=== Muchat – AI Chatbot ===
Contributors: muchatai
Tags: chatbot, live chat, woocommerce, customer support, artificial intelligence
Requires at least: 6.8
Tested up to: 7.0
Requires PHP: 8.2
Stable tag: 3.0.4
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Connect a Muchat Agent for AI chat, WordPress content access, and live WooCommerce order tracking without copying API keys.

== Description ==

Muchat AI connects your WordPress site to an Agent managed in Muchat. Select Connect, sign in to your Muchat account, and choose an Agent to add its AI chat widget. The plugin also provides authenticated access to site content and live WooCommerce order tracking for a connected Muchat service.

Version 3.0 includes:

* A secure authorization-code connection with PKCE and an Agent picker on Muchat.
* Connection health, last-check information, and separate statuses for the widget, site data, and order tracking.
* A local, asynchronous widget loader using the Agent's public website token.
* Path-based rules that show the widget everywhere except selected paths, or only on selected paths.
* Optional signed identity for logged-in WordPress members. It sends the WordPress user ID, display name, and email only after an administrator enables this setting.
* Authenticated data endpoints for WordPress posts, pages, and WooCommerce products, with pagination and modification filters for Muchat synchronization.
* Live WooCommerce order tracking for guests and signed-in customers, including order status, purchased items, totals, and shipping methods.
* A native, translation-ready WordPress administration screen with bundled Persian translations and RTL-friendly presentation.

Widget appearance, greetings, persona, business hours, and order-tracking actions are managed in Muchat. Content synchronization is performed by the connected Muchat service using the plugin's authenticated data endpoints; the plugin does not start an independent synchronization job when it is activated.

A Muchat account and an HTTPS single-site WordPress installation are required. WooCommerce is optional for chat and WordPress content access, and is required for product data and order tracking. WordPress Multisite is not supported in version 3.0.

== External services ==

This plugin connects to the Muchat hosted service. Muchat provides the account login, Agent selection and management, connection provisioning, verification, and visitor chat widget that make the plugin useful. No connection request is made merely by activating a fresh installation.

When a WordPress administrator selects Connect or Reconnect, the plugin sends API requests to `https://v2api.mu.chat` and opens the account and Agent selection flow at `https://v2app.mu.chat`. These requests contain the site's canonical HTTPS URL, an installation UUID, the exact WordPress callback and REST handshake URLs, WordPress/plugin/protocol versions, the administrator's WordPress interface locale, and temporary authorization security values (state and a PKCE challenge). The administrator's browser is then sent to Muchat to sign in and select an Agent. Muchat returns a one-time authorization code to WordPress, and the plugin exchanges it server-to-server for installation credentials. Muchat contacts the registered `muchat-sync/v1/handshake` REST URL to verify that the connection is reachable. These transfers are necessary to connect the selected Agent and verify the site.

After an Agent is connected and the widget is enabled on the current path, the visitor's browser downloads `https://widget.mu.chat/sdk.js` and communicates with `https://widget.mu.chat`. Like other web services, Muchat receives network and browser information needed to serve the widget, including the visitor's IP address, request headers, and the URL of the page where the widget runs. Muchat also receives chat messages and any information the visitor chooses to submit in the chat. These transfers are necessary to display and operate the Muchat chat service.

Signed member identity is disabled by default. If a site administrator enables it, the plugin sends Muchat a short-lived signed token containing the WordPress user ID and its site/Agent binding, the logged-in member's WordPress display name, and email address. It does not send the username, password, role, phone number, or custom profile fields. If token creation fails, the widget continues anonymously.

After connection verification, Muchat can request posts, pages, and, when WooCommerce is active, products from the site's authenticated data endpoints. These responses include the content and product fields exposed by the plugin for synchronization with Muchat. The endpoints require the installation credential and its data-access scope.

