v1.3.0 — Inventory Collector

SFB Toolkit v1.3.0

Added

• Inventory Collector module — GET /wp-json/sfb/v1/inventory (HMAC-protected) collects:
  • WordPress core version
  • Active theme (incl. child + version)
  • All plugins (including premium, via get_plugins())
  • mu-plugins
  • PHP version
  • Whitelisted files: sha256 + mtime (functions.php, style.css, wp-config.php, .htaccess, advanced-cache.php)
  • Whitelisted options (read-only)
  • Reusable blocks
• HMAC-SHA256 auth helper (class-sfb-hmac.php) with replay protection:
  • 300s signature window
  • 360s nonce cache (transient)
  • Constant-time comparison
• Bootstrap endpoint GET/POST /wp-json/sfb/v1/inventory-secret (manage_options auth) for secret retrieval + rotation
• Settings page toggle for Inventory module (default ON)

Use case

Central change-tracking pipeline (PG sco_global.site_inventory_snapshots) — feeds daily snapshots from each managed WP site to bridge for diff detection.

Trigger: task #2300 special-plus FluentCRM incident (lack of historical plugin version tracking).

Compatibility

Backwards-compatible with v1.2.0. Existing modules (file verify, nonce provider, article tracker) unchanged.

Deployment

Auto-update via GitHub Updater on sites already running v1.0.0+ (detection within 6h).