Changelog — conviro/module-aichat (Conviro_AiChat)

Format: newest first. Dates are the dates the version entered Conviro's Composer registry (apps/api/src/assets/composer/), taken from git history. The 1.4.0 entry is compiled from the commit messages 315d32c9..d3472ce2 on feat/magento-10-10, extended 2026-09-25 with 514d99b0..c3374a58 (revenue attribution, two new events, the admin cards) and the release-gate R3 commits (ceaaac4d, c26b8965, ee07b4fc, 8791cdc4).

1.5.0-RC1 — unreleased (release candidate for the pilot)

Release candidate, not a stable release. Composer installs it only by exact version (composer require conviro/module-aichat:1.5.0-RC1); a store that requires a range such as ^1.4 stays on 1.4.x. Customer Hub: a signed-in shopper sees their own orders in the chat without an order number or e-mail. Release notes (draft) · Signed customer identity and My orders · Upgrade 1.4 → 1.5. Built on 1.4.1 (released 2026-09-27). Tested end to end with the real Conviro API on Magento 2.4.7-p4, 2.4.7-p9 (Luma and Hyvä, Redis) and 2.4.8-p5, behind the built-in page cache and Varnish; Hyvä Checkout and other versions not yet (Supported versions). Every new feature is off by default in the module and at Conviro.

• Signed customer identity (beta): per-installation Ed25519 key (secret key encrypted in Magento, public key registered with Conviro, separate from the webhook secrets), same-origin never-cached bootstrap GET /conviro/identity/bootstrap, 60-second assertion without name or e-mail, holder proof and single-use challenge at Conviro, 15-minute verification. Sign-out, account switch, customer deletion and password change / reset revoke it (identity.bindings_revoked); signing out in one browser tab clears the orders shown in the shopper's other open tabs at once; rotation with bin/magento conviro:identity:rotate-key or the admin button. New table conviro_identity_binding (kept one day; a deleted customer's rows at the deletion — Phase 5). Requires ext-sodium.
• My orders: two read-only routes GET /V1/conviro/identity/bindings/:bindingId/orders[/:orderId] under the new ACL leaf Conviro_AiChat::api_customer_orders, granted only while Show verified shoppers their own orders is on; the binding is re-checked on every call; only the customer's own orders, only storefront-visible statuses, this store view by default (website optional); no address, e-mail, phone, payment or item prices.
• Widget: order list / detail cards, tracking, distinct loading / unavailable / expired / signed-out / not-in-account views (never "no orders" on an error), Talk to a person with the selected order, store-view sign-in link, 29 languages (native review pending).
• Admin: Customer Experience & Identity card (key state and age, features, store views, Conviro's view, clock), Test identity bridge (synthetic, creates nothing), Repair access for "Order listing permission missing" (Sipariş listeleme izni eksik), a summary line on Integration Health.
• Operations: a first-blocker line at the top of the card naming the first failing gate with its fix and a runbook link (30-second runbook); Reset identity (the emergency rotation — needs Conviro's reset route; an older backend changes nothing); the server's clock skew read from Conviro's Date header, in module-health and on the card; an identity section in the diagnostics bundle (states and counts; the signing key provably never in it); a deleted customer's binding rows go at the deletion.
• Conviro side (deployed separately): identity routes, principals and replay protection in Postgres (migration 0233), verified order reads, sealed storage of verified answers, masked handoff context and daily counts (migration 0234), the guest code ledger (migration 0235), dashboard section. Migrations apply in number order after 1.4.1's 0232.
• Guest one-time code (off by default): a guest asking about an order gets a 6-digit code by e-mail first; nothing about the order is shown before the code, and nothing says whether the order exists.
• Cancel / return requests by verified shoppers (off by default): always approved by a staff member before anything changes in Magento.

1.4.1 — 2026-09-27

Hardening from the first production store's field report after its 1.3.4 → 1.4.0 upgrade. Release notes. The backend needs migration 0232 (applied before the API deploy).

