Nibbly 2.3.0

Nibbly 2.3.0 adds an optional AI agent to the frontend assistant, actions for the dashboard assistant and a search engine check in the System status. It is a compatible minor release: the documented admin API, accounts and sessions are unchanged. New storage is created on first use, the AI API keys move to their own file, and the site-wide search engine block now really blocks the whole site.

Compatibility and upgrade

Deploy the complete core, including the new admin/api/agent.php, the directory includes/ai/agent/, includes/ai/dashboard-actions.php, includes/ai/settings-store.php, includes/seo-check.php and js/ai-agent.js. Read Upgrading from 2.2.0 to 2.3.0 first. In short:

• Search engine block. seo.noindexSite ("Block this website for search engines", Settings → Branding → Search engines) used to empty robots.txt only; pages stayed indexable. It now also sends noindex, nofollow in the robots meta tag and in an X-Robots-Tag header and empties sitemap.xml. Turn it off on live sites before or right after the update.
• API keys move. The provider keys, the Brave Search key and the Pexels key are stored in content/ai-secrets.json (owner-only, in .gitignore); content/ai-settings.json holds no key afterwards and can be committed. Keys that an older file still holds move once when an administrator opens the dashboard or the AI settings. Copy, deploy and back up both files together.
• Customized site files. If the site has its own includes/header.php, includes/footer.php, includes/page.php, includes/news-post.php or route.php, merge the agent hooks listed in UPGRADING.md (preview, agent loader). Without them the site keeps working, but agent previews and the agent mode are limited.
• New storage, created on first use and to be kept with content/ in backups: content/ai-agent/, content/ai-model-quirks.json, content/seo-check.json.
• The AI agent is off by default. Existing limits and settings are not changed.

Highlights

• AI agent in the frontend assistant (off by default). It works through a request with a fixed set of tools and stages every change in a change set that the person reviews: before/after per operation, images with credit and AI badge, sources, validation and render checks, a preview on the real page (owner only), one confirmed click to apply, a backup and journal for every apply, undo, and a separate publish step. New news, events and pages stay hidden or private until published. A chat reply never applies anything. It reads pages through their rendered templates, can research the web (Brave Search, a separate tool-less reading step; the agent never sees a web page) and read addresses the user writes, and brings in uploaded, generated and stock images. Administrators can have it put a page into a menu.
• Dashboard assistant actions. The assistant can offer cards that open a dashboard area or settings tab and, for administrators, change the dashboard theme, colours and language. The model only chooses from a fixed catalogue, the server validates every call against the role, and nothing changes before the person confirms.
• Search engine check in System status. It reads what the live site really delivers (robots.txt, robots meta tag, X-Robots-Tag, sitemap.xml) and compares it with the SEO settings. A dashboard banner appears while the live site blocks search engines, with a one-click "Allow indexing".
• AI settings. The model fields offer the models of the provider, the limits are guides with a small tolerance and warning bars at 80 % and when reached, the defaults fit the agent, and OpenAI models are addressed through the Responses API with automatic parameter handling. Texts are available in all nine admin languages.

Security

• External links written by the agent must come from the user or from a fetched source, also inside rich text. All external fetching of the agent goes through one safe fetch (public addresses only, DNS pinning, manual redirects, size and content-type limits).
• The status of another user's change set is not revealed. AI API keys are kept out of the settings file and out of every response.

Fixed

• Dashboard → Pages: language versions with translated URL paths (for example leistungen and services, linked in $PAGE_MAPPING) are one page again and show "Edit" instead of "Create"; editor links, previews, duplicate, trash and SEO badges use each version's own slug. Files and public URLs are untouched.
• An old invalid favicon, logo, Open Graph image or site URL no longer blocks saving colours, radius and other settings; changed values are still validated.
• The skip link no longer shows its shadow at the top left until it is focused.
• The agent keeps its answers: a finished run shows its answer in the chat again after a new login or reload, and the chat history saves it. A page the agent creates starts with its title as the h1.

Validation

All 55 offline smoke suites pass locally with PHP 8.5, including the new suites for the agent (tools, change sets, loop, research, media, security, settings), the dashboard actions, the search engine check, the page list languages and the settings with old invalid paths, and the Chromium checks of the agent, the page list, the responsive layout and the dashboard. CI for the release commit passed: PHP 8.1, 8.4 and 8.5, Apache/PHP-FPM routing, and Chromium. The agent and the assistant were tested against scripted mock providers; no live provider or search API is part of the test suite. No .htaccess or routing rule changed; route.php only gained the preview hook.

See the complete changelog for all entries.

Release commit: aac271d2ff58192fda607690dff918aec4246660. CI for the release commit.