Changelog

0.0.1-alpha.17 (WIP)

Privacy and data changes

This update adds the group names to the live sessions.

The Privacy and data considerations are being updated to reflect this.

In addition, a line has been added to clarify that API requests and responses are processed directly from your machine; this does not describe a change in behavior.

• In "What is the nature of the requests to those servers?", add to the "The following requests are for live monitoring" section:

• Get the group name of a session.

• In What servers are called?, add:

• Requests are sent directly to the social VR applications from your machine, and the responses are processed exclusively on your machine.

Application changes

Important:

• The application now requires .NET 10 (instead of .NET 9).

Features:

• Current progress is now displayed on the data collection button, contributed by @art0007i.
• Group names of VRChat live sessions are now shown under the user count.
• Session names (typically, world names) that match certain strings can be pushed to the bottom of the live sessions list, from the settings page (Deprioritized Virtual Spaces).
• Third-party acknowledgements are now visible from inside the built application, in the Settings page.

Fixes:

• Fix Booth.pm wishlist URLs are no longer displayed as being an account name.
• Fix some profile links to Patreon service starting containing patreon.com/c/ were incorrectly displayed.
• Fix log file was previously truncated or had missing lines, if it was opened by an external program while XYVR is running.
• Fix pressing the log out button on a Resonite connection with an expired token should no longer trigger an error.
• Fix sqlite initialization on Linux, contributed by @art0007i.
• Fix VRChat login should now function on Linux/Photino, contributed by @art0007i.
• Attempt to fix a multithreading issue related to live session monitoring, which may have led to failing to list all sessions.
• If the individuals.json file gets corrupted, it should now recover from this.
  • Fix reading an empty string was previously treated as a success instead of a failure to deserialize.
  • Fix data_individuals table was previously not written to for recovery.
  • Fix data_individuals table was previously written to when saving preferences.

Changes:

• The Show/Hide portraits" button is now next to the "Light/Dark mode" button.
• All other buttons are now only shown when a search is being made, as those buttons only have an effect during searches.
• The thumbnail cache is now cleared when the application starts, as the storage could grow out of control.
• If the ui-preferences.json file gets corrupted, we will try now try to recover from this.

Internal changes:

• Log when worlds are removed from the cache.
• If an API repeatedly returns a server error, we may wait for even longer periods before retrying.
  • Previously, the maximum delay was 80 seconds; it could now last 5 minutes.
• Public Resonite sessions are no longer printed into the logs.
• Builds are now output by default to the build/ and build-photino/ folder, contributed by @art0007i.

0.0.1-alpha.16

Privacy and data changes

This update adds internal handling to support another social VR platform: Cluster (cluster.mu).

The Privacy and data considerations are being updated to reflect this.

If you only use Resonite, VRChat, or ChilloutVR accounts, this does not affect you.

• Add data considerations for the Cluster social VR application (cluster.mu):
  • In What servers are called?, add the following:

• We only perform requests to the following URLs:
  • for Cluster accounts: https://api.cluster.mu/v1
• We fetch thumbnails:
  • for Cluster: only from URLs that start with https://cluster-file-storage.imgix.net/.

• These new considerations only apply to accounts of type cluster.mu.

Application changes

Features:

• You may now assign a custom profile to your contacts. The UI is now designed around displaying profile pictures.
  • You choose a profile picture by opening a users' account, and then drag and drop a picture into it.
  • The 2D profile pictures from the various social VR apps are not used as a profile picture.
  • The picture is stored with the XYVR database.
  • If a session has five or more participants, that session is now shown full-width to accomodate the large size of the profile pictures.
• Resonite has an additional field to specify a 2FA code when logging in.
• Add partial implementation of the Cluster (cluster.mu) social VR platform.
  • For this version, it is not possible to log-in to Cluster accounts due to technical and privacy limitations.
• Live sessions now contain additional information:
  • Live sessions now display the session entry permission type.
  • Live sessions now have icons:
    • Red ID card icon: VRChat instances now show when entering it requires Age Verification, contributed by art0007i.
    • Server icon: Resonite sessions now display when it is hosted headless.
  • ChilloutVR instances and Resonite sessions now show the usernames of people in the session, contributed by art0007i.
  • Resonite sessions now have buttons to open the instance through the web browser, and a button to copy a web link to it.
• There are now buttons to quickly filter online users by app.
• The window size and position are now remembered across sessions.
  • Although implemented, it is unclear whether this works on Linux.
• In search results, links to the following services are now marked as such and shortened for most of them:
  • Artstation, Bandcamp, Bluesky, Booth.pm, Carrd, Facebook, Fansly, Fantia, GitHub, GitLab, Gumroad, Instagram, Jinxxy, Ko-fi, Linktree, Misskey.io, Misskey.niri.la, Mixcloud, Patreon, Skeb, SoundCloud, Steam, TikTok, Twitch, Twitter, X, YouTube, cluster.mu, lit.link, pixivFANBOX
  • Links to Bluesky are not shortened to keep the identifier consistent with the use of custom domains.

