Flowdular v0.6.5

Flowdular v0.6.5

Source commit: f25a805

Previous release: v0.6.4

Full comparison

Packages

Package	Version	Artifact
@flowdular/sdk	0.6.5	flowdular-sdk-0.6.5.tgz
flowdular	0.6.5	flowdular-0.6.5.tgz
create-flowdular	0.6.5	create-flowdular-0.6.5.tgz
@flowdular/sandbox	0.6.5	flowdular-sandbox-0.6.5.tgz

Changes

• fix(sandbox): keep the session agent selected while it is not offered (befd02dd)
• Merge pull request #153 from Flowdular/fix/sandbox-driver-select (2b2c6d98)
• fix(sandbox): route reviews after the handed-on specialist and back to their reviewer (1e35b70d)
• Merge pull request #154 from Flowdular/fix/sandbox-review-routing (ec15b722)
• fix(sandbox): fold a review report the gate cannot read (811eb8a1)
• Merge pull request #155 from Flowdular/fix/sandbox-unreadable-review-display (6a1d65ca)
• release: 0.6.5 (169bb4eb)
• Merge pull request #156 from Flowdular/release/0.6.5 (f25a8057)

All 8 commits, their complete messages and the file summary are included in the attached CHANGELOG.md.

Verify downloaded assets

Download all release assets into one directory. With Cosign installed, run:

cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity 'https://github.com/Flowdular/flowdular/.github/workflows/platform-release.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --certificate-github-workflow-sha 'f25a805735a888eb614b56e5dce3aea1126ac469'
sha256sum --check SHA256SUMS

Signatures cover the listed artifacts through SHA256SUMS. Git tags and GitHub-generated source downloads are not signed by this workflow; use the attached signed source archive. The release workflow publishes the verified npm packages in a later job for non-draft releases.

Flowdular v0.6.4

Flowdular v0.6.4

Source commit: a709ab1

Previous release: v0.6.3

Full comparison

Packages

Package	Version	Artifact
@flowdular/sdk	0.6.4	flowdular-sdk-0.6.4.tgz
flowdular	0.6.4	flowdular-0.6.4.tgz
create-flowdular	0.6.4	create-flowdular-0.6.4.tgz
@flowdular/sandbox	0.6.4	flowdular-sandbox-0.6.4.tgz

Changes

• fix(sandbox): keep the skeleton's translation keys and route named files (9b869ecc)
• fix(sandbox): let the frontend write translations and merge bundles in the CLI (6b8ab852)
• fix(sandbox): let the frontend hand wording to the business manager (ac5512fc)
• test(sandbox): keep the run 5 role fixture and cover a symlinked bundle (fc9960ac)
• Merge pull request #150 from Flowdular/fix/sandbox-scaffold-translations (36c81a0a)
• fix(sandbox): let a module review pass and say why a chain pauses (ed6b342c)
• fix(sandbox): let the UX designer write screen designs (f2209b87)
• fix(sandbox): say why a review report is not accepted (7853886d)
• fix(sandbox): find local paths from their .flowdular segment (b0b5d100)
• fix(sandbox): keep the walk back to a path inside that path (a26dd80f)
• fix(sandbox): read quotes from the line start when finding a path (8ea35b36)
• Merge pull request #151 from Flowdular/fix/sandbox-review-cycle (28ad9f18)
• release: 0.6.4 (b3fb7b09)
• Merge pull request #152 from Flowdular/release/0.6.4 (a709ab1b)

All 14 commits, their complete messages and the file summary are included in the attached CHANGELOG.md.

Verify downloaded assets

Download all release assets into one directory. With Cosign installed, run:

cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity 'https://github.com/Flowdular/flowdular/.github/workflows/platform-release.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --certificate-github-workflow-sha 'a709ab1b05762206b58f3455fac003a7d1e34f06'
sha256sum --check SHA256SUMS

Signatures cover the listed artifacts through SHA256SUMS. Git tags and GitHub-generated source downloads are not signed by this workflow; use the attached signed source archive. The release workflow publishes the verified npm packages in a later job for non-draft releases.

