Changelog

Requires FluentCart. Invoices and the other store modules require FluentCart 1.6.4 or later. The agent skills need the free Site Agent plugin (https://gauravtiwari.org/product/site-agent/); Site Agent 0.4 or later serves them to connected agents without an extra install.

• The invoice and quote skills now work straight through a Site Agent MCP connection, in Claude, ChatGPT, Cursor and other MCP clients, with no Python script or local credentials. The agent runs each step with Site Agent's PHP tool.
• With Site Agent 0.4 or later, the skills appear in Site Agent's own skill list as gtfc-invoice and gtfc-quote whenever Custom Invoices and Request a Quote are on, so a connected agent finds them without a download.
• Invoices → Automation links to Site Agent, which is free, explains that agents connected through Site Agent 0.4 or later need no extra install, and still recommends adding the skills for everyday use.
• The bundled script also accepts Site Agent's authenticated URL as a single SITE_AGENT_MCP_URL setting. INSTALL.md in each skill ZIP covers OAuth, Application Passwords and the authenticated URL.

• New AI agent support through Site Agent, a free plugin that connects agents such as Claude, ChatGPT and Cursor to your site. With Site Agent 0.4 or later, a connected agent gets the GT Link Manager skill automatically: it can find, create and update links, set country rules, organize categories and read analytics, using the same checks as the REST API.
• New gtlm_agent() for integrations. It returns every link with the branded short link as url and the destination as target_url, the same shape as link lists. Permanent deletion and analytics changes stay in the dashboard.
• New an AI agents page in the GT Links menu shows what a connected agent can do and how to connect one.
• Improved settings are grouped into cards.

• AI agents through Site Agent
• With Site Agent 0.4 or later (free), any connected agent, such as Claude, ChatGPT or Cursor, gets the Page Blocks skill automatically. It can create draft pages from sections, list and edit the sections on a page, and create, update and render library blocks.
• gt_pb_agent() for integrations. Section markup is always written through WordPress's block serializer, so HTML, CSS and JavaScript with quotes, -- or <script> stay intact.
• Changes to published pages are staged as an autosave unless publishing is requested, and stale reads are refused. Agents cannot turn on PHP execution.
• A new AI agents page in the Page Blocks menu shows what a connected agent can do and how to connect one. The AI Integration settings link to it.

• New WordPress multisite, subfolder and subdomain. Each site keeps its own settings, compiled configuration, and page cache under cache/gt-performance/sites/<id>/, and the shared drop-in picks the site from the host and path before WordPress loads. Network admin screen and wp gt-performance network status|purge|map|defaults.
• New stored compressed copies. Each cached page keeps a gzip copy, and a Brotli copy when PHP has the brotli extension; the drop-in sends the one the browser accepts. Turn it off with "Store compressed copies".
• New "Let LiteSpeed cache pages". On LiteSpeed and OpenLiteSpeed the server keeps and serves the pages GT Performance would cache, tagged per site and URL and purged on every change, with _lscache_vary for signed-in visitors and shoppers. GT Performance steps aside while the LiteSpeed Cache plugin is active.
• New optional server rules (wp gt-performance server-rules add|remove|status|nginx). Apache serves stored pages, compressed copies included, without PHP; Nginx gets a copy-ready snippet; on LiteSpeed the rules switch on the cache lookup and drop campaign parameters such as utm_source from its key. Rules are rewritten when settings change and removed on deactivation.
• Fixed after a plugin update, republishing the drop-in compiled the cache rules before the store integrations had registered, so cart and session cookies of WooCommerce, Easy Digital Downloads, and FluentCart could be missing from the drop-in's rules until settings were next saved. The drop-in now republishes after every module is loaded, and a compile that missed them repeats on the next request.
• Bypass paths written for the site root, such as /wp-admin/ or /account/, also cover the same paths below a subfolder site.

• Fixed OAuth sign-in failed with "Sorry, you are not allowed to access this page" in clients that add their parameters to the authorization address with a second ?, such as Grok. The authorization endpoint is now /wp-json/site-agent/v1/oauth/authorize, which has no query string and forwards to the consent screen.
• The old consent address repairs such requests, so clients that saved it earlier also connect.

