ملبّيdocs

Changelog

Mulabbe (ملبّي) releases under one semantic version for the API, dashboard, widget and shared package. Bump it with pnpm version:set <version>, then describe the release below.

  • Major: a breaking change for merchants or for API clients (/api/v1, webhooks).
  • Minor: new features, backwards compatible.
  • Patch: fixes only.

The running API reports its release at GET /api/version and in the x-wakeel-version header on every response. The dashboard shows its own release in the account menu and offers a reload when the API is newer.

1.8.0 (2026-10-21)

  • New name: Mulabbe / ملبّي. The dashboard, emails, notifications, the website chat widget, the docs site, the Arabic user guide and its screenshots, and the pricing sheets now carry the new name, on mulabbe.com (app., api. and docs.).
  • Breaking for integrations (nothing is live yet): webhook headers are now X-Mulabbe-Signature and X-Mulabbe-Event-Id; the CRM webhook field is mulabbeId; the widget's JavaScript object is window.Mulabbe with the mulabbe:ready event; site verification uses mulabbe-verification.txt; the platform's WhatsApp alert templates are mulabbe_owner_alert, mulabbe_owner_otp and mulabbe_owner_digest (create them in Meta before turning alerts on); the website crawler is MulabbeBot.
  • Production: the server's IP can be hidden behind Cloudflare, either with the proxy plus a firewall that only lets Cloudflare reach the web ports (deploy/firewall), or with a Cloudflare Tunnel (deploy/docker-compose.tunnel.yml). Compose commands now read COMPOSE_FILE from deploy/.env.

1.7.4 (2026-10-21)

  • Security: an agent who cannot see a contact or ticket no longer sees its CRM sync status or can trigger "Sync now" for it.
  • Security: a contact export's download link goes only to the member who asked for it and to owners.
  • Security: the flow run log hides the customer's name on conversations the viewer cannot open.
  • Security: viewers no longer receive the full support-session record or internal template and ticket settings they do not need.
  • Code health: every dashboard area now reads the server's shared data types; the transition allowance is gone, so a copied type fails the build. One shared helper replaces two copies of the "read with a POST" query.

1.7.3 (2026-10-17)

  • Security: team members can no longer read a business's internal settings (AI spending caps, plan overrides) through the current-business endpoint; it now returns only what the dashboard needs.
  • Coaching never suggests a fixed answer that states a price, discount or stock, and explains why if an owner types one; "phrase to avoid" suggestions are more precise.
  • Reactions to customers after the 24-hour window are refused up front with a clear reason instead of failing.
  • Plan & usage shows the CRM connections limit.
  • Code health: the server and dashboard share their data types across all main areas, with a check that stops copies coming back.

1.7.2 (2026-10-16)

  • Every verified finding from the platform assessment (docs/17) is fixed: 7 high and 33 medium.
  • The assistant: one-time notices are no longer lost when a reply is replaced, discovery questions count only when the customer saw them, and auto-approved drafts respect a team member taking over.
  • Money and data: a quoted district delivery fee is what the order charges, a zero-value discount code is not used up, AI budget counters are exact under concurrency, and per-conversation analytics are not shown when a filter would make them wrong.
  • Inbox: faster list and counts, live updates never skip events after reconnecting and keep flowing at peak.
  • Code health: the assistant runtime is split into focused parts, duplicated helpers are merged, and API data types are shared between server and dashboard.

1.7.1 (2026-10-16)

  • Fixes from the 1.7.0 platform assessment (docs/17): on a production server (Redis queue) the assistant can now answer and send at all; human replies on Messenger and Instagram after 24 hours are delivered; the assistant no longer locks itself out of a conversation after a hand-over; an emoji reaction no longer deletes a reply waiting for approval; catalog import keeps each product's own options.
  • Dates and times in the dashboard follow the workspace's time zone instead of Riyadh time.
  • Old live-update events, sent emails and used buttons are cleaned up automatically, so the database stops growing without limit; a checkout race that could deadlock on a real database is fixed.
  • Public documentation site (docs.<your-domain>): landing page, Arabic help center and developer docs.

