Expand feature set and documentation:

- Enhanced integrations with support for ScreenCloud, Spectacle (KDE), macOS Share sheet, Xerahs, and CLI script.
- Added two-factor authentication (TOTP) support.
- Introduced user and admin activity logs powered by Spatie Activitylog.
- Implemented in-app updates for browser-based instance upgrades.
- Updated guides and configuration documentation to reflect new features.

Author: sergix44

README.md

@@ -17,19 +17,26 @@ This is the next-generation XBackBone, rebuilt from the ground up on **Laravel 1
 
 ## Features
 
-- **ShareX ready** — generate a ready-to-use ShareX uploader config in one click.
+- **One-click integrations** — generate ready-to-use uploader configs for ShareX, ScreenCloud,
+  ishare, Spectacle (KDE), the macOS Share sheet, Xerahs, and a CLI script, all pre-filled with
+  your instance URL and a personal token.
 - **Wide media support** — inline previews for images, video, audio (waveform), PDFs, and
   syntax-highlighted code, plus pastes and link shortening.
 - **Multiple storage backends** — Local disk, Amazon S3 (and S3-compatible), FTP, and SFTP.
 - **Content-addressed storage** — uploads are de-duplicated by content fingerprint.
 - **Private & public uploads** — per-resource visibility, optional password protection and
   expiration.
 - **REST API** — versioned API with token authentication and auto-generated OpenAPI docs.
-- **Modern authentication** — registration, email verification, password reset, and passkeys (WebAuthn).
+- **Modern authentication** — registration, email verification, password reset, two-factor
+  authentication (TOTP), and passkeys (WebAuthn).
 - **User management** — admin roles, per-user disk quotas, and usage statistics.
+- **Activity log** — a searchable, filterable timeline of account and admin activity, for both
+  your own actions and (for admins) the whole instance.
 - **Feature flags** — toggle sign-ups, default theme and more without redeploying.
 - **Theming** — switchable daisyUI themes, localization-ready UI.
 - **Guided web installer** — set up the database, storage, and admin account from the browser.
+- **In-app updates** — admins can check for new releases and upgrade the instance from the
+  browser, with no shell access required.
 - **Legacy import** — migrate users and uploads from a legacy XBackBone instance, with old
   links transparently redirected.
 

core/README.md

@@ -22,6 +22,7 @@ can be installed, upgraded and downgraded independently from the deployment skel
 - **Laravel Fortify** for authentication, **Sanctum** for API tokens, **Pennant** for feature
   flags
 - **Scramble** for auto-generated OpenAPI documentation
+- **Spatie Activitylog** for the account and admin activity feed
 - **Flysystem** adapters for FTP/SFTP, **php-ffmpeg** and **ImageMagick/GD** for media previews
 - **Vite 8** for asset bundling
 - Tested with **Pest 4**, analyzed with **Larastan**, formatted with **Pint**
@@ -50,9 +51,12 @@ User-facing pages are Livewire components under [`app/Livewire/`](app/Livewire):
 
 - **Dashboard** — upload files, create pastes and links, manage and search your resources.
 - **Preview** — the public viewer for a shared resource, with media players and social embeds.
-- **Integrations** — generate a ShareX uploader configuration.
-- **Profile** — manage account info, API tokens, passkeys, data export, and account deletion.
-- **Admin settings** — sign-up toggle and default theme, user management, and statistics.
+- **Integrations** — generate uploader configurations for ShareX, ScreenCloud, ishare, Spectacle
+  (KDE), the macOS Share sheet, Xerahs, and a CLI script.
+- **Profile** — manage account info, API tokens, passkeys, your activity log, data export, and
+  account deletion.
+- **Admin settings** — sign-up toggle and default theme, user management, statistics, the global
+  activity feed, and in-app updates.
 
 ### REST API
 
@@ -82,6 +86,25 @@ and passkeys (WebAuthn).
 Global and per-user settings are managed with Laravel Pennant (see [`app/Features/`](app/Features)):
 `SignUp`, `DefaultTheme`, and `AlphabetForIds`.
 
+### Activity log
+
+Notable events — resource uploads and changes, user and token management, passkey changes, and
+authentication (logins, registrations, lockouts, failures) — are recorded with
+[Spatie Activitylog](https://spatie.be/docs/laravel-activitylog) via the listeners in
+[`app/Listeners/`](app/Listeners). The `ActivityLog` Livewire component renders the feed: users
+see their own activity under **Profile → Activity**, while admins get a global, searchable feed
+filterable by category (`ActivityCategory`) under **Admin → Activity**. Event presentation
+(labels, icons, colours) is centralised in `app/Support/ActivityEvent.php`.
+
+### In-app updates
+
+Admins can check for new releases and upgrade the instance from **Admin → Updates**. `CheckForUpdate`
+compares the installed `xbackbone/core` version against the latest stable release on Packagist, and
+`UpgradeApplication` rewrites the skeleton's Composer requirement and runs the post-upgrade
+migrations and cache steps in a detached process. The feature is only available on real skeleton
+deployments (`app/Support/Updater.php` gates it on production plus an `APP_ROOT`); see
+[`config/updater.php`](config/updater.php).
+
 ### Media previews
 
