# AI support assistant in Help

The Help dialog's "Поддержка" tab can now open an AI assistant that answers
"how do I..." questions from the Caterium handbook (the same articles as the
"Руководство" tab).

Privacy and isolation:

- Nothing is requested from the assistant service until the user presses
  "Задать вопрос помощнику". Opening Help, searching the handbook and switching
  tabs stay fully local, exactly as before.
- The chat runs in an `<iframe>` served from the assistant's own origin
  (`sandbox`, `referrerpolicy="no-referrer"`). It cannot read orders, clients,
  local storage or the Supabase session of Caterium, and no third-party script
  is added to the app page.
- The assistant page sets `frame-ancestors` to `https://app.caterium.ru`, so no
  other site can embed it.
- The assistant has no access to company data and cannot change anything in
  Caterium. The tab tells users not to type passwords, confirmation codes or
  customer data because their question is processed by an external service.

Assistant configuration (agent, instructions, knowledge base and rate limits)
lives in the assistant service, not in this repository. The client only needs
`BOT.origin` and `BOT.agent` in `public/core/help-center.js`.

If the assistant service is unreachable, only the chat area is affected (it
shows the browser's or the assistant's own error page); the handbook and its
search keep working.

Regression coverage: `tests/help-center.spec.mjs` asserts that no external
request is made before the click, and that the iframe uses the expected
`src`, `referrerpolicy` and a restrictive `sandbox` (no top navigation, forms
or modals). No database, migration or permission change.