moonbasemoonbase

Changelog

What’s new in moonbase — version history and release notes.

Subscribe:RSS feed

v0.10.0

Added

  • —Onboarding tour (N1) — 5-step floating card with space-themed copy, per-step icons, server-side dismiss persistence in `user.preferences.tourDismissed`. Appears for zero-mission users only; survives browser clears via DB.
  • —Public status page (N21) — `/status` marketing page showing real-time service health from `/api/health`, 4-service grid, incident history stub.
  • —Docs expansion (N11) — 5 new articles: Custom Domains 101, Env Vars Best Practices, GitHub Actions CI/CD, Deploy Troubleshooting deep-dive, Billing overview (14 total).
  • —Content moderation queue v2 (N3) — `ModerationFlag` Prisma model + migration, DB persistence on every flagged upload, admin queue UI at `/admin/moderation` with approve/reject/note actions + email on reject.
  • —PRICING-v2 scaffold (T41) — `weight-tracker`, `overage-calculator`, `site-freeze` modules + daily billing summary script (Stripe wiring in T55).
  • —ClamAV moderation (T51) — ClamAV scan + phishing pattern check on every upload ZIP; log-only v1; moderation page.
  • —Abuse detection (T52) — IP/domain-burst + disposable-email detection; audit log flagging; admin count.
  • —Templates gallery (T12) — 6 seed templates, `Template` schema migration (create-only); framework-colored cards; "Coming soon" disable for empty `zipUrl`.
  • —Preview screenshots scaffold (T19) — `previewImageUrl` on Project model; graceful puppeteer no-op; fire-and-forget capture after deploy success.
  • —Certbot SSL automation (T46) — `x100-certbot-setup.sh` + `domain-ssl-ready` webhook endpoint.
  • —Lighthouse CI (T33) — `.github/workflows/lighthouse.yml` (weekly + marketing-change trigger, staging URL, a11y/perf budgets).
  • —Onboarding tour (T34) — 5-step floating card, `useOnboardingTour` hook.
  • —Deploy retry logic (T49) — 3 retries / 10s backoff in deploy scripts; webhook history log; replay-last-failed-deploy.sh.
  • —LearningEntry schema (T45) — auto-logs failed deploys; admin entry count badge.
  • —ForbiddenPage (403) and MaintenancePage (503) reusable components (N22).
  • —Rate limiting documentation (N20) — `docs/security/rate-limiting.md` with full endpoint audit; added IP gate to `forgot-password` (5/15 min).
  • —Backup strategy (T30) — `backup-db.sh` nightly script + docs.
  • —Monitoring strategy docs (T32) — Sentry + webhook coverage + UptimeRobot setup guide.
  • —Phone verification test plan (T48) — test plan + vitest stubs for all edge cases.

Changed

  • —Theme transitions (N2) — 0.15s ease on all color properties; `color-scheme` synced for browser-native UI elements.
  • —Branded error pages (N22) — `global-error.tsx` and `error.tsx` rewritten in English with MoonBase space-themed design; `not-found.tsx` preserved.
  • —Compatibility Engine (T43) — added `build_output_dir` and `esm_cjs_mismatch` Tier-2 repair action types.
  • —Admin users page (T52) — shows count of abuse-flagged accounts at top.
  • —Moderation admin page (N3) — upgraded from placeholder text to live queue with stats, approve/reject/email workflow.

Fixed

  • —Onboarding tour Turbopack — `ssr: false` in Server Component rejected by Turbopack; switched to direct import.
  • —Phone verification test (N19) — `vi.hoisted()` fix for vitest hoisting issue; 72/72 test files passing, 728 tests.

Security

  • —Rate limiting added to `POST /api/auth/forgot-password` (5 requests/IP/15 min, in-memory, anti-enum: always 200).
  • —`ModerationFlag` table for persisting flagged uploads; admin review flow.

Other

  • —Updated 11 minor/patch packages: `@sentry/nextjs` 10.55, `lucide-react` 1.17, `zod` 4.4.3, `pg` 8.21, `next-intl` 4.13, `otplib` 13.4.1, `resend` 6.12.4, `tsx` 4.22.3, `yauzl` 3.3.1, `@types/react` 19.2.15, `@types/node` 20.19.41.

v0.9.0

Added

  • —MoonBase R7–R8 rebrand — all `moonlink` strings replaced with `moonbase` across codebase; legacy symlinks for 30-day soak.
  • —Phase 5 hardening — CSP report-only, HIBP password breach check, 2FA backup code count UI, watchdog PM2 process.
  • —Phase 5 billing gates — 3 missions / 100MB / 10K visits plan limits enforced at upload boundary; 402 on exceed.
  • —Circuit breaker — MoonServer calls wrapped in `moonserverBreaker`; ops alert on circuit open.
  • —Audit log — search + CSV export at `/admin/audit-log`.
  • —Mission archive — soft-archive missions without deleting; `?archived=1` toggle.
  • —Mission Log soft-delete — `deletedAt` stamping instead of hard delete.

v0.8.0

Added

  • —Daily analytics table populated from each site's Webalizer report (one row per site per day).
  • —Nightly sync job at 02:00 UTC that reads Webalizer reports via cPanel and updates the dashboard.
  • —On-demand refresh trigger so analytics can update outside the nightly window.
  • —Backfill script to seed historical data for existing sites.
  • —Cloudflare fallback for brand-new sites that don't have Webalizer data yet, with a "real visitor counts arrive within 24h" hint shown in the dashboard.