• OAuth connections are on by default. Sites that never changed the setting get them as soon as Site Agent is enabled; a site that turned them off keeps its choice.
• Tools → Site Agent leads with connecting through OAuth and moves Application Passwords to a "not recommended" section with a warning. It also warns when OAuth is off, when URL authentication is on, and when Application Passwords made tool calls in the last 30 days.
• site-context reports how the connection authenticated. For an Application Password or an authenticated URL it carries a warning that agents pass on, asking the user to reconnect with OAuth.
• Tools → Site Agent lists the plugins that give agents their own skill (GT Extensions for FluentCart, GT Page Blocks Builder and GT Link Manager) and shows which are active on the site.
• Fixed list-skills showed plugin skill descriptions with their YAML quotes.

• New opt-in OAuth 2.1 connections. Turn on "OAuth connections" in Tools → Site Agent, then add the endpoint to an OAuth-capable client (Claude, ChatGPT and others) with no credentials. The client finds the sign-in through the endpoint's 401 response, registers itself, and sends you to a WordPress consent screen where you allow or deny it and pick the tool groups it may use. PKCE (S256) is required.
• OAuth clients get one-hour access tokens and rotating refresh tokens that end after 30 days without use. Only token hashes are stored, tokens authenticate only the MCP endpoint, reusing a rotated refresh token ends the connection, and connections stop when the approving account loses administrator rights. Revoke connections in Tools → Site Agent; audit history shows OAuth calls with the client name.
• Site Agent uses its own issuer, /wp-json/site-agent/v1/oauth, so it never takes over the site-root OAuth discovery documents that another plugin's OAuth server may serve (Rank Math's MCP server does). Each registered client is stored separately.
• Plugins can add read-only skills to list-skills and get-skill with the site_agent_skills filter. GT Extensions for FluentCart 2.8.3 uses it for its gtfc-invoice and gtfc-quote skills.
• Application Passwords in a header or the authenticated URL keep working unchanged.

• The invoice editor shows the total with tax beside the form and updates it as you type. Issue the invoice from that panel, right under Save your draft. It saves your changes and issues them in one step, and refuses to issue if the total changed while saving. You no longer save the draft first.
• A draft linked to a quote request shows Send proposal in the same place instead. Pick the valid-through date, and the panel saves your prices and emails the proposal for acceptance in one step.
• New AI agent skills for invoices and quotes. Download them under Invoices → Automation as ZIP files for Claude Code and other agents that read SKILL.md folders. They connect through the free Site Agent plugin, save drafts freely, and ask you before issuing an invoice or emailing a customer. The ZIPs contain your site's address and no passwords.
• New gtfc_agent() PHP function for trusted integrations: list, create, update, issue and email invoices, and create, prepare, send and withdraw quote proposals as the signed-in user, with the same checks as the admin screens.
• A proposal that the customer already accepted can no longer be sent again.