When order tracking is configured in Muchat, the service sends an authenticated lookup to the site's `muchat-commerce/v1/orders/track` endpoint. Guest lookups require an order number and matching email or phone information. Signed-in lookups require the optional member identity feature. Responses include matching order statuses, dates, item names and quantities, totals, payment method labels, and shipping methods. Default responses exclude billing/shipping addresses, contact details, payment links, order keys, and internal notes. Store code can customize the returned order details through the plugin's filter. This exchange is used to answer the customer's order inquiry.

Muchat service terms: https://app.mu.chat/terms

Muchat privacy policy: https://app.mu.chat/privacy

Muchat documentation: https://docs.mu.chat/

== Installation ==

1. Install Muchat AI through the WordPress Plugins screen, or upload it to `/wp-content/plugins/muchat-ai`.
2. Activate the plugin on a single-site WordPress installation using HTTPS.
3. Open the Muchat screen in the WordPress administration menu and select Connect.
4. Sign in to Muchat, select the Agent you manage, and return to WordPress.
5. Wait for verification to complete, then configure widget visibility and optional member identity.
6. For order tracking, activate WooCommerce and configure the order-tracking action for the selected Agent in Muchat. Enable signed-in member identity if customers should look up orders linked to their WordPress account.

If you are not signed in to Muchat, use the sign-in link on the plugin settings page first. After signing in (and completing your profile if required), return to WordPress and select Connect or Reconnect. The login flow does not automatically resume a pending WordPress connection.

== Frequently Asked Questions ==

= Do I paste an API key or Agent ID into WordPress? =

No. Select Connect, authenticate on Muchat, and choose an Agent there. Secret data credentials are never displayed in the browser or stored as plaintext by WordPress.

= What does Disconnect Muchat remove? =

It first asks Muchat to revoke the backend connection. After Muchat confirms, WordPress removes the selected Agent, website token, data and identity credentials, widget settings, and visibility rules. If Muchat returns an error, the local integration remains unchanged and Disconnect can be tried again.

= What member information can be sent to Muchat? =

Nothing is sent by the identity feature until an administrator enables it. When enabled for a logged-in member, the plugin creates a five-minute signed token containing the WordPress user ID, display name, and email address. Visitors who are not logged in continue anonymously.

= Can I choose where the widget appears? =

Yes. You can show it on all paths except a list, or only on a list. Exact paths, a limited `*` wildcard, and `<front>` for the home page are supported. Hostnames, schemes, query strings, and fragments are not accepted as rules.

= Where do I change colors, messages, persona, or business hours? =

Manage those settings in Muchat. The WordPress plugin deliberately does not duplicate them.

= Does version 3.0 synchronize posts or WooCommerce products? =

It provides authenticated posts, pages, and WooCommerce product endpoints for the connected Muchat service to read and synchronize. The Muchat service manages synchronization; the WordPress plugin supplies the data. Product access requires active WooCommerce.

= How does order tracking work? =

With WooCommerce active and the order-tracking action configured in Muchat, guests can look up an order using its number and matching contact information. Signed-in customers can look up their own linked orders when member identity is enabled. A verified connection and order-tracking permission are required. The settings page shows whether order tracking is available. Order completion dates describe the WooCommerce order status; they are not shipment or delivery estimates.

= What happens when I upgrade from version 2? =

Version 3 does not automatically import the old widget connection or visibility settings. After upgrading, open Muchat in WordPress, select Connect, choose your Agent, and configure visibility again. The widget remains hidden until a new connection supplies its website token. Existing Muchat account data is not deleted by this upgrade. Plan the upgrade for a time when an administrator can complete the connection.

= Why does connection verification fail? =

If the plugin says WordPress is blocking outgoing connections, ask your hosting provider to check `WP_HTTP_BLOCK_EXTERNAL` in `wp-config.php` and add `v2api.mu.chat` to `WP_ACCESSIBLE_HOSTS`. Keep any existing allowed hosts. There is no need to disable the restriction for all external connections. If `MUCHAT_API_BASE` was customized, allow the hostname shown in the plugin's error message instead. Then try connecting again.

