TalkDock — Floating Chat Button

Changelog

1.1.6

• Refreshed plugin description copy for clarity and readability.

1.1.5

• Resolved the Plugin Check nonce-verification warning in settings checkbox payload handling.
• Reconfirmed AJAX no-refresh settings saving, persisted-value verification, and POST fallback.
• Maintained save status feedback and live-preview refresh after successful saves.

1.1.2

• Added the TalkDock Pro integration hooks while keeping all free features fully functional without the add-on.
• Hardened settings saves, feedback uploads, frontend asset enqueues, and generated CSS output for WordPress.org review.
• Refined the admin UI, responsive tab layout, and shadow-free design system.
• Preserved the existing privacy posture: no background telemetry and no visitor data sent by the free plugin.

1.0.9

• Fixed WordPress.org review blockers: all JavaScript is enqueued through WordPress, the text domain is consistently talkdock across plugin headers, gettext calls, and the POT template, external service disclosure is explicit, Report-a-Bug uploads are sanitized and validated at the boundary, and frontend design CSS is generated from validated values instead of printed as raw inline CSS.
• Removed the remote Google Fonts admin dependency and uses the system font stack instead.
• Cleaned admin/front-end markup output and tightened late escaping for dynamic values.
• Normalized Markas Studio public links under https://studio.markashosting.com/plugins/talkdock/, including docs, support, TalkDock Pro, Terms of Use, and Privacy Policy permalinks.
• Removed the optional author homepage header because the plugin-specific URL is intentionally used as the Plugin URI; this avoids duplicate URL validation errors during WordPress.org submission.

1.0.8

• FIX (Report-a-Bug delivery): the modal showed “Thanks — your report has been recorded” even when the cross-site bug-report receiver returned HTTP 413 (payload too large). Two underlying issues: (a) the dispatcher treated any non-WP_Error response from wp_remote_post as success, so a 413 / 429 / 500 from the receiver slipped through as ok = true; (b) the receiver’s body cap was 1 MB while the plugin permits up to 3 × 5 MB images, so a typical multi-screenshot bug report exceeded the cap. The dispatcher now requires an actual 2xx status before reporting success; on non-2xx the modal shows an honest “Saved locally — receiver was unreachable” warning and leaves itself open so the user can resend. The receiver-side cap (in the Markas Studio dashboard’s plugin-bug intake) has been raised to 12 MB to match the plugin’s spec’d wire budget with comfortable headroom.
• FIX (response parsing — receiver entry_id): the cross-site receiver responds with { success: true, id: <post_id>, message: '...' } on a successful intake, where id is the reference number of the recorded report on the receiver side. The previous dispatcher discarded the body entirely on 2xx and returned only { ok, status } upstream, so the receiver’s reference number was lost between layers. The dispatcher now decodes the response body, extracts the id field (accepting entry_id as a forward-compat alias), and propagates it as remote_entry_id through the dispatch result → local log row → AJAX response → modal history pill. The user-facing success message now includes the receiver-assigned reference (“Thanks — your report has been recorded (ref #847).”), and the Previous Reports panel renders sent rows as “Sent · #847” so the user has a number to cite in any follow-up. Pre-1.0.8 log entries that lack the field render as “Sent” with no reference, gracefully — no data migration required.
• NEW (Smart auto-resize): screenshots are now optimized client-side before submission. Images larger than the per-image target are scaled to a 1920px longest edge and re-encoded as JPEG with progressive quality steps (0.85 → 0.72 → 0.6) until they fit. A typical 5 MB retina screenshot lands at ~400–600 KB without visible quality loss, and the 413 budget becomes practically unreachable from the UI.
• NEW (Paste-from-clipboard): you can now paste a screenshot directly into the open modal with Cmd / Ctrl + V. Captured images run through the same auto-resize pipeline. A timestamped filename is synthesized so multiple pastes don’t collide. Text pastes into the subject / message inputs are left untouched.
• NEW (Previous reports panel): an opt-in “Show previous reports” disclosure inside the modal lists the most recent submissions from this site with their delivery status (Sent / Local only / Not delivered). Reads from the existing bounded local log; no new options are created. Lazy-loaded on first expand.
• FIX (wp_options bloat): the local tlkd_feedback_log option no longer stores the base64-encoded attachment binary. With 50 entries × up to 15 MB raw attachments, the option row could theoretically reach ~750 MB and slow every admin page load. The log now stores per-attachment metadata only (name, MIME, byte count); the audit trail is preserved, the bloat hazard is gone.
• FIX (privacy / wire format): the dispatcher’s outbound User-Agent no longer includes home_url(). The readme privacy section already promised the plugin never auto-attaches your site URL, but the previous header TalkDock/1.0.7; <home_url> shipped it on every dispatch. The receiver-side dashboard derives the source host from the Origin / Referer header (unchanged), so the User-Agent is now plain TalkDock/1.0.8.
• HARDENING (PHPCS hygiene): the $_FILES superglobal is read in three places inside process_attachments() (existence check, raw-array capture, per-file loop). The previous build used an inline phpcs:ignore that only covered one line and left the other two flagged. Replaced with a method-scoped phpcs:disable / phpcs:enable pair stacking both WordPress.Security.NonceVerification.Missing and WordPress.Security.ValidatedSanitizedInput.InputNotSanitized. Each suppression carries a one-line justification naming the mitigation. No behavioural change.
• HARDENING (link-rel sweep): every target="_blank" link in the plugin’s admin views now uses rel="noopener noreferrer" (was rel="noopener"). noopener neutralizes reverse-tabnabbing; noreferrer additionally suppresses the Referer header so the destination site does not learn which wp-admin/admin.php?page=… page the click came from.
• No change to the AJAX action names, the nonce, the option keys, the validation rules, the JSON payload schema, the diagnostic block, or what is opt-in vs opt-out. The 5 MB per-image cap and 3-image cap are unchanged. The set of fields transmitted is unchanged — except that the outbound User-Agent header no longer contains home_url(), per the readme’s privacy guarantee.

