release: v0.8

.changeset/allow-header-405.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/server": patch
+---
+
+405 responses now include `Allow: POST, OPTIONS`.

.changeset/analytics-event-names.md

@@ -0,0 +1,6 @@
+---
+"@chatcops/core": minor
+"@chatcops/server": minor
+---
+
+Analytics events are named `noun.verb` now: `conversation.started`, `message.sent`, `message.received` and `lead.captured`, also exported as `ANALYTICS_EVENTS`. The old `noun:verb` names keep working until 1.0. `track()` and `getEvents()` read them as the new ones, stats count events a store saved under either, and `eventCounts` has both keys, so the numbers carry on across the upgrade. Stats gain `leadsCaptured`. `leadsCapture`, the same number, is deprecated. A custom `EventSink` now receives the new names. Webhook event names don't change.

.changeset/announce-streamed-replies.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/widget": patch
+---
+
+Announce completed assistant replies once for screen readers.

.changeset/anthropic-sdk-1.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/core": patch
+---
+
+The Claude provider now uses `@anthropic-ai/sdk` 1.x, which talks to Claude's API version 2026-10-21. That version removed `temperature`, so it's never sent to Claude: a configured `temperature` logs one warning and is left out. Claude 4.7 and later, including the default `claude-haiku-5-5`, already ignored it. On older Claude models a lowered `temperature` no longer has an effect; use `effort` instead.

.changeset/arabic-widget-locale.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/widget": patch
+---
+
+Add Arabic widget translations, loaded only for visitors using Arabic.

.changeset/brave-oranges-refuse.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/widget": patch
+---
+
+Show unread reply count in the launcher badge and accessible name.

.changeset/bright-questions-start.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/widget": minor
+---
+
+Add configurable suggested question buttons to new widget conversations.

.changeset/bright-rerankers-smile.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/core": minor
+---
+
+Add a Cloudflare Workers AI reranker for knowledge retrieval.

.changeset/bright-rerankers-sort.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/core": minor
+---
+
+Add `cohereReranker` for reranking retrieved chunks with Cohere's Rerank API.

.changeset/chatcops-test.md

@@ -0,0 +1,10 @@
+---
+"@chatcops/cli": minor
+"@chatcops/ingest": patch
+---
+
+`chatcops test` runs eval files against your bot: YAML conversations (`evals/**/*.chat.yaml`, or `.chat.ts`/`.chat.mjs` modules) with assertions on each reply. It uses the config's new `server` section and runs through the real request path with fresh in-memory storage, tool mocks, page context, locale, `repeat` and `passRate`. Options: `--filter` (name or `tag:x`), `--repeat`, `--concurrency`, `--reporter pretty|json` (repeatable) and `--json`. Exit 0 when all passed, 1 when some failed, 2 when it couldn't run. This first version has the `contains` assertion (and `not-contains`); more are coming.
+
+`ingest` and `search` now say what's missing from the config when they run, so a config with only `server` works for `chatcops test`.
+
+`globToRegExp` in `@chatcops/ingest`: `**/` now also matches no folder, so `docs/**/*.md` matches `docs/intro.md`.

.changeset/chinese-widget-locale.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/widget": patch
+---
+
+Add Simplified Chinese widget translations, loaded only for visitors using Chinese.

.changeset/citations.md

@@ -0,0 +1,6 @@
+---
+"@chatcops/core": minor
+"@chatcops/server": minor
+---
+
+Answers now cite the pages they came from. Chunks from knowledge sources with `retrieve` are passed to the turn as `sources`, and each page the reply cites becomes a `source` part (once per page), streamed after the text and saved with the reply. Claude gets the chunks as `search_result` blocks and cites them natively; other providers get a numbered `<sources>` block and cite with `[n]`, and numbers that match no source are removed from the text. New in core: `sources` on `runTurn` and provider step params, `citations: 'native'` on providers, a `source` provider event, and `CitationParser`/`parseCitations`/`sourcePart`.

.changeset/cjk-knowledge-sources.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/core": patch
+---
+
+Support Japanese and Chinese in TextKnowledgeSource and FAQKnowledgeSource using word segmentation.

.changeset/cli.md

@@ -0,0 +1,8 @@
+---
+"@chatcops/cli": minor
+"@chatcops/ingest": minor
+---
+
+New package: the `chatcops` command. `chatcops ingest` builds or updates a knowledge index from `chatcops.config.ts` or `--source` (sitemaps, page URLs, folders), with `--dry-run`, `--max-pages`, `--concurrency`, `--prune`, `--force`, `--index` and `--json` (one JSON object per line). `chatcops search` shows what retrieval finds for a question. Both refuse an embedder other than the one the index was built with. Exit codes: 0 done, 1 finished with failed pages or discovery errors, 2 could not run.
+
+`ingest()` takes `maxPages`; a capped run never prunes.

