Skip to content

release: v1.0.0 - #514

Merged
anurag629 merged 23 commits into
productionfrom
dev
Oct 31, 2026
Merged

anurag629 merged 23 commits into
productionfrom
dev

Conversation

@anurag629

Copy link
Copy Markdown
Member

1.0.0: everything on dev since 1.0.0-rc.0, with rc mode turned off (#513). The version PR this opens publishes core, server and widget 1.0.0 under npm's latest tag. After this, breaking changes wait for 2.0.

Nothing breaks between the rc and 1.0.0. The breaking changes from 0.x are the ones in the rc, and Upgrading to 1.0 covers them.

New since the rc:

Checked on these commits (details in #513):

  • live smoke on Claude, OpenAI and Gemini: 22 of 23, the same as at rc, with the prompt cache read verified at the provider level
  • the 0.6 → 1.0 upgrade check: 13 of 13

Merging this also deploys the website from production. The site keeps loading widget 0.7 from the CDN until a follow-up switches it to 1.0 once that's on npm.

anurag629 and others added 23 commits October 30, 2026 11:39
* feat(widget): support CSP nonces for styles

* docs(widget): update nonce API snapshot

---------

Co-authored-by: Anurag Verma <78868769+anurag629@users.noreply.github.com>
* feat(widget): wait for cookie consent before using storage (#405)

`waitForConsent` (and `data-wait-for-consent`) holds the chat behind a
notice until `ChatCops.setConsent(true)`. While it waits the widget reads
and writes no localStorage or sessionStorage and calls no API, and the
welcome bubble stays hidden. The notice has a button that calls
`onConsentRequest`, left out when there is none.

`setConsent(true)` shows the normal chat (the saved conversation comes
back); `setConsent(false)` closes the chat and removes the conversation,
the session token and the bubble's flag. Both work before init() and
before the chat has loaded, through the loader and the Widget class.

Panel.hideMessages/showMessages become one setBodyVisible(), and the new
private members join the mangle list, to keep the panel in budget. The
single-file limit goes from 19 KB to 19.5 KB.

* fix(widget): add setConsent to the npm and single-file ChatCops object, fix docs samples

Review of #468: window.ChatCops and the default export had no setConsent,
so those builds could not give consent. It now keeps the value until init()
and applies it before init(), like the loader. Also declares consentBanner in
the docs sample, notes that sendMessage() resolves without sending while
consent is missing, and drops the .size-limit.json change (rebased on dev's
new budgets).

---------

Co-authored-by: Saif Ullah jafri <saifullahjafri@Saifs-MacBook-Air.local>
Co-authored-by: Anurag Verma <78868769+anurag629@users.noreply.github.com>
…476)

The widget calls it once each time it asks the server for a session, not per
message. A function that throws, rejects, returns a non-string or takes over
5 seconds means the session starts without the visitor, with a console
warning. A string still works as before, and setUser() replaces the function.

Co-authored-by: Saif Ullah jafri <saifullahjafri@Saifs-MacBook-Air.local>
Co-authored-by: Anurag Verma <78868769+anurag629@users.noreply.github.com>
Signed-off-by: Anurag Yadav <anuragyadav2787@gmail.com>
Signed-off-by: Anurag Yadav <anuragyadav2787@gmail.com>
Co-authored-by: Anurag Verma <78868769+anurag629@users.noreply.github.com>
Co-authored-by: Anurag Verma <78868769+anurag629@users.noreply.github.com>
…en (#491)

The token in setUser(), ChatCops.setUser() and the script tag loader is now a
UserToken: a string, or a function (sync or async) that returns a fresh token
each time a session is requested. Passing the same function again keeps the
chat; a different function, a string or no token counts as another visitor.

Co-authored-by: Saif Ullah jafri <saifullahjafri@Saifs-MacBook-Air.local>
Co-authored-by: Anurag Verma <78868769+anurag629@users.noreply.github.com>
…499)

Found by upgrading the 0.6 examples with only the upgrade guide's steps. The Express example and homepage tab mounted with app.all('/chat'), which never routes /chat/session, and 33 server configs in the docs, READMEs and homepage set neither sessionSecrets nor allowAnonymous, so 1.0 refuses to start them. The curl commands now get a session token first. docs:check fails on a handler or full ChatCopsServerConfig without either option.
Co-authored-by: Anurag Verma <78868769+anurag629@users.noreply.github.com>
…evals (#501)

The index was behind 11 pages (the #499 server snippets and the Oct 30 widget docs). Rebuilt it (29 pages, 300 chunks) and re-recorded both eval files: replay 9 of 9, citations 48 of 50 (96%).
* feat(widget): a Stop button while a reply streams (#494)

While a reply streams the send button becomes a Stop button, named by the new
stopButton string. Clicking it aborts the request and keeps what has streamed
as a finished reply, with Regenerate and no error.

* test(widget): check the stopped reply exists instead of asserting it

---------

Co-authored-by: Saif Ullah jafri <saifullahjafri@Saifs-MacBook-Air.local>
Co-authored-by: Anurag Verma <78868769+anurag629@users.noreply.github.com>
… connection is back (#495) (#502)

A message sent while navigator.onLine is false is shown with a waiting note
(the messageWaiting string, announced through the reply live region) and not
sent. The widget sends the waiting messages in order, one at a time, on the
window's online event, and removes the listener in destroy(). They are never
saved.

Co-authored-by: Saif Ullah jafri <saifullahjafri@Saifs-MacBook-Air.local>
…enu (#508)

Panel 18 to 19 kB, single file 20 to 22 kB, ESM guard 30 to 32 kB. The loader stays at 5 kB. The next room is the launcher the panel draws again.
Co-authored-by: Anurag Verma <78868769+anurag629@users.noreply.github.com>
docs:check now type-checks README code too. Fixed what it found: persistHistory in the root README, chat()/chatSync() in core (now runTurn), and the server README's RateLimiter, 0.5 stream format and made-up Redis store sections, rewritten from the current API.
…505)

* Added widget menu

Signed-off-by: Anurag Yadav <anuragyadav2787@gmail.com>

* test(widget): configure privacyUrl in dev.html

Signed-off-by: Anurag Yadav <anuragyadav2787@gmail.com>

* fix(widget): address review feedback on header menu

Signed-off-by: Anurag Yadav <anuragyadav2787@gmail.com>

---------

Signed-off-by: Anurag Yadav <anuragyadav2787@gmail.com>
Co-authored-by: Anurag Verma <78868769+anurag629@users.noreply.github.com>
pre.json to exit, so the next version PR gives core, server and widget 1.0.0. Live smoke 22/23 as at rc (cache verified at provider level), upgrade check 13/13.
@anurag629
anurag629 merged commit c6d513e into production Oct 31, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants