v0.5.0-beta.6

What's Changed

• feat(webchat): verify workspace member links by @mrgoonie in #53
• chore(release): prepare webchat beta.6 by @mrgoonie in #54

Full Changelog: v0.5.0-beta.5...v0.5.0-beta.6

v0.5.0-beta.5

0.5.0-beta.5

Fixes beta.4's widget rejection of tagged public Worker service-binding image tickets. Approved images can now load in inline and floating widgets; malformed tickets remain rejected. See #51 for verification.

This beta includes the opt-in public Worker image service binding. Binding calls bypass hostname security rules: expose public directories only, and change the service ID when repointing a binding. See the package README.

The 0.5.0 beta requires a legacy signing secret of at least 32 bytes. PHP rate limiting fails closed if private storage cannot be verified; Windows hosts need an atomic shared limiter. PHP image fetching on Windows remains unavailable without verified private locking. Hosted credential requests and page context are opt-in, and their deployed signed-in/end-to-end staging journeys remain unverified.

This is a prerelease; npm latest remains on the stable version.

v0.5.0-beta.4

Known issue: The widget in this beta rejects tagged service-binding image tickets, so this new image path does not render. Upgrade to 0.5.0-beta.5 or later for the fix.

0.5.0-beta.4

This beta adds opt-in public Cloudflare Worker service bindings for approved image paths on sibling hostnames. Service bindings bypass hostname security rules: expose public directories only and change the service ID when repointing a binding. See the package README for setup.

This release includes the 0.5.0 beta changes: hosted credential requests and per-turn page context are opt-in, and the legacy secret must contain at least 32 bytes. PHP rate limiting fails closed when private storage is unavailable; configure a shared limiter on Windows. PHP image fetching on Windows remains unavailable when private locking cannot be verified. The hosted credential and page-context journeys still require deployed Gateway/CCP staging verification.

The npm latest tag remains on the stable release. This is a prerelease for testing.

Changes: #49

v0.5.0-beta.3

Beta upgrade notes

• Hosted credential requests are off by default. They require CCP signed-in identity, Gateway/agent support, and an explicitly pinned HTTPS Dewee form origin. The visitor enters credentials only in the authenticated hosted form, never in the chat widget. The deployed end-to-end journey has not yet been verified.
• Direct Gateway transport now suppresses credential-tool payloads and unmatched or malformed tool results to avoid exposing handoff information.
• Legacy Gateway hosts must configure a visitor secret of at least 32 bytes; an ephemeral secret is an explicit development-only option.
• PHP returns 503 when its default limiter storage or a custom limiter is unavailable. Windows hosts need an atomic shared limiter unless deliberately disabled; PHP image fetching still requires verified private lock storage and is unavailable on Windows by default.
• Markdown images use a bounded backend proxy. Workers can opt in to exact same-origin public Assets paths; the binding bypasses site middleware and must not expose private files. Sibling same-zone hosts remain restricted.
• Optional page context is disabled by default and requires visitor consent and Gateway/CCP support for v1.

This is a prerelease. Live verification of the credential handoff, page context and navigation/history flow remains outstanding.

What's Changed * feat: add hosted credential request handoff by @mrgoonie in #45 * chore(release): prepare 0.5.0 beta 3 by @mrgoonie in #46 * fix(widget): show credential request progress by @mrgoonie in #47 Full Changelog: v0.5.0-beta.2...v0.5.0-beta.3

v0.5.0-beta.2

Beta upgrade notes

• Legacy Gateway hosts must configure a visitor secret of at least 32 bytes; the ephemeral secret is for explicit development use only.
• PHP returns 503 when its default limiter storage or a custom limiter is unavailable. Windows hosts need an atomic shared limiter unless deliberately disabled; PHP image concurrency still requires verified private storage.
• Images use a bounded backend proxy and approved sources. Workers can optionally proxy same-origin files from explicitly public Assets directories; that binding bypasses site middleware and must never expose private files. Sibling same-zone hosts remain restricted.
• Optional page context is disabled by default and requires visitor consent and Gateway/CCP support for v1.

This is a prerelease. Authenticated credential handoff, Windows-backed image locking, and deployed end-to-end verification remain open.

