What's Changed

• feat(editor): unify Core Framework into one tabbed panel with declarative management by @DavidBabinec in #123
• feat(editor): consolidate left panels into one tabbed Explorer panel by @DavidBabinec in #128
• fix(spotlight): keep highlighted row in view by @DavidBabinec in #125
• fix(onboarding): open framework import ready to import (pre-select Full) by @DavidBabinec in #129
• Fix AI token tool argument leniency by @nguyenngothuong in #121
• feat(editor): drag media assets onto canvas by @DavidBabinec in #112
• fix(security): audit follow-ups — response headers, import SVG sanitization, MCP token expiry by @DavidBabinec in #115
• fix(editor): refresh framework state after onboarding changes by @DavidBabinec in #130
• fix(editor): make canvas mouse scroll use shift-wheel sideways by @DavidBabinec in #127
• chore(release): prepare 0.0.8 by @DavidBabinec in #131
• chore(release): complete 0.0.8 notes by @DavidBabinec in #134
• test(canvas): stabilize breakpoint dimming assertion by @DavidBabinec in #135
• test(canvas): scope breakpoint dimming query by @DavidBabinec in #136
• fix(docker): exclude tests from release image build by @DavidBabinec in #137

New Contributors

• @nguyenngothuong made their first contribution in #121

Full Changelog: v0.0.7...v0.0.8

What's Changed

• feat(framework): import Core Framework defaults from onboarding by @DavidBabinec in #91
• fix(security): harden sanitizers and regexes flagged by CodeQL by @DavidBabinec in #94
• feat(ai): MCP connectors — expose CMS tools to external AI clients by @DavidBabinec in #109
• docs(readme): link interface demo video by @DavidBabinec in #111
• chore(release): prepare 0.0.7 by @DavidBabinec in #114

Full Changelog: v0.0.6...v0.0.7

What's Changed

• fix(data): avoid blob-backed site export downloads by @DavidBabinec in #75
• fix(templates): resolve dynamic data in outlet previews by @DavidBabinec in #78
• feat(agent): add runtime code asset tools by @DavidBabinec in #76
• refactor(editor): split non-site workspace layout state by @DavidBabinec in #79
• fix(spotlight): use active canvas tree for layer commands by @DavidBabinec in #82
• refactor(styles): simplify admin color token vocabulary by @DavidBabinec in #85
• refactor(admin): add fluid typography token scale by @DavidBabinec in #86
• refactor(admin): add fluid spacing token scale by @DavidBabinec in #87
• fix(content): hide empty settings panel by @DavidBabinec in #89
• fix(import): stream site transfer bundles and unify review flow by @DavidBabinec in #77
• refactor(site-import): reuse CMS media client by @DavidBabinec in #80
• refactor(page-tree): reuse traversal selectors in form analysis by @DavidBabinec in #81
• refactor(admin): remove circular deps and recover lazy HMR loads by @DavidBabinec in #83
• fix(cms): stop auto-creating post type templates by @DavidBabinec in #88
• test(quality): expand feature validation coverage by @DavidBabinec in #84
• chore(release): prepare 0.0.6 by @DavidBabinec in #90
• test(ui): isolate toast bus state between tests by @DavidBabinec in #92

Full Changelog: v0.0.5...v0.0.6

What's Changed

• fix(publisher): render current entry body in any content outlet by @DavidBabinec in #62
• fix(canvas): render base.text tag:none as bare text to match published DOM by @DavidBabinec in #63
• fix(export): server-accurate export size estimate (incl. media) by @DavidBabinec in #64
• docs(readme): rewrite the GitHub front page in a human voice with deeper feature detail by @DavidBabinec in #69
• feat(data): granular full-site export dialog + cmd+k Export by @DavidBabinec in #68
• refactor(editor): make saved layouts the single source of truth by @DavidBabinec in #66
• fix(content): route collection create/update/delete through step-up by @DavidBabinec in #72
• feat(data): split system/custom table capabilities and lock system tables by @DavidBabinec in #71
• fix(agent): create loops through HTML import by @DavidBabinec in #70
• fix(editor): make Settings modal and toolbar trailer truly global by @DavidBabinec in #67
• feat(agent): add document-targeted site tools by @DavidBabinec in #73
• chore(release): prepare 0.0.5 by @DavidBabinec in #74

