== Changelog ==
= 3.6.1 =
* MCP: Added standard read-only, destructive, idempotent and open-world annotations to discovered tools, with reviewed classifications for built-in tools and integrations. WordPress Abilities use their declared metadata; unknown or invalid classifications default conservatively. Authorization and capability checks are unchanged.
* Media: `wp_upload_image` now accepts ChatGPT conversation image attachments directly through `openai/fileParams`, while preserving the existing base64 input.
* Media: Added `wp_upload_media` for ChatGPT attachments, HTTPS URLs and base64, with WordPress MIME validation, bounded image resizing/conversion/compression, structured results and rollback support. New installations and upgrades do not enable this tool automatically.

= 3.6.0 =
* Identity: Recent MCP versions include the configured site URL, description and a domain/path display title without renaming the server or tools; older identity formats are preserved.
* Fix: Plugin-setting reads preserve empty strings and null values in sensitive fields while continuing to hide configured secrets and sensitive containers.
* MCP: Added 2026-07-28 stateless discovery, request metadata/header validation, result types, private cache hints and protocol-specific HTTP errors while retaining legacy 2025 clients and SSE.
* Tasks: Added the negotiated Tasks extension adapter with flat task handles, result polling, cancellation and owner isolation over the existing media worker.
* OAuth: Added RFC 9207 issuer responses, REST discovery alternatives, public-PKCE CIMD, optional approval for new clients and an Authorization-header diagnostic.
* Security: Added identity-aware rate limits with Retry-After, explicit trusted-proxy handling, and removal of Authorization fragments from authentication logs.
* Safety: Added dry-run previews and optimistic state checks for option/settings updates, plus public HTML verification after edits.
* Profiles: Added the optional Compact Site editorial profile without changing existing active profiles or enabling the new tool on upgrades.
* Diagnostics: Added opt-in, bounded local protocol statistics with 30-day retention and manual deletion.
* Developer: Added isolated PHP regressions and validation of emitted responses against official MCP and Tasks JSON schemas. Live WordPress/client interoperability remains a deployment check.

= 3.5.4 =
* Branding: Renamed the user-facing plugin name from StifLi Flex MCP to Flex MCP across WordPress metadata, admin screens, MCP server identity, messages, and documentation; technical slugs and integration identifiers remain unchanged.
* Fix: MCP Server, Multimedia, SEO, Plugin Integrations, Logs, Automation Tasks, and Event Automations admin assets now load reliably with the current Flex MCP page hooks, preserve compatibility with legacy hooks, invalidate stale browser caches with the plugin version, preserve native WordPress table layout for tool rows, and keep legacy OAuth tab links fully styled and interactive.
* MCP: The `2025-11-25` initialize response now advertises the WordPress Site Icon through the protocol-standard `serverInfo.icons` structure and reports the plugin version on both direct and SSE transports; older negotiated protocol versions remain unchanged.
* MCP: Unknown methods now return the standard JSON-RPC `-32601` code consistently across direct and legacy SSE flows, including task methods, preventing strict clients from treating probes as reconnect failures.
* OAuth: Discovery now accepts RFC path-scoped metadata URLs for the MCP `sse` and `messages` resources, including WordPress installations hosted in subdirectories.
* Compatibility: `mcp_ping`, `wp_get_posts`, and `wp_get_post` now advertise `outputSchema` and return matching `structuredContent` while preserving their legacy text output.
* WooCommerce: Product and variation reads now include additive ISO 8601 lifecycle and sale-window dates plus stable catalog, tax, stock, and purchasing fields; subscription details are included only when supported by the product runtime.
* WooCommerce: Coupon reads now include ISO 8601 dates and non-personal usage, amount, product, and category restrictions, while order reads expose additive ISO 8601 lifecycle aliases without removing existing date fields.
* New: Added `cf7_list_forms` and `cf7_get_form` for Contact Form 7 form discovery and normalized field schemas.
* New: Added optional `flamingo_get_submissions` sensitive reads with strict result caps and redaction of email, phone, IP, and secret fields; the tool is hidden when Flamingo storage is unavailable.
* Reliability: Failed database schema upgrades now pause automatic retries for 24 hours to prevent repeated queries and log flooding on incompatible hosts; plugin reactivation clears the cooldown for an immediate retry.
* Developer: Added 3.5.4 upgrade seeding and separate Contact Form 7 and Flamingo integration catalog entries.

