← All changes | admin/class-ajax-handler.php +638 -21 3.2.8 → 3.2.25 View file →

		@@ -27,8 +27,9 @@
27	27	private function mxchat_init_ajax_hooks() {
28	28	// Settings AJAX
29	29	add_action('wp_ajax_mxchat_save_setting', array($this, 'mxchat_save_setting_callback'));
30	30	add_action('wp_ajax_mxchat_save_prompts_setting', array($this, 'mxchat_save_prompts_setting_callback'));
	31	+ add_action('wp_ajax_mxchat_acf_toggle_group', array($this, 'mxchat_acf_toggle_group_callback'));
31	32	add_action('wp_ajax_migrate_pinecone_settings', array($this, 'ajax_migrate_pinecone_settings'));
32	33
33	34	// License AJAX
34	35	add_action('wp_ajax_mxchat_handle_activate_license', array($this, 'mxchat_handle_activate_license'));
		@@ -53,11 +54,119 @@
53	54	add_action('wp_ajax_mxchat_reset_global_rate_limit', array($this, 'mxchat_reset_global_rate_limit_callback'));
54	55
55	56	// Custom (OpenAI-compatible) Provider connection test
56	57	add_action('wp_ajax_mxchat_test_custom_provider', array($this, 'mxchat_test_custom_provider_callback'));
	58	+
	59	+ // Built-in provider key validation — cheap per-provider auth check (plan-mxchat-20260623-c41f74)
	60	+ add_action('wp_ajax_mxchat_test_provider_key', array($this, 'mxchat_test_provider_key_callback'));
	61	+
	62	+ // Custom Post Meta discovery scan for the KB whitelist picker (plan-mxchat-20260709-fe8e4e)
	63	+ add_action('wp_ajax_mxchat_scan_custom_meta_keys', array($this, 'mxchat_scan_custom_meta_keys_callback'));
57	64	}
58	65
59	66	/**
	67	+ * Discover non-ACF custom post-meta keys present on published public content, so the
	68	+ * KB → Custom Post Meta section can offer a click-to-add picker instead of a blind
	69	+ * "type the exact key you already know" textarea. plan-mxchat-20260709-fe8e4e.
	70	+ *
	71	+ * Bounded + button-triggered only (never on page load). Returns up to 50 keys by
	72	+ * frequency, each with a short sample value, so the owner can judge relevance before
	73	+ * whitelisting. Underscore-prefixed (protected/internal) keys are hidden unless the
	74	+ * caller opts in; ACF-managed keys are excluded so this picker never double-lists the
	75	+ * sibling ACF discovery picker on the same page.
	76	+ */
	77	+public function mxchat_scan_custom_meta_keys_callback() {
	78	+ check_ajax_referer('mxchat_prompts_setting_nonce');
	79	+
	80	+ if (!current_user_can('manage_options')) {
	81	+ wp_send_json_error(['message' => esc_html__('Unauthorized', 'mxchat')]);
	82	+ }
	83	+
	84	+ global $wpdb;
	85	+
	86	+ $include_internal = isset($_POST['include_internal']) && $_POST['include_internal'] === '1';
	87	+
	88	+ // Restrict discovery to public post types (the content the KB actually embeds).
	89	+ $post_types = get_post_types(array('public' => true), 'names');
	90	+ if (empty($post_types)) {
	91	+ wp_send_json_success(array('keys' => array(), 'scanned' => 0));
	92	+ }
	93	+ $pt_placeholders = implode(',', array_fill(0, count($post_types), '%s'));
	94	+
	95	+ // Build the set of ACF-managed meta keys to exclude. ACF stores, alongside each
	96	+ // value key `foo`, a reference key `_foo` whose value is the ACF field key
	97	+ // (`field_xxxxx`). Strip the leading underscore from every such reference key to
	98	+ // get the real meta key, and exclude those — the ACF picker on this page owns them.
	99	+ $acf_managed = array();
	100	+ $acf_refs = $wpdb->get_col(
	101	+ $wpdb->prepare(
	102	+ "SELECT DISTINCT meta_key FROM {$wpdb->postmeta} WHERE meta_key LIKE %s AND meta_value LIKE %s",
	103	+ $wpdb->esc_like('_') . '%',
	104	+ $wpdb->esc_like('field_') . '%'
	105	+ )
	106	+ );
	107	+ foreach ((array) $acf_refs as $ref_key) {
	108	+ if (strlen($ref_key) > 1 && $ref_key[0] === '_') {
	109	+ $acf_managed[substr($ref_key, 1)] = true;
	110	+ }
	111	+ }
	112	+
	113	+ // Discover keys + counts + a sample value in one bounded aggregate query.
	114	+ // SUBSTRING(MIN(...)) keeps the sample selection ONLY_FULL_GROUP_BY-safe.
	115	+ $params = $post_types;
	116	+ $sql = "SELECT pm.meta_key AS mk, COUNT(*) AS n, SUBSTRING(MIN(pm.meta_value), 1, 200) AS sample
	117	+ FROM {$wpdb->postmeta} pm
	118	+ INNER JOIN {$wpdb->posts} p ON p.ID = pm.post_id
	119	+ WHERE p.post_status = 'publish'
	120	+ AND p.post_type IN ($pt_placeholders)
	121	+ AND pm.meta_key <> ''";
	122	+ if (!$include_internal) {
	123	+ $sql .= " AND pm.meta_key NOT LIKE %s";
	124	+ $params[] = $wpdb->esc_like('_') . '%';
	125	+ }
	126	+ $sql .= " GROUP BY pm.meta_key ORDER BY n DESC, pm.meta_key ASC LIMIT 200";
	127	+
	128	+ // phpcs:ignore WordPress.DB.PreparedSQL — placeholders assembled above, values in $params.
