Every release,
every story.

find_element returned no identifier you could use

• fix find_element returned no identifier you could use. The compact response built id, admin_label and _path, then filtered out nulls — and two of the three were always null on Divi 5, because admin_label read the Divi-4-only
• fix GreenShift reported version "unknown" on current installs. 8.2.2 added a plugin-header fallback, and it worked, but the directory list was one entry short: the live wp.org directory is greenshift-animation-and-page-build
• change Bricks structural operations now refuse rather than restructure. Bricks stores _bricks_page_content_2 as one flat array where every element carries a parent id and a children list of child id *strings*, not embedded node

A targeted edit re-injected, and restructured, the whole page

• fix A targeted edit re-injected, and restructured, the whole page. update_module and the v2 patcher both persist by re-injecting the full tree through inject_content, which re-ran the Divi 5 section scaffold over it. That sc
• fix A setting sent inside attributes was accepted and ignored. The alias lift only ran over keys at the top level of updates, and attributes is on the reserved list, so updates: {admin_label: "X"} lifted to its canonical pat
• fix admin_label lookups missed every Divi 5 module. The Divi adapter's own finder has known since 2026-07-28 that the label lives at attributes.module.meta.adminLabel.desktop.value; the shared tree utility checked only a fla
• fix apply_builder_patch returned 422 respira_patch_not_persisted on Divi 5. Downstream of the label lookup above, not a save fault: the identifier never resolved to the intended node, so nothing meaningful changed and the no
• fix Reported paths described a page shape that did not exist. build_path_string() labelled by depth, hardcoding depth 0 as sections[] and depth 1 as rows[], so a fullwidth module at depth 1 was announced as rows[0] on a page

include= silently dropped any token it did not recognise

• fix include= silently dropped any token it did not recognise. An unknown token was discarded and the read fell back to basic, so the caller got HTTP 200 and a plausible payload with no sign that part of the request had been
• fix Renewing a lapsed licence never re-enabled the API keys the lapse disabled. The lapse switches keys off from four places; nothing ever switched them back on, so renewal left them dead permanently and the only cure was no
• fix The Builders screen described primary-versus-not-primary in the vocabulary of intelligence-versus-detection. Both columns were ternaries on a string compare against the active builder, because the admin endpoint returned
• fix The Gutenberg-native family reported no intelligence layer. is_intelligence_available() derived its package directory from the builder's display name, so GreenShift went looking for a greenshift-intelligence/ that does n
• fix GreenShift reported "vunknown" on a correctly detected site. The plugin has shipped under at least two names with different version constants. The version now falls back to reading the plugin header, which survives whate
• fix An excerpt sent through the meta bag was written as post meta and rendered nowhere. create_custom_post had accepted an excerpt argument since 3.1.0, but none of the three update paths did, so the only way to set one on a

An authentication failure was reported as "respira/v2 is not available on this site"

• fix An authentication failure was reported as "respira/v2 is not available on this site". The version probe swallowed its own error and fell back to v1, so every failure mode reached you as the same message followed by four
• add excerpt on update_page, update_post and update_custom_post. There was no way to ask for it, so callers put it in meta, where it became a post meta row that reads back perfectly and renders nowhere. The description says a

GreenShift is the 17th supported page builder

• add GreenShift is the 17th supported page builder. GreenShift by Wpsoul (shipping as "GL - Page Builder", still greenshift-blocks/ internally) is Gutenberg-native, so reads, element operations and design tokens work through
• fix Nested blocks were silently dropped when children arrived under a key other than children or innerBlocks. The tree utility walks rows, cols, columns, modules and elements on the read side, so an agent could extract a pag
• fix The activity log recorded a kept write as a failure. A structural write that is applied and deliberately kept but cannot be confirmed on its public route returns stored_unverified with HTTP 502. The audit trail derived i

Updates now succeed on hosts that block PUT at the edge

• fix Updates now succeed on hosts that block PUT at the edge. Managed hosts and WAFs commonly allow GET and POST but reject PUT, PATCH and DELETE before the request ever reaches WordPress. The result was every update failing

wordpress/mcp-adapter now targets ^0.5

• change wordpress/mcp-adapter now targets ^0.5 (was ^0.4, resolving to v0.4.1). Plugins that bundle their own copy of the adapter end up sharing one set of loaded classes, so a plugin requiring 0.5+ (WP Rocket, for one) could fi

