What’s new in Pinwren

Features

• custom fields and form builder (#63) (25a8640)
• interactive slack with buttons, slash command and message capture (#59) (40bc335)
• release tracking, fixed-in and regression detection (#64) (fa1e373)
• server-side named and shared dashboards with filter bar (#60) (7d36ea3)
• tracker adapter sdk with trello, asana, clickup and notion (#61) (8e1b514)
• widget: screen recording with optional voice narration (#58) (900cd1a)

Features

• agent hand-off, generated repro tests and MCP/SDK/CLI parity (#45) (f2efbac)
• ai auto-labels and per-project automation rules (#46) (007131d)
• share links, client sign-off and reporting widgets (#44) (98ab038)
• widget: error-triggered report prompt and observability link-outs (#43) (9548b00)
• www: load the pinwren widget on the marketing site (#32) (fa52b0f)

Features

• v2 dashboards, widget markers and screenshots, edition badge, global features (#39) (e0d1892)

Features

• add cloud billing with Dodo Payments in test mode (#28) (7e013ea)
• add cloud sign-up and onboarding (#31) (e73736a)
• add fly.io and supabase deployment config (#29) (8e8b578)
• add launcher theme and favicon branding (#21) (9979e69)
• enforce cloud tenant isolation (#27) (793a472)
• guest: add capability-based feedback portal (#19) (4291864)
• web: dashboard translation system, language preference and picker (13a448f)
• web: translate the dashboard into ten more languages (530a09d)
• www: add the Product Hunt badge to the site footer (a76b992)
• www: add the Tool Index badge to the site footer (0908d06)

Bug Fixes

• ci: isolate the release feed and fresh-install assertions (5f5bb7b)
• harden release readiness and repair onboarding (f6c091e), closes #16

Features

• widget: screenshot quality setting and a "Reduce capture quality" switch (ca31591)

Features

• ai: document AI triage, forward its settings, fix what the model is shown (5cb16c4)
• ai: triage and enrichment implementation (#13) (6f1b4fb)
• api: Hono API with Better Auth, dashboard routes and public widget routes (4ecf132)
• api: wave 4 — realtime, rounds, views, replay, identity, viewer role, licences, SDK/MCP/CLI (64f16fa)
• api: wave-1 backend — widget contract, email, notifications, webhooks, API tokens, S3 (308a3c4)
• brand: add the Pinwren logo, icons, social preview and brand guide (9c34f11)
• complete v1 — BugPin admin model, SitePing widget UX, email and notifications (b2016b7)
• core,db: shared schemas, origin matching, Postgres schema and migrations (fb37415)
• docker: self-host image and compose; smoke test and demo site (08bacdc)
• license: add production licence key pinwren-2026 (d4c461f)
• wave-3 admin parity — trackers, panel actions, branding, privacy, templates, security (8ba1b3e)
• web: dashboard for every wave-2 feature (1a7836a)
• web: Next.js dashboard — auth, onboarding, inbox, projects, settings (98a3dbb)
• web: rebrand the dashboard and emails with the new logo and palette (79599e3)
• web: v1 dashboard — Redux Toolkit, server-rendered shell, wave-4 screens (1f173d2)
• widget: default to the Pinwren orange accent and the new mark (41effc0)
• widget: embeddable widget with pinned comments, bug reports and screenshot editor (f7ea760)
• widget: Figma-style comments and full bug-report parity (3854011)
• widget: v1 chunks, session replay, identity, visibility and @pinwren/react (0102b1c)
• widget: wave-3 parity — lazy panel/report chunks, actions, branding, privacy, export (e92f829)
• www: marketing site, live demo and documentation (f1f93ed)
• www: rebrand the website and docs with the new logo and palette (3f2b429)

Bug Fixes

• ai: guard outbound calls, scope translations, apply through the update path (6d9e867)
• cap report metadata, align the body limit, publish every package (7d8a8fe)
• lock project settings saves; generate route types before lint (2a6c8f4)
• make realtime resume, session lifetime and the sign-in limiter work across workers (a6af078)
• security: close the CodeQL alerts (ReDoS, regex anchor, JSON-LD escape, demo page) (ebb0ecc)
• security: pre-release hardening from the independent review (2400367)
• types: add react and react-dom types to root devDependencies (fd41850)
• www: route hero pill button to self-hosting docs (aa91f94)

Performance

• api: remove hot-row lock waits and run cluster workers (e46b63b)

The first public release, 0.1.0. Pinwren was developed privately as "Annota" and renamed before publishing.