	129	+ $rows = $wpdb->get_results($wpdb->prepare($sql, $params));
	130	+
	131	+ $keys = array();
	132	+ foreach ((array) $rows as $row) {
	133	+ $mk = $row->mk;
	134	+ if (isset($acf_managed[$mk])) {
	135	+ continue; // already offered by the ACF picker
	136	+ }
	137	+
	138	+ $raw = (string) $row->sample;
	139	+ if ($raw !== '' && (is_serialized($raw) || preg_match('/^(a:\d+:\{|O:\d+:"|s:\d+:")/', $raw))) {
	140	+ $sample = esc_html__('[structured value]', 'mxchat');
	141	+ } else {
	142	+ $sample = trim(preg_replace('/\s+/', ' ', $raw));
	143	+ if (function_exists('mb_strlen') ? mb_strlen($sample) > 60 : strlen($sample) > 60) {
	144	+ $sample = (function_exists('mb_substr') ? mb_substr($sample, 0, 60) : substr($sample, 0, 60)) . '…';
	145	+ }
	146	+ if ($sample === '') {
	147	+ $sample = esc_html__('(empty value)', 'mxchat');
	148	+ }
	149	+ }
	150	+
	151	+ $keys[] = array(
	152	+ 'key' => $mk,
	153	+ 'count' => (int) $row->n,
	154	+ 'sample' => $sample,
	155	+ );
	156	+
	157	+ if (count($keys) >= 50) {
	158	+ break;
	159	+ }
	160	+ }
	161	+
	162	+ wp_send_json_success(array(
	163	+ 'keys' => $keys,
	164	+ 'scanned' => is_array($rows) ? count($rows) : 0,
	165	+ ));
	166	+}
	167	+
	168	+/**
60	169	* Test connection to a Custom (OpenAI-compatible) provider by hitting its /models endpoint
61	170	* with whichever auth scheme the user configured. Reports model count or a clean error.
62	171	*/
63	172	public function mxchat_test_custom_provider_callback() {
		@@ -125,8 +234,122 @@
125	234	'count' => $count,
126	235	));
127	236	}
128	237
	238	+/**
	239	+ * Validate a BUILT-IN provider key with the lightest authenticated call per
	240	+ * provider (a /models or key-info GET — never a generation). Reads the posted
	241	+ * key value so the owner can test BEFORE saving; falls back to the saved option
	242	+ * when the field is empty. Mirrors mxchat_test_custom_provider_callback and the
	243	+ * add-on test buttons (cf5bd5 veo / 8d16f1 perplexity). The key is never logged.
	244	+ * plan-mxchat-20260623-c41f74.
	245	+ */
	246	+public function mxchat_test_provider_key_callback() {
	247	+ check_ajax_referer('mxchat_test_provider_key');
	248	+ if (!current_user_can('manage_options')) {
	249	+ wp_send_json_error(array('message' => esc_html__('Unauthorized', 'mxchat')));
	250	+ }
	251	+
	252	+ $provider = isset($_POST['provider']) ? sanitize_key(wp_unslash($_POST['provider'])) : '';
	253	+ $posted_key = isset($_POST['key']) ? trim((string) wp_unslash($_POST['key'])) : '';
	254	+
	255	+ $option_map = array(
	256	+ 'openai' => 'api_key',
	257	+ 'xai' => 'xai_api_key',
	258	+ 'claude' => 'claude_api_key',
	259	+ 'deepseek' => 'deepseek_api_key',
	260	+ 'gemini' => 'gemini_api_key',
	261	+ 'openrouter' => 'openrouter_api_key',
	262	+ );
	263	+ if (!isset($option_map[$provider])) {
	264	+ wp_send_json_error(array('message' => esc_html__('Unknown provider.', 'mxchat')));
	265	+ }
	266	+
	267	+ // Prefer the just-typed value (test-before-save); fall back to the saved key.
	268	+ $key = $posted_key;
	269	+ if ($key === '') {
	270	+ $options = get_option('mxchat_options', array());
	271	+ $key = isset($options[$option_map[$provider]]) ? trim((string) $options[$option_map[$provider]]) : '';
	272	+ }
	273	+ if ($key === '') {
	274	+ wp_send_json_error(array('message' => esc_html__('No API key entered or saved for this provider.', 'mxchat')));
	275	+ }
	276	+
	277	+ // Lightest authenticated metadata call per provider — model-agnostic, no generation.
	278	+ $headers = array();
	279	+ switch ($provider) {
	280	+ case 'openai':
	281	+ $url = 'https://api.openai.com/v1/models';
	282	+ $headers = array('Authorization' => 'Bearer ' . $key);
	283	+ break;
	284	+ case 'xai':
	285	+ $url = 'https://api.x.ai/v1/models';
	286	+ $headers = array('Authorization' => 'Bearer ' . $key);
	287	+ break;
	288	+ case 'deepseek':
	289	+ $url = 'https://api.deepseek.com/models';
	290	+ $headers = array('Authorization' => 'Bearer ' . $key);
	291	+ break;
	292	+ case 'openrouter':
	293	+ // /auth/key validates the key itself (the public /models list does not).
	294	+ $url = 'https://openrouter.ai/api/v1/auth/key';
	295	+ $headers = array('Authorization' => 'Bearer ' . $key);
	296	+ break;
	297	+ case 'gemini':
	298	+ $url = add_query_arg(array('pageSize' => 1, 'key' => $key), 'https://generativelanguage.googleapis.com/v1beta/models');
	299	+ break;
	300	+ case 'claude':
	301	+ $url = 'https://api.anthropic.com/v1/models';
	302	+ $headers = array('x-api-key' => $key, 'anthropic-version' => '2023-06-01');
	303	+ break;
	304	+ default:
	305	+ wp_send_json_error(array('message' => esc_html__('Unknown provider.', 'mxchat')));
	306	+ }
	307	+
	308	+ $response = wp_remote_get($url, array(
	309	+ 'headers' => $headers,
	310	+ 'timeout' => 10,
	311	+ ));
	312	+
	313	+ if (is_wp_error($response)) {
	314	+ wp_send_json_error(array('message' => sprintf(esc_html__('Network error: %s', 'mxchat'), esc_html($response->get_error_message()))));
	315	+ }
	316	+
	317	+ $code = (int) wp_remote_retrieve_response_code($response);
	318	+ if ($code >= 200 && $code < 300) {
	319	+ wp_send_json_success(array('message' => esc_html__('Key is valid.', 'mxchat')));
	320	+ }
	321	+
	322	+ // Surface the provider's own error text when present (trimmed; key never echoed).
