Unreleased
LatestChanged
- Deleting a post now preserves its reusable originals in the Media Library; permanent file removal is owned by the library instead
- Instagram and TikTok publishing now share a provider contract and registry, making future network integrations additive instead of requiring worker branching
- Self-hosted media storage now defaults to a persistent local volume and can switch to generic S3-compatible storage or Cloudflare R2 through configuration
- Publishing setup now gives first-time account connection actions the same prominent branded treatment as landing-page calls to action
- The setup guide now documents FeedbackBasket as an optional paid waitlist integration, including project ID setup and the replaceable provider boundary for open-source deployments
- The public landing page can now switch between general availability and prominent inline FeedbackBasket signup forms through environment configuration, with coordinated animated waitlist signals and no login detour
- Refined the authentication page with higher-contrast navy and teal accents, clearer workspace-creation styling, and a cleaner form footer without the redundant home link
- The official hosted application, CLI, MCP, metadata, and email defaults now use `getrolino.com` as the canonical managed-service domain
- Clarified Rolino's single-codebase open-source SaaS model: the production web application and server now use AGPL-3.0-or-later, integration-facing packages remain MIT, managed Stripe subscriptions pay for the official hosted service, and canonical self-hosting requires neither hosted billing nor a license key
- Reworked the landing-page feature section into a spacious, product-led publishing canvas with original campaign imagery, softly floating social-network marks, and visual media, caption, preview, scheduling, validation, and human-approved agent handoff stories
- Prepared Rolino's source tree for its dedicated public repository with product-neutral examples, honest workflow proof instead of implied customer endorsements, and repository links that resolve to `deifos/rolino`
- CLI authorization now starts with read-only access and uses accessible shadcn checkbox cards so users explicitly choose draft, scheduling, and immediate-publishing permissions; existing credentials remain unchanged
- Compacted the desktop CLI authorization screen to keep approval actions in view and brought the local terminal handoff page into Rolino's visual brand
- Agent contract discovery now reports version 0.7.0, advertises browser CLI authorization, and exposes separate identity, project, post-read, draft-write, confirmed-scheduling, confirmed-publishing, integration-health, and calendar capabilities
- New CLI and trusted-host credentials explicitly grant confirmed scheduling and publishing while older credentials retain their original scopes until reauthorized
- CLI authorization now clearly grants identity and workspace reads, draft creation and editing, confirmed scheduling, and confirmed publishing while remaining unable to delete, manage teammates, access social credentials, or bypass confirmation
- Existing agent credentials retain their original scopes; users must reauthorize to add draft-write access rather than having permissions expanded silently
- Agent API keys now expire after 90 days by default across every creation path, require explicit organization binding, and fail closed for stale session organizations
- CLI and MCP timeout configuration now shares one parser for milliseconds and `ms`, `s`, or `m` duration values
- Local stdio MCP now reuses the browser-authorized, host-scoped CLI credential through a neutral Node-only package, while keeping `ROLINO_TOKEN` as the explicit headless override
- The CLI now has an exact dependency allowlist and remains Axios-free by using the SDK's native `fetch` transport
- Agent access now clearly communicates its organization-wide scope and uses the available desktop width for a dedicated setup rail while preserving a stacked responsive layout
- Organization-wide Agent access now lives in the global Workspace navigation instead of a brand's settings, and credential revocation validates organization membership directly
- Agent setup copy controls now sit above full-width command blocks so CLI and MCP instructions remain readable without horizontal scrolling
- Self-hosted agent setup now prefers the runtime canonical authentication URL, allowing one generic container image to serve different domains without a Vercel build-time setting
- The portable scheduler now runs publishing and agent coordination cleanup together and reports bounded cleanup counts in its structured tick log
- Post versions now advance for web edits, media changes, scheduling, publishing, and worker status aggregation so agent `If-Match` checks also detect changes made outside the public API
- The Agent access screen is now focused on connections and setup, with workspace and revocation guidance above the connection list while setup remains visible in the right rail; its CLI-to-MCP showcase now appears on the public landing page
- Destructive UI actions now follow a repository-wide shadcn confirmation-dialog standard, including explicit cancellation and destructive confirmation treatments
- Expanded contributor and self-hosting security guidance for agent API keys, package-boundary validation, MCP stdout isolation, and the remote transport security gate
- Simplified the signed-in sidebar brand header and focused Connections on launch-ready Instagram and TikTok publishing accounts while hiding unfinished providers and empty sections
