Commit Graph
110 Commits
Author SHA1 Message Date
John Smith 23b12d73b9 fix(admin): neutralise core table stretching on History tab ledger 2026-09-05 15:28:55 -04:00
John SmithandClaude e11581e9ef fix(admin): reset .form-table under any EMCP admin form
Belt-and-braces reset for the WordPress core .form-table rules (forms.css /
common.css ship border-collapse: collapse; margin-top: .5em; width: 100%;
clear: both;) which, combined with an inherited flex stretch on the form,
can let the form table pull its parent's height instead of its cells'.

The form-level reset in #4 already nails the form itself; this kills the
table as a candidate for the same kind of stretch. Scoped to .elementor-mcp-admin
so nothing leaks outside admin pages.

Co-Authored-By: Claude <[email protected]>
2026-09-03 13:23:49 -04:00
John SmithandClaude 024e736dd9 fix(admin): belt-and-braces reset for inline forms (anchors height/display)
A wholesale reset on every form inside any EMCP admin page so no ancestor
can stretch it past its content height: min-height: 0 !important,
height: auto !important, display: block. The AI Chat settings page
wrap-only rule from #3 was necessary but not sufficient — the stretch came
from an inherited rule (wp-admin/css/common.css in WP 7.1 uses
form { display:flex; flex-direction:column } combined with the shell's
min-height: calc(100vh - 32px), which resolved the inline form to
~1700 px on a tall page even with the wrap flush.

This scoped override does not affect non-admin pages (the selector is
gated by .elementor-mcp-admin) and is intentionally !important so it
defeats an inherited core style with the same specificity instead of
needing deeper !important chains for every ancestor.

Co-Authored-By: Claude <[email protected]>
2026-09-03 13:20:16 -04:00
John SmithandClaude da48dbe4ff fix(admin): tighten AI Chat settings card so controls don't read as stranded
The AI Chat settings page is one short form; with the shared .tab-content
padding/margin it sat at the top of a tall card and the form rows landed
near the bottom of the visible viewport at 100% zoom — looking like the
controls were dropped below where they should be.

Make the .elementor-mcp-ai-chat wrap flush (transparent bg, no padding/
margin/border) on top of the existing .tab-content card, tighten the h2
and description spacing, and leave the form's existing 650px max-width
alone so the controls sit high in the viewport at any zoom.