= 3.5.2 =
* Reliability: Post meta, Yoast, Rank Math, ACF, and featured-image mutations now complete through the standard WordPress post-update lifecycle after effective metadata changes, refreshing modification dates, caches, and save listeners.
* New: Added `yoast_get_schema` for resolved Yoast JSON-LD and enriched `yoast_get_meta` with stored/resolved values, social fallbacks, robots data, and explicit SEO/readability analysis status.
* New: Added `wpforms_get_form` and `wpforms_get_entry`; WPForms reads now normalize choices and timestamps, redact sensitive keys, paginate deterministically, and fail cleanly when entry storage is unavailable in WPForms Lite.
* Improvement: `wp_set_featured_image` now accepts optional attachment alt text, handles unchanged requests idempotently, and post reads expose non-breaking `featured_media_id` and `featured_media_url` aliases.
* Improvement: `divi_validate_layout` accepts `raw_content` and can validate shortcode structure without Divi Builder or a Divi theme being active.
* Improvement: The Help tab now reports the live enabled-tool count, prioritizes OAuth 2.1, includes current WAF/schema troubleshooting, and provides copy-safe diagnostics without credentials or request payloads.
* Developer: Added `scripts/audit-tool-schemas.ps1` to validate live `tools/list` schemas, including active WooCommerce and optional integration tools, for strict MCP clients.

= 3.5.1 =
* New: Added undo-aware `divi_clone_page`, `divi_replace_image`, and `divi_apply_library_template` tools, preserving Divi content and `_et_*` metadata for Divi 4 and alternate Divi 5 storage.
* New: Added `elementor_apply_template_to_page` with replace and append modes, including support for ordinary pages that do not yet contain Elementor data.
* New: Added single and bulk Elementor render repair tools that validate and re-save existing builder data, restore required metadata, searchable fallback content, and caches without inventing missing layouts.
* New: Added undoable `wp_update_permalink_structure` with native token validation, exact write verification, `%XX` preservation, and rewrite-rule refresh on update, rollback, and redo.
* Improvement: `elementor_replace_text` now supports an expected-count guard, nested image alt/title/caption replacement, and optional synchronization to editable Media Library attachments.
* Improvement: Elementor clones now populate `post_content` with a safe textual fallback extracted from builder widgets so WordPress core search can find cloned content.
* Improvement: URL write sanitization now detects input mangling before Elementor or Divi changes and preserves percent-encoded and templated URL segments.
* Fix: Tool schema normalization now supplies a valid `items` schema for every array and normalizes schema-valued `additionalProperties` for strict MCP clients.
* Security: MCP debug logs now redact sensitive arguments and decoded payloads and no longer store raw request bodies.
* Developer: Added `stifli_flex_mcp_oauth_metadata_url` to override OAuth and OpenID metadata probe URLs on hosts that intercept `/.well-known/` routes.

= 3.5.0 =
* New: Added optional Divi integration with six MCP tools for page format inspection, layout outlines, shortcode validation, local template discovery, Divi Library retrieval, and structure-safe text replacement with dry-run support.
* New: Added `wp_publish_and_promote` to publish draft, pending, or scheduled content and add it to a navigation menu in one undoable workflow.
* New: Added `wp_create_menu` and extended `wp_create_nav_menu` with optional theme-location assignment.
* New: Added `wp_create_preview_link` for expiring, cryptographically protected public previews of non-public content, with no-cache and noindex headers.
* Improvement: Post revision results now include Unicode-aware content length for safer revision selection and restoration workflows.
* Improvement: Elementor and Divi text replacement tools now warn when replacement text contains literal escape sequences, helping prevent accidental escaped markup or formatting.
* Improvement: OAuth diagnostics now identify Sucuri/CloudProxy blocks, provide provider-specific guidance, offer a nonce-protected Re-check now action, and retry blocked checks sooner.
* Improvement: Added upgrade seeding, profile registration, optional integration discovery, and complete undo/redo tracking for the new editorial and Divi tools.

= 3.4.9 =
* New: Added `wc_get_order` for detailed retrieval of one WooCommerce order, including customer addresses, line items, fee lines, shipping lines, totals, customer note, and raw payment method ID.
* Improvement: Added `wc_get_order` to WooCommerce Read Only, WooCommerce Store Management, Complete E-commerce, and Safe Mode profiles, with an upgrade migration for existing installations.
* Improvement: `wc_update_order` and `wc_update_product` now reload and return the actual persisted object after saving, improving write verification.
* Fix: `elementor_replace_text` case-insensitive matching now supports Unicode text, including accented characters.

= 3.4.8 =
* Fix: Restored legacy SSE response delivery so Claude Desktop connectors receive `initialize` and other JSON-RPC responses through their active SSE session.

= 3.4.7 =
* Fix: Restored the Continue to MCP Server action on the first-activation layer selection screen for new installations.

= 3.4.6 =
* Security: Strengthened MCP access controls for sensitive read operations.

= 3.4.5 =
* New: Added WP MCP Hub links and a free, open-source multi-site management message to the plugin documentation.
* New: Added a dismissible WP MCP Hub notice and a persistent footer message across Flex MCP admin pages.

= 3.4.4 =
* New: Added `elementor_update_widget` to update Elementor widget settings by `element_id` with undo compatibility.
* New: Added `elementor_export_template` to export Elementor template/page data as JSON for portability workflows.
* New: Added `wc_bulk_assign_product_categories` and `wc_bulk_delete_products` for WooCommerce bulk product operations.
* Improvement: Expanded `wc_batch_update_products` to support `create`, `update`, and `delete` operations (plus legacy `updates` compatibility).
* Improvement: Added compatibility aliases for automation scripts (`wc_batch_update_products.update[].id` as alias of `product_id`, and `elementor_export_template.post_id` as alias of `template_id`).
* Improvement: Expanded `mcp_ping` with `connection_context` and `builder_versions` to improve connector diagnostics.
* Improvement: `mcp_ping.connection_context.session_id` now falls back to the active ChangeTracker session when transport context is empty, improving `mcp_rollback_session` operability.
* Improvement: Added `session_id` filter to `mcp_get_changelog` schema and runtime filtering, so rollback targets can be discovered from tool outputs.
* Improvement: Added enriched `sflmcp_tool_context` hook payload while preserving legacy hook compatibility.
* Improvement: Hardened `wp_update_post` and `wp_update_page` responses with requested-vs-saved checks, including dropped-field reporting.
* Improvement: Added `.mcpb` one-click bundle download flow from OAuth settings to simplify Claude Desktop connector setup.
* Improvement: Added `README.md` optimized for GitHub rendering, including linked video thumbnail preview.

= 3.4.3 =
* Fix: WordPress 6.9+ Abilities compatibility for schema-less abilities. When no arguments are provided and the ability has no effective input schema, MCP now calls `execute(null)` instead of `execute([])`.
* Fix: Plugin Integrations tab CSS now uses the same base visual style as the Tools tabs, restoring card/table layout consistency in `admin.php?page=sflmcp-server&tab=plugins`.

= 3.4.2 =
* New: Added `wp_get_cron_schedule` to inspect scheduled WP-Cron events with next-run timestamps, overdue status, and optional hook filtering.
* New: Added `wp_get_error_log_tail` to read recent lines from `wp_debug` or plugin logs with optional keyword filtering.
* Improvement: Added proactive OAuth notices for Plain permalink mode and stale static `.well-known` metadata files that can break connector discovery.

= 3.4.1 =
* Improvement: Enhanced post and page management tools.
* Improvement: Improved search results and WooCommerce order listings.
* Improvement: Improved WordPress taxonomy and post metadata tools.
* Improvement: Added integration refinements for MCP tool execution.

= 3.4.0 =
* New: Added modular installation with a first-activation selector for AI Chat Agent, AI Copilot, Automations, SEO, and Plugin Integrations.
* Improvement: New installations load only MCP Server by default, including Multimedia and Logs & Roll Back; disabled addons no longer register their PHP classes, menus, hooks, cron workers, or automation tables.
* Improvement: Added an Add-ons tab under MCP Server settings so administrators can change layers at any time while preserving all modules on existing installations until explicitly changed.

= 3.3.13 =
* Security: Retired legacy Custom Tools runtime execution to prevent lower-privileged users from invoking administrator-defined custom workflows through tool execution endpoints.
* Security: Existing legacy Custom Tools are disabled automatically during upgrade, and `custom_*` tool calls now return a deprecation error instead of dispatching HTTP requests or WordPress action hooks.
* Improvement: Removed Custom Tools from MCP tool discovery and admin surfaces. Use WordPress Abilities for custom MCP extensions with explicit permission callbacks.

= 3.3.12 =
* Security: Hardened `elementor_add_widget` raw settings path by requiring `unfiltered_html` before accepting caller-supplied raw `settings`.
* Security: Tightened non-curated widget validation to fail closed when Elementor widget registry is unavailable, preventing permissive fallback acceptance.
* Improvement: Updated tool schema/docs to explicitly state the raw settings capability requirement.

= 3.3.11 =
* New: Added `elementor_add_widget`, a structural Elementor write tool for inserting widgets or containers into existing Elementor pages.
* Improvement: Supports raw Elementor settings for registered widget slugs and curated flat parameters for container, heading, text-editor, button, image, image-box, icon-box, icon-list, video, divider, and spacer widgets.
* Security: Validates `edit_post` on the target page, validates parent containers/sections/columns when `parent_id` is supplied, and rejects unknown non-curated widget types unless Elementor's registry is unavailable.

= 3.3.10 =
* Security: Added object-level `edit_post` and `delete_post` checks to post, page, and media MCP tools before mutating or deleting specific content.
* Improvement: Single-object post, media, post meta, and SEO tools now accept common ID aliases (`ID`, `id`, `post_id`, and `attachment_id` where relevant) for better MCP client compatibility.
* Improvement: Post, page, media, and term update tools now preserve existing text fields when optional text arguments are sent as empty strings.
* Improvement: Rank Math and Yoast SEO tools now read and update the WordPress slug, returning the slug actually saved by WordPress.
* Cleanup: Expanded uninstall cleanup to remove OAuth, automation, event, ability, changelog, and dynamic plugin options across single-site and multisite installs.

