=== Zaplane - AI Agent Automation & Workflow Builder ===
Contributors: kodezen, tusharimran
Tags: automation, workflow, webhook, ai agent, integration
Requires at least: 6.8
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.5.0
License: GPLv3 or later
License URI: https://www.gnu.org/licenses/gpl-3.0.html

No-code WordPress automation & AI agent workflow builder. 100+ integrations: WooCommerce, FluentCRM, Slack, Gmail, Google Sheets and more.

== Description ==

Zaplane is a no-code automation and workflow builder for WordPress. Pick a trigger (an order, a form submission, a user action, a webhook, a scheduled time) and chain it to one or more actions (email, CRM update, chat message, HTTP call) with delays, conditions, filters, loops and AI steps in between. Workflows are built visually on a drag-and-drop canvas and run in the background on Action Scheduler, the same queue WooCommerce uses. Everything — workflows, run history, credentials — stays in your own WordPress database.

= Features =

* **Visual workflow builder.** Drag-and-drop canvas with trigger, action, condition, filter, router, iterator, delay and AI nodes. Variable passing between steps, test runs, logs and re-tries.
* **100+ built-in integrations.** WooCommerce, FluentCRM, Mailchimp, Brevo, Slack, Discord, Telegram, WhatsApp, Gmail, Google Sheets, LearnDash, Tutor LMS, Fluent Forms, Gravity Forms, WPForms, Shopify and more. See the full list below.
* **Flow control and utility steps.** Delay, Condition, Filter, Router, Iterator, Set Variable, HTTP Request, Send/Catch Webhook, Human Approval, Schedule, Formatter, Date/Time, CSV, XML, JSON Parser, Image Helper, Conversation Memory, Business Knowledge, MCP Client, Sticky Note.
* **AI automation.** A tool-calling AI Agent, generated replies and images, and search over your own knowledge base. Uses the WordPress AI Client when core provides it, or your own OpenAI, Anthropic or Gemini key.
* **Inbox and live chat.** A website chat widget, Facebook Messenger and WhatsApp channels, selling in chat with product cards, saved replies and quick-answers, automatic answers from Business Knowledge, agent presence and business hours. Workflows can read, reply to and route conversations.
* **WordPress Abilities API access.** Zaplane registers its workflow capabilities as abilities. Install an MCP adapter and an AI client you approve can discover, build and run workflows. Every ability requires an administrator; Zaplane runs no server of its own.
* **Extensible.** Custom Apps turn any REST API or WordPress hook into a trigger or action without writing a plugin. Companion plugins can register their own triggers and actions through `zaplane_register_integration()` on the `zaplane_register_integrations` action.
* **Ready-made recipes** for common jobs: abandoned-cart recovery, order confirmations, review requests, drip campaigns, birthday emails, lead nurturing, membership provisioning, support auto-replies and more.
* **GPL-3.0, free.** Every integration, trigger, action and recipe is in this plugin. No premium tier, no per-task fee.

= Typical use cases =

Recover abandoned WooCommerce carts, follow up on orders, request reviews, remind customers about subscription renewals, and warn when a product goes out of stock. Add form submissions to a CRM, apply or remove tags, enrol contacts in sequences, run drip campaigns and autoresponders, and sync between CRMs. Route Fluent Forms, Gravity Forms, WPForms, Contact Form 7, Formidable, Ninja, Fillout, Typeform or Jotform submissions anywhere. Enrol learners on LearnDash, Tutor LMS, LifterLMS, MasterStudy or Academy courses, grant membership on purchase, and email instructors on completion. Provision access on MemberPress, Paid Memberships Pro, SureMembers, BuddyBoss or Ultimate Member when a payment succeeds. Run hourly, daily, weekly or cron-based scheduled tasks, including birthdays, anniversaries and delayed follow-ups.