Co-Authored-By: Claude <[email protected]>
2026-09-03 13:09:13 -04:00
John Smith 95ca38e591 fix(theme): eliminate dark-on-dark headings, theme postboxes, widefat tables, and form controls
- Broaden CSS custom properties to :root and body shells
- Enforce pure white color (#ffffff) on all h1-h6 headings across all EMCP screens
- Theme WordPress postboxes to dark metal cards (#111116) with dark headers (#16161d) and white titles
- Theme widefat and wp-list-table with dark zebra striping and high-contrast links
- Style all form controls (input, select, textarea) and buttons to Blood & Steel palette
- Elevate description text to readable #a1a1aa and labels to #ffffff
- Remove nested .wrap classes in page-migrate.php and page-memory.php
- Bump EMCP_TOOLS_VERSION to 3.14.5
2026-09-02 23:40:45 -04:00
John Smith b2fb9f0074 fix(layout): eliminate horizontal overflow and admin sidebar drift
- Set display: none on closed emcp-notif-drawer to remove it from layout calculation
- Remove backdrop-filter containing-block trap on .emcp-appbar
- Eliminate legacy negative margins on .elementor-mcp-stats
- Enforce overflow-x: hidden / clip across html, body, #wpwrap, and #wpcontent
- Normalize #wpbody-content to float: none and width: auto
- Bump EMCP_TOOLS_VERSION to 3.14.4
2026-09-02 23:25:57 -04:00
John Smith 1e19fe26b7 fix(theme): improve contrast on low-mode card, AI chat, context preview, and redirects
- Bump EMCP_TOOLS_VERSION to 3.14.3 and use filemtime for instant asset cache-busting
- Add is_emcp_screen helper in class-admin.php to ensure assets enqueue on all submenus
- High-contrast pure white typography and dark metal surface on elementor-mcp-low-mode-card
- High-contrast styling for form-table on AI Chat tab (white labels, readable descriptions, dark inputs)
- Deep obsidian pre/code background with bright monospace text on elementor-mcp-context-preview
- Lock notification drawer with visibility:hidden, opacity:0, and pointer-events:none when closed
- Replace inline #fff styles in page-redirects.php, page-marketplace.php, and page-pro-upsell.php with dark theme cards and tables
2026-09-02 23:12:06 -04:00
John Smith 139b416a11 fix(admin): dock app bar flush to wpadminbar and apply dark canvas theme
- Eliminate 10px light gap between wpadminbar and emcp-appbar
- Reset .wrap.elementor-mcp-admin margins and padding to 0
- Add admin_body_class hook to inject emcp-admin-page emcp-theme-dark
- Paint wpcontent, wpbody-content, and wrap canvas with #09090b Obsidian Void
- Re-theme remaining white sub-cards, filters, disclosures, notices, and footer to dark steel
2026-09-02 22:36:10 -04:00
John Smith 4535bea933 feat(dashboard): remove video guides clutter and EMCP Cloud marketing banners
- Remove Featured video guides section and YouTube tutorial embeds from the dashboard
- Remove EMCP Cloud and Pro marketing sidebar cards from the dashboard
- Remove sticky rotating announcement marquee bar advertising Cloud and LTD
- Remove app-bar Cloud connection nag button
- Refactor Explore your toolkit and Help & resources into clean full-width responsive grids
- Unlock settings sync entitlement and remove paid cloud upgrade prompts
2026-09-02 22:16:55 -04:00
John Smith bb938bdd33 feat(branding): overhaul visual identity to Heretek Blood & Steel theme
- Import Heretek master logo (logo.png) from Heretek-AI/ProxmoxVE
- Generate scaled 96x96 (icon-sm.png) and 32x32 (icon-xs.png) RGBA icons
- Bundle self-hosted Cinzel-Bold.woff2 for offline gothic-tech typography
- Overhaul admin.css and ai-chat.css with dark steel void surfaces and crimson blood accents
- Port signature Heretek graphical effects (machine-icon glow, blood borders, corruption glow, circuit pulse, custom scrollbars)
- Update admin badge to HERETEK UNLOCKED and refresh documentation
2026-09-02 21:57:40 -04:00
Mian Shahzad RazaandClaude Opus 5 bee16487dd feat(oauth): show every client registration, and let an admin remove one
Prompted by a support ticket where a client kept failing with "the return
address this app asked for does not match the one it registered". The server
was right to refuse (RFC 8252 relaxes the PORT for a loopback redirect, never
the path), but the site owner had no way to see the stale registration, let
alone clear it, and nothing on the client side would drop it either.

Connected apps listed only clients holding a live token, because
list_authorized_clients() INNER JOINs the token table. Its own copy admitted
it: "An app that has registered but not finished signing in is not listed."
And Revoke deleted tokens while leaving the registration, which then survived
gc() forever because authorized_at was set.

- list_clients() LEFT JOINs, so a registration with no live token appears.
  Connected rows sort first so the useful ones stay on page 1.
- client_state() names the three cases: connected, signed out (authorized once,
  can sign back in), never signed in.
- delete_client() removes the registration and its tokens together. Tokens
  first: bearer validation reads the token table alone, so one outliving its
  client row would keep working.
- The panel shows each registration's callback under its name, which is the
  field someone comes here to compare against a refused authorization, plus
  status and registration date. Sign out (when connected) and Remove
  (confirm-gated), both manage_options with a per-client nonce. Paged at 20.

Also fixes a silent action: revoke redirected with oauth_revoked=1 but nothing
rendered it, so signing an app out appeared to do nothing. All three outcomes
now show a notice.

Live-verified on msrplugins.test with three seeded registrations: cancelling
the confirm changed nothing, accepting removed the row, and Sign out flipped a
connected app to Signed out while keeping its registration.

Co-Authored-By: Claude Opus 5 <[email protected]>
2026-08-23 21:33:34 +05:00
Mian Shahzad RazaandClaude Opus 5 b7cfe45d58 feat(sandbox): page the Blocks, Widgets and PHP Snippets tables
All three Sandbox screens rendered every artifact in one table, and each row
carries that artifact's source: the snippets table ships every snippet's whole
PHP into the DOM, widgets ship compiled PHP, blocks ship block.json plus
render.php. With 26 snippets the page carried 26 code blocks; paged, page two
carries six.

The stores also asked for a flat posts_per_page 200 with no_found_rows, so a
site past its 200th artifact lost the rest with nothing on screen saying so.