.changeset/cloudflare-example-origins.md

@@ -0,0 +1,4 @@
+---
+---
+
+The Cloudflare Worker example uses `allowedOrigins` instead of the deprecated `cors`.

.changeset/cloudflare-vectorize.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/store-cloudflare": minor
+---
+
+Add optional Cloudflare Vectorize and D1 vector storage with semantic and keyword search.

.changeset/dutch-widget-locale.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/widget": patch
+---
+
+Add Dutch widget translations, loaded only for visitors using Dutch.

.changeset/eleven-locales-disclosure.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/widget": patch
+---
+
+Add source labels and AI disclosure translations to 11 widget locales.

.changeset/embedder-http.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/core": patch
+---
+
+`openaiEmbedder` now keeps `batchSize` between 1 and 2048 (what OpenAI accepts), so a value of 0 no longer loops forever. The OpenAI, Voyage and Gemini embedders share one implementation of retries and batching, with no change in behavior.

.changeset/eval-cassettes-gzip.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/cli": patch
+---
+
+Eval recordings save response bodies over 4 kB gzipped in base64 (`encoding: 'gzip'`), so a streamed reply, which is one event per token, takes about a tenth of the space. Request bodies stay readable JSON, so a re-recording's diff still shows what changed.

.changeset/eval-cassettes.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/cli": minor
+---
+
+`chatcops test --record` saves every HTTP call the tests make (model, embeddings, tools that call APIs) to `__cassettes__/<eval file>.jsonl`, and `--replay` answers them from there without the network. Replay is the default when `CI` is set; `--live` calls the APIs anyway. Calls are matched by a hash of their method, URL and body, so a changed prompt, model or tool list fails with where the request changed and a note to re-record, instead of passing on an old answer. Headers and key-like query parameters are never saved.

.changeset/eval-judge.md

@@ -0,0 +1,7 @@
+---
+"@chatcops/cli": minor
+---
+
+`judge` assertions in `chatcops test`: a model grades the reply against a rubric from 0 to 1 and passes at `threshold` (default 0.7). The default judge is the cheap model of a provider other than the bot's; `--judge-model provider:model` or `judge` in the config picks another. Without a key for it the run refuses to start, and every run prints the judge it used. Judge calls are recorded and replayed with the rest.
+
+`prices` in the config (US dollars per million tokens, by model id) gives each turn and judge call a cost, and the run prints what it spent. `--max-cost <usd>` stops starting turns once a run has spent that much; it needs prices for the models in use. Reporters get a run summary (mode, judge, cost) in `onEnd`.

.changeset/eval-turn-errors.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/cli": patch
+---
+
+`chatcops test` no longer stops the whole run when something throws while a reply is read, such as a knowledge source that can't reach its index (or a replay that has no recording for an embedding call). That test fails with `internal_error` and the message, and the other tests still run.

.changeset/export-config-types.md

@@ -0,0 +1,6 @@
+---
+"@chatcops/widget": minor
+"@chatcops/server": minor
+---
+
+The types that make up a config are now exported, so a site can name them: `ThemeConfig`, `ThemeMode`, `PreChatField`, `PreChatFormConfig`, `Persistence`, `MessageStatus` and `MessageErrorType` from `@chatcops/widget`, and `TurnstileConfig` from `@chatcops/server`.

.changeset/focus-ring-controls.md

@@ -0,0 +1,5 @@
+---
+'@chatcops/widget': patch
+---
+
+Add --cc-focus-ring on :host for visible keyboard focus indicators across widget controls.

.changeset/french-widget-locale.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/widget": patch
+---
+
+Add French widget translations, loaded only for visitors using French.

.changeset/gemini-embedder.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/core": minor
+---
+
+Add `geminiEmbedder` for embeddings via Google's Gemini batchEmbedContents API.

.changeset/german-widget-locale.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/widget": patch
+---
+
+Add German widget translations, loaded only for visitors using German.

.changeset/hebrew-widget-locale.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/widget": patch
+---
+
+Add Hebrew widget translations, loaded only for visitors using Hebrew.

.changeset/hi-widget-locale.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/widget": patch
+---
+
+Add Hindi widget translations, loaded only for visitors using Hindi.

.changeset/identity-tokens.md

@@ -0,0 +1,6 @@
+---
+"@chatcops/server": minor
+"@chatcops/widget": minor
+---
+
+Signed-in visitors. With `identity: { secret }` on the server, your site signs a `userToken` (an HS256 JWT with `sub`, `exp` and an optional `tier`) and the widget sends it with `/session` (`userToken` or `data-user-token`). The user id goes into the session token and is stored on the conversation, so the same user can resume it with a fresh token and nobody else can. `identity.tiers` gives a tier its own budgets.