= 3.3.9 =
* Security: Added explicit WordPress capability enforcement for sensitive WooCommerce read tools, including orders, order notes, refunds, reports, taxes, shipping, payment gateways, system status, settings, webhooks, and coupons.
* Improvement: Enriched ACF MCP responses with field group metadata, field definitions, labels, types, return formats, nested sub-fields, structuredContent, and normalized object values for posts, users, terms, dates, and plugin objects.

= 3.3.8 =
* New: Added `wp_css_get_global` tool to read active theme Additional CSS (Customizer) with hash and optional metadata/statistics output.
* New: Added `wp_css_set_global` and `wp_css_set_scoped` tools to manage global and scoped CSS with validation, optimistic concurrency (`expected_hash`), and dry-run mode (`validate_only`).
* Improvement: Integrated `wp_css_set_global` and `wp_css_set_scoped` with ChangeTracker so they appear in Logs (`sflmcp-logs`) with rollback/redo support.

= 3.3.7 =
* New: Added optional `wp_search_image` module (`class-search-image.php`) with lazy loading from the model only when enabled in `sflmcp_tools`, protected by `upload_files` capability.
* New: `wp_search_image` now returns MCP-friendly output in both text JSON and `structuredContent`, including URL, thumbnail URL, caption, alt text, author, author URL, source URL, dimensions, license/metadata, and provider-specific fields such as Unsplash `download_location`.
* New: Added a dedicated **Search Image** tab in Multimedia Settings with tool toggle, provider toggles + API keys (Unsplash/Pexels/Pixabay), preferred bank, image selection mode (`most_relevant`, `random_top10`, `random_top20`), and extra search parameters (orientation, safe search, language/locale, timeout).

= 3.3.6 =
* New: Added SEO optimization tools for GSC-backed post context, title/meta suggestions, and safe Yoast/Rank Math metadata updates with rollback support.
* New: Added MCP resources for site info, post types, recent posts, and SEO summary through resources/list and resources/read.
* Improvement: SEO and Google Search Console modules now load lazily only when enabled, connected, or opened in the SEO admin page.

= 3.3.5 =
* New: Added Google Search Console support under a new SEO admin page, with Google OAuth connection, encrypted tokens, connection testing, cache controls, tool toggles, and 5 read-only SEO data tools.
* Improvement: Google Search Console performance queries now return compact summaries with capped row output to prevent excessive MCP token usage.
* New: Added Elementor compatibility as a plugin integration with 7 dedicated tools for cloning pages, replacing text/images/links, reading page outlines, listing local templates, and importing templates.
* Improvement: Various reliability and compatibility improvements across WordPress content handling, WooCommerce order tools, OAuth discovery, and plugin integrations.

= 3.3.4 =
* Improvement: Various improvements and content updates in the plugin documentation and onboarding resources.

= 3.3.3 =
* Improvement: Upgraded the Abilities admin table with sortable columns, row selection, and bulk actions (enable, disable, remove).
* Improvement: Upgraded Discover Abilities with category filtering and bulk import actions for selected or visible abilities.
* Improvement: Added a dedicated bulk abilities backend action and reused shared import/category normalization logic.
* Fix: Moved the OAuth global reset action to the visible Connected Clients area in MCP Server Settings and removed duplicate placement.
* Fix: Hardened `wp_update_nav_menu_item` updates with a safer merge flow that preserves existing values unless explicitly changed.

= 3.3.2 =
* Fixed: `wp_create_post` and `wp_update_post` now correctly apply `post_category` and `tax_input` (including `post_tag`) when creating or updating posts.

= 3.3.1 =
* Improvement: Enhanced "Alternative: Application Passwords" with in-page generation from MCP Server Settings (no navigation to profile required).

= 3.3.0 =
* New: Compatibility with The Events Calendar plugin, including integrated event tools for listing, reading, creating/updating, and trashing events and related entities.

= 3.2.9 =
* Improvement: Updated image generation model catalog in Multimedia Settings. Added new OpenAI and Gemini image models while keeping previous models available for user selection.
* Improvement: Set default image models to cost-effective options (`gpt-image-1` and `gemini-2.5-flash-image`) and refreshed pricing guidance in the UI.
* New tools: `wc_get_variation`, `wc_batch_update_variations`, `wc_get_product_attributes`, `wc_get_attribute_terms`, `wc_create_product_attribute`, `wc_set_product_attributes`, `wc_get_coupon`, `wc_get_coupon_count`, `wc_empty_coupon_trash`.
* Tool improvements: `wp_get_taxonomies` (slug/name/label output), `wp_get_term_meta` (structured payload with secret redaction), `wc_get_product_variations` (normalized variation rows), `wc_update_product_variation` (ownership validation), `wc_delete_product_variation` (ownership validation), `wc_get_coupons` (status filtering, including trash), `wc_delete_coupon` (clear trash vs permanent outcome), `wc_get_coupon_count` (status-based counting, including trash).

