Rapls AI Chatbot

Changelog

1.7.6

• Fixed: Conversation list message search returned no hits when AES-256-GCM encryption was on. The search ran a SQL LIKE against messages.content, but with encryption enabled the column holds encg:... ciphertext that can never match a plaintext keyword. The list now also scans the most recent N encrypted messages in PHP after decryption (default 2000, filterable via raplsaich_search_decrypt_limit). Plaintext sites keep using the cheaper SQL path.
• Added: ?conversation_id=N direct filter on the conversations admin page. Used by Pro analytics’ “View Conversation” button so the link always resolves to the target row, regardless of encryption state. An info notice appears at the top showing which conversation is filtered, with a “Show all” link to return to the unfiltered list.
• Changed: Hierarchical preset group chips (Pro 1.6.0+) now use the same neutral grey palette as their child chips, instead of the site primary colour. Avoids visual confusion with the visitor’s own messages (which use the primary). The “▸” marker baked into the label still signals “tap to reveal more”.

1.7.5

• Security: Session tokens issued to the chat widget now carry an expiry and a session-version stamp. Previous v1 tokens were a deterministic HMAC of the session id alone, with no TTL or revocation channel — once leaked, they remained valid until the underlying session row was deleted. The new v2 format is version.iat.exp.hmac, signed over version.iat.exp.session_id. Default TTL is 7 days (filterable via raplsaich_session_token_ttl, capped at 30 days). Bumping raplsaich_session_version (the existing “Reset all user sessions” admin button) now also revokes every outstanding token. Old v1 tokens are rejected at verification time; clients automatically receive a v2 token on the next /session call, so the visitor experience is unchanged
• Security: Offline-message endpoint’s permission callback now verifies the request comes from one of the allowed site hosts (Origin/Referer match), not just that any Origin/Referer header is present. The internal guard_public_post() same-origin check is kept as defense-in-depth, but non-browser clients with spoofed headers can no longer reach the callback at all

1.7.4

• Fixed: New “Start a new conversation” header button (1.7.3) was hard-to-read white-on-white in the Simple and Light themes. The Simple/Light theme overrides now apply to both header buttons (close + new-conversation) instead of only close.

1.7.3

• Added: New “Link Open Behavior” setting under Display Settings — choose between opening reply links in a new window/tab (existing behavior) or in the same window. Applies to all link types in chat replies (knowledge base sources, web sources, content cards, action buttons, product cards, markdown links, raw URLs).
• Added: “Start a new conversation” button in the chat header (circular-arrow icon, next to Close). Tapping it confirms once, then drops the visitor’s local session and re-renders the welcome message. Useful for visitors who want to test a fresh question without prior context, and for admins testing the bot. Server-side conversation history is kept intact for admin review.
• Added: Drag-and-drop reordering on the preset question button rows in Chat Settings. A grip handle appears on the left of each row; drag a row up or down to reorder. Save the form to persist the new order.

1.7.2

• Changed: Preset chips now use a neutral grey colour scheme distinct from user-message bubbles, so visitors no longer mistake a preset chip for one of their own past messages
• Changed: Welcome-message preset chips stay visible after a click instead of being removed — visitors can scroll back and tap a different preset later. Tapped chips are visually marked as “visited” (semi-transparent). The persistent “show under every reply” mode is unchanged: those re-render naturally on each bot reply
• Changed: Hierarchical preset groups containing only one child are now rendered as flat chips so visitors don’t need two taps to send a single question

1.7.1

• Added: chatbot.js support for hierarchical preset chips — when a preset item carries a children array, the chip renders as a group with a “▸” suffix; tapping it reveals the child chips with a “← back” chip to return. Free’s flat presets are unchanged
• Added: REST /preset-canned validation now also accepts canned-reply clicks coming from Pro 1.6.0+ hierarchical preset groups
• Changed: CSS for preset chips gains group/back variants (filled chip for groups, dashed-border chip for back)

1.7.0

• Added: Glossary (proper-noun protection list) — register up to 50 terms (product names, service names, brand names, words that take on a different meaning when translated) so the AI keeps them verbatim across all reply languages. Optional per-row Notes field for free-form per-language instructions (e.g. “Always render as Staff Perks in English, 员工福利 in Chinese”). Toggleable on/off in Chat Settings
• Added: New raplsaich_inject_glossary filter callback (priority 98) on the existing raplsaich_system_prompt chain — applies to all surfaces that use the filter (REST /chat, Pro regenerate / suggestions / LINE / MCP tools), so the glossary is enforced consistently regardless of how the conversation is triggered

