Coquille Revue 2.6.0

Breaking changes

• WP-CLI in English, with no alias for the 2.5.0 names (WP-CLI refuses unknown options):
  • apply options: --toutes → --all, --ignorer-alertes → --alerts-reviewed, --texte=<fichier> → --text-file=<file>, --champ=<champ> → --field=<field>.
  • locate output: present_sur_la_page → found_on_page, alertes → alerts; in occurrences, champ → field, nombre → count, forme → form, ligne → line, modifiable → writable, type fichier → file, forms exacte → exact, typographie simplifiée → straight_quotes, insécables en   → nbsp_entity.
  • apply report: applique → applied, champ → field, forme → form, avant → before, apres → after.
  • Help texts and messages are in English, and never translated.
• JSON export (admin button and wp coquille-revue list): _avertissement → _warning, alertes → alerts. Alerts are fixed codes: web_address, code_or_command, invisible_characters, mixed_scripts, instruction_or_authority, long_addition, added_symbols, unreadable_text, still followed by the code points involved (invisible_characters (U+200B), added_symbols (U+0022)). The source values are codes: logged_in_user, registered_unverified (a logged-in account without a role on the site), anonymous_unverified.
• Markdown export: the instructions for Claude Code, the introduction and the data block are in English and never translated (author: instead of auteur:, area line zone: x=… y=… width=… height=…); each annotation heading shows its type, mode and source codes. The title, the date line and the footer are in fixed English too: the whole file is never translated.
• Rules for Claude Code (exports): rewritten in English, never translated, so that a translation can never weaken them.
• Claude Code plugin 2.6.0: /coquille-revue:apply-review is in English (it answers in the user's language) and stops when the export comes from a WordPress plugin older than 2.6.0 (no _meta.plugin_version key, or no alerts key). Update the WordPress plugin and the Claude Code plugin together.
• Stored values: an anonymous visitor who gives no name is stored with an empty author name (it was Anonyme), shown as “Anonymous” in the language of the screen; the database upgrade empties Anonyme on existing rows of visitors. The original text recorded for an area without text is (zone without text) (it was (zone sans texte direct)).
• Public credit off by default: the “plugin by Atelier 4F Digital” link is no longer shown in the visitors' review bar, and pages no longer carry an HTML comment with the plugin name and version. A per-site setting (off by default) shows the credit in the information popover of the pencil button; the credit stays on the admin page and in the exports and README files.
• WordPress 6.2 minimum (it was 5.8): every SQL query passes the table name through the %i placeholder of $wpdb->prepare(), introduced in that version.
• Keyboard shortcut: Ctrl+Shift+R (the browser's hard reload) is no longer taken over. Review mode is toggled with Alt+Shift+C (Option+Shift+C on Mac), for logged-in users only, and never while typing in a field.
• REST API: the platform field, ignored by the server, is no longer declared nor sent by the script (an older script that still sends it is accepted). Every field is validated (type, length, allowed values) before it is sanitized: a value of the wrong type (an array instead of a string, for example) gets a 400 error instead of crashing PHP; a field that is too long gets 400, no longer 413. The original text and the suggestion must be at least 2 characters long. PATCH /annotation/{id}/status requires the status parameter (it defaulted to applied). GET /annotations is paginated: per_page (at most 100, 100 by default) and page, with the totals in the X-WP-Total and X-WP-TotalPages headers. Its created_at and applied_at fields are in the site time zone, like the exports (they were the raw database value), and the new created_at_gmt and applied_at_gmt fields give them in UTC, like date and date_gmt in the WordPress API.
• WP-CLI apply --type=option only changes text options of the site: blogname, blogdescription, widget_*, theme_mods_*, options_* (ACF), a list that the coquille_revue_cli_writable_options filter can extend. locate tells for each option whether it is writable. locate and apply refuse an original text shorter than 2 characters.
• Thank-you email: a generic message, with none of the text typed by the visitor (no name, title or excerpt), with the date, the site name and a link to the home page. The sender is the WordPress one (wp_mail_from and wp_mail_from_name filters): no more From or Reply-To set to the administrator's address.
• Injection test kit renamed: tests/injection/insert-cases.php, export-cases.php, delete-cases.php and cases.json (keys category, expected and language).

