Conversation
New pw-auth CLI and dev-login-cli mu-plugin template that generate one-time WP login URLs via WP-CLI and cache Playwright storageState for headless browser automation. Updated all docs with usage, prerequisites, and troubleshooting. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
feat: ship MCP server integration and onboarding docs
…cial Feat/mcp adapter official
- Extended scan_log_delta() grep pattern to detect PHP-FPM segmentation faults (segmentation fault, segfault, core dumped) that would otherwise be missed - These patterns are now caught as alert events and counted in log_alert_count - Improves evidence collection for theme crash diagnosis, complementing HTTP status and wp-die detection
Restructure the README from a technical reference into a marketing-style home page: hero tagline, core features with usage examples at top, MCP server overview and everyday workflows in the middle, security model, and a Hidden Gems section at the bottom surfacing non-obvious capabilities like headless QM profiling, AI triage contracts, and domain-specific pattern detection. https://claude.ai/code/session_0166hobYmJGamoeagjxg72rK
…s.md Adds a planned implementation checklist for the ai-ddtk/update-options ability, covering the core ability registration, a hardcoded blocklist for dangerous keys (siteurl, home, template, stylesheet, active_plugins), the double-confirm UX contract (confirm_dangerous param + error_log), an optional prefix allowlist filter, decision-tree/table updates, and required unit + integration tests. No functional code changes. https://claude.ai/code/session_0166hobYmJGamoeagjxg72rK
… blocklist Adds the ai-ddtk/update-options ability to templates/ai-ddtk-abilities.php: - _ai_ddtk_options_blocklist() helper (filterable via ai_ddtk_options_blocklist) with two-tier safety model: always_refuse (active_plugins, active_sitewide_plugins) and require_confirm (siteurl, home, template, stylesheet, admin_email) - update_option() used for each key so sanitization callbacks fire; no raw SQL - Per-key result objects with previous_value, new_value, changed bool - autoload hint (yes/no/unchanged) passed through to update_option() - confirm_dangerous: true required for require_confirm keys; overrides are written to PHP error_log with user ID and timestamp for audit - dangerous_keys_present flag included in every response Documentation updates (docs/mcp-adapter-abilities.md): - Full Phase 3 API reference section with input/output schema tables and example calls including blocked-key error response - Quick reference table, Rule of Thumb table, and decision tree updated - Phase 3 verify-via-mcp scenario row added - All implemented Phase 3 checklist items checked off Tests (test/test-update-options-ability.php): - 23 standalone PHP unit tests covering: blocklist helper contents, happy-path writes, autoload hint passthrough, always-refused key hard-stop, require-confirm soft-stop, audit log output, and input validation - All 23 tests pass (php test/test-update-options-ability.php exits 0) https://claude.ai/code/session_0166hobYmJGamoeagjxg72rK
…ervices-WzdjN Claude/document mcp services wzdj n into Development
… add integration recipe Addresses 4 review findings from Phase 3 implementation: 1. (High) Safety claims vs implementation mismatch — siteurl/home are now validated via esc_url_raw() + wp_http_validate_url() before update_option(); template/stylesheet are validated against wp_get_themes(). Invalid values are rejected with descriptive errors even when confirm_dangerous is true. 2. (Medium) Contradictory Phase 3 status — updated header from "Status: Planned — no functional code yet" to "Status: Implemented" with cross-reference to the API section. Checklist wording now accurately describes the validation that exists. 3. (Medium) No live integration coverage — added recipes/integration-test-update-options.md with 7 manual test scenarios covering safe writes, always-refused keys, soft-stop, URL validation, theme validation, and autoload hints. 4. (Medium) No post-sanitize key validation — keys that sanitize to empty string are now skipped (not written) and returned in a skipped_keys array. Tests: 31/31 passing (8 new tests for value validation and key sanitization). https://claude.ai/code/session_0166hobYmJGamoeagjxg72rK
- Add tools/valet-site-copy.sh for clone/teardown workflows - Update Valet recipe, CLI reference, README, and AGENTS to point to helper - Record changes in changelog
…tection Addresses two additional review findings: 1. (High) Sensitive values leaked in responses — Added `redact_values: true` input parameter that replaces `previous_value` and `new_value` with "[REDACTED]" in response payloads. Prevents API keys, SMTP creds, and license keys from leaking into MCP transcripts or agent context. 2. (Medium) admin_email not value-validated — Now validated via `sanitize_email()` + `is_email()` alongside existing URL and theme validation. Invalid emails are rejected before `update_option()` runs. Tests: 36/36 passing (5 new: admin_email validation + redaction tests). Docs: input schema table, blocklist tier table, and checklist updated. https://claude.ai/code/session_0166hobYmJGamoeagjxg72rK
…-options-WzdjN feat: Phase 3 — add ai-ddtk/update-options ability with dangerous-key…
