Resayil AI

Resayil AI links your WordPress site to the Resayil AI AI operations platform. Once connected, the Resayil AI agent can:

• Read and draft WordPress posts on your behalf
• Assist with WooCommerce product and order management (requires WooCommerce)
• Chat with the Resayil AI directly from your WordPress admin (Resayil AI > AI Chat)
• View a live summary of your products and recent orders (Resayil AI > Store)

This plugin’s own chat surface is the in-admin AI Chat panel above. Telegram and WhatsApp are additional chat channels available on paid Resayil AI plans and are provisioned from your Resayil AI dashboard (not by this plugin) — see your dashboard’s Channels page once connected.

How it works

1. Install and activate this plugin.
2. Obtain a Connect Key from your Resayil AI dashboard (Account > Connect new store).
3. Paste the key into Settings > Resayil AI > Settings and click “Connect this site”.
4. The plugin generates a WordPress Application Password (and, if WooCommerce is active, a read-only WooCommerce REST API key) and securely registers your site with the Resayil AI backend. You never copy or paste credentials by hand. The agent starts in read-only mode; a read/write WooCommerce key is issued only if and when you enable writes for the connection.

External Service Disclosure

This plugin connects to the Resayil AI backend service (https://ecomai.resayil.io, operated by Resayil) so the Resayil AI agent can operate your store on your behalf. By using this plugin you agree to the Resayil AI Terms of Service and Privacy Policy.

What is sent, and when:

• On connect (you click “Connect this site”): your site URL, the connecting user’s login name, a newly generated WordPress Application Password, your one-time Connect Key, and — if WooCommerce is active — a newly generated read-only WooCommerce REST API key/secret. A per-site secret used to verify signed requests from Resayil AI is also sent. These travel once, over HTTPS.
• During normal use: the Resayil AI agent uses the stored Application Password / WooCommerce key to read and (only with your approval, and only once writes are enabled for your connection) update your content, products, and orders. These requests are initiated by you through the Resayil AI chat agent.
• AI Chat panel: chat messages you type into the Resayil AI Chat panel (Resayil AI > AI Chat in the WordPress admin) are sent to ecomai.resayil.io over HTTPS for AI processing; the AI reply is returned and displayed in the same panel. No chat content is stored by this plugin locally. The request is signed with your per-site secret so it is scoped to your account only.
• On disconnect: the plugin revokes the Application Password and WooCommerce key it created and notifies Resayil AI (the notice is signed with your per-site secret so it cannot be spoofed for another site).

No data is sent to the external service without the site administrator explicitly initiating a connection. The Application Password is never stored in plaintext by this plugin — only the handles needed to revoke them are kept.

WooCommerce key permission and storage: the WooCommerce REST key is minted read-only by default (least privilege), matching the agent’s default read-only posture; a read/write key is provisioned only when you deliberately enable writes for the connection. Note that WooCommerce core itself stores the REST key’s consumer secret in plaintext in its own database table ({prefix}woocommerce_api_keys) — this is standard WooCommerce behavior, not introduced by this plugin. Keeping the key read-only by default limits the impact of any exposure of that table to read access.

Capability bridge (advanced, optional, off by default)

The plugin can optionally expose a small, named set of LOCAL operations to Resayil AI over a signed REST endpoint (POST /wp-json/ecomai/v1/capability). This is disabled by default and only runs when you enable it in Settings AND Resayil AI enables it for your account. It never executes remote or arbitrary code — only this fixed allowlist:

• wp.get_seo_meta — read a post’s SEO title/description (Yoast).
• wp.set_seo_meta — update a post’s SEO title/description (Yoast).
• wp.upload_media — sideload an image into the media library from an HTTPS URL (the URL is validated against private/reserved/link-local addresses to prevent server-side request forgery).
• wp.schedule_post — schedule a draft or pending post for future publication. It cannot schedule already-published content (which would unpublish it).

Every call is authenticated with an HMAC signature using your per-site secret, is replay-protected, and each capability has its own on/off switch (all default off). An optional storefront assistant widget is likewise off by default.

Source Code

Available at https://github.com/soudshoja/shopify-ai (private repository — source included in the zip).

Build: no compile step is required (pure PHP + vanilla JS). To produce a clean
distributable archive (runtime files only, excluding dev tooling), run from the
plugin directory:

bash bin/build-zip.sh        # or: composer build-zip  /  npm run zip

This writes resayil-ai.zip with resayil-ai/ as the archive root.
A plain zip -r resayil-ai.zip resayil-ai from the parent directory
also works for manual builds.