Product updates

• Comment-automation: add image-only filter and AI comment moderation
• Triggers: add sequence actions and guard against trigger loops
• Auth: add mobile JWT auth, member-scoped /v1 access and /v1/me endpoints

• Builder: improve status text contrast
• Builder: gate manage access by credentials
• Worker: complete orphaned integration jobs
• Export: make CSV exports open correctly in Excel on Windows
• Ui: use system fonts
• message list spacing
• Ai-agent: fixbug reply image reader with rich response
• Hooks: type-check test files by default in the pre-commit hook
• Release: publish installable package tarballs
• Zalo: log and drop messages with no content instead of throwing
• Workspace-members: resolve invitation links on serving tenant host
• Auth: normalize legacy MCP resources

• Hooks: scope pre-commit lint and typecheck to changed files
• Worker: reduce idle load of the sequence producer and cron scanners
• Integrations: import only the Google APIs in use
• Hooks: add an opt-in switch to skip builder test files in the type check

• Tooling: standardize workspace build configuration

• Contacts: add ad ids column and export history to contact export
• Mcp: add OAuth2 authorization for the MCP server
• Mcp: add human-in-the-loop safeguards
• Mcp: add OAuth consent flow
• Ecommerce: connect stripe with the store’s own secret key
• Mcp: bind OAuth consent to workspaces
• Places-near-me: add Places near me tool and flow action
• Auth: upgrade better auth to 1.7
• Ai: add Muse (Meta Model API) provider
• Flows: add call phone number button
• Flows: implement AI Segment Image step (SAM 3.1)
• Keywords: add manychat-style match conditions for contact keywords
• Platform: gate custom app credentials by plan

• Mcp: simplify mutation confirmation
• Database: decode oauth consent aggregate dates
• Mcp: include guides in Docker build context
• Messenger: persist SSO callback URL
• Admin: relabel sidebar groups
• Flows: save pending flow changes on exit
• Broadcast: match the recipient count to who is actually sent
• Auth: skip mcp plugin db seed during next build
• Broadcast: guard sending an edited draft on leftover recipients
• Auth: use placeholder jwt issuer when builder url unset at build
• Webchat: reject spoofed origins without referer
• I18n: translate hardcoded data table, actions and inbox filter labels
• Mcp: support Streamable HTTP on SSE path
• Auth: canonicalize MCP resource URLs
• Webchat: discard corrupted guest conversation ids and surface load failures
• Theme: load Inter font with Next.js
• Database: re-parent custom app credentials migration onto main head

• Repo: add root typecheck script
• Agents: enforce mechanical invariants in lint and slim AGENTS.md

• Realtime: stabilize presence reporting test
• Ci: reuse release quality gate

• Platform-admin: add super-admin/support roles
• Contacts: add activity-based contact filters
• Fb-marketing-messages: custom audiences, send campaigns and statistics
• Google-ads: capture Google Ads clicks from Zalo
• Variables: add new system variables
• Ai-files: structure-aware chunking, test query page and paramet…
• Pipelines: add pipeline boards for tracking deals and tickets
• Tiktok: add messaging and comments switches to the app credential
• Builder: show page skeletons instantly on workspace navigation
• Pipelines: follow the workspace country currency by default
• Ads: keep every ad click a contact comes from
• Ecommerce: add stripe and paypal online payments to the web shop
• Builder: add connect-your-agent card and default first workspace

• Windows: make lint, typecheck, build, three test suites and the git hooks run on Windows
• Workspace: bound workspace purge cleanup
• Analytics: ensure workspace mac inserts select all columns
• Worker: clean up orphaned Messenger webhooks
• Fb-marketing-messages: split node-only audience upload out of the router graph
• Builder: keep Enter as newline on touch keyboards
• Builder: keep in-page navigation lists visible while a route loads
• Flow: re-check instagram profile fields live in condition steps

• Database: drop unused analytics event tables
• Worker: consolidate worker processes

• ci(tests): diff affected suites against the merge commit’s main parent
• ci(test): speed up the test and type-check jobs

• Media: store channel media lazily and compress images
• Admin: add create-workspace-for-owner flow in admin console
• Realtime: add dedicated Redis endpoint
• Ai: upgrade to AI SDK v7
• Ecommerce: add orders, web shop, discount codes, sales analytics and store automation

• Builder: limit tailwind sources to package src folders
• License: add seven-day grace period
• Realtime: recover calling state after a realtime resync
• External-request: log failures and follow redirect semantics
• Realtime: prevent races during paged message loads

• License: add recurring license refresh
• Admin: add enterprise menu groups, platform audit log, and db smtp
• Auth: add enterprise oidc sign-in and signup gate
• Messenger: open mini app buttons in messenger message templates

• Channels: show accurate connect errors and keep the workspace on retry

​

🔒 Security

• Deps: bump node to 24.22.1 for october 2026 security fixes

• Jev: implement jev flow
• Analytics: filter dashboards by channel and inbox
• Ai-router: add public API
• Saved-replies: attach media library images to saved replies
• Flows: add open mini app button that continues the flow on submit
• Connections: add self-serve channel connections
• Working-hours: track agent response time within working hours
• Working-hours: add on-shift routing, holidays and response sla
• Platform-admin: add persisted admins and consent policy

• Api: stop resolving a contact’s conversation and inbox arbitrarily
• Ai-agent: fix error load tag
• Webchat: split connect config schema from db-backed schema

• Folders: move the folder bar into each table card

• ci(release): add swap so the builder image build stops running out of memory
• ci(tests): run affected suites on pull requests