Flowdular v0.6.3

Flowdular v0.6.3

Source commit: 2e1c1e1

Previous release: v0.6.2

Full comparison

Packages

Package	Version	Artifact
@flowdular/sdk	0.6.3	flowdular-sdk-0.6.3.tgz
flowdular	0.6.3	flowdular-0.6.3.tgz
create-flowdular	0.6.3	create-flowdular-0.6.3.tgz
@flowdular/sandbox	0.6.3	flowdular-sandbox-0.6.3.tgz

Changes

• fix(sandbox): keep a reasoning line whole for its ellipsis and title (73c58532)
• Merge pull request #142 from Flowdular/fix/sandbox-reasoning-line (51e8a8ce)
• fix(sandbox): validate a module after a turn writes files it checks (9cb7ec1f)
• fix(sandbox): hand named work only to a role that may write it (6a74a8a5)
• fix(sandbox): show every draft module in the preview shell (fe58f0e2)
• Merge pull request #143 from Flowdular/fix/sandbox-handoff-scope (b4fd7447)
• Merge pull request #144 from Flowdular/fix/sandbox-preview-draft-navigation (32b8b050)
• fix(sandbox): list the composed modules in the preview's module catalog (8e91486e)
• Merge pull request #145 from Flowdular/fix/sandbox-preview-catalog (4f4afb2a)
• fix(sandbox): show a review verdict as a summary, not raw JSON (0a6ddfe4)
• test(sandbox): refuse a passing review whose check has no evidence (f37d8068)
• Merge pull request #146 from Flowdular/fix/sandbox-review-verdict-card (c41c88d3)
• fix(sandbox): read a failing review through the shared report parser (1e92c81e)
• Merge pull request #147 from Flowdular/fix/sandbox-review-fail-parser (99a3967d)
• fix(sandbox): run every gate that checks a file the turn wrote (ff12fc6a)
• fix(sandbox): show the session's own state while a chain runs (cab6d2b8)
• Merge pull request #148 from Flowdular/fix/sandbox-gates-by-files-and-chip (31796be5)
• release: 0.6.3 (bf73c1b0)
• Merge pull request #149 from Flowdular/release/0.6.3 (2e1c1e12)

All 19 commits, their complete messages and the file summary are included in the attached CHANGELOG.md.

Verify downloaded assets

Download all release assets into one directory. With Cosign installed, run:

cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity 'https://github.com/Flowdular/flowdular/.github/workflows/platform-release.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --certificate-github-workflow-sha '2e1c1e128eb9c9263a9f0d7e3400f594d428337a'
sha256sum --check SHA256SUMS

Signatures cover the listed artifacts through SHA256SUMS. Git tags and GitHub-generated source downloads are not signed by this workflow; use the attached signed source archive. The release workflow publishes the verified npm packages in a later job for non-draft releases.

Flowdular v0.6.2

Flowdular v0.6.2

Source commit: 1092d8e

Previous release: v0.6.1

Full comparison

Packages

Package	Version	Artifact
@flowdular/sdk	0.6.2	flowdular-sdk-0.6.2.tgz
flowdular	0.6.2	flowdular-0.6.2.tgz
create-flowdular	0.6.2	create-flowdular-0.6.2.tgz
@flowdular/sandbox	0.6.2	flowdular-sandbox-0.6.2.tgz

