cockpitOS AI Assistant (WordPress Plugin)

The plugin connects a WordPress site with the cockpitOS dashboard (API URL, API key of the WordPress site, optional Center ID). The chat operates as a Web Component through a PHP Proxy (admin-ajax.php) – the API key is not delivered to the browser (see below).

Visible Page Content and API Key

• No context as plain text: The shortcode only outputs a mount container (and styles/scripts). Content for the bot (pages, cockpit data) is server-side merged in POST /api/ai/visitor-chatbot – they do not appear as readable article text or hidden blocks in the page HTML.
• API Key: Is stored only in the WordPress database and in the PHP Proxy. In the public markup (e.g. data-config64), no key is output once the proxy is used.

Bot Context: WordPress Push + Cockpit

When this WordPress website is assigned to a center website in Cockpit (WordPressWebsite → centerId), the visitor chatbot always loads the pushed WordPress pages (staticPages from the push) into the system context – in addition to the usual cockpit slices (shops, events, etc.). This keeps information from content mapping usable, even if the user question sounds like it is only about shops and the pure intent analysis wouldn't have selected CMS pages.

Context from the Cockpit (No Manual Double Plating)

Texts, colors, and quick topics for the embedded chat come from the chatbot tab in the cockpit (center website configuration), not from parallel WordPress settings:

• The plugin calls GET /api/wordpress/embed-config with the website API key and takes over, among other things, greeting, rotating search field placeholders as chips (popularTopics), consent titles/descriptions, and privacy policy URL.
• The response is briefly cached (for a few minutes) to ensure each page view does not hit the dashboard API; after disconnecting, the cache is cleared.
• Shortcode attributes can still be set: For example, if you define your own popular_topics in the shortcode, these have priority over the cockpit values – otherwise, the central list from the cockpit applies.

Technical details on the JSON: API Contract - WordPress Embed.

Disconnect

Under cockpitOS AI → Connection, the section "Disconnect" appears when a connection is active.

• Removes the API key stored in this plugin, the Center ID, and the Embed URL (Center Website App).
• Disables "Use Existing Connection".
• Deletes the last push summary (display under Sync & Status).
• Content mapping (post type associations) remains intact.
• The cockpitOS integration (main plugin), if installed, is not changed – its API key is in the options of the other plugin.

After disconnecting, the shortcode becomes ineffective for visitors without a new connection (or shows a notice to administrators).

Test Connection

With a saved connection, cockpitOS AI → Connection shows the section "Test Connection & Embed URL".

• Test Connection – calls server-side GET /api/wordpress/embed-config with Bearer token. Upon success, Center slug and Center ID appear.
• Generate Embed URL with Token – calls POST /api/wordpress/embed-token and shows a finished URL …/embed/chat?et=… (without API key in the address). For this, COCKPIT_WP_EMBED_TOKEN_SECRET must be set in the dashboard; otherwise, an error message appears.

Debug Log (Development)

When WP_DEBUG is set to true in wp-config.php, the plugin writes technical hints to error_log (e.g., failed API responses without secrets, chat proxy nonce, rate limit). In production, set WP_DEBUG to off.

Quick Checklist for Target Website

Topic	Note
HTTPS	Page and dashboard API via TLS; avoid mixed content.
Caching	Clear page cache after plugin updates (asset version to COCKPIT_OS_AI_VERSION).
Consent / GDPR	Consent text in the widget; link to privacy policy.
Duplicate Chat	Only one shortcode mode per page (e.g., no second FAB); ambient trigger hides if mode="bubble" is already set.
Troubleshooting	Check context status under Sync & Status; ensure API URL is reachable.

Technical details on embed (?et=), proxy, and API: API Contract - WordPress Embed.