	323	+ $detail = '';
	324	+ $body = json_decode(wp_remote_retrieve_body($response), true);
	325	+ if (is_array($body)) {
	326	+ if (isset($body['error']['message'])) {
	327	+ $detail = $body['error']['message'];
	328	+ } elseif (isset($body['error']) && is_string($body['error'])) {
	329	+ $detail = $body['error'];
	330	+ } elseif (isset($body['message'])) {
	331	+ $detail = $body['message'];
	332	+ }
	333	+ }
	334	+ $detail = trim((string) $detail);
	335	+ if (strlen($detail) > 200) {
	336	+ $detail = substr($detail, 0, 200) . '…';
	337	+ }
	338	+
	339	+ if ($code === 401 || $code === 403) {
	340	+ $msg = ($detail !== '')
	341	+ ? sprintf(esc_html__('Key rejected (HTTP %1$d): %2$s', 'mxchat'), $code, esc_html($detail))
	342	+ : sprintf(esc_html__('Key rejected (HTTP %d). Check the API key.', 'mxchat'), $code);
	343	+ wp_send_json_error(array('message' => $msg));
	344	+ }
	345	+
	346	+ $msg = ($detail !== '')
	347	+ ? sprintf(esc_html__('Provider returned HTTP %1$d: %2$s', 'mxchat'), $code, esc_html($detail))
	348	+ : sprintf(esc_html__('Provider returned HTTP %d.', 'mxchat'), $code);
	349	+ wp_send_json_error(array('message' => $msg));
	350	+}
	351	+
129	352	// ========================================
130	353	// SETTINGS AJAX HANDLERS
131	354	// ========================================
132	355
		@@ -140,10 +363,10 @@
140	363	wp_send_json_error(['message' => esc_html__('Unauthorized', 'mxchat')]);
141	364	}
142	365
143	366	$name = isset($_POST['name']) ? $_POST['name'] : '';
144		- // Strip slashes from the value before saving
145		- $value = isset($_POST['value']) ? stripslashes($_POST['value']) : '';
	367	+ // Remove WP's added slashes before saving (wp_unslash is the canonical form; plan-3f8158).
	368	+ $value = isset($_POST['value']) ? wp_unslash($_POST['value']) : '';
146	369
147	370	//error_log('MXChat Save: Processing field name: ' . $name);
148	371	//error_log('MXChat Save: Field value: ' . $value);
149	372
		@@ -164,8 +387,127 @@
164	387	}
165	388
166	389	// Handle special cases
167	390	switch ($field_name) {
	391	+ // Editor Assistant enable toggle (plan-8cb0cb). STANDALONE option — NOT part
	392	+ // of mxchat_options, so it skips the mxchat_sanitize strip-trap entirely. Save
	393	+ // it directly and short-circuit (mirrors the mxchat_transcripts_options pattern
	394	+ // below); never falls through to the generic mxchat_options save. Default OFF.
	395	+ case 'mxchat_editor_assistant_enabled':
	396	+ $ea_value = ($value === 'on' || $value === '1') ? 'on' : 'off';
	397	+ update_option('mxchat_editor_assistant_enabled', $ea_value);
	398	+ wp_send_json_success(['message' => esc_html__('Setting saved', 'mxchat')]);
	399	+ return;
	400	+
	401	+ // Smart asset loading toggle (plan-915355). STANDALONE option, same
	402	+ // reasoning as the Editor Assistant case above — saved directly and
	403	+ // short-circuited so it never touches mxchat_options / mxchat_sanitize.
	404	+ // Default OFF (opt-in performance optimization).
	405	+ case 'mxchat_smart_asset_loading':
	406	+ $sal_value = ($value === 'on' || $value === '1') ? 'on' : 'off';
	407	+ update_option('mxchat_smart_asset_loading', $sal_value);
	408	+ wp_send_json_success(['message' => esc_html__('Setting saved', 'mxchat')]);
	409	+ return;
	410	+
	411	+ // Hybrid keyword boost toggle (plan-38ffa1). STANDALONE option, same
	412	+ // pattern. Enabling runs capability detection HERE, at admin-save time —
	413	+ // building the FULLTEXT index during a visitor's chat request is not
	414	+ // acceptable, and detection is a one-time cost the admin can wait on.
	415	+ case 'mxchat_hybrid_keyword_toggle':
	416	+ $hkb_value = ($value === 'on' || $value === '1') ? 'on' : 'off';
	417	+ update_option('mxchat_hybrid_keyword_toggle', $hkb_value);
	418	+ if ($hkb_value === 'on') {
	419	+ MxChat_Utils::mxchat_hybrid_detect_capability(true);
	420	+ }
	421	+ wp_send_json_success(['message' => esc_html__('Setting saved', 'mxchat')]);
	422	+ return;
	423	+
	424	+ // ACF→PDF import-time extraction (plan 11720c). STANDALONE option, same
	425	+ // pattern. Moved from a per-import modal checkbox to an install-level
	426	+ // setting on Knowledge → ACF Fields. Stored '1'/'0' to match the
	427	+ // knowledge page's sibling toggles. Default OFF.
	428	+ case 'mxchat_acf_pdf_extraction':
	429	+ $apx_value = ($value === 'on' || $value === '1') ? '1' : '0';
	430	+ update_option('mxchat_acf_pdf_extraction', $apx_value);
	431	+ wp_send_json_success(['message' => esc_html__('Setting saved', 'mxchat')]);
	432	+ return;
	433	+
	434	+ // In-chat YouTube card: master switch + its own confidence floor
	435	+ // (plan f52492). STANDALONE options, same pattern as the cases above.
	436	+ // Default ON — the card already ships, so this is an opt-OUT.
	437	+ case 'mxchat_video_embed_enabled':
	438	+ $vce_value = ($value === 'on' || $value === '1') ? 'on' : 'off';
	439	+ update_option('mxchat_video_embed_enabled', $vce_value);
	440	+ wp_send_json_success(['message' => esc_html__('Setting saved', 'mxchat')]);
	441	+ return;
	442	+
	443	+ // Page-cache purge on settings save (plan b76ed6, Support Ticket 468).
