Book a demo
Book a demo
Login
NewFixedSecurity

v2.9.9.1

Ask the AI Assistant from the Command Palette

You can now type a question into the command palette and send it straight to the AI assistant. Restores, clones and migrations now import your database with the site’s own access, not full admin rights. This release also fixes site security settings that could turn off when you changed something else.

🔥 New Features

🆕 Ask the AI Assistant from Anywhere with ⌘K

Before, typing a question like “why is my site slow?” into the command palette found nothing. You had to close it and open the assistant yourself.

Who it’s for: Everyone who uses the AI assistant. It is rolling out to teams gradually.

  • Ask from the palette: press ⌘K on a Mac or Ctrl+K on Windows and Linux, and type two or more characters. Choose Ask the AI assistant “…” to open the chat and send what you typed.
  • It knows where you are: ask while you view a server or site, and the assistant answers about that one without asking which.
  • Navigation comes first: when a page, server or site matches, Enter still opens it. A question shows the ask row at the top under Looks like a question. Enter asks only when nothing matches.
  • Shortcut: ⌘↵ or Ctrl ↵ asks from any state. The palette footer shows it as Ask AI.
  • Nothing runs on its own: the palette only sends your question. Any change the assistant suggests still needs your approval.

How to use xCloud AI Assistant

🧑‍💻 For Developers: Public API and MCP

  • Errors say why: a 429 now carries errors.code: rate_limited with retry_after, reset_at, limit, bucket and next_actions, so monitors know when to retry. Message and headers are unchanged.
  • Missing permissions are named: a 403 returns forbidden_ability or forbidden_team_permission with the missing name. Through MCP, the ability refusal keeps its code missing_ability.
  • Server not connected: the access-logs 422 now has errors.code: server_unreachable.
  • MCP search: compact search ranks action words higher, so “delete site” and “backup now” find the right operation first.
  • Vulnerability counts: GET /api/v1/sites/{uuid}/vulnerabilities/count returns data: null for a WordPress site whose scanning is off, instead of zeros. POST /api/v1/sites/{uuid}/vulnerability-scan returns 409 for such a site, and vulnerability_scan_enabled reports the setting the dashboard uses.

🔒 Security

  • Restores, clones and migrations now import your database with the site’s own access, never with full database admin rights. This covers backup restores, clones, snapshot restores, .wpress imports and cPanel and manual migrations. If a restore can’t run safely, it stops before changing anything.
  • SQLite site restores: Restoring an SQLite site, such as n8n, now stays inside that site’s folder, even if the folder holds shortcuts that point somewhere else.
  • Node.js: Node.js apps now restart after a server reboot using xCloud’s own fixed steps, so nothing a site writes can run with admin rights. Node.js 14 downloads are checked before they are installed.
  • AI assistant: changes to the built-in firewall and to PHP in the uploads folder now need a click on the card, not a typed “yes”. The assistant also refuses requests to run raw server commands, however they are worded.

🐞 Bug Fixes

  • Site security
    • Approving one change on the AI assistant’s site security card, such as turning off XML-RPC, no longer turns off the built-in firewall or resets your other security settings.
    • Saving the site Settings page no longer turns off a custom robots.txt.
  • WordPress
    • Database passwords are now written to wp-config.php exactly, so a site no longer loses its database connection after a password change.
  • AI assistant
    • A site mention inside a link in your chat message now shows as one working link.

Please note

  • New WordPress database passwords use letters, digits and _ - ! @ %. Other characters get a clear error. Passwords that already work are not affected.