Changes

• fix(reference): bind the catalog reference to flowdular.tenant_id (4cfac465)
• chore(reference): keep the catalog reference as a plain in-repo module (134b2651)
• docs: stop naming the separate module repository (5f658ae8)
• fix(sandbox): give every agent turn the sandbox's own time limit (2693d8de)
• fix(sandbox): keep long transcript lines inside the chat column (e927569c)
• spec(reference): approve catalog.core 0.8.2 (0429f3f9)
• Merge pull request #132 from Flowdular/fix/catalog-reference-names (82ac3132)
• Merge pull request #133 from Flowdular/fix/sandbox-turn-time-limit (80b57a30)
• feat(sandbox): send an implementer's questions through the spec owner (ac8f5a3a)
• feat(agents): implementing roles ask instead of deciding (3d63cf90)
• feat(sandbox): fail module rules on a permission the spec does not list (a02317ef)
• docs(sandbox): describe questions an implementer asks (4514d922)
• fix(coding-agent): report an operator stop of a BYOK turn as aborted (81a6a968)
• Merge pull request #134 from Flowdular/feat/sandbox-implementation-questions (46c33e87)
• fix(sandbox): answer a reload inside the preview (9371c848)
• fix(sandbox): leave the gate verdict as the session state (59102a0a)
• fix(sandbox): inset the quality checks drawer like every other drawer (e8be22d2)
• fix(sandbox): put a question's options on their own line (ea4951b1)
• fix(sandbox): keep the verdict a turn wrote while a check ran (1c4eda71)
• Merge pull request #135 from Flowdular/fix/byok-abort-finish-reason (3d4c2bf5)
• Merge pull request #136 from Flowdular/fix/sandbox-preview-status (9a8388a5)
• fix(sandbox): route gate repairs to a role that can write the fix (a2775970)
• Merge pull request #137 from Flowdular/fix/sandbox-gate-repair-routing (28c427c6)
• fix(sandbox): resume an implementer with its answers before a repair (dd4f99b0)
• fix(sandbox): keep why a repair chain stopped in the transcript (55bdf9be)
• fix(sandbox): redact the handoff prompt before it is stored (37b4fce7)
• Merge pull request #138 from Flowdular/fix/sandbox-repair-follow-ups (7fde625b)
• fix(sandbox): stop module rules failing correct module code (3f89e34f)
• fix(sandbox): redact all transcript fields, stored and streamed (50480f39)
• Merge pull request #139 from Flowdular/fix/sandbox-module-rules-false-positives (91c934fd)
• Merge pull request #140 from Flowdular/fix/sandbox-transcript-redaction (b8a2a34c)
• release: 0.6.2 (b9b4e3ee)
• Merge pull request #141 from Flowdular/release/0.6.2 (1092d8e8)

All 33 commits, their complete messages and the file summary are included in the attached CHANGELOG.md.

Verify downloaded assets

Download all release assets into one directory. With Cosign installed, run:

cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity 'https://github.com/Flowdular/flowdular/.github/workflows/platform-release.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --certificate-github-workflow-sha '1092d8e8ad3e8291a10b6a3b3a62a4c2752c6910'
sha256sum --check SHA256SUMS

Signatures cover the listed artifacts through SHA256SUMS. Git tags and GitHub-generated source downloads are not signed by this workflow; use the attached signed source archive. The release workflow publishes the verified npm packages in a later job for non-draft releases.

Flowdular v0.6.1

Flowdular v0.6.1

Source commit: 0f14ceb

Previous release: v0.6.0

Full comparison

Packages

Package	Version	Artifact
@flowdular/sdk	0.6.1	flowdular-sdk-0.6.1.tgz
flowdular	0.6.1	flowdular-0.6.1.tgz
create-flowdular	0.6.1	create-flowdular-0.6.1.tgz
@flowdular/sandbox	0.6.1	flowdular-sandbox-0.6.1.tgz

