=== Zaplane - AI Agent Automation & Workflow Builder ===
Contributors: kodezen, tusharimran
Tags: automation, workflow, webhook, ai agent, integration
Requires at least: 6.8
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.5.0
License: GPLv3 or later
License URI: https://www.gnu.org/licenses/gpl-3.0.html

No-code WordPress automation & AI agent workflow builder. 100+ integrations: WooCommerce, FluentCRM, Slack, Gmail, Google Sheets and more.

== Description ==

**Zaplane** is a no-code **WordPress automation** plugin and workflow builder that runs entirely inside your WordPress site. Connect a **trigger** (a WooCommerce order placed, a form submitted, a user registered, a subscription renewed, a webhook received) to one or more **actions** (send an email, add a contact to your CRM, post a Slack message, create a Trello card, call an API) with delays, conditions, filters, loops and AI steps in between.

Build **automation workflows** visually on a drag-and-drop canvas — no code required — and let them run reliably in the background on Action Scheduler, the same queue WooCommerce uses.

= Why Zaplane? =

* **No-code visual workflow builder** — design automations by connecting trigger and action nodes on a flow canvas.
* **Self-hosted — no per-task fees** — workflows, run history and credentials stay in your own WordPress database. No external automation service to pay per task or per workflow. Data reaches a third-party only when a workflow or connection you set up uses it (see External services).
* **100+ integrations** — WooCommerce, Easy Digital Downloads, FluentCRM, Mailchimp, Slack, Discord, Telegram, WhatsApp, Gmail, Google Sheets, Zoom, LearnDash, Tutor LMS, Elementor, Fluent Forms, Gravity Forms, WPForms, Contact Form 7 and many more (full list below).
* **Flow control steps** — Delay, Condition, Filter, Router (multi-branch), Iterator (loop), Set Variable, HTTP Request, Send/Catch Webhook, Human Approval, Schedule, Manual trigger, Sticky Note.
* **Reliable background processing** — long-running and scheduled steps run on Action Scheduler.
* **Ready-made recipes** — templates for abandoned carts, birthday messages, win-backs, upsells, review requests, order confirmations, lead nurturing and more.
* **Optional AI automation** — write replies, run a tool-calling AI Agent, generate images, or search your own knowledge base, through the WordPress AI Client (when available in core) or your own OpenAI, Anthropic or Gemini key.
* **AI access through the WordPress Abilities API** — Zaplane registers its workflow capabilities as abilities. Install an MCP adapter and an AI client you approve can discover, build and run workflows. Zaplane runs no server of its own, and every ability requires an administrator.
* **Build your own integrations** — Custom Apps let you add any REST API or WordPress hook as a trigger or action without writing a plugin.
* **GPL-3.0, 100% free, no premium upsell** — every integration, trigger, action and recipe is in this plugin.

= What you can automate =

* **WooCommerce automation** — welcome new customers, recover abandoned carts, follow up on orders, tag high-value buyers in your CRM, notify Slack when a product goes out of stock, send a review request after delivery, trigger subscription renewal reminders.
* **CRM & marketing automation** — add form submissions to FluentCRM / Mailchimp / Brevo / ActiveCampaign / Groundhogg / GemCRM, apply or remove tags, enrol contacts in sequences, sync between CRMs, send birthday emails.
* **Form automation** — route Fluent Forms, Gravity Forms, WPForms, Contact Form 7, Formidable, Ninja Forms, Fillout, Typeform or Jotform submissions to any destination; create tickets, cards, deals, posts, users or orders from a form.
* **LMS automation** — enrol learners on LearnDash, Tutor LMS, LifterLMS, MasterStudy or Academy courses, grant membership on purchase, email instructors on course completion, award points, print certificates.
* **Membership automation** — provision access on MemberPress, Paid Memberships Pro, SureMembers, BuddyBoss or Ultimate Member when a payment succeeds; downgrade on cancellation; sync membership status to a CRM.
* **Messaging automation** — post to Slack, Discord, Telegram or Microsoft Teams-style channels, send Gmail / SureMail replies, auto-reply on WhatsApp or Facebook Messenger, create Zoom or Google Meet meetings.
* **Content & publishing automation** — publish posts across sites, update ACF / Meta Box / JetEngine fields, add Events Calendar events, generate PDFs, send Google Docs / Google Sheets.
* **AI automation** — route a form submission through an AI Agent, summarise support emails, auto-reply to webhooks with your knowledge base, translate content, extract structured data.
* **Scheduled & recurring automation** — hourly, daily, weekly or cron-based jobs; birthdays and anniversaries; polling triggers for Google Sheets / Google Docs; delayed follow-ups.

