Release v0.5.0-beta.3 · nextlevelbuilder/dewee-webchat

Beta upgrade notes

Hosted credential requests are off by default. They require CCP signed-in identity, Gateway/agent support, and an explicitly pinned HTTPS Dewee form origin. The visitor enters credentials only in the authenticated hosted form, never in the chat widget. The deployed end-to-end journey has not yet been verified.
Direct Gateway transport now suppresses credential-tool payloads and unmatched or malformed tool results to avoid exposing handoff information.
Legacy Gateway hosts must configure a visitor secret of at least 32 bytes; an ephemeral secret is an explicit development-only option.
PHP returns 503 when its default limiter storage or a custom limiter is unavailable. Windows hosts need an atomic shared limiter unless deliberately disabled; PHP image fetching still requires verified private lock storage and is unavailable on Windows by default.
Markdown images use a bounded backend proxy. Workers can opt in to exact same-origin public Assets paths; the binding bypasses site middleware and must not expose private files. Sibling same-zone hosts remain restricted.
Optional page context is disabled by default and requires visitor consent and Gateway/CCP support for v1.

This is a prerelease. Live verification of the credential handoff, page context and navigation/history flow remains outstanding.