1.6.6

• Added: Optional “Fixed reply” field on each preset question row. When set, tapping the chip renders the configured reply instantly with no AI call (zero token cost, no AI provider latency, fully controllable wording). Empty field keeps the existing behavior (forwards the question to the AI). Mix per row — common FAQs can be canned, edge cases can stay AI-driven
• Added: New REST endpoint POST /preset-canned that persists the canned exchange to the conversation history (when save_history is on) and tags the user message with metadata.preset_index + metadata.preset_canned = true, so Pro analytics still counts the click and the conversation shows up in the admin Conversations list

1.6.5

• Fixed: WordPress.org Plugin Check rejected 1.6.4 with “Description: A maximum of 150 characters is supported.” — the short description had grown to 152 characters when the 13-language auto-reply pitch was added in 1.6.1. Trimmed to 130 characters by dropping filler words (“for WordPress”, “and”) without losing keyword coverage

1.6.4

• Added: New “Also show preset buttons under every bot reply” toggle in Chat Settings. When on, the same preset chips re-appear after every AI response — handy for navigation-style bots where visitors hop between common topics. When off (default), behavior is unchanged: chips appear once after the welcome message and disappear after the first user message
• Added: Stale preset chip cleanup when the visitor sends a message — prevents chips from stacking up across turns in persistent mode

1.6.3

• Changed: The “Question sent to the bot” field on each preset question row is now a 2-row textarea (vertically resizable) instead of a single-line input. Long questions like “次回のイベント開催日を教えてください” no longer overflow the visible area in the editor

1.6.2

• Added: Preset question buttons — chips shown under the welcome message (configurable on/off in Chat Settings, up to 10 entries). Tapping a chip submits the configured question text. Chips disappear once the user sends their first message. Useful for nudging visitors toward common topics (“Pricing”, “Hours”, “Staff perks”, etc.) without making them type.
• Added: preset_index request param on /chat and metadata.preset_index on the user message row, so Pro analytics (1.5.0+) can attribute clicks back to a specific preset.
• Added: Public helper RAPLSAICH_Admin::sanitize_preset_questions() so Pro per-bot sanitizers can reuse the validation rules (max 10 rows, label ≤ 40 chars, question ≤ 200 chars, both required).

1.6.1

• Changed: Description and feature copy in readme + LP files now lead with the 13-language auto-reply use case (tourism, hospitality, retail sites that get multilingual inquiries without multilingual staff). The feature itself is unchanged

1.6.0

• Milestone release consolidating eight patch updates (1.5.15–1.5.22):
  • Current-date injection so the AI can answer “today / yesterday / this week” questions without manually adding the date to the knowledge base
  • Robust against weak models (e.g. Gemini Flash Lite) that previously dismissed injected dates as fabrication
  • channel column on conversations + Channel column in the admin Conversations list (Web / LINE)
  • Conversations admin decluttered from 12 columns to 8, with overlap fixes and CSS for the channel badge
  • Japanese label for “Conversations” simplified to 会話
  • raplsaich_get_max_context_chars() exposed as a helper so external surfaces (Pro’s LINE channel) feed the same volume of knowledge to the model
  • Plugin home and Pro upgrade links migrated to the new /plugins/ URL structure on raplsworks.com

1.5.22

• Changed: Plugin home and Pro upgrade links updated to the new /plugins/... URL structure on raplsworks.com (the standalone rapls-ai-chatbot-guide/ and rapls-ai-chatbot-pro pages have moved). Affects the plugin header URI, the dashboard upsell, the Settings banner, and the readme

1.5.21

• Changed: The “max RAG context characters” calculation that scales with the configured AI model is now exposed as a public helper (raplsaich_get_max_context_chars()) so non-REST surfaces — Pro’s LINE channel in particular — can feed the same volume of knowledge to the model. The REST controller’s get_max_context_chars() method is preserved as a thin wrapper for back-compat

1.5.20

• Fixed: Conversations admin — Msgs and Lead cells visually overlapped on narrow viewports because the new layout left those columns at default width with no overflow handling. Lead now has an explicit 200px width, Msgs is widened to 70px, and cell content is constrained with overflow/word-break rules. Channel badge in the Session cell also gets its own styles so Web vs LINE is distinct
• Changed: Japanese label for “Conversations” simplified from “会話履歴” to “会話” so the admin menu reads naturally as just “会話”

1.5.19

• Changed: Conversations admin page now shows 8 columns instead of 12. The ID column is gone (still in the row’s data-id and shown in the Session tooltip), Channel is folded into the Session column as a small badge, the separate Handoff column is folded into Status as a sub-badge, and Started has been merged into Last Active (start time is now in the cell tooltip). All sort options remain available

