Skip to content

v4.2.0 — AI Chat Widget, Security Hardening & Performance

Choose a tag to compare

View all tags
@jonradoff jonradoff released this 24 Mar 06:51
· 82 commits to main since this release
v4.2.0
422b3d9

What's New in v4.2.0

AI Chat Widget

Add a floating AI assistant to any page with a single <script> tag. Visitor queries run a two-phase pipeline: hybrid semantic+fulltext search retrieves relevant excerpts, then Claude Haiku synthesizes a conversational answer streamed live via SSE. Works without an Anthropic key as a pure search experience. Fully configurable from the admin panel — title, colors, position, prompt templates, rate limits.

Fork MCP Tools (8 new tools → 72 total)

Eight dedicated tools for fork workspace management: list_forks, create_fork, get_fork, fork_page, remove_fork_page, merge_fork, archive_fork, delete_fork. Forks let you stage and preview sets of page edits before merging to live.

Security Hardening

  • SecurityHeaders middleware: CSP (path-aware admin vs. public policy), HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy
  • SESSION_SECRET enforced at 32+ characters; server refuses to start with a weak secret
  • Trusted proxy config: TrustFlyProxy reads the unspoofable Fly-Client-IP header in cloud deployments
  • Chat endpoint: separate per-IP (5/min) and global (30/min) rate limiters, prompt injection defense
  • API body size cap on all endpoints

Performance

  • Optimized content query paths
  • Bulk content operations (up to 100 pages per call)
  • export_content for transform/re-import pipelines

Previous release: v1.1 · Full changelog: CHANGELOG.md

Assets 2
Loading