• Google-ads: add click-to-message conversion tracking
• Mini-apps: add WhatsApp Flow builder with public link, uploads and custom fields
• Mini-apps: delete the whatsapp flows along with a mini app
• Inbox: view whatsapp flow responses like the whatsapp app
• Flows: suggest the contact’s phone or email in get user data
• Flows: add a whatsapp location step
• Flows: add a view catalog step for whatsapp
• Flows: sync messenger welcome message flows
• Broadcasts: add recurring broadcasts
• Flows: fill mini app and minigame tokens in messenger template links
• Builder: accept mini app and minigame links in messenger templates
• Mini-apps: duplicate a mini app
• Mini-apps: save a screen’s answers to custom fields as the visitor moves on
• Mini-apps: save to whatsapp as a draft, preview, then publish or delete it
• Flows: send products in whatsapp flows
• Inbox: send products from the composer and the api
• Triggers: add shopping cart and product question triggers
• Inbound-webhooks: receive data from external systems via webhook urls
• Leaderboard: add leaderboard ranking campaigns
• Inbox: add scroll-to-bottom button to the conversation message list
• Instagram: add story mention automations and storyMention input type
• Ads: connect the Conversions API from each Meta channel’s Ads tab
• Ads: keep Conversions API settings on reconnect and fix the Instagram account lookup

• Auth: google sign-in sent some users back to the login page
• Auth: facebook sign-in sent some users back to the login page
• Inbox: improve inbox read and unread behavior
• Mini-apps: keep the issues list inside its popover
• Coexist: date synced contacts from their oldest message
• Mini-apps: publish to whatsapp on the first try and harden the flow step
• Media: stop retrying graph attachments with no fresh media
• Whatsapp: log the credit line error under err so the stack survives
• Mini-apps: widen the delete dialog so its buttons fit
• Flows: keep running the node after a get user data reply
• Auth: let phone-only facebook accounts sign in
• Mini-apps: fix editor qa issues and derive the last screen from its actions
• I18n: capitalize payload in the get messenger ad payload label
• Whatsapp: accept webhook contacts without a profile
• Builder: hide pancake support chat bubble on inbox page
• Analytics: show real totals in the all contacts by channel chart
• Comment-automation: scope comment and story automations to one account
• Messenger: stop treating reel comments as live comments

• Contact-filter: optimize the order of the filter field list
• Mini-apps: split mini app code into smaller, single-purpose files
• Broadcast: run recurring broadcasts on the schedule worker

• Agents: require a public api for every feature, including result-returning ones
• Skills: pick builder file and image fields from the media library

​

📋 Upgrade Notes

​

Connections

1. Run database migrations (adds the Connection and ConnectSession tables):

pnpm --filter @chatbotx.io/database db:migrate

2. Backfill Connection rows for existing inboxes and integrations. Preview with a dry run first, then apply:

pnpm --filter @chatbotx.io/database db:backfill-connections -- --dry-run
pnpm --filter @chatbotx.io/database db:backfill-connections

pnpm --filter @chatbotx.io/database db:backfill-connections -- --verify

​

Environment

• REALTIME_BROADCAST_SECRET must be at least 32 characters. Generate one with openssl rand -base64 32.
• New optional variables:
• REDIS_QUEUE_URL and REDIS_QUEUE_BULK_URL split queue Redis by role. Both fall back to REDIS_URL. Drain bulk jobs and restart every producer and consumer before the cutover.
• PROFILE_SNAPSHOT_JOBS_PER_SECOND
• FACEBOOK_BUSINESS_AI_APP_ID enables Messenger “return to bot” in conversation routing.

• Connections 1 foundation
• Connections: complete connection engine
• Connections 3 builder api
• Builder: add bot simulator tool
• Message-templates: raise messenger body variable limit to 15
• Threads-comments: add post picker for threads comment automation
• Flows: enforce channel step support
• Conversation-routing: add WhatsApp and Messenger conversation routing
• Ai-handover: per-page AI hand-over settings and apply to all customers
• Contact-filter: add Instagram profile and commented-on-post filters
• Flows: configure quick reply settings
• Comment-automation: add facebook and instagram live comment automation
• Api: expose coupons and booking URLs
• Public-api: add missing endpoints and fix gaps against the builder
• Public-api: expose remaining tools endpoints for cli and mcp
• Public-api: add product import, audience preview, bulk tagging and CAPI routes
• Media: improve attachment loading in the inbox
• Media: optimize attachment loading with per-channel storage
• Inbox: optimize attachment loading in conversations
• Public-api: open workspace advanced settings and channel disconnects
• Reflinks: add embeddable chat widget for ref links
• Public-api: fill broadcast templates with flat templateParams
• Public-api: simpler inputs for templates, imports and channel settings
• Reflinks: let ref link chat widgets use their own logo and brand
• Reflinks: read and update the chat widget through the public api

• Threads-comments: use thumbnail for video posts in post picker
• Broadcasts: show unknown for audience filter values that no longer exist
• Conversation-routing: fix Types check broken on main by #1378
• Bot-simulator: hide support chat bubble on simulator page
• Comment-automation: validate flowId exists before saving a reply
• surface expired Meta connect sessions
• Triggers: let the five WhatsApp call conditions match their events
• I18n: repair the Spanish trigger.* strings mangled by a word-fragment replace
• Tools: remove beta badge from tiktok comment automation
• Tools: update tools list test for removed tiktok beta badge
• Env: ship a schema-valid REALTIME_BROADCAST_SECRET example
• Instagram-facebook: reject unaccepted thread handovers
• Connections: restore dropped behaviors and fix engine regressions
• Public-api: validate flow ids on write and give colliding CLI commands distinct names
• Connections: rebuild oauth redirect_uri from credential on connect-session callback
• Connections: write jsonb columns without db default on channel insert
• Connections: wire token refresh, teardown, and backfill into engine writes
• Public-api: declare the error codes public routes really throw
• Messenger: stop dropping page labels during tag sync
• Quota: write workspace usage through the caller’s transaction
• Quota: hand quota back when a connect or workspace-create transaction rolls back
• Error-logs: close the delete dialog after a successful delete
• Messenger: tag contacts with the ad on referral-only webhooks