Added

• Translation-ready interface: every text shown to visitors and administrators, sent by email or returned by the REST API is an English source string of the coquille-revue text domain, loaded on init from the languages/ folder (Domain Path). The folder ships the coquille-revue.pot template and a complete French translation (.po, .mo and .l10n.php). The script's texts are passed in the i18n key of its configuration block.
• _meta.plugin_version key in the JSON export, read by the Claude Code plugin.
• 13 new prompt injection cases in tests/injection/cases.json (30 cases in all): 11 in English, and 2 (French and English) with an instruction hidden in invisible Unicode “Tag” characters. insert-cases.php also publishes a page that holds the original texts, one paragraph block per line written as typed (apostrophes kept, no <br>), and points the annotations to it; delete-cases.php deletes it.
• Per-site “Thank-you email” setting (on by default) on the admin page, for the site's administrators only. When it is off, visitors are no longer asked for their email, the email is not stored, and the privacy texts are adapted. The coquille_revue_notify_contributor filter ($enabled, $row) decides annotation by annotation.
• Admin page: 50 annotations per page with pagination, alerts under each suggestion (the same alerts as in the exports for Claude Code), full original text and suggestion on hover, confirmation before “Applied” when a thank-you email is about to be sent. When an annotation is set to “Applied” but its thank-you email is held back by the daily limit, or the site cannot send it, a warning says so instead of “Status updated.”; wp coquille-revue status says so too.
• Per-site “Credit” setting (off by default), for the site's administrators only. Both site settings (thank-you email and credit) are saved by a single form.
• coquille_revue_load_overlay filter (boolean): return false to keep the review interface off a page.
• coquille_revue_rate_limits filter: an array of positive integers, ip_5min (5 by default), ip_hour (10), site_hour (30) and user_5min (60); a missing or invalid value keeps its default. The admin page shows the limits in force.
• Uninstall: deleting the plugin from the Plugins screen removes the annotations table, the settings and the scheduled tasks, on every site of the network (uninstall.php). Deactivating keeps everything.
• readme.txt in English for the WordPress.org directory (description, privacy, FAQ, changelog).
• WordPress.org directory assets and demos, in wporg-assets/ (left out of the zip, like docs/):
  • an original icon (icon.svg, icon-128x128.png, icon-256x256.png) and banner (banner.svg, banner-772x250.png, banner-1544x500.png);
  • five screenshots in English (screenshot-1.png to screenshot-5.png: the bubble with a correction, the information popover of the pencil, the admin page, the Markdown export for Claude Code, the bubble on a phone), captioned in readme.txt and shown in README.en.md; the same scenes in French in docs/screenshots/fr/, shown in README.md;
  • two Try it in WordPress Playground demos linked from the README files: blueprints/blueprint.json installs the latest release, turns on public mode and opens a sample page to review; blueprint-fr.json, linked from the French README, does the same on a site in French with a French sample page.
• Releases also carry coquille-revue.zip (fixed name), so that releases/latest/download/coquille-revue.zip always points to the latest version.
• Development tools, left out of the zip (see CONTRIBUTING.md):
  • Composer development dependencies with exact versions and a lock that installs on PHP 7.4 to 8.4: PHP_CodeSniffer with WordPress Coding Standards 3 and PHPCompatibilityWP, PHPUnit 9.6 and the PHPUnit Polyfills.
  • phpcs.xml.dist: security, database and WordPress API rules, prefixes, text domain, WordPress 6.2 and PHP 7.4 minimum (0 errors, 0 warnings).
  • PHPUnit integration tests (tests/phpunit/) with the WordPress test suite: REST API, personal data, CSV, thank-you email, alerts, Markdown and JSON exports, WP-CLI commands (every refusal of apply, through a WP-CLI stand-in declared in the test bootstrap), admin actions and page, loading of the files, database upgrade, and site isolation on multisite. The isolated group (trusted proxy header, uninstall) runs in a pass of its own. bin/install-wp-tests.sh installs the test suite without svn; bin/test-local.sh runs the tests on Windows with the PHP and MySQL of Local, on a dedicated database (it refuses a WP_TESTS_BASE path with spaces, which the installer does not quote, and writes its php.ini at every run).
  • GitHub Actions (.github/workflows/ci.yml): PHP syntax from 7.4 to 8.4, PHPCS, JavaScript and shell syntax, PHPUnit (PHP 7.4 with WordPress 6.2, PHP 8.3 w...

Coquille Revue 2.5.0 — première version publique

Première version publique de Coquille Revue : relire un site WordPress directement sur ses pages, puis appliquer les corrections avec Claude Code, avec votre accord.

Installation de l'extension : téléchargez coquille-revue-2.5.0.zip ci-dessous, puis dans WordPress Extensions > Ajouter une extension > Téléverser une extension.

Plugin Claude Code (facultatif) :

claude plugin marketplace add Atelier-4F-digital/coquille-revue
claude plugin install coquille-revue@atelier-4f-digital

Puis /coquille-revue:apply-review --url=https://votre-site.fr dans le dossier du site (WP-CLI requis, aucun mot de passe WordPress).

Points forts

• Bouton crayon sur les pages : sélection de texte ou de zone, correction, suggestion ou question. Mode privé par défaut, mode public avec anti-spam.
• Administration : onglets par statut, exports CSV/JSON/Markdown, e-mail de remerciement au contributeur.
• Multisite cloisonné, droits stricts, données personnelles jamais transmises à Claude Code, conformité RGPD (purges automatiques, outils d'export et d'effacement).
• Commandes WP-CLI wp coquille-revue list | locate | apply | status : le texte des visiteurs ne passe jamais par une ligne de commande.
• Règles anti-injection de prompt éprouvées par un test de 17 annotations piégées (tests/injection/).

Détails : CHANGELOG.md · English: README.en.md