• Upgrade command: one generator (module + Conviro backend, shared cases), built for the store's mode and locales; no --keep-generated in-place; docs cover who runs it, failure exit, release-directory upgrades, rollback.
• Cron health: per-job heartbeat (last run / success / failure), admin system message (cron silent 10 min, or an event waiting 15 min while cron runs), health report to the Conviro dashboard every 15 min.
• Held cart / payment events: a confirm-only page (no sync starts).
• Widget: loading on first interaction (default) / idle / immediately; build id cached (no version.json request per page view); theme hook conviro:before-init (appearance only).
• Lead form placement: embed only (new installs) / every page (kept for upgraded stores with a key) / inside the chat / off; one bundle per page.
• Theme overrides: detected per store view; Check storefront reads the served page and loader.
• Checkout safety: skipped events counted and shown; no payment.failed for an order that was created.
• 4-byte characters survive utf8mb3; error texts cut on character boundaries.
• Network protection: Cloudflare challenge recognised, retried, never read as a key problem; User-Agent: Conviro-Magento/… on every call.
• Package: no Test/ in the zip; the diagnostics bundle lists every cron job and no longer masks the bearer row's own "… = No." instruction.

1.4.0 — 2026-09-26

Published 2026-09-26, a few hours after the release candidate 1.4.0-RC1 (also in the registry). The owner released it without the planned 24–48 h pilot: only one store uses the module. setup_version in etc/module.xml is 1.4.0 (Magento allows only digits there). Requires the matching Conviro backend (see Release notes). All measurements: local stacks only (2.4.7-p4; 2.4.4-p13 and 2.4.9 in the version matrix of 2026-09-26).

Security

• Signed inbound webhooks. /conviro/webhook/receive now verifies X-Webhook-Signature: t=,v1= (HMAC-SHA256, 5-minute window), checks the tenant, accepts only known events and ignores replays. Before, it acknowledged everything unverified, forwarded leads to a WooCommerce endpoint, and failed Magento's CSRF check so it never actually ran. (315d32c9)
• Magento OAuth 1.0a is the primary way Conviro authenticates to the store, with the legacy bearer token as a fallback during the migration window. The integration's access token is no longer regenerated on every Save Config, and enable_integration_as_bearer is never written. The legacy bearer plugin (WebApiAuthorizationFix) now acts only on the Conviro integration's own token, reads no superglobals and runs no SQL, and is inert under OAuth. (315d32c9)
• Least-privilege ACL: the Conviro read API. The integration holds only the module's own read-only routes (/V1/conviro/..., etc/webapi.xml, ACL Conviro_AiChat::api_*) — catalog, stock / MSI salability, one order by number or e-mail, one customer / cart by exact e-mail, store topology — each answering exactly what the core route of the same path answers. No Magento catalog, sales, customer, cart or store resource any more: the 1.3.x set reached 61 core write routes (products, prices, stock, carts including placing an order) and unfiltered customer / cart search (security review R3 M1). Cancel / hold / comment only while order-action assistance is on; Magento_Cart::manage is gone (a B2B quote request becomes a staff task). An upgraded store keeps its old resources until Conviro confirms the read API, then they are dropped; the upgrade re-registers every connected store once (data patch RefreshIntegrationAccess). A ping route (GET /V1/conviro/ping, ACL Conviro_AiChat::api) lets Conviro tell "no such product / order" from a downgraded module in any store language, and says whether MSI is installed (msi; stores on 1.3.x are asked through GET /V1/modules): Conviro never reads Magento's (translated) error text. (315d32c9, 90c79bc8, R3 M1)
• Events signed with a timestamp (X-Conviro-Signature: v1=, timestamp in the MAC). (52fc1635)
• Browser-mediated connect with state + PKCE (S256); no API key to copy. (09cfe93b)
• Templates escape at output with $escaper; the lead form uses SHA-256 instead of MD5; UUIDs from Magento's identity generator. (b72311a8)
• Full-page-cache privacy regression tests (WidgetPrivacyTest, fpc-privacy.sh). (315d32c9)

