BotWire 0.4.0

What's Changed

• chore(deps-dev): bump happy-dom from 20.10.2 to 20.10.5 in /npm/botwire-js by @dependabot[bot] in #32
• chore(deps-dev): bump vitest from 4.1.8 to 4.1.9 in /npm/botwire-js by @dependabot[bot] in #33
• Bump StackExchange.Redis from 2.8.16 to 3.0.0 by @dependabot[bot] in #34
• Bump StackExchange.Redis from 3.0.0 to 3.0.7 by @dependabot[bot] in #38
• Bump Microsoft.NET.Test.Sdk from 18.6.0 to 18.7.0 by @dependabot[bot] in #37
• chore(deps-dev): bump happy-dom from 20.10.5 to 20.10.6 in /npm/botwire-js by @dependabot[bot] in #36
• chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #35
• Replace RegexPiiGuard with RedactWire; clear PII messaging; 0.4.0 by @adamy in #39
• docs: add Lemon Squeezy checkout URLs to COMMERCIAL.md by @adamy in #27

Full Changelog: v0.3.0...0.4.0

BotWire v0.3.0

BotWire v0.3.0 — Redis: multi-container support

The Phase 1.6 release makes BotWire correct behind a load balancer. Conversation sessions and rate-limit counters can now live in Redis instead of process memory, so they survive restarts and are shared across every instance. One new opt-in package, one new line of code — defaults are unchanged.

New features

• BotWire.Redis package — Redis-backed stores wired up with a single call after AddBotWire(...):

  builder.Services.AddBotWire(opts => { /* ... */ })
                  .AddBotWireRedis("localhost:6379");

  Registers a shared IConnectionMultiplexer plus both stores below. Multi-targets net6.0/net8.0/net10.0.

• RedisConversationStore — conversation sessions persisted to Redis as JSON with a sliding TTL equal to SessionTtl (refreshed on every save). Sessions survive an API restart or load-balancer bounce, so full history is no longer lost when a request lands on a different instance. Dual-history (compressed send-history vs. full history) and all session flags round-trip intact, and the MaxHistoryMessages cap is enforced identically to the in-memory store.

• Distributed rate limiting — MaxMessagesPerMinute, MaxSessionsPerIpPerHour, and DailyTokenBudget are now backed by atomic Redis counters when Redis is configured, so two instances sharing one Redis enforce one shared limit instead of N×. The daily-token-budget key expires at the next UTC midnight. Over-limit behaviours are unchanged (delay / reject / degrade). MaxConcurrentSessions remains per-container by design — a true distributed semaphore leaks permits on container crashes; set it per-replica or disable it.

  Introduced behind an IRateLimitStore abstraction, so BotWire.Core takes no dependency on StackExchange.Redis.

• RedisShop sample — a two-part multi-container testbed: a RedisShop.Api service (Redis sessions + distributed rate limiting + email escalation) and a Vite + React + TypeScript shopfront with a hand-built chatbox on the headless botwire-js client. See samples/RedisShop/README.md.

Breaking changes

None. Without AddBotWireRedis(...) everything behaves exactly as in v0.2.0 (in-memory stores, per-process counters).

Notes

• Requires a reachable Redis instance (e.g. Docker Desktop). Redis connection failures surface as errors rather than silently dropping conversation history.
• Default deployments without Redis are still single-instance: counters and sessions remain per-process and reset on restart.

Get started

dotnet add package BotWire.AspNetCore
dotnet add package BotWire.Redis

See the README for the full quick start and the RedisShop sample for a multi-instance setup.

What's Changed

• docs: README — 0.2 rate limiting + token audit fields by @adamy in #25
• chore(deps-dev): bump esbuild from 0.28.0 to 0.28.1 in /npm/botwire-js by @dependabot[bot] in #24
• docs: restructure README, add botwire-js section, route licensing to … by @adamy in #26
• feat: Redis multi-container support (Phase 1.6) by @adamy in #28
• fix: resolve two code-scanning alerts by @adamy in #29
• chore(deps): bump esbuild and vite in /samples/RedisShop/web by @dependabot[bot] in #30

Full Changelog: v0.2.0...v0.3.0

BotWire v0.2.0

BotWire v0.2.0 — Production Hardening

The Phase 1.5 release: everything from v0.1.0 plus the guardrails, observability, and a framework-agnostic JavaScript SDK that make BotWire ready for real traffic. Still one-line integration, still bring-your-own-key.

New features

• Five-dimension rate limiting — independently configurable, each disabled at 0:

  • MaxConcurrentSessions — queue and wait for a slot (never reject)
  • MaxMessagesPerMinute — per-session throttle that delays rather than errors
  • MaxMessagesPerSession — prompt the user to start a new conversation
  • MaxSessionsPerIpPerHour — reject new sessions over the cap
  • DailyTokenBudget — degraded response once the daily token budget is spent

  opts.RateLimiting = new RateLimitOptions { DailyTokenBudget = 500_000 };

• Token accounting — real provider usage (TotalTokenCount, with a char-based estimate fallback) now flows through every turn, feeds the daily budget, and is recorded on message and escalated audit entries.

