v1.1.2 — Security fix: permission_check

Security

• Removed is_app_password_request() bypass in permission_check() — WP REST auth middleware handles Application Password validation automatically; the bypass was unintentionally allowing unauthenticated access
• Tightened REST capability from read to manage_options — API is admin/agent only

Docs

• Added Security & Design Notes section to readme.txt for WP.org submission
• Documents auth rationale, long-poll tradeoff, direct DB query pattern, and safe uninstall default

v1.1.0

Merged namespace refactor from Skippy + conflict guard.

v1.0.0 — Initial standalone release

Extracted from BotCreds Agent Access 2.0.3.

New in this release:

• Standalone plugin — works without Agent Access
• Nests under Agent Access menu when both are active (no conflicts)
• Add Channel button in sidebar
• Fixes UTC timestamp rendering in message list

REST API namespace: agent-access/v1 preserved for backward compat with live clawpress.blog agents.