= Full integrations list =

aBlocks, ActiveCampaign, ACF, AI Agent, AI Chat Model, Anthropic, AR Form, Avada Form, Beaver Builder, Bit Form, Booking Calendar Contact Form, Brevo, BuddyBoss, Business Knowledge, Catch Webhook, Contact Form 7, CoBlocks, Custom Apps, Discord, Divi Builder, Dokan, Easy Content Manager, Easy Digital Downloads, Elementor, Essential Blocks, Everest Forms, Facebook Messenger, Fillout, FluentCart, FluentCRM, FluentSMTP, Fluent Forms, Formidable Forms, Forminator, FunnelKit, GameEngine, GamiPress, GemBoards, GemBooking, GemCRM, Gmail, Google Docs, Google Gemini, Google Meet, Google Sheets, Gravity Forms, Groundhogg, Gutena Forms, HappyForms, HTTP Request, Inbox (live chat), JetEngine, JetFormBuilder, Jotform, Kadence Blocks, LearnDash, LifterLMS, Mailchimp, MasterStudy LMS, MemberPress, Meta Box, Metform, MCP Client, Ninja Forms, OpenAI, OpenAI-compatible endpoints, Paid Memberships Pro, Paymattic, Profile Builder, QuizPress, Send Webhook, Shopify, Slack, Spectra, StoreEngine, SureCart, SureForms, SureMail, SureMembers, Tally Form, Telegram, The Events Calendar, Trello, TruePlayer, Tutor LMS, Typeform, Ultimate Member, weForms, WhatsApp, WooCommerce, WooCommerce Bookings, WordPress core, WordPress AI Client, WP Map Block, WPFunnels, WPForms, WP User Frontend, ZenAppBuilder, ZenCommunity, Zoom.

Each service needs your own account with that provider. See **External services** below for what Zaplane sends to each one.

== Installation ==

1. Upload the `zaplane` folder to the `/wp-content/plugins/` directory, or install the plugin through the **Plugins > Add New** screen in WordPress.
2. Activate the plugin through the **Plugins** screen.
3. Open the **Zaplane** menu in your WordPress admin.
4. Create a new automation, pick a trigger, add your actions, and turn it on.

= Requirements =

* WordPress 6.8 or higher
* PHP 7.4 or higher

== Frequently Asked Questions ==

= Do I need a Zaplane account or any external service to use this? =

No. Zaplane needs no account with us and does not send your site's data to us. You only need an account with a third-party service (for example Slack or Mailchimp) if you build a workflow that uses that service.

= Does Zaplane require WooCommerce? =

No. WooCommerce is optional. Zaplane works with WordPress core events and with whichever supported plugins you have installed; the available triggers and actions depend on the plugins active on your site.

= How are scheduled and background steps processed? =

Zaplane uses Action Scheduler (the same background-processing library used by WooCommerce) to run delays, scheduled steps and long-running workflows reliably.

= Where does my data go? =

Workflows, run logs and connection credentials are stored in your WordPress database. Data leaves your site only when something you set up needs it to: a workflow step that calls a service, testing a connection, a builder field that loads options from a connected account (such as your Slack channels), or an AI step. Every service, with what is sent and when, is listed under External services.

= Can workflows reach private or internal addresses? =

Not by default. HTTP Request, Send Webhook, Custom Apps and every other step that fetches a URL refuse loopback, private, link-local and reserved addresses, including after a redirect. A developer can allow a specific internal host with the `zaplane_http_allowed_private_hosts` filter.

= What can an AI client connected through the Abilities API do? =

Zaplane registers its capabilities as abilities, and an MCP adapter you install exposes them to an AI client. Zaplane runs no server of its own, so authentication and transport are WordPress core's. Every ability requires an administrator, and the client can read your workflows, runs and recipes, draft and test workflows, and run them. It cannot administer your site: actions that activate or deactivate plugins, create, change or delete users, change roles or capabilities, or change site options are kept out of its reach, and it cannot create, read, edit, activate, test or run a workflow that uses one, including one you built yourself. You can still use those actions in workflows you build in the Zaplane dashboard.

= Can a Custom App call PHP functions? =

Only functions that code on your site has allowed with the `zaplane_custom_app_callables` filter. A Custom App can also fire a WordPress action or filter hook of your choosing.

= Can I build multi-step workflows with conditions and delays? =

Yes. You can chain multiple actions and insert delay, condition, filter, iterator and variable steps to control exactly how and when each step runs.

