feat(automations): add floating AI copilot chat

.env.local.example

@@ -24,10 +24,13 @@ SUPABASE_SERVICE_ROLE_KEY=your-service-role-key
 # key — users have to re-save their WhatsApp settings to reconnect.
 ENCRYPTION_KEY=your-64-char-hex-key-here
 
-# Meta App Secret (Meta for Developers → App Settings → Basic).
-# Verifies the HMAC-SHA256 signature on every inbound webhook POST.
-# Required — without it the webhook rejects every request.
-META_APP_SECRET=your-meta-app-secret
+# Z-API instance credentials are saved per account in Settings > WhatsApp
+# and encrypted in the database. Optional values below are only for the
+# local readiness smoke check (`npm run zapi:check`); the app does not
+# use them for normal sending.
+# ZAPI_INSTANCE_ID=your-zapi-instance-id
+# ZAPI_INSTANCE_TOKEN=your-zapi-instance-token
+# ZAPI_CLIENT_TOKEN=your-zapi-client-token
 
 # ============================================================
 # RECOMMENDED — safe defaults exist but you'll want to set these.
@@ -42,9 +45,6 @@ META_APP_SECRET=your-meta-app-secret
 # or a background worker that has no incoming request.
 NEXT_PUBLIC_SITE_URL=https://crm.example.com
 
-# Default language locale (e.g. en)
-NEXT_PUBLIC_APP_LOCALE=en
-
 # ============================================================
 # OPTIONAL — only needed if you use the feature.
 # ============================================================
@@ -81,38 +81,21 @@ NEXT_PUBLIC_APP_LOCALE=en
 # See docs/automations-and-cron.md.
 # AUTOMATION_CRON_SECRET=generate-a-long-random-string
 
-# Meta App ID (Meta for Developers → App Settings → Basic). Required to
-# create/edit message templates with an IMAGE header: Meta only accepts a
-# Resumable-Upload media handle (not a plain URL) as the header sample, and
-# that upload is app-scoped. Without it, image-header template submission
-# returns a clear error; text/body-only templates are unaffected. Pair
-# with META_APP_SECRET.
-# META_APP_ID=your-meta-app-id
-
-# When "true", POST /api/whatsapp/templates/submit skips the Meta call
-# and stores the row with a synthetic `dry-run-<uuid>` meta_template_id.
-# Set this in CI and local development so you can exercise the full
-# template UI without a real WABA. Leave unset (or "false") in prod.
-# WHATSAPP_TEMPLATES_DRY_RUN=true
+# Distributed rate limiting (recommended for multi-instance deploys).
+# When these are set, src/lib/rate-limit.ts uses Upstash Redis over
+# REST with a fixed-window counter shared across all app instances.
+# When unset, the app falls back to the in-memory per-process limiter.
+# UPSTASH_REDIS_REST_URL=https://your-instance.upstash.io
+# UPSTASH_REDIS_REST_TOKEN=your-upstash-rest-token
 
-# ------------------------------------------------------------------
-# AI reply assistant (optional)
-# ------------------------------------------------------------------
-# The AI assistant is bring-your-own-key: each account pastes its own
-# OpenAI or Anthropic key under Settings → AI Assistant. The key is
-# stored AES-256-GCM-encrypted with ENCRYPTION_KEY (above) — there is
-# NO global provider key env var, and nothing here is required for the
-# feature to work. The two vars below only tune behaviour.
-#
-# The AI knowledge base (migration 030) uses Postgres full-text search
-# out of the box. Optional semantic search needs the `pgvector`
-# extension — migration 030 runs `CREATE EXTENSION IF NOT EXISTS vector`
-# (Supabase has it available) — plus a per-account embeddings key set in
-# Settings → AI Assistant. Still no env var required.
+# Optional rate-limit store tuning.
+# Timeout for the Upstash REST call in milliseconds. Default: 1500
+# RATE_LIMIT_STORE_TIMEOUT_MS=1500
 
-# Per-call timeout for provider requests, in milliseconds. Default 30000.
-# AI_REQUEST_TIMEOUT_MS=30000
+# Fallback if the external store errors or times out:
+# - memory (default): keep the old in-process limiter behavior
+# - deny: fail closed with 429 until the store recovers
+# RATE_LIMIT_FALLBACK_MODE=memory
 
-# How many recent text messages of a conversation to send the model as
-# context (draft + auto-reply). Default 20.
-# AI_CONTEXT_MESSAGE_LIMIT=20
+# Optional Redis key prefix for the shared buckets.
+# RATE_LIMIT_KEY_PREFIX=wacrm:rate-limit:v1

.gitignore

@@ -39,6 +39,9 @@ yarn-error.log*
 # vercel
 .vercel
 
+# git worktrees (subagent-driven-development isolation)
+/.worktrees/
+
 # typescript
 *.tsbuildinfo
 next-env.d.ts

CHANGELOG.md

@@ -9,6 +9,21 @@ Versions follow [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 Pre-1.0, `MINOR` bumps cover new modules; `PATCH` bumps cover bug fixes
 and polish.
 
+## [0.9.0] — 2026-07-20
+
+Removes the AI reply assistant from the product.
+
+> **Migration required:** apply `supabase/migrations/037_drop_ai.sql`.
+> This migration is destructive: it drops AI configuration, knowledge
+> base, usage, message badge, and conversation auto-reply data.
+
+### Removed
+
+- **AI Agents and AI reply assistant.** Removed the `/agents` section,
+  `/api/ai/*` routes, inbox draft button, auto-reply handoff banner,
+  AI message badge, provider configuration, knowledge base UI, and the
+  internal AI runtime.
+
 ## [0.8.1] — 2026-07-10
 
 Fixes inbound chats fragmenting into multiple threads for the same

README.md

@@ -33,13 +33,6 @@ clone or fork it to run your own CRM.
 - **No-code automations** — triggers on inbound messages, new
   contacts, keywords, or schedule; conditional branches, waits,
   tags, webhooks. Visual builder.
-- **AI reply assistant** — bring your own OpenAI or Anthropic key
-  (stored encrypted; no per-seat AI fee, your data stays yours).
-  One-click AI-drafted replies in the inbox, plus an optional
-  auto-reply bot with a per-conversation cap and clean human handoff.
-  Add a **knowledge base** (FAQs, policies, product docs) and it
-  answers from your own content — hybrid retrieval (Postgres full-text,
-  or semantic pgvector when an embeddings key is set).
 - **Real-time dashboard** — response times, daily volume, pipeline
   value, cross-module activity feed.
 - **Team accounts** — invite teammates by link, role-based access