Changelog

What’s new

Material changes to the StratHub platform, most recent first. Security advisories at security@strathub.ai.

Extension health monitor + full-codebase bug sweep

v8.3.0·
  • New real-time extension health monitor: heartbeat-based failure detection (connection lost, capture script blocked), red toolbar badge, and OS notifications — surfaced without opening the popup.
  • Fixed strategy export dropping blocks-format trigger count/unit (exported "On Every 1 Losses" instead of the real "8 Wins").
  • Security: exact-match CORS origin allow-list, session-id path-traversal sanitizer, removed a client-bundled API token and an unauthenticated key/env info leak.
  • Extension repairs: unreachable screenshot/game-result handlers, cloud sync restoring only 4 of 10 games, mines-picker double-count, and a dead duplicate service worker.
  • Platform fixes: dual-format strategy import/export, an import date-parsing precedence bug, and a scorecard divide-by-zero.
  • Added the missing extension bridge handlers for settings and balance.

Enterprise hardening + brand refresh

v8.2.0·
  • Enterprise security pass: HTTP security headers (CSP, HSTS, X-Frame-Options), distributed rate limiting, 5-strike account lockout, CSRF double-submit, session rotation on password change.
  • Append-only audit log with SHA-256 hash chain for every admin-console action.
  • New /status page and /api/health endpoint for uptime monitoring.
  • Branded 404 and 500 error pages.
  • Terms of Service and Privacy Policy published.
  • Rebuilt brand system: new ascending-analytics mark, refined wordmark, cleaner dark theme.
  • Public security policy, incident-response runbook, and backup/DR docs under docs/.

Groq provider + smart env-var resolution

v8.1.0·
  • Added Groq as a fifth AI provider — fast Llama/Mixtral/Gemma inference.
  • Smart env-var aliasing that picks whichever configured variable has the correct format per provider.
  • Per-provider key-format validation exposed on /api/ai/status with actionable warnings.
  • Router skips providers with obviously malformed keys to save round-trips.

User-scoped bet history → Supabase

v8.0.3·
  • Per-Stake-user bet history now persists to api.sl_game_history on Supabase.
  • Tables migrated from public to api schema so PostgREST can see them — also unblocks the extension's own sync.
  • New GET /api/history endpoint with all-games, single-game, and aggregate-stats modes.

Domain rebrand + provider round-out

v8.0.2·
  • Canonical domain switched from strathub.com to strathub.ai across code, manifest, CORS, and metadata.
  • Full landing redesign with alternating feature rows, engine pipeline, and live-data visualizations.
  • AI routing verified operational across Anthropic, OpenAI, OpenRouter, DeepSeek.

Staff admin console

v8.0.1·
  • /admin login, dashboard, and change-password flow.
  • api.sl_staff table with bcrypt-hashed credentials + role-based access control.
  • JWT session cookies (HS256, 8h TTL) verified through middleware.
  • Tier taxonomy scaffold at /tiers covering Users, Staff, Creators, Affiliates.