• Error-logs: delete error logs through the business service
• Whatsapp: load and verify manual webhooks through the business service
• Workspaces: store channel profile logos through the workspace service
• Workspace-members: create invitations through the invitation service

• remove unused kafka package, split queue redis, add scaling ADRs
• test(database): update retention interval SQL assertion
• Public-api: make route descriptions match what the code does

• Comment-automation: add mentions filter, exact exclude, gif/emoji hide and tag counters
• Inbox: add mark conversation read/unread flow actions
• Inbox: render gif attachments and autoplay gif videos
• Messenger: fetch page profile after setup changes
• Contacts: show contact id and per-channel ids in inbox contact panel
• Threads: release threads channel to all users
• Whatsapp: keep contacts linked when a customer changes their number
• I18n: add Azerbaijani locale
• Comment-automation: show comment text in sent, delivered and seen dialogs
• Ai-agent: implement ai action
• Comment-automation: process missed comments from the last 7 days

• Ui: stop TagsInputField from taking focus on mount by default
• Worker: complete inbound jobs for disconnected zalo oas instead of failing
• Messenger: show gif attachments of facebook post comments in inbox
• Zalo: keep gif and video messages in inbox
• Threads: show gif replies in inbox
• Telegram: keep stickers and show animations as gifs
• Inbox: show a placeholder for media-only comments
• Tiktok: show image comments in inbox
• Tiktok: mark hide-emoji switch as required in comment form
• Comments: mark hide-comment switches as required in instagram and threads forms
• Mcp-server: add repository metadata and correct bin path
• Inbox: keep useInboxList’s empty fallback referentially stable
• Ui: declare —destructive-foreground in :root and .dark
• I18n: correct English leftovers in home.* for da and es locales
• Ui: remove self-referential —shadow-*/—tracking-normal declarations in @theme inline
• Workspaces: show create-workspace card in community edition with zero workspaces
• Ui: raise —ring/—sidebar-ring contrast to meet WCAG 1.4.11
• Comment-automation: record inline private replies in the inbox
• I18n: add missing channelIdentity keys to az locale
• Ui: derive a dark-mode-safe —primary instead of reusing the light-mode value
• Channels: preserve workspace on connect retry
• Broadcasts: show names instead of ids in audience filter
• Messenger: keep video comments’ media and match reel automations
• Messenger: trigger keyword replies for ad questions tapped in Click-to-Messenger ads
• Messenger: save avatar for commenters who never messaged the page

• Realtime: reduce broadcast and inbox update work
• Integrations: unify comment channel structure across meta, tiktok and threads
• Quota: admit new contacts without waiting on the MAC lock
• Flows: show inbox load state in template menus

• Threads: list threads channel in readme, agents guide and skills
• Readme: update lifetime deal link

• Analytics: load dashboard charts progressively
• Media: load Messenger and Instagram media and avatars on demand
• Mcp: evaluate business tool selection
• Inbox: mark bot messages as read
• Realtime event queue
• Broadcasts: add send rate to schedule and resume
• Api: add idempotency keys and retry headers

• Worker: forward commentAnchor to getUserData prompts
• Inbox: close refactor audit gaps
• Inbox: refine state seeding and coverage
• Inbox: preserve cache consistency
• Ai-file: fix bug upload pdf error
• Contacts: rename the custom fields reset control to clear
• Database: stop snowflake id collisions from failing message saves
• Meta-conversions: stop attributing test events to a real contact
• Database: fix the call recording retention query
• Meta-conversions: label the whatsapp test event input as a click id
• I18n: finish the Spanish translation of the comment automation strings
• I18n: translate the optional field marker
• Worker: ignore accents in comment and story automation keywords

• Inbox: prefetch initial state and migrate query stores
• Builder: migrate remaining provider consumers
• Contacts: migrate contacts table to client-side TanStack Query
• add conversation contact index
• Database: add contactInboxId indexes for cascade deletes
• Realtime sender cost
• Realtime: remove workspace hot-path storage read
• Messenger: skip third-party echoes for unknown contacts
• Realtime client inbox
• Realtime protocol v2
• Broadcasts: simplify schedule and resume activation

• Worker: stop enqueuing evaluateTemplateSent after template sends

• Ai-agent: mcp load bot field
• Threads: gate the threads ui behind a preview allowlist instead of hiding it
• Whatsapp: add in-app voice calling
• Tiktok: add comment automation and rename the comment-automation tables
• Tiktok: comment-to-message private reply for comment automation
• Worker: move coexist media backfill jobs to a dedicated low-priority queue
• Builder: show the low queue in the developer Bull Board
• Broadcast: add a send limit for audience range and messages per minute
• Flows: add spintax, per-channel sendText limits, and minigame message variables
• Flows: route deep-link buttons through an app-links interstitial
• Contacts: add reset all custom fields to the contact inbox panel

