What's new in VeloxScript

Your workspace dashboard now shows a plan-aware “Workspace Telemetry” panel with segmented fuel gauges for Scripts, Locations, and Seats. As you approach a plan limit the bars cross from emerald to amber to rose, and a nudge surfaces if an upgrade would unblock you. No more surprise 402s at create time.

The Marketplace tab has been rewritten to stop pretending. Six fake “coming soon” script cards are gone; in their place is a roadmap with three clearly-labelled (planned) categories — community scripts, launch templates, verified integrations — and a mailto link to get notified when each ships.

The Team invite flow also grew a teeth. Right after you send an invitation the page shows a green “Invitation ready” card with the full accept URL, so you can paste the link into Slack or DM instead of waiting for the recipient to dig through their inbox.

veloxscript.com/status is live. The page polls two fresh health endpoints every thirty seconds and surfaces dashboard + loader status with sub-second refresh. Background tabs stop polling automatically.

Under the hood, /api/health and /api/health/loader return a clean 200/503 split that external monitors (BetterStack, Uptime Robot, Pingdom) can hit on a schedule with HEAD or GET. Every response carries the deployed commit SHA and region, so when something goes sideways we can see exactly which version is serving.

Admin tools moved out of Settings and into a dedicated /admin console. The aesthetic is deliberately different from the rest of the app — amber chrome, tight corners, Roboto Mono labels — because admin should feel like a cockpit, not a feature tour.

Admins can now impersonate a non-admin user to reproduce support issues in under a minute. Every impersonated session wears a very loud caution-tape banner that can’t be missed, and the impersonation is audited in every affected workspace’s activity log.

Multi-user workspaces are real. Owners and admins can invite teammates by email, recipients click a one-click accept link in their inbox, and you’re in. Plan limits gate seat count (Free = 1, Starter = 3, Pro = 10, Agency = unlimited) with clear upgrade nudges when you hit the cap.

Owners can hand off ownership with a type-to-confirm flow, and non-owners can leave a workspace on their own (as long as they’re not the last owner). Every action lands in the activity log with the before/after context.

Changing your password now invalidates every other device’s session on the next request. If someone steals a cookie, revoking it from the Active Sessions panel in your account settings kills it within a second — no waiting for the 7-day JWT expiry.

Each active session is tagged with the browser and IP it was issued from, so you can see at a glance whether that “Chrome on a laptop in Germany” is you or isn’t.

Every meaningful action in your workspace — scripts published, locations added, GHL reconnects, kill switch toggles, team role changes — now lives in a single searchable activity view. Filter by category, filter by date window, expand any row to see the before/after diff.

The Settings tab has an embedded version; /audit gives you the full standalone page. Audit rows are immutable: we never delete them, not even when the underlying entity is hard-deleted.

Two-factor authentication via any TOTP app (1Password, Authy, Google Authenticator). The challenge is adaptive: if either the device cookie or the originating IP is already known to us, we skip the 2FA prompt. Cold logins from a new browser on a new network still hit the challenge — matches the Google and Apple pattern.

Any code change, enable/disable, or kill-switch toggle now sends an email to the workspace owner with the actor, IP, and timestamp, plus a big amber “If this wasn’t you” block. Bulk script operations coalesce into a single summary email.

When a script assignment update would hit more than five locations, the confirm button shows the explicit impact count so you can back out before deploying to the whole fleet.

Error monitoring via Sentry on both the server and the client, with source maps uploaded so stack traces point at real file paths. Rate limiting on signup, login, and the customer-facing loader — all backed by the database so the limits survive a serverless cold start.

Stripe webhook idempotency: every inbound event is recorded before we process it, so a duplicate delivery short-circuits cleanly. Password reset is wired up through Resend with a 24-hour token lifecycle.

Legal pages (Privacy, Terms, Cookies) live at their stable URLs with a temporary “not yet lawyer-reviewed” banner — placeholder content until we commission the real drafts.