- Centralized Rolino's product palette across semantic UI tokens, installed-app metadata, onboarding defaults, and authentication emails so future color changes happen in one configuration
- Repositioned the public landing page around open-source Instagram and TikTok publishing, with direct human-and-agent messaging, a clear upload-to-publish workflow, agent-ready automation, and a populated product calendar that hides unfinished modules
- Refreshed the app-wide design tokens with Rolino's yellow primary actions, yellow-tinted hover, selection, navigation, and status states, navy-tinted neutrals, accessible focus colors, and coordinated chart and dark-mode palettes
- Unified new-brand defaults, installed-app metadata, and authentication emails with Rolino's yellow identity
- Focused the public launch navigation, dashboards, onboarding, landing page, and sign-in experience on social scheduling and publishing while preserving Ideas, Campaigns, Research, Analytics, and Ask Rolino for later releases
- Reorganized the post composer into a compact workspace with an independently scrollable publish setup panel
- Scheduled posts now refresh provider health before delivery and move to Action Required after repeated unknown results or an overdue grace window
- TikTok publishing settings now validate creator privacy, interaction, disclosure, duration, consent, and video-cover choices before delivery
- Made the changelog accessible from the public landing page and signed-in workspace, with this file as its single source of truth
- The signed-in sidebar changelog link now shows the latest version and last-updated date
- Reduced the sidebar mascot card footprint so navigation stays visible without unnecessary scrolling
- TikTok draft delivery now refreshes live creator health before immediate and scheduled submissions
Fixed
- CLI authorization now presents optional permissions in a readable two-column layout with clearer descriptions instead of squeezing them into narrow cards
- The Media Library now uses compact, format-aware masonry cards with uncropped previews, shorter portrait frames, accurate collection totals, cursor-based loading beyond 200 assets, accessible in-use guidance, and direct links to referenced posts
- Concurrent Media Library attachment and deletion races now return actionable conflicts, while queued storage cleanup is reported as pending instead of failed
- Social OAuth callbacks now require a one-time, user-bound grant and revalidate current workspace membership before connecting an account
- Media uploads now bind completion to an expiring upload intent, reject replayed local uploads, sign the expected byte length, and clean abandoned objects
- Email-code delivery diagnostics now use opaque browser tickets instead of exposing status lookups by email address
- Research prompts now isolate fetched pages, search results, and prior model output as untrusted data so embedded instructions cannot redefine the agent task
- Rescheduling a partially published post now leaves completed destinations untouched, preventing duplicate social posts
- Publishing workers now use fenced, renewable database leases and quarantine unknown expired attempts instead of risking duplicate provider submissions
- Confirmation dialogs now use a wider, better-spaced layout with larger text so destructive choices and their consequences are easier to read
- Self-hosted database readiness now recognizes the latest storage-cleanup migration instead of reporting fully migrated deployments as pending
- Post cards now use a responsive masonry layout that preserves a consistent card width even when only one post remains, with compact shadcn-composed sections and bounded previews that keep portrait or landscape media fully visible
- Authentication now describes email sign-in codes consistently and keeps email-provider configuration details out of user-facing delivery errors
- The changelog now combines repeated category headings within a release, preventing duplicate-section rendering errors while preserving every entry
- The landing-page audience strip now keeps labels intact, balances its five meaningful groups, and removes the stray “Your workflow, too” placeholder
- The public footer now uses a deliberate centered mobile layout with clearer separation between navigation, creator credit, and copyright
- Production builds now generate the Prisma client from a fresh checkout before compiling the application
- Prisma migration commands now prefer a direct database URL, preventing pooled Supabase connections from stalling production migrations
- The idea-to-insight migration now respects the configured PostgreSQL schema instead of assuming `public`
- Pinned the patched HTTP router used by Prisma tooling to prevent the disclosed HTTP/2 denial-of-service vulnerability
- Cross-platform CI now discovers TypeScript tests without shell glob expansion and compares installed MCP paths through their canonical filesystem locations on macOS
- TikTok draft uploads now use one compact sticky status surface instead of repeating outcomes below the composer, keep processing and provider failures visible without a refresh, explain pending-share limits in plain language, say successful handoffs were sent to the mobile inbox instead of published, explain the required in-app completion and caption handoff, exclude inbox deliveries from published totals, and prevent accidental duplicate sends
- Fresh-clone test runs now generate the Prisma client automatically with a non-connecting fallback used only for generation, while migration and deployment commands still require an explicit database URL
- CLI-only installations now explain the exact `@rolino/mcp` installation command when MCP setup is requested, while source checkouts continue to use their local built server
