v0.0.34 — reach and honesty

The largest release so far: 47 commits, 25 features, 19 new tabs, and the ability count roughly doubled to 788 across 40 namespaces and 27 groups. Previous releases were single-feature increments.

The theme is reach and honesty — most of the popular plugins a site actually runs can now be driven directly, each behind this plugin's own permission floor, and every ability that cannot do something says why and names the route that works instead.

⚠️ Breaking change — read before updating

Abilities now require administrator rights unless a rule says otherwise. If anyone below administrator drives this site through an AI client — a shop manager running a store, for example — they lose access on update until an administrator grants it.

Two remedies:

• set a rule on the individual ability under User Access, or
• move the site-wide floor with the acrossai_default_ability_capability filter.

This closes a real hole rather than a theoretical one. Measured across the abilities installed on one site: three registered with no permission check at all, two were open to any logged-in subscriber, and one that writes content was open at contributor level. This plugin now decides who may run an ability, whoever registered it, and the answer comes from one place you can see and change.

Setting access could previously remove the lock — choosing "Everyone" replaced an ability's built-in check with one that allowed anybody, so an action that reads as tightening actually opened the door. Access rules now sit on top of a floor that cannot be removed by accident, and when the rule system cannot reach an answer it denies rather than allows.

New tabs

Plus homes for the abilities WPForms and Akismet already ship, which previously landed in no tab and no tool, so nothing could find them.

Safety

Editing a WooCommerce product or order through the generic content tools silently corrupted the store, and no longer does. Writing a price through content/update-cpt-item left the price the shop actually charges on the old value — and saving the product correctly afterwards did not repair it, because WooCommerce sees the meta already changed and never re-derives. Orders were worse: WooCommerce no longer keeps them in the posts table, so the write changed a row nothing reads and was later deleted outright. Both are now refused, naming the ability that does work.

A backup archive anyone can download is a total compromise, and this now checks for it. An archive holds the entire database — every password hash, every stored key, every customer address. Both common backup plugins drop a .htaccess to prevent it; on nginx, IIS and Caddy that file is never read, so the protection is present, looks correct, and does nothing. Check Backup Exposure asks the running web server for the real URL and reports the real status code.

Restoring says plainly that it cannot be undone, and records what the site looked like beforehand so what was given up is visible rather than left to be inferred.

The abilities screen

Integration tabs are now named after the plugin they drive, and abilities registered by other plugins belong to a toolset instead of vanishing into a catch-all. The registration gate is gone, tabs were regrouped into task groups, and deep links to retired tabs fall back to "All".

Housekeeping

The readme's changelog was exceeding WordPress.org's 5,000-word cap and being truncated on import. The complete history now lives in changelog.txt, shipped inside the plugin; the readme carries the recent releases and points there. Nothing was lost — the move was verified byte-for-byte.

@since tags that named versions 0.0.35–0.0.54 now read 0.0.34, the version they actually ship in. Those numbers came from features developed against their own release targets that were bundled into one release instead.

Full changelog: changelog.txt — all 156 entries for this release, and every earlier release in full.

Quality gates: 2985 tests green · PHPCS clean · PHPStan level 8 clean · PHPCompatibility 8.1- clean.