GoRun 0.19.0

Added

• Canvas run context inlines each source under a ## [ref:…] header and shortens long sources to fit 64,000 characters with a marker giving the exact characters left out, instead of failing the run or silently cutting items over 12,000 bytes to 3,000 characters. The review dialog says how many sources were shortened, and external agents fetch the full text with the new canvases.source MCP tool. Upgrade note: runs prepared before the upgrade (queued or waiting_agent) were reviewed against the old context format, so their review-hash recheck fails closed: queued runs fail at dispatch, waiting runs are refused by canvases.context and the watchdog stops them after 24 hours. Review and run them again.
• Analytics (Site, /admin/analytics): built-in, cookieless visitor statistics. A script under 1 KB records page views; visitors are a daily salted hash with no IP address or user agent stored, Do Not Track and Global Privacy Control are respected and signed-in staff views are not counted; only theme-rendered pages get the script, and /auth/ (sign-in links), /admin and /_a/ are never tracked. The dashboard shows visitors, views, views per visitor and form submissions against the previous period, a chart, top pages, sources and campaigns, countries and devices, per-form conversion, CSV export, a dashboard widget and GET /api/v1/analytics/summary (400-day, 512-byte limits). Settings cover on/off, excluded path prefixes, leaving analytics out of backups and deleting data; the new analytics.view permission lets a marketer read it. Country needs the optional GeoLite2-Country.mmdb in the data directory. Data lives in analytics.db, which backups include as an optional member (skipped with a warning if it cannot be copied); turn the module off with GORUN_ADDONS='{"analytics":"disabled"}'. See docs/ANALYTICS.md.
• Any form on the site now stores its submissions. A builder Form section (title, slug, fields, button label, thank-you message) creates the form when the page is published, and a plain HTML form posting to /forms/{slug} with the CSRF token is captured on its first submission, with unknown fields recorded as discovered.
• Forms in the admin inbox group lists each form with a table of its entries: filters by status, dates and text, 50 per page, CSV export, a detail page that marks an entry read, spam or deleted, and field pinning, hiding, renaming and reordering that never rewrite stored entries.
• Builder forms can have one file field. Attachments download from the entry page under the same permission, and plain captured forms never accept files.
• site.form.submitted webhooks for these forms carry form (the slug) and fields. The contact form and its inbox are unchanged.
• The {{form "slug" csrf .Request.URL.Path}} theme function renders a published builder form anywhere, and the editor previews a draft form with every control disabled.
• Canvas agent and provider cards list their inputs and the schedule that triggers them. A running agent turns a ring around its avatar and shows a short writing line, a failed node says why under its heading, and the toolbar counts running runs.
• Schedule cards and the scheduled tasks panel show the next run as a clock time with a relative label, such as "Next 14:20 · in 42 minutes".
• The flow and lanes views carry an edge legend, and an edge from an enabled schedule shows a clock mark.
• Native task-entry search, choice and service layouts, with compact rows, image-led and featured/secondary result layouts in the page builder.
• Shared opt-in public navigation, detail/action and feedback components, plus a default public-detail page template.
• Search, taxonomy/field filters and pagination in native directories, including independent query state for multiple directories on one page.
• Directory results that open an opted-in detail return to the same search, filters and page, and a filtered directory with no results offers a reset link.
• Suggest improvement on every builder section offers validated layout alternatives that keep the section's text, links and media; preview renders in the sandbox, apply changes only the unsaved draft, and a configured AI provider may pick one of the allowed alternatives from layout metadata alone.

Fixed

• A canvas result whose media is missing shows a red seal and a placeholder, not the green check.
• Decoration on canvas cards at the board's top or start edge is no longer clipped, and footer buttons stay inside rounded card corners.
• The lanes view narrows its cards (down to 240px) so the four columns fit a 1440px screen without sideways scrolling.
• A canvas watchdog closes runs that stopped making progress and records why. Runs left queued for 15 minutes fail as never started. Runs waiting more than 24 hours for an external agent become uncertain. Interrupted runs (running past 5 minutes, already swept) now say so. Stuck runs no longer count against the board's run limit, and the run history explains each stop in Arabic and English. Nothing is retried automatically.

Container image

docker pull ghcr.io/zadstack/gorun:0.19.0

Multi-arch (linux/amd64, linux/arm64). Binary archives below include the themes; verify them with the SHA256SUMS file.