Added

• Event outbox: observers only queue an event locally; the cron job conviro_deliver_events delivers every minute with retries (+30 s … +8 h, 7 attempts), credential holds (401/403), dead letters and purging. (52fc1635)
• Canonical event envelope v1 and events order.placed, order.processing, order.completed, order.canceled, order.status_changed, order.shipped, order.refunded, order.partially_refunded, customer.created, product.created, product.updated, product.deleted, cart.updated, payment.failed, test.ping. (52fc1635)
• inventory.updated from admin, MSI and import stock changes, one per product (coalesced). (3bb49b22)
• Setup wizard (Stores › Settings › Conviro Setup): environment check, browser-mediated connect, Magento OAuth, store-view selection, data sync, AI permissions, verify. New admin resource Conviro_AiChat::setup. (09cfe93b)
• Store-view selection: customer, order, cart and payment events only for selected store views; the mapping is sent to Conviro. (09cfe93b)
• Reconnect / Disconnect, with a cron retry when Conviro cannot be told. (09cfe93b)
• Integration Health card (Connection, Authentication, Webhooks, Catalog sync, Orders / events, Cron / queue, Extension version, Environment, and a conditional Cart & payment events row) with remediations and one verdict; Test connection, Send test event, Retry failed. (fff8da0a, 52fc1635)
• Sync jobs: catalog re-sync, inventory re-sync, order history (window none / 30 / 90 / 365 days, default 90), opt-in customer import, repair failed items — checkpointed, resumable, back-pressured; progress reported to Conviro as sync.job.progress and events order.synced, customer.synced. (fff8da0a, 3bb49b22)
• Diagnostics download without secrets or customer data. (fff8da0a)
• MSI salability (isSalable, salableQty) and configurable children in product events; MSI stays optional. (90c79bc8)
• Automatic OAuth migration of stores upgraded from 1.3.x (data patch + cron). (09cfe93b)
• Cart / payment confirmation settings (sync/cart_recovery_confirmed, sync/payment_assist_confirmed) and the upgrade patch that holds toggles that were already on. (09cfe93b)
• New settings general/app_url, stores/*, initial_sync/*. New cron jobs conviro_catalog_resync, conviro_sync_jobs, conviro_connection_maintenance, conviro_purge_outbox, conviro_purge_inbound_events.
• New tables conviro_event_outbox, conviro_sync_job, conviro_inbound_event; conviro_webhook_log gains direction and hits (unauthenticated rejections are one row per reason and minute). (declarative schema)

Changed

• No storefront, checkout or admin request calls Conviro any more (1.3.x posted from observers with a 5 s timeout). Measured: an order is placed with Conviro down (264 ms); queueing costs p95 2–3.5 ms. (52fc1635, fff8da0a)
• order.placed fires when the order is created (quote submission), not on the checkout success page; payment.failed fires on quote-submission failure (1.3.x's hook was never called by the default checkout). (52fc1635)
• Disabled products are sent as enabled: false and leave the assistant's knowledge at once. (52fc1635)
• Configuration scopes: connection and AI capabilities are default-scope only; sync toggles are really read per website. (b72311a8)
• Helper\Data split into Model\Config and services; the helper remains as a deprecated facade. No ObjectManager::getInstance() calls. (b72311a8)
• Below Conviro's security minimum the admin notice says SECURITY UPDATE REQUIRED; the upgrade command includes setup:di:compile and setup:static-content:deploy -f. (b72311a8, fff8da0a)
• The configuration page no longer waits on Conviro on every render (Conviro's view cached 60 s, 3 s connect timeout). (fff8da0a)

Removed

• Setup/InstallSchema (replaced by etc/db_schema.xml).
• Observers CheckoutSuccess and CheckoutFailure.
• Admin blocks ConnectionStatus and DeliveryHealth (replaced by the Integration Health card).
• The WooCommerce forward in the inbound webhook.

Requires on the Conviro side

POST /v1/api/magento/events, the OAuth 1.0a signer and verification, the connect / store-mapping / disconnect endpoints, the commerce tables (migrations 0219–0229), the AI action policy and Trust Layer v2, revenue attribution, payment assist and the magento:module key scope — all on feat/magento-10-10, not deployed as of 2026-09-25.

Known limitations

See Release notes and Supported versions.

Added (revenue attribution and two §21 events)

• Revenue influenced by Conviro (plan P6.4, owner decision 4): with the shopper's consent the chat widget keeps two first-party cookies (the chat's random visitor id; up to five followed Conviro product-link ids), the module adds their ids to order.placed / checkout.started from storefront requests only, and Conviro reports per currency, never summed, "influenced" — never "caused" — by conversation, by product link and by recovered cart. New toggle Revenue attribution (default on, website scope). (101ed33d widget, 514d99b0 API, f9e583f6 module, 240e8e3e dashboard)
• customer.updated (e-mail or group changes of existing customers, while customer data is shared; no name) and checkout.started (checkout page reached, behind the confirmed cart-recovery switch; recorded only). (514d99b0, f9e583f6)
• Admin "AI Answers and Revenue" cards on the configuration page: answers grounded in live store data vs other sources, ungrounded claims, and revenue influenced — loaded after the page from Conviro's API-key stats endpoints. (514d99b0, f9e583f6)
• Measured together: attribution.sh 39/39 including a real-browser consent test on Luma. (c3374a58)

Release gate R3 (privacy / data defects and security review)