= Where is the source code for the admin interface? =

In the plugin itself. `dev_zaplane/` holds the React source of the admin interface and `assets/scss/` its Sass; the files in `assets/build/` are compiled from them. See Source Code and Build Process for where each file is and how to build it.

== Screenshots ==

1. The visual workflow builder canvas.
2. Choosing a trigger for a new automation.
3. Configuring an action step.
4. Browsing ready-made recipe templates.
5. Workflow run history and logs.

== External services ==

Zaplane contacts no third-party on install, activate or browse, and sends nothing to its authors. It calls a service only after you add a connection for it, and then only when you test the connection, when the editor loads options from it, or when a step that uses it runs. Each service needs your own account; review its terms and privacy before connecting. Requests carry your site's address in the User-Agent header. AI entries apply only when a connection uses that provider.

* **ActiveCampaign** — contact emails, names, phone numbers and list / tag / automation IDs, with your key, to your account API URL. Terms: https://www.activecampaign.com/legal/terms-of-service · Privacy: https://www.activecampaign.com/legal/privacy-policy
* **Anthropic** — prompts, messages, history, knowledge context, tool definitions and results, image URLs, with your key, to `api.anthropic.com`. Terms: https://www.anthropic.com/legal/commercial-terms · Privacy: https://www.anthropic.com/legal/privacy
* **Brevo** — contact emails, names, attributes and list IDs, with your key, to `api.brevo.com`. Terms: https://www.brevo.com/legal/termsofuse/ · Privacy: https://www.brevo.com/legal/privacypolicy/
* **Discord** — server, channel and user IDs and the message content, with your bot token, to Discord's API. Terms: https://discord.com/terms · Privacy: https://discord.com/privacy
* **Fillout** — form IDs, with your key, to `api.fillout.com`. Terms: https://www.fillout.com/terms · Privacy: https://www.fillout.com/privacy
* **Google Gemini** — prompts, history, knowledge context, images, and (with semantic search) knowledge text and queries, with your key, to `generativelanguage.googleapis.com`. Terms: https://ai.google.dev/gemini-api/terms · Privacy: https://policies.google.com/privacy
* **Google (Gmail, Calendar, Meet)** — recipients, subjects, bodies, event titles, times, attendees, OAuth codes and tokens, through the OAuth client you configure, to `gmail.googleapis.com`, `www.googleapis.com`, `meet.googleapis.com`, `accounts.google.com`, `oauth2.googleapis.com`. Terms: https://policies.google.com/terms · Privacy: https://policies.google.com/privacy
* **Jotform** — form IDs and the form definitions you create, with your key, to `api.jotform.com`. Terms: https://www.jotform.com/terms/ · Privacy: https://www.jotform.com/privacy/
* **Mailchimp** — subscriber emails, merge fields, tags and audience IDs, with your key, to the `api.mailchimp.com` data centre named in your key. Terms: https://mailchimp.com/legal/terms/ · Privacy: https://www.intuit.com/privacy/statement/
* **Meta (Messenger, WhatsApp)** — recipient ID or phone number, message text, templates, media URLs and locations, with your page or WhatsApp Business token, to the Meta Graph API (`graph.facebook.com`). Terms: https://developers.facebook.com/terms/ · Privacy: https://www.facebook.com/privacy/policy/
* **OpenAI** — prompts, messages, history, knowledge context, tool definitions and results, image prompts and URLs, audio files, and (with semantic search) knowledge text and queries, with your key, to `api.openai.com`. Terms: https://openai.com/policies/services-agreement/ · Privacy: https://openai.com/policies/privacy-policy/
* **OpenAI-compatible providers** — the same data as OpenAI, to the base URL you enter (e.g. OpenRouter, Azure OpenAI, Ollama). Terms and privacy are those of the provider you choose.
* **Slack** — channels, users, message text and names, your OAuth code or bot token, and for Human Approval the message and approve / reject links to the webhook URL you enter, to Slack's API. Terms: https://slack.com/terms-of-service/api · Privacy: https://slack.com/trust/privacy/privacy-policy
* **Telegram** — chat ID, message text and media URLs, with your bot token, to `api.telegram.org`. Terms: https://telegram.org/tos/bot-developers · Privacy: https://telegram.org/privacy
* **Trello** — the card, list, board, member and label details you configure, with your key and token, to `api.trello.com`. Terms: https://www.atlassian.com/legal/atlassian-customer-agreement · Privacy: https://www.atlassian.com/legal/privacy-policy
* **Typeform** — form titles, fields, workspace and your site's webhook URL, with your access token, to `api.typeform.com`. Terms: https://www.typeform.com/legal/service-terms-and-conditions · Privacy: https://www.typeform.com/legal/privacy-policy
* **WordPress AI Client** — prompt, history, knowledge context, tool definitions and results, and images, to WordPress core's AI Client, which forwards to the provider the site owner configured. Zaplane stores no key and contacts no AI service itself. Terms and privacy are the configured provider's.
* **YouTube thumbnails (email editor)** — the video ID, as part of the image URL, to `img.youtube.com`, only when you add a YouTube link to a Video block. Terms: https://www.youtube.com/t/terms · Privacy: https://policies.google.com/privacy
* **Zoom** — meeting topics, times, settings, registrant names and emails, OAuth codes and tokens, through your Zoom app, to `api.zoom.us` (sign-in at `zoom.us`). Terms: https://www.zoom.com/en/trust/terms/ · Privacy: https://www.zoom.com/en/trust/privacy/privacy-statement/
* **Addresses you configure** — HTTP Request, Send Webhook, Custom Apps, MCP Client, the AI Agent's HTTP tool, and the steps that read a file from a URL (CSV, Image Helper, Upload Media From URL, AI image and audio) send to, or fetch from, the address you enter. The MCP Client also sends your site's address. Requests go only where you point them; private-network addresses are refused unless a developer allows them.

