Core Support

• Added A collection's version can follow a changelog. Collections → a collection → Current version now offers No version, Type a version (as before), or From a changelog: the current version of the changelog you pick, which updates with each new release, so docs never show an old version again. The changelog linked to the collection is listed first, each with its current version. A doc's own version still wins; if the changelog is removed or has no releases yet, the typed version shows.
• Fixed Changelog sources with spaces in the file name stopped syncing. Saving a changelog removed the percent-encoding from its addresses, so .../blob/main/Commerce%20Bridge%20for%20Hoster.txt was stored as .../CommerceBridgeforHoster.txt and the sync got a 404. "Check source" still worked, because it never saved. Addresses now keep their encoding, and a file address is no longer encoded twice when it is fetched from GitHub, GitLab, Bitbucket, Gitea or Forgejo (%20 became %2520). A changelog saved with the broken address needs its address entered again once.
• Fixed The same encoding loss affected a collection's Product page, Community and Source code links and a doc's Old addresses, which are now kept as entered.
• Fixed Docs with non-Latin or other encoded characters in their address redirected to themselves. The check that sends a doc to its one canonical address read the requested address without its encoded characters, so it never matched and the page looped. It now compares the address as requested.

• Fixed A new connected site could vanish. About 1 in 300 new connected sites got an id made only of digits, which WordPress stored as a number, so Core Support never listed the site and its contact form, portal and docs answered "not connected". Site ids now always contain a letter. Sites created before stay as they are.

• Added Your theme on docs pages. Settings → Header and footer has a new card that names the active theme, and its parent when it is a child theme, and says when Core Support recognizes it (built-in rules that also cover its add-on plugins and generated CSS). Two switches, both off by default, load the theme's styles or its scripts on docs pages:
• Added Styles: the theme's stylesheets, theme.json global styles and Additional CSS load, so its fonts and colors reach the docs.
• Added Scripts: the theme's scripts load and run.
• Added Either way, the theme's header, footer and other page markup stay out: from the theme's head and footer code, only the chosen style or script tags come through. Changelog and portal pages still load only Core Support's files.

• Fixed Core Support restyled video players inside docs. A player from another plugin, such as TruePlayer, Presto, Plyr or Video.js, got Core Support's text-field look on its volume and seek sliders (border, padding, white background, 36px height), Core Support's fonts and focus outline on its buttons, and doc styles on its links, menus, posters and video. A forced auto height and 16:9 ratio could also resize its video or embedded YouTube frame. Docs pages now skip any element that holds media together with player controls, so the player looks as it does on any other page. Ordinary doc content keeps its styles.
• Fixed Sliders and file pickers never get text-field styles. Range, file, submit, button, reset and image inputs are left as their own plugin or the browser draws them, on every Core Support page.
• Added csp-not-prose class. Add it to any block in a doc (Advanced → Additional CSS class) to keep Core Support's doc typography off that block and everything inside it.

• Added Tokens for GitLab, Bitbucket, Gitea and Forgejo. Settings → Changelogs has a token for each service beside GitHub's, and an address for a self-hosted GitLab or Gitea/Forgejo server. A changelog can sync from a repository, a folder or file in one, or its releases on any of them. Each token is sent only to its own service. Bitbucket has no releases, so it reads changelog files only.
• Added Exact token permissions in Settings. Each token field names what the token needs: Contents: Read-only on GitHub, the read_api scope on GitLab, Repositories: Read on Bitbucket, read:repository on Gitea and Forgejo.
• Added A question mark beside each settings section opens its guide on gauravtiwari.org in a new tab, and a tooltip names the guide. It is on Settings, Connections, Connected sites, Integrations, Chat, Diagnostics and License. The core_support_docs_url filter points the links elsewhere, or hides them when it returns an empty string.
• Fixed A GitHub token without file access read as "needs an access token". A fine-grained token that can see a repository but was not given Contents now gets "The GitHub token can see the repository but not its files", with the setting to change. Other services name the permission their token needs.
• Fixed A later "not found" hid a refused token. When the first changelog file was refused and the next names were not found, the sync reported the last 404. It now reports the refusal. A 404 with a token says the token may not cover the repository.

• Fixed The inbox ignored Settings → Header and footer. The agent workspace always showed the logo, the brand name and "Core Support / By Gatilab" in its footer, whatever the support portal pages were set to. It now uses the Support portal pages settings: the logo, the site name (hidden from view but still read out when switched off), the label beside it, and the footer text, credit and links. The version badge and the agent links stay.

