*** MCP Content Manager Lite Change Log ***

2026.09.02 - version 1.2.0

= Security =
* Security: hardened the permission checks used across the plugin's abilities and the application authorization flow. Updating is recommended for every site; no configuration change is required afterwards.
* Security: the public /health endpoint no longer reports the exact WordPress and PHP versions to unauthenticated callers. Liveness fields are unchanged, so external monitoring keeps working; the version details are returned to administrators only.

= AI providers (WordPress 7.0+) =
* New: Ollama Cloud and OpenRouter are now real AI providers, not just credential slots. They register with the WordPress AI Client, so a saved API key is paired with a working provider and the connector reports itself as connected — and the models become available to anything on the site that uses the AI Client, not only this plugin's chat.
* Fix: Connectors API — both connectors now declare their plugin association ('file', not 'slug', which core discards) and their constant / environment variable names, so Settings > Connectors reports the real source of each API key instead of always showing it as stored in the database.
* Fix: connector registration now merges with the entry WordPress auto-generates from a registered AI provider, instead of skipping its own registration and losing the logo and plugin association.

2026.04.29 - version 1.1.0

31 new abilities (31 → 62) | 17 new files.

= Sprint 1 — read-only abilities =
* New: Discovery extended (list-post-types, list-taxonomies, list-post-statuses, list-shortcodes, get-permalink-structure).
* New: Site stats (get-site-stats, get-media-stats).
* New: Content shortcuts (list-recent-posts, list-pending-comments, list-scheduled-posts, list-trashed-posts, list-post-revisions).
* New: FSE read-only (list-blocks-registered, list-block-patterns, list-fse-templates metadata).
* New: Menus, widgets and sidebars read-only (list-nav-menus, list-widgets, list-sidebars).
* New: WooCommerce read-only conditional (wc-get-store-info, wc-list-products, wc-list-recent-orders with redaction, wc-list-coupons).
* New: SEO read universal (seo-read-meta with adapters for Yoast, Rank Math, AIOSEO, TSF, SureRank, SEOPress, Slim SEO, Squirrly).
* New: System extended (list-cron-events, list-user-roles).

= Sprint 2 — UX and trust =
* New: Activity Log table, class and admin tab. Retention 30 days, daily cron purge.
* New: OAuth allowed_abilities allowlist column + Permissions class (set/get/is_allowed APIs).
* New: Rate limiting hourly (1000) and daily (10000) per client_id, filterable.
* Tweak: MCP annotations (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) on every ability — existing and new.

= Sprint 3 — Onboarding =
* New: Get Started wizard tab as the first tab.
* New: Connect tab with config exporter for Claude Desktop, ChatGPT, Cursor, Windsurf, Continue, JetBrains AI and curl.
* New: Public /mcpcomal/v1/health endpoint for monitoring tools.

= Sprint 4 — Differentiators =
* New: Multilingual read-only (i18n-list-languages, i18n-list-translations-for-post, i18n-get-post-in-language, i18n-list-string-translations) with adapters for Polylang, WPML and TranslatePress.
* New: Prompts gallery loaded from data/prompts.json (30+ curated prompts) and admin tab.
* New: Spanish translation bundled (es_ES.po/.mo).

= Sprint 5 — Funnel =
* New: Navigable Premium catalog inside the Go Premium tab.
* New: "Detected on this site" badges in Status linking to relevant Premium categories.
* New: Premium hints with per-session throttle (MCPCOMAL_Premium_Hints) — wc-list-recent-orders and seo-read-meta surface a hint once per OAuth session per category, not on every call.

= UI for granular OAuth permissions =
* New: "Permissions" subview inside the Authentication tab. Per-OAuth-client allowlist editor with checkbox tree grouped by area (Core, WooCommerce, Multilingual, SEO).
* New: handle_oauth_actions handler for mcpcomal_save_permissions with nonce protection.

