Resayil AI

Resayil AI links your WordPress site to the Resayil AI AI operations platform. Once connected, the Resayil AI agent can:

• Read and draft WordPress posts on your behalf
• Assist with WooCommerce product and order management (requires WooCommerce)
• Chat with the Resayil AI directly from your WordPress admin (Resayil AI > AI Chat)
• View a live summary of your products and recent orders (Resayil AI > Store)

This plugin's own chat surface is the in-admin AI Chat panel above. Telegram and WhatsApp are additional chat channels available on paid Resayil AI plans and are provisioned from your Resayil AI dashboard (not by this plugin) — see your dashboard's Channels page once connected. How it works

1. Install and activate this plugin.
2. Obtain a Connect Key from your Resayil AI dashboard (Account > Connect new store).
3. Paste the key into Settings > Resayil AI > Settings and click "Connect this site".
4. The plugin generates a WordPress Application Password (and, if WooCommerce is active, a read-only WooCommerce REST API key) and securely registers your site with the Resayil AI backend. You never copy or paste credentials by hand. The agent starts in read-only mode; a read/write WooCommerce key is issued only if and when you enable writes for the connection.

External Service Disclosure This plugin connects to the Resayil AI backend service (https://ecomai.resayil.io, operated by Resayil) so the Resayil AI agent can operate your store on your behalf. By using this plugin you agree to the Resayil AI Terms of Service and Privacy Policy. What is sent, and when:

• On connect (you click "Connect this site"): your site URL, the connecting user's login name, a newly generated WordPress Application Password, your one-time Connect Key, and — if WooCommerce is active — a newly generated read-only WooCommerce REST API key/secret. A per-site secret used to verify signed requests from Resayil AI is also sent. These travel once, over HTTPS.
• During normal use: the Resayil AI agent uses the stored Application Password / WooCommerce key to read and (only with your approval, and only once writes are enabled for your connection) update your content, products, and orders. These requests are initiated by you through the Resayil AI chat agent.
• AI Chat panel: chat messages you type into the Resayil AI Chat panel (Resayil AI > AI Chat in the WordPress admin) are sent to ecomai.resayil.io over HTTPS for AI processing; the AI reply is returned and displayed in the same panel. No chat content is stored by this plugin locally. The request is signed with your per-site secret so it is scoped to your account only.
• On disconnect: the plugin revokes the Application Password and WooCommerce key it created and notifies Resayil AI (the notice is signed with your per-site secret so it cannot be spoofed for another site).

No data is sent to the external service without the site administrator explicitly initiating a connection. The Application Password is never stored in plaintext by this plugin — only the handles needed to revoke them are kept. WooCommerce key permission and storage: the WooCommerce REST key is minted read-only by default (least privilege), matching the agent's default read-only posture; a read/write key is provisioned only when you deliberately enable writes for the connection. Note that WooCommerce core itself stores the REST key's consumer secret in plaintext in its own database table ({prefix}woocommerce_api_keys) — this is standard WooCommerce behavior, not introduced by this plugin. Keeping the key read-only by default limits the impact of any exposure of that table to read access. Capability bridge (advanced, optional, off by default) The plugin can optionally expose a small, named set of LOCAL operations to Resayil AI over a signed REST endpoint (POST /wp-json/ecomai/v1/capability). This is disabled by default and only runs when you enable it in Settings AND Resayil AI enables it for your account. It never executes remote or arbitrary code — only this fixed allowlist:

• wp.get_seo_meta — read a post's SEO title/description (Yoast).
• wp.set_seo_meta — update a post's SEO title/description (Yoast).
• wp.upload_media — sideload an image into the media library from an HTTPS URL (the URL is validated against private/reserved/link-local addresses to prevent server-side request forgery).
• wp.schedule_post — schedule a draft or pending post for future publication. It cannot schedule already-published content (which would unpublish it).

Every call is authenticated with an HMAC signature using your per-site secret, is replay-protected, and each capability has its own on/off switch (all default off). An optional storefront assistant widget is likewise off by default.

1.3.3

• Disconnecting now sends a signed notice to the Resayil AI backend so your account's connection record is removed automatically, not just the local WordPress credentials (the confirmation message now reflects whether the backend was reachable).
• Corrected the plugin description and feature list: this plugin's own chat surface is the in-admin AI Chat panel. Telegram and WhatsApp are described as paid-plan channels provisioned from the Resayil AI dashboard, not implied to be provisioned by this plugin.
• Backend coexistence fix: sites running both this plugin and the Resayil AI WooCommerce extension no longer interfere with each other's signed requests.

1.3.2

• Renamed the storefront widget's localized JS object and the browser-facing REST namespace (chat, store, features) from a generic ecomai prefix to the plugin's own resayil prefix, to avoid naming collisions with other plugins.

1.3.1

• Removed the manual load_plugin_textdomain() call — WordPress.org auto-loads translations for hosted plugins since WordPress 4.6, so the bundled call is no longer needed.
• Corrected the readme Contributors line to match the WordPress.org account username.
• Added an Author Email header to the plugin file for ownership clarity.

1.3.0

• Added Store Features page (Resayil AI > Store Features): choose, per connected store, which capabilities the agent may use with read, view, and write tiers, mirroring the web dashboard. Selections are synced with the Resayil AI backend over the signed per-site channel and enforced server-side.
• Added "Create account & connect": set up a Resayil AI account and connect this site in one step, with passwordless magic-link sign-in. The existing connect-key path is kept for merchants who already have an account.
• Hardening and WordPress.org compliance refinements.

1.2.0

• Added AI Chat panel (Resayil AI > AI Chat): chat directly with the Resayil AI from the WordPress admin. Messages are sent to ecomai.resayil.io over HTTPS and signed with the per-site secret. History, real-time polling, and inline approval cards are included.
• Added Store panel (Resayil AI > Store): responsive product and order card grid reading local WooCommerce / WordPress data, no network call required.
• Added /wp-json/ecomai/v1/{chat,history,poll,approvals,approvals/{id}/approve,approvals/{id}/reject} REST endpoints (manage_options + WP REST nonce on every route).
• Added /wp-json/ecomai/v1/store/{products,orders,status} REST endpoints (local reads only, manage_options + nonce).
• Privacy: updated suggested policy text and disclosure to cover the AI Chat data flow.

1.1.1

• WordPress.org compliance: removed the Update URI header, refreshed "Tested up to", added a GPL LICENSE file and the translation template (.pot).
• Privacy: registered suggested privacy-policy text plus a personal-data exporter and eraser for the stored connecting username and timestamp.
• WooCommerce: declared High-Performance Order Storage (HPOS) and cart/checkout Blocks compatibility, and added the WC version headers.

1.1.0

• Connect flow implemented (GAP-B3, Option B): the plugin self-generates a WordPress Application Password and, when WooCommerce is active, a read-only WooCommerce REST API key (least privilege; upgraded to read/write only when writes are enabled), then registers the site with the Resayil AI backend.
• Added Disconnect (revokes the generated credentials + clears local state).
• Added the optional, off-by-default capability bridge (HMAC-signed, named-allowlist REST endpoint) and the optional, off-by-default storefront assistant widget.
• Added text-domain loading and expanded external-service disclosure.

1.0.0

• Initial release — plugin scaffold, Settings page, connection flow stub.