WP AI Bridge v0.4.2

WP AI Bridge v0.4.2

Patch release hardening OAuth refresh recovery and Native Ability boundaries.

Changes

• Makes rotating OAuth refresh-token exchange retry-safe after an ambiguous lost response using bounded recovery state that preserves client, resource, user, scope, and approved-client revision binding while retaining normal one-time rotation and replay protection.
• Keeps the Gateway-facing provider-native Ability catalog aligned with the active MCP Adapter exposure contract, with a fail-closed fallback when the Adapter runtime resolver is unavailable.
• Bounds provider-native Ability results at the canonical WP AI Bridge MCP edge so credential/security-like nested values, errors, and throwables cannot cross that boundary. Direct/default MCP Adapter execution and Bridge-owned purpose-specific credential contracts remain unchanged.

Upgrade notes

Already-canonical v0.4.0 and v0.4.1 installations can update normally to v0.4.2. No data migration, OAuth client reset, or ChatGPT reconnection is required solely because of this patch release.

Sites still on v0.3.0 that must preserve pre-canonical Workspace data must first use the immutable v0.4.0 migration release, verify the migrated Workspace, and then update to the current release.

Validation

• Final release source: main@1bc3693b21072d2a23aa9f7e534eff39591642c9
• Final release tree: e4f5925896380d86cdbfaafd47e51d4853cc3bd1
• Release preparation: PR #87
• Executable-mode correction: PR #88
• Final exact-head CI: 35382164466 / #425 — 13/13 SUCCESS
• Release artifact: wp-ai-bridge.zip
• SHA-256: 1214fa1a6a5ff7da8682fe91535c1100f45d30cbfe23b380630e1234eec1f2ca
• Included engineering work: #80, #81, #82
• Issue #82 independent HIGH_ASSURANCE review: COMPLETE / APPROVE; no material findings.

Release tracking: #86

WP AI Bridge v0.4.1

WP AI Bridge v0.4.1

This release establishes WP AI Bridge as the fully native canonical baseline after successful completion and verification of the one-time v0.4.0 migration.

Changes

• Removed the retired pre-v0.4.0 Workspace migration runtime and activation hook.
• Removed migration-only localization, transaction/engine fixtures, and legacy migration CI runners.
• Current runtime and localization no longer depend on former WP Native Builder Bridge identifiers.
• Retained canonical wp-ai-bridge/wp-ai-bridge.php, WP_AI_Bridge, wp-ai-bridge/* Abilities, OAuth/MCP routes, and canonical Workspace storage.
• Replaced migration-specific CI lanes with canonical activation/identity coverage on both supported WordPress lanes.
• Verified fresh canonical activation and Workspace create/read behavior without the retired migration schema marker.

Upgrade notes

Existing canonical v0.4.0 installations can update normally to v0.4.1. No additional data migration or ChatGPT reconnection is required solely because of this cleanup release.

Sites still on v0.3.0 that need to preserve pre-canonical Workspace data must first use the immutable v0.4.0 migration release, verify the migration, and then update to v0.4.1.

Validation

• Integrated source: main@5c5bdadf1d5594c006913770ea7b2f540b32e22a
• Reviewed candidate: 1b38509ad5b9047c0c6ad081d57b72ebb8819043
• Exact-head CI: 35234084373 - 11/11 SUCCESS
• Release asset: wp-ai-bridge.zip
• SHA-256: 6813b1d85d1878998e21a8aa5ebc40bfb2a2f974d1e869061fcbb122037a463d

Tracking: Issue #77 / PR #78

WP AI Bridge v0.4.0

WP AI Bridge v0.4.0

This is the canonical identity migration release for WP AI Bridge.

