Changelog

• Comments and the reply form are restored in all six regular page templates.
• Long preformatted text wraps, classic image captions are constrained, and floated images are cleared.
• The translation template is bundled, and the languages directory is registered.

Update from 4.11.0 to resolve the submissions-screen error. Existing form and submission records are preserved.

• Empty, malformed, and numeric saved-view keys are handled safely.
• Spam stays in the submissions tabs; old bookmarks redirect correctly.
• Delivery recovery has a clear empty state, contextual task cards, guided outcome confirmation, and guarded retries.
• Form Theme Customizer adds wrapper padding, defaulting to 10px. Zero and CSS spacing values work consistently in the customizer, form preview, and frontend.

It also strengthens calculated prices, login and capacity checks, draft recovery, payment confirmation, fulfillment and refund recovery, attachment ownership, and concurrent editing.

Existing-form authoring API mutations now require the current fingerprint. Historical renewal refunds with missing entitlement terms require administrator reconciliation. Retention remains off by default.

Validated with 619 PHP tests, 75 JavaScript tests, WordPress/database checks, browser authoring, multipart downloads, and lifecycle cleanup checks.

• What's Changed
• Fixed
• Pros & Cons: unreadable in dark mode. The template filled every empty color field with a light hex value (#f0fdf4, #fef2f2 and dark titles) and wrote all eight into the block's inline style. An inline custom property beats the stylesheet, so the token fallbacks in pros-cons.css, which mix the theme's background, text, success and danger colors and already follow dark mode, never ran. In dark mode the list text turned light while the columns stayed near-white: 1.2:1 contrast against the 4.5:1 that WCAG AA asks for. The block now writes only the colors an editor actually chose and leaves out the style attribute when there are none. On a dark theme the columns measure 11.8:1 for text, 7.1:1 or better for titles and 5.9:1 or better for icons. In light mode they look the same as before, except that the pros column takes the theme's success color instead of a fixed green.
• The eight color fields no longer default to those light values, so a newly inserted block doesn't save them into its data. Blocks that already carry one of the old defaults (#f0fdf4, #16a34a, #166534, #fef2f2, #dc2626, #991b1b) are treated as uncustomized and follow the theme too. Any other custom color still applies exactly as set, in both modes.
• Commits
• 2.12.1: Pros & Cons follows the theme into dark mode (95d1665)
• Stats
• Commits: 1
• Changes 9 files changed, 156 insertions(+), 46 deletions(-)
• Plugin Info
• Blocks included: 29
• Requires WordPress: 6.0+
• Requires PHP: 7.4+
• Requires: ACF Pro 6.0+ or Secure Custom Fields
• Installation
• Download acf-blocks-plugin-*.zip from the assets below
• Go to Plugins → Add New → Upload Plugin in WordPress admin
• Upload the zip file and activate

• What's Changed
• Added Content Tools duplicates native posts/pages into drafts with permission checks and a metadata allowlist.
• Added Link Health scans stored public-content links in resumable batches, with safe HTTP checks, cached results, ignore/recheck actions, and CSV export.
• Added Site Activity records a bounded private history of settings, publishing, and plugin/theme changes, with privacy export and anonymization.
• All three modules are disabled by default. Link Health weekly scans are separately opt-in.
• Fixed Component styles render inside the block editor canvas even when generated uploads CSS is unavailable.
• Fixed Protect File blocks, bound URLs, and serialized block settings when replacing or unlinking links.
• Fixed Keep partial scans and concurrent recheck/ignore actions consistent when source content changes.
• Improved Stream filtered CSV exports in one pass, and preserve WordPress update hooks and feed cache invalidation after link edits.
• Fixed Record successful manual, bulk, and automatic plugin/theme updates after their final outcome is known.
• Added Link Health filters for status, source type, and URL/source title, including filtered pagination and CSV export.
• Added Previewed URL replacement and unlinking in individual source posts, with edit permissions, revisions, and concurrent-save protection.
• Improved Live Link Health progress and results, continuous bounded checking while the workspace is open, and 50 link results per page across all sources.
• Fixed Stop requests are honored after an active batch, stopped scans resume their saved cursor, and stale browser requests cannot advance or stop a newer scan.
• Improved Backend branding, local outline icons, consistent form controls, accessible labels, and mobile alignment.
• Improved Color-adaptive SVG admin mark, module back buttons and breadcrumbs, and responsive settings layouts with guidance in a right sidebar.
• Fixed Link Health and Site Activity now include the current module in their breadcrumbs.
• Commits
• Fix v1.7.0 release review regressions (758c341)
• Add Link Health filters and previewed URL editing (7b4d154)
• Fix Link Health live scanning and paginate 50 results (ac664ff)
• Refine listing assets with restrained translucent materials (c815ead)
• Render listing branding with colorful liquid glass materials (36570dd)
• Add colorful listing icon and bento banner (5f83bf1)
• Improve module navigation and responsive settings guidance (3b249eb)
• Correct directory screenshot framing and image formats (f1772b6)
• Polish backend branding, local icons, and form alignment (4677cef)
• Add Content Tools, Link Health, and Site Activity for 1.7.0 (9401ae3)