Changes

• ui: let a single row action scroll with a narrow table (c3f6fd58)
• spec(system): draft 0.9.2 operator-only platform settings (55906a50)
• spec(system): approve 0.9.2 (4ff73863)
• system: change platform settings only from the operator workspace (7deef88f)
• docs: name the operator workspace that changes platform settings (97bfdd79)
• infra: pass FD_OPERATOR_TENANT to the app container (1a28fdcc)
• test(system): keep the operator workspace tests independent (ce8e8c3c)
• Merge pull request #99 from Flowdular/fix/tablecard-mobile (0b175a4b)
• Merge pull request #98 from Flowdular/fix/settings-platform-scope (105318bc)
• spec(system): draft 0.9.3 operator workspace recorded by first-run setup (3c31777e)
• spec(auth): draft 0.14.8 with the owner's operator answers (061031ad)
• platform: let the setup done page request its restart (26718f3f)
• sandbox: read the platform mode from its first answer (bdb38c40)
• sandbox: record the platform address the launcher starts (a967fa8c)
• spec(auth,system): approve auth.core 0.14.8 and system.core 0.9.3 (49ebe8c9)
• test: let the Chrome helper open a served page and type into it (7ace3b7d)
• fix: refuse invalid workspace address characters while typing (92fe8723)
• sandbox: send a refused questions block back to the specialist (a1c151a3)
• fix(sandbox): stop the launcher's platform when the launcher dies (e4c65c0c)
• sandbox: treat an exited platform process group as stopped (5df8a07d)
• sandbox: test cancelling startup before the platform answers (1b1329cd)
• sandbox: move only the credential the launcher collected (ff805d4b)
• sandbox: approve only the specification text the operator reviewed (dd2092a8)
• sandbox: follow session changes made from another tab or browser (bc802317)
• Merge remote-tracking branch 'origin/main' into fix/sandbox-session-fixes (539b48ee)
• fix: clear the CI audit for source-map-js (c3300627)
• Merge pull request #101 from Flowdular/fix/ci-audit-source-map-js (adc52628)
• coding-agent: give the business manager room for the questions limits (450ba8b7)
• Merge remote-tracking branch 'origin/main' into fix/sandbox-platform-restart (3f04303c)
• Merge origin/main into fix/setup-slug-typing (0c8d55da)
• Merge remote-tracking branch 'origin/main' into fix/sandbox-session-fixes (1a29b777)
• Merge pull request #102 from Flowdular/fix/sandbox-platform-restart (539068c8)
• Merge pull request #100 from Flowdular/fix/setup-slug-typing (2a830c42)
• Keep a closed PostgreSQL connection from crashing the process (09f79fca)
• Keep a dropped connection from crashing deploy start vercel (5bc4ff6c)
• Merge remote-tracking branch 'origin/main' into fix/setup-operator-tenant (aed5de4a)
• Merge remote-tracking branch 'origin/main' into fix/sandbox-session-fixes (6d0c6fa0)
• Merge origin/main into fix/sandbox-process-leak (7958a3b1)
• auth: record the deployment's operator workspace (c48aa2e0)
• system: take the operator workspace from auth.core's record (cddd1a5a)
• platform: test that first-run setup records the operator workspace (8bb77e2e)
• docs: describe the recorded operator workspace and the override (8de81e9c)
• chore: bump auth.core to 0.14.8 and system.core to 0.9.3 (23d34951)
• chore: remove the cl script from generated apps (bcbe9136)
• Merge pull request #103 from Flowdular/fix/sandbox-session-fixes (fe48f813)
• fix: fold accented letters in the workspace address (ac942e83)
• fix(sandbox): keep the platform guard alive through stop() (0af3a478)
• Merge remote-tracking branch 'origin/main' into fix/pg-pool-idle-error (81a6e9f2)
• auth: resolve a workspace id before a slug that spells it (81ee9cde)
• Merge pull request #105 from Flowdular/fix/pg-pool-idle-error (4c12b84b)

All 179 commits, their complete messages and the file summary are included in the attached CHANGELOG.md.

Verify downloaded assets

Download all release assets into one directory. With Cosign installed, run:

cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity 'https://github.com/Flowdular/flowdular/.github/workflows/platform-release.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --certificate-github-workflow-sha '0f14ceb7d1ace1525aebdd4a112d0cc385307fde'
sha256sum --check SHA256SUMS

Signatures cover the listed artifacts through SHA256SUMS. Git tags and GitHub-generated source downloads are not signed by this workflow; use the attached signed source archive. The release workflow publishes the verified npm packages in a later job for non-draft releases.