Fixes:

• Fix sending yourself an invite to VRChat instance should now be functional.
• The rate limit delay for Resonite API calls has been raised from 500ms to 1 second, to avoid getting a Too Many Requests response.
• Fix list of participants in a session was sometimes displayed in an incorrect location on the screen.

Changes:

• Changes in live sessions:
  • The button to join a session is now displayed at the bottom right.
  • Due to the change in profile pictures, multi-sessions are no longer shown within live sessions and within users located in private sessions; they are now shown only inside the modal.
  • A question mark is now shown when the total number of participants in a session is not yet known.
• Search-related changes:
  • The search bar has been moved to the top of the screen.
  • Changes in search results and modal:
    • The link to open the profile is now the rightmost.
    • The "Contact" label is no longer shown.
    • Links are now shown at the top rather than at the bottom.
  • Search results are now shown in three columns.
  • If the search terms are a quick filter for online users, then the address book is not shown.
  • The profile pictures of users in private sessions are now shown even if there is a search term.
• A log file is now written to disk, contributed by art0007i.

Internal changes:

• Builds and the WebView2 build script now output the executable to the build/ folder at root, contributed by art0007i.
• Resonite live internals now throw an exception when the user has failed to log in (session expired), contributed by art0007i.
• Update vite to 7.1.11 and js-yaml to 4.1.1 as suggested by Dependabot.
• Update react-router-dom to 7.12.0 as suggested by Dependabot.
• Http requests now handle errors differently:
  • If any 5xx server error is returned, we use exponential backoff to retry that request.
  • If 429 Too Many Requests status code is returned, we wait 80 seconds before retrying.

0.0.1-alpha.15

Features:

• VRChat live sessions now have a button to invite yourself to the session.
• Resonite live sessions now have a button to join that session.
• In the settings, there is now a setting to toggle whether Resonite sub-sessions are displayed. This does not affect how sessions are displayed during a search.
• Live monitoring now shows your own session you're in.
• Clicking an account or an individual will open that individual in a modal.
  • That modal also shows the previous account usernames, links, notes, and bio.

Changes:

• We normally refresh the list of sessions slowly due to rate limiting, but this caused the list of sessions in the UI to reorder itself every time a session is refreshed, making the list of sessions in the UI practically unusable.
  • Now, when we're refreshing the list of sessions to update the total number of users in a session, the updated list of sessions is pushed to the UI all at once. This means the UI will no longer reorder itself while we're making the API requests to refresh that list.
• The UI theme is undergoing changes.
• The button to copy the account ID to the clipboard is now only shown in the modal.

Internal changes:

• The custom name of live sessions is now hidden in demonstration mode.
• Requests to VRChat API are more aggressively canceled when the application exits.
• Replaced an incorrect localization line.

0.0.1-alpha.14

Features:

• Add ChilloutVR live monitoring, contributed by art0007i.
  • The CVRX license by AstroDogeDX is now referenced in the third-party acknowledgements.

Changes:

• In the login page message privacy disclosure, clarify that data is never transmitted to a third-party.
  • Nothing actually changed in the privacy considerations, this just makes it explicit that no third-party is involved.

0.0.1-alpha.13

Features:

• Add Simplified Chinese locale, contributed by modimobeikete.

Changes:

• Live monitoring will now start when logging into an account. Previously, the program needed to be restarted.
• Live monitoring will now stop when logging out of an account.
• Reorganized how the buttons are placed in the settings.
• ChilloutVR API URL has been switched to api.chilloutvr.net by request from a member of the ChilloutVR team.
• Documentation URL has changed. References to documentation URLs inside the app have been changed accordingly.

Internal changes:

• Compiling localization files is now dynamic, based on a manifest file.
• Accounts can now be tagged as lost during data collection. This happens when a user deletes their VRChat account.
• The live monitoring agent is now considered core functionality.