• Security Chat no longer learns content meant for some readers only. Password-protected posts and docs in collections set to "Signed-in visitors" were learned like any other post, so Chat could quote them to anyone. Chat now never learns them, forgets a collection's docs the moment it is closed to signed-in visitors, and learns them again when it is opened. On update, everything restricted that Chat had learned is forgotten once.
• Added Support Manager role. Support Agent now works tickets, incoming mail, Chat conversations and docs. Support Manager does all of that plus Settings, Connections, Connected sites, Integrations and Diagnostics. Updating moves existing Support Agents to Support Manager, so nobody loses access; new agents get tickets only.
• Added Tickets in WordPress's privacy tools. Tools → Export Personal Data includes every ticket opened with the address, with its public conversation, and email received from it. Tools → Erase Personal Data removes the customer's name, address, subjects, own messages, attachments and original emails, and keeps the team's replies.
• Added Settings → Data: delete everything on uninstall. Off by default. When on, deleting Core Support from the Plugins screen removes its tables, settings, docs, changelogs, collections, private attachment files, roles and scheduled tasks on that site, and gives back the homepage if the support page held it. Files in an R2, S3 or Bunny bucket stay there.
• Added Conversation titles can use no model. The Conversation titles menu has "No model: first words of the question".
• Added A warning on Core Support screens when attachment storage needs attention, since new files go to the database until it is fixed.
• Fixed Saving Chat settings switched model-written conversation titles off. The setting had no field, so every save turned it off. It now follows the Conversation titles menu.
• Fixed The core_support_chat_rate_limit filter did nothing. Every Chat limit now goes through it: chat_session, chat_ip, chat_global and contact_ip, and a limit of 0 turns a bucket off.
• Fixed Chat introduced itself with an empty name when its own brand name was blank. It now uses the help desk brand, which falls back to the site title.
• Fixed Chat with no key for its answer model showed its button and then failed every question. The button now stays hidden until the provider has a key, and the warning on the Chat screen says so.
• Fixed The learning card counted posts with nothing to learn. A published post with no text of its own, such as a docs section that only groups its docs, can never be learned, yet it counted as published, so Docs read 172 of 202 on a site with 30 such sections. These posts are now recorded when Chat finds nothing to learn in them and left out of the card's counts, the Knowledge tab's Published column and the "Learn all now" summary; the card says how many are not counted. A post that gains text is learned and counted again. On upgrade, published posts that were checked but never learned are checked once more by the 30-minute check.
• Fixed The hourly limit on new tickets and replies said "Hourly demo limit reached". It now says "You have reached the hourly limit" and can be translated.
• Fixed Delivery activity said "Handed to WordPress mail" even when Emailit, Resend, Brevo or SendGrid sent the email. It now names the mail service in use.
• Fixed The Logo help text described the old fallback, and the connected-site portal switch asked for WordPress mail when any mail delivery except Capture only works.

• Fixed The Cloudflare relay Worker never delivered a message. On Cloudflare, the bundled tools/mail-relay Worker failed every delivery before sending it: it asked fetch for redirect: 'error', which Workers rejects, and called the global fetch as a method of its dependencies, which Workers refuses as an illegal invocation. Each email was retried three times and then forwarded to the fallback address, or rejected without one, so no relayed mail became a ticket. The Worker now fetches with redirect: 'manual' (a redirect still counts as a failed delivery and is not retried) and calls fetch directly. Redeploy the Worker from this version; nothing changes in WordPress or in the signature format.

• Added Docs on a connected website. Core Support → Connected sites → a website → Docs on this website shows the docs collections ticked for it on that site, from one script tag that works on static sites and site builders. The docs open in a frame that grows with its content and keeps search, navigation, videos and code blocks working. Only the ticked collections appear there: search, the docs home and the navigation leave the others out, and any other collection sends the reader back to the docs home. Only that site's addresses may frame them. Collections that need sign-in cannot be shown. Embedded pages are not indexed, so the docs site keeps its search ranking. Each collection also has its own start address, for a product's own site.
• Added Share buttons on docs and changelogs (Settings → Header and footer → Sharing): X, LinkedIn, Facebook, Bluesky, Threads, Reddit, WhatsApp, email and copy link, as plain links to each network's share page with no scripts from them. Off until you tick networks.
• Added Badges in any colour. A badge's colour can be your own: a hex code (#7c3aed), an rgb(), hsl() or oklch() value, or a CSS variable from your theme (var(--brand)), mixed so it reads in light and dark mode. The badges editor now lists the built-in badges (New, Improved, Fixed, Removed, Deprecated, Security, Breaking) first, to recolour them or add words, with a colour picker for your own colours.
• Changed Docs pages leave out only your theme. Every plugin's and block's styles and scripts now load on docs pages, so video players (TruePlayer, Presto and the like), Code Block Pro and analytics work. What goes is the theme's: files in the theme's folder, handles named after it, and rules for popular themes and their pro add-ons (Astra, GeneratePress, Kadence, Blocksy, OceanWP, Neve, Hello Elementor, Divi, Avada, Bricks, Storefront, Flatsome and more, and Marketers Delight); WordPress's theme layer (theme.json global styles, classic theme styles, Additional CSS); and code the theme hooks into the page head and footer. Block plugins whose names start like a theme's, such as GenerateBlocks and Kadence Blocks, stay. Settings → Header and footer → Other plugins on docs pages lists plugin handles to leave out as well, and the core_support_theme_handle_prefixes filter adjusts the theme rules; on docs pages the core_support_standalone_handles filter keeps a theme handle that would otherwise go. Changelog and portal pages still load only Core Support's styles and scripts.
• Changed Code blocks that bring their own highlighting and copy button (Code Block Pro and the like) keep their look on docs pages and get no second copy button.
• Fixed "What is the current version?" still answered with an old release on a changelog with many releases. On gauravtiwari.org, "what is the current Stackless version?" found the 1.0.4 release passage, not the passage naming 1.5.1, and Chat answered 1.0.4. Every passage of a changelog now starts with "{Product} changelog (current version X, released D)", so whichever release search finds, the current version comes with it. Learned changelogs are marked once on upgrade and learned again by the next 30-minute check.