= Flow-control & utility steps =

Delay (minutes, hours, days or until a date) · Condition (if/else) · Filter (stop if criteria don't match) · Router (branch into many paths) · Iterator / Repeater (loop over a list) · Set Variable · Schedule · Manual trigger · Human Approval (pause for a Slack approval) · HTTP Request · Catch Webhook · Send Webhook · Formatter · Date / Time · CSV · XML · JSON Parser · Image Helper · Conversation Memory · Business Knowledge · MCP Client · Sticky Note.

= Full integrations list =

aBlocks, ActiveCampaign, Advanced Custom Fields (ACF), AI Agent (tool-calling), AI Chat Model, Anthropic (Claude), AR Form, Avada Form, Beaver Builder, Bit Form, Booking Calendar Contact Form, Brevo, BuddyBoss, Business Knowledge, Catch Webhook, Contact Form 7, CoBlocks, Custom Apps, Discord, Divi Builder, Dokan, Easy Digital Downloads, Elementor, Essential Blocks, Facebook Messenger, Fillout, FluentCart, FluentCRM, FluentSMTP, Fluent Forms, Formidable Forms, FunnelKit, GameEngine, GamiPress, GemBoards, GemBooking, GemCRM, Gmail, Google Docs, Google Gemini, Google Meet, Google Sheets, Gravity Forms, Groundhogg, HTTP Request, JetEngine, Jotform, Kadence Blocks, LearnDash, LifterLMS, Mailchimp, MasterStudy LMS, MemberPress, Meta Box, Metform, MCP Client, Ninja Forms, OpenAI, OpenAI-compatible endpoints (Azure OpenAI, Ollama, OpenRouter, self-hosted), Paid Memberships Pro, Paymattic, Profile Builder, QuizPress, Send Webhook, Slack, Spectra, StoreEngine, SureCart, SureForms, SureMail, SureMembers, Telegram, The Events Calendar, Trello, TruePlayer, Tutor LMS, Typeform, Ultimate Member, weForms, WhatsApp, WooCommerce, WooCommerce Bookings, WordPress core (post type, taxonomy, user, option, role, custom hook), WordPress AI Client, WP Map Block, WPFunnels, WPForms, WP User Frontend, ZenAppBuilder, ZenCommunity, Zoom.

Each service needs your own account with that provider. See **External services** below for exactly what Zaplane sends to each one, and when.

== Installation ==

1. Upload the `zaplane` folder to the `/wp-content/plugins/` directory, or install the plugin through the **Plugins > Add New** screen in WordPress.
2. Activate the plugin through the **Plugins** screen.
3. Open the **Zaplane** menu in your WordPress admin.
4. Create a new automation, pick a trigger, add your actions, and turn it on.

= Requirements =

* WordPress 6.8 or higher
* PHP 7.4 or higher

== Frequently Asked Questions ==

= Do I need a Zaplane account or any external service to use this? =

No. Zaplane needs no account with us and does not send your site's data to us. You only need an account with a third-party service (for example Slack or Mailchimp) if you build a workflow that uses that service.

= Does Zaplane require WooCommerce? =

No. WooCommerce is optional. Zaplane works with WordPress core events and with whichever supported plugins you have installed; the available triggers and actions depend on the plugins active on your site.