Changed

  • —Dashboard "Visitors this month" KPI now shows unique visitors instead of page requests.
  • —Traffic chart subtitle clarified to "unique visitors" so the metric is unambiguous.

v0.7.0

Added

  • —Profile tab: edit display name, view profile picture (gradient avatar), change email with verification.
  • —Security tab: change password, enroll or disable two-factor authentication, see recent sign-ins.
  • —Two-factor authentication on login: codes from your authenticator app, plus one-time recovery codes.
  • —Notifications tab: opt in or out of product-update emails.
  • —Danger Zone: download all your data as a ZIP, delete your account.

v0.6.0

Added

  • —/settings page for app-level preferences (language, theme).
  • —/activity page showing your full account history — deploys, sign-ins, settings changes.
  • —Activity recording: every meaningful action now leaves a timestamped audit entry.

Changed

  • —Sign-in now redirects to /dashboard instead of /missions.

v0.5.0

Added

  • —Placeholder pages for upcoming features (analytics, billing, domains, API keys, docs) with "notify me when ready" forms.
  • —User menu in the sidebar (account, sign out).
  • —Hebrew and English translations plus right-to-left support across all sidebar surfaces.

v0.4.0

Added

  • —Persistent sidebar navigation with mobile slide-out menu and right-to-left support.
  • —Shared "New Mission" button accessible from anywhere.
  • —Dashboard page with: stats strip (active sites, storage used, visitors, sites needing your attention), recently launched thumbnails, traffic chart across all sites, recent activity feed.

Changed

  • —Primary call-to-action buttons unified to a consistent emerald color across the app.
  • —Site display names now link to their Mission Control page.

Fixed

  • —Thumbnail iframe loading on the Dashboard.
  • —Removed the legacy /dashboard → /missions redirect (Dashboard now lives at /dashboard).

v0.3.0

Added

  • —Real-time publish progress: the publish modal now reflects each stage as it actually happens, not on a fixed timer.
  • —Terminal-style progress console inside the publish modal.
  • —"Post-launch" eyebrow that appears above the live site after a successful deploy.
  • —Loading state for the live-preview iframe.
  • —Script to reset a regular user's password from the command line.

Changed

  • —Visitors empty state reverted to a clean placeholder.

v0.2.0

Added

  • —Pause and resume for sites — paused sites show a clean maintenance page.
  • —Password protection for sites (visitors are prompted before they can view).
  • —Mission Control analytics card showing real visitor counts.
  • —Full analytics page: daily breakdown, top pages, top countries, browser and OS, all written in plain English.
  • —Daily analytics sync at 02:00 UTC, plus a manually-triggered endpoint for re-syncing on demand.
  • —Per-month analytics snapshot storage so historical data is preserved without re-fetching.
  • —Skeleton loaders and entrance animations across Mission Control.
  • —Control Center (admin) foundation: operator login with two-factor authentication.
  • —Operator account: command-line script to reset an admin's password.

Changed

  • —Mission Control analytics replaced the Cloudflare-only data source with AWStats (which counts real visitors, not just raw requests).
  • —Filtered out internal MoonLink traffic (login probes, automatic SSL checks) so they don't pollute the analytics totals.
  • —Simplified the analytics card to two main numbers plus three session metrics.
  • —Admin two-factor: extended the time window for code entry; login UX polish.

Fixed

  • —Fixed the mini chart on the analytics card to render in the right direction in Hebrew.
  • —Percentage-change badge on the analytics card.

Security

  • —Excluded local Claude Code config from version control.

v0.1.0

Added

  • —Next.js 14 application with Hebrew and English support, right-to-left rendering, RagSans custom font.
  • —Marketing landing page: hero, language-switching navbar, trust bar, problem statement, how-it-works, features, AI assistant section.
  • —User registration and sign-in (Auth.js v5, email and password).
  • —Project upload flow: ZIP upload, smart ZIP normalizer (handles nested folders and missing index.html), file-size-based monthly pricing display.
  • —Shared cPanel hosting architecture: subdomain creation, file upload, automatic SSL, space-themed default names like `ageless-surya15`.
  • —Step-by-step publish progress UI with a terminal-style console, Hebrew error messages, retry button, and tracking IDs for support.
  • —Live-site preview iframe on Mission Control.
  • —Cleanup tooling for orphaned cPanel subdomains and post-extraction ZIP cleanup.
  • —Launch quotes bank for visual flair during the publish flow.
  • —Rebrand to MoonLink (the product was originally a different name).

Fixed

  • —Iframe preview race condition.
  • —Iframe disappearing on slow loads (eager loading plus 30-second timeout).
  • —ZIP cleanup after extraction (works around an unsupported cPanel API method).

Security

  • —Broadened .gitignore env-file pattern (catches `.env.local`, `.env.production`, etc.).

Full history at CHANGELOG.md