• Added Excerpts, terms and custom fields. Every learned post now also gives Chat its excerpt, its terms and its custom fields (Advanced Custom Fields or Secure Custom Fields, and meta registered for the post type), so post types without an editor are learned at all: before, a post with no content was skipped. A field group tab that opens with an on/off field that is off is left out, so a switched-off deal is never quoted; underscore fields, images, files, passwords and hash-like values are never read. Chat → Knowledge → Custom fields to leave out lists more. Filter core_support_chat_post_fields.
• Added A custom field changed without a post save (an import, WP-CLI, the REST API) marks the post for the next check, and so does a change to any of its terms.
• Changed Changes are learned every 30 minutes, and only what changed. Publishing or updating a post of a learned type, a store price, option or license change, a changelog's text, synced release dates, pre-releases or kept history, and a doc moving to another collection (or its collection being renamed) now mark the post as changed instead of learning it at once. A new 30-minute check (core_support_chat_sweep, schedule core_support_chat_30min) learns marked posts again, oldest change first, then posts modified since they were learned, then published posts of a learned type that were never learned, so a backlog of missed posts never holds back a change just made. Each post is embedded only when its passages differ from what was learned, so an unchanged post costs no embedding request. Up to 25 posts a check and 20 seconds (core_support_chat_sweep_batch, core_support_chat_sweep_seconds); the rest waits for the next check. Each check also compares up to 10 unchanged learned posts, oldest first, for changes no hook reports (core_support_chat_sweep_checks, 0 turns it off), and forgets learned posts that are no longer published. Three embedding failures in a row end a check; a post that keeps failing moves behind the others.
• Changed The daily store check now compares every learned product with what Chat learned and marks the changed ones, instead of queueing every product.
• Changed Unpublishing, trashing and deleting still forget a post at once. "Learn all now" still learns at once.
• Changed What Chat has learned shows on the Knowledge tab only, no longer above Conversations.
• Changed The learning card shows how many posts are waiting for the check and what the last check did. Filter core_support_chat_watched_meta lists post meta whose changes mark a post.
• Fixed "What is the current version?" answered with an old release. Every changelog release is its own passage, and none said which one is newest, so Chat answered from whichever release matched the question best. Each changelog now starts with a passage that names the current version and its date, the newest pre-release when there is one, and the six most recent releases. On upgrade, every learned changelog is marked once so the next check learns it again.
• Fixed A post type with no pages of its own was offered as a source link that led nowhere; it no longer shows one.

• Added Header and footer settings. Settings → Header and footer has a card for each of the docs, changelog and support portal pages. Show or hide the logo and the site name, change or remove the label beside them, show or hide the docs search box, and add links and buttons to the header, each a plain link, a button or a primary button, in any order. The footer can be hidden, can carry its own text such as © {year} {site}, can show or hide the footer credit, and can list its own links. Addresses can be full https:// addresses, paths on the site, or Core Support pages such as {docs} and {support}. On phones, plain header links move into a menu. The defaults match the pages before this release.
• Added Filters core_support_header_links and core_support_footer_links change a page's links.
• Changed Minified, deferred assets. Release builds include a minified copy of every stylesheet and script (a third smaller before compression), served unless SCRIPT_DEBUG is on. The portal and block scripts and the admin scripts now load deferred, like the docs and changelog scripts already did. Embed snippets for connected sites name the minified scripts; snippets copied before keep working.

• Added Custom badges. Settings → Changelogs has a Custom badges editor: a label (such as Beta or Docs), a colour (green, blue, orange, red, yellow or gray) and other words that show the same badge, with a live preview. Changes labelled with those words, as [Beta], Beta: or under a ### Beta heading, show the badge on changelog pages, in feeds and the visual editor's suggestions, and come through the API as category custom-{label}. Custom words win over built-in ones, so Docs can be a badge of its own; a badge named after a built-in one (New, Improved, Fixed, Removed, Deprecated, Security or Breaking), such as Fixed | green | patch, changes its colour and adds words to it, and its category stays fixed. Up to 20 badges, stored one per line as Label | colour | other, words, which also works without JavaScript.
• Added Filters core_support_changelog_category and core_support_changelog_tone set a label's badge and colour.

• Added Import FluentCommunity courses as docs. wp core-support docs import fluentcommunity <course> turns a course on this site into a collection: sections keep their titles and order, each published lesson becomes a doc, and links between lessons (also into courses imported earlier) point at the new docs. --retire hides the course in the community and redirects its lesson and course addresses to the docs, although FluentCommunity still answers them. An "&" in a section title no longer turns into "amp" in its address.
• Added Kept release history for changelogs. wp core-support changelog history <url> --changelog=<slug> keeps every release from a published changelog page (one that lists releases as <article class="release">, following its /page/N/ pages) beside the changelog's own or synced text. Syncing never removes history, and where a version is in both, the history's notes show. Feature headings become badged changes with their details below, and the one-line summary is not repeated. Chat learns the full history, one passage per release.
• Fixed --no-images on wp core-support docs import was rejected as an unknown parameter; it now leaves image addresses as they are.
• Fixed Doc addresses are resolved inside their collection. Two collections can each have a "Getting started" section at /docs/{collection}/getting-started/ instead of the second becoming getting-started-2, and an address always opens the doc in the collection it names. Imported top-level docs keep their clean slug, and plain-permalink doc links name the collection too.

Upgrading

• Changed Search reads every passage. Each question is compared with every learned passage instead of a shortlist of about 50, and that ranking is combined with the database's word search, so a passage that names the exact product, setting or error code still comes first. Only the best passages' text is read. With a persistent object cache (Redis or Memcached), the vectors are kept there. Above 5,000 passages at 512 dimensions (proportionally fewer with longer vectors, and 2,000 for keyword search without FULLTEXT), Chat compares a shortlist as before; the core_support_chat_full_scan_max_chunks filter changes the limit. See the [retrieval benchmark](docs/chat-retrieval-benchmark.md).
• Changed Smaller vectors. OpenAI text-embedding-3 and Voyage 4 search models store 512 numbers per passage instead of 1,536 or 1,024, so search reads a third to a half of the data, at a small cost in accuracy. The core_support_chat_embedding_dimensions filter sets another size, or 0 for the full one.
• Changed Every passage knows its doc. Passages start with the doc's title and the product it documents ("Core Forms › Install the plugin"), both for search and for the model, and follow the doc's H2 and H3 sections instead of breaking in the middle of one. A long section's later passages repeat its heading. Text from neighboring blocks no longer runs together.
• Changed A new search model keeps Chat answering. After you choose another search model, every post is learned with it in the background while Chat keeps answering with the old one; Chat switches once every post is learned, then deletes the old passages. The learning card on the Knowledge and Conversations tabs shows the progress. Before, answers stopped until everything was learned again by hand.
• Fixed Safe relearning. A post's passages are replaced in one database transaction, so a failed save keeps the old ones and a question never meets a half-written post. One process learns a post at a time; a post saved while it is being learned is learned again right after. Duplicate passages left by earlier versions are removed, and the database now refuses new ones.
• Fixed Updating from 0.8.0 learns every post again in the background, with one embedding request per post for OpenAI and Voyage search models. Chat answers from the stored passages until it finishes. While Chat is off, this waits until it is turned on.

• Added How Chat answers. Chat → Settings has a new card: answer length (short, balanced or detailed), what Chat answers questions about (this site and its products, or anything with the site's content first), asking one short question when a question is unclear, suggesting a person for accounts, orders, billing, refunds and bugs, and your own rules, one per line (up to 20). Your rules win over the built-in ones, except never asking for passwords or keys.
• Added Built-in answer rules. Chat answers the question in its first sentence, uses the docs for facts about the site and copies names, prices, menu paths and setting labels exactly, answers for the product, plan or version the visitor means, writes steps as a numbered list, replies in the visitor's language, and ends without filler.
• Added Limits in every answer. Each answer length has a word limit (about 80, 180 or 400 words) and a matching output cap, never above "Longest answer". Chat asks at most one question and adds at most two links per answer, never says it checked, changed or sent something, never promises refunds, prices, dates or features the docs do not state, keeps to the docs on legal, tax, medical and security questions, and ignores instructions hidden in docs or messages that try to change its rules.
• Added A model and thinking level for each task. Chat → Settings sets the thinking level for answers (off, low, medium or high) and, for follow-up questions and conversation titles, its own model and thinking level. Follow-up questions such as "what about teams?" can be rewritten by a model into a full search, so the right docs are found; the built-in rules stay the default. Test connection checks every chosen model once.
• Added Store data in Chat's knowledge. WooCommerce products, FluentCart products and Easy Digital Downloads are learned with their store data, not only their description: price and sale price, options and their prices, SKU, stock status, attributes, categories, subscription terms (billing period, trial, sign-up fee), and license terms (sites per license, validity, current version, WordPress and PHP requirements). Stackless subscription and software licensing terms on WooCommerce products are included while those Stackless modules are active. Products are re-learned when their prices, options, stock status or terms change, and once a day for changes no hook reports; unchanged products are skipped without an embedding call. The core_support_chat_product_facts filter adds facts for any post type.
• Added Learn all now, five posts at a time. The Knowledge tab learns a post type in batches of five while the screen is open, and the Learned column, the summary and the progress bars update after every batch. A failing key stops the run with the provider's reason instead of working through every post. Without JavaScript the old background queue still runs.
• Fixed Token usage on streamed replies. OpenAI and DeepSeek streams now ask for usage, Claude streams count input tokens from the start of the reply as well as output tokens, and a reply from a provider that sends no usage is estimated from its text, so the daily token budget holds. Follow-up rewrites and conversation titles count toward the budget too.
• Fixed Thinking level for Claude. The level is sent as Claude's effort, thinking is switched off where the model allows it (Claude Haiku 5.5, Sonnet 5 and Opus 5; Sonnet 5.5 drops up-front thinking), and Opus and Sonnet 4.6 to 4.8 think when a level above Off is chosen. Before, the setting did nothing for Claude.
• Fixed Room to think. Thinking tokens count toward a reply's output cap on every provider, so answers, titles and connection tests get extra output room when thinking runs, and a thinking model no longer spends the cap before it writes a word.
• Changed Background learning runs in batches of five posts instead of twenty, and the Learned column and summary update while jobs are waiting.
• Changed "Extra instructions" is now "Tone and extra instructions" under How Chat answers, added after your rules.

• Added Changelogs at /changelogs/. One changelog per product or service and every release across products, with a product list, Stable only filter, an address per release (#v1.2.0), RSS and a JSON API. Each changelog's releases are one text in WordPress readme or Markdown style, written in wp-admin or synced every 24 hours (customizable) from a readme.txt, CHANGELOG.md or changelog.txt at any address, a GitHub repository (private ones with a token) or its GitHub releases, or wordpress.org. Undated versions take their dates from GitHub releases. Labels such as [NEW], [IMPROVED], [BUG FIX] and [REMOVED] become badges. See [integrations](docs/integrations.md#changelogs-release-history-at-changelogs).
• Added Changelog editor. The Releases panel starts with a choice: write releases here, or sync them from GitHub or a file. Written changelogs have a visual editor (release cards with version, date, summary and labeled changes, Enter for the next change) and the same changelog as text, kept in step through the site's own parser. Synced changelogs show what an address points at, Check source to preview it before saving, which token applies, the schedule, a status card with the file being read, Sync now in place, and the synced releases read-only.
• Added One GitHub token for changelogs. Settings → Changelogs holds a fine-grained token used for every changelog synced from GitHub (private repositories included) unless a changelog sets its own. Saving it re-checks failed changelogs at once, and failed syncs are retried hourly.
• Added Current models built in: GPT-6 Astra, GPT-6.1 Sol and GPT-6 Luna (default), Claude Fable 5.1, Opus 5.5, Sonnet 5.5 and Haiku 5.5, and DeepSeek V4.1 Flash, each with the previous generation. GPT-6 models are sent as reasoning models, "Off" reasoning becomes "low" for Astra and Sol, and Claude 5 models are sent without temperature.
• Added Test connection for Chat. Chat → Settings sends a one-line test to the chosen chat and search models, with a key typed in the form or the saved one, and says whether each answered, how fast, and why not (refused key, unknown model, rate limit, server error). Nothing is saved and keys never come back.
• Added Learning progress. The Conversations and Knowledge tabs show how much of the chosen content Chat has learned, per post type, and what is waiting; the bars update while learning runs.
• Added Chat model lists stay current. With an API key saved, each provider's newest models and up to three previous versions are listed, refreshed daily.
• Added Chat learns from any post type. Chat → Knowledge lists every public post type with what it has learned, Learn all now and Forget.
• Added Chat placement. Choose where the chat button shows: every page, docs pages, support portal pages, the home page, single posts of each type, extra addresses (with * for a whole section), and addresses where it never shows. Docs and support pages are the default.
• Added Footer credit. Settings → Branding sets the text that replaced "Powered by Core Support" on portal and docs pages, with an optional link, or hides it.
• Added Portal and docs color mode. Visitors get a light portal, docs and chat widget by default; Dark and Automatic are options. The wp-admin workspace keeps its own color mode.
• Added Docs at /docs/. Product documentation in collections, sections and pages with branded standalone pages, instant search, "On this page", previous and next, callout and steps block styles, "Was this helpful?" feedback, signed-in-only collections, redirects from old addresses, and a Docs insights screen for empty searches, unhelpful docs and stale pages. See [integrations](docs/integrations.md#docs-product-documentation-at-docs).
• Added Chat. An AI assistant that answers from your docs, ported from Alpha Chat: OpenAI, Anthropic, xAI or DeepSeek, OpenAI or Voyage embeddings or keyword search with no extra key, streaming replies with source links, and "Talk to a person" handoff into a ticket with the transcript. One script tag embeds it on connected sites, with origins checked and conversations owned by a server-issued token. Encrypted keys or CORE_SUPPORT_CHAT in wp-config.php, a daily token budget, rate limits, message and turn caps, retention, and privacy export and erase. Core Support → Chat has settings, knowledge indexing, conversations and embed code.
• Added Docs importers (wp core-support docs import): docs sites by sitemap or page, Markdown files and GitHub wikis, and wordpress.org readmes, as drafts. Native blocks that pass editor validation, images copied into the media library, links between pages rewritten, old addresses recorded for redirects, and safe re-runs that never overwrite edited or published docs.
• Added Telegram team alerts. Alerts can go to a private chat, a group, a forum topic or a channel through your own bot. Settings → Team alerts checks the token with Telegram when you save it, and Find my chat lists the chats the bot has seen so nobody has to look up a chat ID. Customer text is escaped, link previews are off, and the ticket link is a button when the site uses HTTPS.
• Added Alert settings in wp-config.php. The CORE_SUPPORT_ALERTS constant can hold any team-alert setting, including tokens, for one site or a map of blog IDs. Constant values show read-only and are never copied into the database.
• Added The core_support_alert_channels filter lets add-ons register their own alert channels.
• Changed Standalone pages (docs, portal, changelogs) use the system sans-serif when the font is set to "Theme font", since theme CSS is not loaded there.
• Changed Docs and changelog pages have clear titles ("Documentation", "Product changelog", "Product 1.2.0 release notes") instead of archive titles.
• Changed Chat settings are grouped into cards, checkboxes are tiles that follow light and dark mode, and selects keep readable text on hover in dark mode.
• Changed Docs and standalone portal pages load only Core Support's CSS and JavaScript. Theme and plugin styles and scripts are removed, including styles WordPress 6.9+ moves into the head after the page is built; titles, meta tags, canonical links and JSON-LD stay. The core_support_standalone_handles filter keeps chosen handles.
• Changed Dark workspace screens in wp-admin paint the whole page, not only the Core Support panel.
• Changed Chat indexes nothing while it is switched off.
• Changed Each channel is delivered on its own. Every alert becomes one WP-Cron job per channel, so a slow or failing service no longer delays the others. Rate limits, server errors and timeouts retry after 1, 5 and 30 minutes (or later when the service asks), up to three times; other rejections are reported at once. Alerts queued by earlier versions still go out.
• Changed Team alerts screen: one card per channel, each with its own Save, Send a test alert, last-delivery status (Ready, Working, Retrying, Failed, Paused) and a switch that pauses the channel without forgetting its settings. Problems never show saved credentials.

