Changelog v6.8.9

Every notable change to Abhiron, newest first.

Version 6.8.9 Current

October 26, 2026 · AI keys, social inbox, TikTok, YouTube and notifications.

Bring your own OpenAI or Gemini API key, encrypted in Supabase Vault, with a cost-tiered model catalog, clear provider errors and automatic model fallback.
Facebook Page, YouTube, LinkedIn and TikTok comments arrive in the Inbox, and agents reply from the Inbox.
TikTok Business direct messages in the Inbox, an AI chatbot for TikTok DMs and a dedicated TikTok settings group.
YouTube connects with Google and stays connected through automatic token renewal.
Unified header notifications across every module, with category filters and working deep links.
Responsive inbox layout, conversation row actions, member names in ownership transfer and paginated activity timelines.
Fix re-adding a removed AI key, campaign template previews and webhook origins behind reverse proxies.

Upgrade: Apply all pending migrations through 20261026003000_byok_reuse_orphan_vault_secret.sql. Set TIKTOK_BUSINESS_APP_ID/TIKTOK_BUSINESS_APP_SECRET and YOUTUBE_CLIENT_ID/YOUTUBE_CLIENT_SECRET for the new channels, and store the cron Vault secrets abhiron_cron_base_url and abhiron_cron_token so scheduled jobs reach the app. See downloadable v6.8.9 release notes.

Version 6.6.8

October 24, 2026 · Inbox, project work, dashboard, reminders and notifications.

Improve inbox layout, chat list, composer previews, quoted replies and WhatsApp retry guidance.
Add channel-specific notification sounds, a volume control and task reminder settings for app and email.
Add project logos and colors, rich descriptions, task status indicators and permission-aware actions.
Correct dashboard lead, customer, pipeline and combined CRM/Project task states and counts.
Improve notification action menus and deep links to tasks and projects.

Upgrade: Apply pending migrations to the linked Supabase project, including 20261024223000_activity_notifications.sql, before enabling database-backed activity alerts. See downloadable v6.6.8 release notes for release highlights; detailed verification status remains in the source release record.

Version 6.5.7

Released October 19, 2026 · Navigation, inbox, tenant reliability and deployment update.

This release improves global search, tenant and workspace switching, the inbox experience, compact navigation, workspace member identity, payment-link currency controls, integrations, and Cloudflare deployment.

Add per-category Global Search pagination and fix message-result deep links.
Add Super Admin tenant creation and improve production organization/workspace switching.
Consolidate the Inbox header, improve composer spacing and keep newly opened conversations pinned to the latest message.
Respect user and platform 12/24-hour preferences for inbox message timestamps.
Load workspace member identities through a workspace-scoped directory function with secure fallbacks.
Add compact sidebar group flyouts and expose Google Sheets as a truthfully gated integration.
Replace the payment-link currency text field with an Admin-configured dropdown, filtered by the selected provider and enforced on the server.
Split Cloudflare deployment into a local build and a centralized prebuilt upload that binds exactly one requested domain.

Upgrade note: Apply 20261019150000_workspace_member_directory.sql before validating the Team directory. Configure CLOUDFLARE_WORKER_NAME, CLOUDFLARE_DOMAIN, and CLOUDFLARE_ZONE_NAME in local ENV, build with npm run build, then upload the prebuilt artifact with npm run deploy:cloudflare.

Version 6.4.5

Released October 18, 2026 · Admin control-plane and platform governance update.

Super Admin settings and permissions get a pass: richer email templates, finer-grained feature toggles, a fixed invite-permission gap, and several admin UI reliability fixes.