• Threads: hide threads from the product ui until meta approves the api permissions
• Triggers: make tag and sequence condition filters searchable
• Messenger: send header variable for text and image templates
• Ai-agent: change import variable bot field in mcp server
• Broadcasts: show page templates and header images in broadcast details
• Whatsapp: show the reason Meta gives when a number cannot place calls
• Whatsapp: stop treating a granted conversions api permission as missing
• Tiktok: drop video.list and request the approved comment write scope
• Tiktok: subscribe the comment webhook, not just direct messages
• Tiktok: read a comment reply’s video id from the comment itself
• Messenger: shrink the page list request when Facebook says the response is too large
• Inbox: load all connected pages in the broadcast page selector instead of only 50
• Worker: count discrete outgoing bot messages
• Cli: add Node executable directive
• Tiktok: read parent_comment_id 0 as no parent, not as a comment reply
• Whatsapp: explain failed call answers and stop ringing in other tabs
• Whatsapp: let only one browser tab answer an incoming call
• Broadcasts: keep a renamed broadcast’s name when its draft is edited

• Integrations: ack-fast telegram/tiktok webhooks, add tiktok webhook tests
• Worker: move job handler data access into business services
• Public-api: audit and clean up public rest/mcp surface

• ci(cli): auto-publish chatbotx cli to npm on release tag
• ci(cli): switch cli npm publish back to oidc via direct npm publish
• Cli: publish CLI skill to skills.sh and ClawHub
• Readme: update cloud trial banner and add MCP/CLI tools promo
• Mcp: rename chatbotx-mcp-server package to chatbotx-mcp
• ci: notify chatbotx-agent’s upstream-drift check on publish

• Error-logs: record the channel-side contact id and stack trace on provider failures
• Api: scope contact scan and contacts import public APIs to workspace tokens
• Api: activate the media public API scope
• Api: activate the channels public API scope
• Api: activate the minigames public API scope
• Api: scope email topics public API to workspace tokens
• Api: scope automation-area public APIs to workspace tokens
• Comment-automation: delivery stats, miss tracking, tag counters, and multi-text replies
• Marketing-messages: add Facebook Marketing Messages tool
• Mcp: agent-first MCP surface, flow-spec DSL, capability discovery
• Threads: add threads channel with comment auto-reply automation
• Flows: create flow with content and publish in one call

• Flows: bound the node-detail push with maxWait
• Channels: stop forwarding the whole query when switching channel
• correct broadcast schedule timezone and retry timed-out contact scans
• Mcp-server: correct default CHATBOTX_API_URL and load root .env in dev

• Public-api: shorten summaries, harden white-labeling, rename enrollment to subscription

• Cli: document full command coverage and known API quirks

• Inbox: record disconnect reason and add reconcile safety limits
• Comment-automation: harden reply delivery and gate media steps per channel
• Automation: implement public API for flows, triggers, keywords, ai-agents, reflinks, ai-triggers
• Messenger: let workspace admins clone templates to their pages
• Api: add analytics-scoped public API and clean up analytics data access
• Appointment: add Google event templates
• Contacts: add automatic customer scan to import contacts from channel history
• Broadcasts: send from multiple pages with per-page templates and flows
• Whatsapp: send native location request from get user data
• Appointments: add public API for appointments, calendars, external calendars, and reminders
• Comment-automation: per-automation reply analytics with full event coverage
• Flows: map javascript json paths to custom fields
• Logging: add LOG_DEBUG flag for opt-in diagnostic logging
• Api: add inbox-scoped public API for conversations, messages, saved replies, and teams
• Api: scope broadcasts and sequences public APIs to workspace tokens
• Api: activate the ads public API scope

• Analytics: repair dashboard timezone crash and click-to-message ad attribution
• Whatsapp: share one business-account credential across its phone numbers
• Instagram-facebook: send private replies via the page node again
• Ai: retire stale model catalog entries
• Sequence: compute dispatch bucket without node crypto
• Database: linearize migration snapshot chain and restore lost entities
• Comment-automation: detect top-level comments on photo posts and resolve replies-by-date timezone
• User-quota: skip deleted users when syncing quota
• Webchat: clear typing indicator when the bot reply arrives

• Worker: move integration, chat and ai-agent handler data access into business
• Builder: move ai feature data access into business services
• Whatsapp: consolidate capi reconnect and remove automatic events card
• Builder: move zalo, tiktok, telegram, webchat, smtp data access into business
• Builder: move growth, comment automation, media library and workspace data access into business

• Database: drop unused AIAssistant table and relations

• Broadcast: redesign broadcasts list with status panel, calendar views and per-status actions
• Ads: move click to message ads into a tools page
• Minigames: add draw lots and scratch-off minigame types
• Capi: add meta capi event dialog, action sources and test events
• Builder: make the app usable on mobile viewports
• Security: hash workspace API tokens and support multiple permissioned tokens
• Workspace: add platform support access with owner opt-in
• revert(api-contract): drop @chatbotx.io/api-contract, standardize public API naming
• Minigame: replace the invite cookie with channel share refs
• Worker: split ai workloads
• Contacts: cover full public API for MCP, move logic into business services
• Api: document declared error shapes across public oRPC routes
• Channels: connect several pages and numbers in one flow
• Api: add ecommerce-scoped public API for products, categories, …

• Worker: parse stored appointment field times
• Sequences: persist delay unit changes after reload
• Appointments: booking connect google calendar error
• Messenger: show flow images and videos to every recipient
• Builder: derive the inbox height from the shell instead of hard-coded dvh
• Variables: localise the gender salutation by workspace language
• Automated-response: match page keywords exactly, not by substring
• Tests: use numeric id fixtures after zodBigintAsString was anchored
• Worker: run comment-triggered private flows on the DM conversation
• Tests: use numeric id fixtures in flow-config schema tests
• Errors: keep meta’s code, subcode and both sentences in graph error text
• Minigame: make save work after adding a prize
• Webchat: accept the minted guest conversation id in message schemas
• Inbox: keep a conversation unread when a bot reply arrives