= How are scheduled and background steps processed? =

Zaplane uses Action Scheduler (the same background-processing library used by WooCommerce) to run delays, scheduled steps and long-running workflows reliably.

= Where does my data go? =

Workflows, run logs and connection credentials are stored in your WordPress database. Data leaves your site only when something you set up needs it to: a workflow step that calls a service, testing a connection, a builder field that loads options from a connected account (such as your Slack channels), or an AI step. Every service, with what is sent and when, is listed under External services.

= Can workflows reach private or internal addresses? =

Not by default. HTTP Request, Send Webhook, Custom Apps and every other step that fetches a URL refuse loopback, private, link-local and reserved addresses, including after a redirect. A developer can allow a specific internal host with the `zaplane_http_allowed_private_hosts` filter.

= What can an AI client connected through the Abilities API do? =

Zaplane registers its capabilities as abilities, and an MCP adapter you install exposes them to an AI client. Zaplane runs no server of its own, so authentication and transport are WordPress core's. Every ability requires an administrator, and the client can read your workflows, runs and recipes, draft and test workflows, and run them. It cannot administer your site: actions that activate or deactivate plugins, create, change or delete users, change roles or capabilities, or change site options are kept out of its reach, and it cannot create, read, edit, activate, test or run a workflow that uses one, including one you built yourself. You can still use those actions in workflows you build in the Zaplane dashboard.

= Can a Custom App call PHP functions? =

Only functions that code on your site has allowed with the `zaplane_custom_app_callables` filter. A Custom App can also fire a WordPress action or filter hook of your choosing.

= Can I build multi-step workflows with conditions and delays? =

Yes. You can chain multiple actions and insert delay, condition, filter, iterator and variable steps to control exactly how and when each step runs.

= Where is the source code for the admin interface? =

In the plugin itself. `dev_zaplane/` holds the React source of the admin interface and `assets/scss/` its Sass; the files in `assets/build/` are compiled from them. See Source Code and Build Process for where each file is and how to build it.

== Screenshots ==

1. The visual workflow builder canvas.
2. Choosing a trigger for a new automation.
3. Configuring an action step.
4. Browsing ready-made recipe templates.
5. Workflow run history and logs.

== External services ==

Zaplane contacts no external service when you install, activate or browse it, and sends nothing to its authors. It talks to a third-party only after you add a connection for it, and then only when you test that connection, when the editor loads options from it, or when a step that uses it runs. Each service needs your own account; review its terms and privacy before connecting. Requests carry your site's address in the User-Agent header.

The AI entries (Anthropic, Google Gemini, OpenAI, OpenAI-compatible, WordPress AI Client) apply only when a connection uses that provider.

= ActiveCampaign =
* Sends: contact emails, names and phone numbers, and list / tag / automation IDs — to your account's API URL (e.g. `*.api-us1.com`) with your key, when you test the connection or an ActiveCampaign step runs.
* Terms: https://www.activecampaign.com/legal/terms-of-service · Privacy: https://www.activecampaign.com/legal/privacy-policy

= Anthropic =
* Sends: instructions, messages, conversation history, knowledge context, tool definitions and results, and image URLs — to `api.anthropic.com` with your key, when you test the connection or an AI / AI Agent step runs.
* Terms: https://www.anthropic.com/legal/commercial-terms · Privacy: https://www.anthropic.com/legal/privacy

= Brevo =
* Sends: contact emails, names, attributes and list IDs — to `api.brevo.com` with your key, when you test the connection or a Brevo step runs.
* Terms: https://www.brevo.com/legal/termsofuse/ · Privacy: https://www.brevo.com/legal/privacypolicy/

= Discord =
* Sends: server, channel and user IDs and the message content you configure — to Discord's API with your bot token, when you test the connection, when the editor loads channels, or when a Discord step runs.
* Terms: https://discord.com/terms · Privacy: https://discord.com/privacy