1.0.7

• Polished the Report-a-Bug modal. The submit button now shows an inline spinner during dispatch and a brief checkmark on success instead of swapping its text; the form is disabled while the request is in flight so the loading state is clearly bounded.
• Fixed a desktop layout regression where the modal could overflow the viewport once the “Sending…” status banner appeared, clipping the footer off the bottom of the screen. The dialog → wrapping form → body now form a proper flex column, so the body scrolls internally instead of pushing the dialog past its max-height cap. The status banner is also auto-scrolled into view when it appears. The dialog now also offsets for the WordPress admin bar (32px / 46px) so it never sits beneath it on desktop.
• Replaced the fragile backdrop-filter: blur(8px) scrim with a solid dim (rgba(15, 16, 20, 0.62)) that renders deterministically regardless of WP admin chrome stacking contexts. The previous blur approach caused “ghost” rendering where tabs and buttons bled through the backdrop. Removed the associated defensive isolation: isolate and z-index: 0 hacks that were only propping up the broken filter.
• Switched the admin CSS and JS enqueue from a static plugin-version cache key to a filemtime()-based version. Any byte-level change to admin/css/admin.css or admin/js/admin.js now forces an immediate browser refetch even when the plugin version has not been bumped. The headline plugin version stays visible in ?ver=… because the new format is TLKD_VERSION.MTIME with a graceful fallback to plain TLKD_VERSION if the file cannot be stat’d.
• Refined the modal visuals toward a minimalist, system-style aesthetic: clean solid-dim backdrop, tighter typography, larger corner radius on desktop, and a primary-indigo Send action that matches the rest of the admin brand instead of the accent terracotta.
• Mobile rendering hardened: switched the full-screen breakpoint to 100dvh (fixes iOS Safari toolbar overlap), added safe-area-inset padding for notched devices, and reduced the body padding so all fields stay reachable on narrow screens.
• Accessibility: animations honor prefers-reduced-motion; the spinner is hidden from assistive tech; the live status region continues to announce send/success/error.
• No change to the AJAX endpoint, validation rules, payload shape, dispatcher behavior, or privacy posture.

1.0.5

• Suppressed five false-positive Plugin Check warnings in TLKD_Feedback. No behavioural change.

1.0.4

• Added an optional “Report a Bug” button on the settings page sidebar. Opens a modal that accepts a subject, message, optional reply-to email, and up to three image attachments.
• The feedback flow is transparent: nothing is transmitted until the administrator clicks Send. Diagnostic environment info is opt-out and the full payload is shown to the user before submission.
• Submissions are recorded locally in a bounded log (tlkd_feedback_log, 50 most recent entries, removed on uninstall unless data is preserved).
• New talkdock_feedback_payload and talkdock_feedback_dispatch filters let extensions modify the payload or replace the default dispatcher.
• Added a == Privacy == section to this readme describing exactly what the Report-a-Bug flow transmits.

1.0.3

• Renamed plugin to “TalkDock — Floating Chat Button” to comply with WordPress.org Plugin Check trademark rules.
• Updated admin hero subtitle to match the new name.
• No functional changes.

1.0.2

• Rebranded from the previous internal name to “TalkDock”.
• Reworked description and admin copy to be factual rather than promotional.
• Removed the red upgrade link from the plugins list row.
• Added an explicit non-affiliation notice regarding WhatsApp.
• Shortcode renamed to [talkdock_button].

1.0.0

• First release.
• Floating chat button with color, position, and animation controls.
• Prefilled message support.
• Visibility rules (login state, hide on mobile).
• Accessibility-first markup.
• Inline shortcode for placing buttons inside content.
• Auto-migration from the legacy custom_wa_* standalone snippet.