v3.3.0

Upgrade notes

• Update the CLI with the server. Pushes are now guarded against overwriting newer server edits, and this needs primo-cli 0.2.0 (npm i -g primo-cli@latest). Older CLIs get 428 Push requires a sync baseline when pushing to an existing site; 0.2.0 won't push to servers older than 3.3.0.
• Two migrations, applied automatically on start: blocks and page types gain a folder field (see "Pull keeps your folders" below; existing records fall back to their name-derived folder until they're next imported), and the default rate limits are scoped to signed-out requests (see below). Tested by upgrading a 3.2.8 instance in place: sites, published pages, and content came through unchanged.
• Local development: stop any running primo dev before upgrading the CLI, then start it again with the new version.

What's new

Pushes can't silently overwrite client edits anymore (#1263)

primo push used to re-upload your local files wholesale, so a push from a stale pull quietly replaced anything a client had changed in the CMS since. Pushes now carry the revision they were pulled from, and the server refuses one that's out of date, before any write:

demo: changed on the server since the last sync (or was deleted).
Nothing was changed. Save your local work before pulling. An intentional overwrite requires --force.

Pull, redo your change, and push. --force is still there for a deliberate overwrite: it asks for confirmation, and saves a downloadable backup of the server's version first (server-side under push_backups/, plus a local copy). The check covers sites and the shared library, including additions, deletions, field edits, and reordering, and re-runs inside the import transaction so a late edit still stops the push. See SAFE_PUSH.md for rollout and recovery details.

A redesigned Create Site wizard (#1272, #1278)

A clickable stepper, a pinned Back/Next footer, and one shared layout for picking a starter and adding blocks, with group chips on narrow screens. The wizard fills the window and its panes scroll on their own, including on the first-site screen.

Marketplace starters without a domain now preview. Many starters are served by id rather than their own domain, and their thumbnails and live preview never loaded; they now load through the marketplace's preview route.

Editor polish (#1266, #1270, #1271)

• The editor renders in embedded browsers. The nested Svelte compiler worker is inlined, so the canvas no longer comes up blank in in-app browser panes.
• Pages fade in once, when they're ready. The canvas waited for nothing while the section list loaded, so sections popped in one by one. It now fades in when every section (header, body, and footer) has rendered, and the spinner covers single-section pages too.
• Spinners animate in Safari. Both were SMIL icons, which Safari draws as static glyphs; they're CSS now, and announce "Loading" to screen readers.
• Browse mode can build a preview. With primo dev in files-author mode, the toolbar's Preview button (and p hotkey) builds the local preview again, without snapshotting or committing records the next pull would discard.

Import and pull fixes (#1264, #1273, #1274)

• Internal nav links survive import. A url field whose value was the path of an existing page (/, /tours) in a site-level repeater imported as empty, so nav menus lost every internal link. Link-to-page conversion now applies only to real link fields.
• Pull keeps your folders. Blocks and page types are addressed by folder, but pull rebuilt folders from display names: a block in blocks/hours-cta/ named "Hours & CTA Strip" came back as blocks/hours-&-cta-strip/, with references rewritten. The imported folder is now stored and exported back, and pages can reference a page type by folder even when its name slugifies differently.
• Pulled files are stable. allowed_blocks is written in a fixed order instead of reshuffling on every pull, and page-list fields keep the page type's folder name instead of its server id.
• Nested pages push after a parent is re-keyed. Pushing nested pages failed with "Failed to find all relation records" when a parent page's id changed.

Fixes that also affect 3.2.x (#1279, #1280, #1281)

• Editors are no longer rate-limited. Rate limiting (on since 3.2.7 as a login brute-force floor) used PocketBase's default rules, which throttle signed-in users too: about 20 record creates per 5 seconds. The editor creates one record per field, so adding a block, including in the Create Site wizard, could fail with 429s partway through. The create, batch, and API-wide limits now apply only to signed-out requests; login attempts are still limited for everyone. Rules you've customized are left as they are.
• Sites with an empty page publish. A newly created page with no sections made every publish of that site fail ("Unknown error") until the page got a section.
• Self-hosted installs opened at localhost are editable. A production binary or Docker image opened at http://localhost:8090 showed the editor in read-only Browse mode with no Publish button.
• The Create Site wizard finishes cleanly. If adding blocks fails it closes with a warning instead of hanging over the new site, and new sites go into the group you're viewing.

Dashboard (#1261, #1262)

• Site thumbnails no longer go stale after publishing.
• Leaving the editor returns you to the site's group.
• A site's host is only linked when it's a plain hostname, so a malformed host can't send you somewhere other than what the card shows.

Better guidance for AI agents (#1265, #1275)

Exported sites' AGENTS.md now includes content-design defaults (site vs. page vs. block fields, what belongs in allowed_blocks, when to reuse page types) and a Fields reference: valid field types, subfields: for nesting, and the site-field / page-field reference formats.

Release testing

This release was checked by having fresh Claude sessions build real sites (a clinic brochure, a photo blog, a three-client agency workspace, a hosted client hand-off, and a no-MCP build) with the CLI, MCP server, and this server built from source, then independently verifying each result: validation, static builds, and a push → pull round trip against a fresh server. The fixes above, plus primo-cli 0.2.0's and primo-mcp 0.1.9's, came out of three rounds of that.