• Orpc: shared error mapping, workspace-access gate, public-only /api

• Agents: streamline skills, add a skills validator, tighten public error contract

• Minigames: add Gashapon minigame type
• Messenger: show non-admin pages as disabled in page picker
• Error-logs: attribute failures to providers and add retention cron
• Flows: add multiple images step for sending image albums
• Contacts: backfill missing contact profile names from channel profiles
• Contacts: persist locale, timezone and language on profile refresh

• Builder: remove HUMAN_AGENT tag warning dialog from message input
• Inbox: cannot send media library image in conversation
• Ads: send required advantage audience flag when creating ad sets
• Worker: reset DM AI history from comment flows
• Variables: resolve user_id system field to the contact id
• Telegram: populate image width/height on incoming photo attachments

• Ads: remove track ads lead and purchase actions
• Builder: rename schemas/ to schema/ and api/authenticated.ts to api/private.ts

• Audit-log: add audit logging service and admin audit log page
• Ads: add in-app messaging ads manager for WhatsApp, Messenger, and Instagram
• Minigames: add Lucky Wheel minigame type
• Inbox: add private reply and fix Instagram/Messenger delivery gaps
• Bot-fields: add bot fields with typed value normalization

• Ai-agent: fix bug ai gent slow reply
• Ads: request the WhatsApp connect scope only for click-to-whatsapp
• Audit-log: format message incorrect

• Templates: add shareable flow templates with install and auto-update
• Push-notifications: device tokens + Expo push notification delivery
• Builder: link contact names to live chat
• Media-library: add workspace media library and wire it into upload flows
• Ads: extend conversion tracking to Messenger and Instagram

• Minigames: extend play link token TTL from 1 hour to 1 day
• Templates: restrict shareable template categories to flows only
• Templates: restore full category enum, gate share UI via explicit list
• Coexist: handle oversized attachments and message id collisions in historical import
• Whatsapp: open website buttons now open their link
• Builder: stop google calendar oauth callback from swallowing its…
• Ui: constrain select popup max-height so long option lists scroll

• Minigame: add agent skill for the Minigame feature

• Coexist: keep synced history out of AI context by default
• Whatsapp: support usernames and business-scoped user ids
• Default-reply: enforce activation frequency per contact
• Builder: add 404 not-found page
• Dynamic-images: add dynamic image template feature
• improve conversions api dataset setup and support variables in flow links
• Whatsapp: replace technical template inputs with product and date pickers
• Permissions: rename contacts permission to contacts / inbox and gate all sidebar menus
• Flows: add date/datetime picker webview for get user data step
• Flows: allow custom field variables in media step urls
• Channels: add generic API channel for custom integrations
• Builder: replace zalo refresh-permissions with oauth reconnect
• Minigames: add Minigame tool with Jackpot management and gameplay

• Appointment-scheduling: fix bug worker handle step error
• Auth: preserve and validate callbackURL through sign-in flows
• Ci: remove invalid matrix context from release.yml job-level if
• Contacts: stop prefetching inbox links from the contacts list
• Builder: render non-coupon variable mentions with their raw id
• Variables: rewrite JS placeholders as property access, not spliced values
• Tiktok: surface silent send failures and enforce TikTok’s 40-char card title limit
• Dynamic-images: make orphaned background cleanup best-effort
• Ui: stop forcing command item icons to white
• Ci: restore image publishing on merge to main and version tags
• Flow: validate and coerce Execute JavaScript step values against custom field types
• I18n: add missing simplified chinese translations
• Whatsapp: send quick reply templates and route button taps in flows
• Meta: avoid duplicate logs for expected Graph API errors
• Zalo: stop duplicating inbox-sent messages and handle postback/receipt webhooks
• Builder: use absolute link for google sheets manage button
• Comment-automation: send private reply flows on instagram channels
• Zalo: surface real OAuth errors and harden daily token refresh
• Auth: white-label sign-in — root-tenant SSO fallback and per-credential OAuth origins
• Appointment: fix appointment handle booking page picker
• Builder: make zodBigintAsString test mocks fully chainable
• Webchat: fail closed when no authorized domains are configured
• Minigames: show live jackpot machine preview in type picker

• ci: split the quality gate into parallel jobs and cut test import cost
• Utils: reorder CHANNEL_CAPABILITIES by product priority
• Ci: ignore node docker major bumps to stay on LTS
• Comment-automation: correct instagram support status
• Readme: sync banner, links, and G2 removal with ahalead

• Capi: dedup lead events per day only for whatsapp
• Flows: add flow import/export

• Comment-automation: send ai agent private replies on instagram channels
• Builder: show the inbox list on every analytics tab

• Builder: reorganize analytics, ads and whatsapp settings navigation

• point self-hosters to chatbotx-docker-compose

• Messages: track and surface send failures across channels
• Ads: add click-to-whatsapp ads conversion tracking and analytics
• Enterprise: enforce license checks at startup and gate cloud-only features
• Integrations: add n8n integration
• Capi: add whatsapp support and a unified dataset connection
• I18n: add Simplified Chinese locale
• add appointment scheduling
• Flows: add execute-javascript step with isolated-vm sandbox