### Booking form, manage page and dashboard

• Customer accounts Optionally link customers to WordPress accounts. Logged-in customers have their details filled in and see their bookings in the dashboard without an emailed link ([core_bookings_dashboard]).
• Customer accounts Require login per site or per service, enforced on the server. Create accounts at booking (checkbox or automatic, subscriber by default) without revealing existing accounts.
• Customer accounts Accounts link only after the email is proven (Core Bookings created the account, or the customer confirmed an emailed link), because WordPress lets users change their email without confirmation. "Trust WordPress account emails" is an opt-in for sites that verify emails at registration and never applies after a user changes their email.
• Customer accounts Managers can create, link or unlink a customer's account with a reason. Deleted users are unlinked; privacy export and erasure include the link.
• Customer accounts Where accounts apply (login required, account creation on, or FluentCart), logged-in customers book under their account email; elsewhere they are prefilled and may book for someone else.
• Outgoing webhooks Send booking, payment, customer, session-pack and waitlist events to Zapier, Make, n8n, FluentCRM or any HTTPS address from Settings > Webhooks, in a standard or flat format.
• Outgoing webhooks Requests are signed (Standard Webhooks), limited to public HTTPS addresses, and retried for about two days. Each endpoint has a delivery log with Resend and turns itself off after repeated failures, emailing the admin.
• Outgoing webhooks Payment holds that expire unpaid now appear in the timeline and notify integrations; pack, waitlist and customer changes emit events for developers too.
• Emails Readable statuses ("Awaiting payment") instead of internal codes.
• Emails An editable email per event (confirmed, awaiting payment, request received, approved, declined, rescheduled with the previous time, cancelled, refunded, balance paid), each able to follow the general template.
• Emails Calendar (.ics) files attached to confirmations and reschedules.
• Emails Optional staff and admin emails for new, cancelled and rescheduled bookings; approval and calendar-conflict emails include booking details.
• Emails From name, From address and Reply-To settings. Waitlist and session-pack emails use the selected delivery provider.
• Emails Completed and no-show updates no longer email the customer.
• Emails Starts on the first bookable date, respects notice and horizon, lists common timezones first, shows the hold time and the amount on the payment button, and marks errors on their fields.
• Emails Optional phone and notes fields and a per-service booking policy saved with each booking.
• Emails Customers can add a cancellation reason and release an unpaid hold; change and cancel buttons hide inside the cutoff.
• Emails The dashboard has Upcoming and Past tabs, editable profile fields, session-expiry notice, and only offers "Book again" for bookable services.
• Emails The standalone page uses the site logo, shows the amount due and lists only active hosts.
• Workspace Add phone and walk-in appointments, with an optional customer email, recorded payment, or an override with a reason.
• Workspace Reopen completed or no-show appointments, confirm a payment-review booking after checking the provider, reschedule from available times, resend confirmations, edit customer contact details and copy the manage link.
• Workspace Filter by staff, date range and any status; upcoming views list the next appointment first. CSV export follows the filters with fuller columns.
• Workspace Group sessions, date-specific hours and FluentCart extras are edited as rows, with weekly repeats.
• Workspace Customers list linked account, bookings, next appointment and credits; rosters get a session picker, capacity, CSV and print; the waitlist shows service and staff.
• Workspace Remove saved credentials, copy webhook and redirect addresses, 18 more currencies, and optional customer details in staff Google events.
• Workspace Setup checks cover the background worker, its schedule, the encryption key, FluentCart and the Stripe publishable key. Operations shows readable names, and old finished records are cleaned up after 30 days.
• Fixes Refunds on confirmed bookings no longer drop pending reminders (Stripe and FluentCart).
• Fixes The background jobs schedule re-creates itself if it goes missing.
• Fixes The refund form stays available after a partial refund.
• Fixes Block text and many interface and validation messages are now translatable; admin muted text meets contrast guidelines.
• Fixes Rate limits can trust your own proxies, and next-slot searches no longer use up booking submissions.
• Fixes Imports and exports keep the new service options and booking contact fields.
• Fixes Privacy export and erasure include booking phone numbers and notes.
• Fixes Webhook address checks cover IPv6 records and pin each request to the checked address; calendar attachments are written to a private temporary folder.
• Fixes A failed database upgrade shows an admin notice and retries instead of stopping the site.

• Take deposits at FluentCart checkout and collect the remaining balance later from the private booking page through a separate FluentCart cart.
• Sell session packs through FluentCart checkout, with activation, expiry, and refund handling matching Stripe packs.
• Read FluentCart refunds per order item: refunding an extra no longer affects the booking, partial appointment refunds record the exact amount, and deposit and balance refunds add up.
• Accept same-site checkout links for balance and pack payments in the booking and customer scripts.
• Give every workspace input, select, and textarea one consistent field style with a visible focus ring; selects keep room for their arrow.
• Use one reason field per operation or payment-event row, shared by its retry and dismiss buttons.
• Lay out the service and staff save bar on one row: change reason, Preview changes, and Save.
• Strip redundant semicolons in the CSS build so the admin skin stays within its 8 KB budget.

• New option to number invoices with FluentCart's invoice numbers. Choose it under Invoices → Invoice appearance → Invoice numbering. An issued invoice and its FluentCart order then show the same number, such as INV-1253, instead of two different numbers. Invoices and store orders share one series, so the next store order takes the number after the invoice.
• The number stays with the invoice when the customer pays in another currency or you edit and reissue it, and a cancelled invoice keeps its number. Invoices issued before you change the option keep their numbers. GT Extensions numbering stays the default.

• Bundle read-only builder skills for Gutenberg, GenerateBlocks, Elementor, Bricks and Divi, with list-skills and get-skill tools, active builders in site-context and the storing builder in get-content.
• Add an opt-in Bricks tools group that serves Bricks 2.4+ abilities on Site Agent's endpoint: Bricks' fast-path tools under their own names, bricks-abilities and run-bricks-ability, with per-password limits, audit history and a PHP execution requirement for Bricks' PHP ability.
• Refuse Elementor, Bricks and Divi layout meta in content writes, because raw writes skip each builder's validation and cache refresh.
• Return the text of the user's autosave from get-content on request, and whether it is newer than the post, so staged edits can be verified and chained.
• Refuse to stage edits to templates and template parts, which core cannot autosave by post ID, with a clear error instead of a REST failure.
• Detect Bricks layouts without an editor mode, GenerateBlocks Pro blocks and GenerateBlocks global styles and conditions.
• Fix the documented default page size of list-terms.