v0.61.81

Fixed

Command updates failed when a third-party plugin globally decodes the Authorization header (GH #269). Some plugins register a global WordPress REST authentication filter that tries to decode the Authorization: Bearer header on every REST request as their own JWT. The agent signs its command tokens with Ed25519, and such middleware can throw an uncaught fatal on the algorithm it doesn't recognize, killing the request to the agent's command routes before the agent handles it (reported with LiveCanvas, whose bundled framework threw DomainException: Algorithm not supported).

The agent no longer presents its command token in the shared Authorization header. At plugin-load time, for the agent's own REST routes only, it relocates the token into a private internal channel before any third-party auth filter runs, so any plugin that globally decodes Authorization simply sees no Bearer to choke on. Non-agent requests and other authentication schemes (for example Application Passwords) are untouched, and the token is still fully verified downstream. This is robust to any such plugin, not just the one reported.

Security (dependencies)

Bumped two transitive dependencies flagged by newly published advisories: golang.org/x/text to v0.39.0 (GO-2026-5970, denial of service) and sharp to 0.35.3 (GHSA-f88m-g3jw-g9cj, a bundled libvips issue in the marketing site's image pipeline). No runtime behavior change to the agent.

Install / upgrade

Enrolled sites update automatically through the control plane. Fresh or manual installs can download wpmgr-agent.zip below.