The Approvals screen called a kept write a failure

• fix The Approvals screen called a kept write a failure. Approving a structural proposal whose change cannot be seen on its verification route returns stored_unverified: the write was applied and was NOT rolled back, it simpl

The stored_unverified response added in 8.1.7 described itself wrongly

• fix The stored_unverified response added in 8.1.7 described itself wrongly. It returned HTTP 409, which is the status this same method uses for a rolled-back write, and it omitted mutation_performed, the one field that tells

A stored, structurally valid FSE template write was rolled back whenever the verification route could not display it

• fix A stored, structurally valid FSE template write was rolled back whenever the verification route could not display it. Frontend verification falls back to comparing a hash of the whole public page when no verification_mar

A masked API key copied from WP Admin now fails at config load instead of at the first tool call

• fix A masked API key copied from WP Admin now fails at config load instead of at the first tool call. The key shown in WP Admin is masked as respira_5f66e38d followed by bullet characters, and that text is selectable. Copyin

The npm listing now states the real tool counts and shows the current key visual

• change The npm listing now states the real tool counts and shows the current key visual. Three surfaces disagreed: the README said 169 core / 272 with WooCommerce, package.json said 197 / 302, and the canonical source (respira-

Version 8.1.2

• document Corrected the npm README heading from 12 to 16 supported page builders.
• document Added Spectra, Kadence Blocks, GenerateBlocks, and SeedProd to the support table, and corrected the stale Site Editor “Next release” label.

Version 8.1.1

• document Updated the npm package description to name MCP 2026-07-28 and legacy-client compatibility directly.
• document Added the 8.1 release summary to the top of the npm README and corrected the stale “Next release” heading.
• document Included CHANGELOG.md in the npm package so the complete version history ships with every installation.

MCP 2026-07-28 protocol support through the official TypeScript SDK 2 packages

• add MCP 2026-07-28 protocol support through the official TypeScript SDK 2 packages. New clients can negotiate the modern stateless protocol with server/discover, per-request metadata, typed results, server identity, and cach
• add Dual-era stdio serving. Existing MCP clients keep using the established initialize handshake, while compatible clients can pin or negotiate 2026-07-28. Existing Respira configuration, site keys, and connection commands d
• add Release coverage for both protocol generations. The packaged-server smoke test now proves both an exact 2026-07-28 negotiation and the legacy initialization path against the complete tool catalog
• sec Updated Axios, FormData, Sentry, and their OpenTelemetry runtime dependencies to patched releases. The production npm dependency audit reports zero known vulnerabilities.

A Divi 5 settings payload sent to update_element was silently discarded

• fix A Divi 5 settings payload sent to update_element was silently discarded. Every other Divi 5 entry point accepts a settings bag: build_page takes one, and patch_module's merge verb routes it through the translator so keys

update_element could report a different element as the result of your edit

• fix update_element could report a different element as the result of your edit. After writing, it re-extracted the page and read the result back by *position*, trusting the post-save tree to index exactly like the pre-edit o

Playbooks could be created but never corrected

• fix Playbooks could be created but never corrected. The connector exposed only list and create, so a mistyped step, a wrong template reference or an abandoned experiment was permanent: there was no way to read a playbook bac

Divi 5 patch_module could never resolve a node, at any depth

• fix Divi 5 patch_module could never resolve a node, at any depth. The lookup bound its result with $out = &$block, which in PHP is a reference *rebind* rather than a value assignment: it detaches the local variable from the
• fix Playbook steps no longer fail with respira_scope_denied. The executor runs each step as its own internal request, and that request was seeded with a key carrying no permissions at all, so every route guarded by a v2 scop

The connection screen was handing out an endpoint that does not exist

• fix The connection screen was handing out an endpoint that does not exist. The setup and settings screens told you to point your agent at https://yoursite.com/?respira=mcp, including inside the copyable npx add-mcp one-liner
• fix The API key panel now shows a rotated key and names it after the agent it belongs to. Rotating a key called the mint function without passing the agent's name, so every rotation produced a row literally called "first key
• change A stale admin bundle now fails the build instead of shipping silently. The plugin admin is compiled from admin/assets/v71/src/**.jsx into one committed bundle, and the release zip ships that bundle rather than the source

bulk_pages_operation's find_and_replace no longer corrupts escape sequences in post content

• fix bulk_pages_operation's find_and_replace no longer corrupts escape sequences in post content. The bulk write path called wp_update_post() directly without wp_slash() first, so WordPress's own unslashing step silently ate
• fix respira_update_option no longer 404s on option names containing a dot (e.g. litespeed.conf.optm-css_min). The write, read, and delete REST routes share one URL pattern, and that pattern didn't allow periods in the option
• fix create_menu_item with object_type: "page" (or any post type/taxonomy) now produces menu items that actually navigate. The menu item was stored with an invalid _menu_item_type value (the raw object slug instead of WordPre
• fix Oxygen style writes (color, background-color, etc.) to global Theme Builder templates now actually persist and render. The style-key lift that nests these properties under options.original (where Oxygen's renderer reads
• fix A patch with an explicit path no longer silently writes to a different element. When a path failed to resolve, the node finder fell back to matching on type, which returns the FIRST node of that type on the page. A targe
• fix Divi accepts the slash-form paths its own tools emit. apply_builder_patch calls carrying a path like /0/1/0/0/0 died in the path parser before reaching the writer, so the edit never happened even though the call reported

Safety & Security scanning for connected WordPress sites

• add Safety & Security scanning for connected WordPress sites. The read-only audit reports authoritative WordPress, WooCommerce, and reviewed extension versions; official core checksums; administrators; standard and must-use
• add Reviewed wp2shell evidence. Exact public-exploit account and plugin markers are separated from lower-confidence database and filesystem observations. The scanner inspects bounded oEmbed, customize changeset, navigation-o
• add Database and configuration posture. Receipts normalize the current database account's global FILE capability to available, absent, or not verifiable without exposing raw grants. DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS
• add Approval-gated core security updates. Only catalog-approved patch targets on the running release branch are accepted. A recoverable-backup confirmation and second approval are required, followed by version, REST, fronten
• sec Broad SQL cleanup, automatic account deletion, and automatic plugin/file removal remain prohibited. Suspicious artifacts are evidence for owner review, not permission to destroy data.
• sec Audit receipts bind evidence to canonical target URLs and a site fingerprint, reject wrong-site results, expose truncation, and distinguish WordPress-visible evidence from host-only gaps.

Divi 5 text modules silently ignored body content

• fix Divi 5 text modules silently ignored body content. An update_module / apply_builder_patch call carrying content on a divi/text module reported success but never wrote the text, unless the module already happened to carry
• fix Partial attribute patches destroyed neighbouring attributes. Writing a nested attribute such as title.decoration.font replaced the entire title group, taking title.innerContent (the heading text) with it, while still ret
• fix batch_update diverged from every other writer on Divi. It routed through the generic patch builder, which replaces whole attribute groups and applies no Divi 5 translation, so flat keys never reached the paths the builde
• fix admin_label could never resolve on Divi 5. The label is stored at module.meta.adminLabel.desktop.value, but the resolver only read the flat admin_label key that exists on Divi 4 nodes, so the selector always returned res

The FSE writer gate now says how to turn it on, in the error message itself

• fix The FSE writer gate now says how to turn it on, in the error message itself. The respira_fse_writer_beta_disabled response already carried an enable_with hint in its data payload, but many MCP clients surface only messag
• fix build_page now actually halts on a Bricks page that references a global class ID absent from the live registry. The registry-verification added in 8.0.3 was gated on a flag that build_page always set the wrong way, so a
• fix Duplicate Bricks global class names are rejected instead of silently accepted. create_bricks_global_class (and update) now refuses an exact name collision with a 409 naming the existing ID, so two classes can no longer s
• fix An unmapped Bricks global-class setting key is now flagged. create_bricks_global_class (and update) checks each key against every Bricks element's real control schema and returns an unmapped_keys array for anything that
• fix HTML-to-Bricks conversion no longer writes Elementor-shaped keys into Bricks elements. Background colour, text colour, and typography properties (font family/size/weight, line height, letter spacing, text transform/decor
• fix Design-token re-import distinguishes "already imported" from "ignored your new value." Changing a token's value and re-importing previously reported the same "variable already exists" skip reason as a true no-op re-impor