Unify every native checkbox across the app (~24 files, including sign-in's "Keep me signed in") onto the shared accessible Checkbox component.
Rebuild Email Templates (Super Admin > Settings) with 7 pre-filled system patterns — welcome, verify email, reset password, team invitation, trial ending, payment failed, invoice — each with a relevant variable list insertable into Subject/Body by click or drag-and-drop.
Fix a permissions gap: accepting a workspace invitation never assigned a matching system role, so invited agents/viewers/admins got zero page permissions (an almost-empty sidebar). accept_workspace_invitation() now assigns the matching role automatically, with a backfill for already-invited members.
Extend Feature Toggles with six new platform modules (Project management, Ecommerce, Appointments & booking, Helpdesk, Live chat, Chatbots) plus per-module sub-feature toggles, wired into the existing route-gating logic.
Fix AI Providers deletion: use a shadcn confirmation dialog, remove a successfully deleted provider from the list and counters immediately, then refresh the registry. Failed deletion keeps the provider visible. Cancel, success, failure and delayed-refresh UI tests pass.
Improve inbox media downloads, CRM and project task creation from conversations, rich-text editing, attachment scheduling, customer notes, and the grouped conversation actions menu.
Add Project Management screens, task and team workflows, Kanban task details, conversation links and project deadline reminders. See the deployment and access guide; production multi-user verification remains open.
Add pagination to Developer Tools > Webhook Events (10 per page) instead of one long scroll.
Add a search box to the Super Admin sidebar to filter admin pages by name.

Upgrade note: Apply migration 20261018150000_auto_assign_role_on_workspace_invite.sql to fix existing invited-member permissions. Email Templates changes affect only the Super Admin editor and saved setting; outgoing transactional email (welcome/verify/reset/invite/billing) does not yet read from it.

Unreleased Updated October 18, 2026

In progress: replace the active Lovable Cloud authentication, connector and AI gateway paths with Abhiron-owned configuration and direct provider APIs. This work has passed local checks but has not been deployed or released. See the running change record and rollout checklist.

Use Supabase Auth directly for sign-in; remove the Lovable auth broker, preview auth storage, error reporting, email event route and active App User Connector gateway client.
Connect Google Workspace and Google Booking Calendar through Abhiron OAuth callbacks, encrypted server-side refresh tokens and direct Gmail, Drive, Calendar and Contacts APIs. Connect Microsoft 365 Booking Calendar through Abhiron OAuth and Microsoft Graph.
Route AI requests to configured providers directly. Continue to read legacy lovable AI provider records through the Gemini adapter without deleting existing records.
Replace the Lovable Vite wrapper with direct Vite, React, Tailwind, TanStack Start and Nitro configuration in vite.config.mts. The default build target is now node-server; specify NITRO_PRESET=cloudflare-module for Cloudflare.
Remove obsolete Lovable SDK dependencies and active gateway setup copy; use local backup and Resend email defaults.
From three client videos: wait for Instagram carousel media readiness, add Facebook and TikTok post previews, prevent repeated sends of published social targets, and allow confirmed deletion of archived drip sequences.
Handle Resend inbound email.received events by retrieving the message and up to ten attachments, then importing them into the app inbox with retry-safe storage.
Add Vault-backed campaign-dispatch and drip-tick schedules in a pending migration. Applying it can send existing queued messages; review the queue and cron secrets before rollout.
Pause TikTok direct posting until explicit creator privacy, interaction, disclosure and consent choices plus posting-status verification are implemented. The previous public default was unsafe.

Rollout: Apply the pending OAuth/Calendar migrations, set server-only OAuth credentials and a stable encryption key, register callback URLs on the actual deployed host, then reconnect accounts that used Lovable connector keys. Review pending campaign messages before applying the new cron migration. No Lovable gateway key is needed. Live provider flows and deployment still need verification.

Version 6.3.2

Released October 14, 2026 · Customization and signed-in navigation update.

Workspace themes and white label controls now live in one grouped Customization page, with clearer saves and resets, stronger access controls, and improved dark mode contrast.

Consolidate Themes and White Label under Settings > Customization. Group brand colors, theme library, other colors, typography, layout and default mode under Visual design; group identity and logos, login page, email and domain under Brand touchpoints. The former Themes route redirects to Customization.
Simplify Brand colors to the workspace brand and accent colors. Give them a focused save action; Use theme colors clears only those two overrides without changing the selected theme or the user's light/dark preference.
Add adjustable text, app border and sidebar border colors. Improve contrast and visibility in the sidebar, top bar, footer, workspace switcher and theme menu, including dark mode.
Replace the duplicate reset and discard controls with a confirmed Reset section to defaults action. It saves defaults for the active section without resetting other sections; other settings retain their Save changes action.
Limit Customization navigation, direct access and server writes to workspace owners and admins. Remove custom CSS and JavaScript controls, and stop returning or injecting stored custom code in tenant sessions.
Add 20261014130000_white_label_border_colors.sql for text and border overrides with a schema-cache reload. Other White Label settings can still save before this migration; saving non-empty new color overrides requires applying it.
Redirect signed-in users from the landing, Features, Pricing, About and Contact pages to the dashboard. Wait for browser auth before rendering marketing content, preventing the page flash on refresh and OAuth return.
Correct the Cloudflare Worker deploy command.