= 3.2.8 =
* Improvement: Official compatibility update for WordPress 7.0 with WordPress AI Client integration in AI Chat Agent.
* Improvement: Improved compatibility with external AI Client connectors such as OpenRouter and Mistral (plus any installed AI Client provider).

= 3.2.7 =
* Improvement: Updated MCP protocol reference and compatibility to the 2025-11-25 specification.
* Improvement: Improved `wp_generate_image` reliability with async task handling plus safer media persistence/post-processing.
* Improvement: Improved `wp_generate_video` reliability with async task handling, atomic file save, and background metadata processing.

= 3.2.6 =
* New: Expanded `mcp_ping` with optional diagnostics (`diagnostics`, `timeout_sec`) to surface site URL, REST endpoint, HTTPS state, DNS resolution, and lightweight reachability checks without forcing remote calls by default.
* New: Upgraded `wp_get_posts`, `wp_get_post`, `wp_get_comments`, `wp_get_users`, `search`, `wc_get_products`, and `wc_get_orders` with richer optional outputs and standardized `include_pagination` metadata wrappers.
* New: Added opt-in enrichment flags for common read tools, including author, featured media, taxonomy context, avatar/registration data, product images/categories/attributes, and order item or totals summaries.
* New: Improved `search` and `fetch` with broader filters, query-param support, custom request/response headers, and targeted remote inspection controls (`head_only`, `include_headers`, `extract_text`, `max_bytes`, `timeout_sec`).

= 3.2.5 =
* New: The AI Chat Agent token usage panel now shows three separate bars for billable input tokens, cached tokens, and output tokens.
* Improvement: Normalized token accounting across OpenAI, Claude, and Gemini providers so the three bars reflect provider-specific cache semantics more truthfully.
* New: Upgraded `wp_get_site_health` into a richer site audit tool with selectable depth levels (`0` basic, `1` medium, `2` deep) to balance diagnostic detail and timeout risk.

= 3.2.4 =
* New: Added `wp_get_plugin_settings` to inspect plugin-related `wp_options` by `plugin_slug`/prefixes with prepared SQL + limit controls and strict recursive redaction of secrets/tokens/passwords.
* New: Generalized term tools - added `wp_update_term` and extended `wp_create_term`/`wp_delete_term` with optional slug/parent/description plus per-taxonomy capability checks (existing `wp_*_category` and `wp_*_tag` tools kept as aliases).

= 3.2.3 =
* New: Generalized term tools — added `wp_update_term` and extended `wp_create_term`/`wp_delete_term` with optional slug/parent/description plus per-taxonomy capability checks (existing `wp_*_category` and `wp_*_tag` tools kept as aliases).
* New: Term meta tools `wp_get_term_meta` (with secret redaction), `wp_update_term_meta`, `wp_delete_term_meta`.
* New: `wp_reorder_menu_items` tool to batch-update `menu_order`/`parent` for navigation menu items in one call (with one-click rollback).
* Security: `wp_create_post`/`wp_update_post` now validate `post_type` exists and is public/show_ui, enforce post-type-aware capabilities, and require `edit_others_posts` cap when assigning a different `post_author`.
* Infrastructure: New DB migration seeds the new tools into existing installs and attaches them to the "WordPress Full Management" profile.

= 3.2.2 =
* Security: Added centralized recursive secret redaction for MCP outputs.
* Security: Applied redaction to sensitive reads (`wp_get_option`, `wp_get_settings`, `wp_get_post_meta`, `wp_get_user_meta`) and masked email/IP fields in `wp_get_comments`.
* Security: Hardened `wp_update_option` and `wp_update_settings` with hard denylist, sensitive-pattern blocking, and optional allowlist via `sflmcp_writable_options`.
* Security: Removed `wp_delete_option` tool (destructive operation without reliable undo), including migration cleanup for existing installs.
* Security: Hardened `wp_upload_image_from_url` with SSRF protection (private/reserved IP blocking), HTTPS requirement, 20MB limit (filterable), MIME allowlist, and image validation.
* New: Added `wp_set_featured_image` tool and support for `featured_media` in `wp_create_post` and `wp_update_post`.
* OAuth: Dynamic client registration now returns HTTP 500 on DB insert failures, logs internal DB errors, and avoids exposing SQL internals.
* Infrastructure: Added `sflmcp_db_version` upgrade flow for versioned DB migrations.

