Skip to content

v0.11.0 — WordPress.org Hardening

Latest
Latest

Choose a tag to compare

View all tags
@pluginslab pluginslab released this 15 May 16:45
· 11 commits to main since this release
v0.11.0
b6a3713
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v0.11.0 — WordPress.org Hardening

Draft release notes. Lands as part of the final version-bump commit
(once PRs #198, #199, #200, #201, #203, #204, #205, #206 are all merged).

Headline

Plugin renamed to "Agentic Admin for WordPress" for WordPress.org
submission compliance, with a major strip-down of hackathon-era
prototype features. Roughly 3,800 lines of code removed, 819 KB
dropped from the shipped bundle, and 9 issues closed across security,
compliance, and critical bug fixes.

readme.txt entry (ready to copy in)

= 0.11.0 =
* Renamed: Plugin is now "Agentic Admin for WordPress". Text domain "agentic-admin", function prefix agentic_admin_*. WordPress.org submission-ready.
* Removed: feedback system, WebMCP bridge, voice input, and three low-value abilities (backup-check, opcode-cache-status, disk-usage). Code preserved in git history; voice + write-file + content-generate + plugin-ecosystem abilities parked for v1.x as opt-in via WP_AGENTIC_ADMIN_ENABLE_LABS constant.
* Security: blocked sensitive-column reads (user_email, user_pass) in query-database to prevent reconnaissance attacks (#166). Hardened query length cap and read-only verb gate.
* Security: escaped output in functions-abilities.php (#121). Added sw-loader.php access-control rationale (#123). Documented direct-DB-call rationale in db-optimize and database-check.
* Compliance: removed deprecated load_plugin_textdomain() call, prefixed uninstall.php globals, fixed nonexistent Domain Path header, excluded CLOUDFEST_HACKATHON.md from distribution build.
* New: ability manifest as single source of truth for which abilities register, with a wp_agentic_admin_enabled_abilities filter for selective override. PHP authoritative for PHP-backed abilities; JS adds back the JS-only ones.
* Fixed: thinking-disable setting now actually suppresses the streaming UI even when Qwen ignores /nothink (#181).
* Fixed: Settings panel is now a real tab (not a stateful cog toggle). No more lingering Chat-tab underline or stale-state regressions (#197).
* Fixed: Activate/Deactivate buttons on plugin-list rows now flip to the inverse action after a successful click (#179).
* Fixed: AI model no longer preloads on every wp-admin page — deferred until the user opens the sidebar for the first time (#116).
* Improved: post-tool summarization is brief (no re-listing items the user already sees in the tool result UI).
* Improved: ChatInput keyboard handling simplified (Space inserts a space, no push-to-talk hijacking).
* Improved: KB embedding moved to a Web Worker with persistent progress across tab switches.
* Pinned: Transformers.js CDN URL to @3.8.1 (was floating @3 range) — privacy-first plugin shouldn't depend on a CDN range that can ship new code without a deliberate bump.
* Removed: 7 stale tab references and 6+ stale docs files (FEEDBACK-DEV.md).
* Tests: 96 unit tests passing, plus the new manifest test suite (7 cases), index test suite (6 cases), knowledge-base test suite (16 cases), and react-agent regression tests (3 cases for the per-call state cleanup fix).

Issues closing on merge of v0.11

Closed via PR

Closed standalone

  • #2 — Sidebar Panel UI (shipped earlier, closed during cleanup)
  • #66 — Updating plugins fails (no longer reproducible)
  • #68 — Install a new plugin (already shipped)
  • #126 — Unescaped queries in backup-check.php (file deleted)
  • #176 — get-site-url returns invalid data (ability removed)
  • #188 — role-capabilities-check JS/PHP sync (PR #183 never merged, drift never landed)

Numbers

Metric Before v0.11 After v0.11
Default abilities registered ~42 33
Total LoC in source tree — -3,800 lines
Shipped bundle (Whisper alone) 819 KB 0
Plugin Name compliance "WP Agentic Admin" (blocked) "Agentic Admin for WordPress" (passes)
Function prefix wp_agentic_admin_ (blocked) agentic_admin_ (passes)
Open Plugin Checker errors 12+ 0
Unit tests passing 89 96+ (additions from new test suites)