Two bugs a live smoke caught on real data, neither visible to php -l or to a
stubbed test:

- ORDER BY post_modified is not a total order. 26 seeded snippets shared two
  timestamps, and across two pages one row appeared twice while another was
  unreachable: 25 of 26 visible. Fixed with an ID tiebreaker, re-measured at
  26 of 26.
- The out-of-range clamp was dead code. WP_Query::set_found_posts() bails when
  a page comes back empty, so such a page reports found_posts = 0 and a clamp
  testing "total > 0" can never fire in the case it was written for. Confirmed
  against the database: LIMIT 490,5 on a one-row table returns 0. It now
  re-queries page 1, which does carry the total, then lands on the last real
  page.

- class-sandbox-list-query.php: one paged query for all three artifact post
  types, returning a page of IDs plus the real total.
- class-admin-pager.php: the windowed pager, lifted out of page-marketplace.php
  rather than copied three more times. Marketplace now renders through it too,
  so there is one pager to style. An ellipsis no longer stands in for a single
  page, which the inherited version could do.
- The three stores gain list_*_page(); the flat list_*() are untouched, since
  the MCP tools want the whole list in one call.
- Each view shows "Showing 1-20 of 57" above the table and the pager below.

Live-verified on msrplugins.test: page 1 and page 2 render with working links,
row actions and code blocks intact, Prev linking back to the clean URL, and the
Marketplace unchanged at 36 results across 2 pages.

Co-Authored-By: Claude Opus 5 <[email protected]>
2026-08-23 21:32:41 +05:00
Mian Shahzad Raza 697c649bce feat(dashboard): rebuild the Cloud promo as a card, and fill the column
The old Cloud card was three plain bullets and a link, which is why the
artwork existed in the first place. This rebuilds it properly rather than
shipping the artwork: badge with its cloud mark, a two-line headline with
the second line in indigo, the description, three benefit rows each with
a circled icon, a title and a supporting line, dividers between them, and
a full-width call to action. Same dark base and inline SVG as the Pro
card beside it, so the column reads as one thing.

Markup rather than the image because of the column it lives in. The
artwork is 1519px wide and its body text is about 24px there, so at this
~380px width it rendered around 6px: readable as shape, not as sentences.
Markup reflows instead of shrinking, keeps the type sharp at any width,
and keeps the copy translatable. The artwork is now in Promos, where the
rest of the launch collateral lives.

Both cards also grow to fill the column again, so it ends level with the
toolkit panel rather than stopping short. Their content is centred as a
group instead of pinned top and bottom, which is what left a tall empty
band through the middle of the Pro card last time.

Two things caught while checking:

- The full cloud artwork's three connected nodes landed on the
  description and the first benefit row. The decoration is cropped to
  the cloud and its layers, sized to finish above the description.
- The call to action overflowed the card by 28px and was being clipped.
  width:100% is measured before the button's own side padding, and a
  flex column already stretches its children, so the width was both
  redundant and wrong.

Verified geometrically: nothing clips, the decoration clears the copy,
and the column is flush with the toolkit.
2026-08-22 14:25:27 +05:00
Mian Shahzad Raza 9d8c1fe246 feat(dashboard): use the EMCP Cloud artwork, and rebuild the Pro card to match
The Cloud promo was a card assembled from markup: badge, headline, three
benefits and a button. The artwork says all of that already, so it takes
the card's place in the sidebar rather than being rebuilt beside it. The
link wraps the image and the alt text carries the same message for anyone
who cannot see it.

That left the flat violet Pro card sitting under a dark indigo banner,
looking like it belonged to a different plugin, so it is now dark too:
an indigo-on-navy gradient, an indigo badge, chip and button, and inline
SVG decoration. Inline rather than an image, so it stays crisp at any
column width and the copy stays translatable.

Three things fixed while looking at it:

- A decoration path pinned top-right at 220x160 crossed the body copy.
- Both cards grew to fill the column height. That was right when they
  were two stretchy cards; with a fixed-ratio image above it, the Pro
  card grew into a tall empty band. It sizes to its content now.
- The Upgrade button painted violet text on the indigo fill: a leftover
  colour override from the old white button, sitting after the new rules
  and winning the cascade. Only the free build renders that button, so
  it would not have shown up on a Pro site.

Verified both states at 1801px and at 2578px wide.