0.0.1-alpha.12

Fixes:

• Fix live monitoring for Resonite and VRChat should now recover after Internet connection is lost.
• Fix Resonite schema was causing failure to retrieve contacts due to badge format, contributed by art0007i.

0.0.1-alpha.11

Features:

• Add Japanese locale, contributed by kazu0617.
• Tentatively add Arch Linux package builds, based on previous work by kazu0617.
• Instance names are now shown below the world name, if available.

Fixes:

• Fix Windows frontend was missing.
• Fix a possible crash that would have been caused by some Resonite status updates for which we could not find the session for.

Changes:

• All world thumbnails are now cached on disk to comply with VRChat's recent policy change regarding thumbnails.

0.0.1-alpha.10

Fixes:

• Try to fix an issue where resolving multisessions would crash because the user does not have a hashSalt defined.
• Try to fix an issue with how multisessions were not being updated during live updates.
• Delete cached VRChat worlds not seen for more than 45 days to avoid indefinitely increasing RAM usage.
• Try to fix a multithreading issue affecting Resonite session IDs.
• Try to fix a multithreading issue affecting how VRChat worlds are cached.

Changes:

• VRChat's policy on thumbnails is about to change. From now on, XYVR will start caching world thumbnail URLs on disk.
  • In the future, we will use those cached world thumbnails. This is not implemented yet as it requires a dynamic API URL to serve the images, which is something we have never used so far in neither Microsoft WebView 2 nor Photino.

Internal changes:

• Add more logging when sessions are being logged.
• Log errors happening in Resonite more aggressively.

0.0.1-alpha.9

Fixes:

• Try to fix various cases where VRChat contacts were still considered to be in a session even after leaving.
• Frontend will no longer request for /null as a thumbnail image when a session does not have a thumbnail.
• Fix crash should no longer occur when caching worlds that don't have an asset creation date. We no longer try to interpret some of the world data cache that we were not interested in.
• If a message in SignalR fails to be interpreted, log it and skip processing that event instead of crashing.
• Fix when all participants leave a session, that session is now properly ignored when new information about it arrives from SignalR.
• Try to fix an issue in Resonite where the sessions that a contact was located in were not tracked properly when the focused session changes at the same time as the list of sessions that this contact is in.

Changes:

• When performing a ChilloutVR data collection, your own account will now be included in the data being collected as a contact.
• The main page now shows online individuals unless there is an active search.
• If a session has an equal number of users in the session (not necessarily contacts), prioritize low-capacity sessions.
  • For example, a 1/2 session in the "For Two" world will be prioritized over a 1/32 in the "SuRroom" world, because it has less remaining slots available.
• Compact mode and language are now saved as part of the preferences.
• VRChat sessions are now fetched at a rate of four requests per second when the application starts, and at one request per second every five minutes afterward.
• Try to improve RAM usage when Resonite sessions are being cached by discarding old session data.

Internal changes:

• Photino logs have been removed, as they are too verbose and may leak undesirable data into the logs.
• vite has been updated to 7.1.5 as suggested by Dependabot for a minor security update.
• Work towards adding localization keys.
• Reduce the number of existing logs.
• Add more logging when errors occur.
• Timestamps and source are now recorded in the console logs.
• Remove leftover Resonite debugging code. We used to get all Resonite sessions to see if it was needed to build the initial session state, but it was only used for debug logging.

0.0.1-alpha.8

Features:

• Now builds on Linux.
  • Added variant of the program based on Photino instead of Microsoft.Web.WebView2.
  • On Linux, session key is written to the filesystem instead of the Windows registry.
  • Opening URLs now uses xdg-open on Linux.
• Connecting to ChilloutVR accounts is now possible using Email.
  • Note: Connecting using access key is not yet supported.
  • Note: If you have not accepted the new ChilloutVR terms of service, the login will fail without an error message. Connect to the ChilloutVR website first to accept the terms of service.
• Improve session card:
  • Session now shows thumbnail images.
  • Session now shows the user count and session capacity.
  • If the session capacity is larger than the world capacity, the session capacity will be displayed differently.
• If the user is connected to multiple worlds at the same time on Resonite, this will now be shown in the session card and the account card.

Fixes:

• When executing the application for the first time, the directories for saving the files are now created in advance.

Changes:

• Rename app to XYVR on Windows, and xyvr on Linux.
• Add app icon on Windows.
• Active sessions are now refreshed every minute.
• World data now expires after 6 hours.

