abhinavxd/libredesk v2.6.0 on GitHub

What's new

AI features (beta) land in this release. Bring your own model: any OpenAI-compatible endpoint works, including a local one.

AI assistants - route conversations to an AI assistant with an automation rule, it answers from your knowledge base and hands off to a human when it can't help.
Juno, the AI copilot - a conversation sidebar tab that answers questions about the conversation and your knowledge base.
Generate reply - draft a reply from the editor toolbar, then edit it before sending.
Knowledge base snippets - write snippets by hand or import them from a URL for the assistant to search.
Learn from resolved conversations - Libredesk drafts snippets from resolved conversations for you to approve or reject. Each approved one joins the knowledge base, so the assistant keeps improving over time.
Custom AI tools - point an assistant at your own APIs so it can look up an order's status or update a customer's address mid-conversation.
Tag suggestions - suggest tags for a conversation from your existing tag list.
Summarize with AI - add a summary of a conversation as a private note.
Refreshed theme - new palette and a consistent design system across the app.

What's fixed

Broken image thumbnails in live chat widget for S3 store.
Fixes to pre-chat form in live chat widget.
New opt-in [ssrf] guard blocks admin-configured outbound URLs (webhooks, OIDC discovery, AI provider and tool calls) from reaching private, loopback and cloud-metadata addresses. Read more.
Many other quality of life fixes and improvements.

Upgrade notes

webhook.allowed_hosts is deprecated and ignored, move it to ssrf.allowed_cidrs and set ssrf.enabled = true to keep webhooks blocked from private addresses.
Always take a database backup before upgrading.
Follow the steps here.

