Back to the changelog

• Feature

  Chrome Extension (MVP)

  FlowSharp now has a **Chrome extension** that recognizes the pages of external systems (CRM, ERP, business apps) where entities live. When you navigate to a page that matches a configured flow, the extension surfaces **active items** for that entity (with status, assignee, direct link), shows a **"Start" button** to create a new item right from the CRM context, and updates a **toolbar badge** (green with count for active items, blue for "you can start", off for no match). Optional **proactive mini-popup** for flows configured as such: if no active item exists, the extension flags it automatically.

• Feature

  Multi-tenant Extension Support

  A single user can connect the extension to multiple FlowSharp tenants and switch context from the popup. URL matching happens **entirely in the browser** — no navigation URL is ever sent to the backend unless it matches a configured template, ensuring privacy.

• Feature

  Entity Prefix

  In the flow designer "Entity" panel you can now specify an **identifying prefix** (e.g. `LEAD-`, `PRJ-`, `ORD-`) that disambiguates `entityRefId` values across different entity types sharing the same numeric ID. URL templates support two placeholders: `{entityRefId}` (full refId, e.g. `LEAD-12345`) and `{entityKey}` (refId without prefix, e.g. `12345`). The prefix is added/removed automatically when matching between FlowSharp and external systems.

• Feature

  Settings → Extension

  New **Settings → Extension** section where you can view active extension connections (browser, last used, expiration), revoke individual connections (the token remains signed but gets rejected by the backend), and find the Chrome Web Store link to install the extension.

• Feature

  Designer: Extension Activation Mode

  For each flow you can now choose how the extension behaves: **Disabled** (default for existing flows) — extension ignores it; **Badge** — the flow appears in the popup when the user lands on a matching page; **Proactive** — the flow proposes itself via an automatic mini-popup if no active item exists for that entity.

• Security

  Extension Auth & RBAC

  New `XExtensionToken` model for user-level extension tokens, separate from tenant API keys and individually revocable. Dedicated `/extension/*` endpoints with Bearer JWT auth and dedicated scope. CORS updated to accept Chrome extension origins via regex matching. The `/trigger/:flowCode` endpoint enforces **server-side RBAC** on `allowManualStart` and `manualStartRoles` when authenticated via extension token — the client-side `canStart` flag is advisory only, the definitive check is in the backend.