== Changelog ==

= 3.8.1 (2026/09/24) =
* Fix: Security: visitors could override a chatbot's or form's model, instructions or environment with renamed parameters. Fixed, and the Advisor widget now escapes its output.
* Add: Glass, a new chatbot theme with colored light under frosted glass, a dark and a light mode, and a mode that follows the visitor's device.
* Update: Every chatbot theme was polished: proper headings, lists and tables in replies, an empty state that introduces the bot, message actions beside the bubble, and a message field that keeps its height on every WordPress theme.
* Update: Timeless and Messages have refreshed defaults (larger text, rounder corners, a white pane), and Messages drops its bubble tails. Customized themes keep their own values.
* Update: Redesigned the dashboard's AI Visibility card, with visits, score and the top AI companies from SEO Engine, and an example you can hide when it is not installed.
* Add: Templates in the Content Studio, shared with the classic generator.
* Add: Every text the chatbot says on its own can be translated or changed with the mwai_chatbot_texts filter, plus a new Empty State Hint parameter.
* Update: Pictures sent by visitors appear as a photo card, and message actions can be reached with the keyboard.
* Update: The mwai_image MCP tool accepts an aspect ratio, and images requested without a size are now square instead of 21:9 on Gemini.
* Update: Workspace now tells you when your site refuses a rename, a delete or a save, instead of failing silently.
* Update: Deleting or resetting a chatbot, a theme or a template now asks first.
* Fix: Embeddings were skipped on pages made with a page builder (Breakdance, Oxygen, Bricks...).
* Fix: Models of a Custom (OpenAI-compatible) environment could not receive images.
* Fix: The discussions list with several lists on one page, empty discussions, and its menu while scrolling.
* Fix: The admin crashed when a chatbot's ID was changed, and a crash in one settings tab no longer locks the whole screen.
* Fix: Stopped or edited Workspace replies no longer come back duplicated.
* Fix: A streamed reply was rebuilt when it finished, reloading its images.
* Fix: Dev Tools no longer polls the server every second while open.

= 3.8.0 (2026/09/18) =
* Add: Models API Pro module, so coding agents and OpenAI-compatible apps can use your site's AI models with one key, with usage tracked in Insights.
* Add: Editor Access for MCP, letting Editors connect with their own account and work on content only.
* Update: Rebuilt the Images, Playground and Content screens as studios, with image versions and brush edits, side-by-side model comparison, a guided brief-to-draft flow and shared presets.
* Update: Knowledge sync now reports why posts were skipped instead of only the count.
* Update: Excluded notes, archives and the Brewfile from the released package.
* Add: Paste a file into the chatbot to upload it, and hover the reply timer to stop a response in progress.
* Fix: Daily, weekly and monthly limits in Absolute mode no longer trip early.
* Fix: Image, media and post creation routes now check permissions before acting.
* Fix: Listing chatbots no longer fatals on the free plugin when a chatbot uses functions.

= 3.7.8 (2026/09/13) =
* Add: Redesigned Dashboard with a providers bento, weekly usage card, daily ideas and an AI visibility card, plus a slimmed Modules tab.
* Add: MCP tools to install and update plugins and themes from the WordPress.org directory.
* Add: GPT Image 2.5 Sunburst and Flare with the new quality levels.
* Fix: Workspace module no longer switches itself off on sites without a Pro licence.
* Fix: OpenAI Vector Store no longer retrieves knowledge twice on the default environment, now passes Max Results to file_search, and repairs old vectors tables missing columns.
* Fix: Uploaded files stay in context on later turns with Claude and other stateless providers.
* Update: The transcription and image edit API endpoints now check the caller can read the supplied attachment.
* Update: Smart Search returns embedded pages and custom post types instead of only posts, and the debug info shows the min score and number of posts found.

= 3.7.7 (2026/09/08) =
* Add: Local Memory now stores the shortcuts and blocks of the last reply, so they persist after a reload.
* Fix: Pairing failures that consumed the token now ask the user to generate a new code.
* Fix: Connection test no longer always reports success.
* Fix: Gemini no longer offers Live-only models as chatbots.
* Fix: Function calling on Google's Standard API.
* Fix: AI Copilot no longer stretches paragraphs to the full editor width.
* Update: Workspace is now described as available on both iOS and Android in the readme and admin.

= 3.7.6 (2026/09/05) =
* Add: Support for GPT-6 Astra, including its max reasoning level.
* Fix: Temperature is no longer sent to models that reject it.
* Update: The reasoning dropdown now only shows levels supported by the selected model.

= 3.7.5 (2026/09/03) =
* Add: Claude Fable 5.1 to the Anthropic models.
* Fix: Anthropic now caps max_tokens to the model's limit instead of returning a 400 error.
* Fix: Provider errors with a flat body (such as Mistral) and any 4xx/5xx status now show the actual error message.
* Update: Removed the Assistants module following OpenAI's shutdown.
* Update: Transcription now uses gpt-transcribe, and Opus 4.1 has been removed.
* Update: Built-in tools that can't be used with Chat Completions are now reported in the logs instead of being dropped silently.

= 3.7.4 (2026/09/01) =
* Fix: Sending a message after a client-side JS function call no longer fails with an invalid_request_error.
* Fix: MCP OAuth login redirects are no longer cached by page caches and served to the wrong visitor.
* Fix: Plugin file tools no longer report a refusal as a missing directory.
* Update: The "Done!" placeholder for client-side function calls is now translatable and filterable.

