@mavea/mavea 2.0.1 → 2.1.0

package/CHANGELOG.md

@@ -6,6 +6,81 @@ All notable changes to Mavéa are documented here. The format is based on
 
 ## [Unreleased]
 
+## [2.1.0] - 2026-08-21
+
+### Added
+
+- **A new conversation now has a front door.** The Go hub offers Prism, the listening modes, Deep
+  Zoom, Delegate, Courses, Synthesis, and Ripple as ways to _begin_. Before this, the setup wizard
+  hid the whole dock, so the only route to any of them was to ask a throwaway question first. The
+  Prism row names the file it will open, and picking a file opens the map on the same gesture
+  instead of staging it somewhere you cannot see.
+- **A fifth way to read a living answer: spheres.** It answers a question the other four cannot —
+  what kinds of force an outcome is made of, and where the explanation hands off from one kind to
+  another. Links that cross between kinds are drawn at full weight; links that stay inside one go
+  faint.
+- **A world now looks like what it is about.** Its domain reaches the room as light rather than one
+  6px dot, so a photosynthesis world and a bailout world no longer read as the same grey rectangles.
+- **Prism and Synthesis remember a document's map.** Re-opening the same file no longer re-reads it
+  through your key. The map is filed under that file's identity and the model that read it, so it is
+  only ever reused for the same document, and the store is bounded by least-recently-opened.
+- **The pen writes in a real hand** — a self-hosted face rather than whatever the system happened to
+  have, so a mark looks the same everywhere.
+- **A bracket's figure is computed, not quoted.** Both of a bracket's anchors have to be found in the
+  rendered page before it draws at all, so the delta between them is provable by construction. A
+  model-authored number gives way to the computed one; a label carrying no digits is a name and is
+  kept.
+
+### Changed
+
+- **The voice sounds like a voice, not a list.** Sentences after the first are gathered into
+  breath-sized utterances, so the synthesizer carries prosody across them instead of restarting for
+  each one, and the first spoken line waits for the canvas's first card to finish arriving.
+- **A briefing beat ends when its narration ends**, instead of being cut off by a character-count
+  guess.
+- **"Tell me more" now builds a world about what you were discussing.** A follow-up that carries no
+  subject of its own used to be explained literally — a thread about refinancing, asked to go on,
+  returned a causal web about the act of explaining.
+- **Your own question is shown back to you in sentence case.** One character, so a typed line reads
+  as a question someone asked rather than as an unfinished fragment.
+- Storage that can fill up now says its cap where you can see it, and the device cache retires what
+  you have not opened in longest rather than what was written first.
+
+### Fixed
+
+- **A pronunciation can never reach the screen, and can no longer make the voice say a common word
+  wrong.** The respelled side of a pronunciation is invented rather than looked up, so asked to catch
+  anything a synthesizer might mangle, a model also respells ordinary vocabulary. Ordinary English is
+  now recognised and the respelling dropped, keeping the word exactly as written.
+- **A card that resolved no content no longer renders.** A table whose rows produced no cells used to
+  draw a header over blank lines under a footer confidently counting them — in a live answer and in a
+  recorded demo alike.
+- **A remembered key is no longer reported missing.** Settings probed the vault before it had
+  finished decrypting, so a key that was there showed as absent; the same race could also fail a real
+  send.
+- **A send that cannot start now says so and keeps what you wrote**, instead of silently discarding
+  it.
+- **A turn that trickles forever now stops.** The Anthropic and Gemini streams carry the same hard
+  ceiling on a whole turn that the OpenAI-compatible path always had — the previous guards only
+  covered time-to-first-byte and a stream that had gone completely silent.
+- **Clicking outside a document map only closes it when you meant to.** A drag released past the
+  panel's edge, or a click whose target disappeared mid-gesture, used to read as "close".
+- **Leaving something you started from the hub lands you back on the hub**, not on an empty stage
+  with half the menus gone.
+- Copy about other companies' models describes what Mavéa needs and what this turn did, never how
+  good somebody else's service is.
+
+### Security
+
+- **The device-local map of a document no longer keeps the document.** A file staged through the
+  conversation dock carried its bytes into the saved map, so re-opening a corpus wrote whole
+  documents into browser storage; the map now keeps only what names a source, and the bytes come from
+  the file you still have open. This also repaired the cache itself, which had been silently
+  refusing to save a corpus of three or more documents for exceeding its entry ceiling.
+- The legal acknowledgement is versioned again for this release, so the changed Privacy Notice is
+  shown once to everyone who had already accepted, and the documents are now digest-pinned in the
+  test suite so a future edit cannot ship without that decision being made.
+
 ## [2.0.1] - 2026-08-18
 