What changes

• Installs as wp-ai-bridge/wp-ai-bridge.php.
• Uses canonical WP_AI_Bridge / wp-ai-bridge runtime, admin, Ability, OAuth and MCP identities.
• Migrates only persistent Workspace Documents/Tasks from the published v0.3.0 storage while preserving WordPress record IDs, content/state, state hashes and versions.
• Previous OAuth/ChatGPT connection state, tokens/clients, access-group settings and disposable runtime state are intentionally not migrated and start fresh.
• Canonical MCP endpoint after cutover: /wp-json/wp-ai-bridge/v1/mcp.

Required upgrade sequence from v0.3.0

1. Back up the WordPress database/site.
2. Deactivate WP AI Bridge v0.3.0.
3. Uninstall/delete the v0.3.0 plugin so its uninstall routine runs; persistent Workspace Documents/Tasks remain.
4. Install this v0.4.0 wp-ai-bridge.zip package.
5. Activate v0.4.0. If preserved legacy Workspace data exists, the current site's exact WordPress posts, postmeta, and options tables must use InnoDB; activation fails closed before Workspace identity mutation otherwise.
6. Verify Workspace Documents/Tasks are present.
7. Reconfigure the desired access groups.
8. Reconnect ChatGPT using the canonical MCP endpoint.

Do not bypass the InnoDB migration guard. Clean installations without legacy Workspace state are not subject to that migration-only engine prerequisite.

Validation

• Integrated source: main@7d4dc716d4eceef186938ee536f71140dfad0a15
• Reviewed candidate: 1c453188430fa3db47923c35612805ab14c34112
• Exact-head CI: 35180329920 — 11/11 SUCCESS
• Independent HIGH_ASSURANCE review: COMPLETE / APPROVE; F-001 RESOLVED; no BLOCKER/REQUIRED findings
• Release asset: wp-ai-bridge.zip
• SHA-256: ac7271e0f7f23804825c4f56fc0ff3a2bf32ea33256d1d68085d2600f30d77fd

Release tracking: #76
Migration implementation: #74 / PR #75

WP AI Bridge v0.3.0

WP AI Bridge v0.3.0

A substantial minor release that completes the current administrator-controlled WordPress capability program and introduces the public WP AI Bridge product identity while preserving in-place upgrade compatibility from WP Native Builder Bridge.

Highlights

• Added paginated, provider-neutral Ability catalog discovery for registered Core/provider contracts and Bridge delegation requirements.
• Added a default-off Native Abilities delegation boundary while retaining independent WordPress/provider permission callbacks.
• Expanded administrator-controlled metadata support with generic term metadata and user/comment metadata workflows, including stale-state and sensitive-key protections.
• Added explicitly enabled safe public-URL Media Library import with bounded streaming and WordPress-native sideload handling.
• Added a separate default-off Source Editing boundary for installed plugin/theme source read, preview, apply, and conflict-safe recovery.
• Added bounded standard comment discovery, replies, moderation, and dual-gated permanent deletion.
• Added administrator-approved OAuth client metadata identities for independently operated MCP Gateways while preserving built-in ChatGPT behavior and OAuth security boundaries.
• Added provider-neutral read/update for non-sensitive settings registered through the WordPress Core REST settings contract.
• Added a default-off Authentication & Credentials boundary for Core-native WordPress Application Password lifecycle operations, with plaintext returned only once at creation and never persisted by the Bridge.
• Added separately authorized plugin/theme installation from bounded public HTTPS package URLs through WordPress Core Upgrader authority.

Product identity and upgrade compatibility

• Public product name is now WP AI Bridge.
• Canonical admin, OAuth, and MCP public routes use the wp-ai-bridge... identity, with bounded legacy aliases retained for existing connections/bookmarks.
• Existing compatibility identifiers remain intentionally stable where required for upgrades: installed plugin directory/entrypoint, PHP namespace/constants, text domain, persisted keys, Workspace identifiers, and existing wp-native-builder/* Ability names.
• Public distributable is now wp-ai-bridge.zip; its installed archive root remains wp-native-builder-bridge/ so existing WordPress installations upgrade in place.