	444	+ // STANDALONE option, same pattern. Default ON — the purge already ships
	445	+ // (3.2.9), so this is an opt-OUT for large sites. Switching it off also
	446	+ // drops a deferred purge the debounce may have scheduled seconds ago,
	447	+ // so "off" takes effect at once rather than after one more purge.
	448	+ case 'mxchat_cache_purge_enabled':
	449	+ $cpe_value = ($value === 'on' || $value === '1') ? 'on' : 'off';
	450	+ update_option('mxchat_cache_purge_enabled', $cpe_value);
	451	+ if ($cpe_value === 'off' && class_exists('MxChat_Cache_Purge')) {
	452	+ wp_clear_scheduled_hook(MxChat_Cache_Purge::DEFERRED_EVENT);
	453	+ }
	454	+ wp_send_json_success(['message' => esc_html__('Setting saved', 'mxchat')]);
	455	+ return;
	456	+
	457	+ // Clamped to the same 20-95 the field advertises. An out-of-range or
	458	+ // non-numeric POST is corrected rather than refused, and the corrected
	459	+ // value is echoed back so the field can reconcile — a silently stored
	460	+ // 0 here would put a video on every answer, which is the bug.
	461	+ case 'mxchat_video_embed_threshold':
	462	+ $vct_value = is_numeric($value)
	463	+ ? (int) $value
	464	+ : MXCHAT_VIDEO_EMBED_THRESHOLD_DEFAULT;
	465	+ if ($vct_value < 20) { $vct_value = 20; }
	466	+ if ($vct_value > 95) { $vct_value = 95; }
	467	+ update_option('mxchat_video_embed_threshold', $vct_value);
	468	+ wp_send_json_success([
	469	+ 'message' => esc_html__('Setting saved', 'mxchat'),
	470	+ 'value' => $vct_value,
	471	+ ]);
	472	+ return;
	473	+
	474	+ // Live-agent availability schedules (plans 8ccaa2 + 99d7a4). STANDALONE
	475	+ // options, same reasoning as the Editor Assistant case above — nested
	476	+ // structures that mxchat_sanitize() would strip on the next autosave of any
	477	+ // other field. Each channel's value arrives as JSON from its own hidden
	478	+ // input, which that channel's schedule editor keeps in sync; the class owns
	479	+ // all validation. The bare legacy name is kept as a defense against a
	480	+ // browser still running pre-split cached admin JS: that UI edited "both
	481	+ // channels" as one, so its save writes both.
	482	+ case 'live_agent_schedule_slack':
	483	+ case 'live_agent_schedule_telegram':
	484	+ case 'live_agent_schedule_webhook':
	485	+ case 'live_agent_schedule':
	486	+ if (!class_exists('MxChat_Live_Agent_Schedule')) {
	487	+ wp_send_json_error(['message' => esc_html__('Schedule unavailable', 'mxchat')]);
	488	+ return;
	489	+ }
	490	+ $decoded = json_decode($value, true);
	491	+ if (!is_array($decoded)) {
	492	+ wp_send_json_error(['message' => esc_html__('Invalid schedule', 'mxchat')]);
	493	+ return;
	494	+ }
	495	+ $channels = ($field_name === 'live_agent_schedule')
	496	+ ? array('slack', 'telegram')
	497	+ : array(substr($field_name, strlen('live_agent_schedule_')));
	498	+ $saved_schedule = null;
	499	+ foreach ($channels as $schedule_channel) {
	500	+ $saved_schedule = MxChat_Live_Agent_Schedule::save($schedule_channel, $decoded);
	501	+ }
	502	+ // Echo the normalized result so the editor can reconcile if it ever
	503	+ // disagrees with the server (e.g. a time the class rejected).
	504	+ wp_send_json_success([
	505	+ 'message' => esc_html__('Setting saved', 'mxchat'),
	506	+ 'schedule' => $saved_schedule,
	507	+ ]);
	508	+ return;
	509	+
168	510	case 'model':
169	511	//error_log('MXChat Save: Processing model selection');
170	512	//error_log('MXChat Save: Model value received: ' . $value);
171	513	//error_log('MXChat Save: Value type: ' . gettype($value));
		@@ -237,8 +579,15 @@
237	579	//error_log('MXChat Save: Processing email_blocker_header_content');
238	580	// Allow HTML content but sanitize it safely
239	581	$options[$field_name] = wp_kses_post($value);
240	582	break;
	583	+ case 'intro_message':
	584	+ // Stored-XSS hardening (Wordfence CWE-79, plan-3f8158): sanitize on save as
	585	+ // defense in depth. wp_kses_post mirrors mxchat_sanitize() (the options.php
	586	+ // save path) so both save routes treat intro_message identically and strip
	587	+ // <script>/</textarea> breakout while keeping basic formatting + {visitor_name}.
	588	+ $options[$field_name] = wp_kses_post($value);
	589	+ break;
241	590	case 'email_blocker_button_text':
242	591	//error_log('MXChat Save: Processing email_blocker_button_text');
243	592	$options[$field_name] = sanitize_text_field($value);
244	593	break;
		@@ -245,8 +594,13 @@
245	594	case 'name_field_placeholder':
246	595	//error_log('MXChat Save: Processing name_field_placeholder');
247	596	$options[$field_name] = sanitize_text_field($value);
248	597	break;
	598	+ case 'consent_checkbox_label':
	599	+ // b062c4 — same allowlist as the options.php save path and the
	600	+ // widget render, so the stored label always equals the shown label.
	601	+ $options[$field_name] = MxChat_Utils::sanitize_consent_label($value);
	602	+ break;
249	603	case 'similarity_threshold':
250	604	//error_log('MXChat Save: Processing similarity_threshold');
251	605	// Validate and save - enforce min 20, max 85
252	606	$threshold = intval($value);
		@@ -273,8 +627,49 @@
273	627	//error_log('MXChat Save: Processing live_agent_status');
274	628	// Set the new value
275	629	$options[$field_name] = ($value === 'on') ? 'on' : 'off';
276	630	break;
	631	+ // Shared handoff channel (plan 1a2666): re-probe the channel's privacy
	632	+ // at configuration time so the settings screen can warn about private
	633	+ // channels (their inbound events arrive as message.groups, which the
	634	+ // documented app setup never subscribes to). Only id-shaped values can
	635	+ // be checked before the first handoff resolves a #name — the handoff
	636	+ // path probes those when it caches the resolved id.
