v0.11.0 — WordPress.org Hardening

v0.11.0 — WordPress.org Hardening

Draft release notes. Lands as part of the final version-bump commit
(once PRs #198, #199, #200, #201, #203, #204, #205, #206 are all merged).

Headline

Plugin renamed to "Agentic Admin for WordPress" for WordPress.org
submission compliance, with a major strip-down of hackathon-era
prototype features. Roughly 3,800 lines of code removed, 819 KB
dropped from the shipped bundle, and 9 issues closed across security,
compliance, and critical bug fixes.

readme.txt entry (ready to copy in)

= 0.11.0 =
* Renamed: Plugin is now "Agentic Admin for WordPress". Text domain "agentic-admin", function prefix agentic_admin_*. WordPress.org submission-ready.
* Removed: feedback system, WebMCP bridge, voice input, and three low-value abilities (backup-check, opcode-cache-status, disk-usage). Code preserved in git history; voice + write-file + content-generate + plugin-ecosystem abilities parked for v1.x as opt-in via WP_AGENTIC_ADMIN_ENABLE_LABS constant.
* Security: blocked sensitive-column reads (user_email, user_pass) in query-database to prevent reconnaissance attacks (#166). Hardened query length cap and read-only verb gate.
* Security: escaped output in functions-abilities.php (#121). Added sw-loader.php access-control rationale (#123). Documented direct-DB-call rationale in db-optimize and database-check.
* Compliance: removed deprecated load_plugin_textdomain() call, prefixed uninstall.php globals, fixed nonexistent Domain Path header, excluded CLOUDFEST_HACKATHON.md from distribution build.
* New: ability manifest as single source of truth for which abilities register, with a wp_agentic_admin_enabled_abilities filter for selective override. PHP authoritative for PHP-backed abilities; JS adds back the JS-only ones.
* Fixed: thinking-disable setting now actually suppresses the streaming UI even when Qwen ignores /nothink (#181).
* Fixed: Settings panel is now a real tab (not a stateful cog toggle). No more lingering Chat-tab underline or stale-state regressions (#197).
* Fixed: Activate/Deactivate buttons on plugin-list rows now flip to the inverse action after a successful click (#179).
* Fixed: AI model no longer preloads on every wp-admin page — deferred until the user opens the sidebar for the first time (#116).
* Improved: post-tool summarization is brief (no re-listing items the user already sees in the tool result UI).
* Improved: ChatInput keyboard handling simplified (Space inserts a space, no push-to-talk hijacking).
* Improved: KB embedding moved to a Web Worker with persistent progress across tab switches.
* Pinned: Transformers.js CDN URL to @3.8.1 (was floating @3 range) — privacy-first plugin shouldn't depend on a CDN range that can ship new code without a deliberate bump.
* Removed: 7 stale tab references and 6+ stale docs files (FEEDBACK-DEV.md).
* Tests: 96 unit tests passing, plus the new manifest test suite (7 cases), index test suite (6 cases), knowledge-base test suite (16 cases), and react-agent regression tests (3 cases for the per-call state cleanup fix).

Issues closing on merge of v0.11

Closed via PR

• #116, #121, #122, #123, #124, #125, #128, #129, #130, #131, #132, #133, #166, #179, #181

Closed standalone

• #2 — Sidebar Panel UI (shipped earlier, closed during cleanup)
• #66 — Updating plugins fails (no longer reproducible)
• #68 — Install a new plugin (already shipped)
• #126 — Unescaped queries in backup-check.php (file deleted)
• #176 — get-site-url returns invalid data (ability removed)
• #188 — role-capabilities-check JS/PHP sync (PR #183 never merged, drift never landed)

Numbers

Metric	Before v0.11	After v0.11
Default abilities registered	~42	33
Total LoC in source tree	—	-3,800 lines
Shipped bundle (Whisper alone)	819 KB	0
Plugin Name compliance	"WP Agentic Admin" (blocked)	"Agentic Admin for WordPress" (passes)
Function prefix	wp_agentic_admin_ (blocked)	agentic_admin_ (passes)
Open Plugin Checker errors	12+	0
Unit tests passing	89	96+ (additions from new test suites)

Files to update for the version bump

1. wp-agentic-admin.php
   • Header: Version: 0.10.0 → Version: 0.11.0
   • Constant: define( 'WP_AGENTIC_ADMIN_VERSION', '0.10.0' ) → '0.11.0'
   • Activate hook: update_option( 'agentic_admin_version', '0.10.0' ) → '0.11.0'
2. package.json: "version": "0.10.0" → "0.11.0"
3. readme.txt: Stable tag: 0.10.0 → 0.11.0
4. package-lock.json: npm install --package-lock-only to sync
5. Add the = 0.11.0 = block above to readme.txt (under == Changelog ==)

Merge order + pre-resolved conflicts

Confirmed via dry-run (2026-05-12): the 7 small PRs (#198, #199, #200, #201, #203, #204, #205) touch entirely disjoint files. They can merge in any order without conflicts among themselves.