= 3.7.3 (2026/08/26) =
* Fix: Chatbots using the default environment and model are no longer excluded from the function calling list.
* Fix: Vision now detects image types from the file contents instead of the extension, so images served through a CDN work.
* Fix: Magic Wand can read the selected text again in the iframed block editor of WordPress 7.1, re-enabling Suggest Synonyms.
* Update: Completed steps in the Setup Assistant now collapse to a single line.

= 3.7.2 (2026/08/20) =
* Fix: Editor Assistant endpoints accepted a nonce any visitor could generate, allowing anyone to run AI queries on the site's provider account (reported by Abdullah Kareem via WPScan).
* Fix: A crafted URL could escape the uploads folder and send any server-readable file to the AI provider (reported by Jashid Sany via WPScan).
* Fix: Editor Assistant now works for admin-equivalent accounts whose role isn't literally administrator.
* Fix: Embeddings sharing the same reference no longer stay stuck, and a single unprocessable vector no longer blocks the maintenance queue.
* Fix: A temperature of 0 is no longer treated as unset and stripped from the request.
* Fix: Image-only replies from GPT-5 models no longer show "medium" as the answer text.
* Update: Claude Sonnet 5 pricing ($2/$10 is now permanent), dashboard wording, and tested with WordPress 7.1.
* 🎵 Discuss with others about Ai Engine on [the Discord](https://discord.gg/bHDGh38).
* 🌴 Keep us motivated with [a little review here](https://wordpress.org/support/plugin/ai-engine/reviews/). Thank you!
* 🥰 If you want to help us, check our [Patreon](https://www.patreon.com/meowapps). Thank you!
* 🚀 [Click here](https://trello.com/b/8U9SdiMy/ai-engine-feature-requests) to vote for the features you want the most.

= 3.7.1 (2026/08/14) =
* Add: WPML support in the MCP server, mirroring the Polylang tools.
* Add: SEO section in the Modules tab, with robots.txt access for AI crawlers and live stats when SEO Engine is installed.
* Update: MCP self-test now detects AI-crawler blocking, nested .htaccess files and www mismatches, and logs every OAuth authorize refusal.
* Update: Internal errors are now hidden behind a filterable public message, and AI Forms no longer show provider errors to visitors.
* Update: Shared dashboard synced with the new Board and the AI site analysis.
* Fix: The mwai_mcp_mutate hook now fires on deletions, so cache purges hooked to it run.

= 3.7.0 (2026/08/03) =
* Fix: Qdrant collections were always created with 1536 dimensions regardless of the embedding model, and default dimensions are now read from the right place.
* Update: Embedding dimensions are no longer locked for OpenAI-compatible models, as that size is only a guess.
* Fix: The MCP access level no longer restricts OAuth connections, and the setting is no longer hidden behind the bearer token.
* Fix: MCP connections no longer drop at random when the client refreshes its access token.
* Update: Credited Revanth Hari Narayana Matte (via WPScan) for reporting the security issues fixed in 3.6.4 and 3.6.6.

= 3.6.9 (2026/08/01) =
* Fix: Crash when clicking quickly through discussions, and slow image checks writing into the wrong message.
* Fix: MCP token refresh being rejected on servers that pass Basic credentials to PHP instead of forwarding the header.
* Fix: Stored chat messages could run scripts when an admin opened a discussion.

= 3.6.8 (2026/08/01) =
* Fix: Workspace mobile app connection on servers that don't expose the Authorization header, with clearer pairing errors.
* Fix: A Context Max Length of zero no longer empties posts, which blocked embeddings sync and blanked chatbot context.
* Update: Transcription now defaults to gpt-4o-mini-transcribe instead of whisper-1.
* Update: The mobile connection warning links to the troubleshooting page instead of showing the htaccess snippet.
* Add: Logging on the MCP OAuth token endpoint for failing refreshes.

= 3.6.7 (2026/07/31) =
* Add: Workspace is officially launched on [iOS](https://apps.apple.com/app/workspace-for-wordpress/id6794717714). 
* Update: OpenAI pricing for GPT-5.6 Terra and Luna following the July 30 cut, and corrected o3 which was priced 7.5x too high.
* Update: Removed the leftover mcp.js relay and its documentation, and corrected the MCP header comment that still mentioned SSE and OAuth.
* Add: getDiscussion() to the PHP API, to read a stored discussion without using $mwai_core.

= 3.6.6 (2026/07/30) =
* Update: Minimum PHP version is now 8.1, declared in the plugin header so WordPress blocks activation on older versions.
* Fix: Push All no longer exhausts the memory limit on large sites; post content is now checked in chunks.
* Fix: Long Japanese and Chinese posts no longer produce empty content, which left their embeddings stale.
* Fix: Hardened the REST endpoints against client-supplied file paths and API keys, corrected the MCP OAuth route match and guest session cookie, and stopped the chatbot key reaching Editors.
* Fix: The mwai_mcp_callback filter now receives five arguments from both the Workspace and the MCP endpoint.
* Add: CSV and JSON export for the Query and MCP logs, honouring the active filters and sort.
* Fix: Chatbot input is no longer hidden behind the mobile keyboard in fullscreen, and shortcuts are now chips that don't inherit the site's button styles.

= 3.6.5 (2026/07/28) =
* Add: Elapsed time counter on the AI Forms submit button, matching the chatbot.
* Add: Note in the Sync panel that the Sync filters are shared by all environments.
* Fix: Three security issues reported by WPScan (key disclosure to editors, guessable guest sessions, audio transcription file read).
* Fix: Streaming requests now respect MWAI_SSL_VERIFY and verify TLS certificates (reported by Mohammed Abd Alrahman).
* Fix: Recurring tasks no longer stay parked after repeated failures, so discussions and logs cleanups run again.
* Fix: Administrator-equivalent accounts (custom roles with manage_options) are no longer refused at the MCP OAuth consent screen.
* Fix: A custom JavaScript filter that crashes no longer breaks the chatbot, and raw JavaScript errors are no longer shown to visitors.
* Fix: The embeddings environment Type field no longer shows "Select" for the Internal (WordPress DB) environment.
* Fix: The Web Search button now appears in the Workspace composer when pinned.
* Update: Push All now respects the Sync category and language filters, so it no longer seeds posts Sync would not maintain.
* Update: Workspace is now available to everyone; Knowledge, MCP Servers and Functions stay Pro.
* Update: Removed the unused module_addons and module_blocks option defaults.

The complete history of AI Engine. The readme keeps only the recent releases,
because WordPress.org truncates a changelog longer than 5,000 words.

= 3.6.3 (2026/07/27) =

* Add: Workspace: a full-screen chat surface in wp-admin, with a model picker across all your environments, conversation history, folders, a prompt library, per-user themes, and edit-and-branch on any message. Available in the Pro, coming later in the Free.
* Add: The Workspace can generate and edit images, search the web with each provider's own search tool (OpenAI, Anthropic, Google, OpenRouter), and work on the site itself through the MCP tools, with an approval dialog before any site-changing tool runs.
* Add: QR-code pairing for the Workspace mobile companion app, with a revocable Application Password.
* Add: Internal (WordPress DB) vector environment that stores embeddings locally, now the default for new installs.
* Add: Discussions now show the tool calls and their parameters alongside the embeddings usage, and can be searched server-side by content and title.
* Add: Claude Opus 5.
* Fix: Public chat and form endpoints no longer trust client-supplied models, environments, instructions or messages, and internal errors are hidden from visitors; the stateful-response restore is now owner-scoped, so another user's chat ID can no longer resume their conversation.
* Fix: Content-aware chatbots no longer inject a post the visitor cannot read, so a client-supplied context ID can no longer leak draft or private content.
* Fix: Chatbot error and notice messages are sanitized before being rendered as HTML, and configuration errors are shown to editors only instead of being printed publicly.
* Fix: Function calling is more reliable: Claude no longer re-calls tools with the previous message's parameters, multi-round calls on stateless providers keep their feedback blocks instead of clearing them each round, and the Gemini 2.x models work again.
* Fix: Google model names and capability detection, so image, thinking and web-search models are recognised and preview variants are no longer ambiguous.
* Fix: OVH replies arriving empty, caused by an oversized max_tokens and a hijacked catalog fetch.
* Fix: Embeddings re-sync destroying a vector when the new content comes back empty, and guest file listing crashing with a 500.
* Fix: The usage-limit lock never firing on streaming chatbots, and the Discussions table spinning forever when opened in a background tab.
* Update: MCP server hardening: a failing tool now returns a readable error instead of killing the server for the client, and the tools list is capped at 500 results.
* Update: Settings Reset now asks you to type the site host and says plainly that it deletes the API keys, environments, chatbots and themes; more native browser dialogs were replaced with NekoModal across Discussions, Query Logs, Knowledge, Templates and Limits.
= 3.6.2 (2026/07/16) =

* Fix: Fixed block editor paragraph spacing broken by the AI Copilot handler wrapper.
* Add: Note filtering support for the wp_get_comments MCP tool, allowing agents to read WordPress 6.9 editor Notes.
* Fix: Fixed the Anthropic engine dropping conversation history on function-call follow-up requests.
* Fix: Fixed duplicate embedding vectors for the same reference and environment, which left embeddings stuck at pending after a sync.
= 3.6.1 (2026/07/13) =

* Fix: MCP user tools not enforcing proper capabilities, allowing Multisite site administrators to edit users beyond their reach. Hotfix. (Thanks to Charles Vosburgh for reporting.)
* Fix: MCP read tools corrupting block-JSON Unicode escapes by double-unslashing database content.
* Update: Native browser dialogs (alert/confirm/prompt) are now forbidden in code; NekoModal is used instead.
= 3.6.0 (2026/07/10) =

* Add: GPT-5.6 family (Sol, Terra, and Luna) to OpenAI models, with Sol marked as the latest.
* Fix: Gemini image models not being selectable when their ID lacks a `-preview` suffix.
* Fix: MCP media upload tool crashing on download errors and rejecting extensionless image URLs.
= 3.5.9 (2026/07/06) =

* Fix: MCP post meta tools double-serializing array values, which stored nested arrays as strings.
* Fix: MCP wp_create_post and wp_update_post tools stripping shortcodes, email HTML, and inline CSS for admin-authorized callers.
* Fix: Chatbot theme styles loading outside AI Engine's admin screens, which caused Gutenberg editor iframe warnings.
* Fix: simpleJsonQuery failing on Anthropic and Google environments by no longer forcing an OpenAI fallback model, with a clearer error message.
* Fix: Discussions and Queries timestamps now display in the site's configured timezone instead of the browser's.
* Fix: MCP Functions settings crashing when tools were registered due to the list being returned as an object instead of an array.
* Fix: OpenAI Vector Store Pull All failing with a limit error by paginating the file list.
* Update: WordPress MCP tools are now enabled by default.
= 3.5.8 (2026/07/03) =

* Fix: Code blocks now display correctly in the Timeless and Foundation chatbot themes (was using proportional font instead of monospace).
* Fix: Sonnet 5 breaking with "each thinking block must contain thinking" when streaming with function calling.
* Fix: MacOS chatbot container showing empty notches in the corners due to double-rounded borders.
* Update: Reorganized the admin UI — Modules tab now leads with "Chatbots & Knowledge" and "MCP & Agents", and Settings tabs were reordered to match.
* Update: Moved the Event Logs option from Settings → AI to Settings → Chatbot for easier discovery.
* Update: Enlarged the chatbot preview pane in settings (480px → 620px) and polished the ChatGPT theme with monospace code blocks, accent border on focused input, and smoother transitions.
* Update: Refined the Messages chatbot theme with monospace code blocks, readable links in user bubbles, input focus ring, and capped bubble width.
* Add: Gutenberg MCP tools: wp_write_blocks, wp_list_block_patterns, and wp_insert_block_pattern.
* Add: Nonce checks added to license, rating, and news notice forms.
= 3.5.7 (2026/07/01) =

* Fix: Chroma "Pull All" now returns all pages of large collections instead of only the first page.
* Add: Claude Sonnet 5 model support.
* Fix: Anthropic function-calling loops no longer fail when no explicit max tokens is set.
* Fix: Gemini Interactions engine now properly includes RAG context, chat history, and PDF uploads, and passes connection tests.
* Add: In-chat image output and stream error handling for Gemini Interactions.
* Fix: Outbound API calls now verify TLS certificates by default.
* Update: Credited Shivamani Vastrala and Meher Sudhakar Abbireddi (via WPScan) for reporting the security issues fixed in 3.5.5.
= 3.5.6 (2026/06/26) =

* Add: Gemini Interactions API engine as the default for Google, with streaming, function calling, and in-chat image generation (classic API kept as a fallback).
* Add: Google Search and Maps grounding as Gemini chatbot tools, plus a setting to fall back to the standard Gemini API.
* Add: MCP server support to Realtime voice chatbots — tools were selectable but previously did nothing — and the model now speaks tool results aloud.
* Add: `mwai_mcp_mutate` action that fires after any content-mutating MCP tool, letting integrations purge caches, reindex, or audit.
* Add: `raw` option to the MCP `wp_get_option` tool to read directly from the database, bypassing object cache and filters.
* Add: `author__not_in` to MCP `wp_get_posts`, and a `content_format=prose` option to `wp_get_post`/`wp_get_post_snapshot` that strips block-attribute JSON to reduce token usage.
* Fix: `wp_create_post` MCP tool no longer corrupts shortcode and HTML content via the markdown parser.
* Fix: MCP log entries mislabeled as OAuth; admin and bearer calls now display correctly.
* Fix: Streaming parallel tool calls leaving a null in the `tool_calls` array, which broke function calling on strict providers.
* Fix: MCP `wp_get_posts`, `wp_get_media`, and `wp_get_comments` filters by author, `user_id`, and email were accepted but silently ignored.
* Fix: `wp_update_option` now decodes JSON-string array values into real arrays before saving, preventing corruption of array options like `sticky_posts`.
* Fix: Chatbot events panel is now scrollable and error messages are dismissable.
* Update: Removed the legacy MCP SSE transport, keeping only the Streamable HTTP endpoint.
* Update: Enabled function calling for Mistral.
* Update: Uploaded images now fill the message bubble width in the chatbot across all themes.
* Update: MCP post tools now accept `ID`, `post_id`, or `id` interchangeably, and `wp_update_post` accepts top-level fields with clearer error messages.
= 3.5.5 (2026/06/20) =

* Fix: Path traversal vulnerability in create_image and prevented chatbot discussions from being taken over by another logged-in user.
* Fix: Add-ons were reported as disabled whenever options were fetched outside the admin context.
* Fix: Max Tokens entered with a thousands separator (e.g. the Danish "64.000") was read as 64 and capped responses.
* Fix: Content Aware placeholders now resolve automatically in chatbot instructions without requiring a toggle.
* Fix: Setup Assistant no longer shows "Connect an AI Provider" as incomplete when only the Fast model is deprecated.
* Fix: Realtime instructions now resolve placeholders like {FIRST_NAME} into their values.
* Fix: MCP tools generated from WordPress REST endpoints could break Google Gemini due to enum on non-string types.
* Fix: Changing the type of an AI environment now drops fields from the previous type (endpoint, region, deployments), preventing engines from calling the wrong provider's endpoint.
* Fix: The "Default AI Environment not configured" warning no longer appears when a Chroma embeddings environment generates its own vectors.
* Fix: The Usage widget on the Dashboard no longer overflows its panel when numbers are wide.
* Fix: Anthropic's streaming ping keepalive events are now ignored instead of being logged as an unknown stream data type.
* Update: Reworked embeddings sync — pages are no longer marked stale without real changes, the background task (now called Maintenance) runs for all environments, processes batches within a time budget, no longer gets blocked by a failing vector, and can be disabled in Settings > Knowledge > Sync Settings.
* Update: API key and token fields are now masked with an eye toggle to reveal them.
* Update: Marked the original GPT-5 models (gpt-5, gpt-5-mini, gpt-5-nano, gpt-5-pro) as deprecated per OpenAI's December 10, 2026 shutdown.
* Update: The fullscreen resize button now uses thin corner-bracket icons that match the close button.
* Update: OpenAI Vector Store document uploads now accept multiple files at once.
* Add: User Memory added to the add-ons list.
* Add: Optional capability filter for get_chatbots() to fetch only chatbots whose model supports function calling.
* 🎵 Discuss with others about Ai Engine on [the Discord](https://discord.gg/bHDGh38).
* 🌴 Keep us motivated with [a little review here](https://wordpress.org/support/plugin/ai-engine/reviews/). Thank you!
* 🥰 If you want to help us, check our [Patreon](https://www.patreon.com/meowapps). Thank you!
* 🚀 [Click here](https://trello.com/b/8U9SdiMy/ai-engine-feature-requests) to vote for the features you want the most.
= 3.5.4 (2026/06/10) =

* Fix: Hold to Talk button on mobile Realtime chatbot no longer triggers the context menu (copy, select) when held.
* Update: Images and files can now be sent without a text message; engines skip the empty text part for providers that reject it.
* Fix: Sending is now blocked while a file is still uploading, with a spinner on the send button and a progress bar on the file preview until upload completes.
* Fix: Eliminated the gap between the chatbot and the keyboard on iOS by locking body scroll while the mobile chatbot is open.
* Fix: Anthropic safety refusals now show a readable message instead of an empty reply.
* Add: Claude Fable 5 model. Marked Claude Sonnet 4, Opus 4, and Opus 4.1 as deprecated.
* Add: Web search support for OpenRouter via the Tools & Capabilities section.
* Add: Full Screen view for Discussions, a Discussions count on the Dashboard, and fixed filenames with underscores being rendered as italics in the admin discussion view.
* Update: AI provider connectors now mentioned in the readme description.
* Update: PDF import now remembers the Density, Overlap, and filename-as-title settings between imports.
* Fix: OpenClaw link in the readme now points to our own article.
* Update: Marked GPT Image 1.5 and GPT Image 1 Mini as deprecated; default image model moved to GPT Image 2.
* Fix: PHP 8.2+ deprecation warning caused by an undeclared `$extraData` property on `Meow_MWAI_Reply`.
* Add: Embeddings sync can now be restricted to specific Polylang languages via a comma-separated languages field.
* Fix: `wp_alter_post` regex mode now handles patterns containing "/" (e.g. Gutenberg block markers) and returns the actual PCRE error instead of a generic one.
= 3.5.3 (2026/05/28) =

* Fix: Filenames with underscores (e.g. `Some_File_2026.pdf`) were getting partially italicized by the chatbot's markdown renderer.
* Fix: ReferenceError (`data is not defined`) in the chatbot response handler that masked the real error message when a host returned a non-JSON body.
* Fix: The Push All button showed "(null)" when a post type had zero matching posts.
* Fix: The `wp_update_option` MCP tool schema no longer logs a "problematic union type" warning on every `list_tools` call.
* Fix: The Meow Apps menu icon now shows correctly in both the expanded and collapsed sidebar states.
* Fix: Hotfix for the MCP endpoint URL being hidden until a bearer token was generated, even though OAuth doesn't need one. It now appears as soon as the MCP Server is enabled.
* Add: Claude Opus 4.8 to the Anthropic model list, with the `latest` tag moved to it.
* Add: AI Forms multi-upload fields now stack new file selections on top of previous ones, with a staged list and per-file remove buttons.
* Add: `mwai-bouncing-loader` and `mwai-bouncing-dot` CSS classes to the chatbot loading dots for custom styling.
* Add: MCP Logs view in Insights with per-tool-call capture, status, duration, and a top tools widget.
* Add: MCP Connection Test in MCP Server settings that detects host-level WAF blocks (e.g. WP Engine's default) before they surface in claude.ai.
* Update: Aligned Forms and Playground markdown rendering with the chatbot so single newlines now produce visible line breaks.
* Update: Extended CORS headers on MCP endpoints with Mcp-Protocol-Version, Mcp-Session-Id, Accept, and Last-Event-ID for browser-context MCP clients.
* Update: Claude Sonnet 4 and Opus 4 (2025/05/14) marked as deprecated ahead of Anthropic's 2026-06-15 retirement date.
* Update: The chatbot Functions empty state now tells Free users that function calling is Pro-only.
* Update: Polished the plugin readme description with cleaner punctuation and brand consistency.
= 3.5.2 (2026/05/22) =

* Add: Setup Assistant on the Dashboard that walks through essential configuration with a progress bar and per-step actions.
* Add: Direct file upload to OpenAI Vector Store via a new Documents tab, with async status polling, Sync from OpenAI action, and clearer PHP upload-limit errors.
* Add: `setField` and `prefill` methods to the AI Forms JS API for setting values programmatically without manual `dispatchEvent` workarounds.
* Update: Redesigned the Dashboard Usage panel into an analytics card with headline, week-over-week delta, daily bar chart, and provider/peak/average/per-query tiles.
* Update: Reorganized the Modules tab into clearer sections with short intros, concise descriptions, renamed Utilities to AI Copilot, and surfaced MCP and Public API as proper modules.
* Update: Renamed the user-facing "Units" metric to "Tokens" across the dashboard, queries explorer, insights, and `[mwai_stats]` shortcode, with full back-compat on REST output and legacy settings.
* Update: Aligned the Discussions, Insights, and Knowledge layouts by standardizing column ratios and removing custom margin and header overrides.
* Update: Added a Refresh button to the Usage panel header, widened the Tokens column in Queries Explorer, and showed "N/A" for queries with no scope.
* Update: MCP tool-registration warnings are now always written to the PHP error log instead of requiring the debug logging flag.
* Fix: Stripped inline citation markers from OpenAI's file_search Responses API text that were surfacing as gibberish in chatbot replies.
* Fix: Stopped embedding the sessionId in chatbot and forms HTML for logged-out visitors, so page caches no longer share one sessionId across all visitors.
* Fix: Guarded REST AI endpoints so they no longer overwrite the cookie-derived session with an empty client-sent sessionId.
* Fix: Gemini embedding queries no longer report bogus token counts by correctly reading promptTokenCount from the response.
* Fix: Dynamic MCP REST tool schemas no longer serialize the meta arg on media/posts/pages as an array, which Claude's MCP validator was rejecting.
* Fix: Translate Post now translates list items inside modern Gutenberg lists, which were silently skipped since WP 6.1+.
= 3.5.1 (2026/05/17) =

* Add: Popup Icon Size option in chatbot settings to resize the popup trigger without custom CSS.
* Fix: Chatbots admin preview now keeps long discussions, fullscreen toggles, and resize actions contained within the preview pane instead of clipping or overflowing the viewport.
* Fix: Chatbot rendering bug where a `$` inside an inline code span caused other message text to leak into the code display.
= 3.5.0 (2026/05/16) =

* Fix: MCP OAuth authorization and token validation now require administrator capability, preventing privilege escalation by non-admin users.
* Update: Marked gpt-5.2-chat-latest and gpt-5.3-chat-latest as deprecated (OpenAI shutting them off August 10, 2026).
* Update: Added a deprecation banner on the Finetunes screen due to OpenAI sunsetting self-serve fine-tuning.
* Fix: CSV import for fine-tuning now shows an explicit error when no usable prompt/completion columns are found.
* Fix: Updated the broken OpenAI tutorial link on the Finetunes screen.
= 3.4.9 (2026/05/12) =

* Add: OAuth 2.1 with Dynamic Client Registration for the MCP server, allowing Claude Desktop and other browser-driven clients to connect without a shared bearer token.
* Add: Per-quality image generation (auto/low/medium/high) for GPT Image models, available in the Image Generator UI and as a global default in Settings → Images.
* Fix: Pulling a remote OpenAI vector store no longer creates entries containing raw JSON error bodies for files uploaded with purpose=assistants.
* Fix: The `mwai_allow_setup` filter now properly grants menu and REST API access to non-admin roles, instead of being overridden by a hardcoded `manage_options` check.
* Fix: Tiktoken vocab cache is now scoped per WordPress install, preventing permission conflicts on multi-tenant hosts.
* Update: Migrated OpenAI Realtime integration from the deprecated Beta endpoint to the GA API, enabling support for gpt-realtime-2 and new voice models.
* Update: Reorganized MCP settings panel with a dedicated section for Bearer Token and Access Level, and a new Connected Apps section to review and revoke OAuth grants.
* Update: Generalized the `manage_options` gate in shared code so each Meow Apps plugin gets its own `{prefix}_allow_setup` filter instead of hardcoding `mwai_allow_setup`.
* Update: Removed gpt-4o-realtime-preview, gpt-4o-mini-realtime-preview, and gpt-realtime-translate from the model list.
* Update: SSE transport for MCP is scheduled for removal in July 2026 and is now hidden from the UI for new users.
= 3.4.8 (2026/05/09) =

* Fix: Resolved OpenAI Responses API "No tool output found" errors during chained recursive tool calls and static-only turns. Static-skip is now disabled for Responses API because every `function_call` must be answered.
* Add: Custom OpenAI-compatible provider for Ollama, LM Studio, vLLM, llama.cpp, LocalAI, and similar servers.
* Add: Built-in xAI/Grok provider with dynamic model fetching and fallback support.
* Add: Insights retention setting with daily cleanup for old log rows. Defaults to Never.
* Add: Embedding chunk metadata: source, partIndex, and partTotal, exposed through `mwai_embeddings_vector_metadata` for Pinecone, Qdrant, Chroma, and OpenAI Vector Store. PDF imports can now use the filename as the chunk title, and Modify Embedding can edit the new fields.
* Add: Code Engine static/dynamic Behavior now applies to Callable function snippets, skipping AI feedback when all calls are static.
* Update: Reworked onboarding with a default OpenAI environment, Knowledge provider chooser, one-click OpenAI vector store creation, no-key welcome message, and AI Assistant enabled by default.
* Update: Reworked Pro license management with a Modify License flow for Re-Validate, Modify, and Remove actions.
* Update: Hardened MCP handling by releasing PHP session locks, using proper trash hooks, deduplicating cache busts, enforcing `confirm_write` for non-read SQL, and purging LiteSpeed/WP Rocket caches after post writes.
* Update: Usage widget preferences for Price/Units/Queries and Daily/Monthly now persist across reloads.
* Update: Query and Reply tabs now point users to Settings > Others > Insights when data is unavailable.
* Fix: Managed-mode WP AI Client and AI Engine integrations now satisfy WordPress 7 AI plugin credential requirements, preventing false rejections for Ollama, OpenRouter, Mistral, Perplexity, and Replicate.
* Fix: Removed redundant vector-DB addon initialization to prevent idle "OpenAI Vector Store ID is not configured" logs.
* Fix: Resolved PHP 8.4 nullable-parameter deprecations in query and MCP helpers.
* Fix: ChatML base now supports string-shaped `error` fields in API responses.
* Update: Removed the legacy snippet-vault fallback and unused per-environment usage field.
= 3.4.7 (2026/04/25) =