== Source Code and Build Process ==

Only one part of Zaplane is compiled: the admin interface, which is a React app. Everything else, including all of the plugin's PHP in `includes/` and `integrations/`, runs exactly as it ships. The complete, uncompiled source of the admin interface is included in this plugin, together with everything needed to build it.

= Where the development files are =

* `dev_zaplane/` — the React source: `app.js` is the entry point, `app.scss` its base stylesheet, with `components/` (shared UI), `containers/BackendDashboard/` (the admin screens and workflow canvas), `redux/` (store and slices), `hooks/`, `utils/` and `webpack/` (a loader that points the email editor's placeholder images at `assets/images/`).
* `assets/scss/` — the Sass for the admin interface; `backend.scss` is its entry.
* `package.json`, `webpack.config.js`, `tailwind.config.js`, `postcss.config.js` and `jsconfig.json` — the dependencies, build scripts and configuration. The build runs on `@wordpress/scripts`, with Tailwind CSS and Autoprefixer through PostCSS.

= Generated files =

* `assets/build/app.js` — built from `dev_zaplane/app.js` and every module it imports.
* `assets/build/app.css` and `assets/build/app-rtl.css` — built from the Sass above; the right-to-left file comes from the same source.
* `assets/build/app.asset.php` — written by the build: the script's WordPress dependencies and its version.

Every generated `.js` and `.css` file starts with a comment naming its source and the commands that rebuild it.

= Building the admin interface =

You need Node.js 18.12 or newer and npm 8.19 or newer. In the plugin's folder, `wp-content/plugins/zaplane`:

1. Install the dependencies: `npm install --legacy-peer-deps`
2. Build the production files: `npm run build`

The build writes minified files to `assets/build/`. While working on the source, `npm run start` rebuilds on every save, unminified and with source maps; run `npm run build` again before using the plugin on a live site. `--legacy-peer-deps` is needed because one dependency, react-json-view, declares support only for older React versions, although it works with the version Zaplane uses.

The PHP library in `vendor/` (Action Scheduler) is managed with Composer; `composer install --no-dev` reinstalls it.