Upgrade note: Marketing content is now client-rendered; review search indexing after deployment. Production site behavior and database migrations still require live verification.

Version 6.2.2

Released October 13, 2026 · Reliability and workspace integrity update.

Version 6.2.2 improves inbox and contact reliability, campaign and drip workflows, integration persistence, billing workspace isolation and production startup.

Inbox and contact reliability

Resolve Messenger recipient names and search imported contacts correctly; refresh inbox messages after separate-page sends and on polling or focus.
Clear incompatible conversation selections when changing channels or accounts, continue pagination through undated conversations, and preserve scalar contact names, phone numbers and email addresses during edits.

Campaigns and drip sequences

Keep campaign dialog actions accessible, surface upload and queue-stat errors, refresh private media URLs at delivery, and show stalled-queue diagnostics.
Add editable drip steps, checked activation, manual enrollment and future-contact welcome enrollment. Stage dispatch and enrollment updates transactionally with recipient eligibility checks and replay protection.

Integrations and OAuth

Use the canonical application origin and reuse exact signed callback URLs for social OAuth authorization and token exchange.
Add Google Workspace gateway administration, encrypted server-side credential persistence, workspace-scoped account restoration and checked connection actions. Scope installed integration metadata by user and workspace.

Billing integrity and workspace isolation

Save invoice and quote headers and lines atomically, preserving original content when validation or insertion fails.
Reject cross-workspace payment, document-line and product references at the database boundary. Recalculate both documents when moving payments or lines, restore payment states correctly and preserve shared deal totals.

Startup and compatibility

Stop the retired service-worker registration and reload loop while preserving unrelated workers and caches. Render the root error page without requiring the failed root query provider.
Correct the animation-module import, conversation account typing and integration dialog HTML semantics.

Upgrade and verification

Apply both 20261012 migrations with the matching application build. Existing historical billing workspace mismatches require separate review; these guards do not automatically repair old records.
Local verification passed 811 regression tests, 79 PostgreSQL checks, the full typecheck, the production build and four public browser smoke checks. Live OAuth, provider ingestion, campaign delivery and authenticated staging checks remain required.
Automatic drip enrollment currently covers future-contact welcome journeys; birthday, anniversary, no-reply and stalled-lead event integrations remain separate work.

Version 6.0.0

Released October 2026 · Major reliability, integrations & UX milestone.

New integrations & OAuth

Google Workspace OAuth — fully implemented: replaced the "Not available yet" placeholder with a real OAuth popup flow backed by the Lovable App User Connector gateway. The connection dialog opens a popup, exchanges the code server-side, fetches the authenticated email via /oauth2/v2/userinfo, and upserts the token into installed_integrations. Disconnect is clean. Granted scopes: gmail.readonly, gmail.send, drive.readonly, calendar, contacts.readonly. Required env var: GOOGLE_WORKSPACE_APP_USER_CONNECTOR_CLIENT_API_KEY.
Social Studio — redirect-URI guidance for TikTok & LinkedIn: the OAuth channel-connection panel now surfaces the exact callback URL (/api/public/social/callback) that must be registered in TikTok Developer Portal and LinkedIn Developer App settings before initiating the OAuth flow, eliminating the most common "redirect_uri mismatch" error for these platforms.