• Fixed Password fields are excluded before form fields can become customer identity, subjects, messages or ticket details.
• Fixed Portal sign-in codes enforce attempt limits and single use across concurrent requests and stale object caches. Failed replacement delivery preserves the previous code. Pending codes issued before this update must be requested again; existing sessions remain valid.
• Fixed Response-suppression headers no longer discard human mail, and HTML-only replies preserve answers written below quoted questions.
• Fixed IMAP ingestion continues after mark-read or move failures, with independent mailbox checkpoints and visible cleanup warnings.
• Fixed Failed attachment association remains retryable, and conversations show all attachments for their visible messages rather than truncating at 500 files.
• Fixed Storage settings prevent destination changes that would strand files, validate the proposed prefix, and report failed settings persistence. Same-destination credential rotation remains supported.
• Fixed Connected-site portals ignore obsolete responses after navigation/sign-out, preserve drafts through conflicts and same-account reauthentication, and work with plain WordPress permalinks.
• Development Added regression coverage for these failure paths and a PHP 8.5/MariaDB packaged-integration CI job. Updated contributor commands and routed historical setup notes to the current integration guide.

• Changed Customers see every ticket sent from their account email. Tickets that arrive from email, Core Forms, Contact Form 7, WPForms, Gravity Forms, Fluent Forms or a connected site now belong to the WordPress account with that exact email address as soon as they arrive, so they appear in that customer's portal and reply emails link to it. Older unowned tickets are linked the next time the customer opens the portal. Tickets that already have an owner never move. Because the sender of an email or a signed-out form is not verified, the portal labels these tickets "Sent by email", "Sent from a website form" or "Sent from <site>", so one sent by someone else using the address is easy to spot.
• Changed Signed-out portal: visitors who are not signed in see only the sign-in prompt. Filters, search, Refresh and New ticket no longer show until they can work, and controls stay hidden rather than greyed out while the page checks who is visiting.
• Changed Quieter portal: the uppercase tagline, the sidebar's filler note and the generated letter tile in place of a logo are gone; without a logo the brand name stands alone. Labels such as "Ticket #12" use sentence case. An empty inbox no longer repeats a second "Start a conversation" button next to New ticket.
• Fixed Theme button styles could repaint portal and admin buttons. On gauravtiwari.org the theme's submit-button rule turned Search into a full-width red bar with dark text. Core Support buttons now outrank theme submit-button rules (including ones that force full width) and reset the properties themes usually set, and Refresh is a compact icon button beside Search.