The WordPress server must be able to reach `https://v2api.mu.chat`, and the Muchat service must be able to reach the site's registered handshake and data endpoints. Check the site's HTTPS certificate and any firewall, maintenance, or REST API restrictions. The connection flow opens `https://v2app.mu.chat`, and the visitor widget loads from `https://widget.mu.chat`. If a Content Security Policy is in use, allow the widget's required scripts and resources. Use the settings page to refresh the connection status or retry verification when available.

= Does it support Multisite or a site without HTTPS? =

No. Version 3.0 requires HTTPS and supports WordPress single-site installations only.

== Privacy ==

The plugin stores a site UUID, connection status, selected Agent summary, public widget token, visibility preferences, and encrypted/hashed credential material in WordPress options. Uninstalling the plugin removes its version 3 options and temporary connection data locally; it does not delete chats, Agents, or other data held in the Muchat account.

The widget can send the current page URL and visitor chat activity to Muchat as described under External services. Optional logged-in member identity sends the WordPress user ID, display name, and email only when enabled by a site administrator. A verified connection also allows scoped content requests and authorized order lookups as described above. Order responses use private, no-store cache headers. Site owners are responsible for providing any notices or consent required for their visitors and jurisdiction.

For Muchat's handling of service data, see https://app.mu.chat/privacy.

== Changelog ==

= 3.0.4 =

* Allowed up to 30 seconds to start a connection during temporary network delays and added a clear timeout message while preserving recent connection status.
* Stabilized connection status during temporary network failures while keeping confirmed status freshness bounded.
* Separated status refresh from verification retries, removed outdated notices, and improved automatic recovery and Persian guidance.
* Clarified the distinction between site access, widget visibility, and adding content to a knowledge base, with a direct management link.
* Showed product, post, and page access directly in the knowledge base card, with clear missing or inactive WooCommerce messages for products.
* Kept order tracking visible on every site, with WooCommerce installation guidance when needed.

= 3.0.3 =

* Clarified connection errors, HTTP 403 guidance, and the distinction between widget visibility and verified data access.
* Added missing Persian translations and removed outdated verification notices after the connection status changes.
* Allowed failed pending connections to be verified again from Muchat and improved status refresh and expired-verification handling.

= 3.0.2 =

* Added PHP 8.2 support while retaining compatibility with newer supported PHP versions.
* Expanded automated PHP, WordPress, and browser checks to cover the minimum supported PHP version.

= 3.0.1 =

* Added clear English and Persian guidance when WordPress blocks outgoing Muchat requests through WP_HTTP_BLOCK_EXTERNAL, including the API hostname to allow in WP_ACCESSIBLE_HOSTS.
* Kept this guidance visible during connection status checks while preserving existing credentials.

= 3.0.0 =

* Rebuilt the plugin connection flow with state validation, PKCE, and server-to-server credential exchange.
* Added Muchat Agent selection and verified connection states without an embedded dashboard.
* Added the asynchronous Muchat widget loader and path visibility rules.
* Added optional short-lived signed identity for logged-in WordPress members.
* Retained compatible content and product response formats behind the new installation authentication.
* Added WooCommerce order tracking for guests and signed-in customers, with support for classic order storage and HPOS.
* Added connection health and feature-availability information with refresh and verification controls.
* Restored WordPress.org branding with standard and high-resolution icons and banners, including Persian banners for RTL pages.
* Added strict WordPress 6.8, PHP 8.3, HTTPS, and single-site requirements.

== Upgrade Notice ==

= 3.0.4 =

Stabilizes connection status, clarifies knowledge base content access, and keeps order tracking visible with WooCommerce setup guidance. Existing credentials and widget settings are preserved.

= 3.0.3 =

Improves connection verification, retry controls, and Persian error messages. Existing connections and widget settings are preserved.

= 3.0.2 =

Adds support for PHP 8.2. Existing connections and settings are preserved.

= 3.0.1 =

Improves connection error guidance for sites that restrict outgoing HTTP requests. Existing connection settings are preserved.

= 3.0.0 =

Version 3.0 is a clean implementation and does not import or migrate settings from version 2. Connect an Agent again after upgrading.