Messaging & inbox fixes

Messenger unknown-contact names fixed: inbound Messenger messages no longer appear under a raw UUID. The webhook handler now calls the Graph API (/v21.0/{sender_id}?fields=name) to resolve the sender's display name and falls back to "Messenger user <id>" when the API is unavailable, preventing blank or UUID-labeled conversations in the inbox.
Messenger webhook diagnostics — verify-token check: the Meta App status panel now includes a dedicated META_WEBHOOK_VERIFY_TOKEN stored diagnostic row. Administrators can immediately see whether the missing META_WEBHOOK_VERIFY_TOKEN (or legacy MESSENGER_WEBHOOK_VERIFY_TOKEN) environment variable is preventing the webhook subscription challenge from completing, with a step-by-step remedy.
WhatsApp template wizard — Submit to Meta always visible: the template editor dialog was reworked from a single scrollable container to a flex flex-col layout with a shrink-0 sticky footer, ensuring the "Submit to Meta" / "Save & resubmit to Meta" button is always reachable regardless of screen height. The button was also renamed from "Save & submit" for clarity. Previously the footer scrolled out of view on any screen shorter than the full form height.
Template preview dialog — responsive sizing: the inbox template-preview dialog now applies sm:max-w-4xl max-h-[90vh], preventing overflow on screens narrower than 1280 px.

E-commerce & billing

Shopify product sync — 250 products per page: the store-sync server function now uses the Shopify API maximum of 250 products per request (previously hardcoded to 100 for all platforms), reducing round-trips by 60 % for large catalogues. WooCommerce retains 100 (its own REST API maximum). The pagination cursor loop and Link-header parser were already correct and required no change.
Billing documents — workspace currency displayed on load: the billing-documents route now reads currency via useTenantCurrency() with a useEffect sync guard instead of a one-shot useState initializer. ZAR, EUR, GBP, and any other non-USD workspace currency now appear correctly on first render without a hard refresh.
PDF print — iframe clone approach: the printDocument() helper was rewritten to clone the printable node into a hidden iframe and call contentWindow.print(). The previous window.print() call produced blank pages or unstyled output because the main document's stylesheets were not available in the print context.

Booking & marketing

Booking module — Appointments tab opens first: the booking overview defaulted to the "Availability" tab on load. The defaultValue prop is now correctly set to "appointments", matching user expectation that the primary view is the upcoming-appointments list.
Drip sequences — Pause / Resume / Activate actions: the drip-sequence panel now renders a SequenceActions component for each row, surfacing contextual per-sequence actions: Pause (running), Resume (paused), and Activate (draft). The previous implementation showed a static placeholder with no controls.

Security & correctness (backend)

Webhook workspace scoping — cross-tenant receipt poisoning fixed: processStatusEvent in webhook.server.ts now receives the resolved account object and scopes every message_outbox and messages query to workspace_id. Previously a delivery receipt arriving on one workspace's webhook could update a message row belonging to a different tenant.
Filter-injection via .or() fixed: raw string interpolation in the inbound-message deduplication query was replaced with a properly quoted filter, preventing a crafted wamid value from escaping the intended filter and matching arbitrary rows. The inbound duplicate check also now includes workspace_id so cross-workspace false-deduplication is impossible.
applyWaMessageStatus cross-workspace protection: the WA status handler in wa-inbox.server.ts now requires an explicit workspaceId parameter and scopes its update query accordingly, preventing a QR-webhook delivery event on workspace A from silently marking a message as "read" in workspace B.
Scheduler double-dispatch race fixed: the drip-sequence / scheduled-message processor in scheduler.server.ts was replaced with an atomic UPDATE SET status='processing' RETURNING * claim step. Two concurrent worker instances can no longer both read the same "pending" row and dispatch the same message twice.
AI conversation stream — overrideConfig allowlisted: the /api/ai/conversation-stream route previously accepted any key under overrideConfig. It is now restricted to language and tone only; attempts to inject model, tool-call config, or other keys are silently discarded, closing a prompt-injection escalation path.
Workflow-queue and analyze.server hooks — supabaseAdmin enforced: two server-side hook handlers (workflow-queue.ts and analyze.server.ts) were constructing a raw Supabase client with the service-role key, bypassing the demo-mode write guard. Both now use the centralised supabaseAdmin singleton so demo instances cannot be written to through these paths.
Billing — previewPlanChange auth gate added: plan-change.functions.ts was missing the assertOrgAdmin check. A non-admin workspace member could previously call the preview endpoint and observe pricing data for plans above their current entitlement. The check is now the first operation in the function.
Coupon redemption — race condition fixed: the invoice engine replaced a racy read-modify-write (SELECT UPDATE in two round-trips) with a single optimistic conditional UPDATE WHERE remaining_uses > 0 RETURNING *. High-concurrency checkout flows can no longer over-redeem a limited coupon.
Sales realtime subscriptions — workspace_id filtered: the use-sales-realtime.ts hook's Supabase Realtime subscriptions on quote_line_items and invoice_line_items lacked a workspace_id filter. Any line-item change anywhere on the platform would trigger UI refreshes for every active sales tab across all tenants. Both subscriptions now carry an explicit workspace_id = eq.<id> filter.