1.5.18

• Added: New channel column on the conversations table (web / line / etc.) plus a “Channel” column in the Conversations admin list, so multi-channel installations can tell at a glance which platform a conversation came from. Existing rows default to “web”. Migration runs automatically on plugin update

1.5.17

• Fixed: Smaller AI models (e.g. Gemini 2.5 Flash Lite) still refused to answer “today’s date” questions in 1.5.16 because the user’s own system prompt typically forbids “inventing dates” and the model treated the injected date as a forbidden invention. The injected date block now (a) opens with a clear “OVERRIDE — TAKES ABSOLUTE PRECEDENCE” marker, (b) explicitly states that no-fabrication rules do NOT apply to the system-provided date, and (c) includes a few-shot example showing the expected answer format in both Japanese and English

1.5.16

• Fixed: Current date injection in 1.5.15 was only applied to the main send-message endpoint and was sometimes ignored by weaker AI models that interpreted the system prompt’s “do not invent dates” rule too literally. Now hooked on the raplsaich_system_prompt filter at priority 99 so all endpoints (regenerate, suggestions, MCP tool, etc.) receive it, and the prompt explicitly states the date is authoritative system context — not fabrication

1.5.15

• Added: System prompt now injects the current date (in the site’s WordPress timezone) so the AI can correctly resolve relative time references like “today”, “yesterday”, or “this week” without needing them in the knowledge base

1.5.14

• Fixed: Root cause of the iPhone Safari “close button off-screen” issue — chat input textarea now uses font-size: 16px so iOS Safari no longer auto-zooms the viewport on focus. The iOS keyboard fix from 1.5.13 is kept as a secondary safeguard
• Fixed: Reference link cards now survive a page reload — message display metadata (sources, cards, web sources) is persisted on the message row and returned by the history endpoint
• Fixed: Link card titles and excerpts no longer show literal HTML entities like &
• Fixed: Link card excerpts strip common Markdown syntax (**, backticks, #, [text](url), etc.) so previews read as plain prose
• Fixed: Link card rows on mobile no longer overflow past the chat bubble — added min-width: 0 to the message content flex child so the inner horizontal scroll container takes effect

1.5.13

• Added: Optional iOS Safari keyboard fix (opt-in) — when enabled, uses the VisualViewport API to keep the chatbot header (including the close button) on-screen while the on-screen keyboard is visible. Disable this setting if it conflicts with your theme’s scroll behavior. Default: off

1.5.12

• Fixed: Vector embedding search checkbox could not be turned off after being enabled — unchecked state was ignored because HTML forms omit unchecked checkboxes from POST
• Fixed: Badge position margin setting was not applied on mobile screens (<=480px) due to a hardcoded media-query override
• Fixed: Primary color was not applied to the badge icon on the Simple / Classic / Light / Minimal / Flat themes (background color was hardcoded)
• Fixed: On iPhone Safari, focusing the chat input pushed the close button off-screen — switched to 100dvh dynamic viewport height
• Added: Separate margin settings for desktop and mobile screens
• Added: Badge icon size setting (30–120px), separate values for desktop and mobile

1.5.11

• Fixed: Fatal error on Settings page in 1.5.10 — template include helper broke local variable scope causing $openai_provider to be null. Templates are now included inline with a file_exists() guard so render-method locals stay accessible

1.5.10

• Fixed: Re-deploy all template files (templates/admin/*.php) — the 1.5.9 release was missing these due to an SVN upload issue, causing admin screens to render blank
• Added: Admin templates now render a visible error notice instead of a blank page if any template file is missing, so future deploy issues are immediately diagnosable

1.5.9

• Removed: Discontinued OpenAI models from the dropdown — gpt-4, gpt-4-turbo, gpt-3.5-turbo, o1, o1-pro (all retired by OpenAI)
• Removed: Discontinued Claude model claude-3-7-sonnet-20250219 from the dropdown (retired by Anthropic)

1.5.8

• Fixed: Gemini API key validation now uses the models list endpoint (no more false “Invalid API key” errors for valid keys)
• Fixed: API key is saved automatically on successful connection test (previously required a separate save step)
• Fixed: Gemini embedding model updated from deprecated text-embedding-004 to gemini-embedding-001 (with 768-dim output for backward compatibility)
• Removed: Discontinued Gemini 1.5 series models (Pro / Flash / Flash 8B) from the model dropdown — Google retired these models
• Added: gemini-2.0-flash-lite to the model dropdown

1.5.7

• Updated: Japanese translations — full-width parentheses replaced with half-width per WordPress Style Guide
• Updated: Dashboard Docs links and review request banner