Flowdular v0.6.0

Flowdular v0.6.0

Source commit: 07106be

Previous release: v0.5.1

Full comparison

Packages

Package	Version	Artifact
@flowdular/sdk	0.6.0	flowdular-sdk-0.6.0.tgz
flowdular	0.6.0	flowdular-0.6.0.tgz
create-flowdular	0.6.0	create-flowdular-0.6.0.tgz
@flowdular/sandbox	0.6.0	flowdular-sandbox-0.6.0.tgz

Changes

• Add first-run setup to Docker and generated projects (5a4215ee)
• Complete first-run sandbox handoff (f8a0187e)
• Merge pull request #81 from Flowdular/core/platform-first-run-setup (ac792f28)
• Add Module Studio plans across platform and sandbox (5d9dd2e3)
• Remove direct module install and update paths (73ed87fb)
• Specify custom workflow node contracts (dceae205)
• Define cache and search index adapter ports (#83) (f789e428)
• Approve custom workflow node specifications (ed58dd1e)
• Draft automations dependency compatibility spec (88f20ff2)
• Expose versioned workflow action templates (bc2215dd)
• Keep uncertain connector calls terminal (0c2ad91e)
• Add action-backed workflow nodes and safe run trails (ed0fd12a)
• Route custom node requests to workflow authoring (30b87bbd)
• Merge remote-tracking branch 'origin/main' into feat/workflows-node-templates (34869a2a)
• Bump platform API for workflow template fields (451e399c)
• Sync the agents v2 capability into composition (46df6ae0)
• Sync SDK starter composition with agent action v2 (a2e25848)
• Add deployment target preflight and Render blueprint (c3ed6759)
• Harden workflow action execution and evidence (32f4ba71)
• Scope agent migration probe to current schema (6024ebe7)
• Clarify Render prerequisites and derive public origin (b810eff9)
• Derive legacy action side-effect keys under RLS (a95e87a7)
• Approve automations.core 0.6.11 specification (075ae78e)
• Approve system.core 0.9.1 specification (d201fba3)
• Align workflow module versions with approved specs (1539d372)
• Merge pull request #84 from Flowdular/feat/workflows-node-templates (3aa406f9)
• Harden deployment preflight and Render source links (da01b559)
• Refresh README for sandbox and deployment paths (2722eca9)
• Merge remote-tracking branch 'origin/main' into feat/deployment-capabilities (aa1dd7dc)
• Merge pull request #85 from Flowdular/feat/deployment-capabilities (02eb050e)
• Merge main after cache and search core changes (309515d2)
• Merge main after deployment CLI changes (a22c03e8)
• Show installed artifact hash in Module Studio (0acb30bd)
• Remove legacy Sandbox delivery target handling (a58dc35d)
• Merge pull request #82 from Flowdular/core/module-studio (9bc9aa94)
• Upgrade the app runtime to Octane 0.8 (d4297483)
• Align DOM property checks with Octane 0.8 (fda44f6c)
• Wait for action claim release before asserting queue state (733e15d5)
• Merge pull request #86 from Flowdular/core/octane-08-upgrade (2cc6673f)
• test: keep optional host modules out of starter expectations (#87) (00f68cd6)
• docs: describe published Flowdular 0.5.1 setup (33101f7f)
• docs: align getting started with first-run setup (7b1f3456)
• Merge pull request #88 from Flowdular/docs/release-051-readme (81bed66c)
• Specify web and worker module startup contracts (17e5b663)
• Record approved worker lifecycle specifications (6909450a)
• Grant decisions scopes in auth workspaces (#89) (d7659550)
• feat(deploy): add experimental Vercel web artifact and preflight (6828f377)
• Prepare queued modules for separate worker startup (ecb2ca8f)
• Start module workers by runtime role (f7ecb7a7)
• Start module workers by runtime role (307ac8a2)

All 136 commits, their complete messages and the file summary are included in the attached CHANGELOG.md.

Verify downloaded assets

Download all release assets into one directory. With Cosign installed, run:

cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity 'https://github.com/Flowdular/flowdular/.github/workflows/platform-release.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --certificate-github-workflow-sha '07106be05894af8ee7384168c492b1e65d90acfc'
sha256sum --check SHA256SUMS

Signatures cover the listed artifacts through SHA256SUMS. Git tags and GitHub-generated source downloads are not signed by this workflow; use the attached signed source archive. The release workflow publishes the verified npm packages in a later job for non-draft releases.