#206 (rename) MUST merge last. It conflicts with 3 of the small PRs. Local git rerere has recorded the resolutions, so when the actual rebase happens, git replays them automatically. To re-prime rerere on another machine, redo the dry-run merge: git checkout -b dryrun dev; git config rerere.enabled true; for b in <small-pr-branches>; do git merge --no-ff --no-edit origin/$b; done; git merge origin/fix/v0-11-wp-org-rename, resolve, commit, discard branch.

Conflict 1: wp-agentic-admin.php (#206 ↔ #198)

Two blocks in the file:

1. Plugin header Text Domain line + Domain Path line — keep #206's Text Domain: agentic-admin, drop Domain Path per #198 (no languages/ dir).
2. load_textdomain() method block — keep #198's empty state (method removed per #131; WP 4.6+ auto-loads).

Also: init() no longer calls $this->load_textdomain().

Conflict 2: includes/abilities/query-database.php (#206 ↔ #199)

Two blocks in the file:

1. Function signature: keep agentic_admin_check_query_safety (combines #206's prefix-rename with #199's new function name + string|true return type).
2. Caller: $safety = agentic_admin_check_query_safety( $query ); (uses the new function + checks true !== $safety).

Also: #199's new functions (agentic_admin_sensitive_columns, agentic_admin_redact_sensitive_row) need the rename applied manually because #206 didn't see them yet. All 'wp-agentic-admin' text-domain strings introduced by #199 → 'agentic-admin'.

Conflict 3: includes/functions-abilities.php (#206 ↔ #201)

One block: the _doing_it_wrong call. Keep #201's esc_html() wrapping with #206's 'agentic-admin' text domain.

Replay sequence

When all 7 small PRs have merged to dev:

git checkout fix/v0-11-wp-org-rename
git fetch origin
git rebase origin/dev    # rerere auto-applies the 3 resolutions
# If any conflict remains (rerere cache lost), consult the blocks above.
npm test && composer lint && npm run build
git push --force-with-lease origin fix/v0-11-wp-org-rename

Smoke test checklist before release tag

• Load plugin in Playground at fresh state — Plugin Name shows "Agentic Admin for WordPress"
• agentic_admin_resolve_enabled_abilities() returns 33 abilities; all function_exists() checks pass
• composer lint 0 errors, 0 warnings
• npm test all passing
• npm run build clean
• Send "list plugins" — UI shows structured result + brief summary (not duplicated listing)
• Click Activate on inactive plugin — button flips to Deactivate, plugin is active in DB
• Click Settings tab — Chat underline disappears, settings content shows; click Settings again — stays on Settings; click Chat tab — switches cleanly
• Disable thinking → send a message → no thinking UI flashes
• Open a fresh wp-admin page (not the plugin page) — model does NOT preload; click superhero icon to open sidebar — only then does the WebGPU check + auto-load run
• Try SELECT * FROM wp_users WHERE user_email = 'admin@…' via query-database — gets blocked with the sensitive-column message
• Verify wp-agentic-admin.zip build via npm run dist does NOT contain CLOUDFEST_HACKATHON.md or docs/FEEDBACK-DEV.md

v0.10.0 — CloudFest Hackathon 2026

CloudFest Hackathon 2026 Release

78 PRs merged across 3 days by 11 contributors, tripling the plugin's capabilities from 14 to 42+ abilities.

Highlights

• Plugin Abilities Platform — third-party plugins can auto-register abilities with the AI assistant
• Voice input — local Whisper model, all audio stays on-device
• In-browser RAG — knowledge base with vector embeddings computed client-side
• Settings UI — GPU detection, context window tuning, knowledge base toggle
• External AI providers — Ollama, LM Studio, OpenAI, any compatible endpoint via PHP REST proxy
• WebMCP bridge — external AI agents via navigator.modelContext
• "Check if Hacked" workflow — multi-step security scan
• Editor sidebar + admin bar — AI assistant accessible from every wp-admin page
• 28+ new abilities — web-search, security-scan, plugin vulnerability scanning, read-file, write-file, query-database, content-generate, and more
• E2E test runner — mirrors browser ReAct loop
• CI/CD — GitHub Actions with PHP lint, JS lint, unit tests, build check
• WCAG 2.2 AA accessibility compliance
• Distribution zip for WordPress Playground compatibility

Install

Download wp-agentic-admin.zip and upload via WordPress Plugins > Add New > Upload Plugin.

