=== MoonPress Chat ===
Contributors: norml
Tags: chatbot, ai, assistant, chat, live chat
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 4.2.3
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

White-label AI chat assistant: bring your own LLM API key (Claude, OpenAI, Gemini, OpenRouter) and get a knowledge-based chat widget on your site.

== Description ==

MoonPress Chat adds an AI-powered chat assistant to your WordPress site. You connect your own LLM provider API key, teach the assistant about your business in the knowledge base, and the widget answers visitors' questions grounded in that knowledge — it does not invent facts you never gave it.

**Features**

* **Bring your own key** — works with Anthropic (Claude), OpenAI, Google Gemini, and OpenRouter. Pick the active provider and model in Settings; keys are stored write-only and never displayed or sent back to the browser.
* **Knowledge base** — describe your business, services and FAQs in wp-admin; the assistant answers only from what you provided.
* **Conversations inbox** — read every dialog, filter leads, and take over a conversation as a human operator when needed.
* **Lead capture** — the assistant collects contact details into a lead list you can process from wp-admin.
* **Templates and reports** — reusable answer templates and usage statistics.
* **Honest fallback** — with no key configured (or the provider unreachable) the widget says so and offers your contact channels instead of hallucinating.

**Privacy**

Visitor conversations are stored in your own WordPress database. No data is sent anywhere except to the LLM provider you explicitly configured (see External services below). The plugin sends nothing to the plugin authors.

= External services =

This plugin connects to the API of the LLM provider **you select and configure** in its settings. It sends the visitor's chat messages, the conversation history of the current session, and the knowledge-base context you authored to that provider in order to generate the assistant's replies. No request is made until you enter an API key and enable the widget.

Depending on which provider you choose, data is sent to exactly one of:

* **Anthropic (Claude)** — [Terms of Service](https://www.anthropic.com/legal/commercial-terms), [Privacy Policy](https://www.anthropic.com/legal/privacy)
* **OpenAI** — [Terms of Use](https://openai.com/policies/terms-of-use), [Privacy Policy](https://openai.com/policies/privacy-policy)
* **Google Gemini API** — [Terms of Service](https://ai.google.dev/gemini-api/terms), [Privacy Policy](https://policies.google.com/privacy)
* **OpenRouter** — [Terms of Service](https://openrouter.ai/terms), [Privacy Policy](https://openrouter.ai/privacy)

You are responsible for ensuring that sending visitor messages to your chosen provider complies with the privacy regulations that apply to your site, and for disclosing it in your site's privacy policy.

= Source code and build =

The plugin ships two separate codebases, built two different ways:

* **The visitor-facing widget** (`assets/widget.js`, `assets/widget.css`) is hand-written, plain JavaScript and CSS. There is no build step: the file in the zip is exactly the file your visitors' browsers download.
* **The admin interface** (Settings, Conversations, Knowledge base, Templates, Reports) is a React app built with Vite. Its full source ships in the zip under `admin-ui/src`; `admin-ui/dist` is the compiled output WordPress actually enqueues. To rebuild it from source: `cd admin-ui && npm ci && npm run build`.

== Installation ==

1. Upload the plugin to `/wp-content/plugins/moonpresschat/`, or install it through the WordPress plugins screen.
2. Activate the plugin through the **Plugins** screen.
3. Open **MoonPress Chat → Settings**, pick your LLM provider, and paste your API key (the Test button verifies it with a real minimal request).
4. Fill in the knowledge base so the assistant has something to answer from.
5. Toggle **Show on site** — or preview first on any page with `?chatbot=1`.

== Frequently Asked Questions ==

= Do I need my own API key? =

Yes. The plugin is bring-your-own-key: you create a key with Anthropic, OpenAI, Google, or OpenRouter and paste it into the settings. You pay the provider directly for usage; the plugin adds no markup and has no subscription.

= Where are my keys stored? =

In your WordPress database (`wp_options`), write-only: the admin UI never displays a stored key and the REST API never returns one. Keys are only ever used server-side to call the provider you configured.