Note on legibility: the artwork is 1519px wide and its body text is about
24px there, so in this ~378px column it renders around 6px. Readable as a
block of shape and colour, not as sentences. Widening the sidebar from 25
to 30 would help if that matters.
2026-08-22 14:09:53 +05:00
Mian Shahzad Raza 95e8bc39f6 fix(admin): render the saved toast in place instead of moving it there
The confirmation was rendered as an ordinary notice at the top of the
page and lifted into the corner by admin.js, so the browser painted it
top-left first and jumped it bottom-right a frame later. Hiding it until
the script had moved it would have fixed the flash by making the
confirmation depend on the script running at all.

PHP now renders the finished toast, so the first paint is already
bottom-right and nothing moves afterwards. admin.js only adds the
dismissing: close button, auto-hide, and a pause while it is read. If
the script never runs the toast stays until the next page load, which is
the right way round for a confirmation.

Version to 3.14.0-rc4 so the test site gets the new CSS and JS: with
WP_DEBUG off the assets are cache-busted by plugin version alone.
2026-08-22 02:38:30 +05:00
Mian Shahzad RazaandClaude Opus 5 26509908d3 feat(admin): show the settings-saved confirmation as a toast
WordPress puts it in a stack above the page, which shifts the whole screen down
at the moment you have finished with the top of it and are looking at what you
changed. It now appears bottom right, fades after 5 seconds, and pauses if you
hover or focus it.

Only this one notice moves. Everything else stays put: page-history's rollback
conflict warning carries a "Roll back anyway" button, and a decision you have to
act on does not belong in a corner.

Bumped to rc2 because assets are cache-busted by plugin version and WP_DEBUG is
off on the test site, so syncing the files without a version change left the
browser serving the cached rc1 admin.js, which predates this.

Co-Authored-By: Claude Opus 5 <[email protected]>
2026-08-21 07:21:59 +05:00
Mian Shahzad RazaandClaude Opus 5 c4406bd4ae feat(admin): say why a tool cannot be switched on, not just that it is off
Reported from a live site: the Elementor Addons cards showed a greyed-out
toggle, and it took a moment to work out that this meant a missing third-party
plugin rather than a bug or a licensing limit. The explanatory line existed,
but at a glance a disabled toggle reads as broken or not-in-my-plan.

Cards now carry a badge naming the dependency ("Needs Essential Addons for
Elementor"). That needed the requirement as data rather than prose, so 53
hand-written notes became `requires => { name, kind }`. It also collapses 27
translatable strings into 2 and lets a theme dependency read differently from
a plugin one, which the single old phrasing conflated.

All 50 currently-unavailable tools carry a badge, not only the three reported.
The UAE write tool keeps its hand-written note, which varies by which UAE
plugin is present, but records the requirement too: without it, it was the one
unavailable tool on the screen with a note and no badge, sitting directly under
uae-read which had both.

The install shortcut the reporter suggested is deliberately not here. It needs
a verified wordpress.org slug per plugin, and the slugs are where this goes
wrong (UAE Pro is `ultimate-elementor`, the free one is still
`header-footer-elementor`), while several dependencies are not on
wordpress.org at all, so a search link would send people to unrelated results.

Held for 3.14.0 alongside the coming integrations, so the version is unchanged
and the notes sit under an Unreleased heading.

