Addresses real gaps found in testing (a Macedonian question on an English
page returned nothing):
- Detect the language of the QUESTION (Cyrillic -> MK; Slovene markers -> SI;
else the page language) and load that language's index + curated answers.
Fixes cross-language questions.
- Expand curated multilingual intents (now incl. enrolment/eVŠ, deadlines,
health, "what is MSOS", etc.) with stem keywords for better paraphrase
matching. MK/SI answers machine-drafted — proofread before launch.
- Suggested-question chips on open (localized) to guide users.
- Privacy-safe analytics: fire a GA4 'assistant_query' event ONLY after the
visitor accepts cookies (q text, result type, question vs page language) so
the team can see real FAQs and unanswered questions.
- Move the widget to bottom-left on pages with the floating "Become a member"
CTA so they never overlap. Design polish (chips, typing dots, launcher pulse).
- CI: rebuild the search index on every deploy (setup-python + build script)
so the assistant stays in sync with content automatically. Build script is
now path-portable (no hardcoded path).
Verified in a headless browser: MK-on-EN now answers correctly, chips work,
analytics event fires only with consent, become-a-member offset applies,
zero console errors.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Proactive security & health pass. No live/exploitable vulnerabilities were
found; these changes remove information-disclosure surfaces and add
standard hardening.
- Remove publicly-downloadable 1.1 MB full source dump (code_export.txt)
and stray empty l.php; add code_export.txt to .gitignore.
- Exclude dev files/folders (*.sh, *.py, docs/, templates/, tools/,
README.md) from the rsync deploy so they never reach the live server.
- .htaccess: add X-Frame-Options, Referrer-Policy, Permissions-Policy,
and a report-only Content-Security-Policy; add defense-in-depth deny
block for dev/VCS files (robots.txt & sitemap.xml left served).
- .htaccess: fix root redirect to canonical msosorg.com + /en/.
- Swap 4 project-page YouTube embeds to youtube-nocookie.com so no
Google cookies are set before consent (GDPR).
- Add rel="noopener" to 30 team social links on the About Us pages.
- Harden esc() in my-route.js to also escape single quotes.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
popovskik
Mark Poljanšek