v0.0.13

Highlights

• 31 new abilities across 10 domains (187 → 218 registered). Ships the entire backlog surfaced by the external AI-tool inventory audit. Two new categories: acrossai-abilities-manager-admin-menu (5 abilities) and acrossai-abilities-manager-content-search (11 abilities). Single-item additions land in existing categories.
• Security hardening pass on the 31 new abilities modeled on the aculect-ai-companion reference plugin: per-object capability checks (edit_post / edit_comment / read_post), internal-CPT filters, bounded content previews, SSRF-safe URL handling, input sanitisation sweep (absint(), path-traversal defence, enum whitelisting).
• Media abilities move to a dedicated Media Library tab and Comments abilities move to a dedicated Comments tab (was: Core). Category-header chips on the Library page now indicate which tab each category belongs to.
• Ability gap audit landed under specs/054-ability-gap-audit/ — durable reference matrix of requested-vs-registered abilities.
• wp.org assets — banner (1544×500 and 772×250) and a sixth screenshot committed (previously untracked).

New option-backed data stores (no new database tables)

• acrossai_abilities_manager_lifecycle_log — rolling event log capturing plugin/theme activate/deactivate/update timestamps. Capped at 50 events per key. Events recorded from 0.0.13 forward (no backfill).
• acrossai_abilities_manager_link_suggestions — internal-link suggestion queue backing the 6 content-internal-link-* / content-audit-internal-links abilities. Capped at 500 total suggestions.

Safety highlights

• media-rename-file — refuses filenames with directory separators, null bytes, or leading dots; enforces realpath containment inside the attachment's original upload sub-directory; refuses to clobber existing targets; requires per-attachment edit_post.
• comments-bulk-update — requires manage_options + moderate_comments; caps at 100 comment ids per call; adds per-comment edit_comment OR parent-post edit_post gate.
• content-internal-link-suggestion-apply — requires per-target-post edit_post + edit_others_posts; re-validates the target as same-site at apply time; only mutates on first-occurrence substring match.
• Content search abilities filter results to items the caller has read_post on and hard-block internal WP types (revision, nav_menu_item, custom_css, wp_block, wp_template, etc.).

No breaking changes

No existing ability slug, input schema, output schema, or permission callback is altered. Every previously-registered ability still resolves to the same class.

Ships

• PR #79 — Feature 054 ability gap audit + wp.org assets
• PR #80 — Feature 055 (31 abilities + security hardening + Media/Comments tab moves)
• PR #82 — merge of 055 branch to main