Changelog

• 2FA (TOTP) — turn it on under Account with any authenticator app. Eight one-time recovery codes, codes can't be replayed, and an admin can reset a locked-out user. Docs →
• Active sessions — see every signed-in device (browser, IP, time) and sign out one or all others.
• API key limits — restrict a key to collections, give it an expiry date or a requests-per-minute limit. Applies to the REST API and MCP. A new dialog replaces the prompt chain.
• Editor layout — custom fields now live in a collapsible “Details” card in the main column (grouped, two per row, long inputs full width; remembers open/closed per collection) instead of small boxes in the sidebar, so the body stays the main content. Collections without a body field drop the block-editing tools. Also fixed: validation errors on publish were never shown, the long dock popups in Station mode (many collections / tools) now scroll instead of running off the screen, and the Schema page can be scrolled in Station mode again.
• Webhook recipes — tested receiver plus copy-paste handlers: Slack/Telegram on review, IndexNow, Cloudflare purge, Mastodon. Docs →
• AI translation of missing locales — one click in the editor creates the missing language versions as drafts (never overwrites, never publishes). Docs →
• Image variants + focal point — /orbiter/media/<id>?w=800&fmt=webp&ar=16:9 serves a resized, re-encoded or cropped version; crops keep the focal point you set in the media library. Bounded and cached. Docs →
• Review workflow — optional. Editors submit entries for review; admins and the new reviewer role approve or request changes. Enforced on every publishing route. Docs →
• Preview links — the editor's Preview button now uses a one-hour token bound to that entry instead of the master preview token (which also fixes previews for editors, who only got a masked token before).
• Version diff — see field by field what a restore would change. Restoring now keeps the content it replaces, so a restore can be undone (previously the replaced content was lost, and the newest snapshot couldn't be restored at all).
• Media usage — each file shows where it is used; filter Unused files and Broken refs; deleting a file that is in use warns first.
• Signed webhooks — HMAC-SHA256 signatures, retries (5 s, 30 s, 5 min) and a delivery log, managed in Settings. Webhook URLs are now admin-only (editors could previously set them). Docs →

• orbiter doctor + dashboard card — flags a pod tracked by git, plaintext credentials, an open Content API and more, with the fix next to each finding. Docs →
• Encrypted secrets — set ORBITER_SECRET and stored FTP/SMTP/AI/GitHub/S3 credentials are encrypted at rest (AES-256-GCM). Opt-in; nothing changes without it.
• Draft-only keys for agents — an API key can be allowed to create and edit drafts over MCP. It can never publish or touch live entries.
• Terminal theme — a fourth palette: amber phosphor on near-black, with a warm paper light variant.
• Admin polish — Settings style cards show their active state, the style default matches the app, leaving the XFCE dock reloads cleanly, visible keyboard focus, and reduced-motion support.

A second pass over the admin and core packages after the previous release. Update @a83/orbiter-admin, @a83/orbiter-core and @a83/orbiter-integration together — the new media headers live in core.

• GitHub push no longer ships secrets — the GitHub push feature committed the whole .pod, including live session tokens, password hashes and stored credentials (FTP, SMTP, AI and GitHub tokens). It now pushes a scrubbed copy. If you pushed before, rotate those credentials and check your repo history.
• Uploaded files can't run script — media is served with nosniff and a sandboxing CSP, and anything that isn't an image, video, audio or PDF is forced to download. Applies to the admin and the public /orbiter/media route.
• Server-side request forgery — importing or linking media by URL could be pointed at internal addresses (localhost, private networks, cloud metadata). Private and reserved targets are now blocked, redirects re-checked, downloads capped at 50 MB. Set ORBITER_ALLOW_PRIVATE_FETCH=1 if you need to import from your LAN in development.
• Login rate limit — it trusted a client-supplied X-Forwarded-For header, so it could be bypassed. The header is now only honoured when the connection comes from a reverse proxy on a private address.
• Restricted editors — AI suggestions, the collection list/detail, /api/info and the quality report no longer expose collections an editor isn't allowed to see. Form-builder configs are admin-only.
• Content API drafts — with the API enabled but no token set, ?status=draft on /orbiter/api/[collection] returned unpublished entries to anyone. Drafts now require a configured, matching token.
• API token hashed — the optional single api.token is now stored as a SHA-256 hash like API keys (existing plaintext values keep working and migrate on first use).
• Desktop app — the embedded server only listens on loopback (it was reachable from your LAN), the window is sandboxed, only http(s) links are handed to the OS, and navigation away from the local admin is blocked.
• Smaller fixes — CSV export works again and neutralises spreadsheet formulas, the login no longer reveals which usernames exist through timing, WordPress media import is covered by the same SSRF protection, and /health no longer exposes the pod path.
• Sessions and public endpoints — changing a password signs out all other sessions. The public form and analytics endpoints are rate-limited and size-capped, and notification mails are capped. The Content API token is compared in constant time.

