v0.3.0

Changelog

• a96b075: docs(security): record SF-001 — a source can never be granted its secret (@fadymondy)
• 717f959: feat(apps): give an app a way to say what goes in the window (@fadymondy)
• f7523fa: feat(connections): build the webhook receiver the schema has been waiting for (@fadymondy)
• 4667d55: feat(integrations): the connection plane, and the actors that run through it (@fadymondy)
• 3dbcf35: feat(sdk): build the shell document, under budget and actually rendering (@fadymondy)
• f9ffe55: feat(sdk): remember where windows were put — on the device, not the account (@fadymondy)
• 040007a: feat(sdk): ship the windowed shell dark, behind mount({ shell }) (@fadymondy)
• 414f504: feat(sdk): the FeedbackOS token layer, in three deliberate layers (@fadymondy)
• d901af8: feat(sdk): the app contract, and apps that actually render in windows (@fadymondy)
• 1d8a1e6: feat(sdk): the issue composer, built on the Initial CTA pattern (@fadymondy)
• b7a184b: feat(sdk): the loader, and the dead-man's switch that makes it safe (@fadymondy)
• 8921baf: feat(sdk): vendor ui-desktop as an embeddable fork, behind one seam (@fadymondy)
• bac392f: feat(setup): declare every environment variable once, and generate the rest (@fadymondy)
• 8eae7b7: feat(setup): generate the wizard's steps from the capability registry (@fadymondy)
• 333b9c9: fix(issues): let a visitor actually file feedback (@fadymondy)
• 37a5af8: fix(mcp): accept a proxied Host, and stop telling operators to lie about APP_ENV (@fadymondy)
• f7ff2a7: fix(sdk): repair four latent bugs the desktop fork inherited (@fadymondy)
• 756482e: fix(sdk): three bugs that only a real host page could reveal (@fadymondy)
• 955e801: fix(sdk): tokenise the chrome and make window controls reachable (@fadymondy)
• 151aebe: perf(sdk): inline the icon set, drop lucide-react from the shell (@fadymondy)
• c2caf95: style(sdk): retire the patterns this sheet had already argued against (@fadymondy)

Install

npx create-togo-builder@latest my-project

The postinstall verifies the binary's SHA-256 against checksums.txt
before running it.