Or try it in WordPress Playground.

Contributors

Marcel Schmitz, Ivelina Dimova, Stefan E, Tome Pajkovski, Alexander Melde, Jan Vogt, Bowe Frankema, Robert Abela, Moritz Bappert, 0xLoopTheory, Lucisu

v0.9.5 — Split Gutenberg goals, align WASM branch, create issues #32-#35

What's changed

Hackathon goals restructured

• Goal 7 split into three: Block Editor Chat Window (Goal 7), Update Post Content Ability (Goal 8), WASM Dev Docs Abilities (Goal 9) — each now follows the same concise format as all other goals
• Goal 9 aligned with the existing feature/wasm-sqlite-devdocs branch — references the 4 implemented abilities (search-wp-blocks, get-block-schema, search-wp-hooks, get-hook-context), 11 tests, and @pluginslab/wp-devdocs-wasm package
• Code examples stripped from stretch goals for consistency

New GitHub issues

• #32 — [AI] WebMCP integration (Goal 6)
• #33 — [Sidebar] Block editor chat window (Goal 7)
• #34 — [Ability] update-post-content (Goal 8)
• #35 — [AI] WASM dev docs abilities (Goal 9)

Existing changes (since v0.9.4)

• Voice + Context Recording separated as Goal 1.5 (stretch)
• WebMCP Integration added as Goal 6 (stretch)

v0.9.4 — WebLLM update and /playground skill

Changes

• Updated: WebLLM upgraded from 0.2.80 to 0.2.82
• New: /playground Claude Code skill for spinning up WordPress Playground with the plugin mounted and activated via MCP

Model benchmarks (Ollama ability tests)

Model	Size	Accuracy	Time
Qwen 3 1.7B	1.7B	18/18 (100%)	69s
Gemma 2 2B	2B	17/18 (94%)	24s
Qwen 3.5 2B	2B	17/18 (94%)	214s
Phi 3.5 Mini	3.8B	15/18 (83%)	122s

Qwen 3 1.7B remains the recommended default — best accuracy and speed for tool calling.

v0.9.3 — onboarding guide, /issue skill, and hackathon doc cleanup

Summary

New

• ONBOARDING.md — step-by-step hackathon guide split into two parts: a 15-minute project tour (everyone reads together) and role-specific deep-dives for all 7 contributor roles (PHP, JS, AI, Testing, UX, Writers, DevOps)
• /issue skill — Claude Code slash command that interviews the user, inspects the codebase, and creates well-structured GitHub issues matching the project's existing patterns
• gh issue * permission added to .claude/settings.json

Improved

• CLOUDFEST_HACKATHON.md simplified — removed ~45 lines of duplicated content (project summary, role descriptions, pipeline explanation) that now lives in ONBOARDING.md. Hackathon doc is now focused on product specs, goals, and research.
• README.md — added /issue skill to Claude Code integration table

Test plan

• Unit tests: 43/43 passed
• No JS/PHP files modified (docs + config only)

🤖 Generated with Claude Code

v0.9.2 — AI Fundamentals glossary, Writer/UX guide, and content improvements

Summary

Documentation overhaul of the AI Fundamentals guide — adding missing content for underserved contributor roles and trimming theoretical content that wasn't actionable.

New content

• Glossary (glossary.md) — ~60 terms (A-Z) with definitions and chapter back-links
• Chapter 13: Designing Abilities — Guide for Writers (use case specs, natural language triggers, response sketches) and UX contributors (confirmation dialogs, model loading UX, sidebar design)
• End-to-end walkthrough (Ch. 8) — Traces a full user message through the system: message router → keyword match → ReAct loop → REST API → streamed response
• Testing tool selection (Ch. 11) — How LLM Testers can write keyword matching tests, edge-case prompts, and ability tests

Trimmed & simplified

• Ch. 1: Condensed temperature/sampling section from table + subsection to 2 sentences
• Ch. 2: Replaced duplicate hardware requirements with a link to Ch. 3 (single source of truth)
• Ch. 5: Removed speculative "Future of Quantization" section (q2, q1.58 ternary research)