* Add: GPT-5.5, GPT Image 2, and Claude Opus 4.7 to the model lists.
* Update: Refreshed default fallback models to GPT-5.4 and GPT-5-mini, and marked several upcoming OpenAI shutdowns as deprecated (gpt-5-chat-latest, gpt-4.1-nano, o3-mini, gpt-realtime-mini, gpt-image-1, sora-2, sora-2-pro).
* Update: Major UI/UX updates! I hope you'll enjoy them, otherwise... let me know! 😊
* Add: New Environments panel on the Dashboard with brand-colored rows, smart setup messages, and warnings for missing or deprecated default models.
* Fix: MCP write helpers (wp_alter_post, wp_update_post) were silently stripping backslashes from Unicode escapes.
* Add: Live timer on the Image Generator "Generating..." row so progress is visible.
* Fix: Auto-open is now skipped on mobile so a fullscreen chatbot no longer hijacks the screen on page load.
* Fix: AI Forms not rendering with their theme CSS when embedded via a synced Pattern.
* Add: Split print-to-PDF into its own toggle, moved behind a new "More options..." modal in Appearance settings.
* Update: Redesigned the Usage and Activity widgets with compact CSS-only stacked bars grouped by provider.
* Fix: Oversized embedding inputs are now caught before they hit OpenAI's 8192-token limit.
* Add: System-prompt hint for Anthropic's code_execution tool so Claude uses the sandbox instead of refusing.
* Update: Switched chatbot and form shortcode displays to the NekoShortcode component.
* Update: Functions section now appears as soon as the model supports it.
= 3.4.6 (2026/04/15) =

* Add: Print-to-PDF button next to the copy icon on the last AI message, allowing export of the full conversation via the browser's Save as PDF dialog.
* Add: Retention setting for discussions cleanup under Settings > Chatbot > Discussions, with a `mwai_discussions_retention_days` filter for overrides.
* Fix: Chatbot auto-scroll no longer fights users who scroll up during streaming.
* Fix: AI Form and Chatbot blocks no longer save as "Unsupported" placeholders when used in patterns created via Appearance > Editor.
* Fix: Hardened chatbot parameter processing so non-string values no longer crash the frontend with "trim is not a function".
* Fix: (Hotfix) Two mobile chatbot issues — keyboard pushing header and messages off-screen, and ChatGPT theme's submit button stretching into an oval below the input pill.
* Fix: Blocks with line breaks breaking after save in the Forms editor.
* Fix: REST MCP tools failing schema validation by forwarding nested JSON Schema fields (items, enum, default, etc.) from WordPress REST arg definitions.
* Fix: NekoUI dropdowns rendering broken inside Gutenberg block iframes.
* Fix: Temperature settings missing for Anthropic models in chatbot params.
* Fix: `ai.formReply` filter firing on every stream chunk instead of only once when the reply is complete.
* Update: Removed DALL-E and migrated existing defaults to gpt-image-1.
* Update: Bumped the discussions messages column from TEXT to MEDIUMTEXT.
* Update: Persisted the Query Mode and Expert Mode toggles in the Knowledge tab via localStorage.
* Update: Simplified `estimate_tokens` to a single-argument signature and added multi-file support to assistant queries.
* Update: Opus 4.6 and Sonnet 4.6 context window updated to 1M tokens.
* 🎵 Discuss with others about Ai Engine on [the Discord](https://discord.gg/bHDGh38).
* 🌴 Keep us motivated with [a little review here](https://wordpress.org/support/plugin/ai-engine/reviews/). Thank you!
* 🥰 If you want to help us, check our [Patreon](https://www.patreon.com/meowapps). Thank you!
* 🚀 [Click here](https://trello.com/b/8U9SdiMy/ai-engine-feature-requests) to vote for the features you want the most.
= 3.4.5 (2026/03/22) =

* Fix: Ensure additional CSS classes set in the block inspector.
* Fix: Stop mapping tool categories to annotation titles so MCP tools display their correct names.
* Add: Support for GPT-5.4 Pro, Mini, Nano, and GPT-5.3 Chat models.
* Fix: Resolve an MCP dispatch type mismatch that caused some MCP tools to fail.
* Update: Add new getStatus(), hasAI(), and hasMCP() API helpers (deprecated the older checkStatus() method).
= 3.4.4 (2026/03/15) =

* Fix: Hotfix resolves MCP server connection failures with clients using protocol version 2024-11-05 by adding automatic version negotiation.
* Add: Display shortcut prompts and names in the Discussions tab.
* Add: Introduce image embeddings support (Gemini Embedding 2) with multimodal embedding: bulk media push, and an AI-powered Library Search that replaces the native Media Library Search.
* Fix: Resolve a broken access control issue in the AI Forms shortcode to ensure only authorized users can access protected content (Private Page/Post).
* Fix: Prevent crashes when working with multi‑modal messages.
* Fix: Prevent the Embeddings screen from crashing when closing a modal.
* Update: Preserve links and inline HTML formatting in both the Editor Assistant and Magic Wand tools.
* Update: Refactor Magic Wand actions to use system messages.
* Update: Clean up old, deprecated options and legacy migration code.
* Update: Fixed Quick Test for Anthropic to use the models endpoint.
* Update: Chatbot Max Height moved to the Appearance section.
* Update: Rename Assistant Mode to Chatbot Mode in AI Forms, you can now use any chatbot to handle your AI Forms.
* Fix: Improve the discussions shortcode by falling back to customId to avoid invalid class names.
* Fix: Styles for the AI Chatbot Block are back.
= 3.4.1 (2026/03/06) =

* Update: Hide the Editor Assistant functions from the chatbot settings to simplify the interface.
* Add: Support for the new GPT-5.4 model for improved AI responses.
= 3.4.0 (2026/03/04) =

* Add: Introduce a fully featured Editor Assistant sidebar (with a client-side feedback loop for chained AI actions). It's called Assistant in the Admin Modules.
* Add: Introduce new dev filters (`mwai_mcp_server` and `mwai_function_call_params`) for customizing MCP servers and function call parameters.
* Add: Allow ignoring posts during embeddings sync, with a “hide” icon for linked posts, a “Show Ignored” modal, and a `mwai_embeddings_sync_post` filter for developers.
* Fix: Hotfix chat sessions so the chat ID resets correctly when needed.
* Fix: Restore the missing scope for AI Search.
* Update: Remove outdated internal TODOs, deprecated fields, legacy crons, and old migration code.
= 3.3.9 (2026/02/21) =