1.5.6

• Fixed: Response Language setting now works when set to “Site language” — was silently ignored
• Fixed: AI responses in wrong language when RAG context is in a different language (triple enforcement)
• Fixed: Chatbot placeholder language now respects site locale over browser language
• Fixed: Response cache now includes language in hash key to prevent stale translations
• Fixed: Reset confirm dialog newlines not rendering in prompt()
• Improved: Response language instruction placed at beginning, end of system prompt, and in user message

1.5.5

• Improved: Complete Free/Pro code separation — all Pro UI code moved to separate Pro plugin
• Improved: Frontend chatbot.js reduced by 50% (4,300 → 2,175 lines) for faster page loads
• Improved: Consolidated admin menu into single “Pro Features” overview page
• Improved: Hook-based extension architecture for Pro features
• Security: Removed arbitrary custom CSS injection — use WordPress Customizer instead
• Security: All CSS variable values escaped with esc_attr(), position margins with absint()
• Security: Block render output sanitized with wp_kses() and widget-aware allow-list
• Security: Added rel="noopener noreferrer" to all external links
• Security: Inline JS/CSS now uses wp_add_inline_script() and wp_add_inline_style() instead of raw output
• Fixed: Lead form display and submission when Pro is active
• Changed: Settings key renamed from pro_features to extensions with automatic migration
• Changed: Unique prefix raplsaich_ applied to all functions, options, hooks, and REST namespace
• Updated: External Services section with per-service documentation and embed-loader.js clarification
• Updated: Chart.js to v4.5.1, html2canvas bundled locally

1.5.2

• Fixed: WordPress Plugin Check compliance (WP_Filesystem annotations, prepared SQL annotations)
• Removed: Artificial free-tier limits — all core features are fully available
• Removed: Default “Powered by” footer from chatbot widget
• Updated: Neutral error messages replacing promotional upsell text

1.5.0

• Added: Gutenberg block — Insert AI Chatbot block in the block editor with height, theme, and bot-id settings; SSR (server-side rendering) support; i18n (JA/EN translation JSON)
• Added: WordPress Abilities API Bridge — Register all 7 MCP tools as WordPress Abilities for auto-discovery by MCP Adapters (Claude Desktop, Cursor, VS Code)
• Added: Response language auto-detect — Automatically detect browser language for welcome message and AI responses; choose from “Site language”, “Auto-detect”, or manual
• Added: OpenRouter provider support (100+ models via single API key)
• Added: Pro add-on compatibility layer for extended features
• Fixed: MCP tool registration timing for reliable integration
• Fixed: Abilities API category registration and naming compliance
• Updated: Japanese translation — all strings translated including Abilities API, Gutenberg block, and response language settings
• Updated: WordPress Plugin Check compliance fixes

1.4.0

• Added: Web search integration — AI automatically searches the web when knowledge base lacks a sufficient answer (OpenAI web_search_preview, Claude web_search, Gemini google_search grounding)
• Added: Web search toggle in AI Settings tab with per-provider cost notice
• Added: Web source citations displayed with globe icon, separate from knowledge base sources
• Added: Cross-site embed page — embed chatbot on external sites via iframe (?raplsaich_embed=1 endpoint)
• Added: Embed loader script (assets/js/embed-loader.js) for easy cross-site integration
• Added: PDF and DOCX file upload support in knowledge base (server-side parsing)
• Added: Vector embedding RAG with hybrid search (keyword 40% + vector 60%)
• Updated: AI model lists — OpenAI GPT-5.2/5.1/5/4.1 series, Claude Opus 4.6/Sonnet 4.5/Haiku 4.5, Gemini 3/2.5 series
• Updated: Japanese translation

1.3.2

• Security: Session ID now transmitted via X-RAPLSAICH-Session header instead of query strings (prevents access log leakage)
• Security: GET requests no longer accept ?session_id= query parameter
• Security: POST requests ignore body session_id when header is present (prevents APM/WAF body-logging leakage)
• Security: Removed client-side raplsaich_user_id remnant from JavaScript
• Security: Context key derivation simplified to session-only HMAC (removed IP binding for stability)
• Security: DOM-based URL linking and offline form rendering (XSS hardening)
• Security: Dompdf post-init safety assertion (isPhpEnabled / isRemoteEnabled check)
• Added: Rate-limited error logging (raplsaich_rate_limited_log()) with filterable interval via raplsaich_rate_limited_log_interval
• Added: Server-side offline message dedup (30-second window, session-preferred key)
• Added: Client-side offline form dedup via sessionStorage
• Improved: Offline message endpoint allows unauthenticated submissions (allow_no_headers)
• Improved: Rate limit fallback keys hashed to prevent wp_options bloat
• Improved: Standardized REST error responses with error_code field
• Improved: Dompdf errors return JSON response instead of wp_die() for better admin UX
• Improved: REST API session authentication documented in readme

