chore: wire production widget URL, redirect dashboard root, group Dependabot updates

[RISHII7]

Summary

Promotes the production widget URL wiring and Dependabot grouping fix from develop to main:

• Widget origin switched from localhost:3001 to the deployed https://echo-widget-steel.vercel.app across the embed demo page, the dashboard Integrations snippets, and the rebuilt widget.js bundle.
• Dashboard root (/) now redirects to /conversations.
• Dependabot minor/patch updates for apps/web, apps/widget, and packages/ui are now grouped, fixing the ERR_PNPM_OUTDATED_LOCKFILE failures on every single-dependency PR.

See CHANGELOG.md for full details.

Summary by CodeRabbit

• New Features

  • The app now redirects the homepage to the conversations page.
  • Embedded widget and integration snippets now load the hosted widget automatically.

• Bug Fixes

  • Fixed widget loading and message handling to work with the deployed production URL.
  • Improved dependency update handling so grouped updates stay within safer minor and patch releases.

• Chores

  • Updated release notes to reflect the latest deployment and CI behavior.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
echo	Ready	Preview, Comment	Jul 9, 2026 6:32am
echo-widget	Ready	Preview, Comment	Jul 9, 2026 6:32am

[coderabbitai]

📝 Walkthrough

Walkthrough

Widget-related URLs are migrated from localhost to a deployed production endpoint across embed HTML, integration constants, and widget.js (including postMessage origin check and hide function rewiring). A Next.js redirect from "/" to "/conversations" is added. Dependabot config gains grouped update-type restrictions for three ecosystems. CHANGELOG.md is updated accordingly.

Changes

Production widget URL migration

Layer / File(s)	Summary
Widget iframe URL and hide wiring apps/widget/public/widget.js	Default WIDGET_URL changed from localhost to the production URL, affecting iframe src generation and postMessage origin validation; hide export rewired to a different internal function, invoked on "close" message.
Embed and dashboard integration snippets apps/embed/landing.html, apps/web/modules/integrations/constants/index.ts	Script src values in the embed landing page and integration snippet constants (HTML_SCRIPT, REACT_SCRIPT, NEXTJS_SCRIPT, JAVASCRIPT_SCRIPT) updated from localhost to the production widget URL.
Redirect and changelog apps/web/next.config.ts, CHANGELOG.md	Adds a non-permanent redirect from "/" to "/conversations" in Next.js config; CHANGELOG.md documents the widget URL and redirect changes plus the Dependabot fix.

Estimated code review effort: 2 (Simple) | ~10 minutes

Dependabot grouping configuration

Layer / File(s)	Summary
Grouped dependency update-types .github/dependabot.yml	Adds groups.dependencies.update-types restricted to "minor" and "patch" for /apps/web, /apps/widget, and /packages/ui npm configurations.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main changes: production widget URL wiring, a dashboard root redirect, and Dependabot grouping.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch develop

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

.github/dependabot.yml (1)

43-47: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Sub-package production dependency grouping diverges from root workspace behavior.

The PR objective states this config "mirrors the root workspace behavior," but the root workspace (lines 13-22) splits groups into dev-dependencies (minor+patch) and production-dependencies (patch-only). The new sub-package blocks use a single dependencies group with minor+patch and no dependency-type filter, meaning minor production dependency updates will be bundled into grouped PRs for sub-packages but would remain as individual PRs under the root config.

If this is intentional (simpler config for sub-packages), consider documenting the rationale. If the intent is to truly mirror root, split the group:

♻️ Proposed refactor to mirror root workspace grouping

     groups:
-      dependencies:
+      dev-dependencies:
+        dependency-type: "development"
         update-types:
           - "minor"
           - "patch"
+      production-dependencies:
+        dependency-type: "production"
+        update-types:
+          - "patch"

This applies to all three blocks at lines 43-47, 68-72, and 93-97.

As per coding guidelines, the PR objective states the Dependabot fix mirrors the root workspace behavior so grouped PRs update pnpm-lock.yaml correctly.

Also applies to: 68-72, 93-97

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/dependabot.yml around lines 43 - 47, The new Dependabot grouping
blocks do not actually mirror the root workspace behavior because they use a
single `dependencies` group with `minor` and `patch` updates and no
`dependency-type` split. Update the three sub-package configs to match the root
pattern by separating `dev-dependencies` and `production-dependencies`, and
apply the same update-type/dependency-type filters used in the root workspace so
grouped PRs behave consistently across packages. Refer to the Dependabot
`groups` entries in this YAML when making the change.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/dependabot.yml:
- Around line 43-47: The new Dependabot grouping blocks do not actually mirror
the root workspace behavior because they use a single `dependencies` group with
`minor` and `patch` updates and no `dependency-type` split. Update the three
sub-package configs to match the root pattern by separating `dev-dependencies`
and `production-dependencies`, and apply the same update-type/dependency-type
filters used in the root workspace so grouped PRs behave consistently across
packages. Refer to the Dependabot `groups` entries in this YAML when making the
change.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: ffdbce35-250c-4407-8c05-a59700af9d94

📥 Commits

Reviewing files that changed from the base of the PR and between 063f86c and 8e4dd1b.

📒 Files selected for processing (6)

• .github/dependabot.yml
• CHANGELOG.md
• apps/embed/landing.html
• apps/web/modules/integrations/constants/index.ts
• apps/web/next.config.ts
• apps/widget/public/widget.js