• Payment assist is real. A failed payment is recorded by Conviro (e-mail hashed, error text masked); when the shopper's chat can be identified (visitor id, with consent), your team sees it on the conversation and — while payment assist is switched on and confirmed — the widget offers help once on the shopper's next page view, in the shopper's language. payment.failed now carries the attribution ids. (ceaaac4d, ee07b4fc, 8791cdc4)
• customer.deleted: deleting a customer drops their undelivered payloads and tells Conviro, which deletes / anonymises what it holds of them through this store (conversations excluded). (ceaaac4d, 8791cdc4)
• order.placed no longer sends the billing name and phone, the line items or the customer id — nothing in Conviro used them. (8791cdc4)
• Retention for the module's own tables: conviro_webhook_log 30 days, finished sync jobs 90 days (the newest per type and active jobs kept). (8791cdc4)
• Disconnect also takes the chat widget and lead form off the storefront unless you tick Keep the chat widget on my storefront; Reconnect brings them back. A disconnect from the Conviro dashboard revokes the key the connect flow minted. (ceaaac4d, 8791cdc4)
• Save Config now registers the store as documented: the observer listened to admin_system_config_changed, which Magento never dispatches; it now listens to admin_system_config_changed_section_conviro_aichat. The OAuth access token is still reused. (8791cdc4)
• No silent reconnect: a disconnected store is registered again only with a key created after the disconnect (wizard Reconnect or a newly pasted key); Conviro answers 409 otherwise, and the OAuth migration stops. (ceaaac4d, 8791cdc4)
• Connect-minted keys are narrow: scope magento:module only (the routes the module calls — not conversations, not the knowledge base), limited to the chosen chatbot, bound to the approved store URL; the approval page refuses a return address that is not on the store's host (or a subdomain); every earlier connect-minted key of the workspace expires within 24 h. (ceaaac4d, c26b8965)
• The widget receives the customer id: the template passed userId, which the widget and Conviro never read; it now passes id, read from the module's customer-data section conviro-customer (id + e-mail). The widget and Conviro still accept userId from older modules. (ceaaac4d, ee07b4fc, 8791cdc4)
• No identity request from guests; no inline script: a guest's page (the guest variant of the cached page) makes no identity request — 1.3.x called /rest/V1/customers/me on every page view — and the widget loader is a static file with a JSON settings block, so no CSP nonce is frozen into cached pages (security review R3 M6, M9).
• Returns (RMA) and B2B quote writes on Adobe Commerce: the integration now requests Magento_Rma::magento_rma / Magento_NegotiableQuote::manage (with their parents) while Order-action assistance is on and only where the installation's ACL tree has them (never on Open Source); Conviro turns a 401 / 403 / 404 from those APIs into a task for your team. (ceaaac4d, 8791cdc4)
• Cart-recovery e-mail in the store view's language (every language the chat answers in), linking to the store view's own cart page or a Cart page URL (headless stores) you set. (ceaaac4d, 8791cdc4)
• Deleted conversations are removed from order / checkout attribution records; the link cookie cvr_att_ids lives 30 days so the workspace's window (1–30 days) decides. (ceaaac4d, ee07b4fc)
• One stall threshold (15 minutes) in the Magento card and the Conviro dashboard; the retry-span wording is computed from the schedule ("7 attempts over about 10 h 43 min"); links from the health card and the wizard into the documentation (Documentation URL, conviro_aichat/general/docs_url). (8791cdc4)
• Compatibility: csp_whitelist.xml uses the core schema URN urn:magento:module:Magento_Csp:etc/csp_whitelist.xsd; the lead-form widget's placeholder image ships (view/adminhtml/web/images). (8791cdc4)

Security review fixes (release gate R3, 2026-09-25)

Module side of the backend / widget fixes; the module PHP findings of the review are the next slice. (f871f44c, 09679c23, and the docs commit after them)

• Attribution cookies need a positive consent signal. The widget writes cvr_att_vid / cvr_att_ids only when the shopper accepted cookies (Cookie Restriction Mode), a recognised consent platform reports consent (IAB TCF v2, OneTrust, Cookiebot) or Google Consent Mode reports analytics_storage granted. New setting Attribution cookies without a consent signal (sync/attribution_without_consent, website scope, default No) for regions where analytics cookies need no consent. After a refusal not even the link click is reported.
• One signing secret per direction. The module asks Conviro for an event secret (signs Magento → Conviro) and a receive secret (verifies Conviro → Magento) instead of one shared secret; with an older Conviro backend the shared secret keeps working. Conviro issues fresh secrets when another store URL or API key registers. Disconnect deletes all of them.
• Documentation URL default is now https://repo.conviro.io/docs/magento2, where Conviro serves these pages (English).

