reflet-sdk 0.5.1 → 0.5.2

package/CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to `reflet-sdk` will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [0.5.2] - 2026-09-29
+
+### Added
+
+- Connect the devtools Board tab to Reflet without configuring a secret key. Approve access in Reflet and revoke it from the Board tab or Account → Devtools. Credentials stay on the dev server, isolated by project and backend; notes remain internal and are attributed to the connected member.
+
+### Fixed
+
+- Using the widget no longer closes the app's open menus, popovers and pickers. Pointing at an element or attaching a screenshot keeps them open, so their content can be reported, and typing in the widget no longer loses focus to a menu's focus trap. The widget also stays clickable while a modal menu disables pointer events on the page.
+
 ## [0.5.1] - 2026-09-28
 
 ### Fixed

package/README.md

@@ -207,7 +207,15 @@ turn it off.
   the reporter's source location, and a code search for the element's text.
 
 Code view and the board go through one dev-only route that reads files from
-your repository and holds the secret key server-side.
+your repository and holds the board credential server-side.
+
+To reach the board, click **Connect to Reflet** in the Board tab: sign in on
+reflet.app, approve the organization that owns the widget's key, and the dev
+server keeps a revocable token in `~/.reflet/devtools/`,
+outside the repository. That token acts as you, only reaches the devtools
+endpoints, and expires after 30 days unused; revoke it with Disconnect or from
+Account → Devtools on reflet.app. Connect works on `localhost`, `*.localhost`
+and `*.test`; elsewhere, set `REFLET_SECRET_KEY`.
 
 Next.js App Router, `app/api/reflet-devtools/[...path]/route.ts`:
 
@@ -226,9 +234,10 @@ export default defineConfig({ plugins: [react(), refletDevtools()] });
 
 | Env var | Purpose |
 |---------|---------|
-| `REFLET_SECRET_KEY` | Your `fb_sec_…` key, server-only. Needed to send notes and read the board. |
+| `REFLET_SECRET_KEY` | Your `fb_sec_…` key, server-only. Optional: replaces Connect, and wins over it when set. |
 | `REFLET_EDITOR` | `vscode` (default), `cursor`, `windsurf`, `zed` or `webstorm` for "Open in editor". |
 | `REFLET_API_URL` | API override, for self-hosted or local Reflet backends. |
+| `REFLET_APP_URL` | Web app origin Connect signs in on. Defaults to `https://www.reflet.app`. Same as the `appUrl` option. |
 | `REFLET_DEVTOOLS_HOSTS` | Comma-separated dev hostnames besides localhost, e.g. `app.test`. Same as the `allowedHosts` option. |
 
 The route only answers on `localhost`, `*.localhost`, loopback IPs and the