= Fillout =
* Sends: form IDs — to `api.fillout.com` with your key, when you test the connection or the editor loads forms.
* Terms: https://www.fillout.com/terms · Privacy: https://www.fillout.com/privacy

= Google Gemini =
* Sends: prompts, conversation history, knowledge context and images; for semantic search, knowledge titles / content and queries — to `generativelanguage.googleapis.com` with your key, when an AI step runs or (with semantic search on) knowledge is embedded or searched.
* Terms: https://ai.google.dev/gemini-api/terms · Privacy: https://policies.google.com/privacy

= Google (Gmail, Calendar, Meet) =
* Sends: recipients, subjects and bodies; event titles, times, descriptions and attendee emails; OAuth codes and tokens — to Google's APIs (`gmail.googleapis.com`, `www.googleapis.com`, `meet.googleapis.com`, with sign-in at `accounts.google.com` / `oauth2.googleapis.com`) using the OAuth client you configure, when you connect, when the editor loads labels or calendars, or when a Gmail / Google Meet step runs.
* Terms: https://policies.google.com/terms (and https://developers.google.com/terms) · Privacy: https://policies.google.com/privacy

= Jotform =
* Sends: form IDs and the form definitions you create — to `api.jotform.com` with your key, when you test the connection, when the editor loads forms, or when a Jotform step runs.
* Terms: https://www.jotform.com/terms/ · Privacy: https://www.jotform.com/privacy/

= Mailchimp =
* Sends: subscriber emails, merge fields, tags and audience IDs — to the `api.mailchimp.com` data centre named in your key, when you test the connection or a Mailchimp step runs.
* Terms: https://mailchimp.com/legal/terms/ · Privacy: https://www.intuit.com/privacy/statement/

= Meta (Messenger, WhatsApp) =
* Sends: recipient ID or phone number, message text, templates, media URLs and locations — to the Meta Graph API (`graph.facebook.com`) with your page or WhatsApp Business token, when you test the connection or a Messenger / WhatsApp step runs.
* Terms: https://developers.facebook.com/terms/ and https://www.whatsapp.com/legal/business-terms · Privacy: https://www.facebook.com/privacy/policy/

= OpenAI =
* Sends: instructions, messages, conversation history, knowledge context, tool definitions and results, image URLs and prompts, audio files you point to; for semantic search, knowledge text and queries — to `api.openai.com` with your key, when you test the connection, when an AI step runs, or (with semantic search on) when knowledge is embedded or searched.
* Terms: https://openai.com/policies/services-agreement/ · Privacy: https://openai.com/policies/privacy-policy/

= OpenAI-compatible providers =
* Sends: the same data as the OpenAI entry — to the base URL you enter (e.g. OpenRouter at `openrouter.ai`, Azure OpenAI, or a self-hosted endpoint such as Ollama), when you test the connection, when the editor loads models, or when an AI / AI Agent step runs.
* Terms and privacy: those of the provider you choose. OpenRouter: https://openrouter.ai/terms · https://openrouter.ai/privacy. Azure OpenAI: https://www.microsoft.com/licensing/terms/ · https://www.microsoft.com/privacy/privacystatement

= Slack =
* Sends: the channels, users, message text and names you configure; your OAuth code or bot token; for Human Approval, the message and its approve / reject links to the incoming webhook URL you enter — to Slack's API, when you connect or test a connection, when the editor loads channels, or when a Slack / Human Approval step runs.
* Terms: https://slack.com/terms-of-service/api · Privacy: https://slack.com/trust/privacy/privacy-policy

= Telegram =
* Sends: chat ID, message text and media URLs — to `api.telegram.org` with your bot token, when you test the connection or a Telegram step runs.
* Terms: https://telegram.org/tos/bot-developers · Privacy: https://telegram.org/privacy