Files to update for the version bump

  1. wp-agentic-admin.php
    • Header: Version: 0.10.0 → Version: 0.11.0
    • Constant: define( 'WP_AGENTIC_ADMIN_VERSION', '0.10.0' ) → '0.11.0'
    • Activate hook: update_option( 'agentic_admin_version', '0.10.0' ) → '0.11.0'
  2. package.json: "version": "0.10.0" → "0.11.0"
  3. readme.txt: Stable tag: 0.10.0 → 0.11.0
  4. package-lock.json: npm install --package-lock-only to sync
  5. Add the = 0.11.0 = block above to readme.txt (under == Changelog ==)

Merge order + pre-resolved conflicts

Confirmed via dry-run (2026-05-12): the 7 small PRs (#198, #199, #200, #201, #203, #204, #205) touch entirely disjoint files. They can merge in any order without conflicts among themselves.

#206 (rename) MUST merge last. It conflicts with 3 of the small PRs. Local git rerere has recorded the resolutions, so when the actual rebase happens, git replays them automatically. To re-prime rerere on another machine, redo the dry-run merge: git checkout -b dryrun dev; git config rerere.enabled true; for b in <small-pr-branches>; do git merge --no-ff --no-edit origin/$b; done; git merge origin/fix/v0-11-wp-org-rename, resolve, commit, discard branch.

Conflict 1: wp-agentic-admin.php (#206 ↔ #198)

Two blocks in the file:

  1. Plugin header Text Domain line + Domain Path line — keep #206's Text Domain: agentic-admin, drop Domain Path per #198 (no languages/ dir).
  2. load_textdomain() method block — keep #198's empty state (method removed per #131; WP 4.6+ auto-loads).

Also: init() no longer calls $this->load_textdomain().

Conflict 2: includes/abilities/query-database.php (#206 ↔ #199)

Two blocks in the file:

  1. Function signature: keep agentic_admin_check_query_safety (combines #206's prefix-rename with #199's new function name + string|true return type).
  2. Caller: $safety = agentic_admin_check_query_safety( $query ); (uses the new function + checks true !== $safety).

Also: #199's new functions (agentic_admin_sensitive_columns, agentic_admin_redact_sensitive_row) need the rename applied manually because #206 didn't see them yet. All 'wp-agentic-admin' text-domain strings introduced by #199 → 'agentic-admin'.

Conflict 3: includes/functions-abilities.php (#206 ↔ #201)

One block: the _doing_it_wrong call. Keep #201's esc_html() wrapping with #206's 'agentic-admin' text domain.

Replay sequence

When all 7 small PRs have merged to dev:

git checkout fix/v0-11-wp-org-rename
git fetch origin
git rebase origin/dev    # rerere auto-applies the 3 resolutions
# If any conflict remains (rerere cache lost), consult the blocks above.
npm test && composer lint && npm run build
git push --force-with-lease origin fix/v0-11-wp-org-rename

Smoke test checklist before release tag

  • Load plugin in Playground at fresh state — Plugin Name shows "Agentic Admin for WordPress"
  • agentic_admin_resolve_enabled_abilities() returns 33 abilities; all function_exists() checks pass
  • composer lint 0 errors, 0 warnings
  • npm test all passing
  • npm run build clean
  • Send "list plugins" — UI shows structured result + brief summary (not duplicated listing)
  • Click Activate on inactive plugin — button flips to Deactivate, plugin is active in DB
  • Click Settings tab — Chat underline disappears, settings content shows; click Settings again — stays on Settings; click Chat tab — switches cleanly
  • Disable thinking → send a message → no thinking UI flashes
  • Open a fresh wp-admin page (not the plugin page) — model does NOT preload; click superhero icon to open sidebar — only then does the WebGPU check + auto-load run
  • Try SELECT * FROM wp_users WHERE user_email = 'admin@…' via query-database — gets blocked with the sensitive-column message
  • Verify wp-agentic-admin.zip build via npm run dist does NOT contain CLOUDFEST_HACKATHON.md or docs/FEEDBACK-DEV.md
Assets 3
Loading