Changelogs

First stable release on the 4.x line.

Highlights

• Stylesheet bug fix. The Gutenberg block no longer auto-loads form-theme.css regardless of settings. The block now respects the global "Default form theme" toggle and the per-form override, matching the shortcode behavior. (Cause: style field in block.json was force-enqueueing the theme stylesheet on any page that used the block.)
• Block inspector overhaul. New panels in the block sidebar:
• Form — pick a form, jump to its admin editor.
• Header — toggle to show the form title as a heading, choose H1–H6.
• Layout — alignment toolbar (left/center/right), max-width (px/em/rem/%/ch), HTML anchor id, custom CSS class.
• Stylesheets — per-block overrides ("use form/global setting", "force load", "force disable") for both form-theme.css and forms.css.
• Stable version. Bumped from 4.0.0-b9 → 4.0.0 across the plugin header, block.json, package.json, and readme.txt.

Upgrade notes

• No schema or data migrations.
• If you previously relied on the block always loading form-theme.css, make sure your global "Default form theme" setting is enabled, or use the new per-block "Force load" override.
• The max-width block attribute is validated against a strict CSS-length regex (px, em, rem, %, ch, vw, vh); other values are ignored.

Files changed

block.json, render.php, assets/js/src/blocks/form/edit.js, assets/js/build/block-form.js, core-forms.php, package.json, readme.txt.

What's Changed

• Added: Character range (unicode-range) support per font in the Fonts module — limit which characters trigger a font download for faster page loads
• Added: Quick-pick presets in the admin UI for common subsets (Latin, Latin Extended, Greek, Cyrillic, Vietnamese, Punctuation/Symbols)
• Added: unicode-range is also emitted into the theme.json fontFace data layer so it propagates to the block editor
• Security: Login Security no longer trusts X-Forwarded-For / Client-IP headers by default — these were spoofable on direct connections, allowing IP-based lockouts to be evaded or weaponized. Sites behind a trusted reverse proxy or CDN can opt in via the new "Trust Proxy Headers" setting.
• Security: Login Security now validates client IPs through FILTER_VALIDATE_IP when proxy headers are in use, dropping malformed values rather than hashing them into transient keys.
• Fixed: Block Cleanup XPath query now safely escapes class names via a proper XPath 1.0 string-literal builder (addcslashes was the wrong escape function and silently failed on classes containing quotes).
• Fixed: Snippets kses_with_styles() placeholder collision — <style> extraction now uses a per-call random token so a snippet body containing the literal placeholder string can no longer corrupt the output.
• Fixed: Fonts module admin badge now reflects the Style field (free-text input) instead of looking for a <select> that doesn't exist.
• Fixed: Fonts module options static cache is invalidated automatically on update_option_functionalities_fonts, preventing stale font lists when the option is updated mid-request.
• Fixed: Task Manager AJAX handlers (Export, Delete, etc.) now register whenever in admin, so existing projects remain manageable even when the module is toggled off.
• Fixed: Task Manager card layout — widget badge now sits above the action row, so Open/Export/Delete align consistently across cards.
• Fixed: Help & Support buttons now have higher CSS specificity to defeat WP 7.0's button reset.

Commits

• v1.4.6: unicode-range fonts, security & correctness fixes (00223a7)

Changed

• System prompt no longer restricts the assistant to "context only" knowledge. The LLM can now draw on general knowledge to explain, clarify, or summarize when retrieval is thin.
• Every chat request injects the current page (URL, title, up to 4,000 chars of post content via url_to_postid()) into the system prompt so "explain this", "summarize this article", and similar queries work without vector-store hits.

Added

• Threads now capture the originating page URL (origin_url) when a conversation begins. Frontend widget sends window.location.href with the first chat request; admin Conversations tab displays it as a clickable link in the detail panel; CSV export includes it as a new column.
• New origin_url VARCHAR(500) column on wp_alpha_chat_threads. Schema version bumped to 1.4.0 — dbDelta adds the column automatically on existing installs.

Changed

• Removed the hard "no retrieval → fallback" gate in ChatService. The LLM is now always called and instructed to handle conversational messages (greetings, thanks, goodbyes, small talk) naturally, reserving the configured fallback message verbatim only for genuine unanswerable factual questions.

Fixed

• "Thanks", "hi", "bye", and similar conversational messages no longer return the "Sorry, I couldn't find an answer" fallback.

Changed

• Frontend widget bundles React directly instead of relying on WordPress core's wp-element / wp-dom-ready script handles. The widget no longer enqueues react, react-dom, react-jsx-runtime, wp-element, wp-i18n, wp-hooks, wp-dom-ready, or wp-escape-html on the frontend.

Performance

• Frontend widget loads as a single ~48 KiB gzipped script instead of seven separate WordPress core script requests.

Added

• Q&A admin tab for curated question/answer pairs. New wp_alpha_chat_faqs table, REST CRUD at /faqs, and context-injection into every chat request.
• Source links now carry UTM parameters (utm_source=alpha_chat, utm_medium=chat_widget, utm_campaign=ai_answer, utm_referrer={host}).

Changed

• Brand identity is prepended to the system prompt on every request. "Who are you?" and similar prompts now resolve without needing RAG context.
• Retrieval gate widened: LLM is called when either chunks OR FAQs are available; fallback only when both are empty.
• System prompt now explicitly tells the LLM not to emit bracketed citation markers — frontend strips any that slip through.