= Trello =
* Sends: the card, list, board, member and label details you configure, with your key and token — to `api.trello.com`, when you test the connection, when the editor loads boards and lists, or when a Trello step runs.
* Terms: https://www.atlassian.com/legal/atlassian-customer-agreement · Privacy: https://www.atlassian.com/legal/privacy-policy

= Typeform =
* Sends: form titles, fields and workspace, and your site's webhook URL (the Create Form step registers it so responses reach your workflows) — to `api.typeform.com` with your access token, when you test the connection, when the editor loads forms, or when a Typeform step runs.
* Terms: https://www.typeform.com/legal/service-terms-and-conditions · Privacy: https://www.typeform.com/legal/privacy-policy

= WordPress AI Client =
* Sends: prompt, conversation history, knowledge context, tool definitions and results, and any image you reference — to WordPress core's AI Client, which forwards them to the provider the site owner configured. Zaplane stores no key for it and contacts no AI service itself.
* Terms and privacy: those of the provider configured in WordPress (see the Anthropic / Google Gemini / OpenAI entries above).

= YouTube thumbnails (email editor) =
* Sends: the video ID, as part of the image address — to `img.youtube.com`, when you add a YouTube link to a Video block on the Email Templates screen.
* Terms: https://www.youtube.com/t/terms · Privacy: https://policies.google.com/privacy

= Zoom =
* Sends: meeting topics, times and settings; registrant names and emails; OAuth codes and tokens — to `api.zoom.us` (sign-in at `zoom.us`) through your Zoom app, when you connect or a Zoom step runs.
* Terms: https://www.zoom.com/en/trust/terms/ · Privacy: https://www.zoom.com/en/trust/privacy/privacy-statement/

= Addresses you configure =
HTTP Request, Send Webhook, Custom Apps, the MCP Client, the AI Agent's HTTP tool, and the steps that read a file from a URL (CSV, Image Helper, Upload Media From URL, AI image and audio) send data to, or fetch data from, the address you enter or that your workflow supplies. What is sent is what you configure in that step; the MCP Client also sends your site's address so a server can recognise calls from it. Requests go only where you point them, and addresses on private networks are refused unless a developer allows them.

== Source Code and Build Process ==

Only one part of Zaplane is compiled: the admin interface, which is a React app. Everything else, including all of the plugin's PHP in `includes/` and `integrations/`, runs exactly as it ships. The complete, uncompiled source of the admin interface is included in this plugin, together with everything needed to build it.

= Where the development files are =

* `dev_zaplane/` — the React source: `app.js` is the entry point, `app.scss` its base stylesheet, with `components/` (shared UI), `containers/BackendDashboard/` (the admin screens and workflow canvas), `redux/` (store and slices), `hooks/`, `utils/` and `webpack/` (a loader that points the email editor's placeholder images at `assets/images/`).
* `assets/scss/` — the Sass for the admin interface; `backend.scss` is its entry.
* `package.json`, `webpack.config.js`, `tailwind.config.js`, `postcss.config.js` and `jsconfig.json` — the dependencies, build scripts and configuration. The build runs on `@wordpress/scripts`, with Tailwind CSS and Autoprefixer through PostCSS.

= Generated files =

* `assets/build/app.js` — built from `dev_zaplane/app.js` and every module it imports.
* `assets/build/app.css` and `assets/build/app-rtl.css` — built from the Sass above; the right-to-left file comes from the same source.
* `assets/build/app.asset.php` — written by the build: the script's WordPress dependencies and its version.

Every generated `.js` and `.css` file starts with a comment naming its source and the commands that rebuild it.

= Building the admin interface =

You need Node.js 18.12 or newer and npm 8.19 or newer. In the plugin's folder, `wp-content/plugins/zaplane`:

1. Install the dependencies: `npm install --legacy-peer-deps`
2. Build the production files: `npm run build`

The build writes minified files to `assets/build/`. While working on the source, `npm run start` rebuilds on every save, unminified and with source maps; run `npm run build` again before using the plugin on a live site. `--legacy-peer-deps` is needed because one dependency, react-json-view, declares support only for older React versions, although it works with the version Zaplane uses.