• Added Native mail providers: Settings → Notifications → Mail delivery can send through the Emailit, Resend, Brevo or SendGrid API instead of WordPress mail. The API key is saved encrypted, or set CORE_SUPPORT_MAIL_API_KEY in wp-config.php. Rate limits and provider outages go back in the queue for up to five attempts; any other refusal, such as an unverified sender, fails visibly. Diagnostics shows the provider's latest error and warns when a mailbox's header reply tracking cannot work with the chosen provider (only SendGrid keeps Core Support's Message-ID).
• Added HTML email: reply notifications and portal sign-in codes now go out as HTML with a plain-text part, in one quiet column: your brand name or logo, the reply as body text, one link to the conversation. The plain-text part is unchanged and is still what replies are read from, so "Please reply above this line." keeps trimming quoted history.
• Changed Reply notifications name the agent who replied ("Gaurav replied") and put the ticket number and subject in the footer.

• Added Connections screen (Core Support → Connections): add and edit mailboxes (relay, automation token, IMAP) and attachment storage from wp-admin instead of wp-config.php. Passwords, secrets, tokens and storage keys are encrypted in the database; wp-config.php entries still win and show read-only. Storage is saved only after a test file round-trips.
• Added Reply tracking without plus addressing: a mailbox can use message headers instead of support+token@. Notifications carry the token in their Message-ID and replies are matched through In-Reply-To/References, with the same sender check.
• Added Customer portal for connected sites (assets/portal.js): customers sign in on another website with an emailed 6-digit code and see, open, answer, resolve and reopen the tickets they opened there. Reply emails for those tickets use the site's name and link to its portal page.
• Added Team alerts (Settings → Team alerts): Pushover, Discord, Slack and a signed JSON webhook for new tickets and, optionally, customer replies. Message text is left out unless previews are turned on.
• Added Email from new senders can open tickets automatically instead of waiting for review.
• Added Pasted screenshots in email are kept and shown inline in conversations for agents and customers; other files stay downloads. Tracking pixels under 1 KB are skipped.
• Added Unencrypted object storage: with encryption turned off, R2, S3 and Bunny files keep their real names and content types, so they open from the provider's dashboard.
• Added Agent alert links open the ticket directly (admin.php?page=core-support&ticket=<id>).
• Added Plugin integrations (Core Support → Integrations):
• Added Customer details beside each ticket from WooCommerce, FluentCart (including Pro licenses), Easy Digital Downloads (including Software Licensing) and FluentCRM.
• Added Tickets from Contact Form 7, WPForms, Gravity Forms and Fluent Forms, chosen per form with optional review, and a "Create Core Support ticket" action for Core Forms.
• Added A Support tab in WooCommerce My Account and the FluentCart customer dashboard, with "Get help with this order" on WooCommerce orders.
• Added Optional FluentCRM sync that adds ticket customers as transactional contacts with a tag.
• Added Admin redesign: Settings, Connections, Integrations, Connected sites, License and Diagnostics now use Tabler cards, switches, choice cards, copy fields, badges and empty states, with the brand's colors and dark mode. The icon set grew to 77 Tabler icons (tools/build/icons.py copies them from the icon library).
• Fixed The admin menu icon was a 1254px, 923 KB image loaded on every admin page; the plugin now ships 40px and 96px versions, and the package is about 0.9 MB smaller.
• Fixed Diagnostics used a thick left border on a rounded card.
• Fixed "Download original email" in the ticket view showed "The link you followed has expired": the URL was HTML-escaped twice.
• Fixed The License menu item pointed to /wp-admin/core-support-license because its submenu was registered before the Core Support menu. Submenus now also appear in a stable order, with License last.
• Fixed Message text is stored as written. Earlier versions removed <tags>, turned < into <, dropped %20-style sequences and collapsed indentation in tickets, replies, email and form submissions.
• Fixed The IMAP poller could stop importing all mail when a listed message was deleted before its turn, or when one message kept failing. Missing messages are now skipped, and a message is retried at most five times.
• Fixed On multisite, a super admin could save a non-existent user as the default assignee or assign tickets to them. Agent checks now require a real member of the site.
• Fixed Email-only customers were told to continue in a portal that cannot show their ticket; their emails now ask them to reply instead.
• Fixed Website-form messages close to the length limit were rejected with a confusing error; the error now says how long the message may be.
• Fixed Unknown mailbox webhook routes return 404 instead of 503, so relays and automation tools stop retrying them. Ignored wp-config.php mailbox entries are listed with the reason on the Connections screen.
• Fixed Agent names containing &, < or > displayed as HTML entities.
• Fixed Sender names containing quotes gained stray backslashes in email.
• Fixed Incoming mail and the branding media picker lost their assets when the menu title was translated.
• Fixed The workspace showed raw JSON parse errors when the server answered with an HTML error page.
• Fixed The attachment count on received email included files that were never stored.
• Fixed A database setup failure no longer prevents the Support Agent role and administrator capabilities from being installed.

• The workspace header shows the installed version (for example "v0.4.1 beta 1") instead of a fixed "BETA 01" label, and the footer shows the full version number.