Co-Authored-By: Claude Opus 5 <[email protected]>
2026-08-21 02:52:14 +05:00
Mian Shahzad RazaandClaude Opus 4.8 bee4ab37f6 style(admin): notifications as a slide-in drawer instead of a dropdown
The announcements panel now opens as a right-side drawer with an overlay +
close button (Escape/overlay/close all dismiss), instead of a small dropdown.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-08-11 03:02:25 +05:00
Mian Shahzad RazaandClaude Opus 4.8 a562f7b5b7 style(admin): cloud-icon (not avatar) button + match notif/cloud button height to Get Help
Bell + cloud buttons now share a 42px height with the Get Help pill; the cloud
button shows a dashicons-cloud with the status dot instead of the user avatar.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-08-11 02:43:16 +05:00
Mian Shahzad RazaandClaude Opus 4.8 b5aa0c19f4 feat(admin): header notifications center (Cloud-fed) + cloud/avatar button
Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-08-11 02:39:21 +05:00
Mian Shahzad RazaandClaude Opus 4.8 44e8e57178 style(sandbox): force the Save-all-to-Cloud icon white
Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-08-11 02:03:38 +05:00
Mian Shahzad RazaandClaude Opus 4.8 a83caf640e style(sandbox): brand the "Save all to Cloud" button with plugin styles
Was using WP's loud button-primary blue; now uses the plugin's --mcp-primary
indigo (matching the bulk-save button), via a dedicated .emcp-sb-save-all rule.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-08-11 02:02:46 +05:00
Mian Shahzad RazaandClaude Opus 4.8 416d95b240 feat(memory): pending-proposal count badge on the Memory tab
Surfaces the number of agent-proposed project-memory entries awaiting review as
a native WordPress bubble on the Memory submenu and a red count badge on the
in-page nav, so pending proposals aren't forgotten.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-08-10 02:15:57 +05:00
Mian Shahzad RazaandClaude Opus 4.8 02f449bbde feat(cloud): make Import-bundle + Cloud Library disclosures prominent cards
Both the "Import a bundle" and "Cloud Library" rows were plain
disclosure-triangle text, easy to miss. Restyle both <details> as bordered
cards with a filled summary bar, dashicon, and a right-aligned chevron that
rotates on open (.emcp-sb-disclosure). The Cloud Library gets an accent variant
(purple tint + "Cross-site" pill) since it's the headline cross-site feature.
Flat colors, no gradients. Import summary drops the manual "+" for an upload
dashicon. CSS in admin.css; markup across the 3 sandbox views + the renderer.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-08-04 20:37:17 +05:00
Mian Shahzad RazaandClaude Opus 4.8 afd9816267 feat(admin): full-width permanent promo strip + dual Cloud/Pro banners
- Top announcement bar is now a permanent full-width edge-to-edge strip
  (matches the app-bar breakout); removed the dismiss button + localStorage.
- Dashboard 25% column split into two stacked banners: EMCP Cloud + EMCP Pro.
  The Pro banner shows an upgrade CTA on free installs, or a 'You're on the
  Pro plan' notice when premium.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-08-03 03:04:42 +05:00
Mian Shahzad RazaandClaude Opus 4.8 d12b346226 feat(admin): promo banners + Cloud banner + header cleanup
- Rotating announcement bar above the app bar: EMCP Cloud (always) + a
  limited-time LTD promo (free installs only), auto-rotating with dots +
  dismiss (localStorage). Flat, on-brand.
- 'Explore your toolkit' is now a 75/25 row with a flat EMCP Cloud banner
  (back up / sync / publish) on the right.
- Header: 'Affiliate Program' -> 'Affiliate'; MCP Log moved from the tab nav
  to the app-bar buttons, before History.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-08-03 02:30:55 +05:00
Mian Shahzad RazaandClaude Opus 4.8 62ec793759 style(sandbox): white dashicon on primary marketplace buttons
The dashicon on button-primary CTAs (Publish/Push update) wasn't inheriting
the white text color. Force it white.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-08-03 00:56:30 +05:00
Mian Shahzad RazaandClaude Opus 4.8 12bf54228e style(sandbox): icons on every action button + plugin button styling
Restyle all Sandbox row actions (Activate/Deactivate, Edit, Delete, Export,
Save to Cloud, Publish/View, Push update, View code) to match the plugin's
design tokens (--mcp-* colors, radius) instead of default WP .button, via a
scoped .emcp-sb-actions block in admin.css. Add a dashicon to each button;
Delete gets a danger treatment. Cluster CSS moved from inline into admin.css.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-08-03 00:41:02 +05:00
Mian Shahzad RazaandClaude Opus 4.8 125796d036 fix(admin): style 'Back to Sandbox' as the outlined header button
The pillar pages' back link was a bare text link; make it the outlined
secondary header button (.elementor-mcp-header-btn--secondary) with a
dashicon arrow, matching the top-bar buttons.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-07-26 19:51:24 +05:00
Mian Shahzad RazaandClaude Opus 4.8 dc6689fd57 fix(admin): redesign Sandbox overview as compact navigation cards
Replace the reused dashboard stat-cards (giant number + floating Open button
+ dead space) with proper nav cards: the whole card is one click target with
a hover lift and a sliding arrow, and the count collapses to a compact inline
'N active . M drafts' line. Removes the heavy standalone button the user
disliked and the surrounding white space.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-07-26 19:41:26 +05:00
Mian Shahzad RazaandClaude Opus 4.8 e29edace87 fix(admin): block editor-asset URL helper + Sandbox overview polish
- Sandbox_Store::artifact_url() (uploads URL for a block's editor script/style).
- Sandbox overview: valid Widgets dashicon (dashicons-screenoptions was blank
  as dashicons-admin-widgets, which is not a real dashicon), brand-indigo
  'Open' button (was default WP blue), larger card icon + title, spacing under
  the intro text, explicit 3-up grid.
- Bump pro submodule (block editor script/style registration fix).

Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-07-26 18:19:56 +05:00
Mian Shahzad RazaandClaude Opus 4.8 f1cf3692a6 chore(release): 3.6.5
Claude Desktop skill bundle (one zip per skill) on the Skills page.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-07-25 01:09:05 +05:00
Mian Shahzad Raza d8f965bce7 feat(admin): Dashboard usage cards + grouped Plugins tab (3.5.0 line) 2026-07-18 21:15:55 +05:00
Mian Shahzad Raza 7a96dec1d6 feat(admin): show Pro tool sections on free — disabled, Pro-badged, with an Upgrade link (3.4.3) 2026-07-18 19:13:57 +05:00
Mian Shahzad Raza f5af8f4889 feat(history): delete individual entries + clear all 2026-07-17 00:25:36 +05:00
Mian Shahzad Raza cb08338379 feat: 'Used N times' on template cards + prompt-copy usage ping 2026-07-16 02:27:09 +05:00
Mian Shahzad Raza cc073e27d6 feat: usage widget on plugin dashboard (this-site activity + popular templates) 2026-07-16 02:22:12 +05:00
Mian Shahzad RazaandClaude Opus 4.8 43ececea99 fix(oauth): serve resource-scoped well-known; accurate per-client OAuth setup
- Well-known 404 fix (the real OAuth-breaker): MCP clients request the
  discovery doc with the resource path appended, e.g. /.well-known/
  oauth-protected-resource/wp-json/mcp/emcp-tools-server (RFC 9728 §3.1), not
  just the root. We matched the root path only, so the request real clients
  make 404'd and OAuth discovery silently failed. Now match the root and any
  resource-scoped variant. (Same bug seen breaking a competitor's OAuth.)

- Accurate per-client OAuth setup in the Connection tab: replace the generic
  "paste the URL" with each client's real flow — cmd (Claude Code:
  `claude mcp add … --transport http <url>`), custom-connector UI steps
  (Claude Desktop, Claude.ai, with a one-click deep link), and config-file
  snippets (Cursor mcp.json + one-click, Codex config.toml, Antigravity
  mcp_config.json via mcp-remote). Add Claude.ai as a client. Structured
  `oauth` field in connection_clients() + emcpRenderOAuth cmd/connector/config
  renderer + deep-link builders (cursor:// and claude.ai). Verified in-browser.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-07-15 22:05:07 +05:00
Mian Shahzad RazaandClaude Opus 4.8 04aa143e07 feat(connection): auth-method chooser (OAuth vs App Password) + per-client OAuth steps
Redesign the Connection tab's connect flow around an authentication-method
chooser (two cards): OAuth "Recommended for your setup" (browser sign-in, no
password) and Application password (today's generate-and-paste flow). The
OAuth card is disabled with an explanation when OAuth isn't available (non-
HTTPS / toggle off).

Choosing a method changes the per-client setup shown: OAuth mode drops the
credential step and shows the simple connect command (e.g. `claude mcp add
<name> --transport http <url>`) or connector URL, plus a "sign in when your
browser opens" note; App Password mode keeps the generate-credentials +
config-block flow. Adds a "Connected apps" section (authorized OAuth clients +
Revoke) with a "Manage connected apps" link.

New: per-client `oauth` command templates in connection_clients(); oauthEnabled/
oauthSignin/genFirst localized; admin.js auth-method toggle + emcpRenderOAuth;
auth-card + panel-visibility CSS. Verified in-browser on the test site.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-07-15 22:05:07 +05:00
Mian Shahzad RazaandClaude Opus 4.8 035b1aaead style(dashboard): stack toolkit cards + pin card icon top-right
.emcp-dash-card becomes a column flex; the card icon is absolutely positioned
to the top-right corner.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-07-14 22:24:29 +05:00
Mian Shahzad RazaandClaude Opus 4.8 2e83cb6c89 feat(themes): Spectra File-Generation notice + Themes agent skills
Admin: the Astra + Spectra section shows an actionable warning when
Spectra's separate-file CSS generation is on (stale cached CSS breaks
AI-built pages) — EMCP_Tools_Admin::spectra_file_generation_on() /
spectra_file_generation_notice(), rendered as a generic section notice
in page-tools.php with amber/blue styles in admin.css.