	637	+ case 'live_agent_shared_channel':
	638	+ $options[$field_name] = sanitize_text_field($value);
	639	+ delete_option('mxchat_slack_shared_channel_privacy');
	640	+ $shared_channel_target = ltrim(trim((string) $options[$field_name]), '#');
	641	+ if ($shared_channel_target !== '' && preg_match('/^[CG][A-Z0-9]{6,}$/', $shared_channel_target)) {
	642	+ if (!class_exists('MxChat_Integrator')) {
	643	+ require_once plugin_dir_path(dirname(__FILE__)) . 'includes/class-mxchat-integrator.php';
	644	+ }
	645	+ MxChat_Integrator::mxchat_probe_slack_channel_privacy(
	646	+ $options['live_agent_bot_token'] ?? '',
	647	+ $shared_channel_target,
	648	+ trim((string) $options[$field_name])
	649	+ );
	650	+ }
	651	+ break;
	652	+ // Webhook handoff destination (plan d88e22). Status normalized like the
	653	+ // other channel toggles; the URL is refused outright when it isn't
	654	+ // https so the admin hears about it at save time instead of the
	655	+ // handoff silently never firing.
	656	+ case 'webhook_handoff_status':
	657	+ $options[$field_name] = ($value === 'on') ? 'on' : 'off';
	658	+ break;
	659	+ case 'webhook_handoff_url':
	660	+ $wh_url = trim((string) $value);
	661	+ if ($wh_url === '') {
	662	+ $options[$field_name] = '';
	663	+ break;
	664	+ }
	665	+ $wh_clean = esc_url_raw($wh_url, array('https'));
	666	+ if ($wh_clean === '' || stripos($wh_clean, 'https://') !== 0) {
	667	+ wp_send_json_error(['message' => esc_html__('Webhook URL must start with https://', 'mxchat')]);
	668	+ return;
	669	+ }
	670	+ $options[$field_name] = $wh_clean;
	671	+ break;
277	672	case 'enable_web_search':
278	673	//error_log('MXChat Save: Processing enable_web_search');
279	674	$options[$field_name] = ($value === 'on') ? 'on' : 'off';
280	675	break;
		@@ -322,9 +717,16 @@
322	717	$transcripts_options = array();
323	718	}
324	719
325	720	// Handle checkbox values (convert 'on'/'off' to 1/0)
326		- if ($value === 'on' || $value === '1') {
	721	+ if ($field_name === 'mxchat_retention_days') {
	722	+ // Number field, NOT a checkbox — without this branch a
	723	+ // value of '1' would hit the 'on'/'1' coercion below
	724	+ // (harmlessly) but nothing would clamp: this direct-DB
	725	+ // path bypasses the registered sanitiser and its
	726	+ // 0-3650 clamp entirely (plan-3c3338).
	727	+ $transcripts_options[$field_name] = max(0, min(3650, (int) $value));
	728	+ } else if ($value === 'on' || $value === '1') {
327	729	$transcripts_options[$field_name] = 1;
328	730	} else if ($value === 'off' || $value === '0' || $value === '') {
329	731	$transcripts_options[$field_name] = 0;
330	732	} else {
		@@ -329,9 +731,20 @@
329	731	$transcripts_options[$field_name] = 0;
330	732	} else {
331	733	// For text/select fields, sanitize appropriately
332	734	if ($field_name === 'mxchat_notification_email') {
333		- $transcripts_options[$field_name] = sanitize_email($value);
	735	+ // sanitize_email() alone CANNOT validate this field: given
	736	+ // "[email protected], [email protected]" it returns the single concatenated
	737	+ // address "[email protected]", which is_email() then accepts.
	738	+ // That is how two addresses used to be stored as one dead
	739	+ // one, silently. MxChat_Utils validates the raw parts first
	740	+ // and refuses the whole list if any of them is bad.
	741	+ $parsed = MxChat_Utils::parse_notification_emails($value);
	742	+ if ($parsed['error'] !== '') {
	743	+ // Reject: the previously stored value stays untouched.
	744	+ wp_send_json_error(array('message' => $parsed['error']));
	745	+ }
	746	+ $transcripts_options[$field_name] = implode(', ', $parsed['emails']);
334	747	} else {
335	748	$transcripts_options[$field_name] = sanitize_text_field($value);
336	749	}
337	750	}
		@@ -508,10 +921,14 @@
508	921	'contextual_awareness_toggle',
509	922	'citation_links_toggle',
510	923	'enable_email_block',
511	924	'enable_name_field',
	925	+ 'enable_consent_checkbox',
	926	+ 'consent_checkbox_required',
512	927	'custom_provider_for_embeddings',
513		- 'custom_provider_for_images'
	928	+ 'custom_provider_for_images',
	929	+ 'print_button_enabled',
	930	+ 'reset_chat_enabled'
514	931	])) {
515	932	//error_log('MXChat Save: Processing toggle: ' . $field_name);
516	933	$options[$field_name] = ($value === 'on') ? 'on' : 'off';
517	934	} else {
		@@ -654,8 +1071,42 @@
654	1071	if ($field_name === 'mxchat_pinecone_host') {
655	1072	$new_value = str_replace(['https://', 'http://'], '', $new_value);
656	1073	}
657	1074	break;
	1075	+ case 'mxchat_pinecone_index_type':
	1076	+ // 362c31: document only once the host has been checked (see sanitize_pinecone_settings).
	1077	+ $new_value = ($value === 'document') ? 'document' : 'vector';
	1078	+ if ($new_value === 'document' && strtolower(trim((string) ($current_options['mxchat_pinecone_host'] ?? ''), '/')) !== strtolower((string) ($current_options['mxchat_pinecone_docs_verified_host'] ?? ''))) {
	1079	+ wp_send_json_error(['message' => esc_html__('Check the document index host first (Check index or Create index for me).', 'mxchat')]);
	1080	+ }
	1081	+ // 3e83e4: same gate as the form save — no switch onto a half-copied index.