What's Changed * fix: support public Worker image assets by @mrgoonie in #43 * chore(release): prepare 0.5.0 beta 2 by @mrgoonie in #44 Full Changelog: v0.5.0-beta.1...v0.5.0-beta.2

v0.5.0-beta.1

Beta: upgrade notes

• Legacy Gateway hosts must configure a visitor secret of at least 32 bytes. A generated process-local secret is available only through the explicit development option.
• PHP fails closed with 503 rate_limit_unavailable when private limiter storage or a custom limiter is unavailable. Windows hosts need an atomic shared rateLimit callback unless they explicitly disable the limiter. PHP image proxy concurrency still requires verified private storage.
• Markdown images use a bounded backend proxy and explicit source policy. Workers currently refuse same-zone sources; image failures retain a fallback.
• Optional page context is off by default and requires visitor consent and a runtime advertising v1. Gateway/CCP must include the matching support before it can be used.

This is a prerelease. Open work: authenticated credential handoff, secure Windows image locking, Workers same-zone images, and live end-to-end verification.

What's Changed

• test(examples): CCP-first smoke coverage for Astro Node and Next.js hosts by @mrgoonie in #24
• fix(widget): restore compact action results in history by @mrgoonie in #29
• fix(server): require stable visitor secrets by default by @mrgoonie in #30
• fix(widget): preserve session renewal ordering by @mrgoonie in #31
• feat(server): support shared identity session stores by @mrgoonie in #32
• feat(php): support signed-in identity sessions by @mrgoonie in #34
• test: make forged signature fixtures deterministic by @mrgoonie in #37
• feat(widget): render images through bounded proxy by @mrgoonie in #38
• fix(example): update Next.js security release by @mrgoonie in #39
• fix(php): fail closed when rate limiter is unavailable by @mrgoonie in #40
• feat(widget): add consented current page context by @mrgoonie in #41
• chore(release): prepare 0.5.0 beta 1 by @mrgoonie in #42

Full Changelog: v0.4.2...v0.5.0-beta.1

v0.4.2

What's Changed

• feat(widget): add opt-in built-in DOM page actions by @mrgoonie in #23
• fix(widget): keep the page-action ack per session visitor by @mrgoonie in #27
• chore(release): 0.4.2 by @mrgoonie in #28

Full Changelog: v0.4.1...v0.4.2

v0.4.1

What's Changed

• feat(server): verified signed-in users through dewee identity session exchange by @mrgoonie in #6
• feat: map gateway admission errors (POLICY_DENIED / RATE_LIMITED) with cooldown UI by @mrgoonie in #12
• feat: CCP transport for the CCP-managed public webchat ingress by @mrgoonie in #13
• feat(widget): launch hosted job access with original identity by @mrgoonie in #17
• fix(php): isolate shared temp files and require a secret by @dannyward630 in #16
• fix(php): keep rate-limit counters in the private temp directory by @mrgoonie in #19
• chore(release): 0.4.1-beta.2 by @mrgoonie in #20
• chore(release): 0.4.1 by @mrgoonie in #21

New Contributors

• @dannyward630 made their first contribution in #16

Full Changelog: v0.3.0...v0.4.1

v0.4.1-beta.2

What's Changed

• feat(server): verified signed-in users through dewee identity session exchange by @mrgoonie in #6
• feat: map gateway admission errors (POLICY_DENIED / RATE_LIMITED) with cooldown UI by @mrgoonie in #12
• feat: CCP transport for the CCP-managed public webchat ingress by @mrgoonie in #13
• feat(widget): launch hosted job access with original identity by @mrgoonie in #17
• fix(php): isolate shared temp files and require a secret by @dannyward630 in #16
• fix(php): keep rate-limit counters in the private temp directory by @mrgoonie in #19
• chore(release): 0.4.1-beta.2 by @mrgoonie in #20

New Contributors

• @dannyward630 made their first contribution in #16

Full Changelog: v0.3.0...v0.4.1-beta.2

v0.4.1-beta.1

What's Changed

• feat(server): verified signed-in users through dewee identity session exchange by @mrgoonie in #6
• feat: map gateway admission errors (POLICY_DENIED / RATE_LIMITED) with cooldown UI by @mrgoonie in #12
• feat: CCP transport for the CCP-managed public webchat ingress by @mrgoonie in #13

Full Changelog: v0.3.0...v0.4.1-beta.1