 ### Fixed

package/PRIVACY.md

@@ -1,6 +1,6 @@
 # Mavéa Privacy Notice
 
-Effective: August 17, 2026
+Effective: August 22, 2026
 
 This notice describes the current, unmodified local and self-hosted Mavéa software. It does not describe a future hosted service. Local-first does not mean every feature stays on your device: connected features send data through the deployment to third parties you choose. If a person or organization deploys Mavéa for others, that operator must provide any additional privacy notices and controls required for its deployment.
 
@@ -25,7 +25,8 @@ Depending on the features you use, browser storage may contain:
 - drafts, tracked items, presentation settings, and recent feature state;
 - provider and model configuration;
 - remembered provider, search, or optional GitHub credentials;
-- a short-lived cache of recent questions and the answers to them, kept on the device so that asking the same thing again does not bill your key a second time; it expires within a day, and it deliberately excludes any answer that drew on attachments, ink, filled-in blanks, cited sources, or your remembered facts;
+- a short-lived cache of recent questions and the answers to them, kept on the device so that asking the same thing again does not bill your key a second time; it expires within a day, and it deliberately excludes any answer that drew on attachments, ink, filled-in blanks, cited sources, or your remembered facts (document text attached to a Prism or Synthesis map is kept separately — see the next entry);
+- the map of a document you exploded with Prism or Synthesis — its claims and the extracted page text they are quoted against — kept on the device so re-opening the same file does not bill your key to read it again. It is filed under that file's identity and the model that read it, so it is only ever reused for the same document; it does not expire on a timer, because the mapping cannot go stale and re-running it would charge you for an identical result. It is bounded instead: the least recently opened entries are dropped once the store passes a fixed number of entries or a fixed total size. Clearing site data removes it;
 - temporary in-progress and finished video-export files in origin-private browser storage until the export is consumed or discarded; and
 - short-lived demo, tour, route, and in-progress session data.
 
@@ -41,6 +42,8 @@ Provider and search keys stay in memory until reload unless you choose Remember.
 
 Keys are decrypted when needed and pass through the deployment's same-origin proxy to the provider you selected. The proxy and its host can technically access credentials and content in transit. Browser encryption does not protect against an active compromise of the device, browser, extension, deployment, proxy, or provider.
 
+The scope you grant is the boundary of what these features can read: a token that can reach private repositories lets any feature you run reach them too, and what it reads can then be sent to your selected model provider (see section 4). Review the scopes at the point of authorization, prefer read-only, and revoke a connection you are no longer using.
+
 Optional GitHub and Google connections can store access tokens, refresh tokens, or repository settings in the actions gateway or its host configuration. The unmodified gateway writes persisted OAuth tokens to an owner-readable host file and keeps limited audit metadata, not request bodies or provider response text. Whoever runs the gateway controls that file, its backups, logs, deletion, and security.
 
 The unmodified gateway has no separate Mavéa user accounts. On a shared deployment, everyone allowed to use action features may act through the deployment operator's connected GitHub or Google account. Use a dedicated, least-privilege gateway and do not expose it to people who should not share those permissions.
@@ -51,6 +54,10 @@ Text you type or paste, conversation context, remembered facts, attached files,
 
 Prism and Synthesis stage and extract supported files locally where possible, but relevant content can still be sent for analysis. Ripple can parse code locally before optional model enrichment sends relevant code or diffs. Local staging is not a promise that later analysis remains local.
 
