WPPilot 1.15.0 — Search and replace, audits, human confirmation and a new admin

• New: a redesigned admin. WPPilot opens on a Dashboard that answers "is everything fine, what did agents do, does anything need me": whether agents can act and under which safety profile, connected clients and when they were last active, changes in the last 24 hours and how many can be undone, writes waiting for approval, and the latest changes with an Undo button on each. The connection wizard, credentials and endpoints moved to their own Connect screen. Sixteen screens are grouped into six sections - Dashboard, Connect, Activity, Agent, Studio, Settings - with the screens of each section as tabs under the page title, and Activity shows a count when writes wait for approval. The look is calmer: hairline cards instead of heavy black borders, sentence-case labels, and green for "agents can act" instead of red. The header is one white bar with the site's name and the agents' state, and the toolbar shows "WPPilot" with a green, amber or grey dot instead of a red "WPPilot ON" block. Every screen now fits a phone without scrolling sideways.
• Prompts shows one industry at a time with the search still covering all of them, in a two-column grid; the screen was 94,000 pixels long with Pro's briefs. The free briefs' industries now match Pro's, so "Pets" and "Pets & animals" are no longer two categories.
• New: search and replace across posts. wppilot/search-replace-preview builds a reviewed plan - every match, per field, with before and after - over post titles, content, excerpts and chosen meta keys, serialized values and builder JSON included (Elementor's escaping is kept byte for byte). wppilot/search-replace-apply writes only posts that are in the plan and unchanged since the preview, 100 per call or as a background job, takes a before-image of exactly the fields it touches, and records one undoable change per post under one batch, so one post or the whole run can be undone. Serialized objects, guids and options are never touched; regular expressions are off unless asked for and bounded. wppilot/search-replace-status and wppilot/search-replace-cancel follow and stop a background run.
• New: image editing. wppilot/edit-image resizes, crops, rotates and flips an image as a new attachment or in place, the way WordPress's own image editor names files and keeps backup sizes, and either can be undone. The original file is never deleted.
• New: accessibility. wppilot/audit-accessibility reads a page as visitors receive it and checks it against WCAG 2.2 - language, title, headings, alt text, labels, accessible names, duplicate ids, ARIA references, landmarks, tab order, zoom lock, iframe titles and table headers - with the success criterion and level on every finding, a score, and what it could not check (contrast, focus, target size, script-rendered content). wppilot/audit-media-alt finds images with missing or filename alt text; wppilot/get-media-image shows an image to the model as MCP image content so it can write real alt text; wppilot/update-image-alt sets it in bulk with undo per image or per batch.
• New: content audit. wppilot/audit-content finds broken internal links, orphan pages, thin content, missing SEO descriptions and structured-data problems (and notes that FAQ and HowTo markup no longer earns Google rich results) across the site as a background job; wppilot/audit-content-status reports it.
• New: Block Notes. An agent can leave a note on a block for a person, reply, and resolve, and read the notes a person resolved - the review loop WordPress 7.1's Notes make possible. Every note it writes can be undone.
• New: site tools. WP-Cron list, run and delete (a deleted event can be put back at the same time and schedule), Site Health tests, transient flush, and - only on Developer Full Access, and recorded in the change log without their results - an options explorer and wppilot/database-query, one checked, read-only SELECT with sensitive columns redacted and the users, options and key tables refused.
• New: multisite. On a network, wppilot/network-list-sites and wppilot/network-run-ability run an ability on another site through that site's own safety profile, confirmation and gates, and record the change in that site's own log.
• New: Connection Doctor, on Diagnostics and as wppilot/connection-doctor. It finds what stops an MCP client connecting - a firewall, Cloudflare, ModSecurity, a stripped Authorization header, disabled Application Passwords, OAuth clock skew or URL mismatch - and gives the exact fix for the server it runs on.
• New: an MCP server card at /.well-known/mcp/server-card.json and an MCP Registry entry; skills and industry briefs served as skill:// resources; MCP Tasks, so a long call can run in the background and be polled or cancelled; and an MCP Apps preview card, which hosts that support it show beside a preview with an Apply button.
• New: a person, not the model, can confirm destructive calls. With Settings > Confirmation mode set to "A person approves", confirm=true from the model is no longer enough: the person approves the exact call in their MCP client, or on a one-time wp-admin link that shows exactly what will run. Each change records how it was confirmed. Off by default; existing connections behave as before.
• New: access tokens are agent identities. A token now has an expiry chosen at creation, can be limited to chosen abilities or categories, and can carry a safety-profile ceiling below the site's. Everything outside its scope is refused and hidden from it, and its changes are attributed to it by name.
• New: other plugins' abilities are governed like WPPilot's own. Any ability can be set to always require confirmation or a minimum profile on the Abilities screen, and a declarative ledger map lets writes by other plugins' abilities (Rank Math and SEOPress settings to start) be undone instead of recorded as irreversible.
• Changed: the change log is stored in its own database table instead of one option capped at 500 rows. Existing history is moved across on update, in order; if the table cannot be created the option keeps working and Diagnostics says why. The Changes screen and the export page through it in the database. History is kept for 10,000 changes or 90 days, and large before-images of changes older than 30 days are dropped.
• New: the features above are portable kits (includes/kits), each exportable into another plugin with scripts/export-kit.php.
• Elementor edits can be undone without Pro. The free Elementor writes (add, edit, move, duplicate, reorder and delete elements, set content and page settings) had no before-image, so on a site without Pro every one was recorded as "No supported before-image". Pro's own Elementor capture still takes over when Pro is active.
• Fixed: undoing a change to a post could report "did not match the before-image" when the post was restored exactly, because the check depended on the order WordPress returned the post's meta in. The check is now order-independent, and when an undo really does not match it names the fields that still differ.
• Fixed: an invalid or expired access token got WordPress's generic 401 on any site where another plugin reads the current user while plugins load (Beaver Builder does), so the client never saw WWW-Authenticate invalid_token and an expired token never said it had expired. The credential is now judged at REST authentication when nothing judged it earlier.
• Fixed: a revalidated server card was always sent in full, and the approval page had no browser tab title.
• 26 new abilities (168 in all). The database, options and PHP abilities stay on Developer Full Access only. No existing ability changed its permissions; existing connections keep working and do not need re-authorising.