The PHP library in `vendor/` (Action Scheduler) is managed with Composer; `composer install --no-dev` reinstalls it.

== Changelog ==

= 1.5.0 =
**Added**
* Inbox module: website live chat, Facebook Messenger and WhatsApp channels, selling in chat with product cards, saved replies and quick-answers, automatic answers from Business Knowledge, agent presence and business hours, email-capture gating, typing indicator and realtime delivery. New triggers and actions so workflows can read, reply to and route conversations.
* Third-party integration API: other plugins can register their own triggers and actions with `zaplane_register_integration()` on the `zaplane_register_integrations` action. See `docs/integrations/third-party/README.md`.
* `wp zaplane make:addon <slug>` scaffolds a ready-to-edit plugin with a sample third-party integration (or adds one to an existing plugin with `--plugin=<folder>`).
* New built-in integrations: Shopify, Google Sheets, Google Docs, JetFormBuilder, Forminator, Everest Forms, HappyForms, Gutena Forms, Tally Form, QuizPress, Easy Content Manager, TruePlayer, WP Map Block, GemBoard, ZenAppBuilder.
* AI Agent: Chat Model, Memory and Tool slots with a slot-aware picker and a `zaplane_agent_slots` filter; a Chat Model's own connection decides the provider; Memory can read Inbox conversations.
* Workflows list: filter by status and folder, search, "Clear filters" affordance; Connections list: status tabs, app filter and search.
* Editor: tidier step connection picker opening the shared "Add connection" modal; missing-connection notice as a card over the canvas; workflows the editor flags when a step has no connection.
* Settings: a gear button per module opens its settings; multi-WordPress support for the WordPress integration.

**Changed**
* Minimum WordPress is 7.0.
* Many editor polish passes: top-bar logo and spacing, Create Workflow modal rhythm, Add Trigger drawer, email-template editor layout.

**Fixed**
* `determine_current_user` settings recursion.
* Workflow re-triggering itself from its own actions.
* Custom Code Execution: process timeouts actually terminate on Windows.
* ORM `where()` on a column named like a function no longer filters out everything.
* Silent no-op actions, formatter and repeater limits, MCP stream parsing.
* Inbox: rate-limit the chat widget per visitor on a real one-minute window; don't run reply workflows for conversations others answer; match chat spellings and pages whose text covers the question.
* Plain-permalinks sites, align plugin header with new readme title, scroll-to-top on sidebar navigation.

**Security**
* Remaining user-URL HTTP routed through `HttpGuard`; PCRE formatter hardened.
* Security and WPCS audit of PRs merged for this release.

= 1.4.0 =
**Changed**
* AI access now uses the WordPress Abilities API instead of Zaplane's own MCP server. Zaplane registers its workflow capabilities as abilities; install an MCP adapter and an AI client you approve can discover, build and run workflows through WordPress core. Every ability requires an administrator, and site-administration actions stay out of an AI client's reach.
* Removed the built-in MCP server, its OAuth sign-in, access tokens, and the "AI access" settings and log screens.
* Raised the minimum WordPress version to 6.8. Abilities and the core AI Client are consumed through the Abilities API when the hosting WordPress version provides them.
* The MCP Client workflow step (calling other services' MCP servers) is unchanged.

= 1.3.3 =
**Security**
* A workflow that another service starts — a Catch Webhook URL, a provider webhook, or a trigger from a connected outside account — can no longer run actions that administer the site: activating or deactivating plugins, creating, changing or deleting users, changing roles and capabilities, and changing site options. Such a workflow cannot be activated, the editor explains why, and the step is refused if one runs anyway. The same actions still work in workflows started by something that happens on the site.
* An AI Agent is never given those actions as tools.
* The Academy and ZenCommunity steps no longer switch the signed-in user while they run; they act for the user they name.
* MCP access tokens now sign in through WordPress's own authentication filter, the one application passwords use, instead of switching the user inside the endpoint.

