What changed in each plugin, newest first.
The changelog text is in English, as in the plugin.
wp-content/mu-plugins/egenverk-babbla-lean.php, and is off until an admin turns it on: a plugin that grants chat access through its own capability rule is not loaded for those requests either, and its users would then be refused — turn lean reads off again in that case. Deactivating Babbla removes the file (on a multisite network only a network-wide deactivation does, since the file serves every site). wp egvb lean on|off|status does the same from WP-CLI. When a Babbla update changes the file, Diagnostics offers to update it.wp-content/uploads/egenverk-babbla-signal/, which carries an .htaccess that sends Cache-Control: no-store, private (Apache with mod_headers) and an empty index.php. The directory and both files are created on activation, on the first write, and again whenever one is missing. The old file in the uploads root is deleted once the new one exists; uninstall (with purge on) removes the directory as well. A wp-admin tab left open across the update still reads the old address: it gets three 404s and falls back to asking the server on a schedule until it is reloaded.poll_interval and signal_token from GET /poll too (see 0.38.0); a busy site's egvb_poll_interval now also stretches the open chat's safety net. Without the file (uploads not writable, or three failed reads) the open chat keeps the 0.38.0 schedule unchanged.GET /unread and GET /poll return poll_interval (seconds) and signal_token (the change signal's current token, read before the answer is built). A new filter, egvb_poll_interval (default 0, clamped to 0–600 seconds), lets a busy site make every closed chat wait longer between its scheduled requests without a release.ALTER TABLE … MODIFY request_id). Existing messages and ids are kept; if the conversion fails, the plugin retries it on the next request.GET /babbla/v1/poll, answers in one request what an open conversation used to ask for in two: its new messages and, when due, the conversation list (and, on request, the unread count). Each part is exactly what its own route returns. The existing routes are unchanged.$wpdb->prepare() straight to $wpdb->query(); the analytics queries that build their SQL from fixed fragments and placeholder lists say so where they run; calculator error messages escape the function names they quote; uninstall deletes log files with wp_delete_file(); the "Selected user" string has a translators comment.Tested up to is 6.9, the version the acceptance runs used._commercial/brand/egenverk-ui/): the symbol and the Babbla glyph in assets/egenverk-ui/, the "by egenverk" signature on Settings → Babbla, and the wordpress.org banner and icons, now rendered from sources kept in .wordpress-org/src/.options-general.php?page=egenverk-babbla&tab=…), each shown only to users who may open it; a chat user without Babbla administration sees Access only. The Plugins screen gets a Settings link to it.admin.php?page=egenverk-babbla-chat.assets/egenverk-ui/, copied unchanged, loaded only on that page): header with the Babbla glyph and the egenverk signature, lead, tabs and footer. Fields and behaviour are unchanged; each tab's own heading replaces its old page title, and the settings sidebar no longer repeats links to Access and Usage..wordpress-org/, kept out of the release zip.admin.php?page=bbl-*) and 0.32.0 (admin.php?page=egvb-*) redirect to their tab or to the full-page chat for one version, keeping their other query args. This replaces 0.32.0's bbl-* → egvb-* redirect.egenverk-babbla, main file egenverk-babbla.php, Author Egenverk). WordPress sees the new folder as a new plugin: activating it deactivates the old babbla/babbla.php copy, so the two never answer the same question twice.BBL_/bbl_/bbl- to EGVB_/egvb_/egvb-: classes, constants, options, capabilities (egvb_chat, egvb_manage), transients, admin-post actions, the log cron, admin page slugs, CSS classes and the egvbConfig client global. The WP-CLI command is wp egvb job. wordpress.org requires a prefix of at least four characters for global symbols.egvb_* (egvb_agent_tools, egvb_integrations, egvb_capability, egvb_admin_capability, egvb_tool_capability, egvb_tool_status_label, egvb_redacted_keys, egvb_rate_limit, egvb_anthropic_request, egvb_openai_request).EGVB_ANTHROPIC_KEY and EGVB_OPENAI_KEY.readme.txt for wordpress.org, with the external services the assistant uses.bbl_* filter names still run for this version, through apply_filters_deprecated(). So do BBL_ANTHROPIC_KEY/BBL_OPENAI_KEY in wp-config.php, the wp bbl job command, and agent jobs Action Scheduler queued under bbl_run_job before the update.EGVB_Install::migrate_from_bbl() runs on activation and on the first request after the update, after the 0.8.0 wctc_ move: bbl_settings, bbl_access, bbl_db_version, bbl_log_dir and bbl_purge_on_uninstall are copied to their egvb_ names (an existing egvb_ value wins) and deleted; a stored agent_capability of bbl_chat/bbl_manage and any role granted those capabilities move to the new names; the bbl_log_cleanup event is cleared. It runs once and a second run changes nothing. Deleting the old keys also disarms the old copy's uninstall.php, which would otherwise read its purge flag and drop the tables this version uses. Transients are left to expire. uninstall.php cleans the old and the new