 Previews are generated asynchronously via the `GenerateResourcePreview` job and the generators

docs/guide/configuration.md

@@ -100,13 +100,42 @@ MAIL_FROM_ADDRESS="files@example.com"
 MAIL_FROM_NAME="XBackBone"
 ```
 
+### Activity log
+
+XBackBone records notable events (uploads, user and token changes, logins, …) to an activity feed.
+It is enabled by default and needs no configuration.
+
+```dotenv
+ACTIVITY_LOGGER_ENABLED=true
+```
+
+| Variable | Description |
+| -------- | ----------- |
+| `ACTIVITY_LOGGER_ENABLED` | Set to `false` to stop recording activity entirely. |
+
+Entries older than a year are pruned when you run `php xbb activitylog:clean` (schedule it if you
+want automatic housekeeping).
+
+### Updates
+
+The [in-app updater](/guide/upgrading#from-the-admin-area) auto-detects Composer. Only set this if
+it lives at a non-standard path:
+
+```dotenv
+XBB_COMPOSER_BINARY=/usr/local/bin/composer
+```
+
 ## Runtime settings
 
 The admin **Settings** page controls behaviour you can change live, including:
 
 - **Sign-ups** — allow or block public registration.
 - **Default theme** — the daisyUI theme new visitors get.
 - **User management** — roles, per-user disk quotas and usage statistics.
+- **Activity** — a searchable, category-filterable feed of instance-wide activity. Each user also
+  sees their own activity under their profile.
+- **Updates** — check for new releases and upgrade the instance from the browser. See
+  [Upgrading](/guide/upgrading#from-the-admin-area).
 
 Some of these are evaluated per user as well as globally — for example a user can pick their own
 theme, falling back to the global default when they haven't.

docs/guide/developer.md

@@ -30,6 +30,7 @@ deployed `app` instance you use `php xbb <command>`.
   [Mary UI](https://mary-ui.com/) components
 - **Laravel Fortify** for authentication, **Sanctum** for API tokens, **Pennant** for feature flags
 - **Scramble** for auto-generated OpenAPI documentation
+- **Spatie Activitylog** for the account and admin activity feed
 - **Flysystem** adapters for FTP/SFTP, **ffmpeg** and **ImageMagick/GD** for media previews
 - **Vite** for asset bundling; tested with **Pest**, analyzed with **Larastan**, formatted with **Pint**
 

docs/guide/getting-started.md

@@ -18,6 +18,8 @@ screenshot and getting a shareable link can be a single keypress.
 - **Keep things private.** Make uploads public or private, protect them with a password, or set
   them to expire automatically.
 - **Stay organized.** Browse, search and manage everything you've shared from your dashboard.
+- **Keep an eye on activity.** A timeline records your account activity — uploads, logins, token
+  and passkey changes — and admins get an instance-wide feed.
 - **Own your data.** Run XBackBone on your own server, with the storage backend of your choice.
 
 ## Your first upload

docs/guide/upgrading.md

@@ -9,7 +9,33 @@ Because the core is a package, your configuration, environment and customisation
 are untouched by an upgrade. You can also **downgrade** the same way if a release misbehaves.
 :::
 
-## Before you start
+## From the admin area
+
+The easiest way to upgrade is from the browser — no shell access required. As an admin, open
+**Settings → Updates**:
+
+1. XBackBone shows your **current version** and, if one exists, the **latest release**. Use
+   **Check now** to bypass the cache and re-query Packagist.
+2. Click **Upgrade** to update to the latest version. XBackBone rewrites the `xbackbone/core`
+   requirement in the skeleton's `composer.json`, runs Composer, and then applies the new
+   migrations and rebuilds the caches for you. Progress is streamed live on the page.
+
+::: warning Requirements
+The in-app updater only appears on a real deployment installed through the `app` skeleton and
+running in production. The web server user must be able to run Composer and write to the skeleton
+(`vendor/`, `composer.json`, `composer.lock`). If Composer lives at a non-standard path, set
+`XBB_COMPOSER_BINARY` in your `.env`. When these conditions aren't met, use the manual process
+below.
+:::
+
+Take a **backup** first (see below) — an in-app upgrade runs the same migrations as the manual
+process, and those are not always reversible.
+
+## Manual upgrade
+
+Prefer the command line, or the in-app updater isn't available? Upgrade by hand instead.
+
+### Before you start
 
 - Take a **backup** of your database and your uploaded files.
 - Note your **current version** so you can roll back: `composer show xbackbone/core`.
@@ -19,7 +45,7 @@ are untouched by an upgrade. You can also **downgrade** the same way if a releas
 php xbb down
 ```
 
-## Upgrade
+### Steps
 
 1. Bump the constraint in the skeleton's `composer.json`, e.g.: