=== SiteSelf Connector ===
Contributors: refact
Tags: automation, maintenance, agency, ai
Requires at least: 5.6
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.8.2
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Lets your SiteSelf agent work on this site's theme and plugin files, with a log you can read and a one-click disconnect.

== Description ==

SiteSelf is a service that works on your WordPress site for you — updating
content, adjusting your design, keeping an eye on things — and reports back in
chat. This plugin is the part that lives on your site, and it exists so your
agent can work on your theme and plugin files rather than content alone.

**What it can do**

* Read and write files inside your themes and plugins folders
* Tell your agent how the site is built: WordPress and PHP versions, active
  theme, installed plugins, and which company hosts the site
* Measure the site: how big its database tables and folders are, how much disk
  is free, and what limits the server's PHP runs under
* Make a backup on your own server before your agent changes your live site,
  covering the database tables and theme or plugin files the change touches
* Change a short, fixed list of settings: whether search engines may index the
  site, and, when Yoast SEO is active, the separator in its page titles
* Send SiteSelf a copy of your database and your site's code when SiteSelf
  builds a staging site from yours
* Clear caches
* Keep a log of everything it did, readable under Tools → SiteSelf

**What it will not do, by design**

* It never runs code that is sent to it. There is no remote code execution.
* It never gives your agent a setting that holds a credential. The settings it
  reads are a short, fixed list that describe how your site is built, and it
  refuses anything whose name looks like a key, token or password. The settings
  it changes are a fixed list too, each written the way WordPress's own
  settings screens write it; it never takes a setting's name, SQL or code from a
  request.
* The files it writes for your agent are inside your themes and plugins folders
  only. Both folders are resolved before anything is written, so `../` cannot
  climb out of them, and a file that turns out to be a shortcut to somewhere
  else (a symlink) is refused rather than followed.
* Its backups stay on your server, in a private folder outside the part of the
  server your site is served from, and are never sent anywhere. If your server
  has no such folder, it takes no backup and says why.
* It cannot edit files that WordPress itself would not let you edit. Whether a
  request is allowed is WordPress's decision, using the same permissions as its
  built-in editors — so `DISALLOW_FILE_MODS`, `DISALLOW_FILE_EDIT`, a managed
  host that switches file changes off, and multisite's rule that only a network
  administrator may touch shared plugin files all apply here too.
* Before replacing a file it keeps a copy of the previous version, and it
  refuses to save PHP that has a syntax error.

**Staging sites**

When SiteSelf builds a staging site from yours — a private working copy on
SiteSelf's servers, where a change is made and checked before it is applied to
your live site — SiteSelf's own systems, never your agent, ask this plugin for
a copy of your database tables and your site's code: WordPress itself, your
themes, your plugins, must-use plugins and translations. Your uploads are not
copied; the staging site shows your live site's images. The plugin never sends
`wp-config.php` or a copy of it under another name, and it leaves out any file
whose name says it holds a credential (such as `.env` or an SSH key), any key
file that holds a private key, repositories, database dumps and logs, and tells
SiteSelf which it left out. The database copy holds every one of your site's
tables — so it includes whatever other plugins store there — except the two
rows where this plugin keeps its own keys. Each copy is requested as a job that
shows in the log under Tools → SiteSelf, and is sent in small pieces, each
checksummed; no file is written on your server to make it.

**How access works**

The plugin adds no new way into your site. Every request must come from a
signed-in WordPress user with the right permissions, using WordPress's own
application passwords — which you create, and can revoke at any time under
Users → Profile → Application Passwords. Deactivating this plugin disconnects
the site from SiteSelf and removes the application password it created.

== Installation ==

This plugin does nothing on its own. It is the site-side half of a service, so
there is a short setup after you activate it.

1. Install and activate the plugin. It opens **Tools → SiteSelf**.
2. Select **Connect this site**. The plugin creates an application password for
   your account and sends it to SiteSelf, which answers with a key.
3. Copy the key and paste it at https://siteself.com/setup/key.

There are no settings to configure. **Tools → SiteSelf** shows what your agent
has done, the previous versions of any file it replaced, and a button that
disconnects the site.

To stop it at any time: select Disconnect under Tools → SiteSelf, or deactivate
the plugin. Either tells SiteSelf and removes the application password the
plugin created.

== External services ==

This plugin connects your site to **SiteSelf**, a service run by Refact at
https://siteself.com. The plugin is the site-side half of that service and is
not useful without it.

The plugin sends two kinds of request to SiteSelf at api.siteself.com, over
HTTPS, and only when an administrator acts. It sends nothing on a schedule.

* **When you select Connect this site or Get a new key**, it sends SiteSelf a
  new application password for your WordPress account (with Connect this site
  only), your username, this site's addresses, the public half of its identity
  key, whether it uses Elementor, Divi or Beaver Builder, whether WooCommerce
  is active, whether your host marks it as a staging site, and the plugin's
  version. SiteSelf answers with a one-time key.
* **When you select Disconnect or deactivate the plugin**, it sends this site's
  id and addresses, why (disconnect or deactivate) and the plugin's version, so
  SiteSelf ends the connection on its side. No credential is sent.

Both are signed with this site's identity key, whose private half never leaves
your server. Otherwise the plugin answers requests that SiteSelf makes to your
site, and only when they carry a signed-in WordPress user with administrator
permissions — the application password, which you can revoke.

**What leaves your site when SiteSelf asks.** A status request returns a
description of how this site is built:

* your site's name, home address, admin address and language
* your WordPress and PHP version numbers
* every plugin installed, with its version and whether it is active
* your active theme, its version, and whether it is a child theme
* which company hosts the site, any must-use plugins that identify them, and
  whether the host reports this as a staging copy
* the server software string and the file path WordPress is installed at
* how many published posts and pages you have
* whether this site permits file changes
* a public key this plugin creates for the site, so that moving to a new
  domain does not look like a different site. The matching private key never
  leaves your server — not to SiteSelf, not in any request.

A measurement request returns the size of each of your database tables and
how many rows it has, the size of your WordPress, theme, plugin, content and
uploads folders, the free space on your server's disk, your PHP version and
limits, whether scheduled tasks run, which drop-in files replace parts of
WordPress (such as an object cache), and where a backup would be kept. It
returns sizes and counts, never what is in a table or a file.

Other requests return the contents of a file inside your themes or plugins
folders, a folder listing, one of a short fixed list of WordPress settings
that describe how the site is built, or the current value of a setting the
plugin can change. Anything whose name looks like a key, token, secret or
password is refused.

The one exception is the staging site described above: when SiteSelf builds
one, it receives your database tables — which hold your content and whatever
personal data of your users your site stores, such as accounts and orders —
and your site's code, excluding uploads, `wp-config.php` and the files listed
there. Apart from that copy, this plugin sends no content, visitor data,
analytics or personal data of your users. Backups the plugin makes stay on your
server.

Service terms: https://siteself.com/terms
Privacy policy: https://siteself.com/privacy

== Frequently Asked Questions ==

= Can I see what the agent has done? =

Yes. Tools → SiteSelf lists every action with a timestamp.

= How do I stop it? =

Select Disconnect under Tools → SiteSelf, or deactivate the plugin. Either
tells SiteSelf, removes the application password the plugin created, and
takes effect immediately.

= Does it work without the SiteSelf service? =

No. This plugin is the site-side half of a service at https://siteself.com.

= Where are backups kept? =

On your own server, never anywhere else: in WP Engine's private folder on WP
Engine, and otherwise in a `siteself-backups` folder in your hosting account's
home folder or beside the WordPress folder, when that is outside what your site
serves. To choose another, define `SITESELF_BACKUP_DIR` in `wp-config.php`. A
backup is hidden until it is complete and has been read back. The newest five
are kept; older ones, and any left unfinished for two days, are removed, each
with a line in the log, and nothing else there is touched. Removing the plugin
leaves them in place.

If your site keeps its themes or plugins outside WordPress's own `wp-content`
folder, the plugin backs up the database only: a backup of those files could
not be put back where they are.

= Can it edit files if my host has locked them down? =

No, and that is deliberate. It asks WordPress the same question WordPress asks
before showing you its own file editors. If your host or your `wp-config.php`
has switched file changes off, this plugin is refused too, and your agent will
tell you which setting stopped it.

== Changelog ==

= 0.8.2 =
* Sites connected to SiteSelf before 0.7.0 now show as connected.
* Disconnecting also sends this site's addresses, so a staging copy of your
  site is not taken for the live one.
* Read-only files are left unchanged, and `.phtml` and `.inc` files are checked
  for PHP errors too.
* Other small fixes.

= 0.8.1 =
* A file is saved in one step, so it is never left half-written.
* If a PHP change causes a fatal error on your home page, the previous version
  is put back.
* Credential files, such as `.env` files and private keys, are not read.

= 0.8.0 =
* When SiteSelf builds a staging site from yours — a private working copy
  where a change is tried before it reaches your live site — the plugin sends
  it your database and your site's code in small, checksummed pieces, when
  SiteSelf's own systems ask; never your uploads, `wp-config.php` or a file
  that holds a credential. See "Staging sites" above.
* Your agent can make a backup on your own server before it changes your live
  site, covering the database tables and theme or plugin files the change
  touches. Backups stay on your server, in a private folder, and are never
  sent anywhere; the newest five are kept.
* Your agent can change two settings through the plugin: whether search
  engines may index your site, and the separator Yoast SEO puts in page titles.
  Each change reads the setting first, is written the way WordPress's own
  screens write it, and is read back. Every change and every refusal is in the
  log under Tools → SiteSelf.
* The plugin can measure your site — the sizes of your database tables and
  folders, free disk space and your server's PHP limits — so SiteSelf knows
  what a copy or a backup takes before it starts one.

= 0.7.2 =
* No change for your site. The status the plugin reports to SiteSelf no longer
  includes a setting that always read "no", whatever your server has. It was
  about how that one request ran, not about your server, and it was misread.

= 0.7.1 =
* No change for your site. Tools → SiteSelf now takes the SiteSelf address it
  names, and the link where you paste your key, from the one address this copy
  of the plugin connects to, rather than writing them out separately. A copy
  that SiteSelf's team points at its test service now sends its key there too.

= 0.7.0 =
* Connecting your site is now one button. Press **Connect this site** and the
  plugin creates an application password for SiteSelf, sends it to SiteSelf
  with your site's address, and shows you a connect key. Paste that key at
  siteself.com and your site is connected. You no longer type your site's
  address anywhere.
* Getting a new key does not create a new application password.
* Activating the plugin opens its screen, Tools → SiteSelf, once. Bulk
  activation is left alone.
* The screen is shorter: three steps to connect, with what Connect sends one
  click away.
* Disconnect and Deactivate are separate. A connected site shows Disconnect,
  which asks you to confirm and keeps the plugin active so you can connect
  again. A site that is not connected shows Deactivate.
* Disconnecting keeps this site's SiteSelf identity, so connecting again is
  recognised as the same site.
* A connected site says so at the top of Tools → SiteSelf, in green.
* Disconnect and deactivation now tell SiteSelf, so the site shows as
  disconnected there too, and remove the application password the plugin
  created. Updating the plugin does not disconnect it.
* A connect key now works for a year, until it is pasted or replaced by Get a
  new key.

= 0.6.1 =
* No change to the plugin. A link in the repository's own README pointed at a
  file that moved, and the version moves with any change inside the plugin
  folder.

= 0.6.0 =
* Closed a hole in the file rails. A file that was a shortcut to somewhere else
  (a symlink) could be written through, which meant a write inside your themes
  folder could change a file outside it. Those are now refused. If you have
  deliberately symlinked a theme or plugin file, your agent will now say it
  cannot write to it rather than quietly changing the file at the other end.
* File editing now uses exactly the permissions WordPress uses for its own
  editors. **On a multisite network this is a real change**: only a network
  administrator can edit theme and plugin files now, because those folders are
  shared by every site on the network. A single-site administrator is
  unaffected. Sites whose host switches file changes off through a filter
  rather than a constant are now correctly refused as well.
* Tools → SiteSelf and your SiteSelf dashboard now report whether writes are
  actually permitted, rather than only whether the two `wp-config.php`
  constants are set. The two can disagree, and it was the second one that was
  being shown.

= 0.5.0 =
* Updates now come from WordPress.org, like every other plugin on your site.
  Earlier versions fetched their own updates from siteself.com because this
  plugin was not in the directory yet. Nothing changes on your Plugins screen —
  the update button is in the same place and works the same way.
* This is the last update that arrives from siteself.com. After it, your site
  checks WordPress.org.

= 0.4.0 =
* Your site can now tell SiteSelf who it is, so moving to a new domain no longer
  looks like a different site. The plugin creates a key the first time SiteSelf
  asks about your site, and keeps it here. The private half never leaves your
  server — not to SiteSelf, not in any request.
* Nothing else changes, and there is nothing to set up. If you move your site,
  restore a backup, or your host makes a staging copy, SiteSelf can tell which
  one is which instead of guessing from the address.
* Removing the plugin leaves the key in place, so reinstalling brings your site
  back as the same site. Disconnect, under Tools → SiteSelf, is what removes it.

= 0.3.0 =
* Updates now arrive on your own Plugins screen. Earlier versions had no way to
  tell WordPress where newer copies live, so updating meant deleting the plugin
  and uploading a zip by hand. It is now an ordinary one-click update, and can
  be turned on for automatic updates like any other plugin.

= 0.2.0 =
* Renamed from "Refact Agent Connector" to "SiteSelf Connector", including the
  plugin folder and the REST namespace. WordPress treats a renamed plugin as a
  different one, so this version had to be installed by hand alongside removing
  the old one — the change in 0.3.0 exists so that never happens again.

= 0.1.0 =
* First release: status, file read/write with backups, allowlisted settings
  reads, cache flush, and the activity log.
