v2.6.0

What's new

AI features (beta) land in this release. Bring your own model: any OpenAI-compatible endpoint works, including a local one.

• AI assistants - route conversations to an AI assistant with an automation rule, it answers from your knowledge base and hands off to a human when it can't help.
• Juno, the AI copilot - a conversation sidebar tab that answers questions about the conversation and your knowledge base.
• Generate reply - draft a reply from the editor toolbar, then edit it before sending.
• Knowledge base snippets - write snippets by hand or import them from a URL for the assistant to search.
• Learn from resolved conversations - Libredesk drafts snippets from resolved conversations for you to approve or reject. Each approved one joins the knowledge base, so the assistant keeps improving over time.
• Custom AI tools - point an assistant at your own APIs so it can look up an order's status or update a customer's address mid-conversation.
• Tag suggestions - suggest tags for a conversation from your existing tag list.
• Summarize with AI - add a summary of a conversation as a private note.
• Refreshed theme - new palette and a consistent design system across the app.

What's fixed

• Broken image thumbnails in live chat widget for S3 store.
• Fixes to pre-chat form in live chat widget.
• New opt-in [ssrf] guard blocks admin-configured outbound URLs (webhooks, OIDC discovery, AI provider and tool calls) from reaching private, loopback and cloud-metadata addresses. Read more.
• Many other quality of life fixes and improvements.

Upgrade notes

• webhook.allowed_hosts is deprecated and ignored, move it to ssrf.allowed_cidrs and set ssrf.enabled = true to keep webhooks blocked from private addresses.
• Always take a database backup before upgrading.
• Follow the steps here.

