caterium/caterium-app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
4265a88c34
caterium-app/docs/releases/2026-09-19-SUPPORT-BOT.md
pavlo d7d6f6ff38 Add AI support assistant to the Help dialog 
The Поддержка tab opens an assistant that answers how-to questions from
the handbook. The chat is a sandboxed iframe on the assistant's own
origin and is only loaded after an explicit click, so Help and its search
stay local and no third-party script runs inside the app.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-19 18:27:47 +03:00

1.7 KiB
Raw Blame History

AI support assistant in Help

The Help dialog's "Поддержка" tab can now open an AI assistant that answers "how do I..." questions from the Caterium handbook (the same articles as the "Руководство" tab).

Privacy and isolation:

  • Nothing is requested from the assistant service until the user presses "Задать вопрос помощнику". Opening Help, searching the handbook and switching tabs stay fully local, exactly as before.
  • The chat runs in an <iframe> served from the assistant's own origin (sandbox, referrerpolicy="no-referrer"). It cannot read orders, clients, local storage or the Supabase session of Caterium, and no third-party script is added to the app page.
  • The assistant page sets frame-ancestors to https://app.caterium.ru, so no other site can embed it.
  • The assistant has no access to company data and cannot change anything in Caterium. The tab tells users not to type passwords, confirmation codes or customer data because their question is processed by an external service.

Assistant configuration (agent, instructions, knowledge base and rate limits) lives in the assistant service, not in this repository. The client only needs BOT.origin and BOT.agent in public/core/help-center.js.

If the assistant service is unreachable, only the chat area is affected (it shows the browser's or the assistant's own error page); the handbook and its search keep working.

Regression coverage: tests/help-center.spec.mjs asserts that no external request is made before the click, and that the iframe uses the expected src, referrerpolicy and a restrictive sandbox (no top navigation, forms or modals). No database, migration or permission change.