v2.6.0

## What's new

AI features **(beta)** land in this release. Bring your own model: any OpenAI-compatible endpoint works, including a local one.

- **AI assistants** - route conversations to an AI assistant with an automation rule, it answers from your knowledge base and hands off to a human when it can't help.
- **Juno, the AI copilot** - a conversation sidebar tab that answers questions about the conversation and your knowledge base.
- **Generate reply** - draft a reply from the editor toolbar, then edit it before sending.
- **Knowledge base snippets** - write snippets by hand or import them from a URL for the assistant to search.
- **Learn from resolved conversations** - Libredesk drafts snippets from resolved conversations for you to approve or reject. Each approved one joins the knowledge base, so the assistant keeps improving over time.
- **Custom AI tools** - point an assistant at your own APIs so it can look up an order's status or update a customer's address mid-conversation.
- **Tag suggestions** - suggest tags for a conversation from your existing tag list.
- **Summarize with AI** - add a summary of a conversation as a private note.
- **Refreshed theme** - new palette and a consistent design system across the app.

## What's fixed

- Broken image thumbnails in live chat widget for S3 store.
- Fixes to pre-chat form in live chat widget.
- New opt-in `[ssrf]` guard blocks admin-configured outbound URLs (webhooks, OIDC discovery, AI provider and tool calls) from reaching private, loopback and cloud-metadata addresses. [Read more.](https://docs.libredesk.io/configuration/ssrf-protection)
- Many other quality of life fixes and improvements.

## Upgrade notes

- `webhook.allowed_hosts` is deprecated and ignored, move it to `ssrf.allowed_cidrs` and set `ssrf.enabled = true` to keep webhooks blocked from private addresses.
- Always take a database backup before upgrading.
- Follow the steps [here](https://docs.libredesk.io/getting-started/upgrade).