Internal changes:

• Linux-related changes that do not affect the user:
  • Javascript .NET from/to React communication has been modified to support both Microsoft.Web.WebView2 and Photino. The latter does not support awaiting on .NET calls, so some basic async RPC has been implemented using deferred Promises.
  • npm run build-and-copy no longer depends on Windows-specific xcopy.
  • Clicking and middle-clicking on links to external websites is now handled in the Backend for UI instead of the browser capabilities, because I could not figure out how to make Photino intercept and cancel navigation and window opening events caused by clicking on <a href= links.
  • Backend for UI has been split to its own project ui-backend.
  • React UI has been split to its own project ui-frontend.
• The internal architecture for handling session data has been drastically changed: live session data is no longer contained within the live user data.

0.0.1-alpha.7

Features:

• Sessions now show up above contacts, where online contacts participating in the session are grouped together.

Changes:

• XYVR is no longer allowed to be run twice to prevent the application overwriting each other's data.
• During data collection, the application will now detect if listing online and offline VRChat friends has failed to return all friends and will now try to recover from this inconsistency.

0.0.1-alpha.6

Fixes:

• Data collection no longer causes notes to be wiped and then rewritten.

Changes:

• The cached data for world names are invalidated after an hour, applicable once XYVR restarts. World data will be requested again only if needed.
• Change how we decide that someone is in a private world, rather than an unknown state.
• Change the terminology from "We" to "This application" in the privacy message.

Internal changes:

• Live monitoring updates and account updates are only sent to the UI when the data has actually changed, which avoids unnecessary data model updates on the React side.
• Most of the main data structures are now immutable.
• Prepare initialization code and project architecture to be more flexible if we want to support other social VR apps.

0.0.1-alpha.5

Features:

• Show the name of the current Resonite session and VRChat world that an account is in.
• Add session: to search by session name.
  • The search field now supports quotes to group worlds, such as session:"h p" to search for session names that contain h p anywhere in it.
• Show online status icons differently when an account is not in a visible world and sort them with a lower priority.

Internal changes:

• Pressing CTRL-SHIFT-E will now redact everything except world and session names.

0.0.1-alpha.4

Features:

• Add a button in the dropdown to unmerge all accounts from a user.
• Add :confusables search term, which will consider some Cyrillic characters equivalent to visually similar Latin characters.
• In compact mode, show all the user's accounts when the search term refers to matches pertaining to different accounts.
• When recent notes are retrieved, the note is now immediately written to the storage rather than requiring a data collection pass.

Fixes:

• In compact mode, keep showing the user's accounts even when has:alt or accounts:>1 is used.
• Auto-reconnect to the VRChat WebSocket when the server resets the connection.
• Auto-reconnect to the Resonite SignalR when the server resets the connection.
• If "429 Too Many Requests" is received from the VRChat API, wait for 70 seconds before retrying.
• Resonite user identifiers can now be searched.

Changes:

• Pressing CTRL-SHIFT-D will switch into debug mode. Debug mode redacts all personal information and links from the UI.
• Add Resonite icon.
• GitHub workflow now creates the ZIP file as XYVR, not xyvr.
• In the logs, print the version number.
• In the logs, tag the reason why a live update is triggered.

Internal changes:

• The code now uses TypeScript in place of JavaScript.
• package.json now uses exact version numbers.
• Split data retrieval structures from data storage structures.

0.0.1-alpha.3

Features:

• Add live status updates using Resonite SignalR API.
• Add live status updates using VRChat Websocket API.
• Display the status of each account.
• Order the results by the most permissive status first.
• Add a new compact view, accessed using a toggle.
  • In the compact view, only accounts that match the search are shown, contrary to the full view.
• Add toggle to show or hide notes.
• Add dropdown to merge accounts belonging to the same user.

Changes:

• Replace emojis with icons.
• On the login screen, add links to the privacy docs.
• In Resonite GetContacts, contacts who aren't accepted yet are no longer considered to be contacts.
• When "Stay logged in" is checked, we will now request a longer expiring session token from the Resonite auth API.

Internal changes:

• Change how contacts are retrieved from Resonite.
• Don't save the Resonite UID file if it existed already.
• Add rate limiting to the Resonite API at two requests per second.

0.0.1-alpha.2

• Fix VRChat login is now possible with two-factor TOTP (authenticator instead of email).
• Middle clicks on links now open it in the default browser rather than in a WebView popup.

0.0.1-alpha.1

First alpha:

• Login, collect, and browse functionality are barely just working.