Flowlight 0.14.3

What's new in 0.14.3

• Review community plugins before install. Imported plugin packages now open a review sheet with provenance, signature status, publisher category, permissions, privacy categories, package digest and script digest before anything is saved.
• Bind plugin trust to signed package contents. Flowlight can verify detached P-256 package signatures against trusted publisher keys, rejects tampered signed packages, keeps unsigned local packages clearly labelled, and prevents unsigned packages from claiming official provenance.
• Declare and enforce sanitized plugin permissions. Plugin manifests now describe which metadata families they use, and installed JavaScript receives only those sanitized context sections while remaining advisory and fail-open. The template, validator, localization catalogs and plugin docs now match the new review contract.

Install

Signed with Developer ID and notarized by Apple.

• brew install --cask xinbetween/tap/flowlight
• Flowlight.dmg — drag to Applications.
• Flowlight-0.14.3.pkg — installs to /Applications; offers to quit a running copy first.

macOS 15 or later, Apple silicon and Intel.

Full changelog: https://github.com/xinbetween/flowlight/releases

Checksums

d0ad6b2188630576d9146f367a20deb63c28b98a6df7a140c55c45204600d5e3  Flowlight.dmg
ddfba44233f08083638b2a956f34dcf5ec1645bb59990deebf4039b98c52d14b  Flowlight-0.14.3.pkg