.changeset/ingest.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/ingest": minor
+---
+
+New package: `ingest()` builds a knowledge index from a site. It discovers pages from sitemaps (indexes and `.xml.gz` too), URL lists and folders of Markdown/MDX/HTML; fetches with conditional requests, a timeout and limited concurrency; extracts readable content as Markdown with Readability, after removing hidden elements, scripts and comments; chunks along headings without splitting code blocks or tables; embeds and writes to any `VectorStore`. A manifest in a `KeyValueStore` makes re-runs embed only what changed, `prune` never runs after a discovery error, and an index refuses an embedder other than the one that built it.

.changeset/italian-widget-locale.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/widget": patch
+---
+
+Add Italian widget translations, loaded only for visitors using Italian.

.changeset/japanese-widget-locale.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/widget": patch
+---
+
+Add Japanese widget translations, loaded only for visitors using Japanese.

.changeset/javascript-assertion.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/cli": minor
+---
+
+`javascript` assertion: point it at a module (relative to the eval file) and its default export is called with `(turn, conversation)`. Returns a boolean or `{ pass, reason?, score? }`, and may be async. A missing file, a module without a default function, or a throw inside it are failures with the file name in the reason. Modules are loaded once per run.

.changeset/keyword-any-word.md

@@ -0,0 +1,6 @@
+---
+"@chatcops/core": patch
+"@chatcops/store-postgres": patch
+---
+
+Keyword search in the pgvector store now matches pages with any of the question's words, ranked by how well they match, instead of only pages with all of them. The storage conformance suite checks this for every store.

.changeset/korean-widget-locale.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/widget": patch
+---
+
+Add Korean widget translations, loaded only for visitors using Korean.

.changeset/logger.md

@@ -0,0 +1,10 @@
+---
+"@chatcops/core": minor
+"@chatcops/server": minor
+---
+
+A `Logger` for everything ChatCops writes: `logger` in the server config gets startup notes, refused requests and every error the server handles instead of throwing, each with a stable `event` name (`provider_error`, `tool_error`, `webhook_failed`, `origin_refused`, …). The default `consoleLogger()` prints the same `[chatcops] …` lines as before; `jsonLogger()` writes one JSON object per line, and any object with `debug`/`info`/`warn`/`error` works. Tools get the logger as `context.logger`, and `runTurn`, providers (`ProviderConfig.logger`), `ConversationManager` and `BufferedEventSink` take one too.
+
+**Tool errors:** when a tool throws, the model now sees only `Tool failed: <name>`, and the full error is logged as `tool_error`. Before, the thrown message went to the model, which could repeat a database error or a connection string to the visitor. Return `{ success: false, message }` to tell the model something it can pass on. Timeouts and cancelled replies keep their messages.
+
+Console lines for errors that come with an error object no longer end in a colon (`[chatcops] Provider error` and the error), and `describeBudgets` and `describeSecurity` no longer start with `[chatcops] `, since the logger adds it.

.changeset/logical-widget-styles.md

@@ -0,0 +1,5 @@
+---
+'@chatcops/widget': patch
+---
+
+Use logical CSS properties for widget styles so layout and message bubbles adapt to right-to-left languages.

.changeset/mobile-fullscreen-scroll-lock.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/widget": patch
+---
+
+Lock document scrolling on mobile screens (640px and below) when the chat panel is open in full-screen mode, and restore original overflow on close or destroy. Update mobile breakpoint to 640px, add safe-area insets, and set mobile input font size to 16px to prevent auto-zooming on mobile devices.

.changeset/parts-assertions.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/cli": minor
+---
+
+`chatcops test` has `cites` and `lead-captured` assertions, for the pages a reply cites and the leads a turn captures.

.changeset/popup-focus-trap.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/widget": patch
+---
+
+Keep keyboard focus inside the open popup chat.

.changeset/portuguese-widget-locale.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/widget": patch
+---
+
+Add Portuguese widget translations, loaded only for visitors using Portuguese.

.changeset/quiet-rivers-smile.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/cli": minor
+---
+
+Add a grouped, more detailed pretty report for `chatcops test`, including the `--verbose` option.

.changeset/quiet-vectors-smile.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/store-upstash-vector": minor
+---
+
+Add an Upstash Vector-backed store for ChatCops embedded page chunks.

.changeset/respect-ingest-robots.md

@@ -0,0 +1,7 @@
+---
+'@chatcops/ingest': minor
+---
+
+Respect robots.txt by default during ingestion, with per-origin policy caching, allow/disallow matching and crawl-delay scheduling. Add respectRobots to opt out for network sources; local files are unaffected.
+
+Report unavailable robots policies as per-origin errors and skip pruning during outages, instead of treating them as successful runs blocked by explicit rules.