• What's Changed
• Compatibility Tested up to WordPress 7.1.
• Security Executable snippets require unfiltered_html. Proxy forwarding headers require configured trusted peers, and PWA precaching excludes authenticated/private responses.
• Fixed Components CSS delivery, schema handling of script templates, Gutenberg link suggestions, custom class cleanup, and module enable filters.
• Fixed Redirect cycle detection, cross-domain redirects, import state, retry-safe hit buffering, task deletion races, task validation, and asynchronous admin forms.
• Fixed Content Integrity acceptance baselines, rendered-page assumption scans, analytics detection, and notification retries.
• Improved Protected file storage and migrations, scoped multisite cleanup, settings round trips, admin module organization, and release validation.
• Commits
• Load WordPress compatibility helpers in the PHP 7.4 sanitizer test (ef12159)
• Release 1.6.3: harden storage and restore module workflows (b3d691f)
• docs add Buy Me a Coffee support links to README (8383067)

• A clearer visual and code workflow
• Blank canvas template without theme header/footer, available for classic and block themes.
• Searchable library with previews, sorting, pagination, and clear copy/linked insertion.
• Optional Visual/Code section conversion with retained native markup and safe refusal of ambiguous/dynamic content.
• Element and section copy, cut, and paste with keyboard support and clipboard-failure protection.
• Smoother Auto/Freeform dragging, insertion cues, edge scrolling, and clean gesture cancellation.
• Consistent sidebar width, starter sections, Design/Layers navigation, color controls, and safer draft/rich-text editing.

Validation: 59 WordPress integration tests / 383 assertions on PHP 8.3 and 8.5 locally and on the CI matrix, 9 converter tests, PHP syntax and coding standards, runtime and translation freshness, an HTTP MCP smoke test on disposable WordPress including a real fatal-change rollback, and both release ZIPs.

The companion archive is separate from the installable WordPress ZIP. Site Agent does not implement OAuth.

• PHP file writes, moves and deletes are syntax- and compile-checked, then the site is loaded with WordPress's edit-scrape check and a change that causes a fatal error is reverted.
• Tool errors include the real message and line. PHP execution rejects exit and die and reports wp_die(), indirect exits and fatal errors as tool errors.
• Edits to published, private or scheduled posts are saved as autosaves for review unless a status is passed. Scheduling requires a future date. Titles keep tag-like text and percent sequences.
• Content writes accept terms, featured images, slugs, publish dates and SEO meta. New tools list terms, import media with alt text, update media, and create, delete or move source files; must-use plugins are reachable and credential files are blocked by name.
• Each Application Password can be limited to some tool groups. The audit history records targets, the password used and denied calls. Diagnostics and a Test connection button explain connection failures.
• URL credentials are removed before dispatch, WP-CLI @aliases are rejected, and SITE_AGENT_ALLOW_EXECUTION=false blocks source editing, PHP and WP-CLI.
• Updates use WordPress's Update URI hook, cache failed checks, and keep validated metadata when the store is unreachable during an upgrade. Signed-package verification ships without an enforcing key.