- Expired CLI browser approvals are now detected before the form renders or submits, explain that the terminal stopped waiting, disable futile resubmission, and direct users to close the page and start `rolino auth login` again
- Widened and reorganized the desktop CLI authorization canvas so its request summary stays on one line and account context, workspace selection, permissions, safety guidance, and approval controls fit without cramped copy or unnecessary page scrolling
- Immediate publishing now rechecks destination retry safety inside the commit transaction so a concurrent ambiguous provider result cannot be queued
- Publish commands now report a missing required `--platform` option directly instead of surfacing a later schema-validation error
- Immediate-publish CLI responses now label due-now work as queued instead of making it look like a future schedule
- CLI authorization permissions now reflow into readable two-column cards instead of compressing four capabilities into narrow desktop columns
- Clean Linux installs now resolve a compatible SWC helper version, and container builds provide Prisma's required OpenSSL runtime without relying on host-installed dependencies
- Small destructive confirmation dialogs now give action labels enough room on desktop and stack their buttons on narrow screens
- Updated Prisma and transitive URL-parser and image-processing dependencies to patched releases after upstream security advisories
- Self-hosted processes no longer emit a missing-Google-provider warning when Google OAuth credentials are intentionally not configured
- Agent API-key creation now regenerates Prisma and uses Better Auth's adapter-compatible `apikey` model name, preventing false missing-model failures after migration
- Restored the complete destination borders in Publish setup and made platform selection explicit with empty and checked square icons
- Removed unnecessary desktop page scrolling when the calendar or a content-light posts view already fits in the viewport, while preserving scrolling for longer content and smaller screens
- Kept the highlighted "humans and AI agents" hero phrase together on one line at desktop widths
- Aligned the landing-page calendar mockup's active states, scheduled posts, and account accents with the yellow primary theme
- Kept the landing-page mascot clear of the hero copy and matched the calendar mockup's compact sidebar footer treatment
- Show the complete number of posts needing attention on the publishing dashboard even when the issue list is capped
- Reconcile already-published Instagram containers instead of attempting to publish the same container again
- Prevent scheduled posts from stalling silently when provider health remains unavailable
- Reject out-of-range TikTok video-cover timestamps during readiness validation
Added
- Optional, least-privilege project-creation access for agents, with paired-brand semantics and no automatic research, connection, scheduling, or publishing
- Permanent Media Library deletion with explicit confirmation, in-use protection, and durable storage cleanup retries
- A self-hosting doctor command, authenticated Prometheus publishing metrics, complete PostgreSQL-and-media backup guidance, and restoration verification steps
- Docker Compose smoke validation in CI and immutable version-tagged multi-architecture runtime, migration, and tooling container releases
- Database integration coverage for publishing lease fencing and one-time, membership-bound OAuth grants
- Durable publishing lease, OAuth connection grant, and upload-intent records with automatic maintenance cleanup
- Website-free onboarding for personal and pre-launch brands, with optional manual context and no automatic website discovery or research
- Visible per-post deletion with a roomier confirmation dialog, scheduled-delivery cancellation, publishing-race protection, reusable-original preservation, automatic development-client regeneration, and clear guidance that already published social content stays online
- Public privacy policy, terms of service, and data-deletion instructions with explicit hosted, self-hosted, waitlist, and connected-platform boundaries, plus a privacy notice beside every waitlist form
- A FeedbackBasket-powered hosted-beta waitlist on the public landing page
- A “Built by Vlad” footer credit with the creator’s photo and a direct link to his X profile
- A self-hosted first-owner bootstrap command with hidden password entry, transactional takeover protection, password sign-in without an email provider, and permanent lockout after an owner exists
- Coordinated `0.1.0-beta.0` release metadata and Changesets changelogs for the public contracts, SDK, shared local authentication, CLI, and stdio MCP packages, with token-free trusted-publishing workflows and a maintainer approval gate
- A release dry run that exercises npm's publish packaging for all five coordinated packages without uploading them, alongside the existing cross-platform clean-install and stdio discovery checks
- Full-history secret scanning in CI with a pinned Gitleaks container and a narrow empty-placeholder allowlist that continues to reject real credential values
- Cross-platform clean-install verification for packed CLI-only and CLI-plus-MCP distributions, including tarball contents, runtime dependency isolation, executable resolution, and installed stdio MCP initialization
- Selectable browser authorization scopes for CLI and local MCP connections, with required workspace reads, independently optional draft, scheduling, and immediate-publishing access, exact credential and audit binding, and least-privilege defaults