• Rebuilt the agent workspace, Incoming mail, customer portal, blocks, and standalone pages on the Tabler design language used by the Stackless theme: neutral surfaces, hairline cards, list rows, light status badges, and 36px controls.
• Added Settings → Branding: brand name, Media Library logo, accent color, neutral palette (neutral, slate, gray, zinc, stone), corner radius, font (system, theme, serif, monospace), and light, dark, or automatic color mode. Accent text and link colors are derived to meet 4.5:1 contrast in light and dark modes.
• The default accent is now Tabler blue (#066fd1). Sites that saved a custom accent keep it.
• Asset URLs now include the file modification time, so page and edge caches never keep a changed stylesheet or script.

• Added built-in IMAP polling with TLS certificate verification, UID tracking (mail already read in a mail client is still imported), unread-only import on first connection, optional move to a processed folder, and visible skipped-message and error status.
• Added a token-authenticated intake endpoint for FlowMattic, Zapier, Make, n8n, and Pipedream. It accepts raw MIME or parsed fields, including attachments by base64 or https URL, and handles idempotent retries.
• Added Connected sites: an embeddable, origin-restricted, rate-limited form for static and WordPress sites, plus a server API with per-site keys. Submissions are reviewed in Incoming mail or open tickets directly, and each ticket shows "via <site>" to agents.
• Added attachment storage in Cloudflare R2, Amazon S3 and S3-compatible services, Bunny Storage, or private local files. Files are encrypted before upload. Added wp core-support storage test and storage migrate to move older originals out of the database.
• Attachments are now extracted from received mail and listed on each message, with authorized download-only links for agents and customers.
• Raised the configurable message limit to 10 MiB with database storage and 25 MiB with external storage.
• Added wp core-support mail-poll, plus IMAP and storage checks in Diagnostics.
• Database schema 4 adds ticket and receipt sources and an attachments table.

This release adds signed inbound email replies, incoming-message review, encrypted originals, delivery recovery, and safer ticket workflows. Stock support pages use their own design, outgoing subjects are shorter, and the plugin includes FluentCart licensing and WordPress updates.

Requires WordPress 7.0+, PHP 8.2+, and sodium for encrypted email and license storage. Inbound email requires the included customer-owned relay and mailbox configuration. Direct Gmail/Microsoft connections and production validation remain open.

The lifetime license is available at https://gauravtiwari.org/product/core-support/ for $199 USD once with unlimited sites. Third-party service charges are separate.

Validation: 96 unit tests, 319 packaged WordPress assertions, 15 relay tests, 11 browser regressions, PHPStan level 8, PHPCS, and JavaScript lint. CI covers PHP 8.2–8.5 and WordPress 7.0/7.1.2.

• Added 25 validated settings for portal copy/colors, intake and ticket defaults, customer permissions, workspace behavior, and reply notifications.
• Enforced intake, message-length, resolution, and reopening rules in the ticket service; applied configurable pagination and reply status.
• Added per-message sender/subject/footer configuration, notification disabling and queue pausing, while preserving capture-only demo behavior.
• Color-coded status, priority, assignment, and delivery activity with visible labels and icons. Priority remains agent-only.
• Replaced the admin menu symbol with the Core Support plugin icon.
• Added a dedicated settings integration suite. See [Alpha 04](docs/milestones/alpha-04.md).

• Added automatic support-page setup that preserves existing site content and homepage settings.
• Added portal-page and URL settings, plus explicit administrator-only homepage placement with restoration of the prior homepage.
• Added Customer Portal, New Ticket, and My Tickets dynamic Block Editor blocks with independent form IDs and state.
• Preserved theme layouts and surrounding content; moved session credentials out of page HTML into a private bootstrap request.
• Updated navigation and notification links to use the configured portal URL, and corrected the old demo homepage takeover.
• Added page/block integration checks and syntax checks for the packaged PHP files. See [Alpha 03](docs/milestones/alpha-03.md).

• Upgraded the site-local Support Agent role to cover the full Core Support interface, including Diagnostics and the email triage lab, using dedicated plugin capabilities. It does not grant WordPress administrator permissions.
• Added an idempotent role upgrade, agent login routing, and 22 assertions using a real non-admin WordPress user.
• Replaced text-symbol icons with a bundled subset of the owner-provided Tabler SVG collection and applied the previously created plugin mark.
• Added guarded operator provisioning for a demo Support Agent account. Passwords are supplied outside the repository and never bundled.

• Added persistent customer tickets and an agent inbox with replies, private notes, status, priority, assignment, search, and pagination.
• Added transactional request deduplication, version conflicts, per-site capabilities, customer isolation, and private-note filtering.
• Added a customer portal with isolated 24-hour demo sessions, captured delivery activity, and an optional WordPress mail handoff worker.
• Prefixed packaged PHP dependencies; added synthetic WordPress integration checks and a backed-up demo deployment workflow.
• Scope and limitations: [Alpha 01](docs/milestones/alpha-01.md). Inbound email and connected mailboxes are not implemented.