A researcher privately reported three vulnerabilities in the admin and core packages. All three are fixed and released. Finding them prompted a broader audit of the rest of the codebase, which turned up more of the same pattern — all fixed below, plus a dependency and process cleanup so the next one is easier to report and faster to close.

• Stored XSS — unescaped field names/IPs in the Inbox, unescaped media filenames and analytics paths from fully unauthenticated endpoints, and the same pattern in apps/demo's public post/page/event pages. Fixed with consistent escaping (and DOMPurify on the demo frontend) everywhere user- or visitor-supplied text reaches innerHTML.
• Collection permission bypass — an editor restricted to specific collections could still reach draft content via the singleton endpoint, the terminal CSV/JSON export, search/calendar widgets, comments, and edit-locks. All now enforce the same requireCollectionAccess check as the main entry routes. See the new permissions docs.
• Path traversal — the local media backend's folder parameter could write outside the configured media directory; the GitHub and S3 backends had the same unvalidated join. All three now resolve and reject anything that would escape the configured root.
• Plaintext API keys — Bearer tokens for the Public Content API and MCP server were stored and compared in plaintext, inside a .pod file that Orbiter's own orbiter init template commits to git by design. Now hashed (SHA-256, constant-time compare), with transparent migration for already-issued keys.
• Missing/inverted access checks — api-keys management, schema field rename/delete, and the embeddable-widget endpoint (/api/widget/:collection — inverted logic made it allow-by-default instead of deny-by-default like every other API gate) each had a broken or missing permission check. All fixed.
• Dependency audit — npm audit went from 40 vulnerabilities to 0: removed an unused, outdated electron-builder devDependency pulling in most of them on its own, bumped nodemailer/sharp/adm-zip/electron to patched versions, and — the big one — Astro 5 → 7 and @astrojs/node 9 → 11 across apps/demo, apps/landing, and the orbiter init scaffold template, closing a critical RCE in Astro's AVIF image optimization.
• Process — new SECURITY.md, GitHub private vulnerability reporting and Dependabot security updates turned on for the repo, and a weekly npm audit CI check.

• @a83/orbiter-mcp — new MCP server package. list_collections, get_entries, get_entry, search_content tools for Claude Desktop and other MCP clients. stdio for local trusted access, --http for remote (same auth as the Public Content API).
• Public Content API — /api/public/[collection] read-only JSON endpoints, opt-in per collection, CORS enabled.
• API keys — generate/revoke Bearer tokens in Settings, optional enforcement on the Public Content API and MCP HTTP transport, hit counters and last-used tracking.
• JSON-LD / schema.org — BlogPosting and WebSite structured data on published HTML, both themes.
• OpenAPI spec + API discovery — auto-generated spec and a discovery endpoint listing available collections and auth requirements.
• Admin panel routing fix — clean extensionless URLs (/login, /dashboard, etc.) now redirect correctly.