Changelog

• 6496cde Merge pull request #456 from abhinavxd/fix/http-write-timeout
• def21f8 increase default http write timeout to 60s
• 189c086 Merge pull request #455 from abhinavxd/chore/tidy-migration-comments
• 232d445 Merge pull request #454 from amaanJvd/fix/unsnoozer-dropped-error-log
• 081cc46 remove redundant comments in v2.6.0 migration
• 3d5d67b fix(log): don't drop the error in unsnoozeAll log call
• ee3a547 Merge pull request #453 from abhinavxd/fix/ai-misc
• c25452a remove redundant snippet URL import hint
• f2edc74 hardcode copilot name and tidy up AI admin copy
• 859777d Merge pull request #447 from abhinavxd/feat/ai-tag-embeddings
• 5e7b1af Merge pull request #451 from abhinavxd/fix/inline-cid-case-and-tx-linking
• 06242de Merge remote-tracking branch 'origin/main' into fix/inline-cid-case-and-tx-linking
• 52a455f link message media in one query inside the insert transaction
• 3544a80 Merge pull request #450 from abhinavxd/fix/s3-thumbnail-preview
• cda5369 use shared attachment URL signing in message handlers
• 75a0925 Fix WS image URLs
• 205ad8a Serve thumbnails inline
• b553e96 Keep widget images inline
• 37224b1 Clarify thumbnail store handling
• 79da9e8 Fix live chat image thumbnails
• 11d0b52 bound the tag query by tokens and always clear the tag index on purge
• 000d789 shortlist tags with embeddings before asking the LLM to suggest them
• 9c1c413 Merge pull request #446 from abhinavxd/fix-ai-reply-markdown
• 16b9906 render the generated reply as html instead of showing raw markdown
• fb4d665 Merge pull request #421 from abhinavxd/feat/ai-agent
• 5e972d1 point each AI admin page's docs link at its section anchor
• bbcc92f add an aria-label to the channel icon in the conversation list
• 276f19d show enabled state as a status badge and stop making checkbox fields required
• f271462 dedup mined FAQs against question and answer so near-duplicate suggestions get caught
• 82f29f2 fix Vue onUnmounted warning on the auth pages
• 0b2ad13 Merge pull request #443 from abhinavxd/dependabot/npm_and_yarn/frontend/postcss-8.5.18
• 349e695 build(deps-dev): bump postcss from 8.5.10 to 8.5.18 in /frontend
• 4ec387a Merge pull request #442 from abhinavxd/i18n-guard
• 1c500ed Revert "temp: test i18n guard, do not merge"
• bcfbd45 temp: test i18n guard, do not merge
• 6d7ce3c require a verified contact in the example tools server and fix its README mismatches
• 71fb197 bump the default completion model off gpt-4o-mini
• 8db2e34 show specific AI provider errors instead of a generic message
• c25ad46 run i18n guard from the base branch and fail on API errors
• e8e2419 show a clear error when the AI agent runs out of steps and hoist openai response structs
• 763bcd6 add CI check to block edits to translated i18n files
• fd21893 cache AI assistants in a store instead of refetching on every copilot panel mount
• b569777 match email quote classes exactly and enforce password length on set password
• 49c5cb3 make AI agent max steps and history size configurable
• 6b8a0f9 fix content loss in knowledge base chunking and harden AI agent limits
• 9f8f10a drop the unenforced-rules section from the design doc
• 23938a1 rename the design doc to DESIGN.md and resync it with the code
• d8b73c5 retheme UI to the green palette and fix form and search bugs
• 712fcbb return clear 400 errors for invalid AI tool and snippet input
• 7c2e19b style sidebar section headers as labels and add design system doc
• b8b2b6c standardize frontend design system, fix form validation, and skip continuity/CSAT messages in AI context
• 1a0a78f Merge pull request #438 from chahat-101/seed-default-business-hours-sla
• 74813b2 reveal admin table row actions on hover and switch to vertical menu, add AI tool enable toggle
• d925640 drop migration, seed only in schema.sql
• 40f8284 strip quoted reply chains from AI agent message context
• d2a548e seed default business hours and SLA policy on install
• 6125f5c harden AI agent knowledge base, OTP, and prompt injection defenses
• cf629f3 only include checked checkbox fields in prechat form submission
• 83f9bb5 show a BETA badge on the AI admin nav item
• aa200f5 make the missing AI API key message provider-agnostic
• ae44e7f expand AI tool context and let contacts correct their email
• 8f8512f apply workspace instructions even with an empty base prompt
• c74eef0 harden the AI agent run loop and admin lifecycle
• f417aac drain AI workers on shutdown before closing the database
• ea03339 address CodeRabbit review findings in the AI agent
• 35ddfe5 make the image pixel-count guard overflow-safe
• 8bedb1a set OTP send-counter TTL atomically to prevent resend lockout
• c659e30 address CodeRabbit review findings in the AI agent
• 2fced94 log when the verification email no-reply guard can't be set
• 1812a03 Merge pull request #437 from abhinavxd/dependabot/npm_and_yarn/frontend/axios-1.18.0
• b422833 build(deps): bump axios from 1.16.0 to 1.18.0 in /frontend
• 1034617 point livechat verification email replies at a no-reply address
• 7760974 send AI verification code through the conversation's inbox
• 085880d make OTP attempt check atomic to prevent brute-force bypass
• bfc3b6e gate AI custom tools behind email OTP verification
• 752e604 drop CC'd contacts' messages from the AI agent history
• 6015859 scope copilot thinking state per conversation
• 1384fd5 scope Generate Reply tools to the conversation's contact
• f460f6b expand copilot with customer-history tools, persona picker, and tag suggestions
• dd3465f make the quoted text toggle keyboard accessible
• b570502 remember when a provider needs max_completion_tokens and track token usage
• ec5333a move OIDC client secret masking to the backend
• 52cebdf update livechat launcher logo
• b1d6fb4 limit when the AI agent appends the confirm prompt
• 35d69fc fix review findings in reports overview and avatar upload
• 94334a0 polish reports overview, avatar upload, and conversation list UI
• 8ac465c support multiple auth headers on AI tools and tune agent timeouts
• e7fa4ce fix review findings in the aiagent package
• a4be8ec fix review findings in the ai package
• fe17af2 drop hardcoded transport fallback in ssrf.NewTransport
• 8f34fc5 guard against a replaced http.DefaultTransport in ssrf.NewTransport
• c7f55e2 guard reply-box AI prompt race and share the SSRF-safe http transport
• a3cdd71 remove inline OpenAI key prompt and reuse generating state for AI prompts
• e5ce8e3 truncate long assistant descriptions in admin table
• 0f2aef1 fix Groq and Together AI provider preset defaults
• cd7e6d9 Update README.md
• 99771a6 Update README.md
• 97c227b skip AI agent on non-open status categories instead of hardcoded names
• 758a01a guard knowledge base URL import against SSRF and fix OIDC transport defaults
• eed50ef link SSRF docs page from SECURITY.md
• 9566dcb apply SSRF guard to all admin-configured outbound URLs
• de8ffa5 Update README.md
• 0f81806 Update README.md
• d02b65f address CodeRabbit findings in AI embedding and assistant flows
• c030c9e harden AI embedding and agent prompt handling, add tokenizer, and switch to a green theme
• 8cdfe86 add AI snippet URL import, conversation summarize, and assistant reply languages
• 616fd00 Update ROADMAP.md
• afb338c address PR review findings in the AI agent
• 976c45d add AI provider connection test and self-heal reasoning model param errors
• e1695b7 send AI agent confirmation question as a separate widget message
• 85a3869 restrict copilot to built-in tools and add per-assistant handoff toggle
• dad99bf render AI agent replies as markdown and fix assistant identity, handoff, and stats bugs
• 3137a3f add conversation attributes to AI agent prompt and mark customer data as untrusted
• 34241f7 improve AI agent context and disclosure
• a7288e1 add AI assistant expectation message shown in the livechat widget
• 44925e6 fix AI agent reply, turn-cap, and stats bugs
• 76d1628 gate AI tool identity to verified contacts and merge v2.6.0 migration into v2.7.0
• 3ba2b82 Merge remote-tracking branch 'origin/main' into feat/ai-agent
• 51d29e0 add local widget JWT test page
• 623fa2c load agents directly in AgentList
• c8884ec add AI reply-box UI and AI author links
• ac40379 improve copilot reply drafts and add presets
• ef0add0 add reasoning effort setting for providers
• 1343790 restrict custom tool methods to GET and POST
• 0d755fc send CSAT on every resolve path
• 16c79a2 guard AI agent replies and add prior-conversation context
• 7186c95 add WIP autonomous AI agent that replies to assigned conversations
• 2fe850a Merge pull request #419 from abhinavxd/dependabot/go_modules/golang.org/x/crypto-0.52.0
• 5815342 build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0
• 0ecd783 add AI copilot backed by a knowledge base and custom tools

