🦋 New version release (#3)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Author: brentrager

.changeset/widget-auth-hook.md

@@ -15,7 +15,7 @@
   <!-- NuGet package metadata -->
   <PropertyGroup>
     <PackageId>SmooAI.SmoothOperator.Core</PackageId>
-    <Version>0.3.0</Version>
+    <Version>0.4.0</Version>
     <Authors>SmooAI</Authors>
     <Company>SmooAI</Company>
     <Description>Native C# implementation of the smooth-operator agent engine — the in-process, Microsoft.Extensions.AI-based sibling of the Rust smooai-smooth-operator-core. Drive an agentic tool-calling loop over any IChatClient; author tools from ordinary C# methods with AIFunctionFactory. Learns from Microsoft Agent Framework idioms.</Description>

dotnet/core/src/SmooAI.SmoothOperator.Core.csproj

@@ -1,5 +1,11 @@
 # @smooai/smooth-operator
 
+## 0.4.0
+
+### Minor Changes
+
+- 715f79c: Embeddable-widget auth (SMOODEV-1878): a pluggable `WidgetAuthProvider` hook in the Rust server that enforces a per-agent **origin allowlist** + public-key **`authContext`** (HMAC-SHA256, replay-protected) for `<smooth-agent-chat>` connections. The `Origin` header is captured at the WebSocket handshake and validated at `create_conversation_session`; hosts plug in a concrete provider (backed by their agent store) while the bundled `PermissiveWidgetAuth` leaves a standalone OSS server unaffected. `WIDGET_AUTH_STRICT=1` fails closed on unknown agents.
+
 ## 0.3.0
 
 ### Minor Changes

typescript/CHANGELOG.md

@@ -1,6 +1,6 @@
 {
     "name": "@smooai/smooth-operator",
-    "version": "0.3.0",
+    "version": "0.4.0",
     "description": "TypeScript SDK for the smooth-operator WebSocket protocol: the native client (`.`), React bindings (`./react`), and the embeddable web-component chat widget (`./widget`). Generated from the language-neutral JSON Schemas in spec/.",
     "license": "MIT",
     "type": "module",