• Content validation — schema fields support required, min, max, and regex. Drafts always save freely. Publish/Schedule shows an inline error banner. Server enforces the same rules via 422.
• Collection permissions — restrict editor users to specific collections. Configured per-user in a checkbox modal. Admins are always unrestricted.
• Content quality dashboard — sidebar panel scans all published entries for missing body, short body, no image, and no SEO metadata. Issue counts at a glance.
• Schema migration — rename a field including all entry data in one atomic transaction. Also: change-type and delete-field routes.
• Multi-pod dashboard — link multiple pod files, see published count, collections, size, and last modified across all projects in one page.
• orbiter encrypt/decrypt — AES-256-GCM with scrypt key derivation. Commit the .pod.enc to git, decrypt in CI with a secret.
• orbiter sync — rsync push/pull in one command. orbiter status — pod health in the terminal.
• SvelteKit support — @a83/orbiter-client opens the pod directly from any Node.js framework. <OrbiterImage> Astro component with auto lazy, alt, and dimensions.

• Astro Content Layer — orbiterLoader() for build-time, orbiterLiveLoader() for SSR. Use getCollection() from astro:content instead of the custom virtual module. Auto Zod schema, hot reload on pod changes.
• Smart Suggestions v2 — multi-section panel with tags, cross-collection related entries, AI SEO title & description, content quality hints, suggestedPrompts. Manual ✦ Suggest button grouped with ✦ AI.
• Publish HTML — one-click static site. Two themes: Orbit (modern) and Canvas (editorial whiteboard). Dark mode, responsive, OG tags, reading time.
• CLI — orbiter publish generates HTML from terminal, orbiter backup creates timestamped pod copy.
• UI polish — dashboard greeting, live word count, pulsing autosave dot, favicon badge, pod size in sidebar, collection color dots, relative timestamps, shortcut hints.

• Calendar view — full month-grid page with color-coded entries (scheduled/expiring/published/draft). Click a day to see entries, filter by status, keyboard nav. Dashboard widget with mini calendar + upcoming list.
• Simple Analytics — privacy-friendly pageview tracking stored in the POD. No cookies, no external scripts, <500 bytes. Bot detection (GPTBot, ClaudeBot, etc). Dashboard with daily chart, top pages, referrers. Human vs. agent traffic split.
• Cross-pod import/export — export all collections + entries as JSON. Import from a .pod file or JSON export. Collections created automatically, skip or overwrite duplicates.
• Desktop auto-update — the Electron app downloads new releases from GitHub in the background. Universal macOS DMG (M1 + Intel in one file). One-click backup (⌘⇧S).
• Table field — mini-spreadsheet as a schema field type. Header row, data rows, add/remove rows and columns, Tab navigation. Stored as string[][].
• Dashboard widget toggles — enable/disable Calendar, Recently Edited, Collections, Notes & To-Do in Settings.
• OG Image picker — media picker modal in the SEO panel instead of a dropdown. Image preview + clear button.

• Templates on first launch — choose Blog, Portfolio, Business, or Events. The app creates all collections and fills them with demo content so you can see how everything works right away.
• macOS — DMG installer, drag to Applications, double-click. Apple Silicon (arm64) and Intel (x64).
• Windows — NSIS installer wizard, optional install directory. x64.
• Self-contained — Electron bundles the full admin server. Runs locally, no internet required after install.
• Multi-site switching — File → Switch POD (⌘O) switches to a different content database and restarts instantly.

• Command palette — ⌘K or / opens a full-screen palette. Opens with recent entries pre-loaded. Type > to enter command mode: > ls, > go, > new, > search, > build, > export, > random, > = expr (math evaluator). Command history with ↑/↓.
• Vim keyboard navigation — press g then a letter to jump to any page: g d dashboard, g m media, g h HUD, g s settings, g b build, and more. Animated g › indicator in the status bar while waiting for the second key.
• Notification center — bell icon in the status bar. Every save, build trigger, and export is logged automatically. Dropdown panel with unread badge, relative timestamps, and clear-all.
• HUD panel expanded — Drafts section (last 10 drafts, clickable to editor) and Activity feed (last 8 events as a live timeline). Opens with g h or the dock button.
• Zen / focus mode — ⌘⇧F hides the dock and status bar for distraction-free writing. Persists across reloads. Toast hint on enter.
• Shortcut cheatsheet — ? key or ? button in the status bar opens a two-column modal with every shortcut and palette command.
• Live build status — status bar shows ◉ building… with a pulse animation while a build is running, polling every 4 seconds until done.
• Breadcrumb in status bar — when inside a collection, the center shows Collection › Entries with a clickable link back.
• Left dock mode — toggle dock position between bottom and left side. All popups, overlays, and magnification axis adapt automatically.
• Hover preview cards — hovering a collection in the dock shows a card with the 3 most recent entries and quick-action buttons (new entry, view all, export).