What's Changed (Auto generated)

• build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 by @dependabot[bot] in #419
• build(deps): bump axios from 1.16.0 to 1.18.0 in /frontend by @dependabot[bot] in #437
• seed default business hours and SLA policy on install by @chahat-101 in #438
• add CI check to block edits to translated i18n files by @abhinavxd in #442
• build(deps-dev): bump postcss from 8.5.10 to 8.5.18 in /frontend by @dependabot[bot] in #443
• Feat/ai agent by @abhinavxd in #421
• render the generated reply as html instead of showing raw markdown by @abhinavxd in #446
• Fix live chat image thumbnails for S3 store. by @abhinavxd in #450
• link message media in one query inside the insert transaction by @abhinavxd in #451
• shortlist tags with embeddings before asking the LLM to suggest them by @abhinavxd in #447
• hardcode copilot name and tidy up AI admin copy by @abhinavxd in #453
• fix(log): don't drop the error detail in unsnoozeAll log call by @amaanJvd in #454
• remove redundant comments in v2.6.0 migration by @abhinavxd in #455
• increase default http write timeout to 60s by @abhinavxd in #456

New Contributors

• @chahat-101 made their first contribution in #438
• @amaanJvd made their first contribution in #454

Full Changelog: v2.5.0...v2.6.0