v0.5.0

Added

• A single deterministic assembler, scripts/build_exclusions.py, now builds the resolved exclusion set — the union of a canonical always-excluded constant (ALWAYS_EXCLUDED: the configuration file, the WordPress drop-ins, the debug log, the cache dir, and the upgrade dirs) with the decision-gated DB-known thumbnails, flagged heavy blobs, and — under --exclude-media — the whole uploads tree. Both consumers that previously hand-assembled the set from the same ingredients now obtain it from this one helper: the extraction file selection (clone §5) and the baseline manifest (clone §9.12, pull's diff), so the two are byte-identical and a scope change can never poison the pull deletion diff. The always-excluded paths exist exactly once, in the constant — every prose reference points at it rather than re-enumerating — and scripts/classify.py now emits uploads_prefix so a media exclusion can be anchored at the WordPress root. Structured so the two blocked child issues can extend the constant: credential-bearing backup patterns (#36) and the WordPress core tree (#37) (#35).

Fixed

• ALWAYS_EXCLUDED now covers the credential-bearing pattern family that previously sailed through unfiltered: every backup, editor-swap, and variant sibling of wp-config.php (wp-config.php.*, wp-config.php~, .wp-config.php.sw?, wp-config-*.php — with wp-config-sample.php, WordPress' own placeholder-only template, explicitly carved back out), .env/.env.* anywhere in the tree, and root-level database dumps (*.sql, *.sql.gz, *.sql.zip) and key material (*.pem, *.key, id_rsa*). scripts/filter_manifest.py and scripts/baseline_diff.py's is_excluded now match a glob-bearing exclusion entry case-insensitively, anchored either at the install root or anywhere in the tree, alongside the existing exact-or-descendant prefix matching. Found on the second live smoke test of the Extractor cutover, where two live wp-config.php.bak-* files carrying the complete secret family in clear text sailed through the exclusion set and landed in local staging (#36).
• ALWAYS_EXCLUDED now also covers the whole WordPress core tree — wp-admin/, wp-includes/, and the root-level core PHP files (index.php, wp-login.php, wp-settings.php, xmlrpc.php, and the rest of the install-root PHP core ships) — so it is never selected for extraction: production's copy is always byte-identical to what clone's scaffold just installed, so transferring it was pure waste. scripts/filter_manifest.py and scripts/baseline_diff.py's is_excluded now also match a bare top-level directory prefix (no / of its own, like wp-admin) against itself and its descendants, not only against a root-anchored file pattern. The specification, the clone/pull skills, and the implementation notes no longer claim GET /files returns a content-scoped tree — it is install-root-wide and carries core too — and now state explicitly that core is kept out by this client-side exclusion set, never by the server. Found on the second live smoke test of the Extractor cutover, where 3,485 core files were extracted and merged over the byte-identical core the scaffold had just installed (#37).

Full changelog: https://github.com/Kntnt/kntnt-wp-skills/blob/v0.5.0/CHANGELOG.md