Flowdular v0.5.1

Flowdular v0.5.1

Source commit: 06e60b7

Previous release: v0.5.0

Full comparison

Packages

Package	Version	Artifact
@flowdular/sdk	0.5.1	flowdular-sdk-0.5.1.tgz
flowdular	0.5.1	flowdular-0.5.1.tgz
create-flowdular	0.5.1	create-flowdular-0.5.1.tgz
@flowdular/sandbox	0.5.1	flowdular-sandbox-0.5.1.tgz

Changes

• Make sandbox a standalone development environment (c6c6bc5e)
• Publish Flowdular 0.5.1 packages with platform releases (e0e0414d)
• Merge pull request #80 from Flowdular/core/sandbox-standalone-ade (06e60b7d)

All 3 commits, their complete messages and the file summary are included in the attached CHANGELOG.md.

Verify downloaded assets

Download all release assets into one directory. With Cosign installed, run:

cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity 'https://github.com/Flowdular/flowdular/.github/workflows/platform-release.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --certificate-github-workflow-sha '06e60b7d0e8b0ac466bd02920a2c35d3865fc680'
sha256sum --check SHA256SUMS

Signatures cover the listed artifacts through SHA256SUMS. Git tags and GitHub-generated source downloads are not signed by this workflow; use the attached signed source archive. The release workflow publishes the verified npm packages in a later job for non-draft releases.

Flowdular v0.5.0

Flowdular v0.5.0

Source commit: d65b299

Previous release: v0.4.3

Full comparison

Packages

Package	Version	Artifact
@flowdular/sdk	0.5.0	flowdular-sdk-0.5.0.tgz
flowdular	0.5.0	flowdular-0.5.0.tgz
create-flowdular	0.5.0	create-flowdular-0.5.0.tgz
@flowdular/sandbox	0.5.0	flowdular-sandbox-0.5.0.tgz

Changes

• feat(branding): brand the backoffice from the platform settings (#75) (6ba1cbc5)
• core(ai-provider): add the typed decision port (fb25e97e)
• fix(cli): let migrate-state run when both state roots exist (32389696)
• feat(create-flowdular): ship the sandbox, a model key and the role subagents (e977b732)
• feat(sandbox): read a model key from the workspace and classify with decisions (1c5fb39a)
• feat(agents,workflows): typed decisions behind a workspace flag (01d1a510)
• fix(create-flowdular): declare the decision capability in the template composition (f81c5d91)
• fix(branding): close the three notes the branding review left open (#77) (e3532a54)
• Merge pull request #76 from Flowdular/feat/core-typed-decisions (d408c49d)
• feat(docs): render handbook markdown into branded print-ready HTML (7d3dfe07)
• feat(sandbox): frozen evaluation suite for the implementation skills (6858941d)
• feat(ui): three-bar brand mark (8c29e974)
• Merge pull request #79 from Flowdular/feat/three-bar-brand-mark (3c04bfe2)
• Merge pull request #78 from Flowdular/feat/evals-and-doc-pipeline (9659135c)
• feat(sandbox): close the containment gaps and gate eject on the module rules (0205547d)
• feat(sandbox): make the recorded approval unforgeable and bound the transcript (7969c600)
• feat(sandbox): check the build against the approved specification (6d87ef16)
• feat(sandbox): create a workspace when there is none (524d13a1)
• fix(.ai): correct the API names and rule numbers the skills cite (af5d5fd2)
• docs: showcase Flowdular with a product demo (0ac46300)
• fix: restore CI audit and SDK consumer smoke (0fa1aa9d)
• fix(sandbox): a slow preview reports a slow preview (e35a8c37)
• feat(sandbox): prepare its own platform access and start the application (e9447091)
• fix(sandbox): provision before the application holds the database (a59978e9)
• feat(sandbox): provision inside the application boot instead of a second process (44119d1f)
• fix(sandbox): set the provision request before the application is spawned (bcdccbfc)
• fix(sandbox): a valid operator address and a non-fatal provision (f0427f39)
• fix(sandbox): mint one sandbox credential per workspace (064f831b)
• fix(sandbox): mark provisioning separately from the credential it writes (40002d1f)
• feat(sandbox): the business flow needs no setup steps (60067671)
• fix(database): release the auth lease the sandbox commands were leaking (7975b0f7)
• fix(modules): give back every lease when a module command fails part way (5ce27782)
• feat(kernel): a declared lifecycle is now enforceable (ad5570e2)
• fix(sandbox): do not fail a turn because pnpm restamped its own lockfile (cc844474)
• fix(sandbox): a directory pnpm created is not the model writing outside its role (f06d165b)
• fix: clear the CI audit and update the sandbox consumer check to the new contract (f4e77059)
• fix(smoke): wait for the sandbox connection instead of asserting it (b7aa8463)
• fix(smoke): the packed consumer has no application to connect to (3232efc1)
• fix(sandbox): serve the dashboard before the application boots (70542f21)
• fix(sandbox): the deferred platform startup referenced an undeclared binding (b2f0b12b)
• fix(sandbox): a refresh re-reads the credential the launcher wrote (259533e6)
• fix(cli): a scaffolded lifecycle declares the kernel its guard imports (f5be922b)
• release: 0.5.0 (d65b2998)