Changelog

6496cde Merge pull request #456 from abhinavxd/fix/http-write-timeout
def21f8 increase default http write timeout to 60s
189c086 Merge pull request #455 from abhinavxd/chore/tidy-migration-comments
232d445 Merge pull request #454 from amaanJvd/fix/unsnoozer-dropped-error-log
081cc46 remove redundant comments in v2.6.0 migration
3d5d67b fix(log): don't drop the error in unsnoozeAll log call
ee3a547 Merge pull request #453 from abhinavxd/fix/ai-misc
c25452a remove redundant snippet URL import hint
f2edc74 hardcode copilot name and tidy up AI admin copy
859777d Merge pull request #447 from abhinavxd/feat/ai-tag-embeddings
5e7b1af Merge pull request #451 from abhinavxd/fix/inline-cid-case-and-tx-linking
06242de Merge remote-tracking branch 'origin/main' into fix/inline-cid-case-and-tx-linking
52a455f link message media in one query inside the insert transaction
3544a80 Merge pull request #450 from abhinavxd/fix/s3-thumbnail-preview
cda5369 use shared attachment URL signing in message handlers
75a0925 Fix WS image URLs
205ad8a Serve thumbnails inline
b553e96 Keep widget images inline
37224b1 Clarify thumbnail store handling
79da9e8 Fix live chat image thumbnails
11d0b52 bound the tag query by tokens and always clear the tag index on purge
000d789 shortlist tags with embeddings before asking the LLM to suggest them
9c1c413 Merge pull request #446 from abhinavxd/fix-ai-reply-markdown
16b9906 render the generated reply as html instead of showing raw markdown
fb4d665 Merge pull request #421 from abhinavxd/feat/ai-agent
5e972d1 point each AI admin page's docs link at its section anchor
bbcc92f add an aria-label to the channel icon in the conversation list
276f19d show enabled state as a status badge and stop making checkbox fields required
f271462 dedup mined FAQs against question and answer so near-duplicate suggestions get caught
82f29f2 fix Vue onUnmounted warning on the auth pages
0b2ad13 Merge pull request #443 from abhinavxd/dependabot/npm_and_yarn/frontend/postcss-8.5.18
349e695 build(deps-dev): bump postcss from 8.5.10 to 8.5.18 in /frontend
4ec387a Merge pull request #442 from abhinavxd/i18n-guard
1c500ed Revert "temp: test i18n guard, do not merge"
bcfbd45 temp: test i18n guard, do not merge
6d7ce3c require a verified contact in the example tools server and fix its README mismatches
71fb197 bump the default completion model off gpt-4o-mini
8db2e34 show specific AI provider errors instead of a generic message
c25ad46 run i18n guard from the base branch and fail on API errors
e8e2419 show a clear error when the AI agent runs out of steps and hoist openai response structs
763bcd6 add CI check to block edits to translated i18n files
fd21893 cache AI assistants in a store instead of refetching on every copilot panel mount
b569777 match email quote classes exactly and enforce password length on set password
49c5cb3 make AI agent max steps and history size configurable
6b8a0f9 fix content loss in knowledge base chunking and harden AI agent limits
9f8f10a drop the unenforced-rules section from the design doc
23938a1 rename the design doc to DESIGN.md and resync it with the code
d8b73c5 retheme UI to the green palette and fix form and search bugs
712fcbb return clear 400 errors for invalid AI tool and snippet input
7c2e19b style sidebar section headers as labels and add design system doc
b8b2b6c standardize frontend design system, fix form validation, and skip continuity/CSAT messages in AI context
1a0a78f Merge pull request #438 from chahat-101/seed-default-business-hours-sla
74813b2 reveal admin table row actions on hover and switch to vertical menu, add AI tool enable toggle
d925640 drop migration, seed only in schema.sql
40f8284 strip quoted reply chains from AI agent message context
d2a548e seed default business hours and SLA policy on install
6125f5c harden AI agent knowledge base, OTP, and prompt injection defenses
cf629f3 only include checked checkbox fields in prechat form submission
83f9bb5 show a BETA badge on the AI admin nav item
aa200f5 make the missing AI API key message provider-agnostic
ae44e7f expand AI tool context and let contacts correct their email
8f8512f apply workspace instructions even with an empty base prompt
c74eef0 harden the AI agent run loop and admin lifecycle
f417aac drain AI workers on shutdown before closing the database
ea03339 address CodeRabbit review findings in the AI agent
35ddfe5 make the image pixel-count guard overflow-safe
8bedb1a set OTP send-counter TTL atomically to prevent resend lockout
c659e30 address CodeRabbit review findings in the AI agent
2fced94 log when the verification email no-reply guard can't be set
1812a03 Merge pull request #437 from abhinavxd/dependabot/npm_and_yarn/frontend/axios-1.18.0
b422833 build(deps): bump axios from 1.16.0 to 1.18.0 in /frontend
1034617 point livechat verification email replies at a no-reply address
7760974 send AI verification code through the conversation's inbox
085880d make OTP attempt check atomic to prevent brute-force bypass
bfc3b6e gate AI custom tools behind email OTP verification
752e604 drop CC'd contacts' messages from the AI agent history
6015859 scope copilot thinking state per conversation
1384fd5 scope Generate Reply tools to the conversation's contact
f460f6b expand copilot with customer-history tools, persona picker, and tag suggestions
dd3465f make the quoted text toggle keyboard accessible
b570502 remember when a provider needs max_completion_tokens and track token usage
ec5333a move OIDC client secret masking to the backend
52cebdf update livechat launcher logo
b1d6fb4 limit when the AI agent appends the confirm prompt
35d69fc fix review findings in reports overview and avatar upload
94334a0 polish reports overview, avatar upload, and conversation list UI
8ac465c support multiple auth headers on AI tools and tune agent timeouts
e7fa4ce fix review findings in the aiagent package
a4be8ec fix review findings in the ai package
fe17af2 drop hardcoded transport fallback in ssrf.NewTransport
8f34fc5 guard against a replaced http.DefaultTransport in ssrf.NewTransport
c7f55e2 guard reply-box AI prompt race and share the SSRF-safe http transport
a3cdd71 remove inline OpenAI key prompt and reuse generating state for AI prompts
e5ce8e3 truncate long assistant descriptions in admin table
0f2aef1 fix Groq and Together AI provider preset defaults
cd7e6d9 Update README.md
99771a6 Update README.md
97c227b skip AI agent on non-open status categories instead of hardcoded names
758a01a guard knowledge base URL import against SSRF and fix OIDC transport defaults
eed50ef link SSRF docs page from SECURITY.md
9566dcb apply SSRF guard to all admin-configured outbound URLs
de8ffa5 Update README.md
0f81806 Update README.md
d02b65f address CodeRabbit findings in AI embedding and assistant flows
c030c9e harden AI embedding and agent prompt handling, add tokenizer, and switch to a green theme
8cdfe86 add AI snippet URL import, conversation summarize, and assistant reply languages
616fd00 Update ROADMAP.md
afb338c address PR review findings in the AI agent
976c45d add AI provider connection test and self-heal reasoning model param errors
e1695b7 send AI agent confirmation question as a separate widget message
85a3869 restrict copilot to built-in tools and add per-assistant handoff toggle
dad99bf render AI agent replies as markdown and fix assistant identity, handoff, and stats bugs
3137a3f add conversation attributes to AI agent prompt and mark customer data as untrusted
34241f7 improve AI agent context and disclosure
a7288e1 add AI assistant expectation message shown in the livechat widget
44925e6 fix AI agent reply, turn-cap, and stats bugs
76d1628 gate AI tool identity to verified contacts and merge v2.6.0 migration into v2.7.0
3ba2b82 Merge remote-tracking branch 'origin/main' into feat/ai-agent
51d29e0 add local widget JWT test page
623fa2c load agents directly in AgentList
c8884ec add AI reply-box UI and AI author links
ac40379 improve copilot reply drafts and add presets
ef0add0 add reasoning effort setting for providers
1343790 restrict custom tool methods to GET and POST
0d755fc send CSAT on every resolve path
16c79a2 guard AI agent replies and add prior-conversation context
7186c95 add WIP autonomous AI agent that replies to assigned conversations
2fe850a Merge pull request #419 from abhinavxd/dependabot/go_modules/golang.org/x/crypto-0.52.0
5815342 build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0
0ecd783 add AI copilot backed by a knowledge base and custom tools

What's Changed (Auto generated)

build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 by @dependabot[bot] in #419
build(deps): bump axios from 1.16.0 to 1.18.0 in /frontend by @dependabot[bot] in #437
seed default business hours and SLA policy on install by @chahat-101 in #438
add CI check to block edits to translated i18n files by @abhinavxd in #442
build(deps-dev): bump postcss from 8.5.10 to 8.5.18 in /frontend by @dependabot[bot] in #443
Feat/ai agent by @abhinavxd in #421
render the generated reply as html instead of showing raw markdown by @abhinavxd in #446
Fix live chat image thumbnails for S3 store. by @abhinavxd in #450
link message media in one query inside the insert transaction by @abhinavxd in #451
shortlist tags with embeddings before asking the LLM to suggest them by @abhinavxd in #447
hardcode copilot name and tidy up AI admin copy by @abhinavxd in #453
fix(log): don't drop the error detail in unsnoozeAll log call by @amaanJvd in #454
remove redundant comments in v2.6.0 migration by @abhinavxd in #455
increase default http write timeout to 60s by @abhinavxd in #456

New Contributors

@chahat-101 made their first contribution in #438
@amaanJvd made their first contribution in #454

Full Changelog: v2.5.0...v2.6.0