Docs: CLAUDE.md notes the nested skill-catalog discovery and the new
Themes domain skills (emcp-themes + emcp-themes/astra). Bumps the pro
gitlink (skills + nested catalog + notice test).

Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-07-14 00:46:32 +05:00
Mian Shahzad RazaandClaude Opus 4.8 ad56cad097 feat(themes-admin): group Astra + Spectra into one combo section, gate toggles by availability
The Astra theme and its Spectra blocks companion are a combo, so the Tools
tab now shows them under a single "Astra + Spectra" section (the combined
theme_astra_spectra category) instead of two separate cards.

Each tool's toggle is now enabled only when its component is installed and
active — Astra tools require the Astra theme (EMCP_Tools_Admin::astra_available()),
Spectra tools require the Spectra plugin (spectra_available()). When inactive
the toggle is greyed out + disabled (the same treatment Elementor tools get
when Elementor is inactive), with a per-card hint ("Activate the Astra theme
to enable this tool." / "Install & activate the Spectra plugin ...").

- class-admin.php: astra_available()/spectra_available() helpers; merge the
  two categories; per-tool 'available' + 'unavailable_note'; drop stale
  "curated" wording from the Spectra/Astra descriptions.
- page-tools.php: per-tool unavailability (platform gate OR the tool's own
  available flag); render the unavailable hint.
- admin.js: bulk "All"/"None" skip disabled checkboxes so an inactive
  component's toggle can't be flipped.
- admin.css: .elementor-mcp-tool-unavailable-note hint style.

Live-verified on the dev site (Astra + Spectra both active): combined
section present, legacy sections gone, all four tools available=1.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-07-13 23:06:00 +05:00
Mian Shahzad RazaandClaude Opus 4.8 ea58584237 feat(connection): stronger .mcpb credential warning (treat bundle as a secret, #86)
Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-07-12 22:10:16 +05:00
Mian Shahzad RazaandClaude Opus 4.8 60c353bfeb feat(history): admin History tab for the change ledger + one-click rollback
Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-07-12 00:09:20 +05:00
82f1f59145 feat(acf): ACF/ACF PRO integration as 2 dispatcher tools (#76)
Lands the ACF domain from #76 (by @DeibyRo), reworked to a consolidated
2-tool surface and a new admin home.

Surface: instead of 15 individual MCP abilities, the domain registers TWO
dispatcher tools — emcp-tools/acf-read and emcp-tools/acf-write — that expose
15 operations (8 read, 7 write). Each takes { operation, arguments }; calling
with no operation returns a discovery catalog listing that side's operations.
dispatch() gates each call by ACF-6.1+ availability (CPT/tax ops) then the
operation's own capability check — no privilege escalation.

Gating: read-vs-write is at the TOOL level — acf-read and acf-write are the
two toggles (acf-read on, acf-write off by default), enabled/disabled by the
standard filter_disabled_tools mechanism like any other tool. No per-operation
toggles. Seeded by the v14 defaults step (DEFAULTS_VERSION 13 -> 14), which
adds emcp-tools/acf-write to the disabled set and strips any pre-release
per-operation ACF slugs.

Admin: new "Plugins" sub-tab on the Tools screen; the ACF section shows the
two dispatcher toggles, each listing the operations it covers.

Everything else from #76 is preserved: CPT/taxonomy authoring as data via
acf_import_* (no executable PHP), full Pro field support
(repeater/flexible/gallery/group/clone), name->key write resolution, immutable
slugs, no delete operations.

Tests: tests/ harness reworked to the dispatcher model (49 tests — routing,
catalog, permission delegation + the 15 executors). pro/tests
ToolCatalogPlatformTest updated for the Plugins tab. Full suite 928 green;
live-verified end-to-end against ACF 6.8.5, including over the real MCP stdio
transport (acf-read exposed, acf-write hidden while off). Versioned 3.2.1.

Co-Authored-By: DeibyRo <[email protected]>
Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-07-11 17:18:23 +05:00
Mian Shahzad RazaandClaude Opus 4.8 ffbffe2cf9 feat(3.2.0): prompts v2, web_fetch, SSRF guard hardening, asset cache-busting
Rounds out 3.2.0 (unreleased) with the prompt rewrite, the AI Chat's web_fetch
tool, and two fixes that reach beyond either feature.

