release: SiteAgent 2.19.3 — a sandbox root that is a link is reported as one (#133)

README.md

@@ -17,7 +17,7 @@
   </a>
   <img src="https://img.shields.io/badge/WordPress-6.2%E2%80%937.1-21759b?logo=wordpress" alt="WordPress" />
   <img src="https://img.shields.io/badge/PHP-7.4%2B-777bb4?logo=php" alt="PHP" />
-  <img src="https://img.shields.io/badge/Stable-2.19.2-green" alt="Stable" />
+  <img src="https://img.shields.io/badge/Stable-2.19.3-green" alt="Stable" />
 </p>
 
 ---
@@ -239,6 +239,10 @@ These plug straight into **Aura's Fleet MCP Gateway**: read tools run on demand,
 
 ## Changelog
 
+### 2.19.3
+
+- **A sandbox root that is a link is reported as one, even when its target is gone.** `third_party.emcp_sandbox` probed `is_dir()` before `is_link()`; `is_dir()` follows a link, so a `wp-content/emcp-sandbox` link to a missing target read as `present: false, store: null`, and a healthy link was resolved before the no-follow rule applied. The link test now comes first in both places: presence counts the link itself, and `store` answers `sandbox_is_link` without resolving anything. (#133)
+
 ### 2.19.2
 
 - **The EMCP sandbox store is counted, not just noticed.** `audit_agent_code` → `third_party.emcp_sandbox` gains `active` (`EMCP_TOOLS_VERSION` is defined — the plugin is loaded) and `store`: `null` when `wp-content/emcp-sandbox` does not exist, `{ error }` (`sandbox_unreadable` / `sandbox_is_link` / `sandbox_walk_failed`) when it cannot be counted, else `{ files, executable_files, newest_mtime, truncated, unreadable_dirs }`. A metadata walk: no file is opened and no name or path leaves the site; iterative and capped at 20000 entries, directories included, so the cap bounds the work; `truncated` or `unreadable_dirs ≥ 1` makes the counts lower bounds. Links are never followed and never stat'ed — a link inside the store is one entry judged by its own name (a `*.php`-named link counts as executable), and a store root that is itself a link is not walked. A throw inside the walk stays inside this store, so `atarim_exec` still answers. `present` / `version`, `scan_executable_files` and `atarim_exec` are unchanged. Aura grades the count info / medium / high (Digitizers/Aura `docs/superpowers/specs/2026-09-21-agent-installed-packages-design.md` §3). (#129)

digitizer-site-worker/digitizer-site-worker.php

@@ -3,7 +3,7 @@
  * Plugin Name:       SiteAgent for Aura
  * Plugin URI:        https://my-aura.app/siteagent
  * Description:       Remote site management agent for Aura dashboard. Enables secure updates, health monitoring, and maintenance operations via REST API.
- * Version:           2.19.2
+ * Version:           2.19.3
  * Requires at least: 6.2
  * Requires PHP:      7.4
  * Author:            Digitizer
@@ -18,7 +18,7 @@
 	exit;
 }
 
-define( 'AURA_WORKER_VERSION', '2.19.2' );
+define( 'AURA_WORKER_VERSION', '2.19.3' );
 define( 'AURA_WORKER_FILE', __FILE__ );
 define( 'AURA_WORKER_DIR', plugin_dir_path( __FILE__ ) );
 

digitizer-site-worker/readme.txt

@@ -4,7 +4,7 @@ Tags: ai, automation, maintenance, updates, wordpress management
 Requires at least: 6.2
 Tested up to: 7.1
 Requires PHP: 7.4
-Stable tag: 2.19.2
+Stable tag: 2.19.3
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
 
@@ -253,6 +253,9 @@ Yes. SiteAgent is open source under the GPLv2 or later license. The source code
 
 == Changelog ==
 
+= 2.19.3 =
+* A third-party sandbox directory that is a link to a missing or unreachable location is now reported as a link, not as "no sandbox here". The audit checks for a link before it looks at what the link points to. Read-only; nothing changes on the site.
+
 = 2.19.2 =
 * `audit_agent_code` now counts what is in a third-party agent tool's sandbox store (`wp-content/emcp-sandbox`): `third_party.emcp_sandbox` gains `active` (the plugin is loaded) and `store` — how many files, how many with an executable extension, and the newest modification date. Until now an empty directory and one holding forty PHP files looked the same to a fleet audit. Counts only: no file is opened and no file name leaves the site. Links are never followed; a sandbox directory that is itself a link is reported as such and not walked. A directory that cannot be read is reported as unreadable, never as empty. Read-only, no settings, nothing changes on the site.
 
@@ -446,24 +449,10 @@ Yes. SiteAgent is open source under the GPLv2 or later license. The source code
 * Compatibility: a 2.13 site that is never sent a disconnect behaves exactly
   as 2.12 did. Nothing on the site changes until Aura asks for one.
 
-= 2.12.0 =
-* Feature: **a rule can now apply to some of a client's sites instead of all
-  of them.** Aura's signed ruleset names the site each document was issued
-  for, SiteAgent stores that identity, and a rule that lists the sites it
-  applies to is enforced only where it belongs. Rules that name no sites are
-  client-wide exactly as before.
-* Safety: a site that cannot prove its own identity — an older record, a
-  document issued before this field existed — enforces EVERY rule rather than
-  skipping the ones it cannot place. Scoping only ever narrows on proof.
-* Upgrade: the identity is recovered offline from the ruleset already stored,
-  by re-verifying its signature locally. No new network traffic, and a site
-  whose ruleset has not changed since the upgrade is repaired on its next
-  request rather than waiting for the next push.
-
-= 2.11.0 and earlier =
+= 2.12.0 and earlier =
 
 * WordPress.org truncates a Changelog over 5,000 words, and this plugin's history is longer than that.
-  The entries for 2.11.0 and every release before it were moved out of this file verbatim and are kept in full at:
+  The entries for 2.12.0 and every release before it were moved out of this file verbatim and are kept in full at:
   https://github.com/Digitizers/SiteAgent/blob/main/docs/changelog-archive.md
 
 == Upgrade Notice ==

docs/changelog-archive.md

@@ -16,6 +16,20 @@ the judgement call this file exists to avoid.
 
 Newest first, continuing exactly where `readme.txt`'s Changelog stops.
 
+= 2.12.0 =
+* Feature: **a rule can now apply to some of a client's sites instead of all
+  of them.** Aura's signed ruleset names the site each document was issued
+  for, SiteAgent stores that identity, and a rule that lists the sites it
+  applies to is enforced only where it belongs. Rules that name no sites are
+  client-wide exactly as before.
+* Safety: a site that cannot prove its own identity — an older record, a
+  document issued before this field existed — enforces EVERY rule rather than
+  skipping the ones it cannot place. Scoping only ever narrows on proof.
+* Upgrade: the identity is recovered offline from the ruleset already stored,
+  by re-verifying its signature locally. No new network traffic, and a site
+  whose ruleset has not changed since the upgrade is repaired on its next
+  request rather than waiting for the next push.
+
 = 2.11.0 =
 * Feature: **the magic-link connect now mints an Application Password for
   the dashboard.** A magic-link connection could run SiteAgent's own tools