= What happens if the key is missing or the provider is down? =

The widget stays functional and honest: it tells the visitor a human will follow up and offers your configured contact channels. It never fabricates answers.

= Does the plugin send any data to the plugin authors? =

No. The only external traffic is to the LLM provider you configured.

== Screenshots ==

1. The chat widget on the front end.
2. Settings — provider, model and API key management.
3. Conversations inbox with operator takeover.

== Changelog ==

= 4.2.3 =
* Every database query now binds its table name through WordPress's own identifier placeholder instead of building the name into the query text.
* The visitor widget script ships formatted for reading, and the readme now says where each part of the source lives and how the admin interface is built.

= 4.2.2 =
* The admin menu no longer offers editors pages they cannot open.
* A request left as a longer sentence now has the phone number picked out of it instead of being dropped, and a mistyped e-mail address is never quietly corrected into a different working one.
* Applying a preset or an AI draft clears leftover knowledge fields from earlier versions of the plugin.

= 4.2.1 =
* Fixed: a site that deliberately turns the AI disclosure notice off is no longer treated as unfinished — it stays configured, keeps its normal menu, and is not sent back to the "Start here" setup page.

= 4.2.0 =
* New: a "Start here" page greets a fresh install with three ways to set the assistant up — the moonpresschat-setup skill, your own provider key, or letting the AI fill the knowledge base — and a checklist of what is still missing before you go live.
* The old onboarding notices are gone: the page reads your actual settings instead, so it never nags a site that is already configured.
* Providers now remember a successful connection test, and stop claiming success once the key, provider or model changes.

= 4.1.1 =
* The consent notice greets first-time visitors in their own language whenever the site has it configured — a warning nobody can read is not a disclosure. Detected from the browser; only languages you actually serve are used, and a visitor's saved choice always wins.

= 4.1.0 =
* The assistant now asks for whichever contact detail your business actually uses. A site with no phone number on file asks for an e-mail address instead of a phone, and the widget notices an e-mail the same way it used to notice a phone number.
* Visitor e-mails are stored with requests and shown in the admin panel alongside phone numbers.
* Fixed: requests left in the chat were silently dropped. A request now needs just one valid contact detail, and the name is optional.
* The public request endpoint is rate-limited per IP.
* The daily digest and the new-request notification are sent in your site's language. Both were previously sent in Russian regardless of the site.
* The daily digest now counts its 24 hours in your site's time zone, so conversations are no longer reported twice or missed near midnight.
* Accepting the AI notice is remembered: it no longer reappears in a new browser tab or when you start a new chat. Editing the notice text asks visitors again, on purpose.

= 4.0.1 =
* Compatibility: tested up to WordPress 7.1.

= 4.0.0 =
* The widget's styles and scripts now load through WordPress's standard asset system (enqueued files instead of inline code), so caching and optimization plugins can handle them like any other asset.
* All internal names now carry the plugin's own `quipbot_` prefix; your existing settings, knowledge base and conversations are migrated automatically on update — nothing to do.
* Hardened the public chat endpoints: stricter validation of what the widget may write, rate limits per visitor and per address, and chat session ids are now 128-bit cryptographically random.

= 3.11.0 =
* The widget can start a new conversation: the launcher now lands on your conversation list whenever you have one, anonymous visitors get their own conversation as a single-item list, and starting a new chat keeps your earlier consent — you're never asked to accept the notice twice.

= 3.10.0 =
* The whole admin panel now runs on the new React interface: Knowledge base, Templates and Reports join Conversations and Settings in the same fast app with a shared sidebar. The old page renderers are removed; apart from the refreshed look of those three pages, nothing changes in how the plugin works.

= 3.9.1 =
* The chat avatar now uses your own logo — your theme logo or site icon — instead of a bundled image, and falls back to a neutral icon that follows your header colours.
* Header text stays readable: pick any header colour and the title, status line and controls switch between light and dark automatically.
* "Analyze my site" no longer times out on larger sites: it reads your pages in short batches and picks up where it left off, and skips login, cart and legal pages instead of loading them.
* The consent notice for regulated industries no longer repeats the same sentence twice.
* Security hardening: the plugin no longer runs any system command to look up an API key. Keys come from Settings, a wp-config constant or an environment variable, as before.