= 1.3.2 =
**Security**
* An AI client connected through the MCP server can no longer reach actions that administer the site: activating or deactivating plugins, creating, changing or deleting users, changing roles and capabilities, and changing site options. It cannot add them to a workflow, or read, edit, activate, test or run a workflow that uses them.

**Fixed**
* Conditions, filters and a few triggers no longer call string functions that need PHP 8, so Zaplane runs on PHP 7.4 as declared.
* Workflow steps now run when Action Scheduler is processed from WP-CLI, as many hosts do from a system cron. Before, every queued step failed there.

= 1.3.1 =
**Security and privacy**
* Removed the Switch Theme and Authenticate User actions. Which theme a site runs, and signing in, are the site owner's own decisions.
* Create, Update and Delete User now accept only the fields their form offers and a role the site defines, and refuse to delete the last administrator or the account the run is using.
* Incoming webhook and Catch Webhook URLs check the provider's signature, or the trigger's shared secret, before the request reaches the workflow.
* The workflow query builder now refuses any table, column, operator or sort direction that is not a plain name, and every value it sends is a placeholder filled in by WordPress.
* The admin palette, the integrations catalogue and the MCP consent screen are escaped on the way out.
* Documented the Telegram API address and the links to claude.ai and ChatGPT under External services.

**Fixed**
* Lists of courses, quizzes, ranks and achievements are read through WordPress instead of the posts table directly.
* Fixed selecting a specific set of columns — a "get this field for every row" query returned nothing.

= 1.3.0 =
**Workflows**
* A workflow can start from more than one trigger. Whichever fires starts the run, and `{{trigger.*}}` reads its data.
* Connecting steps is easier: drop a line anywhere on a step's card, and letting go on empty canvas opens the step picker.

**Recipes**
* Group recipes set up several workflows at once in a new folder, starting with WooCommerce Customer Lifecycle and StoreEngine Store Emails.
* Every recipe opens a setup for its optional steps, settings and connections. Plugins can register recipes as simple arrays.

**AI**
* The AI, AI Agent and Generate Image steps use the WordPress AI Client when it is available in core, including the agent's tool calling. Your own provider key is still an option.

**AI access (MCP server)**
* claude.ai and ChatGPT can connect through OAuth, with administrator approval. WordPress application passwords also work.
* Tool calls are logged, tokens can expire, and run tokens can be limited to chosen workflows.

**Security and compatibility**
* Merge tags are no longer evaluated as PHP, and outbound requests are checked on every redirect.
* MCP tokens now act as their own user and require administrator rights.
* Updates come only from WordPress.org. WordPress 6.8 or later is required.

**Fixes**
* GemCRM Send Email now reaches only the chosen contact or list.
* Fixed shipped recipes' Send Email steps, duplicate recipes after a rename, fields with hyphens, forms watched by two triggers, and Logs Re-Try.

= 1.2.0 =
**New integrations**
* aBlocks — a Form Submitted trigger for aBlocks form-builder forms.
* FluentCart — 21 new triggers and 52 new actions across carts, coupons, licences, customers, orders, products and subscriptions.

**AI access (MCP server)**
* Let Claude, Cursor or any Model Context Protocol client read your automations and build new ones from a plain-language description. Off by default, behind scoped and revocable tokens.

**Modules**
* Optional features are now opt-in and switched off on a fresh install. Existing sites keep whatever they had.
* A card on the Workflows, Dashboard and Connections screens lists what you have not turned on, with a one-click switch. Picking a step whose module is off now says so in the builder and offers to enable it there.

**Workflow canvas**
* Nodes are colour-typed as trigger, action, tool or AI, on the card and on the connector leaving it, so a glance shows what feeds what.
* Node cards now sit on a canvas of their own colour instead of sharing it, connectors draw a single stroke instead of three, and the delete control is a real, keyboard-reachable button.