• Builder: optimize build pipeline and gate types in CI

• post-merge cleanups for ads conversion tracking

• Workspaces: sticky account rail with billing/redeem links
• I18n: add Traditional Chinese translations
• Channels: add two-tier channel visibility policy for resellers
• Contacts: import column auto-mapping and template download
• add daily token refresh for tiktok, instagram, and messenger channels
• Webchat: add branding, avatars, and widget CSS hardening
• Channels: add whatsapp token refresh and unify channel refresh jobs

• Auth: link facebook sso to existing account on matching email
• Whatsapp: keep setup working when credit line sharing fails
• Worker: prevent scheduled workspace purge from failing on overlapping runs
• Ai-function: fix ai function create button not vent
• Workspaces: drop unusable serverside redirect after scheduling deletion

• Worker: delete each workspace as soon as its teardown finishes
• Ui: add allowClear to ComboboxField and dedupe none label

• Auth: add facebook sso login and reuse token for messenger connect
• Auth: add google sso sign-in and share tiptap paste-to-text conversion
• Whatsapp: save template flow responses to contact custom fields
• Automated-response: press enter to navigate keyword inputs
• Flows: support variables in set custom field value
• Auth: add sign-in method switcher and reorder SSO providers
• Workspace: add logo editor and store avatars as storage paths
• Automated-response: add page (outbound) keyword automation tab
• Instagram: coexist history sync for native Instagram

• External-webhooks: accept provider from input instead of hardcoding make
• Tiptap: prefer html clipboard source in prompt editor paste
• Flows: stop button editor dialog reading stale node data
• Flows: connect dropped node link to whichever node it lands on
• Workspace: make scheduled deletion purge reliable
• Flows: sync jump-target edge when a button’s beforeStep retargets
• Worker: use correct schema field for addContactNotes step
• Flow: resolve button/quickReply target when continuing multi-step chain
• Messenger: normalize missing workspaceId to undefined in connect route
• Sequences: prevent long flow name from overflowing onto delay selector
• Conversations: show assigned name in tooltip instead of raw text

• Readme: refresh screenshots and add G2 review links

• Flows: support variable templates in Google Sheets column mapping
• Instagram: add story reply automation
• Broadcasts: show target page in broadcast names and details
• Comment-automation: rich text reply editor with variable resolution

• Whatsapp: keep channel name accurate and in sync
• Ui: add popover border and center radio-group indicator
• Instagram: correct story-reply message direction and contact profiles
• Instagram: resolve correct channelType for story-reply automation
• Flows: prevent toolbar menu labels from wrapping
• Whatsapp: fill template variables with contact values
• Instagram-facebook: capture Send API message_id to prevent inbox duplicates
• Flows: sync node rename and keep confirm enabled for button step actions
• Messages: prevent duplicate inbox messages from channel echoes
• Messenger: get eligible Lead Ads pages

• Codegraph: share mcp config and setup docs with team

• Flows: show every carousel card and connect their buttons
• Coupons: add management flows
• Products: add product categories and meta catalog sync
• add product url field and fix meta catalog follow-up bugs
• Instagram: comment-to-DM automation with Instagram Login
• I18n: add RTL support and migrate from Radix UI to Base UI
• Whatsapp: show carousel cards as one swipeable carousel
• I18n: expand builder locale support to 18 languages

• Messenger: apply the carousel layout choice when sending cards
• Products: show meta catalog sync errors
• Instagram-facebook: send private reply via page node, not igId
• Flows: improve carousel Arabic support

• ci: use pull_request_target for PR labeler to allow label creation

• Contacts: timezone-aware date and datetime custom fields
• Quota: add monthly bot-messages metric and enforcement
• Database: add external-webhook table and fix migration chain
• Worker: propagate channel origin through trigger execution
• Integrations: add Make.com credential settings
• Flows: add Make trigger step with external webhook attach/detach
• Questionnaries: add multi delete list
• Quota: track per-workspace usage
• Whatsapp: connect automatically after signing in
• Messenger: add Facebook Lead Ads Automation tool
• Usage-ring: show compact usage value alongside limit
• Whatsapp: improve phone verification
• Webhooks: add create/delete to the public webhooks API

• Worker: type condition-evaluator operator as OperatorType
• unrelated contact and webhook payload fixes
• Comment-automation: deliver flow-type private replies via comment-anchored send
• Comment-automation: post flow-type public replies as comments, not DMs
• External-webhooks: wire v1/external-webhooks route into main router
• External-webhooks: drop external-webhooks from public API spec
• freeze a workspace while it is waiting to be deleted
• Variables: show the gender word in the right language and case
• Whatsapp: connect selected phone
• Tiktok: stop dropping live inbound webhook deliveries
• Builder: resolve workspace quota gates from the owner, not the viewer
• Tiktok: read message_id from nested send response, not flat
• Whatsapp: send full card content and continue the flow after a quick reply

• Broadcasts: add Instagram and Telegram broadcast channels
• Broadcasts: add tiktok broadcast channel
• add billing menu

• Broadcasts: make TikTok broadcasts reach their recipients
• Auth: avoid logo flash and fix theme logo swap
• Quota: count workspace owner toward team-members quota
• Quota: count teamMembers as distinct humans via live DB read
• Deps: bump concurrently to ^10 to pull in shell-quote 1.8.4

• Git: require branching off main before committing

• Inboxes: add public list inboxes endpoint with internal ids
• add follow up
• Flows: add “Update Contact Data” Messenger action
• Workspaces: surface and enforce scheduled-deletion state across the app
• add condition support
• Flows: add “Get payload for Messenger Ad” and run flows from bare-ID postbacks
• Ai-agents: move bot reply delay setting into agent actions
• Questionnaires: add management flows
• Platform-credentials: add delete action and require full field input on update
• add any input option
• Integrations: store authorizing user identity on Facebook connect

