v1.2.0

[1.2.0] — 2026-06-11

Changed

• App-context windows can now genuinely close themselves. Browsers only honour
  window.close() when the window has an opener or its back/forward stack holds fewer than two
  entries (the OAuth-popup pattern). The app opens the forms with noopener, and a native POST
  navigation made the success page entry #2 — so the v1.1.1 Close button always fell back to the
  ✕ hint. In app context the form now submits via fetch() and the response (success, form
  error, or error page) replaces the document in place, keeping the stack at one entry — the
  Close button is then permitted to dismiss the tab/Custom Tab. Native form POST remains for
  direct visitors, no-JS, and as the automatic fallback if fetch() fails. (#6 follow-up)

v1.1.1

[1.1.1] — 2026-06-11

Fixed

• App-context exit is now best-effort, not just instructional. The success/message pages'
  "close this window" guidance gains a Close this window button that attempts
  window.close() — which works when the form was opened as a plain script-opened tab — and,
  where the in-app overlay (Android Custom Tab / iOS in-app Safari) refuses it, the button swaps
  for a pre-rendered hint pointing at the overlay's own ✕. The static instruction line remains
  for the no-JS case. (#6 follow-up)

v1.1.0

[1.1.0] — 2026-06-11

Fixed

• In-app overlay exit (#6). The form's "← PunchIn" back link and the post-submit "Done" button
  pointed at /, which — inside the in-app browser overlay the PWA opens (Android Custom Tab /
  iOS in-app Safari) — loaded a second copy of the app inside the overlay instead of returning
  to the PWA. The app now marks its links with ?from=app (carried through the form like
  theme/accent); in that context the pages drop every root link and show "close this window to
  get back to PunchIn" instead. Direct visitors keep a link, relabelled "Back to PunchIn".
  Requires the companion punchin change that adds the param to its feedback links.

Changed

• Relicensed Apache-2.0 → Business Source License 1.1 (PR #4), matching the PunchIn app's
  licensing model. Individuals may still use, modify, and self-host the worker to run feedback
  intake for a project or repository they personally control, at no charge (the LICENSE's
  Additional Use Grant); organizational use requires a commercial license from PunchIn-App.
  On the Change Date (2030-06-02) the work relicenses to AGPL-3.0.

v1.0.1

First tagged release of punchin-feedback — the account-free bug-report / feature-request intake Worker for PunchIn.

Added

• Account-free intake worker: /bug and /feature forms derived from the live GitHub issue-form templates (KV cache + bundled offline fallback), filing real issues via a GitHub App, with R2 screenshot uploads, optional reporter email (copy / closed / reopened, unsubscribe + List-Unsubscribe), retention sweeps, and spam controls (honeypot, per-IP rate limit, optional Turnstile).
• Two-way issue comments: reporters can opt into comment notifications and reply by email (posted back as an issue comment, sender-verified, no loops).
• Repo governance + project-board automation brought to parity with the sibling punchin-email worker (SECURITY, CODE_OF_CONDUCT, CONTRIBUTING, issue/PR templates, dependabot, CI template-sync job, release/board workflows).

92 tests passing. Full details in docs/CHANGELOG.md.