Skip to content

v1.26.0 — Angie bridge (read-only): Aura Design Engine inside Angie

Choose a tag to compare

View all tags
@BenKalsky BenKalsky released this 03 Aug 23:24
· 36 commits to main since this release
v1.26.0
68707aa
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Angie bridge (read-only v1) — K3

Registers "Aura Design Engine" as an MCP server inside Elementor's Angie assistant via the public @elementor/angie-sdk. Opt-in, off by default (Connection tab).

Six read-only inspection tools: list-widgets, get-widget-schema, get-page-structure, list-pages, list-global-classes, list-variables — Angie can answer "what's on this page / which widgets, classes, variables exist / what settings does X take".

No write tools. Angie is an agent (the LLM picks the exact tool + params); this cookie/capability transport cannot carry the per-mutation human approval the governed write path requires. A mutating ability reached through the bridge returns bridge_writes_phase_b. Governed writes stay exclusive to the MCP connection (snapshot-before-write + rollback + optional approval grants).

Enforcement: server-side allowlist with a read-only invariant (annotations.readonly && !destructive) checked against the live registry on both list and execute; each ability's own permission callback runs before execution; anything outside the allowlist is a plain 404. Responses tagged _meta.source: angie-bridge. Bundle enqueued only when the Angie plugin is present.

Deps: @elementor/angie-sdk 1.5.0 + @modelcontextprotocol/sdk 1.30.0 (pinned exactly; includes the #31 security bump with a rebuilt bundle), built with vite 6.

Tests: 17 new bridge tests (permission matrix, allowlist regression guard, read-only invariant, delegation, error mapping); full suite 739 green on PHP 8.0/8.1/8.2.

Full details in CHANGELOG.md.

Assets 2
Loading