1.3.1

• Added: Pro add-on compatibility for enhanced rate limiting and PDF export
• Improved: Rate limit error messages are now customizable
• Improved: Diagnostic options renamed to raplsaich_diag_* namespace
• Improved: Frontend debug minimum capability is now filterable via raplsaich_frontend_debug_min_cap

1.3.0

• Added: Pro add-on compatibility for response caching, audit logs, conversion tracking, offline messages, and answer templates
• Improved: Knowledge base supports ‘qa’ and ‘template’ entry types
• Improved: Database schema updates for caching and conversion tracking

1.2.23

• Added: Sortable column headers in admin tables — Dashboard model stats, Conversations, Knowledge, and Crawler pages now support click-to-sort with ascending/descending toggle
• Added: Knowledge base draft status — entries can be “published” or “draft”, with filter tabs and draft count badge
• Added: Enhanced content extraction (Pro) — DOMDocument-based HTML parsing preserves document structure as Markdown-style text for better AI context
• Added: Session reset feature — administrators can invalidate all existing chat sessions at once
• Improved: Session cookie set as httpOnly with SameSite=Lax for better security
• Improved: Knowledge base model supports status filtering and sorting with SQL whitelist validation
• Improved: Content index model supports orderby/order parameters for sorted admin views
• Updated: Japanese translation

1.2.22

• Improved: Default system prompt now enforces accuracy, honesty, and no-fabrication rules for better AI response quality
• Improved: Site learning context prompt explicitly instructs AI not to guess or fabricate when information is missing
• Added: raplsaich_system_prompt filter — developers can now modify the system prompt programmatically
• Added: Customizable feature prompts — regenerate instruction, feedback learning headers, and summary prompt are now editable in Settings
• Added: Advanced prompt sections gated behind checkboxes (disabled by default) for safe editing
• Added: Placeholder documentation for regeneration prompt ({variation_number}, {forbidden_start}, {style})
• Updated: Debugging guide with new prompt customization section

1.2.21

• Added: Knowledge base export support (CSV/JSON) — available with Pro add-on
• Added: Budget limit check integration in REST API (blocks AI calls when Pro budget limit exceeded)
• Added: Budget alert hook after AI responses (triggers Pro email notifications)
• Added: Pro features stub methods for budget management (check_budget_limit, get_budget_block_message, maybe_send_budget_alert)
• Improved: Default settings include budget and monthly report configuration keys
• Added: Detailed debugging guide documentation (docs/debugging-guide.md)

1.2.20

• Added: Knowledge page prefill support (prefill_question parameter for quick FAQ creation from analytics)

1.2.19

• Security: API key encryption now covers Google Gemini keys (AIza…) in addition to OpenAI and Claude
• Security: Added OpenSSL availability check with graceful fallback for encryption/decryption
• Security: Conversation history endpoint (/history) now verifies session ownership via cookie and IP
• Security: Chart.js bundled locally instead of loading from external CDN (WordPress.org compliance)
• Added: Session cookie (raplsaich_session_id) set on session creation for reliable history access across IP changes

1.2.18

• Security: Sanitized API error messages to prevent information leakage
• Security: Proxy-aware client IP detection for rate limiting (Cloudflare, X-Forwarded-For)
• Security: Consistent SHA-256 hashing for IP-based rate limiting
• Fixed: User message duplication in AI context (improved response accuracy)
• Fixed: Uninstall now removes all tables including leads and user_context
• Fixed: Transient cleanup uses prepared statements
• Improved: Database schema checks cached per request (performance)
• Improved: Consolidated database upgrade logic in Activator class
• Improved: Pro-only REST routes only registered when Pro is active
• Added detailed Japanese descriptions for all AI models
• Translation improvements

1.2.5

• Security improvements and code quality enhancements
• WordPress Plugin Check compliance updates
• Updated AI model pricing information
• Bug fixes and performance improvements

1.0.0

• Initial release
• Multiple AI provider support (OpenAI, Claude, Gemini)
• Site learning with automatic content crawling
• Custom knowledge base with Q&A format support
• Priority levels for knowledge entries
• Conversation history with search
• Usage statistics with cost estimation
• Daily token usage charts
• Model-by-model cost breakdown
• Customizable chatbot appearance
• Rate limiting support
• Quota error handling with custom messages
• Settings import/export/reset
• Japanese translation included
• Mobile-responsive chat widget
• Page exclusion settings