- A versioned, tenant-scoped read API for server discovery, authenticated identity, capabilities, project listing, and project lookup, with hashed scoped API keys and stable request/error envelopes
- Private monorepo foundations for runtime contracts, a dual-module TypeScript SDK, an agent-safe CLI with `whoami`, project, and doctor commands, and schema-backed stdio MCP tools
- A trusted-host command for self-hosters to create organization-bound, expiring development API keys without exposing raw keys in the database
- A credential-safe live smoke command that verifies the migrated database, public API, SDK, built CLI commands, and stdio MCP server without retaining its temporary key
- Browser-based CLI login with a signed-in workspace approval screen, PKCE-protected one-time codes, host-scoped credential storage, durable authorization audits, and revoking `auth logout`
- A signed-in Agent access screen for reviewing personal CLI and MCP connections, granted capabilities, expiry, usage, and last activity, with workspace-scoped revocation that never exposes raw credentials
- Tenant-scoped post reading across the public API, SDK, CLI, and stdio MCP, including status filters, ordered media, destination state, and secret-safe transport contracts
- CI with real PostgreSQL migration execution, grouped dependency updates, and dependency-boundary checks for the application and new agent packages
- A vendor-neutral Docker Compose reference with the standalone Rolino Node app, PostgreSQL, one-shot migrations, a portable scheduler process, health/readiness probes, an isolated agent smoke profile, and optional Caddy TLS termination
- A documented `dev:worker` command for running publishing and agent-maintenance ticks against the local development server
- An explicit ephemeral-fixture mode for running the existing API, SDK, CLI, and stdio MCP smoke test against a clean self-hosted database
- Automatic, token-free stdio MCP setup for Codex and Claude Code, with user and project scopes, explicit confirmation, dry-run support, and recoverable backups for file changes
- Tenant-scoped integration health, post readiness, and scheduled-calendar reads across the public API, SDK, CLI, and local MCP, with least-privilege capabilities, bounded pagination, and secret-safe responses
- PostgreSQL-backed agent idempotency and confirmation grants with canonical request binding, hashed keys and tokens, renewable execution leases, safe result replay, one-time credential-bound approval, and portable expiry cleanup
- Tenant-scoped draft post creation and optimistic draft updates across the public API, SDK, CLI, and local MCP, with required idempotency, stale-version protection, explicit CLI consent, and secret-safe audit events
- Tenant-scoped post scheduling across the public API, SDK, CLI, and local MCP, with separate preview and execute operations, live provider rechecks, five-minute credential-bound confirmations, optimistic concurrency, idempotent replay, and atomic audits
- Tenant-scoped immediate publishing across the public API, SDK, CLI, and local MCP, with exact-destination preview and execute operations, live provider rechecks, five-minute credential-bound confirmations, durable due-now queuing, idempotent replay, and ambiguous-provider retry protection
- Agent-platform architecture decisions and a threat model covering shared API contracts, monorepo packages, portable self-hosting, capability discovery, credential boundaries, and release gates for remote MCP and consequential actions
- Release-ready landing-page SEO with canonical metadata, future-ready platform-neutral copy, and a high-impact social preview featuring Rolino's landing-page typography and mascot, oversized frameless network icons, a kinetic calendar composition, and a prominent site URL, plus structured product data, crawler guidance, sitemap coverage, and branded favicon and installed-app icons
- Added reduced-motion-aware floating social icons and live calendar events that surface on varied days in the landing-page hero
- A new landing-page hero with a flat illustrated Rolino mascot, responsive full-height HTML calendar product preview, publishing capability overview, brand-authentic social decorations, and customer trust strip
- A centralized launch feature configuration and hidden-feature inventory so unfinished modules can be restored without removing their implementation
- A prioritized social publishing and management roadmap covering worker reliability, self-hosting, analytics, collaboration, engagement, and evidence-backed automation
- AI-assisted brand onboarding and website discovery
- Evidence-backed research, insights, and marketing idea generation
- Campaign planning, tasks, and content generation
- Instagram image and Reel publishing
- TikTok direct publishing and draft delivery
- Timezone-aware scheduling and calendar views
- Cloudflare R2 uploads and a reusable media library
- Repost workflows and per-destination publishing status
- Destination-aware publishing readiness checks with live Instagram and TikTok account health
- Per-platform caption overrides, Instagram carousel ordering, and platform-specific caption validation
- Representative image and playable video previews for Instagram and TikTok
- Guided recovery actions, issue notifications, and per-destination publishing receipts
- Per-teammate success email preferences for published posts and delivered TikTok drafts
Removed
- Obsolete pre-Rolino design mockups containing personal and legacy product references from the public source distribution
In progress
- Social analytics and performance reporting
- Additional publishing providers
- Team collaboration and playbook automation