Receipts are bound to the measured site

• sec Receipts are bound to the measured site. Security audits now return canonical WordPress target URLs and multisite context, allowing the dashboard and assistants to reject evidence from the wrong connected site
• sec Bounded coverage is explicit. Executable-file scans return partial after a time, file, or result limit, and known Breakdance generated-cache paths are labeled as observations whose contents were not independently verifie
• sec Account hygiene is visible without exposing secrets. Administrator session counts and supported 2FA provider signals are included while tokens, recovery codes, passwords, salts, and secret values remain excluded

Security audits report multisite activation truthfully

• fix Security audits report multisite activation truthfully. Network-active plugins are now recognized alongside per-site and must-use plugins, and every inventory row includes its activation scope

approval_token is now declared in the input schema of every tool that requires it

• fix approval_token is now declared in the input schema of every tool that requires it. 11 destructive tools (delete_post, delete_comment, delete_term, delete_option, bulk_pages_operation, and the site-pattern/site-navigation
• fix respira_acf_* tools now honor a per-call site_id override. Same root cause as the Bricks/Elementor fix shipped in 8.0.3, just never applied to the ACF branch: the dynamic-dispatch path used the globally active site inste

Bundled skills now match the public catalog

• fix Bundled skills now match the public catalog. content-portability, site-onboarding, woo-agent-storefront, and woo-catalog-perfection were live on the respira.press marketplace and installable straight from GitHub, but mis

respira_redeem_token now merges sites instead of replacing them

• fix respira_redeem_token now merges sites instead of replacing them. Redeeming a per-site-scoped token (the dashboard's "Set up assistant" link for one specific site) legitimately carries only that one site. The write to ~/.

site_id is now honoured on every Bricks and Elementor tool

• fix site_id is now honoured on every Bricks and Elementor tool. Every tool handled in the main dispatch switch already resolved a per-call site_id override correctly. The Bricks and Elementor tools that fall through to the d

Core integrity evidence excludes user-managed files

• fix Core integrity evidence excludes user-managed files. Official checksum comparison now excludes wp-content, separates changed, missing, unexpected, and symlinked core files, and bounds unexpected-file discovery to executa

Bricks global classes no longer report success without persisting

• fix Bricks global classes no longer report success without persisting. Class creation reads the authoritative option value, invalidates WordPress's alloptions cache, verifies the new ID and every prior ID after the write, an
• fix HTML-to-Bricks conversion preserves the expensive parts of the design. Source classes now use Bricks' _cssClasses, CSS Grid templates, grouped padding/margin, absolute offsets, and gaps map to native controls, and inline
• fix Unsupported color-mix() degrades honestly. Functional colors inside border shorthand remain intact during parsing, are omitted before Bricks validation instead of aborting the import, and produce a visible warning with a

Read-only security audit endpoint

• add Read-only security audit endpoint. Adds the bounded /wp-json/respira/v1/security/audit capability used by the Safety & Security dashboard to inspect authoritative WordPress and WooCommerce versions, core checksums, admin
• add Approval-gated WordPress security updates. Adds exact, catalog-approved core patch updates with backup confirmation, two-step approval, and post-update version, REST, frontend, and checksum verification

OAuth discovery no longer depends on /.well-known/

• fix OAuth discovery no longer depends on /.well-known/. RFC 9728 clients look for the protected-resource document at {site}/.well-known/oauth-protected-resource. SiteGround, and most managed WordPress hosts, reserve /.well-k
• fix The admin header no longer claims "MCP connected" when nothing has connected. It read a static default rather than any live signal, so it showed connected on every install, including sites where no agent had ever called,
• fix The Add-ons screen reported stale tool counts. The WooCommerce card showed 79 tools on a v4.0.0 add-on that ships 105, because the version ladder's top rung was open-ended and 4.0 still satisfied >= 3.1. The same ladder

respira_redeem_token now writes the config where the server will read it

• fix respira_redeem_token now writes the config where the server will read it. The write target was hardcoded to homedir()/.respira/config.json and ignored RESPIRA_CONFIG_FILE. On a plain machine the two agree, which is why t