= 3.2.1 =
* fix bug

= 3.2.0 =
* **🗂️ Tools UI overhaul** — Tools are now organized into collapsible category groups with expand/collapse controls, read/write mode badges, and token count per category for easier management
* **🧩 New "Plugins" tab** — Dedicated integrations hub with 12 pre-loaded plugin integrations ready to connect:
  * **All Sources Images** — Find stock images and generate AI images; set featured or inline images in posts *(Recommended)*
  * **AiPatch Security Scanner** — AI-powered security auditing and vulnerability scanning *(Recommended)*
  * **Notification for Telegram** — Send Telegram notifications from MCP tools
  * **WPCode** — Manage code snippets (insert headers/footers) via AI
  * **Code Snippets** — Create, activate, and manage PHP/CSS/JS snippets via AI
  * **Woody Snippets** — Alternative snippet provider with full snippet_* tool support
  * **Advanced Custom Fields (ACF)** — Read and update ACF fields and field groups
  * **Yoast SEO** — Read and update Yoast metadata; trigger reindexing
  * **Rank Math** — Manage Rank Math SEO metadata and head output
  * **WPForms** — List forms and read form entries
  * **Gravity Forms** — List forms, read entries, and update submissions
  * **Forminator** — List forms and read form entries


= 3.1.5 =
* Fixed: OAuth re-authorization crash when reconnecting previously authorized clients (ChatGPT, Claude Desktop) 


= 3.1.4 =
* **🌐 WebMCP — Browser AI (Beta)** — Use Chrome's built-in Gemini Nano to edit posts directly, no API key needed!
* Note: Beta feature — Gemini Nano is a compact on-device model with limited reasoning; works best for simple editing tasks

= 3.1.3 =
* Fixed: Minor bug fixes and stability improvements


= 3.1.2 =
* **⏪ Roll Back — Undo Any AI Change Instantly!**
* New: Full change tracking — every modification by ChatGPT, Claude, AI Chat Agent, Copilot, or automations is recorded
* New: One-click rollback — undo any change from the Logs & Roll Back admin page
* New: Redo support — re-apply a rolled-back change if you change your mind
* New: Session rollback — undo all changes from an entire AI conversation at once (LIFO order)
* New: Before/after snapshots — see exactly what changed with full state comparison
* New: Source tracking — every change shows where it came from (MCP Connection, Chat Agent, Copilot, Automation, Event, WP Admin)
* New: 5 MCP tools — `mcp_get_changelog`, `mcp_get_change_detail`, `mcp_rollback_change`, `mcp_redo_change`, `mcp_rollback_session`
* New: Changelog admin page with filters, search, detail modal, CSV export, and automatic purge
* New: Works across 60+ mutating tools — posts, pages, products, orders, options, menus, media, snippets, and more
* New: File backup & restore — even deleted media files can be recovered
* Improved: The only MCP server for WordPress with built-in undo capabilities

= 3.1.1 =
* Compatibility: Tested with WordPress 7.0 RC

= 3.1.0 =
* **🔐 OAuth 2.1 Authentication** — Connect ChatGPT, Claude Desktop, and any MCP client with one click!
* New: Full OAuth 2.1 implementation with PKCE (S256) — the most secure authentication standard
* New: Dynamic Client Registration (RFC 7591) — AI clients register automatically, zero manual setup
* New: Auto-discovery via RFC 9728 (Protected Resource Metadata) and RFC 8414 (Authorization Server Metadata)
* New: Automatic token refresh — sessions stay active for up to 90 days without re-authorization
* New: Auto-approve for returning clients — authorize once, connect instantly on future sessions
* New: Simplified Settings page — just copy the URL and paste it in your AI client
* New: "View More Details" panel with connected clients, active tokens, and troubleshooting
* New: One-click client deletion and token revocation from the admin panel
* Improved: No more API keys or passwords needed for external AI clients
* Improved: Full compatibility with Claude Desktop Connectors and ChatGPT Apps & Connectors
* Improved: Standards-compliant OpenID Connect discovery fallback for maximum client compatibility
* Security: PKCE S256 challenge on every authorization flow
* Security: Short-lived authorization codes (10 min) with single-use enforcement
* Security: Access tokens expire in 24 hours, refresh tokens in 90 days
* Security: Application Passwords still supported as fallback for advanced setups

= 3.0.3 =
* Fixed: MCP Server connection with Claude Desktop and other SSE-based clients now works correctly
* Fixed: Scheduled automation tasks running more frequently than configured and producing intermittent errors

= 3.0.2 =
* **🧩 Code Snippets Management** — 7 new MCP tools for managing code snippets directly from AI agents!
* New: snippet_list, snippet_get, snippet_create, snippet_update, snippet_delete, snippet_activate, snippet_deactivate tools
* New: Multi-provider support — compatible with WPCode, Code Snippets (v2/v3), and Woody Code Snippets plugins
* New: Automatic provider detection — seamlessly works with whichever snippet plugin is installed
* New: LLM-friendly input normalization — maps common AI output variants for code_type, location, and scope parameters
* New: PHP code sanitization — automatically strips `<?php`, `?>` tags and markdown code fences from AI-generated code
* New: Code Snippets v3.x full namespace support — resolves namespaced functions and classes automatically
* New: Woody Code Snippets scope mapping — translates locations to Woody's dual scope/location system
* Security: Rate limiting (30 requests/minute per IP) on MCP endpoints to prevent abuse
* Security: SSRF protection on fetch tool — blocks requests to private/reserved IP ranges (127.x, 10.x, 172.16.x, 192.168.x)
* Improved: Snippet tools added to WordPress Full Management profile (auto-migrated for existing installs)

