Open source · AI · Vanilla JS · PHP
HeshBot
HeshBot is the chat assistant on this website. I built it to replace a third-party chat widget: it runs on my own hosting, calls the Google Gemini API, and answers questions about my services and projects using only the public content of this site. When it doesn't know something, it says so and points you to email.
What it does
- Answers visitor questions about my full-stack, AI and IT support work, grounded in a knowledge file built from this site's pages
- Says it doesn't know instead of guessing, and suggests emailing trevor@trevorheshka.com
- Falls back to other Gemini flash models when one is unavailable, with a friendly message when the free quota runs out
Front end
- Dependency-free vanilla JavaScript and CSS widget
- A small launcher bubble; the widget only loads when you click it
- Keyboard and screen-reader friendly (dialog and live-log roles, Esc to close) and full-screen on phones
- Markdown-lite rendering that escapes the model's output before formatting it
- Conversation kept in sessionStorage for the current tab only
Back end
- Single PHP 7.4 endpoint using curl to call the Gemini REST API
- API key kept in a config file outside the web root
- Per-IP rate limiting (file-based), message length and history caps, and a same-origin check
- JSON errors, and only the chat endpoint is reachable from the web
Built with
- JavaScript, CSS, PHP 7.4, Python (knowledge build script)
- Google Gemini API
- MIT licence
FAQ
What is HeshBot?
HeshBot is the chat assistant on trevorheshka.com. It calls the Google Gemini API and answers questions using only the public content of this site.
Is HeshBot open source?
Yes. The code is MIT-licensed on GitHub at github.com/YardPhantom/HeshBot.
What is HeshBot built with?
A dependency-free vanilla JavaScript and CSS widget, a single PHP 7.4 endpoint that uses curl to call the Gemini REST API, and a Python script that builds its knowledge file from the site's pages.
How does HeshBot avoid making things up?
It is grounded in a knowledge file built from this site's pages, and when the answer isn't there it says so and suggests emailing trevor@trevorheshka.com.
How is HeshBot protected from abuse?
Per-IP file-based rate limiting, message length and history caps, a same-origin check, and only the chat endpoint is reachable from the web. The API key is kept outside the web root.
Source code
The code, README and licence are on GitHub: github.com/YardPhantom/HeshBot.
Related
- AI development — how I build AI assistants like this
- Full-stack development
- All projects