Wyregraf Changelog

Every released version of Wyregraf, from 0.7.0 back to 0.1.0.

0.7.0 — October 24th, 2026 #

• New — Add global and per-chat blocked-word/phrase filtering and exact IPv4/IPv6 bans before chat dispatch, with inherit/add/replace policies and configurable visitor messages.
• New — Add secret-free JSON import/export for global settings and all chat configurations; imports merge recognized options and create new draft chats.
• New — Add a guided Setup screen for provider keys, model profiles, the first source and index, chat creation, preview, and embed instructions.
• New — Add Retrieval Lab case import/export, baselines, Recall@K, MRR, provenance, entity-conflict, latency, and provider-call metrics.
• New — Add structure-aware chunking, contextual enrichment, coreference rewriting, entity extraction, hybrid lexical/vector retrieval, query planning, reranking, citation integrity, and strict answer verification as per-source or per-chat controls.
• New — Add Voyage contextual embeddings and reranking alongside OpenAI and Anthropic provider support.
• New — Add opt-in validated atomic facts per source, generated through a retryable queue with source-span validation and diagnostic dead letters.
• New — Add automatic source reindexing, resumable retrieval-text backfills, failed-job diagnostics, and retry controls.
• Security — Replace the vulnerable third-party PDF viewer with a locally bundled PDF.js worker, disable PDF eval support, and restrict inline previews to same-origin files.
• Security — Rate-limit anonymous chat, subchat, and source create/update/delete requests by chat group and IP.
• Security — Update Guzzle, PSR-7, PHP_CodeSniffer, WPCS, and JavaScript dependencies; remove the unused abandoned scraper/Goutte dependency.
• Compatibility — Remove dbDelta-incompatible foreign-key declarations and use explicit application-level child cleanup so fresh installs and upgrades work on supported MySQL and MariaDB versions.
• Compatibility — Avoid eagerly loading the bundled plugin-engine Composer autoloader so Wyregraf can run beside another Artifex plugin.
• Tweak — Lower the default Cosine Similarity Threshold for new retrieval chats and retrieval tools from 0.80 to 0.50 so a fresh install answers a direct first question instead of returning the no-results message.
• Fix — Register the Chats options tab (streaming, site-wide launcher, retention) so the Setup screen's "enable the launcher" step and the launcher settings are stored instead of being dropped by the options sanitizer.
• Fix — Read the chat API's result key in the Setup screen preview so a successful test answer is shown instead of a generic error.
• Fix — Allow a REST source update without re-sending the parent subchat; a partial PUT /sources/{id} no longer fails with a missing-parameter error.
• Fix — Replace fragile pipe-delimited agent-network routing identifiers with exact, zero-based integer group identifiers.
• Fix — Restore keyboard focus to the launcher button when its chat dialog closes.
• Fix — Replace retired Claude 3 choices and inaccurate GPT help text with the supported Claude Sonnet 4.6, Haiku 4.5, and Opus 4.6 catalog.
• Dev — Expand release gates for dependency audits, PHP/JavaScript lint, static analysis, complete SLIC suites, compiled assets, and installable ZIP inspection.

0.6.0 — July 27th, 2026 #

• New — Streaming, token-by-token chat responses for both OpenAI and Anthropic, across retrieval and plain-chat paths, with a global toggle, a per-chat off-switch, and an automatic all-at-once fallback on buffering hosts.
• New — Per-role and guest quotas and rate limiting (by queries, tokens, or spend) over hourly/daily/monthly windows, with per-chat overrides and configurable limit messages.
• New — Conversation transcripts admin screen with search, per-conversation delete/purge, and a retention setting with daily cleanup.
• New — Knowledge Gaps admin screen listing unanswered and low-confidence questions and the answers rated down.
• New — Usage analytics admin screen: question volume, questions-per-day chart, and top questions, with selectable date ranges.
• New — Per-chat starter questions and automatic follow-up question suggestions after an answer.
• New — Thumbs up/down feedback on assistant messages, saved per message and surviving reload.
• New — Grounded-answer guardrail: return a configurable fallback (with no AI call) when retrieval finds nothing, and instruct the model to decline on weak matches.
• New — Per-chat persona / brand voice and allowed-topics scope added to the system prompt.
• New — Floating chat launcher: a per-chat or site-wide bubble that opens a chat panel, with position, label, and icon options.
• New — Widget theming: owner accent color, brand logo, avatars, and welcome message applied to the chat.
• New — Copy and regenerate actions on assistant messages.
• Improved — Automatic answer-in-the-question's-language behavior when no chat language is set.
• Fix — Rewrote the Anthropic API client to use the correct wire format and register the provider so Claude models work reliably, including while streaming.
• Dev — New database tables for message feedback, unanswered queries, usage, and query logs, with retention crons and expanded test coverage.