Added

• Widget (@pinwren/widget, MIT): one script tag; closed Shadow DOM; core ≈33 KB gzip with the side panel, report form, capture engine and each locale loaded on demand.
  • Comments pinned to elements or regions, anchored by CSS selector, XPath, test id, text and geometry; comments on selected text with the quote highlighted; threads with team replies; resolve and reopen; deep links (?pinwren=<id>); a side panel with filters, search and CSV/JSON export.
  • Bug reports with viewport, full-page, element or screen-share capture; an editor with draw, box, arrow, text, pixelate, crop, undo and redo; up to three attachments; console and network diagnostics, browser environment and page timing; drafts that survive reloads; an offline outbox with retries.
  • Privacy mode (text fields masked in captures, no timing data, coarse user agent, consent notice), built-in masks for passwords and card fields, and data-pinwren-mask.
  • Launcher options, white-label branding, read-only mode, right-click to comment, 11 languages, and the Pinwren JS API (init, open, close, on, identify, destroy).
• Dashboard and API (AGPL-3.0): Next.js 16 dashboard with the Hono API mounted at /api and /w.
  • Triage inbox with list, detail and board views, filters, bulk edits with undo, and keyboard shortcuts; page review with pins over screenshots; statuses, priorities, assignees, internal and public comments, activity timeline.
  • Workspaces, invitations and roles; email and in-app notifications; editable email templates; branding; retention policies; instance security settings; update check.
  • Two-way GitHub and GitLab issue sync, signed webhooks (generic, Slack, Discord) with a delivery log, scoped API tokens for /api/v1, and custom panel actions.
• Self-hosting: one Docker image (dashboard, API, widget bundles, migrations) plus Postgres; files on disk or S3-compatible storage; node:cluster workers; pg-boss background jobs on Postgres.
• Project tooling: Prettier and ESLint (typescript-eslint strict type-checked, Next.js, React Compiler and accessibility rules) replacing Biome; strict TypeScript with exactOptionalPropertyTypes in every package; the React Compiler (native Rust implementation) and typed routes in the dashboard; CI, CodeQL, OpenSSF Scorecard, dependency review, release-please, and multi-arch Docker images on GHCR with SBOM and provenance.

First run, install and projects

• The first account is the admin. A new server sends you to "Create the admin account"; that account configures SMTP, security and the licence from the dashboard right away. The one-time setup token and the /setup claim page are gone (ADR 0021 amendment). PINWREN_ADMIN_EMAILS still adds more admins.
• Get started checklist on the inbox, driven by the server's real state: admin account, email set up, a test email sent, widget connected, first report received, a teammate added. Dismissible.
• Install tab: snippets for HTML, Next.js, Google Tag Manager, npm (@pinwren/widget) and React (@pinwren/react), built from PINWREN_URL (with a hint when the dashboard is opened on another address); a "Verify from your terminal" npx pinwren doctor command; test-report steps once connected; refused sites listed ("Blocked a request from … 2 min ago") with Allow; a warning while no site is allowed.
• What is this site for? when creating a project: a public website keeps bug reports private; a staging or client-review site shows reviewers each other's pins (preset on POST /api/projects). New projects open on their Install tab. Creating projects is an Admin permission.
• Review links: a page link with a token that shows the widget to a client or reviewer, with an expiry, last-used time and revoke.
• Project export (JSON + every file, as a zip built in the background) and erase everything one reporter sent (dry run first, recorded without the address) on Project › Privacy & data.
• "Email the reporter" moved to the project's Widget tab, next to a link to the reporter email settings.
• The command palette lists every settings page you can open (same rules as the settings menu); the account menu has Profile & settings.
• The Licence page shows what a licence switches on today (white-label and Jira Cloud sync) apart from the Coming soon Enterprise features; licences naming those keep working.
• Docker: every variable in docker/.env now reaches the app (env_file, Compose v2.24+); docker/.env.example has commented blocks for SMTP, S3 storage and HTTPS. New docs/self-hosting/getting-started.md walks from install to the first emailed report.