* Add: Cross Site now support shorcuts (Quick Actions), blocks (GDPR-friendly), etc.
* Update: Modernized all Gutenberg Blocks.
* Fix: Avoid crashes caused by Claude when using MCP tools together with function calling.
* Fix: Prevent React-related crashes during streaming.
= 3.3.8 (2026/02/18) =

* Add: Support for the Claude Sonnet 4.6 model.
* Add: Forward Anthropic keepalive events to the browser.
* Add: Make Realtime transcript captions clickable links.
= 3.3.7 (2026/02/14) =

* Add: Introduced role-based access control for MCP with three levels (admin, read-write, read-only).
* Add: Improved Content Aware features (better placeholder replacement, more accurate context detection, etc).
* Fix: Automatic bearer token generation when MCP is first enabled.
* Update: Improvements in the Realtime module, more to come soon.  
* Update: OpenAI now exclusively uses the Responses API, simplified and optimized the code.
= 3.3.6 (2026/02/06) =

* Add: Support for the new Claude Opus 4.6 and Opus 4.5 models for improved AI responses.
* Update: Deprecated GPT-4o, GPT-4o mini, GPT-4.1, GPT-4.1 mini, and their related realtime/transcribe models to guide users toward newer, supported options.
* Update: Replaced shortcut-based data storage with AES-256 encryption to avoid cache corruption issues.
* Add: Enhanced the wp_update_post MCP tool with better truncated JSON detection, content verification, and richer response data.
* Update: Linked PDF chunks via unique refChecksum and added ref filter to embeddings table.
* Add: Added WooCommerce MCP module with 25 tools for managing products, orders, inventory, customers, reviews, and analytics.
= 3.3.4 (2026/01/30) =

* Fix: Prevent duplicate shortcut transients from being created on every page.  
* Fix: Hotfix TypeError crashes in MCP tool calls when JSON-RPC requests are missing an id field.  
* Add: Introduce a new wp_upload_request MCP tool that generates one-time upload URLs so agents can upload local files via curl instead of base64.  
* Add: Add a new MCP "Database" module that lets you execute SQL queries.  
* Update: Remove the default popup title and AI name fallback so leaving the title field empty now shows no title at all.  
* Fix: Resolve a PHP 8.2 deprecation warning related to a dynamic property.
= 3.3.3 (2026/01/27) =

* Add: Introduce a Streamable HTTP transport for MCP so Claude Code can connect directly to WordPress. 
* Fix: Prevent unsafe file renaming during metadata updates.  
* Fix: Hotfix SSRF vulnerabilities by using wp_safe_remote_get for external URLs and secure URL fetching in audio transcription and file handling.  
* Add: Improved embedding dimension handling with matryoshka support, showing fixed vs configurable dimensions in the UI with clearer tooltips.  
* Update: Redesign and refine the ChatGPT Theme and Foundation Theme with improved layouts, bubble styling, and more flexible avatar/name display and header titles.  
* Add: Introduce 'context framing' for embeddings with a new filter.  
* Add: Moved Embeddings "Sync Settings" into Settings > Knowledge with separate Local Content and Remote URLs sections and a new Sync Interval option.  
* Add: Store Shortcuts prompts securely on the server and only send a shortcutId to the client so prompt text is no longer exposed.  
* Add: Load plugin translations properly with load_plugin_textdomain to ensure all text is translatable.  
* Fix: Via MCP, ensure scheduled posts created via wp_update_post respect the schedule_for parameter and edit_date flag so they publish at the correct time.  
* Add: New MCP integration for Polylang.
* Fix: Improve Gemini 3 support, restoring vision capabilities, function calling, and enforcing a single candidate response, and fixed image generation pricing.
* Add: Support image generation via OpenRouter.  
* Fix: Resolve undefined array key warnings in Remote URL sync and only update timestamps when content actually changes.
* 🎵 Discuss with others about Ai Engine on [the Discord](https://discord.gg/bHDGh38).
* 🌴 Keep us motivated with [a little review here](https://wordpress.org/support/plugin/ai-engine/reviews/). Thank you!
* 🥰 If you want to help us, check our [Patreon](https://www.patreon.com/meowapps). Thank you!
= 3.3.2 (2026/01/23) =

* Add: New "Remote URL" feature for Embeddings to create and auto-sync embeddings from external URLs with change detection.  
* Fix: Corrected auto-scroll behavior for non-streaming chatbots so conversations stay in view.  
* Add: Enabled multi-block support for Magic Wand tools (Correct Text, Enhance Text, and Translate Text).  
* Add: Introduce a user.query filter in the JS API so developers can intercept, modify, or cancel user messages before sending.  
* Add: Support next_run_delay for multi-step tasks to better control task scheduling.  
* Fix: Resolved an issue where multi-file uploads were empty.  
* Fix: Ensured the Standard Header correctly displays the Popup Title.  
* Fix: Adjusted link colors in the Timeless theme.  
* Fix: Prevent shortcuts from bypassing locked chatbots (GDPR consent, for example).  
* ⚠️ Important: Changed the mwai_chatbot_reply filter to pass a reply object instead of a query. Developer! Use reply->query where query was previously used.
= 3.3.1 (2026/01/04) =

* Update: Removed unused files and code to reduce clutter and improve performance.
* Info: Wishing you a Happy New Year 2026 ☀️🎉 No doubt this year will be full of surprises again, let's continue riding the AI wave together! 😊