Security model

Privileged surfaces remain explicitly administrator-controlled and WordPress/provider-native authorization remains independently authoritative. This release does not introduce a generic shell, SQL/database administration API, unrestricted filesystem API, unchecked HTTP proxy, or generic credential-dump surface.

Validation

• Runtime release candidate: bf14059934eeac3b2793fe3752ed40acd9896087
• Exact-head CI: 35139599858 — 11/11 jobs passed
• Final release commit: 22c2f7ef802c604415ac186d7c9d9734246046ef
• Final release differs from the tested runtime merge only by the completed public CHANGELOG.md summary.
• Final installable artifact: wp-ai-bridge.zip
• SHA-256: a36e86d5374cbdd6e961e94e2dcc95cd9d1006963ec06e62d9ad3abfc9d22f11

Research Issues #31 and #32 remain intentionally open and are not claimed as implemented by this release.

Release tracking: #69

WP Native Builder Bridge v0.2.0

WP Native Builder Bridge v0.2.0

Minor release introducing administrator-controlled, provider-neutral Advanced Metadata support.

Added

• A dedicated Advanced Metadata access group, disabled by default and controlled by the WordPress administrator.
• Generic typed post-meta read, update, and delete abilities for WordPress post objects the connected user is authorized to edit, including private and non-REST CPTs.
• Support for authorized protected/private metadata without provider, post-type, or meta-key whitelists.

Safety and integrity

• Existing Core/provider metadata authorization remains authoritative where defined.
• Workspace internals and credential/session/security-like metadata keys remain outside the generic surface.
• Generic metadata deletion additionally requires Users & Destructive access.
• Mutation identity is based on physical metadata rows with byte-exact optimistic stale-write protection, explicit SQL NULL handling, ambiguity refusal, and row-scoped compensation for concurrency races.
• No generic SQL/database administration, arbitrary options/user-meta access, filesystem/shell execution, or credential retrieval was added.

Compatibility and validation

• WordPress 6.9+.
• Official WordPress MCP Adapter.
• Exact release commit passed Quality and both supported real-WordPress integration lanes.

Resolved: #34

Release artifact SHA-256: 8382960bd32eb23dbf36fc527f20446c99e54718578b84fe74b1d7f90cdbfdeb

WP Native Builder Bridge v0.1.2

WP Native Builder Bridge v0.1.2

Patch release focused on provider integration correctness and durable architecture guidance.

Fixed

• Gutenberg targeted mutations now accept the canonical top-level block path 0 and reject leading-zero aliases such as 00.
• Gravity Forms GFAPI fallback reads now use the provider-supported gravityforms_edit_forms capability; the nonexistent gravityforms_view_forms check has been removed from runtime and integration setup.
• GFAPI fallback read authorization is covered for allowed and denied users, including raw MCP transport coverage.

Architecture

• Provider integration is now explicitly discovery-first and provider-agnostic.
• Native Core/plugin/theme WordPress Abilities are reused first.
• Provider-specific fallback code is limited to real gaps backed by documented public APIs/contracts.
• Capability discovery never bypasses WordPress/provider authorization or Bridge access groups.

Compatibility and safety

• WordPress 6.9+.
• Official WordPress MCP Adapter.
• Existing stale-write, permission, OAuth, Workspace, and native-first safety boundaries remain intact.

Resolved: #27, #28, #29.

Release artifact SHA-256: f8fa563f37a9f00084075ff0a9d050a49d147a06349cfcd054ef509c0aa8c6fb

WP Native Builder Bridge v0.1.1

WP Native Builder Bridge v0.1.1

A polished patch release for the first public WP Native Builder Bridge line.

What it does

WP Native Builder Bridge connects a WordPress 6.9+ site directly to a ChatGPT Workspace App over HTTPS using WordPress-backed OAuth, the official WordPress MCP Adapter, and permission-checked WordPress Abilities.