….0 and 1.2.0 entries - Remove [Unreleased] section; promote content to dated [1.1.0] block - Add [1.2.0] entry for ai-ddtk/update-options Phase 3 ability - Add concise LLM maintainer rules as HTML comment at top of file - Drop Keep a Changelog reference (diverging from that convention) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…iene Addresses 12 of 20 items from @mrtwebdesign code review (P1-AUDIT-MATT.md): Security & repo hygiene: - Remove committed npx/playwright symlinks, add to .gitignore - Remove stale BACKLOG-DEPRECATED.md and ROADMAP-DEPRECATED.md - Add plaintext password warning to AGENTS.md sensitive data section - Add 1MB Content-Length limit on MCP HTTP transport (413 response) Error handling: - Preserve error cause chain in withResourceError() (index.ts) - Return structured error for missing WPCC binary instead of crash (wpcc.ts) - Guard against undefined site name with actionable message (local-wp.ts) Code quality: - Add JSDoc to regex patterns in allowlist.ts, tmux.ts, wpcc.ts - Fix POSIX compliance: &> to >/dev/null 2>&1 (wp-ajax-test/install.sh) - Add timeout 10 wrap on WP-CLI call (theme-crash-loop.sh) - Add file-existence guard for curl timeout (theme-crash-loop.sh) - Bump MCP server README version 0.6.2 → 0.6.3 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Adds passwordless authentication to wp-ajax-test by reading Playwright auth state files from pw-auth. This eliminates the need for plaintext credentials in temp/auth.json. - New --auth-state flag reads cookies from pw-auth's cached auth state - Filters cookies by target domain, skips expired, verifies wordpress_logged_in_* - --auth-state takes precedence when both --auth and --auth-state are provided - Deprecation warning on --auth pointing users to --auth-state - MCP wp_ajax_test tool gains authState parameter (preferred over auth) - Updated error suggestions to recommend pw-auth workflow - 2 new MCP tests: auth-state precedence + flag-shaped path rejection - README quick start updated to show pw-auth workflow first Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- aiddtk-tmux: use escaped double quotes so $log_file expands correctly for paths with spaces inside tmux's sh -c - wpcc: quote underscore prefix in [[ ]] pattern for clarity Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
noelsaw1
added a commit
that referenced
this pull request
Apr 5, 2026
- Add tools/wp-ajax-test/SPEC.md (complete tool specification) - Add tools/wp-ajax-test/AI-INSTRUCTIONS.md (AI agent guidance) - Design principle: Centralized by default, local copy when needed - AI agents call ~/bin/ai-ddtk/bin/wp-ajax-test directly - Create project wrapper only if customization required - Auto-authentication with nonce/cookie handling - JSON I/O for AI parsing - Batch testing support - Add to ROADMAP.md as opportunity #9 - Update CHANGELOG.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
[1.0.10] - 2026-03-07
Changed
1.0.101.0.10v2.7.2pw-auth loginimmediately before browser automation and rerun with--forceif the one-time login URL expires or auth is staleChanged
1.0.91.0.9WP_ENVIRONMENT_TYPEdefined for browser requests, even if WP-CLI is already running inlocalFixed
pw-authfalse-positive error detection — the Playwright login flow now detects real WordPresswp_die()/ fatal pages using error-page markers and specific fatal messages instead of matching genericnot allowedtext from normal admin markuptemplates/dev-login-cli.phpnow accepts*.testhosts in addition to localhost and*.localWP_CLI::get_runner()->config['user']so wrappers that pass--useras a global WP-CLI flag still resolve the requested user correctly[1.0.8] - 2026-03-07
Added
pw-auth) for passwordless WP admin login in Playwright sessionsbin/pw-authCLI withlogin,status, andclearcommandsstorageStateto./temp/playwright/.auth/<user>.jsonrelative to CWD (12h default, configurable)--wp-cli "local-wp <site>", custom--redirectpaths,--forcere-authadmin.json,editor.json)--site-urlvalidated against WP-CLI login URL origin to catch mismatcheswordpress_logged_in_cookie,/wp-admin/accessibility, error page detectionplaywright-core, temp script file (avoidsnode -eresolution issues), and automaticnpm root -g/NODE_PATHrecovery before failingtemplates/dev-login-cli.php)wp dev login)dev_login_allowed_hostsfilter--format=urlfor clean scripting output,--redirectfor custom landing pagesedit_postscapabilitystr_ends_with()dependency)temp/README.md: Updated Playwright section withpw-authworkflow, CWD storage note, and Playwright auto-resolution guidanceChanged
1.0.81.0.8v2.7.1pw-authauto-attempts global npm-root /NODE_PATHrecovery before falling back to manual export instructionsFixed
pw-authcommand injection — replacedevalwith bash array invocation for WP-CLI command execution;--wp-cli,--user, and--redirectvalues no longer pass through a shell parser.mjs+require()incompatibility — temp Playwright script now uses.jsextension (CJS) sorequire()works correctly--site-urlbase path (not just origin) for/wp-admin/reachability check--redirectdouble-encoding — removedrawurlencode()from CLI side;add_query_arg()handles encoding, PHP$_GETauto-decodes on the receiving endstr_ends_with()withsubstr()in mu-plugin host checktemp/to CWD./temp/playwright/.auth/so each project gets its own cache--site-urlwas unused — now validated against the login URL origin returned by WP-CLI; mismatches fail immediately with a clear errorwp-login.php, no WP error page,wordpress_logged_in_cookie present,/wp-admin/accessible without redirectpw-authnow auto-discoversnpm root -g, appends it toNODE_PATHwithout duplication, re-checksplaywright/playwright-core, and logs the auto-configured path before failing[1.0.7] - 2026-03-06
Added
theme-crash-loop.shworkflow underexperimental/temp/theme-crash-loop/<run-id>/aiddtk-tmuxfor unattended repro/debug loopsChanged
1.0.71.0.7experimental/folder and the initial crash-loop helperFixed
experimental/theme-crash-loop.shnow supports--dry-runeven when the inferred Local site path does not exist yet[1.0.6] - 2026-03-06
Added
aiddtk-tmuxwrapper for resilient AI-agent terminal sessionsbin/aiddtk-tmuxhelper withstart,status,list,send,capture,attach, andstoptemp/logs/tmux/tmuxis not installedtemp/README.mdupdates for tmux log storage and commandsChanged
install.shupdated to v1.0.6tmuxavailabilityaiddtk-tmux1.0.6v2.7.0Fixed