1.7.0 (2026-10-16)

  • Assistant coaching: a new Bot Studio page that turns your team's corrections into suggestions (FAQ answers, missing policies, phrases to avoid, product talking points, "Ask me first" and hand-over topics), with the evidence behind each. Accepting changes the draft only; nothing reaches customers until you publish. No credits.
  • Production: live updates work across several API containers; files can be stored in S3 or Cloudflare R2; a command creates the first super admin on a new server; every setting is checked when the server starts.
  • Breaking for self-hosting: production now requires VAPID keys (web push) and refuses SEED_DEMO=true. Realtime connections are websocket-only.

1.6.0 (2026-10-15)

  • Ready for production on a Contabo server: deployment files, automatic HTTPS, nightly backups, a readiness check and a step-by-step runbook (docs/16). The API refuses to start on a server with unsafe settings and lists every problem at once.
  • Database changes on a server can no longer silently drop data: safe changes apply on start, anything destructive stops and waits for a reviewed, backed-up sync.
  • Real email sending over SMTP (Amazon SES, Resend, Brevo, Postmark).
  • Credit packs are shown in each business's own currency; the platform console warns about currencies that have no pack.
  • Breaking for API clients: GET /api/credits/packs now returns {currency, currencyMismatch, provider, items}.

1.5.2 (2026-10-15)

  • Assistants created before 1.5.0 load again: their AI model page and the draft check no longer fail.
  • The Arabic user guide covers every 1.5 feature with new annotated screenshots.

1.5.1 (2026-10-15)

  • Full UI QA of 1.5.0 (docs/15): Studio number fields refuse values out of range instead of saying "saved", publish and scenario failures are explained in plain words, the setup wizard no longer adds a second website chat, and setup counts as finished after a successful launch.
  • A chat that is handed to the team no longer leaves a reply waiting for approval; "replies waiting" notifications are grouped per customer; the plan page updates as soon as a payment is marked paid.
  • The new-product form copies the price to every size and clears errors as you fix them; sample phone numbers follow the business country; the invite page explains the email confirmation step up front.
  • One name for the AI everywhere: «المساعد» in Arabic and "assistant" in English.

1.5.0 (2026-10-15)

  • "Ask me first": choose topics (refunds, large discounts, big orders, complaints, your own keywords) where the assistant writes the reply and waits for your approval while the rest of the chat stays live. It follows opening hours, keeps the customer's follow-up messages with the held reply, and never holds hand-overs, "are you a bot?" or privacy requests.
  • Product talking points: selling points the assistant mentions and lines it must never say, per product or variant. Prices and stock still come only from the catalogue; "never say" also catches common Arabic word endings.
  • Choose which assistant answers each channel, duplicate an assistant, and see the answering assistant in the inbox. Switching keeps the channel's mode.
  • A ticket reopens when the customer replies within 7 days, even after it closed itself.
  • Full logic QA round (docs/15): replies waiting for approval are not sent while the bot is paused, two edits of one order can no longer take stock twice, offline replies no longer hand harmless questions to the team, and adding a note right after a reply works.

1.4.0 (2026-10-14)

  • Online card payment is switched off: credit packs are paid offline and the platform marks the order paid in the admin console. Old checkout links stop working. It can be switched back on with one setting.
  • The assistant reads sizes written in Arabic letters («مقاس اس»), recommends sizes from the store's size guide, answers "where is my order?" from the customer's own orders, asks for details when a photo is unclear instead of showing unrelated products, and skips a free-delivery offer when delivery is already free.
  • The admin console warns before a plan change that puts a business over its limits, and the daily AI safety cap can be set per business.
  • The flow editor opens at a readable zoom; the AI assistant is called «المساعد» everywhere in Arabic; unnamed customers have one label; simulator previews follow the workspace language.
  • Breaking for API integrators: every plan limit (seats and CRM connections included) now answers 403 PLAN_LIMIT; 402 is only for credits and the playground cap.