• Database: run migrations sequentially
• Webchat: hide support chat widget on /webchat embed page
• Contacts: emit accurate change events for custom fields and tags
• Contacts: improve contact removal
• improve message processing reliability
• Questionnairies: update send data multi choice
• Instagram: use real access token for webhook unsubscribe
• Telegram: redirect duplicate-error to original workspace id
• Integrations: prevent duplicate workspace creation on oauth resubmit
• Database: default sequential migrations to enabled
• Builder: restrict /manage menu access to cloud edition
• Integrations: stop oauth referer from looping back to the connect page
• Integrations: simplify oauth workspace creation, surface messenger connect errors
• Integrations: don’t fail channel connect on branding write error
• Worker: make smart delay recovery more reliable

• Worker: remove unused questionnaires worker script

• Auth: add reseller SMTP routing and account credentials email template
• Worker: enable google sheets steps in flows
• Builder: restrict flow step menu to supported steps for tiktok channel
• Messenger: add “Get JSON for Messenger Ads” action
• Contacts: add phone and email filters
• Builder: replace refresh-permissions with oauth reconnect for messenger and instagram
• Worker: blocked-owner safe-return guard + soft-delete purge & trial+7d crons (2/3)
• Billing: trial-expired banner, disabled create surfaces, deletion card + docs (3/3)
• Webchat: identity-verified access tokens with rate limiting
• add smart response delay

• Integrations: unsubscribe pages from webhooks when a channel is disconnected
• only show bubble chat in main domain
• fix(worker) invalid quick replies and missing contact inbox read receipts
• Google-sheets: remove unused google drive scope
• Builder: make sequence step cards responsive instead of overflowing on narrow widths
• Conversations: stuck conversations
• Worker: resolve variables in get user data step message
• Redis: preserve rich types in withCache via superjson envelopes
• Workspaces: state 24-hour data deletion window in deletion card and alert
• Webchat: honor hideHeader/hideMessageInput config and fix visibility defaults

• Contacts: add audience filters, in-place filter editing, and faster contact search
• Worker: add AI agent reply support to comment automation
• Contacts: reliable search, audience filters, and broadcast template flow picker
• Ai: add snapshot file
• Broadcasts: preview receivers and view full broadcast details
• Billing: trial-expired read/delete-only enforcement + business-layer disconnect (1/3)
• Conversations: show comment vs DM icon in conversation list

• Flows: harden flow duplication
• Worker: trigger workspace defaultReply flow when bot can’t answer
• Messenger: show every facebook page a user manages when connecting a fanpage
• Broadcasts: keep messenger broadcasts on the selected fanpage
• Analytics: count monthly active contacts for every outgoing message
• Conversations: anchor last-message lookup on conversation lastActivityAt
• Conversations: fix empty last-message preview and show attachment count
• Messenger: disable business manager page lookup, return direct pages only
• Builder: show numbers in the app language and fix a page load error

• Integrations: unify disconnect dialogs and cleanup inboxes

• Contacts: add Contact Id column to contact export
• Ai: add OpenAI-compatible providers
• Facebook-ads: add facebook ads integration with custom audience flow action
• Variables: add contact system fields and simplify the variable picker
• add contact tagging to broadcast and sequence reports

• Worker: don’t skip fb comment automation on top-level comments
• Whatsapp: open the correct Meta screen for each connect mode
• Storage: unify public file url building in a shared helper
• Webhooks: make outgoing webhooks deliver events reliably
• Broadcast: stop retrying permanent template errors

• relicense Community Edition from AGPLv3 to MIT

• Flows: add undo/redo history to the flow editor
• Workspace: add active-hours toggle for workspaces
• Flows: add revert draft to published version
• Instagram: add Instagram via Facebook OAuth integration
• Worker: add bull-board queue inspector
• Workspace: gate channel create/edit routes on superAdmin permission
• Integrations: log webhook request body for debugging
• Integrations: log webhook request body for debugging

• workspace access now available immediately after accepting an invite
• Inbox: prevent long inbox labels from pushing buttons out of view
• Variables: correct system attribute rendering, subscribed date, and timezone handling
• Forms: localize empty-state text for all ComboboxField usages
• Workspace: invalidate member caches on workspace rename
• Ui: use current locale in formatDate instead of hardcoded en-US
• Deps: pin biome and ultracite to 2.4.16 / 7.8.3
• Comment-automation: stop silent failures in FB comment auto-reply
• Comment-reply: stop duplicate sends on retry for messenger/instagram
• Worker: skip profile lookup for outgoing echo messages
• Messenger: include Business Manager owned/client pages in getUserPages

• Contact-filter: skip subquery when no filter conditions are set

• Tiptap Editor: Add plain text editor option.
• External Request Flow Step: Add external request flow step in flow builder to call external APIs.
• Facebook Comment Automations: Post comment automations for Messenger channels to auto-reply to posts.
• Security & Scoping: Enforce workspace permission guards and contact PII scoping.
• Segmentation: Improve broadcast and contact filtering.

• Make quick reply buttons reliable across every channel.
• Fix contacts list sorting and filtering.
• Fix contacts export to include all matching contacts, not just the current page.
• Fix flow message ordering.
• Fix help item validation.
• Messenger: Handle failed attachment downloads and dedupe duplicate URLs.

• Builder: Replace hardcoded UI strings with translations.