+Two of these flows do not wait for you to press anything, which is the part worth knowing. Features that watch something for you — tracked items, dashboards, and the morning brief — re-issue requests on the cadence you configure, so the same content and credentials go out again on a timer rather than only when you ask; most run only while Mavéa is open, and each run can bill your provider. And remembered facts are attached to later requests: something you told Mavéa once can be included in a request you make weeks afterwards, to whichever provider is selected at that time. You can review or forget remembered items, and turning a tracked item or a dashboard off stops its checks.
+
+Connecting a code host is the same boundary, and it is worth stating plainly because the content is not something you typed: when you point Mavéa at a repository, the files, documentation, diffs, commit messages, issues, and other repository data a feature reads can be sent through the deployment to the model provider you selected. **A private repository is not treated differently from a public one** — if you grant a token or OAuth scope that can read private repositories, private source and internal documentation can leave your control the same way a pasted snippet does, and the provider's own retention and processing terms then apply to it. Grant the narrowest scope that makes the feature work, prefer read-only and a repository allowlist where your host offers one, use a dedicated account for shared deployments, and do not connect a repository whose contents you are not permitted to disclose to that provider.
+
 ## 5. Voice, microphone, speech, and reels
 
 If you enable listening, the browser captures microphone input. Audio is processed by the deployment's configured speech-to-text endpoint — by default a local one on the same machine, though an operator can configure a different endpoint — which converts speech to text. Recognized transcripts may then be sent to your selected model provider, including while listening continues.

package/README.md

@@ -1,6 +1,6 @@
 <div align="center">
 
-# Mavéa
+# Mavéa™
 
 <picture>
   <source media="(prefers-color-scheme: dark)" srcset="https://cdn.jsdelivr.net/npm/@mavea/mavea@latest/docs/media/mascot-dark.svg" />
@@ -120,10 +120,16 @@ Twelve moments from the walkthrough and the recorded sessions. Every one replays
     <td width="25%" valign="top"><img width="168" src="docs/media/doc-prism.jpg" alt="A NASA technical report read claim by claim, each finding highlighted on the real scanned page" /><br /><sub><b>A document, claim by claim.</b> Every finding highlighted on the real page it came from.</sub></td>
   </tr>
   <tr>
+    <td width="25%" valign="top"><img width="168" src="docs/media/go-hub.jpg" alt="A new conversation offering Prism, Just listen, Watch me think and Deep Zoom as ways to begin, beside the model and voice already set up" /><br /><sub><b>Start anywhere.</b> A new conversation offers every mode as a way in — no need to ask a question first.</sub></td>
     <td width="25%" valign="top"><img width="168" src="docs/media/trip-plan.jpg" alt="A day trip drawn as a route map with numbered stops beside an hour-by-hour plan" /><br /><sub><b>It picks the right form.</b> A route becomes a map; a day becomes an hour-by-hour plan.</sub></td>
     <td width="25%" valign="top"><img width="168" src="docs/media/repo-course.jpg" alt="A GitHub repository turned into a beginner-to-expert curriculum with lessons, files to read and a checkpoint" /><br /><sub><b>A repository, taught.</b> Beginner to expert, built from the code, with real files.</sub></td>
     <td width="25%" valign="top"><img width="168" src="docs/media/deck-export.jpg" alt="The export studio previewing a generated slide, with PDF and PPTX downloads" /><br /><sub><b>Out as a deck.</b> Ten skins, a live preview, PDF or PowerPoint.</sub></td>
+  </tr>
+  <tr>
     <td width="25%" valign="top"><img width="168" src="docs/media/doc-export.jpg" alt="The export studio previewing a generated document page in an editorial template" /><br /><sub><b>Or as a document.</b> The same answer set as a paper, ready to print or send.</sub></td>
+    <td width="25%"></td>
+    <td width="25%"></td>
+    <td width="25%"></td>
   </tr>
 </table>
 
@@ -174,3 +180,9 @@ components remain under their own licenses.
 Copies of the software must keep the license's required notice:
 
 > Required Notice: Copyright (c) 2026 Akash Maitra and Aryan Chordia
+
+## Contact
+
+- **Commercial license, trademark permission, or acquisition** — <trymavea@gmail.com>
+- **Questions and feature ideas** — [GitHub Discussions](https://github.com/TryMaveaAI/mavea/discussions)
+- **Security** — follow [SECURITY.md](./SECURITY.md); never report a vulnerability in a public issue

package/SECURITY.md

@@ -16,7 +16,7 @@ Please **do not** open a public issue for security problems. Instead:
 - **Preferred** — open a private report through GitHub:
   [**Report a vulnerability**](https://github.com/TryMaveaAI/mavea/security/advisories/new)
   (the repository's _Security → Advisories_ tab), or
-- email the maintainers at **akash.maitra@gmail.com**.
+- email the maintainers at **trymavea@gmail.com**.
 