• Space Station mode — a distinct admin layout: floating magnification dock (macOS-style), HUD status-bar panel with stats and notes, frosted glass page headers with contextual action buttons. Toggle in Settings → Interface → Layout.
• Mobile tab bar — in Station mode, the dock collapses to a native-feeling bottom tab bar on screens under 768 px. Stats stack to a 2×2 grid; cards resize automatically.
• Multilingual (i18n) — per-entry locale variants using a dedicated locale column (not slug suffixes). Configure locales in Settings → Language; locale tabs appear in the editor automatically. getLocaleCollection() and getLocaleEntry() in orbiter:collections with automatic fallback to the default locale.
• Settings two-column layout — settings groups reflow into a responsive two-column grid to reduce scrolling. Save button pinned to the page header and repeated at the bottom.

• Scheduled publishing — set a publish_at date on any entry. A server-side scheduler auto-publishes and fires the build webhook. Also supports unpublish_at to revert published entries to draft at a future date.
• Content comments — per-entry editorial comment thread directly in the editor. Post, resolve/unresolve, and delete comments. Stored in a _comments table, never mixed with entry data.
• RSS feeds & XML sitemap — /orbiter/rss/[collection].xml and /orbiter/sitemap.xml injected automatically by the integration. No configuration needed.
• Schema export & import — download any collection's schema as JSON, re-import to another collection or pod. Export/Import buttons in the schema edit panel.
• CSV import & export — bulk entry management. Export all entries as CSV, import to create or update by slug.
• Entry locking — when you open an entry, the editor claims a lock. If another user is already editing, a warning banner appears. Lock expires after 90 s without a heartbeat.
• Email notifications — configure SMTP in Settings. Get an email on publish and/or new comment. Powered by nodemailer, always async.
• Required field validation — fields marked required in the schema block saves (non-autosave) until filled.
• Image optimization — uploaded images are resized and compressed automatically via sharp. Max-width and quality configurable per pod in Settings.

• Trash / soft delete — deleted entries move to a recoverable Trash tab. Restore to draft or permanently delete. Bulk restore and bulk purge supported.
• Activity log — every create, update, publish, unpublish, delete, and restore is recorded with the acting user and timestamp. Visible in the editor's meta panel.
• Draft preview — generate a preview token in Settings → API and attach it to your preview URL. getPreviewEntry() in orbiter:collections reads any draft directly from the pod, bypassing the published-only snapshot.
• Schema field drag-sort — reorder fields in the schema editor with a drag handle. Order is preserved in the stored schema.
• Rate limiting — login endpoint is limited to 5 attempts per 15 minutes per IP. Returns 429 with a human-readable message.
• TypeScript types — orbiter-env.d.ts is auto-generated at build time with per-collection interfaces and typed overloads for all query functions.

• Singleton collections — mark a collection as singleton to skip the entries list and go straight to the one record. Good for site settings, about pages, or any single-document content.
• Drag-to-sort entries — reorder entries manually with a drag handle. Order persists in the pod and is reflected in getCollection() output.
• Callout blocks — type /note in the block picker to insert a tinted info/warning box inline with prose.
• Table blocks — type /tbl for an editable 2×2 table. Tab to navigate cells, toolbar to add/remove rows and columns.
• Boolean field — on/off toggle field type for schema definitions.
• Preview URL per collection — set a URL template with {slug} in Schema; an ↗ Preview button appears in the editor topbar.
• Version display — admin sidebar footer now shows Orbiter vX.Y.Z · pod vN so you always know what's running.