Updated

• INDEX.md: Added "For Writers & Designers" section

Test plan

• Unit tests: 43/43 passed
• No JS/PHP files modified (docs-only release)

🤖 Generated with Claude Code

v0.9.1 — clean up stale version annotations and outdated comments

Summary

• Removed ~40 stale version annotations (v1.0–v2.0, @since 2.0.0, Phase 1, etc.) from comments across 11 source files and 3 docs
• Fixed model-loader.js comment that incorrectly referenced Qwen2.5-7B instead of actual default Qwen3-1.7B
• Updated ARCHITECTURE.md current version from v0.7.0 → v0.9.0
• Fixed THIRD-PARTY-INTEGRATION.md references to non-existent v1.4.1 for includeIf feature
• Updated README.md /release example to current versioning

Test plan

• Unit tests: 43/43 passed
• JS lint: 0 errors on changed files
• PHP lint: no new issues in changed files

🤖 Generated with Claude Code

v0.9.0 — CloudFest Hackathon 2026 Preparation

CloudFest Hackathon 2026 Preparation

Everything needed to onboard 8 hackathon contributors on day one.

What's New

• CLOUDFEST_HACKATHON.md: Sharpened 5 goals with starting points, definitions of done, and main stage demo flow
• 7 team role definitions: PHP Developers, React/JS Developers, AI Enthusiasts, LLM Testers, UX/Design, Writers, DevOps
• 28 GitHub issues across all roles — abilities, sidebar UI, AI architecture, testing, docs, DevOps
• 12 GitHub labels for hackathon workflow
• LICENSE (GPL-2.0-or-later)
• SECURITY.md with vulnerability reporting policy
• README.md header image from CloudFest pitch deck

Hackathon Goals

1. Sidebar UI (must-have) — persistent chat on every wp-admin page
2. Expanded Abilities (must-have) — go from 14 to 25+ abilities
3. External AI Providers (stretch) — Google Prompt API, Gemini, WP AI Client
4. LAN AI (stretch) — consult local network Ollama/llama.cpp
5. Advanced Abilities (stretch) — filesystem, database, web search

Fixes

• readme.txt changelog: internal 1.x versions renumbered to public 0.x scheme
• CONTRIBUTING.md: WordPress version requirement corrected to 6.9+

Full hackathon doc: CLOUDFEST_HACKATHON.md

v0.8.0 — Claude Code project config & contributor skills

What's changed

This release adds full Claude Code project configuration so contributors get an opinionated, productive setup out of the box.

.claude/ project config

• CLAUDE.md — project rules: code style (WPCS + eslint), build/test commands, ability patterns, version bumping steps, constraints, and common pitfalls
• settings.json — pre-allowed safe commands (build, test, lint, git, ollama), denied destructive commands (rm -rf, sudo, force push, hard reset), Chrome DevTools MCP plugin auto-enabled

5 contributor skills

Skill	Description
/release 0.9.0	Version bump all files, commit, push, and create GitHub release
/test	Run PHP lint, JS lint, unit tests, and ability tests in sequence
/new-ability cache-warm	Scaffold PHP + JS ability files with registration and test case
/update-docs	Sync all documentation with current codebase state
/pr	Create PR with branch naming, pre-flight checks, and structured template

.mcp.json — project-scoped MCP servers

Auto-available to all contributors using Claude Code:

• wp-devdocs — WordPress hooks, functions, and API documentation
• wp-blockmarkup — Gutenberg block markup and schemas
• wp-playground — spin up WordPress test instances

Other

• .claude/settings.local.json added to .gitignore for personal overrides
• README updated with Claude Code integration section

Full changelog: 788d229...93208cf

v0.7.1 — Auto-load abilities, full test coverage

What's changed

Auto-loaded ability metadata

Ability tests no longer maintain a static manifest. load-abilities.js extracts id, label, and description directly from the JS source files at test time — single source of truth, zero drift.

Full test coverage

Test suite expanded from 8 tests (5 abilities) to 18 tests covering all 14 abilities:

• Plugin management: list, activate, deactivate
• Diagnostics: error log, site health, PHP version
• Cache & performance: cache flush, db optimize, transient flush, revision cleanup
• Cron & rewrites: cron list, rewrite list, rewrite flush
• Core WordPress: site info, environment info
• Knowledge questions: no-tool responses

Baseline: 100% accuracy (18/18) in ~45s with Qwen 3 1.7B via Ollama.

Lint fixes

All test files now pass wp-scripts lint-js.

Full changelog: a465729...788d229