	1082	+ if ($new_value === 'document' && (($current_options['mxchat_pinecone_index_type'] ?? 'vector') !== 'document') && class_exists('MxChat_Pinecone_Documents')) {
	1083	+ $running = MxChat_Pinecone_Documents::migration_blocks_switch((string) ($current_options['mxchat_pinecone_host'] ?? ''));
	1084	+ if ($running !== null) {
	1085	+ wp_send_json_error(['message' => MxChat_Pinecone_Documents::switch_blocked_message($running)]);
	1086	+ }
	1087	+ }
	1088	+ break;
	1089	+ case 'mxchat_pinecone_vector_host':
	1090	+ $new_value = trim(str_replace(['https://', 'http://'], '', sanitize_text_field($value)), '/');
	1091	+ break;
	1092	+ case 'mxchat_pinecone_vector_index':
	1093	+ case 'mxchat_pinecone_docs_region':
	1094	+ $new_value = sanitize_text_field($value);
	1095	+ break;
	1096	+ case 'mxchat_pinecone_docs_cloud':
	1097	+ $new_value = in_array($value, array('aws', 'gcp', 'azure'), true) ? $value : 'aws';
	1098	+ break;
	1099	+ case 'mxchat_pinecone_docs_language':
	1100	+ $lang_value = sanitize_key($value);
	1101	+ $new_value = (class_exists('MxChat_Pinecone_Documents') && array_key_exists($lang_value, MxChat_Pinecone_Documents::languages())) ? $lang_value : 'en';
	1102	+ break;
	1103	+ case 'mxchat_pinecone_top_k':
	1104	+ // d0cae1: out-of-range and junk normalize to the default 50 —
	1105	+ // same clamp the read site applies.
	1106	+ $top_k = absint($value);
	1107	+ $new_value = (string) (($top_k >= 1 && $top_k <= 1000) ? $top_k : 50);
	1108	+ break;
658	1109	default:
659	1110	wp_send_json_error(['message' => esc_html__('Unknown Pinecone field', 'mxchat')]);
660	1111	}
661	1112
		@@ -685,14 +1136,16 @@
685	1136	);
686	1137	//error_log('[MXCHAT-PROMPTS] Updated existing option, result: ' . ($save_result !== false ? 'SUCCESS' : 'FAILED'));
687	1138	} else {
688	1139	// Insert new option
	1140	+ // Credential option — must NOT autoload (holds the Pinecone secret;
	1141	+ // autoloaded rows are read into memory on every request).
689	1142	$save_result = $wpdb->insert(
690	1143	$wpdb->options,
691	1144	array(
692	1145	'option_name' => 'mxchat_pinecone_addon_options',
693	1146	'option_value' => $serialized_options,
694		- 'autoload' => 'yes'
	1147	+ 'autoload' => 'off'
695	1148	),
696	1149	array('%s', '%s', '%s')
697	1150	);
698	1151	//error_log('[MXCHAT-PROMPTS] Inserted new option, result: ' . ($save_result !== false ? 'SUCCESS' : 'FAILED'));
		@@ -810,10 +1263,18 @@
810	1263	}
811	1264
812	1265	// Handle ACF field exclusion toggles
813	1266	if (strpos($name, 'mxchat_acf_field_') === 0) {
814		- // Extract field name from the input name (e.g., mxchat_acf_field_private_notes -> private_notes)
815		- $field_name = str_replace('mxchat_acf_field_', '', $name);
	1267	+ // The identifier after the prefix is the ACF field KEY (unique per
	1268	+ // field), not the field name — names are shared across groups and
	1269	+ // collide (plan 30e81f). Reject anything that isn't key-shaped so a
	1270	+ // stale pre-3.2.20 page (or its exit beacon) posting a bare name
	1271	+ // can't write junk into the key-based list.
	1272	+ $field_key = str_replace('mxchat_acf_field_', '', $name);
	1273	+ if (!preg_match('/^field_[A-Za-z0-9_\-]+$/', $field_key)) {
	1274	+ wp_send_json_error(['message' => esc_html__('Invalid ACF field identifier', 'mxchat')]);
	1275	+ return;
	1276	+ }
816	1277	$is_enabled = ($value === 'on' || $value === '1');
817	1278
818	1279	// Get current excluded fields
819	1280	$excluded_fields = get_option('mxchat_acf_excluded_fields', array());
		@@ -822,13 +1283,19 @@
822	1283	}
823	1284
824	1285	if ($is_enabled) {
825	1286	// Remove from exclusion list (field should be included)
826		- $excluded_fields = array_values(array_diff($excluded_fields, array($field_name)));
	1287	+ $excluded_fields = array_values(array_diff($excluded_fields, array($field_key)));
	1288	+ // Lazy legacy-name conversion: if this field's NAME is still
	1289	+ // stored (its group was inactive when the 30e81f migration
	1290	+ // ran), including this one field must not silently include
	1291	+ // its same-named twins — swap the name entry for the keys of
	1292	+ // every OTHER field currently wearing that name.