0.5.0 — July 27th, 2026 #

• Security — Enforce per-chat-group ownership on the chat REST API (chats, subchats, messages, sources) to prevent cross-group/cross-user access (IDOR); previously only the nonce was checked.
• Security — Require a valid REST nonce for the OpenAPI documentation endpoint instead of leaving it publicly accessible.
• Security — Redact API keys, tokens, and passwords from debug output and stack traces via __debugInfo() and #[\SensitiveParameter] on credential-carrying parameters.
• Security — Sanitize chat message input and harden JSON request parsing (depth limit, error handling, type guards) for chat history and sources.
• Feature — Add Summaries and Questions embeddings with admin management (per-type chunk counts and queue controls) to improve retrieval quality.
• Feature — Resolve citations to the original source document when a summary or question chunk matches, so results show the real content.
• Fix — Return a clear error response on chat/AI provider failures (e.g. quota limits) instead of an empty reply or a fatal error, and stop saving blank assistant turns.
• Fix — Answer from prior conversation history when a similarity search returns no new matches, instead of a "no matches" response.
• Fix — Skip blank chat-history entries when building prompts to avoid a missing-placeholder error breaking subsequent chats.
• Fix — Guard against malformed split-queries from the LLM during retrieval, falling back to a plain retrieval query.
• Fix — Chunk long summaries and questions so they respect chunk-size limits while keeping a shared parent reference.
• Tweak — Update selectable OpenAI models and pricing (GPT-5.5/5.4, GPT-4.1, GPT-4o, o3/o4-mini) and default new profiles to gpt-4.1-mini.
• Tweak — Show detailed chat error messages to administrators while showing a generic message to other users (filterable via pngx_wyregraf_pro_chat_show_error_details).
• Tweak — Recreate missing HAMMING/COSIM vector SQL functions automatically at search time so a database restore or migration can self-heal.
• Compatibility — Raise the minimum required PHP version to 8.2 and add PHP 8.2 dynamic-property compatibility across classes.
• Compatibility — Remove the Weaviate and Pinecone vector store backends; Wyregraf now stores and searches vectors exclusively in the local WordPress MySQL database, with no external vector database or third-party service required. Existing profiles set to those backends fall back to local MySQL storage.
• Dev — Add an embeddings integrity verification helper and a REST chat-group ownership (IDOR) test.
• Dev — Update coding standards and build tooling (WPCS 3, VIPWPCS 3, Strauss 0.27.2), narrow autoload to vendor-prefixed, run CI on PHP 8.2, and remove Rector.
• Dev — Remove obsolete files (HubSpot Setup_Queue, local MCP config, rector.php, tests.md, stray .DS_Store files) and dead code (binaryFilteredSearch).
• Dev — Drop the probots-io/pinecone-php Composer dependency (and its orphaned sammyjo20/saloon transitive) along with the Pinecone/Weaviate vector store classes and admin fields.

0.4.0 — July 27th, 2026 #

• Feature — Add Internal Embeddings source.

0.3.0 — February 8th, 2024 #

• Feature — Add Namespace Filter to chats.
• Tweak — Add text-embedding-3-small and text-embedding-3-large models
• Tweak — Update OPENAI LLM models and pricing with 0125 versions.

0.2.0 — January 9th, 2024 #

• Feature — Add URL Scrape feature to create embeddings from any public URL.

0.1.0 — November 30th, 2023 #

• Initial Release
• Feature — Embeddings and Vectors Profiles
• Feature — LLM Profiles
• Feature — Retrieval and Standard Chats
• Feature — Embeddings System
• Feature — Retrieval and Chat Prompts