 Do not submit a public or external security pull request or attach exploit code unless a maintainer
 requests it through the private reporting channel.

package/TERMS.md

@@ -1,6 +1,6 @@
 # Mavéa Terms of Use
 
-Effective: August 17, 2026
+Effective: August 22, 2026
 
 These Terms of Use (the **Terms**) govern your use of the Mavéa application, command-line package, demos, documentation, and related materials (collectively, the **Service**). **Licensor** means each applicable copyright holder offering software under the PolyForm license. **Maintainers** means the people who publish or contribute to Mavéa; a Maintainer is not necessarily a Licensor. **Deployment operator** means the person or organization hosting the copy you use. **Responsible Party** means the applicable Licensor, Maintainer, or deployment operator responsible for a statement, obligation, service, or claim. In these Terms, **we**, **us**, or **our** means the relevant Responsible Party or Parties in context. A separately operated deployment remains independent from the Licensors and Maintainers unless the same person or organization serves both roles.
 
@@ -38,6 +38,8 @@ You must independently review and verify important output against qualified prof
 
 Mavéa can communicate with model, search, speech, media, hosting, OAuth, and action providers that you select. Those services are independent third parties and are governed by their own contracts, privacy policies, acceptable-use rules, retention practices, availability, and pricing.
 
+Connecting a code host or other content account authorizes Mavéa to read what that credential can reach and to include the relevant parts in requests to the provider you select. This applies to private repositories exactly as it does to public ones: if the scope you grant can read private source, internal documentation, diffs, or issues, that material can be sent to a third party under that party's own terms. You are responsible for having the right to disclose it, for granting the narrowest scope that works, and for revoking connections you no longer use.
+
 You provide and control your own accounts, API keys, OAuth grants, and other credentials. Requests send relevant credentials and content through the deployment's same-origin proxy before reaching the selected third party. The proxy operator can access that material in transit. You must use a deployment operator you trust.
 
 All costs of using the Service are your responsibility, including hardware, electricity, network access, hosting, domains, model tokens, search requests, speech services, storage, OAuth applications, connected-account activity, taxes, and any other third-party charges. Labels such as "fast", "balanced", or "thorough" are relative product descriptions, not price quotes or spending limits. Any token counts or usage figures the Service displays are informational only: they report what a provider stated for the current session in this browser, are not a billing record, and may be incomplete, unavailable, or wrong — your provider's own account is the authoritative measure of what you were charged. You are responsible for provider budgets, quotas, and billing alerts.
@@ -131,4 +133,4 @@ No governing-law, arbitration, venue, or class-action-waiver clause is included
 
 ## 16. Contact
 
-For a hosted copy, contact the person or organization that gave you access. For the public repository, use the Mavéa GitHub issue tracker for non-sensitive questions. Do not put confidential information in a public issue. Security reports must follow [SECURITY.md](./SECURITY.md).
+For a hosted copy, contact the person or organization that gave you access. For the public repository, use the Mavéa GitHub issue tracker for non-sensitive questions. Do not put confidential information in a public issue. Security reports must follow [SECURITY.md](./SECURITY.md). Commercial licensing, trademark permission, and other business inquiries may be sent to trymavea@gmail.com. Correspondence does not create a license, warranty, support obligation, or commercial right; see Section 2.

package/TRADEMARKS.md

@@ -1,4 +1,4 @@
-# Mavéa Trademark Policy
+# Mavéa™ Trademark Policy
 
 Effective: July 19, 2026
 
@@ -13,3 +13,5 @@ You may make truthful, nominative references such as "runs with Mavéa" or "a no
 - preserve all required copyright and license notices.
 
 You may not use the Mavéa Marks for commercial promotion, merchandise, advertising, or fundraising without prior written permission from the applicable rights holders. No permission is granted by silence, issue discussion, or software-license compliance.
+
+Requests for written permission may be sent to trymavea@gmail.com. A request is not permission; only a signed writing from the applicable rights holder grants it.