v1.6.2 — Readme, schema fixes, Wayback integration

• Readme updated: 35 abilities, theme management, Wayback Machine references, v1.6.0/1.6.1 changelogs
• output_schema fixes: explicit type fields for WP 6.9 Abilities API compliance
• Footer: About and Privacy Policy links

v1.6.1 — Release fix

Patch bump so the self-updater picks up the v1.6.0 theme management changes on sites already running 1.6.0.

v1.6.0 — Theme Management

Theme Management — 7 new abilities

Read-only (reader surface)

• list-themes — list installed themes with status, type (block/classic), parent info
• get-theme-info — detailed metadata, theme.json contents, full file tree
• get-theme-file — read any theme file (templates, parts, patterns, styles, assets, PHP, CSS, JSON)

Write (full surface)

• create-theme — scaffold standalone or child block themes with theme.json design tokens, starter templates, header/footer parts
• update-theme-file — write/update any theme file with path traversal protection and JSON validation
• delete-theme-file — remove files with protection for required files (style.css, templates/index.html)
• activate-theme — switch active theme with dry-run support

Child theme support

create-theme accepts a parent parameter to scaffold a child theme that inherits templates, parts, and styles from an existing theme. Only override files are created.

Extras

• extras/mu-plugin-theme-caps.php — reference mu-plugin to create a "Theme Editor" role (Editor + edit_themes + switch_themes)

v1.5.6

Hardening

• Lock down updater-debug endpoint to admin-only (update_plugins capability)
• Second self-updater test

v1.5.5

Test release

Self-updater validation — this release should appear in Dashboard > Updates.

v1.5.4

Self-updater hardening

• Fix null cache bug in GitHub API transient
• Add dual filter hooks (pre_set + get) for update transient
• Clear GitHub cache on force-check
• Add /apmcp/v1/updater-debug REST endpoint
• Fix WPCS array alignment

v1.5.3

Test release to verify self-updater flow.

v1.5.2

Self-updater

• Added GitHub-based self-updater for plugin updates via Dashboard > Updates
• 12-hour transient cache; click Check again for immediate checks

v1.5.1

Security hardening & self-updater

Security

• upload-media SSRF hardening — validate URL scheme, resolve DNS, block RFC 1918/loopback/link-local/metadata targets
• audit-post per-post permission check — prevents auditing another users unpublished content
• audit-post link checker — re-enabled TLS verification, restricted to editor+ role, scheme-validated
• transition-status — enforces post-type-specific publish capability after loading the post

Improvements

• Audit log now records the real MCP ability name and distinguishes MCP-driven vs wp-admin changes
• Self-updater — plugin checks GitHub releases for updates; use Dashboard > Updates > Check again for manual checks

Fixes

• Version metadata in plugin header and readme.txt now matches actual release
• WPCS alignment fix for consecutive assignment equals signs

v1.5.0

v1.5.0 — Audit, repair & legacy content conversion

New abilities

• audit-post: Read-only scan for legacy issues — dead links, HTTP links, missing block markup, deprecated HTML, broken images, missing metadata, numeric slugs, whitespace artifacts, missing featured image
• repair-post: Automated mechanical fixes with dry_run support and concurrency guards — http-to-https, strip-deprecated-html, convert-to-blocks, generate-excerpt, whitespace-normalize, decode-title-entities, strip-empty-tags

New converter

• html_to_blocks(): DOMDocument-based classic HTML → Gutenberg block conversion for pre-Gutenberg posts (handles p, h1-h6, blockquote, ul/ol, img, hr, pre, table, div, figure, bare text)

Bug fix

• Markdown converter: Pre-process legacy HTML <img> tags (standalone and linked) into markdown syntax before wp_kses() strips them

Infrastructure

• Git Updater headers added for GitHub-based plugin updates
• Server segmentation updated: audit-post on reader surface, repair-post on editorial surface