keys.fail_on), the way a timed-out query fails in production: no rows plus last_error, never an exception. Every fix above is pinned by a test that fails without it.get_results() answers a failed query with false, the array cast turned that into zero rows, and the agent reported — with every appearance of certainty — that nothing in the chat mentioned what was asked about. BBL_Repository::search_messages() returns null when the query itself failed, and search_chat refuses with an error that tells the model to say so instead of answering from it.list_conversations refuses in the same way instead of printing every conversation as empty and never touched.POST /channels/{id}/read answers 500 when the marker was not stored. mark_read() ignored both write results and read back a missing row as 0, so the client cleared its badge on a marker the server had never saved and the unread count returned on the next poll.finish_job() reports whether a row actually moved. BBL_Agent_Runner's finally branch treats status = 'running' as unfinished, so a silently failed UPDATE could fail an answered job and post "The agent could not answer" underneath the answer it had just given. A job whose answer reached the channel is now closed as done by that branch, and the failure notice is posted only by whoever actually closed the row.assets/js/bbl-settings.js only upgrades the click to an in-place swap, so switching costs no request and keeps unsaved edits in the fields. A url with an unknown or missing section opens Overview, and a connection test still opens Provider, where its result renders.window.location.hash, and the browser answers that by scrolling the named element to the top of the viewport; every click pushed the screen further down. The section now lives in the url as ?section=<slug> and the client swaps the card with history.pushState, which does not scroll.BBL_Settings::get( 'launcher_visible' | 'launcher_size' ), new fields on the settings page); a signed-in user's own choice, made from the bubble's own menu, is stored in uiPrefs in localStorage exactly like theme and drawer/window are, and overrides the site default until the user changes it back — a later site-default change does not silently undo it. Hidden means not rendered at all, not display: none on an element that still exists, so no keyboard trap is left behind.@N (@99+ above 99), for unread mentions, next to the existing total-unread badge. With the bubble hidden it is the only place @-mentions surface outside the panel itself.GET /channels. The cache paints the conversation on the first frame, and the textarea, the mention button and Send used to stay disabled until the channel list answered — on a host that takes seconds per request, that wait was the whole delay made visible in the one place the user came to type. A channel the cache still has but the server does not is answered with 403/404 and cleared, as before.agent_busy corrects it either way.DELETE /channels/{id}/messages empties a conversation, and only the caller's own assistant conversation: a DM or a room holds what colleagues wrote, and no menu item deletes that. Refused with 409 while a job for that channel is queued or running, since the answer would land in a conversation the user just emptied. Mention rows and read markers go with the messages, so the next answer is not born already read.https://github.com/vigg3 as the author URI. Regenerated catalogs carry the same name.wp-config.php), which model is entered, and what the daily budget is. "Getting started" moved into it.BBL_Tools::run() scrubs every result through the new BBL_Redact, before the transient is filled, so a cached entry is clean too and an integration cannot forget the step. Removed keys cover names, e-mail addresses, phone numbers, street addresses, postcodes, cities, personal numbers and IP addresses, at any depth and whatever their case; an e-mail address written inside free text is masked in place. Filter bbl_redacted_keys lets an integration add keys of its own.order_lookup no longer reads the customer's name or e-mail at all. It returns whether the order is a guest order; staff have the customer on screen in wp-admin next to the answer.bbl_agent_tools declares itself through the new bbl_integrations filter with a name, version, the tools it registers and a note about what they read. Settings → Assistant → Integrations lists them with a checkbox each, so an administrator can see what a plugin offers the assistant and switch it off without deactivating the plugin.enabled_integrations. A newly installed integration starts off: activating a plugin must not change what leaves the store for the provider until someone has seen what it does and said yes.BBL_Tools::resolve_tools() drops a filter-registered tool whose integration is not enabled, so the model is never offered it and run() refuses it as an unknown tool. Tools registered in core are unaffected.bbl_jobs.message_id is unique, so two workers retrying the same question cannot both create a job and answer twice. BBL_Install::DB_VERSION is 7; maybe_upgrade() adds the index through dbDelta.wpdb double returns an empty result and sets last_error when a select fails, the way wpdb does, instead of throwing. A missing table used to throw in tests while production returned null, which let a test prove something production does not do.GET /channels/{id}/messages returns agent_status with the tool now running and a label already translated for display ("Searching the chat…"). The label is built server-side from the tool name and its validated arguments, never from model text, and is always null when agent_busy is false, so a status left behind by a crashed job is never shown under a finished answer. The value lives in a two-minute transient rather than a bbl_jobs column: it is worthless once the job ends. Filter bbl_tool_status_label lets an integration label its own tools.meta.sources holds up to twelve items a tool actually returned, each with its source_id, a label and a URL built server-side. The assistant is asked to cite a claim with [[s:<id>]]. The client renders those markers in the next release, and only for ids present in meta.sources — a reference the model invents has nothing to render.tests/test-i18n.php no longer freezes the sv_SE default prompt to the 0.5.0 wording. That invariant kept a Swedish site on the text it read before the prompt became translatable, but it also meant no new instruction could ever reach one. It is replaced by the requirement that the translation keeps calculate, analytics_report, source_id and the [[s: marker syntax untranslated — a translated marker would make every citation unrenderable.list_documents (what is readable) and read_document (one page as plain text). The readable set is WooCommerce's terms page, the site's privacy policy page and the pages an administrator picks under Settings → Assistant → Readable pages — nothing else. Drafts, password-protected pages, posts and unknown slugs are refused with one wording that does not reveal whether the page exists.context_pages: up to 20 published pages the assistant may quote, such as shipping, returns and warranty. Ids are validated when saved and again on every read, so a page that is unpublished or protected afterwards stops being quotable at once.source_id (doc:<slug>) and the page's permalink, built server-side — the anchor the reference chips in a later release attach to.list_conversations (the conversations you can see), search_chat (text search, default the last 90 days) and read_conversation (a window of messages, paged with before). Every read is scoped to the person asking — BBL_Repository::visible_channels() and channel_for_user() decide, so the agent never returns a private room, a DM or another user's assistant conversation the asker could not already open. A channel id the asker cannot see is refused with the same wording as one that does not exist, so the tools cannot be used to probe which conversations exist.source_id (msg:<channel_id>:<message_id>), the anchor the reference chips in a later release attach to.fn( array $args, int $user_id ). Existing callbacks that only read shop data ignore it. A user-scoped tool must take it from there and never call get_current_user_id(), because the agent job runs in a background request with no user set.tests/migration-rehearsal.php) that exercises the schema 4 to 6 upgrade, the request-id constraint and the legacy rename against a real WordPress and MySQL, on an isolated table prefix. Every option the migration reads or deletes is snapshotted and put back, since option names carry no table prefix.toLocaleDateString. A Swedish site in an English browser showed 9/18/2026. A WordPress locale that is not a valid BCP 47 tag, such as pt_PT_ao90, falls back to the browser's format instead of throwing inside the inbox render.assistantsvar corrected to assistentsvar in the new-group screen and the shared-answer label.sv_SE catalog: the chat client, the settings, usage and diagnostics screens, the system messages the assistant writes into a conversation, and the provider errors it reports. A site running any other locale keeps the English source strings.languages/babbla.pot for translators, plus bin/make-pot.sh, which regenerates it, merges the new strings into every shipped .po, and compiles the .mo and .l10n.php catalogs WordPress reads. Header updates normalize wrapped fields and only touch the catalog header; malformed headers and invalid printf translations stop generation.babbla.pot (including echoing helpers, contexts and plurals), and every Swedish entry and plural form is translated and present in both compiled catalogs. Client translation calls require literal arguments, enforced by lint; composer test also runs the catalog-generator regression.WPLANG option, with WordPress fallbacks) takes precedence over the administrator's profile language, and saving an unchanged default keeps it following future locale and wording changes..po/.pot sources — WordPress loads the compiled catalogs, so those are development files.analytics_report gains three metrics — customers (distinct customers with a paid order in the period), new_customers and returning_customers (split by WooCommerce's own returning_customer flag, so the numbers match its Analytics screens) — and a customer breakdown that returns one row per customer with their id and name, for "who buys the most".wc_customer_lookup, the table Analytics maintains — no wp_users, no usermeta, no free-form SQL, and the same 50-row cap and paid-status predicate as every other breakdown. A customer breakdown is order-level, so it is refused together with a product or category split for the same reason the other order totals are.