1.3.0 (2026-10-14)

  • Credits are the only AI meter: the plan's "AI conversations per month" limit and the overage switch are gone. Replies on a business's own AI key have their own price on the credit list (free by default).
  • The 14-day trial now ends: unused trial credits expire and a "choose a plan" banner shows. Bought credits keep working.
  • The daily AI safety limit grows with the plan and follows the owner's choice for when credits run out. The website chat has a daily credit limit the owner sets.
  • After paying for a credit pack, the owner sees whether the payment went through.
  • Business flows tested end to end (signup to first sale, discounts, hand-over, tickets, CRM, flows, knowledge, team, analytics, developer API, privacy) and over 50 issues fixed, among them discounts above the store's cap, the chat switching to English after a size tap, invitations lost at signup, duplicate "resolved" messages, notification links to missing pages, and the bot offering sizes or stock that do not exist.
  • Breaking for API integrators: the usage.threshold_reached webhook now reports AI credits (resource: 'ai_credits') instead of AI conversations.

1.2.0 (2026-10-13)

  • AI credits: every AI reply, copilot draft, photo reading and knowledge document costs a fixed number of credits from a price list the platform edits. Plans include monthly credits; bought credits never expire. Merchants see credits only, never tokens or AI cost.
  • Plan & usage shows the balance, usage by day and feature, the history, and what the bot does at zero (offline replies or hand over to the team). A banner warns when credits run low.
  • Credit packs and payments: buy a pack from Plan & usage; manual payment (the platform marks it paid) and a test checkout, ready for an online payment provider.
  • Platform console: credits overview with real AI cost and margin per business, versioned price list, packs, payment orders, credit adjustments, plan changes and the AI spending cap.
  • The sales agent was tested live on 55 conversations and fixed: browses the catalogue, takes orders instead of opening tickets, says the after-hours notice once, understands Levantine "هاي", stops repeating searches, answers faster and recovers from provider timeouts.
  • Arabic date and time pickers everywhere, Arabic labels instead of internal names, one name for the bot modes, and an Arabic user guide with annotated screenshots (docs/user-guide-ar).
  • CRM settings no longer show server variable names to merchants.

1.1.0 (2026-10-11)

  • Contact merge across WhatsApp, Instagram, Messenger and the widget, with duplicate suggestions and a 7-day undo.
  • AI reply assistant in the inbox: grounded suggestions with sources, and rewrite into a shorter, warmer or formal tone, another dialect or another language.
  • The bot understands customer photos and suggests matching products (vision models).
  • Customer privacy requests (access and erase) from chat or the team, and an option to mask phones, e-mails, addresses and order numbers before they reach the AI.
  • Daily and weekly summaries by e-mail and WhatsApp.
  • Analytics: sales funnel, entry points, lost-sale reasons and top customer questions.
  • Follow-ups: cart recovery and customer reminders inside the messaging window.
  • Knowledge import from your website (verified domain) and from PDF and Word files.

1.0.0 (2026-10-11)

First complete release, running fully locally.

  • AI sales and support agent on WhatsApp, Instagram, Messenger and the website widget, in Gulf, Levantine, Egyptian, MSA, Arabizi and English, with an offline engine plus Claude, OpenRouter and any OpenAI-compatible model (platform, business and bot level).
  • Shared inbox, contacts and CRM with segments and custom fields, tickets with SLAs, CSAT and merge, orders and leads, catalog, knowledge, templates, automations and analytics.
  • Bot Studio with a visual flow builder, versions with diff and rollback, and playground model comparison.
  • CRM sync with a sandbox CRM, generic webhooks, HubSpot, Zoho, Odoo and Salesforce.
  • Commerce: bundles, size charts, back-in-stock, slot booking, COD verification, order changes, bank transfer and wallet receipts.
  • Developer platform: scoped API keys, public REST v1 with OpenAPI, signed outbound webhooks, tamper-evident audit log.
  • Onboarding wizard, admin console with audited support view and kill switches.