Builder & widget fixes

Flow Builder & Chatbot Builder — sidebar auto-collapse: opening the Flow Builder or Chatbot Builder now automatically collapses the main application sidebar, giving the full viewport width to the builder canvas. Closing the builder restores the sidebar to its previous state. Previously the sidebar remained open and overlapped the builder at smaller viewport widths.
Live Chat widget — session reuse hardened: the widget runtime now stores visitorKey and session token as separate local-storage keys and validates both independently on page reload. A stale or mismatched token no longer causes the widget to silently fail to reconnect; it starts a fresh session instead. Covered by the full 704-test widget suite.
Tenant accent-colour — foreground always white: accentForeground() in accent-color.ts now unconditionally returns #ffffff. Previously the function ran a contrast calculation that could return near-black on mid-tone brand colours (e.g. #D81C20), and a CSS variable injection at runtime would override the static stylesheet's white, making button labels and badge text illegible. Contrast is now maintained by accentStrong() darkening the fill, not by darkening the text.

Demo & onboarding

Demo seed data — two realistic workspaces: fresh installations now receive pre-seeded demo data for both built-in accounts. The agent@demo.com workspace ("Wellness Hub") includes 12 conversations and 37 messages across WhatsApp, Messenger, and Live Chat channels with realistic health-and-wellness scenarios. The user@demo.com workspace ("Northbridge Goods") includes 12 conversations and 35 messages covering e-commerce support scenarios. Evaluators and new team members can explore every inbox and CRM feature without needing to generate test traffic.

Developer quality & React correctness

Hook scope fixes across 7 files: useZonedDateFormatter and useTenantCurrency calls that were conditionally invoked inside callbacks, event handlers, or nested functions were lifted to unconditional component top-level scope. This eliminates "rendered more hooks than previous render" runtime errors in the booking calendar, billing documents route, and related views, and brings every affected component into compliance with the React Rules of Hooks.
Zero TypeScript errors maintained: all changes ship with 0 tsc --noEmit errors. Strict-mode compilation confirmed after each fix.

Version 5.0.0

Rebrand — Abhiron end to end 5.0.0

App-wide sweep: 500+ retired-brand references replaced across 130+ files, including the SDK/CLI package name (@abhiron/sdk, @abhiron/cli), the outbound webhook signature header (x-abhiron-signature), the public API host, environment variable prefixes, the mobile app's bundle identifier and package name, the Docker image name, and the nginx site config.
Fixed two pages left broken by an earlier, incomplete rebrand pass: the homepage meta title and the About page description had the brand name silently deleted rather than replaced — both now interpolate the brand name correctly.
Canonical, share-link and Open Graph URLs that pointed at a placeholder preview address now point at the real production domain.
Database rebrand: the platform-wide brand name setting, workspace white-label overrides, marketplace plugin publisher names, integration docs URLs and taglines, plugin category copy, a stray column default, and two pg_cron scheduled job names all now read Abhiron.
The documentation portal — this changelog, the docs index, status and support pages, including the header logo mark — reads Abhiron throughout.
Browser storage keys fold forward automatically from either retired brand namespace into the current one on first load (storage schema bumped), so active organization, workspace, favorites and preferences survive the upgrade with nothing for the user to redo.
The legacy-brand template scanner (Super Admin → notification template preview) and the outbound-branding and database rebrand CI guards were updated to flag the retired names instead of the current one, so stale copy can't quietly creep back in.

