Repository navigation
WPPilot 1.16.0 - #12
Merged
Merged
Conversation
…unreviewed, not tested) Kit runtime API 1.2: unclaimed() lets a kit stand aside for an ability name that Pro 1.10.0 (or a richer Pro version) registered first. Free phpunit and the kit gates passed on this change alone; none of the five moved kits exist yet. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Every client below was re-checked against its vendor's documentation on 2026-09-30; the source URL is cited next to each builder. - Kimi: target Kimi Code CLI (~/.kimi-code/mcp.json, /mcp-config, /mcp-config login) instead of the archived Python kimi-cli. - GitHub Copilot: emit Copilot CLI's format (mcpServers + tools, at ~/.copilot/mcp-config.json or .github/mcp.json); .github/copilot/mcp.json is undocumented and the CLI rejects "servers". Note that VS Code uses the VS Code tab and the cloud agent cannot use OAuth. - Devin Desktop: list ~/.config/devin/mcp_config.json with the Windsurf path. - Zed: native url/headers and url-only OAuth; drop "source": "custom". - Kilo Code: kilo.jsonc under "mcp" (OpenCode's shape). - OpenClaw: mcp.servers with transport "streamable-http". - Claude Desktop token entry: run through mcp-remote, since the config file is for local servers. - Native OAuth for Zed, Cline, Kilo, OpenCode, Amazon Q/Kiro, OpenClaw; OAuth tabs for Kimi, Qwen, ZCode, Factory Droid, OpenClaw (Gemini CLI locally). - Manus accepts an access token. - Fix the Claude Code "needs authentication" note, the Antigravity IDE hint and the Roo Code migration targets. Shared config paths now live in one helper per client, and ClientConfigsTest pins each shape. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Ledger rows written inside an agent session now carry its id (the hashed Mcp-Session-Id, one stdio process, or one credential and client until 30 minutes idle) and a digest of the target's state right after the write. wppilot/undo-session undoes a session newest first through the verified rollback, refusing the whole run when something else changed a target since, stopping at the first change that fails verification, and never skipping an irreversible change silently (allow_partial to proceed past them). Every undo keeps the state it replaced, and wppilot/redo-session puts it back oldest first under the same checks. wppilot/list-sessions lists sessions and their undo/redo plan. The Changes screen lists recent sessions and gets Undo session / Redo session buttons. Also stops recording a row for the legacy MCP execute tool itself: it ran the target ability, which records its own row, so every legacy call (reads included) left an extra "No supported before-image" row that would have made every legacy session look irreversible. Ledger table schema 2 adds session_id and redo_data. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A local client (Claude Code, Cursor, CI) can launch WP-CLI instead of connecting over HTTP. The command drives the adapter's own request router for the wppilot server, so tools, the mcp_adapter_pre_tool_call controls and permission checks are the HTTP ones, run as the user WP-CLI's --user names. It refuses to start without a user or with abilities switched off, keeps stdout to JSON-RPC only (errors and stray output go to stderr), drops the runtime object cache before each message, credits writes to method stdio with the client from initialize, and makes each process one session for undo-session. The Connect screen shows the claude mcp add command and a Cursor mcp.json filled in with this site's path and user. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
README, docs/wordpress-mcp.md and docs/SAFETY.md describe both features; CHANGELOG.txt lists them under Unreleased for the 1.16.0 merge. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… audits into the free plugin WPPilot 1.16.0 takes the basics of five WPPilot Pro feature sets as kits, under the ability names Pro uses: WooCommerce store reads and a basic product editor (woo-basics, 13), one post's SEO title, description and robots for seven SEO plugins (seo-basics, 14), read-only forms with contact details redacted (forms-basics, 8), backup and security status (backup-status, security-status, 5), and scheduled audits with a Routines screen (scheduled-audits, 5). Every write is undoable from the Changes screen. Pro 1.10.0 still registers all of these. Each kit ability now registers only while its name is free (Runtime\unclaimed(), kit runtime 1.2), and the undo capture attaches only to the copy that registered, so on a site running Pro 1.10.0 Pro's copies answer and nothing is registered twice; scheduled audits stay off while Pro's routines kit runs. The coexistence gate loads Pro's kits in its engine's order and proves the stand-aside against a Pro release with --installed-pro. 45 new abilities, 213 in all; version 1.16.0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… Dashboard's notices Found on WordPress 7.1 over MCP. Forminator loads its form and entry models on init and SmartCrawl defines SMARTCRAWL_VERSION on init, both after the kit loader chooses its files on plugins_loaded, so with either plugin active and no Pro their free abilities never registered. The loader now looks for the classes their main files declare, and the abilities still check the rest when they run. list-orders asks WooCommerce for orders only, so refunds no longer count towards total and pages. The Dashboard's recent changes logged a notice for every change made by an ability that is no longer registered, such as an SEO plugin's edit after the plugin was switched off. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Session undo/redo, ledger schema 2, wp wppilot mcp serve and the Changes/Connect session and stdio UI, on top of the Pro-to-Free moves. Conflicts: CHANGELOG.txt's Unreleased section folded into 1.16.0, and readme.txt's 1.16.0 changelog brought level with it. The registered count is 216 (213 from the moves plus list-sessions, undo-session and redo-session, measured with scripts/check-ability-count.php), updated in product-facts.json, README and docs/wordpress-mcp.md; the README Changes row now counts 8. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Client configuration generators matched to the vendors' docs, and the widened credential-key redaction in the change history. Conflicts: CHANGELOG.txt's Unreleased section folded into 1.16.0 (new entries with the other new ones, fixes with the fixes), and readme.txt's 1.16.0 changelog brought level with it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The session undo checks each target is still as the session left it and keeps the state it replaces for a redo, which needs the target's state now. The change log knew that for its own restore types and the runtime's post-partial only, so a session holding a WooCommerce product edit, an All in One SEO edit or a routine save or delete undid those unchecked and refused to redo them. Runtime 1.2 gains an optional SessionLedger host interface: a kit registers, per restore type, how to read the target now in its before-image's shape and what to key it by. WPPilot's ledger answers wppilot_change_current_state and wppilot_change_payload_target with it; the standalone ledger, which has no sessions, does not implement it. woo-basics, seo-basics (AIOSEO; the other SEO plugins already go through post-partial) and scheduled-audits register theirs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
It still said 168, the 1.15 count; check-doc-consistency does not read it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A session that updated a post and then set the post's SEO title could not be undone: update-post keeps the whole post, the SEO kit keeps only its meta keys, so the two are different targets, and the whole-post check saw the SEO write as someone else's edit to the post and refused the run. Found live on Free alone with update-post then yoast-edit-post-seo. The undo and redo plans now note which parts each pending row writes, per object (a post-partial target is its post), and a difference between a target's recorded and current state is the session's own when every differing part is written by the session through another target on the same object. A difference in any other part is still a conflict, states without per-part hashes never qualify, and the check made just before each change is touched still compares the whole state. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…loper Full Access Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Twenty Twenty-Five names its spacing sizes "20" to "80". PHP stores those slugs as int array keys, and under strict types to_markdown() passed them to scrub(string), so wppilot/adopt-design-from-site threw a TypeError on the default theme instead of returning a draft. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
delete-comment's before-image is the comment-status snapshot it shares with moderate-comment, so the generic status branch filed it as a reversible status restore before the explicit "permanently deleted" branch was reached. The Changes screen and session undo offered to undo it, and rollback-change failed with wppilot_rollback_target_missing. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…undo and stdio in the upgrade notice Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
delete_theme() is defined in wp-admin/includes/theme.php, which WordPress does not load for a REST or MCP request, so wppilot/delete-theme failed on every call with "Call to undefined function delete_theme()" after passing all of its own checks. Found live over MCP HTTP under Developer Full Access. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
wppilot/read-file and wppilot/list-directory are annotated read-only, and wppilot_ability_risk() classes every read-only ability as a plain read before it looks at the critical-name list, so both ran under Production Safe and even Read Only. Found live: under Production Safe read-file returned wp-config.php, with the database password, the auth salts and Solid Security's encryption key. Those profiles promise no server filesystem access. Both now declare meta.safety min_profile developer (the mechanism the database reads already use) with audit_reads, so they register only under Developer Full Access and each call is recorded. The fresh-install count on the default profile drops from 156 to 154 and the Developer Full Access list from eighteen to twenty; README, docs and both changelogs say so. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
9ddf72c dropped "the Pro edition" from forminator-list-entries, since Pro has no reveal for Forminator, and FormsBasicsTest still required that phrase of all four entry readers, so the unit suite failed on the release branch. Forminator's description is now held to naming Forminator > Submissions; the other three still name the Pro edition. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A numeric slug becomes an int key, which is why 1e70b3c casts the keys before scrub(). The docblocks still said string keys, so mago called those casts redundant; they now say array-key and the analysis is back to its count before the fix. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The approval page, OAuth consent and authorize pages, Block Editor Queue, visual runtime and Connected Apps are registered without a parent to keep them out of the menu. get_admin_page_title() never looks there, so admin-header.php passed a null title to strip_tags() and PHP 8.1+ logged a deprecation on every visit (16 lines in one live pass). The title is now taken from the page's own registration on admin_init. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…e fixes in the 1.16.0 changelog Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
WPPilot 1.16.0. It moves the basics of five Pro feature sets into Free, adds whole-session undo and redo and a local stdio connection, and matches every client's generated config to its vendor's current docs.
What's new
list-sessions,undo-session,redo-session, and buttons on the Changes screen).SessionLedgerkit interface.wp wppilot mcp serve: stdio for Claude Code, Cursor and CI, with the same gates as HTTP.pswd,siteIdandcloudflare_key.execute-abilityledger rows.Compatibility
Works beside the released WPPilot Pro 1.10.0. Pro registers first, and each Free copy stands aside for any ability name already registered.
test-kit-coexistencepasses in both modes, including--installed-prowith the 1.10.0 zip.Verification
🤖 Generated with Claude Code