Handling & Configuration

• Secrets Sync Controls: Added pruneMissing support in secrets management paths to improve state reconciliation behavior.
• Environment Base URL Support: Added ENVAULT_BASE_URL support across relevant MCP and API integration paths.
• Auth/Error UX Improvements: Improved API error handling with clearer authentication hints, especially for 401 scenarios during setup and agent-driven operations.

Documentation & Platform Clarity

• Comprehensive Docs Expansion: Added and expanded documentation for accessibility, notifications, projects/environments, security, and system status.
• SDK + MCP Workflow Guidance: Enhanced setup and operational guidance for SDK/MCP agent workflows with clearer structure and execution paths.
• Platform Information Architecture: Improved docs organization and navigability across core, configuration, and platform-focused documentation surfaces.

MCP Distribution, Auth Continuity, and Release Reliability

• MCP Lifecycle Management: Added dedicated MCP integration management commands and improved the command surface for more predictable local setup and day-to-day usage.
• MCP Packaging Stability: Fixed MCP publish contents to reliably include postinstall.mjs, closing installation regressions across npm flows.
• SDK Packaging Hardening: Fixed SDK package layout and imports for package-local typecheck/build paths, and ensured postinstall assets are included in published artifacts.
• Auth Continuity UX: Improved sign-in continuity by remembering the last auth provider and hydrating user state earlier in the flow.
• Platform Messaging: Updated landing and docs surfaces to better present the SDK + MCP platform story and AI safety/GUI integration guidance.

Release & CI Improvements

• Provenance-Ready Publishing: Added required repository metadata for npm provenance and aligned release streams for app, SDK, and MCP.
• Pipeline Isolation: Split semantic-release configurations by target stream and tightened CI authentication (including OIDC-only npm publishing for SDK/MCP).
• Post-Release Validation: Added package smoke verification after publish to catch artifact/runtime issues earlier.
• Build/Repo Hygiene: Migrated Tailwind config to mjs, removed obsolete MCP config files, and refined ignore rules for local editor artifacts and secret-safe workflows.

SDK, MCP, and Agent Workflow Foundation

• Added first-class TypeScript SDK package (@dinanathdash/envault-sdk) with delegated agent token flow, compatibility checks, and HITL polling execution support.
• Added standalone MCP server package (@dinanathdash/envault-mcp-server) with direct Envault tools for status, pull/push, approvals, and local key edits.
• Added inline terminal approval command envault approve <approval_id> for machine-agent workflows.
• Introduced SDK/MCP backend routes for delegate auth, pending approvals, approval status polling, and SDK version compatibility.
• Added global + project agent access kill switches and dedicated audit events for agent approvals/rejections.
• Added independent semantic-release pipelines for SDK and MCP with decoupled tag streams (sdk-v*, mcp-v*).
• Expanded docs and legal pages to cover SDK/MCP setup, security model, and policy implications.

Navigation, UX & Accessibility

• Account and Header Navigation: Added direct Dashboard and Notifications access from the account menu, and aligned header navigation behavior across dashboard and system-status surfaces.
• Interaction Reliability: Fixed notification tooltip reopen edge cases and refined keyboard shortcut behavior to suppress global hotkeys while users are typing in input/contenteditable fields.
• Secrets UI Consistency: Standardized add-variable dialog naming/structure and improved masked secret rendering consistency across variable views.
• Accessibility and Input Experience: Added global haptics feedback with persistent opt-out controls, and cleaned up keyboard hint visuals/content across docs and UI surfaces.

Runtime Stability, Security & Account Lifecycle

• View Transition Guard Hardening: Improved transition handling for hidden tabs, callback timeouts, development-mode behavior, and unsupported browsers by introducing safer no-op/fallback execution paths.
• Auth and Callback Robustness: Tightened OAuth callback handling and related routing behavior for more reliable sign-in flows across environments.
• Account Soft-Delete Lifecycle: Consolidated the 7-day deletion window, revival flow, purge automation, and deletion/revival notification behavior into a more resilient account lifecycle.
• Cron and Endpoint Protection: Enforced cron secret validation (x-cron-secret) for scheduled maintenance endpoints and aligned operational safeguards.
• Dependency Compatibility: Aligned key runtime dependencies (mermaid, three, @types/three) and normalized ASCII-safe output/copy patterns to reduce rendering and terminal compatibility issues.

Docs, Changelog & Developer Experience

• Changelog Rendering Pipeline: Migrated changelog entry body rendering to server-side MDX components to preserve rich MDX content and avoid CSP/runtime eval-related regressions.
• Docs Page Actions: Added Copy Markdown and Open actions to docs pages, backed by a dedicated raw markdown endpoint (/api/docs/markdown).
• Public Docs API Access: Updated proxy allowlist/auth behavior so public docs markdown actions no longer fail with unauthorized responses.
• Docs Content Structure Cleanup: Normalized top-level docs heading structure to avoid duplicate page-level H1 output when frontmatter titles are present.