Channel picker redesign

The inbox “Reply via” channel switcher, the inbox's channel/account selector, the contact timeline's channel filter, and the “link a channel identity” dialog now render every channel as a colored icon chip instead of a flat, uncolored icon.
The shared channel icon component gained a boxed chip variant plus coverage for Live Chat, Discord, Slack and Teams, so every picker in the app draws from one consistent, branded palette.

Release

Version bumped to 5.0.0 across the app, this documentation portal, the release manifest, the downloadable PDF release notes, Docker Compose defaults, and the marketplace listing.

Version 4.8.8

Security & RLS hardening: fixed a PostgREST filter-injection path, restricted billing_documents deletes, locked down public.settings, and tightened policies on payment_methods, billing_document_templates, and workspace_invitations so invite tokens are readable only by an admin or the invitee.
SECURITY DEFINER functions audited and pinned to a fixed search_path, licensing logic isolated, and administrative functions refactored to verify the caller before doing privileged work.
Rate-limiting restored for vcard_views, social channel tokens moved behind column-level grants, and an XSS sink in the public footer removed.
New RLS regression suites: a DB-free static migration policy guard plus a live per-role harness that mints ephemeral users for every organization and workspace role, covering insert/update/delete on billing templates, invite-token privacy, and cross-tenant denial for every role.
Automated security scans wired into CI so new findings block merges.
Developer Center RBAC: navigation entries and sensitive actions are hidden for users without the required organization role — not just blocked by route guards — with requireOrgRole loader guards and integration tests asserting 403 behaviour.
The 403 page now names the missing organization role and links to team & roles so users can request access.
In-app organization switcher for the Developer Center and org-scoped API key management with selectable scopes.
WhatsApp Forms (Meta Flows) end to end: publishing, a composer picker, and nfm_reply ingestion, plus centralized WhatsApp Catalog logic.
Friendly error messages when publishing a form or sending from the composer fails, translating raw Meta and backend errors into actionable guidance.
Organization settings load reactively, Super Admin brand leaks fixed, Billing portal empty states corrected, and Developer Center / Booking overview crashes resolved.
Faster builds: incremental TypeScript compilation and query typing fixes cut warm typechecks to seconds.

Version 4.2.2

The product is now Abhiron end to end — app UI, documentation portal, changelog, deployment manifests, SDK/CLI package names, and stored marketplace copy — with browser storage keys migrated automatically so active organization, workspace, and preferences survive the rename.
Fixed outbound messages stalling in “queued”: composite WhatsApp thread keys now resolve to the correct recipient, with automatic retry for messages stuck longer than 20 seconds.
Unsupported WhatsApp media types (WebP images, WebM audio) are delivered as documents instead of failing with a media upload error; voice notes record as OGG/Opus.
Attachments and downloads work across the app — outbound media creates attachment records visible in the conversation, media lightbox, and CRM profile, with blob-based downloads plus an explicit error state and retry.
Inbox sync status consolidated into a single info popover showing last sync time, duration, item counts, and recent runs.
Sidebar menus behave as an accordion: one section open at a time, state persisted across navigation, with smooth collapse and expand animations.
Automated security scanning in CI, plus audited agent, user, and RLS coverage across the platform.

Version 4.0.0

Subscription plans are now fully linked to payment gateways: per-plan price/product mapping, workspace-level overrides, environment-aware resolution, and an admin "verify mappings" action that syncs live from the gateway API.
Billing webhooks normalize Stripe and Paddle events into a single router that keeps subscription status, renewals, and cancellations in sync automatically, with signature verification and a replay tool for failed deliveries.
Full upgrade/downgrade flow — plan change wizard, checkout hand-off, entitlement refresh on return, and a billing settings page with invoices and subscription history.
Redesigned marketing site: new landing page, live pricing driven by real plans, monthly/yearly toggle, plan comparison table, current-plan badges, and smooth in-page scrolling.
WhatsApp templates enforce strictly numbered placeholders ({{1}}, {{2}}); named variables are auto-converted on import with a field-by-field preview, plus URL button query/fragment parameter mapping.
Version 4.0.0 consolidates the 3.9.x billing and platform work into the first fully self-serve release: sign up, pick a plan, pay, and get entitlements without admin involvement.