Fixed

• Identity-style questions returning fallback even with an indexed site.

Added

• Indexer::index_post now stores a SHA-256 content hash + embedding model per post and skips re-embedding when nothing has changed. Makes "Reindex all" idempotent and cheap.
• New GET /knowledge-base/queue endpoint returning pending / in_progress / complete / failed counts for the alpha-chat Action Scheduler group.
• New POST /knowledge-base/queue endpoint runs one Action Scheduler batch synchronously (useful when DISABLE_WP_CRON is set).
• Dashboard shows live indexing queue counts with auto-refresh every 5s while work is in flight, plus a one-click "Process now" button.
• Knowledge Base toolbar gains a "Process queue now" button.

Fixed

• Chat panel close button was invisible on mobile — SVG had no explicit size inside the shadow DOM's all: initial root. Added a global svg rule + sized close icon; close is now a circular button in the header top-right.
• Re-queued bulk jobs no longer re-embed already-indexed content (hash guard).

Changed

• Removed :host reset for all SVGs globally, ensuring any icon placed in the widget renders at its CSS size.

• Initial public release.
• OpenAI (GPT-5.4 / GPT-5.4 mini / GPT-4.1) and Anthropic (Claude Opus 4.7 / Sonnet 4.6 / Haiku 4.5) chat providers.
• MySQL-backed vector store with cosine similarity.
• Shadow-DOM-isolated React widget.
• Gutenberg block and [alpha_chat] shortcode; floating launcher is opt-in.
• Customizable launcher position, nudge text, brand name, and color scheme.
• Source cards (title + thumbnail) attached to each reply.
• In-chat contact form (Name + Email + Message) with admin email notifications and Contacts admin tab.
• Knowledge Base batch actions: select rows, bulk index / remove, "Index remaining", filter by indexed state.
• All public post types indexable (filter via alpha_chat_indexable_post_types).
• Token-frugal: empty retrievals skip the LLM entirely.
• Rate limiting on chat (30/min per session) and contact (5/hour per IP).

Bundles v2.1.0 through v2.4.0 — major feature release.

Emmet HTML Expansion (NEW)

Type an abbreviation in the HTML editor, press Tab, get expanded HTML: - div.hero>h1{Title}+p{Body} → nested section with heading and paragraph - ul.menu>li.item\$*4>a[href="#"]{Link} → 4-item menu with auto-numbered classes - img.avatar[alt=""] → self-closing void tag

Supported: tags, .class, #id, [attr="val"], {text}, > child, + sibling, *N multiply, \$ numbering. Cursor auto-jumps to the first empty slot.

Removed: Unreliable HTML class autocomplete (replaced by Emmet).

Frontend CSS Layers (NEW)

Three independent toggles under Page Blocks → Settings → Frontend CSS:

• Semantic Reset (~1KB) — modern reset, accessible images, prefers-reduced-motion
• Typography (~3KB) — system-font stack (zero external requests), responsive headings via clamp(), 65ch measure, styled lists / blockquotes / code / kbd / tables
• Utility Classes — ~330 Tailwind-inspired classes (grid, flex, spacing, typography, colors, borders, shadows, transitions) + sm: md: lg: responsive variants. Frontend inlines ONLY the classes actually used on the page — no bloat. Builder loads the full set for autocomplete.

Top-Level Page Blocks Admin (NEW)

Moved out of Settings to its own top-level menu: - All Page Blocks — list table with bulk actions, search, status filter - Add New — full edit form with Monaco editors, live preview, position picker - Settings — existing settings page - License — license management

Shortcode Library (NEW)

Reusable blocks stored in a custom database table (wp_gt_page_blocks): - [page_block id="123"] — embed by ID - [page_block slug="hero-section"] — embed by slug - Theme-independent position hooks via gt_pb_get_positions() filter (wp_head, wp_footer, the_content, loop_start, etc.)

Bug Fixes

• Fixed cssClasses config being serialized as JSON object (array_unique key gaps) — Array.isArray() now passes on the JS side.

Compatibility

• WordPress 6.0+
• PHP 8.1+
• Works with any WordPress theme
• PHPStan level 5: 0 errors

Critical fix for v2.0.0/v2.0.1.

The builder was stuck on "Loading Page Blocks Builder..." with no errors. Root cause: the v2.0.0 release ported the dropin's JS which expects the app element ID md-pb-builder-app, but the template HTML still used the old ID md-page-block-builder-app. The JS bailed out silently at the missing-element check.

Fix

• templates/builder-shell.php: Updated app element ID to md-pb-builder-app
• Updated wrapper class to md-pb-builder-root and loading class to md-pb-builder-loading to match the new CSS naming

Upgrading from v2.0.x

Just update — clear browser cache to reload the new template.

Internal hardening release. No functional changes.

Fixes

• Fix block_categories_all filter signature mismatch (callback registered with accepted_args=2 but only declares 1 parameter)
• Fix esc_attr() type errors when emitting external asset tags — cast int post_id and int|false filemtime result to string before passing
• Properly escape stylesheet id attribute in external file output
• Remove redundant is_array() / is_string() checks against already-narrowed types

Verification

• PHPStan level 5 passes with 0 errors on the entire plugin
• All previously broken features verified working