Version 2.7.1 New Features / Changes

• Replaced the old catalog with 12 practical examples: Clean Share Link, Open GitHub PR Files, Search Selected Text, Copy Markdown Citation, Normalize Clipboard Text, Research Trail, Redact Emails, Fetch and Preview Text, Confirmed Webhook Test, 20-20-20 Reminder, Focus Sprint Timer, and Normalize Text Custom Block Source.

-Added editable/restorable model instructions. Custom guidance stays local and in manual backups; browser sync uses the built-in default.

-Upgraded Ollama to complete-graph drafting with strict parsing, compilation, Action Pack validation, risk/permission review, full recipe JSON inspection, stale-draft protection, loopback-only endpoints, redirect blocking, and bounded responses.

-Added the internal workspace-recipe.v1 JSON format. It now drives deterministic bundled generation and provides the LLM with a strict machine-readable graph, block, port, trigger, and settings contract.

The editor now has compact cards, clearer controls, smooth connections, a deduplicated Block Library, measured Logical Flow regions, automatic branch positioning/rebranching, non-overlapping backgrounds, and live composite dragging.

Version 2.6 New Features / Changes



AI Connectors:
-Rename user-facing “Local Ollama Builder” surfaces to “AI Connectors” in settings, draft UI, help, README, and reviewer notes.
-Keep Ollama as the only connector in 2.6.0; keep existing ollama* storage keys for compatibility unless a migration is strictly needed.
-Remove llama3.2 as a default model. Model selectors must only render models returned from /api/tags.
-On refresh, if the saved model is absent, auto-select and save the first installed model. If no models are returned, clear/disable drafting and show a blocking message.

Undo:
-Add GlobalSettings.undoHistoryLimit, default 100, editor-session only, with a settings input allowing 0 to 10000.
-Add an Undo button to the workspace surface toolbar and support Ctrl+Z / Cmd+Z when focus is not in an input.
-Undo covers workspace graph, block settings, metadata/config, add/delete/paste/connect/disconnect/move operations, and full logical-flow/custom-block edits. ---Exclude viewport/pan/zoom, popout state, tabs, import staging, and persisted backups.

Block Tooltips:
-Extend block definitions with concise description and optional tips.
-Show descriptions in the block picker, quick/context menus, and existing help tooltips.
-Make Condition Select explicit: it chooses between values and does not control which downstream side-effect blocks run; point users to Logical Flow for branch execution.

Logical Flow Blocks:
-Add a Logical Flow insertion action that creates one locked unit: a no-visible-output condition block, a flow-control block with input, true, and false ports, plus True and False visual branch containers.
-Persist flow group metadata so condition/control/containers/branch contents lock, unlock, move, and delete as one unit. Deleting any part deletes the entire flow and contained branch blocks.
-Branch containers expand from reachable branch nodes, support missing else branches, and use depth-based colors for nested flows.
-Add VM/compiler support for real branch execution: only the selected branch subprogram runs, and side-effect blocks in the unselected branch do not run. Validate cycles per branch and roll branch risk/permissions into the parent pack.

Custom Blocks:
-Add workspaceType: "custom-block" plus custom-block metadata: stable block id, display name, --version, category, visible workspace types, tooltip/help text, typed inputs, typed outputs, and configurable fields with labels/defaults/tooltips/visibility rules.
-Add custom-block interface nodes for declared inputs and outputs. Custom block workspaces compile to validated VM subprograms, never eval() or new Function().
-Add StoredState.customBlocksV2 for installed custom blocks. Installing happens only by compiling a custom-block workspace, not by importing arbitrary code.
-Installed custom blocks appear in the block picker with a neutral “Custom” tag and an “open source workspace” link

Version 2.5 New Features / Changes
Added functionality to create workspaces for use in creating content blockers / focus guard along with
Added a connector so you can use a local AI model to help build workspaces.
Trust and warning UX: split technical risk from trust source. Bundled verified and user-created items show green status, modified bundled/imported show review status, and imported high-risk packs stay red until reviewed. Keep strict warnings in import/audit flows.
Bundled/examples split: classify current built-ins into separate Bundled and Examples tabs, generate artifact hashes in the bundled index, verify bundled artifacts before install/open, and update help copy.
Large resources: store resources once in IndexedDB, reference them from stored workspaces and installed Action Packs, and bundle bytes only on export. Use schema-7 streaming artifacts under existing .workspace/.actionpack extensions with WSPC2/ACTP2 magic, resource manifests, raw resource sections, SHA verification, quota checks, and graceful missing-resource runtime placeholders.
Backups: add a resource-aware backup/export path for unlocked data; exclude resources from Chrome/Firefox sync. When any locked Action Pack exists, disable backup export, backup restore, and full reset UI.
Logging: add Settings default for new Action Packs and per-pack logging toggles. Fresh installs default logging off; migrated existing packs keep logging on to preserve behavior. Run logs and SaveStringToLog entries are skipped when disabled; trace remains separate.
Add V2 schema support for workspaceType: 'data-modifier' | 'content-blocker', WorkspaceGraphSurface, and content-blocker config. Bump the current repo schema by one version and migrate older schema versions, including current metadata.profile === 'content-blocker'.
Data Modifier workspaces keep the current single React Flow surface, Run controls, URL Input Filter, Hotkey controls, current block registry, compile/export behavior, and V1 .urlpack conversion path.
Content Blocker workspaces get three separate drag-and-drop surfaces: Page Load Decision, Recurring Check, and Challenge Page. Type is locked after selection and displayed as a read-only badge.

Version 2.0.5 prioritizes security enhancements.
- Enhanced workspace import validation and migration processes, including the rejection of potentially hazardous keys, the implementation of size and count restrictions, the verification of finite coordinates, the rejection of unsafe trigger-filter configurations, and the removal of unknown source fields following validation.
- Reinforced overlay/hotkey runtime message validation and eliminated reliance on message-provided tab IDs and URLs.
- Introduced trusted-event guards for overlay pointer events and OverlayInput keyboard and mouse capture functionalities.
- Implemented content-script restrictions for page text, raw HTML, and link retrievals.
- Updated security assistance documentation, bundled workspace compatibility metadata, manifests, and package versions.

URL Alchemist 2.0 is a Chrome extension for building browser workflows from visual blocks. Create editable workspaces, compile them into portable binary Action Packs, and run those packs from page input data, hotkeys, context menus, intervals, or visible overlay events

The update was focused entirely on hardening and security.
- Unsafe redirect/output handling: packs can no longer transform a tab into j
avascript:, other non-web schemes, malformed absolute URLs, or file:// when
local files are disabled.
- Import hardening: .urlpack imports are now capped at 1 MB, numeric fields
are validated more strictly, failed imports clear any previously staged
pack, and the staging modal blocks imports that would reuse an installed
pack ID or fail the same regex/hotkey safety checks as the Forge.
- Regex correctness bug: $1-style capture groups now expand correctly for
NTH_OCCURRENCE, BEFORE_PATTERN, and AFTER_PATTERN, not just standard
replacements.
- Hotkey message hardening: background execution now prefers the real sender
tab URL over the message-provided URL to avoid spoofable intra-extension
input.