All 43 commits, their complete messages and the file summary are included in the attached CHANGELOG.md.

Verify downloaded assets

Download all release assets into one directory. With Cosign installed, run:

cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity 'https://github.com/Flowdular/flowdular/.github/workflows/platform-release.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --certificate-github-workflow-sha 'd65b299803dba4f3740d801958c77aa576900ff4'
sha256sum --check SHA256SUMS

Signatures cover the listed artifacts through SHA256SUMS. Git tags and GitHub-generated source downloads are not signed by this workflow; use the attached signed source archive. This action does not publish to npm.

Flowdular v0.4.3

Flowdular v0.4.3

Source commit: 894e95e

Previous release: v0.4.1

Full comparison

Packages

Package	Version	Artifact
@flowdular/sdk	0.4.3	flowdular-sdk-0.4.3.tgz
flowdular	0.4.3	flowdular-0.4.3.tgz
create-flowdular	0.4.3	create-flowdular-0.4.3.tgz
@flowdular/sandbox	0.4.3	flowdular-sandbox-0.4.3.tgz

Changes

• fix(database): name a locked or unreadable local database (ff979204)
• Merge pull request #63 from Flowdular/fix/local-database-guard (9f0ab43b)
• feat(spec): declare a feature flag, and use one (35486fcb)
• Merge pull request #64 from Flowdular/feat/spec-feature-flags (7a667184)
• feat(auth): configure the SMTP relay from module settings (7e799be4)
• test(auth): cover the mail settings refusals, precedence and test route (d86e147c)
• fix(auth): refuse a relay URL whose credentials are not percent-encoded (9887af61)
• fix(auth): keep the test route's refusal to the mail port's own words (5600ffae)
• fix(create-flowdular): retarget the example module at auth.core 0.14 (8b17f589)
• test(agents): stub auth.core at the version the dependency range names (95966b99)
• Merge pull request #65 from Flowdular/feat/mail-settings-ui (801bfbae)
• fix(ui): line a settings group head up with its rows (6e05ae6e)
• Merge pull request #66 from Flowdular/fix/flags-group-header (7c59ab4d)
• spec(agents): the workspace assistant as a thread of runs (ddcf1167)
• feat(agents): store assistant threads and turns (8d480737)
• test(agents): cover the assistant scenarios end to end (b54887f7)
• feat(auth): seed and backfill the workspace assistant scope (95e7ecf4)
• fix(agents): write a settled run onto its assistant turn (dd0c11e4)
• chore(agents): keep the assistant translation namespace for the client (f94b7d9f)
• perf(agents): index the turn a settled run is written onto (a41f3b71)
• test(agents): cover the assistant conversation data class (a9d3ed28)
• fix(agents): keep the new spec invariant a YAML string (21249f5d)
• Merge pull request #67 from Flowdular/feat/platform-assistant (4f3a36fd)
• feat(auth): let an API token write and bind it to browser origins (9bec9c85)
• feat(core): describe the served API and open it to a named browser origin (c16a564b)
• feat(system): show the deployment's API in Administration (dc21bab9)
• feat(core): serve the API document from a generated application too (f76fc54a)
• feat(auth): bound what an API token may spend per minute (46b876e5)
• feat(agents): the workspace assistant in the header (#68) (8f72e986)
• fix(database-testing): run its own suites on the preset it publishes (60cf217f)
• fix(sandbox): read a denied SDK lookup as an absent SDK (d85bb715)
• Merge pull request #69 from Flowdular/core/server-public-api-openapi (ce280cfb)
• feat(design): design a screen as a preview the platform dresses (b8018e36)
• Merge pull request #70 from Flowdular/core/ui-preview-harness (0f47ae68)
• fix(agents): give the lease renewal case room to be measured (814ed959)
• feat(design): show a preview to the person who asked for it (71f25595)
• Merge pull request #71 from Flowdular/fix/agents-action-lease-flake (dede4e87)
• Release 0.4.2 of the SDK, the CLI, the generator and the sandbox (86cf6ccb)
• chore(release): keep every place that carries the version in step (5ae99fbd)
• fix(cli): translate every library the SDK publishes into a scaffolded module (13da7a63)
• Merge pull request #72 from Flowdular/release/0.4.2 (ce540f67)
• fix(web): stop a development page painting before its own stylesheets (7b08ddcb)
• feat(web): mount a module site from the command line, at the address it needs (b477bc5c)
• Merge pull request #73 from Flowdular/core/cli-web-mount (329e4443)
• Release 0.4.3 of the SDK, the CLI, the generator and the sandbox (91ee36ab)
• Merge pull request #74 from Flowdular/release/0.4.3 (894e95e0)

