WP Sudo v3.4.0 — Research Snapshot

Versions before 4.9.0 automatically replayed an intercepted request after reauthentication (#322). Do not use this version.

RESEARCH PROTOTYPE ONLY. Do not install on production, public staging, or any site containing real users, credentials, or data. Use only in WordPress Playground or a disposable local test environment.

Maintenance/hardening release.

Highlights

• Break-glass recovery mode hardened: WP_SUDO_RECOVERY_MODE is now role-gated to administrators (manage_options / manage_network_options) — non-admins gain nothing. A permanent, non-dismissible notice renders on the Sudo settings screen while active, and a new wp_sudo_recovery_mode_active audit hook fires (stored as a sampled recovery_mode event, ≤1 per user/hour). Break-glass usage is now explicit, bounded, and auditable.
• Psalm gate repaired: the type-coverage gate had been silently passing without analyzing anything (a top-level exit in uninstall.php aborted the run). Fixed, with a guard that fails the gate loudly if no coverage figure is emitted; the shepherd.dev type-coverage badge reports again (~96%).
• CI hardening: least-privilege permissions on all workflows; documentation-only PRs skip the heavy jobs without deadlocking required checks.
• Docs audit: corrected confabulated AJAX handler names and the OTP-resend mechanism description, and replaced drift-prone hardcoded counts with links to docs/current-metrics.md.
• Playground: recovery-mode and user-switching scenario blueprints for manual review.
• Fixes: removed an obsolete Editor role-error notice workaround; fixed a random-order unit-test flake in SSL detection.

New public hook: wp_sudo_recovery_mode_active. Full notes in CHANGELOG.md.

🤖 Generated with Claude Code