v1.6.2 — audit fixes and widget bundle 0.12.3

Changed

• The bundled widget is now @escalated-dev/escalated 0.12.3. It keeps its script settings when embed.js is placed in the page <head>, and Enter no longer picks a stale mention suggestion.

Security

• Attachments are private. Inbound email and form attachments were written to the public uploads directory under the sender's file name, with HTML and SVG allowed, and linked directly, so an emailed invoice.html or logo.svg could run script on the WordPress origin when an agent opened it. Bytes now go to wp-content/uploads/escalated-private (deny-all .htaccess/web.config; move it outside the web root with the escalated_attachment_storage_dir filter on nginx) under random extension-less names, the MIME type is detected from the bytes, and HTML, SVG, XHTML and more PHP extensions are blocked. Files are served only by GET /escalated/v1/attachments/{id}/download, which requires a bearer token (tickets:read) or a signed-in session with a REST nonce, ticket visibility for staff, or being the requester (internal-note attachments are staff only). Downloads always use Content-Disposition: attachment, X-Content-Type-Options: nosniff and a sandbox CSP, and anything outside a short list of safe types is sent as application/octet-stream. Serialized attachment urls and the agent ticket page now point at this route. Files stored by earlier versions under uploads/escalated keep working through the route; their old public URLs are no longer linked, but delete or protect that directory to stop direct access.
• Widget ticket creation and chat start answer 403 when guest tickets are disabled.
• The widget knowledge base routes (/widget/articles, /widget/articles/{slug}, /feedback) answer 404 when the knowledge base is off and 403 to anonymous callers when it is not public.
• The legacy POST /widget/chat/{session_id}/messages route now requires the widget to be enabled and is rate limited like the other chat routes.
• Chat start counts against the per-IP guest ticket limit, and visitor chat messages against the guest reply limit.
• Widget rate-limit 429 responses carry Retry-After.

Added

• Outbound webhooks include occurred_at, an ISO-8601 UTC time. timestamp is unchanged.

What's Changed

• Private attachments, widget guard fixes, webhook occurred_at by @mpge in #97
• chore(widget): ship the widget bundle from @escalated-dev/escalated 0.12.3 by @mpge in #98
• chore(release): v1.6.2 by @mpge in #99

Full Changelog: v1.6.1...v1.6.2