All 46 commits, their complete messages and the file summary are included in the attached CHANGELOG.md.

Verify downloaded assets

Download all release assets into one directory. With Cosign installed, run:

cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity 'https://github.com/Flowdular/flowdular/.github/workflows/platform-release.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --certificate-github-workflow-sha '894e95e0f6bd49aa4390abb813b2a4464ca39580'
sha256sum --check SHA256SUMS

Signatures cover the listed artifacts through SHA256SUMS. Git tags and GitHub-generated source downloads are not signed by this workflow; use the attached signed source archive. This action does not publish to npm.

Flowdular v0.4.1

Flowdular v0.4.1

Source commit: a102bfb

Previous release: v0.4.0

Full comparison

Packages

Package	Version	Artifact
@flowdular/sdk	0.4.1	flowdular-sdk-0.4.1.tgz
flowdular	0.4.1	flowdular-0.4.1.tgz
create-flowdular	0.4.1	create-flowdular-0.4.1.tgz
@flowdular/sandbox	0.4.1	flowdular-sandbox-0.4.1.tgz

Changes

• fix(metering): read meter labels and units in the workspace language (83cd36c1)
• Merge pull request #59 from Flowdular/fix/meter-units-and-flag-count (4a5da7cd)
• fix(contracts): read a plural family only when a count can select it (ed09715d)
• Merge pull request #60 from Flowdular/fix/plural-family-detection (aafeab55)
• fix(kernel): keep the barrel loadable in a generated application (957c86ec)
• Merge pull request #61 from Flowdular/fix/kernel-browser-semver (260f4ac1)
• Release 0.4.1 of the SDK, the CLI, the generator and the sandbox (fc2cfbfd)
• Merge pull request #62 from Flowdular/release/0.4.1 (a102bfb1)

All 8 commits, their complete messages and the file summary are included in the attached CHANGELOG.md.

Verify downloaded assets

Download all release assets into one directory. With Cosign installed, run:

cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity 'https://github.com/Flowdular/flowdular/.github/workflows/platform-release.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --certificate-github-workflow-sha 'a102bfb14a26a655ee0cb03c589f3034369b2737'
sha256sum --check SHA256SUMS

Signatures cover the listed artifacts through SHA256SUMS. Git tags and GitHub-generated source downloads are not signed by this workflow; use the attached signed source archive. This action does not publish to npm.