.changeset/retrieval.md

@@ -0,0 +1,8 @@
+---
+"@chatcops/core": minor
+"@chatcops/server": minor
+---
+
+Retrieval building blocks. `KnowledgeSource` has an optional `retrieve(query)` that returns chunks with their source page. When a source has it, the server calls it with the conversation so far, for follow-up questions, and gives the model every source's chunks as one numbered block, fenced as reference material that never contains instructions. Sources with only `getContext` work as before.
+
+New in core: the `Embedder`, `Retriever`, `RetrievedChunk` and `RetrievalQuery` types, `openaiEmbedder` (fetch only, `text-embedding-3-small` at 1024 dimensions by default, with retries on rate limits), `retrieverKnowledge` and `formatSources`.

.changeset/retrievers.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/core": minor
+---
+
+Ready-made retrievers: `vectorRetriever` searches a vector store by meaning, and `hybridRetriever` also searches by words and merges both by rank (reciprocal rank fusion, k = 60), which finds product names and codes that meaning alone misses. Both take `candidates` and an optional `reranker` (new `Reranker` interface), and refuse an embedder whose vectors don't match the store's size. A short or follow-up question is searched together with the visitor's previous one (`retrievalQueryText`). `reciprocalRankFusion` is exported too.

.changeset/rtl-widget-direction.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/widget": minor
+---
+
+Add locale-aware text direction and language attributes for RTL widget support.

.changeset/spanish-widget-locale.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/widget": patch
+---
+
+Add Spanish widget translations, loaded only for visitors using Spanish.

.changeset/sqlite-vector-search.md

@@ -0,0 +1,5 @@
+---
+'@chatcops/store-sqlite': minor
+---
+
+Add opt-in sqlite-vec vector storage with cosine similarity, metadata filtering, and FTS5 keyword search including CJK segmentation.

.changeset/tidy-vectors-search.md

@@ -0,0 +1,5 @@
+---
+'@chatcops/store-postgres': minor
+---
+
+Add optional pgvector-backed vector storage with cosine and keyword search.

.changeset/tool-call-assertions.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/cli": minor
+---
+
+`chatcops test` has `calls-tool` and `no-tool-call` assertions, for checking that a turn calls a tool with expected arguments or makes no unexpected tool calls.

.changeset/typed-widget-events.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/widget": patch
+---
+
+`ChatCops.on()` and `widget.on()` type each handler by its event, so `on('message', (message) => ...)` gets a `MessageData` and `on('error', (error) => ...)` an `Error`. A handler typed `(...args: unknown[]) => void` still works. `WidgetEvents` and `MessageData` are exported.

.changeset/ur-widget-locale.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/widget": patch
+---
+
+Add Urdu widget translations, loaded only for visitors using Urdu.

.changeset/usage-assertions.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/cli": minor
+---
+
+`chatcops test` has `tokens-under`, `latency-under` and `cost-under` assertions, to catch replies that get longer, slower or more expensive.

.changeset/vector-store.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/core": minor
+---
+
+New `VectorStore` interface (`vectors` on `ChatCopsStorage`) for embedded chunks of a site's pages, with `upsert`, `query` (cosine similarity), an optional `keywordQuery` and `deleteBySource`. `memoryVectors({ dimensions })` keeps them in memory and does BM25 keyword search with `Intl.Segmenter`, so Japanese and Chinese work. `runStorageConformance` checks `vectors` when a store has them. The server doesn't search vectors yet.

.changeset/voyage-embedder.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/core": minor
+---
+
+Add `voyageEmbedder`, which turns text into vectors with Voyage AI's embeddings API. It embeds documents and search queries the way Voyage recommends, batches requests, and retries rate limits and server errors.

.changeset/warm-rerankers-rank.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/core": minor
+---
+
+Add `voyageReranker` for reranking retrieved chunks with Voyage AI's Reranker API.

.changeset/welcome-bubble-button.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/widget": patch
+---
+
+Make the welcome bubble text keyboard-accessible.

.changeset/welcome-bubble-delay.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/widget": patch
+---
+
+A `data-welcome-bubble-delay` that isn't whole milliseconds, such as `3s`, now falls back to the default delay instead of being read as 3 ms.

.changeset/widget-ai-disclosure.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/widget": minor
+---
+
+The chat now starts with a note that the visitor is talking to an AI ("You're chatting with an AI assistant. It can make mistakes."), as the EU AI Act asks (Article 50). It's on by default, stays first in the log (also after a new conversation), and has `role="note"`. `disclosure: { text, learnMoreUrl }` (or `data-disclosure-text`, `data-disclosure-url`) changes the wording and adds a link; `disclosure: false` (`data-disclosure="false"`) removes it and logs a console notice that telling visitors is then up to you. New locale strings: `disclosure`, `disclosureLearnMore`.