## Changelog
* 6496cdec Merge pull request #456 from abhinavxd/fix/http-write-timeout
* def21f89 increase default http write timeout to 60s
* 189c0860 Merge pull request #455 from abhinavxd/chore/tidy-migration-comments
* 232d4454 Merge pull request #454 from amaanJvd/fix/unsnoozer-dropped-error-log
* 081cc46a remove redundant comments in v2.6.0 migration
* 3d5d67b5 fix(log): don't drop the error in unsnoozeAll log call
* ee3a5477 Merge pull request #453 from abhinavxd/fix/ai-misc
* c25452a1 remove redundant snippet URL import hint
* f2edc74e hardcode copilot name and tidy up AI admin copy
* 859777df Merge pull request #447 from abhinavxd/feat/ai-tag-embeddings
* 5e7b1afc Merge pull request #451 from abhinavxd/fix/inline-cid-case-and-tx-linking
* 06242de1 Merge remote-tracking branch 'origin/main' into fix/inline-cid-case-and-tx-linking
* 52a455f1 link message media in one query inside the insert transaction
* 3544a80a Merge pull request #450 from abhinavxd/fix/s3-thumbnail-preview
* cda53690 use shared attachment URL signing in message handlers
* 75a09251 Fix WS image URLs
* 205ad8a2 Serve thumbnails inline
* b553e962 Keep widget images inline
* 37224b10 Clarify thumbnail store handling
* 79da9e89 Fix live chat image thumbnails
* 11d0b523 bound the tag query by tokens and always clear the tag index on purge
* 000d789e shortlist tags with embeddings before asking the LLM to suggest them
* 9c1c413f Merge pull request #446 from abhinavxd/fix-ai-reply-markdown
* 16b99069 render the generated reply as html instead of showing raw markdown
* fb4d665c Merge pull request #421 from abhinavxd/feat/ai-agent
* 5e972d1d point each AI admin page's docs link at its section anchor
* bbcc92f2 add an aria-label to the channel icon in the conversation list
* 276f19de show enabled state as a status badge and stop making checkbox fields required
* f2714621 dedup mined FAQs against question and answer so near-duplicate suggestions get caught
* 82f29f27 fix Vue onUnmounted warning on the auth pages
* 0b2ad13a Merge pull request #443 from abhinavxd/dependabot/npm_and_yarn/frontend/postcss-8.5.18
* 349e695f build(deps-dev): bump postcss from 8.5.10 to 8.5.18 in /frontend
* 4ec387a5 Merge pull request #442 from abhinavxd/i18n-guard
* 1c500edc Revert "temp: test i18n guard, do not merge"
* bcfbd454 temp: test i18n guard, do not merge
* 6d7ce3c0 require a verified contact in the example tools server and fix its README mismatches
* 71fb1978 bump the default completion model off gpt-4o-mini
* 8db2e34a show specific AI provider errors instead of a generic message
* c25ad467 run i18n guard from the base branch and fail on API errors
* e8e24197 show a clear error when the AI agent runs out of steps and hoist openai response structs
* 763bcd61 add CI check to block edits to translated i18n files
* fd21893e cache AI assistants in a store instead of refetching on every copilot panel mount
* b569777c match email quote classes exactly and enforce password length on set password
* 49c5cb34 make AI agent max steps and history size configurable
* 6b8a0f95 fix content loss in knowledge base chunking and harden AI agent limits
* 9f8f10ae drop the unenforced-rules section from the design doc
* 23938a18 rename the design doc to DESIGN.md and resync it with the code
* d8b73c58 retheme UI to the green palette and fix form and search bugs
* 712fcbb6 return clear 400 errors for invalid AI tool and snippet input
* 7c2e19b7 style sidebar section headers as labels and add design system doc
* b8b2b6c9 standardize frontend design system, fix form validation, and skip continuity/CSAT messages in AI context
* 1a0a78f4 Merge pull request #438 from chahat-101/seed-default-business-hours-sla
* 74813b2e reveal admin table row actions on hover and switch to vertical menu, add AI tool enable toggle
* d925640a drop migration, seed only in schema.sql
* 40f8284e strip quoted reply chains from AI agent message context
* d2a548ef seed default business hours and SLA policy on install
* 6125f5ce harden AI agent knowledge base, OTP, and prompt injection defenses
* cf629f34 only include checked checkbox fields in prechat form submission
* 83f9bb58 show a BETA badge on the AI admin nav item
* aa200f58 make the missing AI API key message provider-agnostic
* ae44e7f4 expand AI tool context and let contacts correct their email
* 8f8512fa apply workspace instructions even with an empty base prompt
* c74eef07 harden the AI agent run loop and admin lifecycle
* f417aacb drain AI workers on shutdown before closing the database
* ea03339b address CodeRabbit review findings in the AI agent
* 35ddfe5d make the image pixel-count guard overflow-safe
* 8bedb1a1 set OTP send-counter TTL atomically to prevent resend lockout
* c659e30e address CodeRabbit review findings in the AI agent
* 2fced942 log when the verification email no-reply guard can't be set
* 1812a032 Merge pull request #437 from abhinavxd/dependabot/npm_and_yarn/frontend/axios-1.18.0
* b4228332 build(deps): bump axios from 1.16.0 to 1.18.0 in /frontend
* 1034617b point livechat verification email replies at a no-reply address
* 7760974e send AI verification code through the conversation's inbox
* 085880d2 make OTP attempt check atomic to prevent brute-force bypass
* bfc3b6e1 gate AI custom tools behind email OTP verification
* 752e6042 drop CC'd contacts' messages from the AI agent history
* 60158595 scope copilot thinking state per conversation
* 1384fd5d scope Generate Reply tools to the conversation's contact
* f460f6b1 expand copilot with customer-history tools, persona picker, and tag suggestions
* dd3465f6 make the quoted text toggle keyboard accessible
* b570502a remember when a provider needs max_completion_tokens and track token usage
* ec5333a3 move OIDC client secret masking to the backend
* 52cebdf3 update livechat launcher logo
* b1d6fb4e limit when the AI agent appends the confirm prompt
* 35d69fc1 fix review findings in reports overview and avatar upload
* 94334a02 polish reports overview, avatar upload, and conversation list UI
* 8ac465c5 support multiple auth headers on AI tools and tune agent timeouts
* e7fa4ced fix review findings in the aiagent package
* a4be8ecb fix review findings in the ai package
* fe17af20 drop hardcoded transport fallback in ssrf.NewTransport
* 8f34fc5e guard against a replaced http.DefaultTransport in ssrf.NewTransport
* c7f55e23 guard reply-box AI prompt race and share the SSRF-safe http transport
* a3cdd711 remove inline OpenAI key prompt and reuse generating state for AI prompts
* e5ce8e33 truncate long assistant descriptions in admin table
* 0f2aef1c fix Groq and Together AI provider preset defaults
* cd7e6d9f Update README.md
* 99771a65 Update README.md
* 97c227b6 skip AI agent on non-open status categories instead of hardcoded names
* 758a01ab guard knowledge base URL import against SSRF and fix OIDC transport defaults
* eed50ef6 link SSRF docs page from SECURITY.md
* 9566dcbf apply SSRF guard to all admin-configured outbound URLs
* de8ffa5a Update README.md
* 0f818064 Update README.md
* d02b65f2 address CodeRabbit findings in AI embedding and assistant flows
* c030c9ee harden AI embedding and agent prompt handling, add tokenizer, and switch to a green theme
* 8cdfe861 add AI snippet URL import, conversation summarize, and assistant reply languages
* 616fd00d Update ROADMAP.md
* afb338cb address PR review findings in the AI agent
* 976c45df add AI provider connection test and self-heal reasoning model param errors
* e1695b78 send AI agent confirmation question as a separate widget message
* 85a38699 restrict copilot to built-in tools and add per-assistant handoff toggle
* dad99bf0 render AI agent replies as markdown and fix assistant identity, handoff, and stats bugs
* 3137a3ff add conversation attributes to AI agent prompt and mark customer data as untrusted
* 34241f7d improve AI agent context and disclosure
* a7288e11 add AI assistant expectation message shown in the livechat widget
* 44925e69 fix AI agent reply, turn-cap, and stats bugs
* 76d16285 gate AI tool identity to verified contacts and merge v2.6.0 migration into v2.7.0
* 3ba2b828 Merge remote-tracking branch 'origin/main' into feat/ai-agent
* 51d29e0e add local widget JWT test page
* 623fa2c4 load agents directly in AgentList
* c8884ec0 add AI reply-box UI and AI author links
* ac403791 improve copilot reply drafts and add presets
* ef0add0f add reasoning effort setting for providers
* 13437903 restrict custom tool methods to GET and POST
* 0d755fc7 send CSAT on every resolve path
* 16c79a27 guard AI agent replies and add prior-conversation context
* 7186c95e add WIP autonomous AI agent that replies to assigned conversations
* 2fe850a2 Merge pull request #419 from abhinavxd/dependabot/go_modules/golang.org/x/crypto-0.52.0
* 5815342b build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0
* 0ecd7839 add AI copilot backed by a knowledge base and custom tools

