=== PhiXtra - AI Shopping Assistant Agent ===
Contributors: phixtra
Tags: woocommerce, ai, chatbot, customer support, shopping assistant
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 8.0
Stable tag: 3.9.7
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Add an AI-powered shopping assistant agent to your WooCommerce store using PhiXtra — helps customers find products and get support.

== Description ==

The PhiXtra AI Shopping Assistant is an AI-powered shopping assistant agent for your WooCommerce store — it chats with customers, helps them find products, answers questions, and provides support.

**You need a PhiXtra API key** to use this plugin. Get one from:
https://portal.phixtra.com/

== Features ==

* AI-powered support and shopping assistant
* Secure API key authentication
* Customizable branding (colors and fonts)
* Free Trial and Upgrade links (optional)
* Built for WooCommerce

== Installation ==

1. Upload the plugin folder to `/wp-content/plugins/` or install via Plugins → Add New.
2. Activate the plugin through the 'Plugins' menu.
3. Go to **PhiXtra AI** settings.
4. Enter your PhiXtra API key and save.

== Frequently Asked Questions ==

= Do I need an API key? =
Yes. You can get a PhiXtra API key from https://portal.phixtra.com/

= Does the plugin store chat logs in my WordPress database? =
No. Chat messages are transmitted to PhiXtra for processing.

== External Services ==

This plugin connects your WordPress / WooCommerce website to the **PhiXtra AI service** (https://phixtra.com), which is required for all plugin functionality.

**Service:** PhiXtra AI Shopping & Support Assistant
**Provider:** PhiXtra (https://phixtra.com)
**Primary endpoint:** https://chat.phixtra.com

= What data is sent and when =

All outbound requests go to the PhiXtra backend at chat.phixtra.com via HTTPS POST. The specific paths and the data each one carries are listed below.

1. **Chat messages** — POST to chat.phixtra.com/chat every time a visitor submits a message in the chat widget. Data includes: the visitor's message text, the configured API key, and a pseudonymous session identifier (UUID stored in localStorage/cookie).

2. **Cart events** (WooCommerce only, when Cart Revenue Recovery is enabled) — POST to chat.phixtra.com/cart-event when a visitor adds/removes items, starts checkout, or completes an order. Data includes: API key, session ID, event type, cart total, cart line-item names/SKUs, and (if the visitor is logged in) their email address.

3. **Cart recovery check** — POST to chat.phixtra.com/check-recovery on each page load when Cart Recovery is enabled, to determine whether a recovery popup should appear for the current session. Data includes: API key and session ID.

4. **Cart recovery reply** — POST to chat.phixtra.com/cart-recovery-reply when a visitor replies inside the recovery popup. Data includes: API key, session ID, and message text.

5. **Notify When In Stock** — POST to chat.phixtra.com/notify-when-in-stock when a visitor submits their email via the "Notify me when back in stock" widget form. Data includes: API key, product ID, product name, product URL, and the visitor's email address.

6. **Stock back-in notification** — POST to chat.phixtra.com/stock-back-in when a WooCommerce product transitions to in-stock. Data includes: API key and product ID.

7. **Handoff contact capture** — POST to chat.phixtra.com/handoff-contact when a visitor submits the in-widget contact form. Data includes: API key, session ID, visitor name, phone number, and email address.

Data is only transmitted when the plugin is active and a valid API key has been saved in the settings. No data is stored in the WordPress database by this plugin.

= URL rendering in the chat widget =

The chat widget (assets/widget.js) formats URLs that appear inside AI responses as clickable hyperlinks. If a URL in the AI response does not already start with "http", the widget prepends "https://" before rendering it as an anchor tag. This formatting happens entirely within the visitor's browser; no request is made to any third-party domain by this code. The URLs rendered are those returned by the PhiXtra AI service (typically product pages on your own store).

= PhiXtra terms of service and privacy policy =

* Terms of Service: https://phixtra.com/terms-conditions/
* Privacy Policy: https://phixtra.com/privacy-policy/

== Privacy ==

All chat messages, cart events, and contact details collected by this plugin are transmitted to PhiXtra as described in the External Services section above. Site owners are responsible for informing their visitors about this data processing in their own privacy policies.

== Changelog ==

= 3.9.7 =
* WordPress.org compliance update (readme.txt only):
  - Rewrote External Services endpoint list to use plain-text hostnames instead of
    bare https:// URLs for POST-only paths, preventing the WP.org URL checker from
    issuing a false 405 error when it probes those paths with a GET request.
  - Added "URL rendering in the chat widget" section to document that assets/widget.js
    prepends https:// to bare URLs inside AI responses purely for in-browser link
    rendering, and contacts no third-party domain in doing so.
  - Updated Terms of Service link to correct URL (phixtra.com/terms-and-conditions/
    previously returned 404).

= 3.9.6 =
* WordPress.org compliance update:
  - Replaced all inline admin CSS (echo style) with wp_add_inline_style().
  - Replaced all inline admin <script> blocks with a dedicated enqueued JS file (assets/admin-settings.js).
  - Added allowlist-based sanitization for font-family setting to prevent CSS injection.
  - Added nonce verification to the /apply-recovery-coupon REST endpoint.
  - Renamed all option/function/handle names to use the 'phixaish_' unique prefix (plugin-wide rename for WordPress.org compliance).
  - Expanded External Services documentation in readme.txt.

= 1.4.0 =
* WordPress.org release.
* Settings sanitization and admin improvements.