= AI Image Generation (Lite minimal) =
* New: MCPCOMAL_Image_Generator class wrapping Google Gemini generateContent with PNG output and Media Library side-loading.
* New: ability mcpcomal/generate-image — generate 1 to 3 images per call, optional attach_to_post.
* New: ability mcpcomal/set-featured-from-prompt — generate one image and set it as the featured image of a post.
* New: Settings tab subsection for Gemini API key and model. API key stored in option with autoload off; "Remove key" button supported.
* Note: Imagen API, multiple aspect ratios, 2K/4K, image editing with prompts and safety controls remain Premium-only.

= QA =
* New: docs/manual-test-plan-v1.1.md with the human checklist for every sprint area.

= Translations =
* Tweak: Spanish translation expanded from 16 to 90 strings; admin tab labels now run through __().

2026.02.20 - version 2.0.0

 13 new abilities (106 → 119) | 11 new files | 7 modified files

= WP-CLI Bridge =
* New: Check WP-CLI availability and binary path (mcm/check-wpcli).
* New: List all WP-CLI commands with permission status (mcm/list-wpcli-commands).
* New: Execute authorized WP-CLI commands remotely (mcm/execute-wpcli).
* New: Admin settings page with master switch, timeout, and per-command permissions.
* New: Default blocklist with 16 dangerous commands and color-coded danger levels (critical/warning/caution).
* New: Secure execution via proc_open() with timeout, escapeshellarg(), and shell metachar blocking.

= Plugin & Theme Installation =
* New: Install plugins from WordPress.org by slug or from any ZIP URL (mcm/install-plugin).
* New: Install and activate themes from WordPress.org by slug or ZIP URL (mcm/install-theme).
* New: Time Machine snapshot created automatically before each installation.
* New: Options diff after plugin activation — returns new options created by the plugin.

= Expanded Options Whitelist =
* New: +57 readable WordPress options (writing, discussion, media, privacy).
* New: +80 writable WooCommerce options (store address, currency, tax, shipping, accounts, emails, pages).
* New: Automatic flush_rewrite_rules() when permalink_structure changes.

= Premium Plugin Discovery =
* New: Discover options by database prefix pattern (mcm/list-options-by-prefix).
* New: List Settings API registered options by group (mcm/list-registered-settings).
* New: AI-guided post-install configuration using discovered options + Settings API scan.

= AI Image Generation (Google Gemini / Imagen) =
* New: Generate images via Google Gemini or Imagen API (mcm/generate-image).
* New: Two model families supported: Gemini (generateContent) and Imagen (predict).
* New: 10 aspect ratios, 3 sizes (1K/2K/4K), PNG/JPEG output.
* New: Generated images saved directly to Media Library with optional featured image assignment.
* New: Prompt stored as _mcm_gemini_prompt attachment meta.
* New: Admin settings page for API key, model selection, defaults, safety level, and person generation.

= FSE Navigation Management =
* New: List and inspect FSE navigation menus with parsed block items (mcm/list-fse-navigations).
* New: Create FSE navigations with custom links, pages, or terms (mcm/create-fse-navigation).
* New: Update FSE navigations — add/update/remove items, rename, delete (mcm/update-fse-navigation).
* New: Block-aware serialization preserving navigation-link, navigation-submenu, page-list, home-link.

= Theme Customization =
* New: Read theme modifications — custom_logo, colors, background, header text (mcm/get-theme-mod).
* New: Set/remove theme modifications with type sanitization (mcm/set-theme-mod).

= Classic Navigation Menus — Extended =
* New: Create new menus from scratch via mcm/manage-nav-menu action=create.
* New: Assign menus to theme locations via action=assign_location.
* New: Delete menus via action=delete.

= Options Whitelist — Extended =
* New: site_icon added to writable options.
* New: woocommerce_ship_to_countries added to writable options.
* New: Privacy policy texts added to readable options.

= Ability Schema Improvements =
* Tweak: All ability descriptions now prefixed with parameter requirements (No parameters required / All parameters optional / Required: param).
* Tweak: id alias accepted for all entity-specific parameters (product_id, order_id, customer_id, coupon_id).
* Tweak: Removed hard required constraints where id alias provides flexibility.
* Tweak: id alias resolution added to all WooCommerce handler classes.

2026.02.18 - version 1.0.0

* First public release.