**Appearance**
* The dark theme was rebuilt for legibility — secondary text and button labels previously fell below the accessible contrast minimum.
* The dashboard chart now follows your palette instead of fixed light-mode colours.

**Performance**
* The admin bundle drops from 23.8 MB to 1.6 MB.

**Removed**
* The Dokan "Withdraw Request Pending" and FluentCart "Order Paid Done" triggers. A workflow still using either will need its trigger re-selected.

= 1.1.0 =
**New integrations**
* StoreEngine — order, subscription and product triggers plus actions.
* AI (Chat Model) — generate replies with Anthropic, OpenAI, or WordPress Core AI.
* AI Agent — autonomous tool-calling agent with Chat Model, Memory and Tools sub-nodes, plus MCP server support.
* Conversation Memory — durable, keyed chat history for AI conversations.
* Business Knowledge — a searchable knowledge base the AI Agent can query; sync from StoreEngine products.
* Custom Apps — build your own integrations (REST or same-site WordPress hooks) without code changes.
* Webhook — a dedicated app for both directions: Catch Webhook (incoming) and Send Webhook (outgoing) with optional HMAC-SHA256 signing.
* Messenger and WhatsApp — AI auto-reply flows.
* Academy — course enrolment triggers, actions and access-group membership.

**New tools & flow control**
* Manual Trigger, Schedule trigger, and Human-in-the-Loop approval.
* Router (multi-branch), Repeater/Iterator, Condition and Filter.
* Utility tools: CSV, XML, JSON Parser, Formatter, Date/Time, Image Helper, Set Variable, and Sticky Note.

**New recipe**
* "AI Reply to Incoming Webhook" — receive a question by webhook, answer it with the AI Agent using your Business Knowledge, then post the reply back out.

**Improvements**
* Dynamic-data "@" token picker across expression fields, with sample outputs so tokens are available before a test run.
* Redesigned Business Knowledge, field, checkbox and connection-icon UI, with icon fallbacks.
* Clearer node port / branch handles and AI Agent sub-node handles on the canvas.

**Fixes**
* AI and AI Agent no longer appear as trigger options where only actions apply.
* Custom Apps: trigger firing, label handling, and the stale generic "Custom App" entry in the app picker.
* Webhook: structured Body fields so multi-line/quoted values (e.g. an AI reply) can't produce malformed JSON.
* Node port, multiple-output, route-indicator, CSV parser, and dynamic-data resolution fixes.

= 1.0.2 =
* Improvements and bug fixes.

= 1.0.0 =
* Initial release.

== Upgrade Notice ==

= 1.4.0 =
Zaplane now exposes its automations as abilities through the WordPress Abilities API; the previous Zaplane-operated MCP server has been removed. The Custom PHP Code step is no longer bundled. Minimum WordPress is 6.8.

= 1.3.3 =
Workflows started by a webhook or an outside service can no longer run actions that administer the site.

= 1.3.2 =
MCP clients can no longer use actions that administer the site, and PHP 7.4 compatibility is fixed.

= 1.3.1 =
Security hardening throughout, and two actions removed: Switch Theme and Authenticate User.

= 1.3.0 =
Adds multiple triggers per workflow, group recipes, WordPress AI Client support and OAuth sign-in for AI clients, and fixes security issues. Requires WordPress 6.8 or later. MCP tokens issued to users without administrator rights stop working.

= 1.2.0 =
Adds aBlocks and FluentCart integrations, an optional MCP server and a rebuilt dark theme. Optional modules are off on new sites. The Dokan "Withdraw Request Pending" and FluentCart "Order Paid Done" triggers were removed; re-select the trigger in any workflow using them.

= 1.1.0 =
Major feature release: StoreEngine, AI Agent (with MCP), AI Chat Model, Memory, Business Knowledge, Custom Apps, a bidirectional Webhook app, and many new tools and flow-control nodes.

= 1.0.2 =
Recommended update with stability improvements and bug fixes.