Adds inline documentation to Tools > Site Agent for connecting with an authenticated MCP URL. The guide covers enabling URL authentication, creating a dedicated Application Password, generating and copying the endpoint, credential privacy, revocation, and client compatibility. It shows a site-specific placeholder URL without displaying real credentials.

Validation: 33 WordPress integration tests / 144 assertions, 7 converter tests, PHP syntax and coding standards, runtime and translation freshness, disposable WordPress rendering, and both release ZIPs.

The companion archive is separate from the installable WordPress ZIP. Site Agent does not implement OAuth. ChatGPT web compatibility with credential-bearing URLs has not been verified.

Fixed library creation returning an incorrect ID after cache/integration writes, and guarded newer template-style APIs on WordPress 6.0.

Validated with 186 passing tests (4 optional integration skips), a fresh packaged upgrade rehearsal preserving content/render/library/settings hashes, PHPStan, syntax, and package checks. Requires PHP 8.1 and WordPress 6.0.

• Native visual editing: Edit native WordPress blocks directly in the Page Blocks workspace. Existing code editors, library, AI, performance tools, page settings, drafts, and save-conflict checks remain available.
• Choose Fixed / Auto placement for normal layout flow or Freeform for desktop drag, resize, snapping, guides, and keyboard nudges. Mobile layouts follow block reading order.
• Drop media files onto the canvas to upload through WordPress and insert native media blocks.
• Use a compact Design inspector with property rows, swatches, responsive controls, and alignment icons.
• Keep the toolbar and footer visible; respect the selected block template's content width.
• Section selection automatically activates Visual or Code mode.
• Compatibility: Existing code sections, legacy Page Block names, linked library references, nested blocks, third-party markup, and CSS loading settings remain supported. Stored sections are not automatically converted. Unreleased prototype sections retain their saved HTML/CSS fallback; conversion to native blocks is explicit and undoable.

Enable URL authentication under Tools > Site Agent, save, then use the converter's new Copy authenticated endpoint button. The URL's auth query parameter contains Base64-encoded username and Application Password credentials. Standard and URL-safe Base64 are accepted; the copy action handles URL encoding and existing plain-permalink query parameters.

Authentication uses WordPress's native Application Password validator on every request. Administrator and enabled-tool checks remain enforced; account passwords, invalid/revoked credentials, conflicting identities and unrelated REST routes are rejected. The mode defaults off, respects emergency disable and HTTPS requirements, and marks MCP responses private/no-store.

Base64 is reversible. Credential-bearing URLs may appear in browser history, proxy/server logs or client configuration. Use a dedicated, revocable Application Password and keep the complete URL private. The client must support Streamable HTTP/MCP and preserve the query on each request. This is not an OAuth implementation or a guarantee of compatibility with every client.

Validation: 33 WordPress integration tests / 144 assertions, 7 converter tests, real headerless local HTTP initialization and tool discovery, route isolation, invalid-credential rejection, cache headers, session termination, coding standards and package checks.

Adds the optional Site Agent companion package, with WordPress workflow instructions, the approved icon and a credential-free MCP connection. The companion covers site inspection, raw-content audits, draft preparation, hash-checked edits and the developer tools enabled on the connected WordPress site.

Two separate ZIPs are provided:

Both companion manifests now use version 0.1.3. The compatibility manifest points to the included mcp.json; the standalone ZIP includes the complete GPL license. Packaging validation is part of CI.

Authentication still requires a compatible private connection using a WordPress Application Password and Basic Authorization header. This release does not add OAuth or claim authenticated ChatGPT web connectivity. Existing WordPress functionality, runtime dependencies and access controls are unchanged.

Validation: 24 WordPress integration tests / 106 assertions, 6 converter tests, PHP/JavaScript syntax, coding standards, translation and generated-runtime freshness, companion metadata/reference checks and ZIP verification.

• site-agent-0.1.3.zip: installable WordPress plugin, also delivered through FluentCart automatic updates.
• site-agent-companion-0.1.3.zip: companion package for compatible ChatGPT/Codex hosts. Do not upload this ZIP to WordPress.