= 3.0.1 =
* **✍️ AI Copilot — New floating writing assistant for the WordPress editor!**
* New: AI Copilot widget available inside the Gutenberg and Classic editors
* New: Quick action chips — Optimize content, Generate tags, Write excerpt, Generate image
* New: Direct editing — the Copilot sets titles, excerpts, tags, categories, and slugs in the editor
* New: Block operations — insert, update, replace, and delete Gutenberg blocks through conversation
* New: Visual feedback — green highlight on changed fields and blocks with auto-dismiss
* New: Keep/Undo banner on every AI change for full user control
* New: Image generation workflow — generate an image and set it as featured or insert as block
* New: AI Copilot settings page with enable/disable toggle and tools mode selection
* New: Full context awareness — reads post content, blocks, metadata, and WooCommerce product fields


= 2.2.2 =
* **📊 Token Usage Bars** — Real-time speedometer-style token bars in the AI Chat Agent showing input, output, and cached tokens per interaction.

= 2.2.1 =
* **🤖 Updated AI Models for All Providers** — Refreshed the full model catalog across OpenAI, Anthropic (Claude), and Google Gemini.
* New: OpenAI GPT-5.4 series — GPT-5.4 Pro, GPT-5.4, GPT-5.4 Mini, GPT-5.4 Nano (1M context, Computer Use support)
* New: OpenAI GPT-5.3 and GPT-5.3 Mini added as stable production models
* New: Anthropic Claude Sonnet 4.6 and Claude Opus 4.6 (1M context, 128K output, Extended Thinking)
* New: Anthropic Claude Sonnet 4.5, Claude Opus 4.5, and Claude Haiku 4.5
* New: Google Gemini 3.1 Pro, Gemini 3 Flash, and Gemini 3.1 Flash-Lite (latest generation)
* Updated: Google Gemini 2.5 Pro, Flash, and Flash-Lite remain as stable production models
* Updated: Default models changed — GPT-5.4 (OpenAI), Claude Sonnet 4.6 (Claude), Gemini 3 Flash (Gemini)
* Removed: Deprecated models — GPT-5 Nano, Gemini 2.0 Flash/Flash-Lite, older Claude 3.x aliases

= 2.2.0 =
* **🆕 AI Image Generation** — Generate images directly from your AI agent using `wp_generate_image`!
* **🆕 AI Video Generation** — Generate videos with `wp_generate_video` using cutting-edge AI models!
* New: wp_generate_image tool with multi-provider support (OpenAI gpt-image-1, DALL·E 2/3, Google Gemini Imagen 4)
* New: wp_generate_video tool with multi-provider support (OpenAI Sora, Google Veo 2/3)
* New: Multimedia Settings admin page with dedicated Images and Videos tabs
* New: Post-processing options — auto-save generated media to Media Library, auto-insert into posts
* New: Configurable default providers, models, image sizes, and quality settings


= 2.1.0 =
* **🆕 Automation Tasks** — Schedule AI tasks to run automatically on a recurring basis!
* **🆕 Event Automations** — Trigger AI workflows when WordPress events occur (new post, new user, etc.)
* New: Automation Tasks admin with create, edit, duplicate, delete, and run-now functionality
* New: 4 schedule presets (hourly, daily, weekly, monthly) with custom time and timezone support
* New: Pre-built automation templates (Daily Sales Report, Trending Article, Weekly Summary, and more)
* New: "Detected Tools" mode — AI identifies required tools during test, saves tokens significantly
* New: Output actions — Email, Webhook, Draft Post, or Custom Hook
* New: Execution Logs tab with full history, token usage, and detailed results
* New: Event Automations with WordPress triggers (post published, user registered, comment posted)
* New: Conditional logic for event triggers (post type, status, category filters)
* New: Dynamic placeholders in prompts (`{{post.title}}`, `{{user.email}}`, etc.)
* New: Rate limiting per automation to prevent runaway executions
* New: Test mode for event automations — preview AI response with real trigger data
* New: Tools count display in AI Chat Agent header with quick configure link
* Improved: Cron tasks now execute with proper user permissions (task creator or admin fallback)
* Improved: Complete log entry format fixes for database consistency
* Improved: Database migration for automation logs table columns
* Technical: New tables `wp_sflmcp_automation_tasks`, `wp_sflmcp_automation_logs`, `wp_sflmcp_event_automations`, `wp_sflmcp_event_logs`, `wp_sflmcp_event_triggers`