== For developers ==

* **Build your own integration from another plugin.** Call `zaplane_register_integration()` on the `zaplane_register_integrations` action, and your triggers and actions appear in the editor live. Walkthrough and example plugin: `docs/integrations/third-party/`.
* **Scaffold a sample integration with WP-CLI.**
  * `wp zaplane make:addon <slug>` — create a ready-to-edit companion plugin at `wp-content/plugins/<slug>/`.
  * `wp zaplane make:addon <slug> --name="My Integration" --author="Acme"` — pre-fill the plugin header.
  * `wp zaplane make:addon <slug> --plugin=<folder>` — add a sample integration file to an existing plugin instead of creating a new one.
* **AI Agent slots.** `zaplane_agent_slots` filters which Chat Model, Memory and Tool nodes an agent accepts.
* **No-code integrations.** Custom Apps turn any REST API or WordPress hook into a trigger or action without writing a plugin.
* **In-depth docs** (not shipped in the dist zip): `docs/backend/`, `docs/frontend/`, `docs/integrations/`, `docs/mcp/`, `docs/recipes/`.

== Changelog ==

= 1.5.0 =
**Added**
* Inbox module: website live chat, Facebook Messenger and WhatsApp channels, selling in chat with product cards, saved replies and quick-answers, automatic answers from Business Knowledge, agent presence and business hours, email-capture gating, typing indicator and realtime delivery. New triggers and actions so workflows can read, reply to and route conversations.
* Third-party integration API: other plugins can register their own triggers and actions with `zaplane_register_integration()` on the `zaplane_register_integrations` action. See `docs/integrations/third-party/README.md`.
* `wp zaplane make:addon <slug>` scaffolds a ready-to-edit plugin with a sample third-party integration (or adds one to an existing plugin with `--plugin=<folder>`).
* New built-in integrations: Shopify, Google Sheets, Google Docs, JetFormBuilder, Forminator, Everest Forms, HappyForms, Gutena Forms, Tally Form, QuizPress, Easy Content Manager, TruePlayer, WP Map Block, GemBoard, ZenAppBuilder.
* AI Agent: Chat Model, Memory and Tool slots with a slot-aware picker and a `zaplane_agent_slots` filter; a Chat Model's own connection decides the provider; Memory can read Inbox conversations.
* Workflows list: filter by status and folder, search, "Clear filters" affordance; Connections list: status tabs, app filter and search.
* Editor: tidier step connection picker opening the shared "Add connection" modal; missing-connection notice as a card over the canvas; workflows the editor flags when a step has no connection.
* Settings: a gear button per module opens its settings; multi-WordPress support for the WordPress integration.

**Changed**
* Minimum WordPress is 7.0.
* Many editor polish passes: top-bar logo and spacing, Create Workflow modal rhythm, Add Trigger drawer, email-template editor layout.

**Fixed**
* `determine_current_user` settings recursion.
* Workflow re-triggering itself from its own actions.
* Custom Code Execution: process timeouts actually terminate on Windows.
* ORM `where()` on a column named like a function no longer filters out everything.
* Silent no-op actions, formatter and repeater limits, MCP stream parsing.
* Inbox: rate-limit the chat widget per visitor on a real one-minute window; don't run reply workflows for conversations others answer; match chat spellings and pages whose text covers the question.
* Plain-permalinks sites, align plugin header with new readme title, scroll-to-top on sidebar navigation.

**Security**
* Remaining user-URL HTTP routed through `HttpGuard`; PCRE formatter hardened.
* Security and WPCS audit of PRs merged for this release.

= 1.4.0 =
**Changed**
* AI access now uses the WordPress Abilities API instead of Zaplane's own MCP server. Zaplane registers its workflow capabilities as abilities; install an MCP adapter and an AI client you approve can discover, build and run workflows through WordPress core. Every ability requires an administrator, and site-administration actions stay out of an AI client's reach.
* Removed the built-in MCP server, its OAuth sign-in, access tokens, and the "AI access" settings and log screens.
* Raised the minimum WordPress version to 6.8. Abilities and the core AI Client are consumed through the Abilities API when the hosting WordPress version provides them.
* The MCP Client workflow step (calling other services' MCP servers) is unchanged.