= 3.9.0 =
* The assistant's safety rules are now visible and editable in the Knowledge base as a pre-filled "Hard rules" field — with the built-in floor still guaranteed even if the field is cleared.

= 3.8.2 =
* The assistant's boundaries now follow your configured topics exactly: adjacent-industry questions your knowledge doesn't cover are deflected to your team instead of improvised.

= 3.8.1 =
* The assistant now firmly stays on topic: unrelated requests (code, homework, general knowledge) are politely declined instead of answered.

= 3.8.0 =
* Developer hooks: filters and actions so add-ons can extend the Q&A bank, language resolution and get notified of new messages and leads.

= 3.7.0 =
* Multilingual widget: add languages in Settings, the widget follows the page language, and visitors can switch languages on the fly.

= 3.6.1 =
* Directory-review readiness: hardened output escaping in the admin screens and safer database queries throughout.

= 3.6.0 =
* Widget appearance settings: pick your accent color, upload a logo and header image, choose the widget's corner and launcher size — all from Settings.

= 3.5.2 =
* Widget header spacing matches the design: clear gap between the greeting and the first card.

= 3.5.1 =
* Widget layout polish: correct card insets, greeting position and message alignment.

= 3.5.0 =
* A completely redesigned chat widget: cleaner cards, a customizable header, and a smoother chat view. Colors, logo and position are configurable (settings UI arrives next).

= 3.4.2 =
* Analyze my site now shows the step checklist with a live spinner the moment you press Generate.

= 3.4.1 =
* Applying a preset or a site analysis now refreshes the assistant's data-privacy instructions, keeping them accurate and in the right language.

= 3.4.0 =
* The assistant, widget and all built-in texts now ship in English and follow your site's language setting.

= 3.3.1 =
* Analyze my site now reads your pages without the chat widget's own text, and generation reliably follows your site's language.

= 3.3.0 =
* Analyze my site: generate a personalized starter knowledge base from your own pages, with admin review before anything is applied.

= 3.2.0 =
* AI disclosure built in: consent gate and disclaimer ship enabled by default, with industry-appropriate wording per preset.

= 3.1.0 =
* Industry presets: 13 one-click starting-knowledge templates + the Setup screen.

= 3.0.0 =
* Renamed to MoonPress Chat (new slug `quipbot`); reactivate the plugin after updating — the main file moved to quipbot/quipbot.php.

= 2.1.0 =
* Removed all built-in demo knowledge content; fresh installs start with an empty knowledge base until you fill it in.

= 2.0.0 =
* White-label release: bring-your-own-key onboarding, neutral factory state.
* Multi-provider LLM support: Anthropic, OpenAI, Google Gemini, OpenRouter — active provider + model selection, write-only keys, real-request key test.
* New React (shadcn/ui) admin: Settings and Conversations, with operator takeover.
* Honest no-key/offline fallback in the widget.

== Upgrade Notice ==

= 4.1.0 =
Lead capture no longer silently drops conversations that only leave an e-mail or only leave a name: a lead now just needs one valid contact detail, e-mails are stored and shown alongside phone numbers, and the assistant asks for whichever contact detail you've actually configured. No action needed.

= 4.0.0 =
Internal data (options and tables) moves to the quipbot_ prefix and is migrated automatically on update — no action needed. Existing chat sessions in visitors' browsers keep working.

= 3.2.0 =
Fresh installs and installs that never served a visitor now show an AI-disclosure consent notice by default before the first chat message. Sites already serving visitors keep their current behavior automatically — nothing to do.

= 3.0.0 =
Renamed to MoonPress Chat: after updating, reactivate the plugin (the basename change deactivates it on file replacement).

= 2.0.0 =
First public release.
