WPPilot 1.8.1 — Fifteen fixes

A defect-only release. No new abilities, no schema changes, no permission changes — existing connections keep working and do not need re-authorising.

Three fixes to features that were out of service

wppilot/reorder-menu-items destroyed the menu it was asked to reorder. wp_update_nav_menu_item() merges its own defaults over whatever it is not given and rewrites the item, so a call carrying only a position blanked the label, cleared the link, reset the type to custom and flattened the nesting of every item it touched — and reported success. Each write now seeds the item's existing values first, the way upsert-menu-item already did.

The Chat screen rendered nothing. Its script was enqueued from a build manifest looked for one directory too deep. The file was never found, the fallback declared no dependencies at all, and the bundle printed before wp-element and wp-components and threw on execution — an empty page with no error anybody could see.

A site-wide fatal was reachable through wppilot/update-site-settings. Any string was accepted as timezone_string, and an identifier PHP cannot resolve makes wp_timezone() throw from inside current_time() and wp_date() — every request that formats a date, for everyone, until the option is repaired by hand. A typo'd timezone is now refused with the setting named.

Two fixes to content corrupted on the way in

Skill and design bodies were being mangled on save. Escape processing meant for AI clients that JSON-encode their tool arguments twice was applied to every submission, so a Windows path in a skill turned C:\temp into C:<TAB>emp and a regex \d+ into d+ — silently, for content typed into wp-admin or read from an uploaded .md file. The rescue now runs only on a body carrying the signature it exists for: no real line breaks, but literal \n sequences where they should be.

Backslashes were stripped from comments, skill bodies and design titles. wp_insert_comment(), wp_update_comment() and wp_update_post() unslash what they are given, so anything handed to them unslashed arrived one round of stripping short.

Also fixed

• A Block Editor batch that failed at commit became permanently stuck: the retry re-serialized the same spec to byte-identical content, WordPress reported "no change" as false, and the item was failed for it — with a message blaming WordPress — on that attempt and every attempt after it.
• wppilot/set-featured-image and wppilot/update-post reported a failure when the requested image was already the featured image. Both are idempotent by declaration, and that was the one thing a retry could not do.
• wppilot/edit-file fatalled on an empty old_string; PHP 8 throws on an empty needle rather than returning a count. It now refuses and points at write-file.
• A Chat session update carrying an empty or non-JSON body returned a 500 instead of a refusal.
• The Preview screen described a preview expiring in 23 hours as having expired 23 hours ago.
• A new skill created as Disabled went live immediately — the form offered the choice and the create path ignored it.
• Trashing or permanently deleting a skill now verifies the post type first, as every other action on that screen already did.
• The "Get Pro" link never appeared on the Plugins page: the filter it hooked was built from a path that does not exist.
• The web-apps panel no longer walks you through an OAuth sign-in on a site where the OAuth routes are deliberately not served. On a public plain-HTTP site those endpoints 404 by design; it now says so and points at the access token, instead of contradicting the method card beside it.

---

Install: download wppilot.zip below and upload it under Plugins → Add New → Upload Plugin. Sites already running WPPilot are offered this update in wp-admin.