SiteHelm 0.11.0

Until now the only way to connect a client was to create an application password and paste it into a config file. An app can now register with the site, send you to a page in your own dashboard that names it and asks whether to allow it, and hold its own credential afterwards — nothing to copy, nothing to paste. It is on wherever the site is served over HTTPS and can be switched off entirely. Application passwords keep working exactly as they did; this is a second way in, not a replacement, and a connection made this way still acts as the account that approved it and can do nothing that account could not.

Added

• Apps can sign in to the site themselves. Register, approve from your own dashboard, done. A connection you can see and cut off from the site rather than from the app.
• Connect asks how your app signs in before it shows you anything to paste, and the snippets follow the choice. On a site that cannot offer signing in, it says which of the two reasons it is and points at the path that does work. Below that: every app that has signed in, with when it registered, when it was last let in, how many live tokens it holds, and a Sign out or Remove button that names the app before it acts. Below that again: whether apps may sign in at all, the address they are given (for hosts answering on a different domain to the one WordPress recorded), and a Test discovery button that asks this site for its own sign-in documents over the network and reports, per address, whether the answer came from this site or from something sitting in front of it. The same verdict appears on Health.
• Home opens with five steps that tick themselves off — connect a client, choose what it may touch, make a test call, make a first change, undo it. Nothing is remembered and nothing is dismissed: every step reads its own answer back off the site, and once all five are done the block folds to one line.

Fixed

• A client that asks for an older MCP protocol revision now gets the one it asked for. The handshake answered with this server's newest revision whatever the client named, and several clients read that disagreement as the end of the conversation and never asked for the tool list — so the whole site looked like it had no operations at all.
• Two schema shapes that strict clients refused to load. A menu item's target offered an empty string as one of its two choices, and the dispatcher tools never said which of their inputs were required. "Same tab" is now the plain _self you would write in HTML; an empty string is still accepted and still means the same thing, but it is deprecated and no longer listed.
• Two sites no longer collide in one client's config. The generated server name carries the site's host — sitehelm-example-com.
• One unreadable global class no longer hides all the others in elementor-global-class-list. The bad entry is reported in its place with a short reason.
• A style class nothing wears is refused instead of silently rendering nothing.

Install

Download sitehelm-0.11.0.zip below and upload it in Plugins → Add New → Upload. Sites already running SiteHelm are offered the update in place. Requires WordPress 6.6 and PHP 8.1 or newer.