Version matrix (release gates R1 / R2, 2026-09-26)

Install-tested on Magento 2.4.4-p13 (PHP 8.1) and 2.4.9 (PHP 8.4, + Hyvä) — Supported versions.

• Compatibility: composer.json requires magento/framework ^103.0.4 (Magento 2.4.4 and later) and PHP ~7.4.0||~8.1.0||~8.2.0||~8.3.0||~8.4.0 (was >=103.0 / >=7.4). A store outside that range keeps 1.3.5 on composer update.
• Fixed: the lead-form CMS widget rendered nothing — on every Magento version, since the widget was added. Magento renders a {{widget}} only for a block implementing Magento\Widget\Block\BlockInterface; the lead-form block now does.
• Fixed (Magento 2.4.9): a full administrator lost the setup actions on the configuration page — the Integration Health card's Setup wizard / Retry failed / Re-sync buttons, and eleven setup fields (Require Signed Webhooks, the data-sharing confirmations, the AI capability switches) rendered read-only. 2.4.9 builds a request's ACL for one role at a time; reading the Conviro integration's grant for the card left it built for the integration. The module now drops it after that read.
• Backend (Magento 2.4.8+): requests with ten or more list entries in the query string were refused ("The signature is invalid"); the list indices are now padded before signing.
• Docs: the upgrade leaves 1.3.x's store-wide Allow OAuth Access Tokens to be used as standalone Bearer tokens switched on — the upgrade guide says to switch it off.

Release gate R4 (2026-09-26)

• Store-wide bearer tokens on the health card. While Magento's Allow OAuth Access Tokens to be used as standalone Bearer tokens is on (1.3.x switched it on) and Conviro signs with OAuth 1.0a, the Integration Health card shows a Store-wide bearer tokens Warning row saying what it opens and a Turn off store-wide bearer tokens button (POST with the admin form key, confirmation first, Conviro_AiChat::setup) that sets it to No. The module still never changes the setting by itself: another integration of the merchant may rely on it. (Integration Health)
• Fixed: the widget was rendered twice on the cart and checkout pages (since 1.3.x). Their layouts place the widget block in more than one container so it survives a theme or checkout that drops one; where both rendered, the page had two conviro-widget-config blocks (a duplicate id) and loaded the lead-form bundle twice. The first widget block rendered on a page now wins, the others render nothing.
• Release candidate 1.4.0-RC1 for the controlled release (pilot store first): stores with Composer's default minimum-stability: stable do not get it from composer update; a pilot installs it with composer require conviro/module-aichat:1.4.0-RC1. A store whose installed version is newer than the one Conviro publishes (the pilot, while Conviro still publishes 1.3.5) is shown no upgrade command in the health card's details — ^1.3.5 would take it back to 1.3.5.

1.3.5 — 2026-08-04

Security release; the minimum secure version.

• The widget no longer renders the logged-in customer's identity server-side. The block is cacheable and Magento's full-page cache varies on customer group, so one shopper's e-mail, name and order history could be served to the next shopper in the same group.
• Greetings are JSON-encoded with JSON_HEX_* inside the inline script.
• Observers' Conviro calls got a 5 s timeout / 3 s connect timeout.
• Create Leads on Registration no longer breaks registration on a Conviro error and posts to the Magento lead endpoint (it had never created a lead).

(436f443f)

1.3.4 — 2026-06-17

• Widget bundle cache-busted with the live build id from version.json (daily stamp as fallback).
• The update notice detects Composer-managed vs app/code installs.

(46c098fa)

1.3.3 — 2026-06-17

• The widget receives the store view's language signals derived from its locale.
• Product links sent to chat can carry UTM parameters (config-driven; source defaults to the store code).

(8cf80765)

1.3.2 — 2026-06-17

• The widget template became a thin loader for the CDN bundle; the store greeting is passed through cw('init', …).

(19ea9c77)

1.3.1 — 2026-06-17

• API URL field is read-only (managed by Conviro).

(312b268a)

1.3.0 — 2026-06-11

• Trust policy fields Return window (days) and Warranty length (months) in AI Capabilities, sent to Conviro.

(6803c11b)

1.2.0 — 2026-06-02

• Merchant-controlled AI capability toggles and deeper commerce actions in chat (registry entry added with 6b2d14c7; the module source was recovered into this repository in 6803c11b). Itemised changes were not recorded in git.

1.1.0 — 2026-06-02

• First version served from Conviro's Composer registry (9da31826). Earlier versions were not published through repo.conviro.io.