v0.24.2

• Security (WordPress.org directory review, round T2): the per-user "All tags" list filters that persist across page loads — usage bucket (WPTO_Admin_Page::get_active_bucket()), "Hide locked tags" (get_hide_locked_tags()), and quick-sort order (WPTO_Tag_Stats_Table::prepare_items()) — now write to user meta only after WPTO_Admin_Page::can_persist_filter_pref() passes, which checks current_user_can( 'manage_options' ) and a wpto_filter_prefs nonce. The histogram bars, quick-sort buttons, "Clear filter" links, and the hide-locked / tags-filter <form method="get"> now carry that nonce via wp_nonce_url() / wp_nonce_field(). A request without a valid nonce still has its filter applied to the current view but no longer alters another logged-in user's saved preferences (CSRF). The reviewer flagged only get_active_bucket(); the sibling cases were fixed in the same pass.

For the full version history, see CHANGELOG.md.

v0.24.1

• Renamed the plugin again, from "Termcraft - Taxonomy Manager" to "Tag Loom - Taxonomy Manager", after the WordPress.org directory review rejected "Termcraft" as already used as another project's distinctive name. Changed the display name (tag-loom.php header, readme.txt title), the slug/text domain (termcraft → tag-loom, ~200 __()/_e() calls across includes/), renamed the main file termcraft.php → tag-loom.php (plus the release.yml/deploy.yml path trigger, version grep, and SLUG), and renamed the GitHub repository gioxx/wp-termcraft → gioxx/wp-tag-loom. The internal wpto_ / WPTO_ code prefix and the wpto-* admin-page slugs are unchanged.

For the full version history, see CHANGELOG.md.

v0.24.0

• Renamed the plugin from "Smart Tags Optimizer" to "Termcraft - Taxonomy Manager" in response to the WordPress.org directory review, which flagged the old name as too generic and too close to an existing "Smart Tags" term. Changed the display name (termcraft.php header, readme.txt title), the slug/text domain (smart-tags-optimizer → termcraft, ~200 __()/_e() calls across includes/), and renamed the main file ai-tags-optimizer.php → termcraft.php (plus the release.yml/deploy.yml path trigger, version grep, and SLUG). The internal wpto_ / WPTO_ code prefix and the wpto-* admin-page slugs are unchanged.
• Replaced the direct Anthropic Claude HTTP integration in includes/class-wpto-api-client.php with WordPress core's AI Client (wp_ai_client_prompt() fluent builder: using_system_instruction(), using_max_tokens(), using_temperature(), using_model_preference(), is_supported_for_text_generation(), generate_text()). The plugin no longer performs wp_remote_post() to api.anthropic.com, stores no API key, and works with whatever provider the site owner configures in core. analyze_batch() now returns a wpto_no_ai_client / wpto_no_ai_provider WP_Error when unavailable; WPTO_Queue::ajax_start_analysis() checks provider_available() upfront.
• Bumped Requires at least to 7.0 (the AI Client ships in WordPress 7.0).
• class-wpto-settings.php: removed the wpto_api_key setting, field, and get_api_key(); wpto_model is now an optional comma-separated model-preference list read via get_model_preference() (returns string[]); the "Test API key" button/AJAX (wpto_test_api_key) became "Check AI provider" (wpto_check_ai_provider → ajax_check_provider()). assets/admin.js handler and the wptoData.i18n keys updated to match (enterApiKey/testingApiKey → checkingProvider).
• class-wpto-activator.php: DB_VERSION 2 → 3; activate() no longer seeds wpto_api_key; maybe_upgrade() deletes the stale wpto_api_key option.
• Moved the admin-notice URL-cleanup from an inline <script> block in WPTO_Admin_Page::strip_notice_query_args() (removed) to the enqueued assets/admin.js, fed by a new NOTICE_QUERY_ARGS class constant passed through wptoData.noticeArgs. Resolves the Plugin Check "use wp_enqueue" finding.

For the full version history, see CHANGELOG.md.

v0.23.3

• Fixed the "All tags" table staying empty after an Ajax action (bulk delete, or lock/hide with "Hide locked tags" on) removed every row on the current page: pagination and item counts went stale until a manual refresh or page change. Added reloadIfTableEmpty() in assets/admin.js, which auto-reloads the page once no wpto-tag-row-* row is left after a delete or lock-triggered hide.
• WordPress.org Plugin Check cleanup ahead of the directory submission: bumped readme.txt's "Tested up to" to 7.1, dropped the Domain Path header (no /languages folder ships, and translations load automatically for WP.org-hosted plugins), tightened the nonce-verification phpcs:disable in class-wpto-admin-page.php's bulk-action dispatch to also cover the .Recommended sniff, fixed a mismatched phpcs:ignore sniff code in uninstall.php, and added a phpcs:disable/enable around the intentional meta_query usage in class-wpto-tag-stats-table.php::prepare_items().
• Added the WordPress.org-required third-party-service disclosure ahead of directory submission: a "Third-party service" paragraph in readme.txt's Description explaining what's sent to the Anthropic Claude API, when, and linking to Anthropic's Privacy Policy and Terms of Service, plus a matching <p class="description"> note next to the Anthropic API Key field in class-wpto-settings.php's Settings page.
• Corrected stale "included Italian translation" claims in readme.txt (feature list), README.md, and README.it.md — no .mo/.po files ship with the plugin anymore since 0.22.0; WordPress.org requires directory-submitted plugins to be translated via translate.wordpress.org instead of bundling translation files.

