=== ToSAI - Web ChatFlow ===
Contributors: openminds
Tags: ai, chatbot, markdown, agents, chat
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.20.3
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Publishes your content as Markdown for AI agents and runs a site-embedded retrieval chat assistant over it.

== Description ==

ToSAI makes your site readable by AI agents, and puts a retrieval-backed chat assistant on it that answers from your own content.

Any published post, page or public custom post type responds with clean GitHub-flavoured Markdown when a client sends `Accept: text/markdown`, following the Cloudflare "Markdown for Agents" convention, so crawlers and assistants consume your pages without wading through theme markup. A REST knowledge endpoint serves the same content with YAML frontmatter, and the plugin can generate `/llms.txt` and `/llms-full.txt` at your site root. None of this requires an API key.

The chat assistant indexes your published content into a vector index stored in your own WordPress database — no external vector service — and answers visitor questions by semantic search over it. Conversations are logged per ticket, and a pricing enquiry can hand off to WhatsApp with the ticket reference and a private transcript link, so whoever replies has the context.

Posts opt out individually via a `_wptosai_exclude` meta value. Drafts, private and password-protected posts are never exposed.

= Features =

* Markdown content negotiation on `Accept: text/markdown` (Cloudflare Markdown-for-Agents compatible)
* REST knowledge endpoint with GFM + YAML frontmatter
* `/llms.txt` and `/llms-full.txt` generation
* Semantic search over your content, with the vector index held in a WordPress database table
* Site-embedded chat widget, themeable entirely through CSS custom properties
* Conversation logging with per-ticket transcripts
* WhatsApp handoff for pricing enquiries
* Optional Cloudflare Turnstile or Google reCAPTCHA v3 on the chat

== External services ==

This plugin connects to several third-party services. None of them is contacted until you configure it, and nothing is sent from a default install.

**BytePlus Ark** — used for embeddings and for chat replies. The text of the posts and pages you choose to index is sent to generate embeddings, and each visitor chat message is sent to generate a reply. Contacted only when a BytePlus API key is configured.
Terms: https://www.byteplus.com/en/legal/terms — Privacy: https://www.byteplus.com/en/legal/privacy

**OpenAI-compatible endpoint (optional)** — when the knowledge backend is set to OpenAI, the same content and chat messages go to the endpoint you configure instead. Not contacted otherwise.
Terms: https://openai.com/policies/terms-of-use — Privacy: https://openai.com/policies/privacy-policy

**n8n workflow (your own instance)** — visitor chat messages and conversation context are relayed to the webhook URL you enter. Nothing is sent until you enter one. Terms and privacy are those of the n8n instance you operate.

**Cloudflare Turnstile (optional)** — when Turnstile is enabled, the visitor's challenge token and IP address are sent to challenges.cloudflare.com to verify the visitor is not a bot.
Terms: https://www.cloudflare.com/website-terms/ — Privacy: https://www.cloudflare.com/privacypolicy/

**Google reCAPTCHA v3 (optional)** — when reCAPTCHA is enabled instead, the visitor's token and IP address are sent to Google for the same purpose.
Terms: https://policies.google.com/terms — Privacy: https://policies.google.com/privacy

**Public IP lookup** — when an administrator explicitly clicks "detect site IP" in the settings, the site's own outbound address is requested from api.ipify.org, falling back to ifconfig.me. No site content and no visitor data is sent, and the request happens only on that click.
ipify: https://www.ipify.org — ifconfig.me: https://ifconfig.me

**WhatsApp** — when a visitor chooses the pricing handoff, their own browser opens a wa.me link containing the ticket reference. No data leaves your server.
Terms: https://www.whatsapp.com/legal/terms-of-service — Privacy: https://www.whatsapp.com/legal/privacy-policy

== Installation ==

1. Upload the plugin to `/wp-content/plugins/tosai` and activate it.
2. Open **ToSAI → Start** in wp-admin and follow the setup checklist.
3. For Markdown-for-Agents only, enable markdown responses under Sitemap — no API key is needed.
4. For the chat assistant, add your BytePlus keys under Agent Setup, then index your content.
5. Connect your n8n instance under Workflow to run the chat conversation.

== Frequently Asked Questions ==

= Do I need an API key to publish Markdown for agents? =

No. Content negotiation, the knowledge endpoint and llms.txt generation all work without any external service.

= Where is the vector index stored? =

In a table in your own WordPress database. There is no external vector service.

= How do I stop a specific post being exposed to agents? =

Set its `_wptosai_exclude` post meta to `1`. Excluded posts are never indexed, and an already-indexed post that becomes excluded is removed from the index on the next run.

= Are drafts or private posts ever exposed? =

No. Drafts, private and password-protected posts are never served as Markdown and never indexed.

== Changelog ==

= 1.20.3 =
* Chat widget: fullscreen takeover on mobile (≤600px) with a header close button; the floating bubble hides while open and background page scroll is locked.

= 1.20.2 =
* Removed the `.semgrepignore` file from the plugin; its exclusions moved into the CI semgrep invocation, so no hidden file ships.
* Dropped checkip.amazonaws.com from the outbound-IP lookup; api.ipify.org and ifconfig.me remain.

= 1.20.1 =
* Re-release for the wordpress.org packaging. No plugin code changes since 1.20.0.
* Tested up to WordPress 7.1.

= 1.20.0 =
* Full WordPress Plugin Check remediation: output escaping, input sanitisation, internationalisation and deprecated-function cleanup across the plugin.
* Renamed to "ToSAI - Web ChatFlow" with the text domain `tosai` for the WordPress.org directory.
* The chat-preview widget is now registered and enqueued properly instead of being emitted as inline script tags.
* Debug logging is consistently routed through a `WP_DEBUG`-gated helper.
* Added readme.txt with a full external-services disclosure.

= 1.19.1 =
* Quality pass on the chat transcript restore.

= 1.19.0 =
* Chat transcript restore across reloads, using an HttpOnly cookie and a server-side record.