• Audit log — opt-in NDJSON business/compliance trail (messages, guard blocks, escalations, rate-limit hits, errors), one file per session bucketed by UTC date. Write your own IAuditLogger to send events elsewhere.

  builder.Services.AddBotWire(opts => { /* ... */ }).AddJsonAuditLog("logs/audit");

• Session summary compression — long conversations fold their oldest turns into a rolling LLM summary to cap token cost, while the full history is preserved for ticket generation.

• Topic / off-topic classification — folded into the main answer JSON ({ offtopic, action, message }), no extra model call.

• botwire-js npm package — framework-agnostic JS/TS client (chat, SSE streaming, session management, zero DOM deps). The embedded widget is now built on top of it.

• Widget enhancements — conversation starters, a conversation-reset button, off-topic/blocked handling, and data-lang multilingual config.

• Session self-heal — a stale session token is transparently rebuilt and the message resent once, invisible to the user.

Breaking changes

• ILlmChatClient now reports token usage. ChatAsync returns LlmChatResult (text + tokens) instead of string, and ChatStreamingAsync takes an Action<int>? onUsage callback. Custom ILlmChatClient implementations must update their signatures. No change is needed if you use the built-in OpenAI client.

Notes

• Rate-limit and token-budget counters are in-memory and per-process (they reset on restart). Durable, cross-instance budgeting (Redis) is planned for a later release.

Get started

dotnet add package BotWire.AspNetCore

See the README for the full quick start and configuration reference.

What's Changed

• chore(deps): bump actions/setup-node from 4.4.0 to 6.4.0 by @dependabot[bot] in #17
• chore(deps): bump actions/setup-dotnet from 4.3.1 to 5.3.0 by @dependabot[bot] in #16
• chore(deps): bump actions/checkout from 4.3.1 to 6.0.3 by @dependabot[bot] in #15
• Task 21: widget session self-healing on InvalidSession by @adamy in #22
• Phase 1.5 — production hardening + 0.2.0 release by @adamy in #23

Full Changelog: v0.1.0...v0.2.0

BotWire v0.1.0

BotWire v0.1.0 — Initial Release

AI-powered customer-support bot for ASP.NET Core. One-line integration:

builder.Services.AddBotWire(opts => { /* topic, docs, provider */ });
app.MapBotWire();

Bring your own OpenAI-compatible API key — no SaaS fees, your only running cost is model tokens.

Highlights

• Embedded chat widget — zero-dependency ~12KB Web Component, served at /botwire/widget.js
• Grounded answers — RAG over your own Markdown docs; no invented policies or prices
• Human escalation — collects contact details and emails a support ticket when a human is needed
• Multilingual — replies in the customer's language; tickets in yours
• Safety guards — PII blocking and prompt-injection defenses, on by default
• Self-hosted — your data and prompts stay in your app (AGPL-3.0; commercial licenses available)

Packages

Package	Description
BotWire.AspNetCore	ASP.NET Core integration: AddBotWire() + MapBotWire(), SSE streaming, embedded widget
BotWire.Core	Core engine: RAG, escalation, guards (no ASP.NET dependency)
BotWire.Channels.Email	Ticket delivery via SMTP (MailKit)

Get started

dotnet add package BotWire.AspNetCore

See the README for the full quick start.

What's Changed

• chore(release): prep 0.1.0 — README, NuGet packaging, AGPL license fix by @adamy in #2
• fix(release): Task 20 — pre-0.1.0 review (off-topic escalation, drop no-op options) by @adamy in #1
• docs(security): add SECURITY.md vulnerability disclosure policy by @adamy in #12
• ci: add CI + tag-triggered NuGet release pipeline (Trusted Publishing) by @adamy in #13
• chore(deps-dev): bump typescript from 5.9.3 to 6.0.3 in /npm/botwire-js by @dependabot[bot] in #3
• Bump coverlet.collector from 6.0.4 to 10.0.1 by @dependabot[bot] in #5
• Bump Microsoft.AspNetCore.Mvc.Testing from 10.0.0 to 10.0.9 by @dependabot[bot] in #6
• Bump xunit.runner.visualstudio from 3.1.4 to 3.1.5 by @dependabot[bot] in #11
• Bump Microsoft.Extensions.DependencyInjection.Abstractions and Microsoft.Extensions.Options by @dependabot[bot] in #9
• Bump Microsoft.Extensions.DependencyInjection.Abstractions and Microsoft.Extensions.Logging.Abstractions by @dependabot[bot] in #8
• Bump Microsoft.NET.Test.Sdk from 17.14.1 to 18.6.0 by @dependabot[bot] in #10
• chore(deps-dev): bump esbuild from 0.25.12 to 0.28.0 in /npm/botwire-js by @dependabot[bot] in #4
• ci: pin actions to commit SHAs; let Dependabot manage action bumps by @adamy in #14
• chore(deps): align versions post-Dependabot; curated release notes by @adamy in #20

New Contributors

• @adamy made their first contribution in #2
• @dependabot[bot] made their first contribution in #3

Full Changelog: https://github.com/adamy/BotWire/commits/v0.1.0