	1293	+ $excluded_fields = $this->mxchat_expand_legacy_acf_name_entry($excluded_fields, $field_key);
827	1294	} else {
828	1295	// Add to exclusion list (field should be excluded)
829		- if (!in_array($field_name, $excluded_fields)) {
830		- $excluded_fields[] = $field_name;
	1296	+ if (!in_array($field_key, $excluded_fields, true)) {
	1297	+ $excluded_fields[] = $field_key;
831	1298	}
832	1299	}
833	1300
834	1301	$updated = update_option('mxchat_acf_excluded_fields', $excluded_fields);
		@@ -835,10 +1302,10 @@
835	1302
836	1303	if ($updated || true) { // Always report success since the state may already be correct
837	1304	wp_send_json_success([
838	1305	'message' => $is_enabled
839		- ? sprintf(esc_html__('Field "%s" will be included in imports', 'mxchat'), $field_name)
840		- : sprintf(esc_html__('Field "%s" will be excluded from imports', 'mxchat'), $field_name)
	1306	+ ? esc_html__('Field will be included in imports', 'mxchat')
	1307	+ : esc_html__('Field will be excluded from imports', 'mxchat')
841	1308	]);
842	1309	} else {
843	1310	wp_send_json_error(['message' => esc_html__('Failed to save ACF field setting', 'mxchat')]);
844	1311	}
		@@ -858,12 +1325,12 @@
858	1325	}
859	1326	return;
860	1327	}
861	1328
862		- // Handle other prompts options
	1329	+ // Handle other prompts options (autoload false — can hold the Pinecone secret)
863	1330	$options = get_option('mxchat_prompts_options', []);
864	1331	$options[$name] = $value;
865		- $updated = update_option('mxchat_prompts_options', $options);
	1332	+ $updated = update_option('mxchat_prompts_options', $options, false);
866	1333
867	1334	if ($updated) {
868	1335	wp_send_json_success(['message' => esc_html__('Setting saved', 'mxchat')]);
869	1336	} else {
		@@ -870,10 +1337,130 @@
870	1337	wp_send_json_error(['message' => esc_html__('No changes detected', 'mxchat')]);
871	1338	}
872	1339	}
873	1340
	1341	+ /**
	1342	+ * If the field behind $included_key still has its NAME stored in the
	1343	+ * exclusion list (a legacy entry the 30e81f migration could not resolve
	1344	+ * because the group was inactive), replace that name with the keys of
	1345	+ * every OTHER current field wearing it. Including one field must never
	1346	+ * silently include its same-named twins — that would be the original
	1347	+ * collision bug in reverse, in the unsafe (privacy-losing) direction.
	1348	+ */
	1349	+ private function mxchat_expand_legacy_acf_name_entry($excluded_fields, $included_key) {
	1350	+ if (!function_exists('acf_get_field')) {
	1351	+ return $excluded_fields;
	1352	+ }
	1353	+ $field = acf_get_field($included_key);
	1354	+ if (!$field || empty($field['name'])) {
	1355	+ return $excluded_fields;
	1356	+ }
	1357	+ $field_name = $field['name'];
	1358	+ if (!in_array($field_name, $excluded_fields, true)) {
	1359	+ return $excluded_fields;
	1360	+ }
	1361	+ $excluded_fields = array_values(array_diff($excluded_fields, array($field_name)));
	1362	+ foreach ($this->mxchat_acf_keys_for_name($field_name) as $twin_key) {
	1363	+ if ($twin_key !== $included_key && !in_array($twin_key, $excluded_fields, true)) {
	1364	+ $excluded_fields[] = $twin_key;
	1365	+ }
	1366	+ }
	1367	+ return $excluded_fields;
	1368	+ }
874	1369
875	1370	/**
	1371	+ * Keys of every currently-registered top-level ACF field with this name.
	1372	+ */
	1373	+ private function mxchat_acf_keys_for_name($field_name) {
	1374	+ $keys = array();
	1375	+ if (!function_exists('acf_get_field_groups') || !function_exists('acf_get_fields')) {
	1376	+ return $keys;
	1377	+ }
	1378	+ foreach (acf_get_field_groups() as $group) {
	1379	+ $group_fields = acf_get_fields($group['key']);
	1380	+ if (empty($group_fields)) {
	1381	+ continue;
	1382	+ }
	1383	+ foreach ($group_fields as $field) {
	1384	+ if (isset($field['name'], $field['key']) && $field['name'] === $field_name) {
	1385	+ $keys[] = $field['key'];
	1386	+ }
	1387	+ }
	1388	+ }
	1389	+ return $keys;
	1390	+ }
	1391	+
	1392	+ /**
	1393	+ * Group-level ACF toggle (plan bf57e0): sets every field in one ACF field
	1394	+ * group included or excluded in a SINGLE option write. The client must
	1395	+ * never loop the per-field endpoint for this — get_option → modify →
	1396	+ * update_option once per field from twenty concurrent requests is a
	1397	+ * lost-update race that silently drops most of the group.
	1398	+ */
	1399	+ public function mxchat_acf_toggle_group_callback() {
	1400	+ check_ajax_referer('mxchat_prompts_setting_nonce');
	1401	+
	1402	+ if (!current_user_can('manage_options')) {
	1403	+ wp_send_json_error(['message' => esc_html__('Insufficient permissions', 'mxchat')], 403);
	1404	+ return;
	1405	+ }
	1406	+
	1407	+ if (!function_exists('acf_get_fields')) {
	1408	+ wp_send_json_error(['message' => esc_html__('ACF is not active', 'mxchat')]);
	1409	+ return;
	1410	+ }
	1411	+
	1412	+ $group_key = isset($_POST['group_key']) ? sanitize_text_field(wp_unslash($_POST['group_key'])) : '';
	1413	+ if (!preg_match('/^group_[A-Za-z0-9_\-]+$/', $group_key)) {
	1414	+ wp_send_json_error(['message' => esc_html__('Invalid ACF group identifier', 'mxchat')]);
	1415	+ return;
	1416	+ }
	1417	+ $state = isset($_POST['state']) ? sanitize_text_field(wp_unslash($_POST['state'])) : '';
	1418	+ $include = ($state === 'on' || $state === '1');
	1419	+
	1420	+ // Resolve the group's fields SERVER-side — a client-supplied key list
	1421	+ // is not trusted. This is the same call the settings UI lists from,
	1422	+ // so the toggle covers exactly the rendered set (top-level fields).
	1423	+ $group_fields = acf_get_fields($group_key);
	1424	+ if (empty($group_fields)) {
	1425	+ wp_send_json_error(['message' => esc_html__('No fields found for this group', 'mxchat')]);
	1426	+ return;
	1427	+ }
	1428	+
	1429	+ $excluded_fields = get_option('mxchat_acf_excluded_fields', array());
	1430	+ if (!is_array($excluded_fields)) {
	1431	+ $excluded_fields = array();
	1432	+ }
	1433	+
	1434	+ $touched = array();
	1435	+ foreach ($group_fields as $field) {
	1436	+ if (empty($field['key'])) {
	1437	+ continue;
	1438	+ }
	1439	+ if ($include) {
	1440	+ $excluded_fields = array_values(array_diff($excluded_fields, array($field['key'])));
	1441	+ $excluded_fields = $this->mxchat_expand_legacy_acf_name_entry($excluded_fields, $field['key']);
	1442	+ } elseif (!in_array($field['key'], $excluded_fields, true)) {
	1443	+ $excluded_fields[] = $field['key'];
	1444	+ }
	1445	+ $touched[] = array(
	1446	+ 'name' => 'mxchat_acf_field_' . $field['key'],
	1447	+ 'value' => $include ? 'on' : 'off',
	1448	+ );
	1449	+ }
	1450	+
	1451	+ // The one write — the whole point of this endpoint.