Full Changelog: v0.0.4...v0.0.5

What's Changed

• Standardize on GHCR; drop the unconfigured Docker Hub mirror by @DavidBabinec in #20
• Per-stylesheet import modes; remove generated import scope classes by @DavidBabinec in #15
• Fix import fidelity: rgba color tokens and import-from-anywhere by @DavidBabinec in #19
• Make var()/env() declarations engine-proof at the import boundary by @DavidBabinec in #21
• Fix plugin useCanvasNodeRect: measure real canvas nodes, not admin chrome by @DavidBabinec in #22
• perf: fix critical hot paths across publish pipeline, public serving, and editor store by @DavidBabinec in #24
• Remove AI credential authentication selector by @DavidBabinec in #30
• perf: incremental site saves; hoist runtime builds out of the publish transaction by @DavidBabinec in #27
• perf(canvas): kill per-node selector storms, per-frame DOM re-measures, and whole-site loop subscriptions by @DavidBabinec in #28
• perf(plugins): handle-based VM dispatch, native base64, and indexed content-API lookups by @DavidBabinec in #29
• Content Outlet availability + toast layering; close outlet invariant holes by @DavidBabinec in #23
• Per-module published-JS channel; migrate the form runtime onto it by @DavidBabinec in #26
• Inline text editing on the canvas (double-click to edit) by @DavidBabinec in #25
• Clean up Style-rules review pane + fix icons:sync for in-house icons by @DavidBabinec in #31
• Fix template read-only hint/open firing over editable page content by @DavidBabinec in #32
• feat(editor): user-saved layouts — save any subtree, re-insert it exactly by @DavidBabinec in #33
• fix(canvas): live mode shows the shared frame skeleton while hydrating by @DavidBabinec in #35
• Remove inconsistent panel keyboard shortcuts from the rail by @DavidBabinec in #36
• feat(canvas): open design mode at 50% zoom; pin live mode to 100% by @DavidBabinec in #34
• fix(cms): homepage swap + delete in one save no longer fails publish by @DavidBabinec in #37
• refactor(publish): one-way layering — repositories never import the publish layer by @DavidBabinec in #38
• refactor(publisher): single class-CSS emission engine for publish and canvas by @DavidBabinec in #39
• fix(media): retina screens download the WebP variants, not the multi-MB original by @DavidBabinec in #40
• refactor(explorer): one structural-row enumeration + shared dnd pointer math by @DavidBabinec in #46
• docs(agents): document PR conventions by @DavidBabinec in #50
• Add a "Not found" template target for designed 404 pages by @DavidBabinec in #52
• refactor(vc): one slot-outlet collector — export it from @core/visualComponents by @DavidBabinec in #44
• refactor(vc): split vcTreeOps out of visualComponentsSlice by @DavidBabinec in #47
• feat(editor): double-click rows to rename in explorer panels by @DavidBabinec in #49
• chore(cleanup): dead-code spring cleanup — knip reports zero unused surface by @DavidBabinec in #41
• refactor(siteImport): one adapter contract, phase-decomposed pipeline, deduped helpers by @DavidBabinec in #42
• refactor(siteImport): decompose conflict-resolution hotspots into named concerns by @DavidBabinec in #43
• feat(publisher): derive from the layout — remove the manual Sizes field by @DavidBabinec in #45
• fix(ai): tools inherit caller capabilities instead of ai.chat acting as a blanket read grant by @DavidBabinec in #51
• fix(editor): apply node inline styles in read-only composed canvas content by @DavidBabinec in #54
• fix(admin): redirect unknown admin URLs to the dashboard instead of a blank page by @DavidBabinec in #55
• chore(release): prepare v0.0.4 by @DavidBabinec in #56
• fix(test): make canvas breakpoint-frame tests wait on readiness instead of fixed sleeps by @DavidBabinec in #57
• refactor(canvas): mount breakpoint frames directly, drop progressive staggering by @DavidBabinec in #58
• test(canvas): render CanvasTransformLayer directly in the no-staggering test by @DavidBabinec in #59
• test: stub user-preference fetches in global setup to stop a cross-test ECONNREFUSED leak by @DavidBabinec in #60
• test: register global afterEach(cleanup) so RTL trees don't leak across files under bun by @DavidBabinec in #61

Full Changelog: v0.0.3...v0.0.4

What's Changed

• [codex] Update toolbar site branding by @DavidBabinec in #8
• Harden plugin sandbox against hangs and preserve VM stack traces by @DavidBabinec in #4
• Make plugin fetch and HTTP routes binary-safe by @DavidBabinec in #5
• Push admin settings changes to running plugin VMs by @DavidBabinec in #2
• Namespace plugin-emitted hook events to plugin..* by @DavidBabinec in #6
• Fix plugin scheduler: cancel namespacing, pause persistence, disabled-plugin fires, ghost sweep by @DavidBabinec in #3
• Mask secret plugin settings on every client-facing payload by @DavidBabinec in #7
• Encrypt plugin secret settings at rest in a dedicated plugin_secrets table by @DavidBabinec in #12
• Add force-uninstall escape hatch and run deactivate before uninstall by @DavidBabinec in #9
• Require editor.code permission for unsandboxed admin-window plugin code by @DavidBabinec in #10
• [codex] Fix data table step-up flow by @DavidBabinec in #11
• docs(deployment): TRUSTED_PROXY_CIDRS and Railway/Render template hardening by @DavidBabinec in #13
• Decouple CSRF origin from proxy trust via PUBLIC_ORIGIN; drop 0.0.0.0/0 from templates by @DavidBabinec in #14
• Revamp README: screenshots, one-click Railway deploy, real voice by @DavidBabinec in #16
• Prepare v0.0.3 release by @DavidBabinec in #17
• Stabilize flaky plugin sandbox infinite-loop abort test by @DavidBabinec in #18

New Contributors

• @DavidBabinec made their first contribution in #8

Full Changelog: v0.0.2...v0.0.3

Full Changelog: v0.0.1...v0.0.2

Full Changelog: https://github.com/CoreBunch/Instatic/commits/v0.0.1