v0.0.23 — 30 new abilities across roles, capabilities, search-replace, site introspection, transients, options, plugin lifecycle, and integrity

Highlights

Three feature spec drops (062, 063, 064) rolled into one release. 30 new abilities across the existing categories plus one new Widgets category. Zero breaking changes.

Feature 062 — Role & capability CRUD + site-wide DB search-replace (8 abilities)

The role/cap surface WordPress core REST does not expose — plus the one bulk operation that no other ability in the plugin walks.

Role & capability CRUD (7 abilities, Users category)

• acrossai/add-role-capability, acrossai/remove-role-capability
• acrossai/create-role, acrossai/delete-role, acrossai/reset-role
• acrossai/add-user-capability, acrossai/remove-user-capability

Guardrails:

• remove-role-capability refuses to strip a WordPress-core administrator baseline capability from the administrator role.
• delete-role refuses on any of the 5 built-in roles AND when the role is still held by any user.
• reset-role accepts only the 5 built-in role slugs (administrator, editor, author, contributor, subscriber).
• remove-user-capability refuses to strip a WordPress-core admin cap from the last remaining administrator.

acrossai/search-replace (Database category)

Site-wide serialized-data-safe string replacement across every WordPress-managed table.

• dry_run: true by default — the ability returns a per-table / per-column match tally without mutating any row. Mutating writes only happen when the caller explicitly passes dry_run: false.
• Table allowlist mirrors the existing Update_Db_Rows.php pattern (validates every input table against SHOW TABLES before scanning).
• Skips wp_posts.guid unless the caller explicitly opts in via include_guids: true — safer default than WP-CLI.
• Recursive maybe_unserialize / maybe_serialize walk keeps serialized meta / options structurally valid.

Feature 063 — Site introspection reads + new Widgets category (11 abilities)

Small single-purpose reads that WordPress does not expose through a public REST endpoint. Every ability is readonly: true, idempotent: true, destructive: false.

• acrossai/get-wp-version (Core)
• acrossai/get-db-prefix (Database)
• acrossai/get-wp-config-constant (FileManager, with 9-constant block-list)
• acrossai/list-theme-mods (Themes)
• acrossai/list-rewrite-rules (Settings)
• acrossai/list-image-sizes (Media)
• acrossai/get-comment-count (Comments)
• acrossai/get-maintenance-mode-status (SiteHealth, with 10-min staleness threshold)
• acrossai/test-wp-cron (Cron, non-blocking probe)
• acrossai/list-widgets, acrossai/list-sidebars — under the new Widgets category (slug acrossai-abilities-manager-widgets)

Guardrails:

• get-wp-config-constant hard-blocks disclosure of AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY, AUTH_SALT, SECURE_AUTH_SALT, LOGGED_IN_SALT, NONCE_SALT, and DB_PASSWORD regardless of the manage_options gate.
• get-maintenance-mode-status uses WordPress core's own 10-minute staleness threshold.
• test-wp-cron fires a single non-blocking wp_remote_get() with a 0.01s timeout so it never hangs a REST response.

Feature 064 — Transient CRUD, nested options, plugin lifecycle & checksum integrity (11 abilities)

Transient CRUD (Cache category, 4 abilities)

• acrossai/get-transient, acrossai/list-transients (paginated, search-filterable, expiry-aware), acrossai/delete-transient, acrossai/delete-expired-transients.

Nested option access (Options category, 2 abilities)

• acrossai/get-nested-option-value, acrossai/patch-option-value — read or mutate one nested key inside a serialized option without round-tripping the whole blob.
• Guarded by Update_Option::BLOCKED_OPTIONS (extracted as a public const on Update_Option in this release so both classes share one authoritative block-list of 21 protected core options).

Post-meta append (Content category, 1 ability)

• acrossai/add-post-meta — WordPress core add_post_meta() semantics with the WP-core unique flag. Complements the existing update / delete post-meta writers.

Plugin lifecycle (Plugins category, 3 abilities)

• acrossai/search-wp-plugin-directory — searches the WordPress.org plugin directory via plugins_api(); short description sanitised via wp_kses_post().
• acrossai/uninstall-plugin — fires the plugin's registered uninstall hook + deletes files via WP core uninstall_plugin(). Refuses on active plugins and on sites with DISALLOW_FILE_MODS.
• acrossai/verify-plugin-checksums — fetches the WordPress.org plugin checksums manifest and compares md5_file() hashes. Per-file status: 'ok' | 'modified' | 'missing' | 'added'.

Core integrity (Core category, 1 ability)

• acrossai/verify-core-checksums — fetches the official api.wordpress.org checksums manifest via wp_remote_get() and compares md5_file() hashes. Same per-file / summary shape as the plugin verify.

Every ability gates on manage_options

Every one of the 30 new abilities uses the literal:

'permission_callback' => static function (): bool {
    return current_user_can( 'manage_options' );
},

Identical to the permission-callback pattern already used by all 219 existing abilities. No cap escalation via filter. No per-ability override.

Testing

204 new PHPUnit test methods on top of the previous 191. Final suite passes across the plugin's PHP 8.1 → 8.5 CI matrix. Every new class file passes PHPStan level 8 and the plugin's PHPCS WPCS strict profile.

No breaking changes

• No ability slug rename.
• No REST endpoint change.
• No option-shape change.
• No new required capability.
• Existing 218 abilities behave identically.
• The Update_Option::BLOCKED_OPTIONS extraction in Feature 064 is a pure move of an inline literal into a public const; behaviour is unchanged.
• Safe upgrade from 0.0.22.

Full Changelog: 0.0.22…0.0.23