	1452	+ update_option('mxchat_acf_excluded_fields', array_values($excluded_fields));
	1453	+
	1454	+ wp_send_json_success([
	1455	+ 'message' => $include
	1456	+ ? esc_html__('All fields in this group will be included in imports', 'mxchat')
	1457	+ : esc_html__('All fields in this group will be excluded from imports', 'mxchat'),
	1458	+ 'fields' => $touched,
	1459	+ ]);
	1460	+ }
	1461	+
	1462	+ /**
876	1463	* Handles AJAX request for Pinecone settings migration
877	1464	*/
878	1465	public function ajax_migrate_pinecone_settings() {
879	1466	// Verify nonce
		@@ -909,9 +1496,9 @@
909	1496	'mxchat_pinecone_index' => sanitize_text_field($old_options['mxchat_pinecone_index'] ?? ''),
910	1497	'mxchat_pinecone_environment' => sanitize_text_field($old_options['mxchat_pinecone_environment'] ?? '')
911	1498	);
912	1499
913		- update_option('mxchat_pinecone_addon_options', $migrated_options);
	1500	+ update_option('mxchat_pinecone_addon_options', $migrated_options, false);
914	1501
915	1502	wp_send_json_success(array(
916	1503	'migrated' => true,
917	1504	'message' => 'Settings migrated successfully from Pinecone add-on'
		@@ -954,9 +1541,10 @@
954	1541	}
955	1542
956	1543	$product_id = 'MxChatPRO';
957	1544	$domain = parse_url(home_url(), PHP_URL_HOST); // Get the current domain
958		-
	1545	+ $was_active = (get_option('mxchat_license_status', 'inactive') === 'active');
	1546	+
959	1547	// Call WooCommerce Software API for activation (not just validation)
960	1548	$response = wp_remote_get(
961	1549	add_query_arg(
962	1550	array(
		@@ -1002,9 +1590,16 @@
1002	1590	update_option('mxchat_license_status', 'active');
1003	1591	update_option('mxchat_pro_email', $customer_email);
1004	1592	update_option('mxchat_activation_key', $license_key);
1005	1593	delete_option('mxchat_license_error');
1006		-
	1594	+
	1595	+ // A fresh activation starts the licence domain check (c93ede) from a
	1596	+ // clean slate: no grace streak carried over, first daily check at a
	1597	+ // random time within the day.
	1598	+ if (class_exists('MxChat_License_Check')) {
	1599	+ MxChat_License_Check::reset(true);
	1600	+ }
	1601	+
1007	1602	// Also track on your website (this is your existing domain tracking)
1008	1603	$this->track_domain_on_website($license_key, $customer_email, $domain);
1009	1604
1010	1605	wp_send_json_success(array('message' => esc_html__('License activated successfully', 'mxchat')));
		@@ -1011,9 +1606,17 @@
1011	1606	} else {
1012	1607	$error_message = isset($data->error) ? $data->error : esc_html__('Activation failed', 'mxchat');
1013	1608	update_option('mxchat_license_status', 'inactive');
1014	1609	update_option('mxchat_license_error', $error_message);
1015		-
	1610	+
	1611	+ // c93ede: a refusal by the licence owner (domain switched off, new sites
	1612	+ // blocked) or a revoked key is an explicit "off" from mxchat.ai. Remember
	1613	+ // who controls it so Pro & Extensions says so, and keep checking so the
	1614	+ // owner's switch-on restores Pro without another click here.
	1615	+ if (class_exists('MxChat_License_Check')) {
	1616	+ MxChat_License_Check::note_activation_refusal(isset($data->code) ? (string) $data->code : '', (string) $error_message, $was_active);
	1617	+ }
	1618	+
1016	1619	//error_log('MxChat Activation failed: ' . $error_message);
1017	1620	wp_send_json_error($error_message);
1018	1621	}
1019	1622	}
		@@ -1070,9 +1673,17 @@
1070	1673	//error_log('MxChat deactivate: Nonce check failed');
1071	1674	wp_send_json_error('Security check failed.');
1072	1675	return;
1073	1676	}
1074		-
	1677	+
	1678	+ // plan-mxchat-20260731-c63fb6 — nonce is not authorization. Without this,
	1679	+ // any authenticated user holding the nonce could revoke the site's PRO
	1680	+ // licence. Every sibling handler in this file already checks.
	1681	+ if (!current_user_can('manage_options')) {
	1682	+ wp_send_json_error(esc_html__('Unauthorized', 'mxchat'), 403);
	1683	+ return;
	1684	+ }
	1685	+
1075	1686	//error_log('MxChat deactivate: Nonce check passed');
1076	1687
1077	1688	$license_key = get_option('mxchat_activation_key');
1078	1689	$email = get_option('mxchat_pro_email');
		@@ -1090,9 +1701,15 @@
1090	1701	delete_option('mxchat_license_status');
1091	1702	delete_option('mxchat_pro_email');
1092	1703	delete_option('mxchat_activation_key');
1093	1704	delete_option('mxchat_license_error');
1094		-
	1705	+
	1706	+ // Nothing left to check: drop the licence domain check's state and its
	1707	+ // scheduled event (c93ede).
	1708	+ if (class_exists('MxChat_License_Check')) {
	1709	+ MxChat_License_Check::reset(false);
	1710	+ }
	1711	+
1095	1712	//error_log('MxChat deactivate: Local data cleared');
1096	1713
1097	1714	// Notify your website's API to properly deactivate
1098	1715	$response = wp_remote_post('https://mxchat.ai/mxchat-api/deactivate-license', array(