Skip to content

Orbit 0.5.2

Choose a tag to compare

View all tags
@ashish200729 ashish200729 released this 09 Aug 02:50
· 10 commits to main since this release
v0.5.2
0e5c6ce

Highlights

Annotate images before sending

Orbit now includes a built-in image markup editor for composer attachments. Open an attached image, draw directly over it, choose from five colors and three stroke sizes, undo or redo changes, and save the annotated image back to your message.

The editor is responsive, keyboard-friendly, theme-aware, and supports reduced motion and high-contrast modes. Toolbar and dropdown surfaces are now opaque, so color and stroke controls remain visible across light, dark, transparent, and forced-color themes.

Security and privacy hardening

This release includes a broad security pass across agent tools and privileged editor services:

  • Tool execution stays bound to the thread and workspace that started the run.
  • File and shell operations add workspace, sensitive-file, URI-scheme, and symlink-aware protections.
  • MCP, OAuth, semantic search, billing, and related network requests use centralized HTTPS and SSRF validation.
  • Browser automation uses an explicit safe-operation policy and authenticated window isolation.
  • Source-control operations are restricted to the active workspace and real Git repositories.
  • MCP approvals, OAuth callbacks, token cleanup, shell-pattern validation, and tool-output ownership are more tightly validated.

Safer updates and release delivery

  • Update manifests are Ed25519 signed with the existing Orbit update key.
  • Every package is verified with SHA-256 before installation.
  • Update URLs are restricted to the expected Orbit GitHub release path.
  • The macOS updater verifies app signatures, installs through private staging, and rolls back if replacement or relaunch fails.
  • Apple Silicon and Intel releases are built and verified sequentially before publication.

Downloads

  • Apple Silicon: Orbit-0.5.2-darwin-arm64.dmg
  • Intel: Orbit-0.5.2-darwin-x64.dmg

First launch on macOS

Orbit is currently ad-hoc signed rather than Apple-notarized. A fresh browser download can show the macOS verification warning. Use Right-click → Open, or approve Orbit under System Settings → Privacy & Security.

For a verified command-line installation, which validates the signed manifest, package checksum, and app signature:

curl -fsSL https://raw.githubusercontent.com/ashish200729/orbiteditor/main/install.sh | bash

Checksums

  • Apple Silicon: 7bb54f6b43461657280a5266366083f2197543951cc69d26bd47cdeab8370402
  • Intel: e9cfb9d0b6abac643345b803f0d7450ee32bffe491b6ed746a8c514424e55b5c

See the full changelog.

Assets 12
Loading