• Enterprise Licensing: Add offline Ed25519 license verification and entitlements for self-hosted versions.
• Persona Action: Add Flow Builder action “Set Persona” for Messenger to change Bot profile on the fly.
• AI Agent Rich Responses: Implement rich response capabilities for AI Agent replies.
• Custom Domain Tenancy: Anchor tenant settings URLs to custom domain for Whitelabel accounts.

• Worker: Skip lastIncomingMessageAt update for post comments.
• Integrations: Use broker callback URL for Telegram webhook registration.
• Integrations: Allow non-owner workspace members through OAuth callback.
• Builder: Show both super admin and platform admin nav links.

• Pin @codemirror/state to 6.7.0.

• New Chat Widget: Revamped and highly customizable website chat widget.
• User Quotas: Add user quota system for resource limitations.
• Email Templates: Customizable HTML email templates.
• MCP Server CLI tools: Dynamic tool generation from public OpenAPI spec.
• Manage Workspace SaaS & Reseller Portals: Dynamic Saas portal navigation and Reseller dashboard on sidebar.
• AI Image Generation: Enable AI Agent to generate images in-chat.
• E-Commerce Products: Store and manage products directly.
• TikTok Channel: Native support for TikTok channel integration.
• Claude & Deepseek: Native support for integrating Claude AI and Deepseek AI.
• Two-way Tag Syncing: Synchronize tags with Messenger labels and Zalo OA tags automatically.
• Facebook & Instagram Post Comments: Receive, reply, edit, delete, like/hide comments.
• Flow Version History: Flow version history with restore/rollback features.
• Integrations: Mailchimp, Klaviyo, ActiveCampaign, Drip, Moosend, GetResponse email integrations.
• Whitelabel Isolation: First-class Tenant table for full Whitelabel isolation.
• AI Message Sharding: Optimize storage and speed for high volumes of AI messages.

• Fixed issues with connection drops, timezone parsing, webhook duplication, and attachment validation.

• Credentials Encryption: Encrypt provider credentials (WhatsApp, Messenger, Instagram, Zalo, Stripe, Giphy) using AES-256-GCM. Self-hosted deployments require setting up ENCRYPTION_KEY.

• Connect to Human: Hand off conversation to human agents.
• AI Function Management: Edit, duplicate, and delete tools for AI Agent.
• Public API v1: Workspace token APIs (error logs, templates, teams).
• AI Text Status: Handle success/error paths for AI text generation.

• Refactor folder and bot-field business logic to service layer.

• SMTP Channel: Connect custom SMTP servers.
• Realtime Whitelabelling: Whitelabel support for realtime web sockets.

• Reload conversation list upon archiving.
• Resolve WhatsApp manual connection errors.
• Fix contact analytics rendering.
• Correct Magic Link redirects.

• Multi-Platform: Connect across WhatsApp, Facebook, Instagram, Telegram, Zalo, Email, and Webchat
• Visual Flow Builder: Drag-and-drop chatbot builder with 15+ node types
• AI Agent: AI-powered responses and actions using OpenAI or Gemini
• Live Chat Inbox: Real-time inbox with human takeover and conversation assignment
• Contact CRM: Manage contacts with tags, custom fields, and segmentation
• Broadcasting: Send targeted messages to specific contact segments
• Sequences: Automate drip campaigns with scheduled messages and auto-enrollment
• Team Management: Invite team members, assign roles, and manage permissions
• Rich Messaging: Support for buttons, quick replies, and carousel cards
• A/B Testing: Test and optimize different message flows
• Triggers: Execute actions based on events within your bot
• Webhooks & HTTP: Integrate external APIs directly into your flows
• Growth Tools: Generate conversation starter links for each platform
• Analytics: Track performance metrics, user engagement, and campaign results

• Change docker registry to ghcr.

• Storage Replacement: Move from MinIO to a Rust-based filesystem (rustfs) to optimize file storage.
• Cache Invalidation: Invalidate workspace cache immediately on workspace creation.
• Dynamic Builder URL: Dynamic builder URL for Whitelabel customization.
• Zalo OA Tag Syncing: Synchronize contact tags with Zalo OA.
• Personas Integration: Improved interface for creating chatbot personas.
• Branding Customization: Customize logo, primary color, and favicon directly.

• Fix Google Sheets integration connection errors.
• Fix URL encoding during Zalo OA redirection.
• Fix Reflink activation within the chatbot.
• Limit the number of Quick Reply buttons and Carousel card titles to prevent Meta API rejections.

• Public API: Deploy public API endpoints to retrieve contacts, update attributes, and trigger flows.
• Debounce Automated Responses: Debounce message delivery to avoid double-replying.
• Email Channel: Process inbound and outbound emails inside the shared inbox.
• Magic Link Login: Secure passwordless login using one-click magic links.
• A/B Testing: Split traffic randomly inside flow builder to A/B test messages.
• Telegram & Instagram: Native integrations for Telegram accounts/bots and Instagram Business profiles.

• Omnichannel Conversation: Maintain a unified chat history across multiple channels (WhatsApp, Zalo, Messenger, etc.) for a single contact.
• Snowflake ID: Use Snowflake IDs for all database entities to boost query speed and scale.

• Launch ChatbotX — an open-source omnichannel chat marketing platform
• Connect WhatsApp, Messenger, Instagram, Zalo, and Webchat in one place
• Build AI agents to automate conversations, capture leads, and drive sales
• Create powerful automation flows across all channels with a unified builder
• Centralize contacts, data, and analytics into a single dashboard
• Support both broadcast campaigns and 1:1 conversations seamlessly
• Integrate with APIs and customize freely with an open, developer-friendly architecture