Agentic Workforce ME Developer PortalDocs 1.0 · Widget 0.1.0

Help

Changelog

Widget and API release notes.

The hosted line /embed/v1/ receives compatible updates in place; entries below describe what changed. Breaking changes would ship as /embed/v2/ and be announced here at least one release ahead.

1.1 (planned) — Known gaps scheduled for the next widget release

TBD

  • Widget auto-recovery after a terminal setup error: today a widget that failed GET /config or the session mint (403 EMBED_ORIGIN_DENIED, 401 EMBED_KEY_DISABLED, network) stays in its offline state until the page is reloaded, even after the key or allowlist is fixed. v1.1 retries on the next open / send.
  • Public npm packages for @hive/embed and @hive/sdk (today: hosted bundle at /embed/v1/* and tarball / private registry).

1.0.1 — Portal rebranded to Agentic Workforce ME

2026-09-03

  • The portal is now the Agentic Workforce ME Developer Portal (header shows the product mark and name; metadata, home page, playground greeting and example titles updated). Documentation-only release.
  • Shipped identifiers are unchanged: @hive/embed, HiveChat, <hive-chat>, hive:* events, hive_pk_… keys, the X-Hive-Embed-Key header, /embed/v1/hive-embed.js and the EMBED_* error codes. The FAQ explains the codename they carry.
  • The playground assistant is now named "Agentic Workforce ME docs assistant".

1.0.0 — Initial release of the embed surface

2026-09-03

  • Hosted bundle line /embed/v1/ (hive-embed.js, hive-embed.mjs, react.mjs); the bundle reports build 0.1.0 via HiveChat.version.
  • <hive-chat> Web Component with Shadow DOM isolation, launcher and inline modes, English + Arabic (RTL), Markdown rendering, streaming replies, thread persistence, keyboard and screen-reader support, mobile full-screen below 480 px.
  • Script-tag loader: data-* auto-init, window.HiveChat.init command queue, apiUrl inferred from the script origin.
  • React wrapper @hive/embed/react (<HiveChat embedKey=… />) with onReady/onSession/onOpen/onClose/onMessage/onError.
  • Public API /v1/embed/*: config (key in the X-Hive-Embed-Key header, fetched on page load), session (15-minute HMAC tokens scoped to tenant + key + agent + origin + visitor, minted lazily on first open or first send), messages, thread history, redacted SSE relay (text deltas and anonymous tool.called/tool.result with step idx), cancel. Per-key CORS allowlists, fail-closed.
  • Publishable embed keys hive_pk_… (hashed at rest) with origin allowlists, server-side theme/config (including branding_url), per-key rate limits, enable/disable, rotate and revoke — console Embed tab and admin /v1/embed-keys API, @hive/sdk embedKeys resource.
  • Identified end users through backend-signed HS256 identity JWTs (sub, name, email, meta, exp ≤ 24 h, optional iat/nbf with clock-skew checks); contacts upserted with PII tags.
  • Rate limits: 60 config reads/min and 30 session mints/min per IP, session mints per key at 10 × rate_limit_per_min, key rate_limit_per_min (default 60) for messages, 20 messages/min and 60 reads/min per visitor, 2 concurrent event streams per visitor, 200 messages per thread, one in-flight reply per thread (409 EMBED_RUN_IN_FLIGHT).
  • Constructed-stylesheet CSS so strict host CSPs need only script-src and connect-src additions.