= 1.3.3 =
**Security**
* A workflow that another service starts — a Catch Webhook URL, a provider webhook, or a trigger from a connected outside account — can no longer run actions that administer the site: activating or deactivating plugins, creating, changing or deleting users, changing roles and capabilities, and changing site options. Such a workflow cannot be activated, the editor explains why, and the step is refused if one runs anyway. The same actions still work in workflows started by something that happens on the site.
* An AI Agent is never given those actions as tools.
* The Academy and ZenCommunity steps no longer switch the signed-in user while they run; they act for the user they name.
* MCP access tokens now sign in through WordPress's own authentication filter, the one application passwords use, instead of switching the user inside the endpoint.

= 1.3.2 =
**Security**
* An AI client connected through the MCP server can no longer reach actions that administer the site: activating or deactivating plugins, creating, changing or deleting users, changing roles and capabilities, and changing site options. It cannot add them to a workflow, or read, edit, activate, test or run a workflow that uses them.

**Fixed**
* Conditions, filters and a few triggers no longer call string functions that need PHP 8, so Zaplane runs on PHP 7.4 as declared.
* Workflow steps now run when Action Scheduler is processed from WP-CLI, as many hosts do from a system cron. Before, every queued step failed there.

= 1.3.1 =
**Security and privacy**
* Removed the Switch Theme and Authenticate User actions. Which theme a site runs, and signing in, are the site owner's own decisions.
* Create, Update and Delete User now accept only the fields their form offers and a role the site defines, and refuse to delete the last administrator or the account the run is using.
* Incoming webhook and Catch Webhook URLs check the provider's signature, or the trigger's shared secret, before the request reaches the workflow.
* The workflow query builder now refuses any table, column, operator or sort direction that is not a plain name, and every value it sends is a placeholder filled in by WordPress.
* The admin palette, the integrations catalogue and the MCP consent screen are escaped on the way out.
* Documented the Telegram API address and the links to claude.ai and ChatGPT under External services.

**Fixed**
* Lists of courses, quizzes, ranks and achievements are read through WordPress instead of the posts table directly.
* Fixed selecting a specific set of columns — a "get this field for every row" query returned nothing.

= 1.3.0 =
**Workflows**
* A workflow can start from more than one trigger. Whichever fires starts the run, and `{{trigger.*}}` reads its data.
* Connecting steps is easier: drop a line anywhere on a step's card, and letting go on empty canvas opens the step picker.

**Recipes**
* Group recipes set up several workflows at once in a new folder, starting with WooCommerce Customer Lifecycle and StoreEngine Store Emails.
* Every recipe opens a setup for its optional steps, settings and connections. Plugins can register recipes as simple arrays.

**AI**
* The AI, AI Agent and Generate Image steps use the WordPress AI Client when it is available in core, including the agent's tool calling. Your own provider key is still an option.

**AI access (MCP server)**
* claude.ai and ChatGPT can connect through OAuth, with administrator approval. WordPress application passwords also work.
* Tool calls are logged, tokens can expire, and run tokens can be limited to chosen workflows.

**Security and compatibility**
* Merge tags are no longer evaluated as PHP, and outbound requests are checked on every redirect.
* MCP tokens now act as their own user and require administrator rights.
* Updates come only from WordPress.org. WordPress 6.8 or later is required.

**Fixes**
* GemCRM Send Email now reaches only the chosen contact or list.
* Fixed shipped recipes' Send Email steps, duplicate recipes after a rename, fields with hyphens, forms watched by two triggers, and Logs Re-Try.

= 1.2.0 =
**New integrations**
* aBlocks — a Form Submitted trigger for aBlocks form-builder forms.
* FluentCart — 21 new triggers and 52 new actions across carts, coupons, licences, customers, orders, products and subscriptions.

**AI access (MCP server)**
* Let Claude, Cursor or any Model Context Protocol client read your automations and build new ones from a plain-language description. Off by default, behind scoped and revocable tokens.

**Modules**
* Optional features are now opt-in and switched off on a fresh install. Existing sites keep whatever they had.
* A card on the Workflows, Dashboard and Connections screens lists what you have not turned on, with a one-click switch. Picking a step whose module is off now says so in the builder and offers to enable it there.