Version 3.9.0

Super Admin consoles for AI providers and payment gateways, including credential storage with column-level protection, connection tests, and a gateway health widget.
Platform audit logging for every gateway and plan-linkage change, plus a webhook delivery health panel with per-event status.
Plan → gateway price mapping (plan_gateway_prices) with workspace-level overrides, environment-aware resolution, and server-side conflict detection for duplicate mappings.
Localization rebuilt for 100+ languages with full RTL support and generated locale data.
Platform Settings: General, Branding, Maintenance mode, and feature flags now apply globally at runtime.
Drag-and-drop uploads for logo, favicon, and PWA icons backed by a private branding bucket with a streaming public endpoint.
Accessible accent-colour engine — contrast is measured and adjusted instead of blocking the save.

Version 3.8.9

WhatsApp templates can be picked, previewed, and sent directly from the Inbox, with markdown-accurate bubble previews and manual Meta sync.
Template parameter editor with auto-suggested values from the contact/CRM record, reusable saved presets, and strict inline validation that blocks invalid sends.
Friendly Meta delivery error mapping (including #131030 recipient-not-allowed) with retry suppression for unrecoverable failures.
Meta App settings screen for App ID/Secret with live connection verification, plus a Facebook Pages manager showing Messenger capability status and safe disconnect/reconnect.
Multi-bot Telegram support — several bots per workspace, each as an independent Inbox account with its own webhook and outbound token.
Unified Inbox fixes: correct contact/conversation mapping for Telegram ingest, webhook idempotency, and a double-increment unread-count bug removed (DB trigger now owns unread state).
Realtime outbound updates and monotonic delivery-status guard so “read” can never regress to “sent” on out-of-order receipts.
Live Chat widget: unified realtime status line, Supabase broadcast updates, required pre-chat fields, and fixed agent handoff/assignment.
Security: tightened RLS across API keys, OAuth clients, webhooks, meeting credentials, and WhatsApp catalog; template RBAC with full audit logging; extensions moved out of public; CI blocks merges on new scan findings.
UI consistency: standardized h-8 w-8 icon buttons app-wide and default accent locked to #D81C20.

Version 3.8.8

App-wide realtime with burst deduplication, coalesced query invalidation, and exponential-backoff reconnection.
Inbox sync settings with background refetch, and a media lightbox for images, video, and documents.
CRM contact identity and cache keys unified so profile edits propagate everywhere instantly.
E.164 phone validation for WhatsApp template sends and template version history.

Version 3.8.7

Conversation transcript export and cross-platform typing indicators.
Agent notifications for assignment, handoff, and SLA breaches.
Flow Builder workspace security — loader-level access guards with live revocation and no data reads on denied opens.
TypeScript build performance work; typecheck time reduced from timeout to roughly 35 s.

Version 3.8.6

Email and SMS channel accounts added to the omnichannel model.
Thread deduplication and hardened conversation merging to stop duplicate chats.
Live Chat widget requires contact details before starting, with fixed media rendering.
RLS corrections for contact re-match jobs, inbox agent assignment, and mobile AI endpoints.
Security CI gate blocking merges on new scan findings; database extensions moved to an extensions schema.

Version 3.4.6

Production-ready Setup Wizard (6 steps) with server-side lock and route guards.
Centralized Environment Mode System (Demo vs Production) with demoWriteGuard.
Enterprise PWA with dynamic manifest, custom service worker, and admin-controlled icons.
Responsive navigation — full sidebar > 1200 px, mini rail 768–1200 px, drawer < 768 px.
Security hardening — XSS remediation, CSP headers, HIBP password check, RLS enforcement.
Auth listener filtered — no more hourly router thrashing on TOKEN_REFRESHED.
Overhauled documentation portal with sidebar nav, search, and syntax highlighting.

Version 3.4.0

WhatsApp Cloud API provider abstraction, webhook processing, and template sync.
AI Chatbot Builder, Live Chat Widget, and Helpdesk module.
Stripe billing, SaaS plan management, and revenue snapshots.

Version 3.3.3

Project Documentation System v1.
Node.js 22 deployment support for cPanel/LiteSpeed.
Swapped xlsx for SheetJS CDN (CVE mitigation).