## What's Changed (Auto generated)
* build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 by @dependabot[bot] in https://github.com/abhinavxd/libredesk/pull/419
* build(deps): bump axios from 1.16.0 to 1.18.0 in /frontend by @dependabot[bot] in https://github.com/abhinavxd/libredesk/pull/437
* seed default business hours and SLA policy on install by @chahat-101 in https://github.com/abhinavxd/libredesk/pull/438
* add CI check to block edits to translated i18n files by @abhinavxd in https://github.com/abhinavxd/libredesk/pull/442
* build(deps-dev): bump postcss from 8.5.10 to 8.5.18 in /frontend by @dependabot[bot] in https://github.com/abhinavxd/libredesk/pull/443
* Feat/ai agent by @abhinavxd in https://github.com/abhinavxd/libredesk/pull/421
* render the generated reply as html instead of showing raw markdown by @abhinavxd in https://github.com/abhinavxd/libredesk/pull/446
* Fix live chat image thumbnails for S3 store. by @abhinavxd in https://github.com/abhinavxd/libredesk/pull/450
* link message media in one query inside the insert transaction by @abhinavxd in https://github.com/abhinavxd/libredesk/pull/451
* shortlist tags with embeddings before asking the LLM to suggest them by @abhinavxd in https://github.com/abhinavxd/libredesk/pull/447
* hardcode copilot name and tidy up AI admin copy by @abhinavxd in https://github.com/abhinavxd/libredesk/pull/453
* fix(log): don't drop the error detail in unsnoozeAll log call by @amaanJvd in https://github.com/abhinavxd/libredesk/pull/454
* remove redundant comments in v2.6.0 migration by @abhinavxd in https://github.com/abhinavxd/libredesk/pull/455
* increase default http write timeout to 60s by @abhinavxd in https://github.com/abhinavxd/libredesk/pull/456

## New Contributors
* @chahat-101 made their first contribution in https://github.com/abhinavxd/libredesk/pull/438
* @amaanJvd made their first contribution in https://github.com/abhinavxd/libredesk/pull/454

**Full Changelog**: https://github.com/abhinavxd/libredesk/compare/v2.5.0...v2.6.0