= 2.0.3 =
* ** Encrypted API Keys** - API keys are now stored encrypted (AES-256-CBC) in the database for improved security
* ** Prompt Caching (Claude)** - Enabled Anthropic prompt caching on system prompt and tools, reducing token usage and latency on repeated requests
* ** Provider Usage Logging** - Real-time logging of input/output/cached tokens for Claude, OpenAI, and Gemini
* ** Rate Limit Awareness** - Captures and logs rate limit headers from all three providers for better diagnostics on 429 errors
* New: Conversation history trimming with configurable "Max Tool Cycles in History" setting to control payload size
* New: Smart trim algorithm with safe cut points — never orphans tool_result references
* New: API key visibility toggle (eye icon) in chat settings
* New: Token estimation utilities (`estimateTokensFromString`, `estimateTokensFromJson`)
* Improved: Auto-save on all chat settings (removed manual "Save Settings" button)
* Improved: Compact request logging — summaries instead of full body dumps, reducing log noise
* Improved: HTTP request layer now returns headers and status code alongside body (`make_request_with_meta`)
* Improved: JSON encoding with `JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE` for cleaner payloads

= 2.0.2 =
* **🆕 WordPress Abilities Integration** (WordPress 6.9+) - Auto-discover and import abilities from other plugins!
* New: Abilities tab in admin (appears only on WordPress 6.9+)
* New: Discover button to scan all registered abilities from themes/plugins
* New: Import, enable/disable, and delete individual abilities
* New: Abilities exposed as MCP tools (ability_* prefix) for AI agents
* New: Database table wp_sflmcp_abilities for persistent ability storage
* Improved: Plugin description updated to reflect 117+ tools
* Improved: Admin menu reordered — AI Chat Agent first, MCP Server second  
* Improved: Renamed "AI Chat" to "AI Chat Agent" across the UI
* Technical: Uses wp_get_abilities(), wp_get_ability(), $ability->execute() APIs

= 2.0.1 =
* **🆕 Built-in AI Chat Client** - Chat with AI directly from your WordPress admin panel!
* New: Multi-provider support - OpenAI, Claude (Anthropic), and Google Gemini
* New: Support for latest models including GPT-4.5, Claude 4 Opus/Sonnet, Gemini 2.5 Pro/Flash
* New: Smart suggestion chips that appear after AI responses
* New: Conversation history auto-saved per user (7-day retention)
* New: Stop button to cancel AI responses mid-generation
* New: Tool permission modes - "Always Allow" or "Ask User" for confirmations
* New: Advanced settings tab with temperature, max tokens, top_p, frequency/presence penalty
* New: Customizable system prompt for AI behavior
* New: Tool display options (Full details, Compact, or Hidden)
* New: Multilingual suggestions - AI responds in the same language you use
* Improved: Sequential tool execution for better reliability across all providers
* Improved: Claude 4.5 model compatibility (temperature/top_p handling)
* Improved: Gemini API message format conversion
* Fixed: Claude multiple tool_use error handling
* Fixed: Gemini "content" vs "parts" API format issue

= 1.0.5 =
* **New: Custom Tools** - Turn any WordPress plugin into an AI tool! Copy-paste examples included, no coding expertise required.
* New: Custom Tools management tab with code editor, enable/disable toggle, and built-in examples
* New: Pre-built Custom Tool examples (WooCommerce product lookup, CF7 forms, Yoast SEO, WP Super Cache)
* New: Custom Tools support input schemas for structured AI interactions
* Improved: All admin styles externalized for WordPress.org compliance
* Fix: Resolved object persistence issue in PHP 8.1+ causing 404 errors on API endpoints
* Fix: Deferred WooCommerce detection to ensure tools load correctly regardless of plugin load order
* Fix: WooCommerce module dispatch now correctly handles tool routing

= 1.0.4 =
* New: Debug logging system with dedicated log file (wp-content/uploads/sflmcp-logs/)
* New: Logs tab in admin UI to enable/disable logging and view debug logs
* New: Clear logs and refresh functionality from admin panel
* New: "WordPress Full Management" profile now active by default on fresh installs
* Security: Log directory protected with .htaccess and index.php

= 1.0.3 =
* Security: Replaced custom token authentication with WordPress Application Passwords
* Security: Removed wp_set_current_user calls for compliance with WordPress.org guidelines
* Removed: User management tools (wp_create_user, wp_update_user, wp_delete_user)
* Removed: Customer management tools (wc_get_customers, wc_create_customer, wc_update_customer, wc_delete_customer)
* Updated: Settings page now guides users to create Application Passwords
* Improved: Authentication uses native WordPress security features

= 1.0.0 =
* Initial public release
* 55 WordPress management tools (posts, pages, comments, media, taxonomies, options)
* 61 WooCommerce tools (products, orders, coupons, shipping, taxes, webhooks)
* Profile-based tool management with 8 predefined profiles
* WordPress Application Passwords authentication
* JSON-RPC 2.0 compliant REST API endpoint
* Server-Sent Events (SSE) support for real-time streaming
* Full internationalization support (i18n/l10n ready)
* Granular permission control per tool
* Profile import/export functionality
* Compatible with ChatGPT Custom Connectors, Claude Desktop, LibreChat