Prompts screen
- A one-time, dismissible notice explains that the prompt library was rewritten,
  since an upgrader would otherwise just find different cards with no
  explanation. Dismissal is stored per USER, not per site, so one administrator
  clearing it does not hide it from the others; the meta key carries the library
  generation so a future rewrite resurfaces it rather than staying dismissed.
- The Pro "Download v1 Prompts" button moves into the Premium Prompts header
  beside "Sync Library" (it was below fifty cards), and also renders in the
  fetch-error branch so it is never orphaned when the bundle fails to load.

EMCP_Tools_Url_Guard — strict validate() / ip_is_blocked() / resolve_host()
The AI Chat's web_fetch needs an SSRF gate. Rather than ship a second guard
destined to drift, the strict methods are added to the class that has protected
the sideload tools since 1.9.1. is_safe_remote_url()/safe_download() are
untouched, so sideload behaviour is unchanged — but they are weaker by history:
a single gethostbyname() (first A record only, never AAAA), port 8080 allowed,
credentialed URLs allowed. validate() checks EVERY resolved A/AAAA record,
restricts ports to 80/443, rejects user:pass@, and blocks loopback, private,
link-local (incl. 169.254.169.254), CGNAT, multicast and reserved ranges,
including IPv4-mapped IPv6. The injected resolver makes it fully unit-testable.
Migrating sideload onto it is deliberately left as a separate change.

EMCP_Tools_Pro_Loader::asset_version()
Assets were versioned by EMCP_TOOLS_VERSION unless WP_DEBUG was on, so an edited
script or style was served from the browser cache on any non-debug install —
including every customer between releases. Versions are now per-asset mtimes.

Changelogs record prompts v2, the builder-agnostic first line, the Pro v1
archive download, web_fetch and its SSRF posture, and the cache-busting fix.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-07-10 06:40:46 +05:00
Mian Shahzad RazaandClaude Opus 4.8 13e57303f2 feat(prompts): ship v2 prompts + a Pro-gated "Prompts v1" download
The bundled sample prompts move to the v2 format: instead of prescribing an
explicit section-by-section Elementor layout, each prompt hands the AI a style
guide, a design signature (art direction, never layout), section intents,
verbatim content facts, and non-negotiable standards (WCAG 2.1 AA, real
photography, one consistent SVG icon set, builder-native construction,
completeness). The first line selects the page builder, so the same prompt
works for Gutenberg, Bricks, or plain HTML/CSS.

Two fixes behind the v2 shape: a per-prompt design signature (so pages stop
converging on one default composition) and a lead-capture form in every
prompt (these are local businesses).

Prompts screen gains a "Prompts v1 (legacy)" card offering the original 50 as
a zip, for users who prefer the prescriptive style. It renders as its own
section so it still appears when the premium bundle fetch fails, and the
download is streamed by a capability + nonce + license gated admin-post
handler rather than a direct link.

The archive itself ships only in the Pro overlay (pro/assets/); pro-manifest.txt
lists it so the release leak-gate hard-fails should it ever appear in a free
build. Its path anchors exactly, so the shared assets/ dir is unaffected.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-07-10 00:07:48 +05:00
Mian Shahzad RazaandClaude Opus 4.8 cf3e8caefd feat(skills-page): flat CSS for the two-ways callout (+ pro gitlink)
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-07-09 08:21:11 +05:00
Mian Shahzad RazaandClaude Opus 4.8 d3552c5143 feat(admin): move Compact tool mode to Tools tab; retire Low-tools mode
Compact tool mode (dispatcher) is the single 'stay under the client tool
cap' control now, so its toggle moves from the Connection tab to the Tools
tab in place of the old Low-tools card — registered under SETTINGS_GROUP so
it saves with the per-tool grid, which stays interactive (call-tool still
honors the toggles). Low-tools mode is fully retired: the essentials filter
+ get_essential_tool_slugs(), the option registration, the save-time
'paused grid' special case, the stat-count branch, the JS live-preview
handler, and the CSS pause rules are all removed. The Connection tab shows
a pointer to the Tools tab. Uninstaller still cleans the legacy option.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-07-09 08:01:21 +05:00
Mian Shahzad RazaandClaude Opus 4.8 45ad949db5 style(admin): match Help & Support button to the Changelog/Affiliate pills
Restyles .emcp-help-toggle to mirror .emcp-appbar-changelog exactly — full
1px border, 4px radius, 12px/18px padding, 13px/600 text, 6px gap, and a
border-color + text → primary hover (caret included) — instead of the old
full-height, border-left-only, square-cornered look.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-07-08 03:18:25 +05:00