Included

• Direct ChatGPT Workspace App OAuth/MCP connection with no tunnel requirement.
• WordPress content, Gutenberg block, Media Library, taxonomy, navigation, site-setting, extension, and user/role abilities.
• Persistent Workspace with Dashboard, Documents, Tasks, Activity, and Settings.
• Optimistic concurrency for overwrite-sensitive content and Workspace operations.
• Astra native Ability reuse when Astra Abilities are enabled.
• Managed Code Snippets support across the tested 3.9.x and 3.10.x provider generations.
• Gravity Forms GFAPI fallback when no native provider Ability surface is active.
• Persian (fa_IR) localization and RTL-compatible admin UI.
• GPL-2.0-or-later licensing.

v0.1.1 polish

• Plugin author metadata is now ACh with https://ach.li.
• Plugin homepage points to this GitHub repository.
• The WP Native Builder Bridge brand name remains untranslated.
• Public README/docs were reorganized as product and usage documentation rather than development-history notes.
• Tasks filter spacing was improved.
• Code Snippets 3.9.x integration-status detection was corrected.

Security boundaries

The Bridge does not expose arbitrary SQL, shell/WP-CLI, generic filesystem access, arbitrary plugin ZIP/PHP upload, arbitrary package URLs, or credential retrieval. Media upload is bounded through WordPress Media Library handling, and plugin/theme installation is limited to WordPress.org slugs.

See the repository README and docs/ directory for installation, permissions, integrations, security, troubleshooting, and development details.

WP Native Builder Bridge v0.1.0

WP Native Builder Bridge v0.1.0

First public release of the self-hosted WordPress bridge for direct ChatGPT Workspace App integration.

Highlights

• Direct ChatGPT Workspace App connection over public HTTPS using WordPress-backed OAuth; no tunnel or separate proxy service required.
• Official WordPress MCP Adapter integration with typed, permission-checked WordPress Abilities.
• Content, Gutenberg block, Media Library, taxonomy, navigation, bounded site settings, plugin/theme lifecycle, users/roles, and supported provider integrations.
• Persistent private Workspace with Dashboard, Documents, Tasks, Activity, and Settings admin screens.
• Workspace optimistic concurrency using version + state hash, compact resume context, export/clear controls, and preserve-on-deactivate/uninstall behavior.
• Astra native Ability reuse through the shared WordPress Abilities registry.
• Code Snippets support for both 3.9.x and 3.10.x provider model generations.
• Bundled Persian (fa_IR) localization and RTL/LTR-neutral WordPress admin UI.
• GPL-2.0-or-later licensed.

Security boundaries

Bridge access groups remain separate from normal WordPress capability checks. Sensitive mutation groups are explicit. Media upload uses WordPress MIME/upload handling and does not expose arbitrary server paths. Plugin/theme installation is bounded to WordPress.org slugs; this release does not expose arbitrary ZIP/PHP upload, shell, SQL, generic filesystem access, or credential retrieval.

Validated release identity

• Source: 1af6d2056639101cefa5ba11cfcdc3198e5a1c37
• CI: GitHub Actions run 34562058130
• Quality / PHP 8.4: PASS
• WordPress 6.9 / PHP 8.4 integration: PASS
• Current WordPress / PHP 8.4 integration: PASS
• MCP Adapter: 0.6.1
• Real ChatGPT Workspace OAuth + MCP connection: PASS on the authorized public test site
• Real connected Workspace document/task optimistic-concurrency checks: PASS
• Live Content disabled permission-denial path: PASS
• Code Snippets 3.9.6 and 3.10.2 provider lanes: PASS
• Astra 4.13.11 native Ability reuse lane: PASS
• Gravity Forms coverage is a GFAPI contract fixture; this release does not claim validation against the commercial Gravity Forms binary.

See README.md, docs/INSTALL-CONNECT.md, and docs/RELEASE-CHECKLIST.md for setup and operating details.