**Workflow canvas**
* Nodes are colour-typed as trigger, action, tool or AI, on the card and on the connector leaving it, so a glance shows what feeds what.
* Node cards now sit on a canvas of their own colour instead of sharing it, connectors draw a single stroke instead of three, and the delete control is a real, keyboard-reachable button.

**Appearance**
* The dark theme was rebuilt for legibility — secondary text and button labels previously fell below the accessible contrast minimum.
* The dashboard chart now follows your palette instead of fixed light-mode colours.

**Performance**
* The admin bundle drops from 23.8 MB to 1.6 MB.

**Removed**
* The Dokan "Withdraw Request Pending" and FluentCart "Order Paid Done" triggers. A workflow still using either will need its trigger re-selected.

= 1.1.0 =
**New integrations**
* StoreEngine — order, subscription and product triggers plus actions.
* AI (Chat Model) — generate replies with Anthropic, OpenAI, or WordPress Core AI.
* AI Agent — autonomous tool-calling agent with Chat Model, Memory and Tools sub-nodes, plus MCP server support.
* Conversation Memory — durable, keyed chat history for AI conversations.
* Business Knowledge — a searchable knowledge base the AI Agent can query; sync from StoreEngine products.
* Custom Apps — build your own integrations (REST or same-site WordPress hooks) without code changes.
* Webhook — a dedicated app for both directions: Catch Webhook (incoming) and Send Webhook (outgoing) with optional HMAC-SHA256 signing.
* Messenger and WhatsApp — AI auto-reply flows.
* Academy — course enrolment triggers, actions and access-group membership.

**New tools & flow control**
* Manual Trigger, Schedule trigger, and Human-in-the-Loop approval.
* Router (multi-branch), Repeater/Iterator, Condition and Filter.
* Utility tools: CSV, XML, JSON Parser, Formatter, Date/Time, Image Helper, Set Variable, and Sticky Note.

**New recipe**
* "AI Reply to Incoming Webhook" — receive a question by webhook, answer it with the AI Agent using your Business Knowledge, then post the reply back out.

**Improvements**
* Dynamic-data "@" token picker across expression fields, with sample outputs so tokens are available before a test run.
* Redesigned Business Knowledge, field, checkbox and connection-icon UI, with icon fallbacks.
* Clearer node port / branch handles and AI Agent sub-node handles on the canvas.

**Fixes**
* AI and AI Agent no longer appear as trigger options where only actions apply.
* Custom Apps: trigger firing, label handling, and the stale generic "Custom App" entry in the app picker.
* Webhook: structured Body fields so multi-line/quoted values (e.g. an AI reply) can't produce malformed JSON.
* Node port, multiple-output, route-indicator, CSV parser, and dynamic-data resolution fixes.

= 1.0.2 =
* Improvements and bug fixes.

= 1.0.0 =
* Initial release.

== Upgrade Notice ==

= 1.4.0 =
Zaplane now exposes its automations as abilities through the WordPress Abilities API; the previous Zaplane-operated MCP server has been removed. The Custom PHP Code step is no longer bundled. Minimum WordPress is 6.8.

= 1.3.3 =
Workflows started by a webhook or an outside service can no longer run actions that administer the site.

= 1.3.2 =
MCP clients can no longer use actions that administer the site, and PHP 7.4 compatibility is fixed.

= 1.3.1 =
Security hardening throughout, and two actions removed: Switch Theme and Authenticate User.

= 1.3.0 =
Adds multiple triggers per workflow, group recipes, WordPress AI Client support and OAuth sign-in for AI clients, and fixes security issues. Requires WordPress 6.8 or later. MCP tokens issued to users without administrator rights stop working.

= 1.2.0 =
Adds aBlocks and FluentCart integrations, an optional MCP server and a rebuilt dark theme. Optional modules are off on new sites. The Dokan "Withdraw Request Pending" and FluentCart "Order Paid Done" triggers were removed; re-select the trigger in any workflow using them.

= 1.1.0 =
Major feature release: StoreEngine, AI Agent (with MCP), AI Chat Model, Memory, Business Knowledge, Custom Apps, a bidirectional Webhook app, and many new tools and flow-control nodes.

= 1.0.2 =
Recommended update with stability improvements and bug fixes.