For the full version history, see CHANGELOG.md.

v0.23.2

• Fixed locked tags being unable to enter the merge selection at all, even as the merge target (which always survives a merge — only source tags get deleted). Removed the lock filtering from add_to_merge_basket() and get_merge_basket_terms() in includes/class-wpto-admin-page.php, from process_add_tags_by_name() (dropping its "Skipped locked tag(s)" notice), and removed WPTO_Merge_Handler::apply()'s rejection of a locked target. Locked tags remain fully protected as a merge source: apply() still skips them there instead of deleting them.

For the full version history, see CHANGELOG.md.

v0.23.1

• Fixed the "All tags" bulk actions (Lock/Unlock/Delete) showing WordPress core's "Please select a bulk action to perform." alert even though the action had actually run. The Ajax submit handler in assets/admin.js was resetting the action <select>s back to -1 synchronously, before WP core's own submit-time bulk-action validation (bound to the same form) had a chance to read the selected value; deferred the reset via setTimeout so it happens after the current submit event has fully finished.

For the full version history, see CHANGELOG.md.

v0.23.0

• Added a "Hide locked tags" checkbox to the "All tags" table (below the Quick sort links), checked by default, so locked tags stay out of the way while working the list. Persisted per-user like the usage-bucket filter (WPTO_Admin_Page::get_hide_locked_tags()); filters via a meta_query on wpto_locked in both wp_count_terms() and get_terms() in WPTO_Tag_Stats_Table::prepare_items().
• Fixed the "All tags" table losing an active search (and sort/bucket filter) when paging past page 1. The #wpto-tags-filter form posted via method="post", so s/orderby/etc. never made it into the URL that WP_List_Table's pagination links are built from; switched the form to method="get" and updated the bulk-action handlers (maybe_process_stats_tab_actions(), process_bulk_delete(), process_bulk_toggle_lock(), the add_to_merge branch in render_stats_tab()) to read tag_id[]/action/action2 from $_REQUEST instead of $_POST to match.
• Converted single-row lock toggle, single-row delete, and the "Lock"/"Unlock"/"Delete" bulk actions on the "All tags" table to Ajax (new wp_ajax_wpto_toggle_lock, wp_ajax_wpto_bulk_lock, wp_ajax_wpto_delete_tags handlers), so those no longer reload the page and drop the current search/sort/pagination state. Rows update or fade out in place; the "Hide locked tags" checkbox is respected when a row gets locked via Ajax. The full-page-reload routes (process_toggle_lock(), process_bulk_delete(), process_bulk_toggle_lock()) are kept as a no-JS fallback. The "Add to merge selection" bulk action is intentionally left as a normal (non-Ajax) submit, since it needs to redraw the merge basket section below the table anyway.

For the full version history, see CHANGELOG.md.

v0.22.2

• Removed the duplicate lock dashicon rendered under the checkbox on locked rows (column_cb() in includes/class-wpto-tag-stats-table.php); the checkbox alone is enough since the "Lock" column already shows state. The "Lock" column icon now also colors itself (red closed lock when locked, gray open lock when unlocked via new .wpto-toggle-lock--locked/--unlocked CSS classes) instead of relying solely on icon shape.

For the full version history, see CHANGELOG.md.

v0.22.1

• Added "Lock"/"Unlock" bulk actions to the "All tags" table's Bulk actions dropdown. Locked tags are checkbox-selectable again (previously hidden entirely) so they can be picked for a bulk unlock; destructive bulk actions (delete, add to merge) still drop locked ids server-side via WPTO_Tag_Lock::filter_unlocked().
• Fixed process_add_tags_by_name() and the bulk "add to merge selection" action counting locked tags as added to the merge basket, when add_to_merge_basket() was actually silently filtering them out. Locked tags are now excluded from the "added" count up front and surfaced in a separate "Skipped locked tag(s)" notice.

For the full version history, see CHANGELOG.md.

v0.22.0

• Added a lock toggle to the "All tags" table (new "Lock" column): a locked tag can't be selected via checkbox, can't be added to the merge basket (manually or by an approved AI suggestion), and can't be deleted, until unlocked again. Backed by term meta (wpto_locked), cleaned up on uninstall when "Remove all plugin settings and export data" is enabled.
• Labeled the "AI Analysis" tab and its headings as "(experimental)" to set expectations that AI-suggested merges are a newer, less battle-tested feature than the manual tools.
• Dropped the bundled languages/*.po/.mo/.pot files from the repository (regenerate locally as needed) and excluded them via .gitignore, matching the WordPress.org review guidance to rely on translate.wordpress.org for hosted translations instead of bundling them.

For the full version history, see CHANGELOG.md.