RESPIRA_CONFIG_FILE now resolves ${HOME}, ~ and %USERPROFILE% itself

• fix RESPIRA_CONFIG_FILE now resolves ${HOME}, ~ and %USERPROFILE% itself. The Cowork MCP config ships "RESPIRA_CONFIG_FILE": "\${HOME}/.respira/config.json", and whether that token gets expanded depends entirely on who launc

wordpress_update_theme_builder_template now advertises and requires confirm_live_edit

• fix wordpress_update_theme_builder_template now advertises and requires confirm_live_edit. Rewriting a Divi global header, footer or body changes every page that uses it and goes live with no approval step, so the plugin ref
• fix upload_media accepts Windows paths and file:// URIs again. A C:\Users\...\photo.jpg path, or any file:// URI, was not recognised as a local file and fell through to the base64 branch, where it decoded to garbage and uplo
• fix Two WordPress installs on the same hostname stay two sites. A site id was derived from the hostname alone, so example.com and example.com/blog both became example-com and the second silently replaced the first: you confi
• fix The handshake that could not shake hands: respira_move_element, respira_reorder_elements, respira_remove_element, respira_duplicate_element and respira_batch_update now expose edit_target (and its editTarget alias) plus
• add First-class FSE template/template-part and Gutenberg design-token tools.
• add Ten Respira-native Site Editor tools for user patterns and block navigation: source-aware pattern discovery, synced/unsynced pattern creation, compact nested navigation traversal, exact block-path updates, stale/wrong-ta

build_mega_menu (Divi)

• add build_mega_menu (Divi). Builds a complete Divi mega menu in one call: a top-level menu item carrying Divi's mega-menu class, each column as a child item, and each link as a grandchild, with an optional assignment to a th
• change Theme Builder write (list / create / update) is confirmed working on Divi 4 as well as Divi 5 — the create path goes through Divi's own theme-builder functions (et_theme_builder_get_theme_builder_post_id, the et_template

Content-based targeting could resolve to a parent/root layout container and silently corrupt it

• fix Content-based targeting could resolve to a parent/root layout container and silently corrupt it. On Elementor pages, an update_module / update_element call whose selector resolved to a section, column, or v4 atomic layou
• fix An empty updates object returned success instead of failing validation. update_element replied success: true, write_was_noop: true when the payload carried no change (which can happen if the tool/MCP layer fails to bind
• add Divi Theme Builder write access. The agent can now discover and edit Divi's global Theme Builder templates (headers, footers, body layouts), not only regular pages. New tools: list_theme_builder_templates (discovery — re
• add WPML translation write access. New tools: get_translations (now a first-class tool), create_translation (creates a translation that JOINS the source's existing translation group — the correct WPML trid + source_language_
• fix Every WPML REST endpoint returned a fatal error. get_translations and duplicate_with_translations registered their permission callback as array( 'Respira_Auth', 'api_key_permission_check' ), but that method lives on Resp
• fix WPML element-type computation. get_translations and duplicate_with_translations built the WPML element type with 'post_' . ltrim($type, 'post_'), which strips *characters* rather than a prefix — turning page into post_ag

PageSpeed errors keep their specific WordPress/upstream code

• fix PageSpeed errors keep their specific WordPress/upstream code. Structured 429 and 5xx responses, proxy HTML responses, and generic HTTP failures now pass through one coded-error path, preserving error envelopes for the ag
• fix Invalid PageSpeed calls stop at schema validation. wordpress_run_pagespeed_audit and wordpress_analyze_pagespeed now require at least one of page_id or url
• fix Transport retries no longer overwrite attempt evidence. npm events now emit an explicit attempt_id; central ingestion deduplicates by attempt rather than logical call id
• change MCP quality reporting now distinguishes task friction from Respira reliability. Expected safety blocks, caller mistakes, customer environment failures, upstream failures, product errors, unknown failures, and incomplete
• change The npm package no longer publishes private repository metadata. The public package continues to link to the Respira website and support page

wordpress_build_mega_menu

• add wordpress_build_mega_menu. Builds a complete native Divi 4 or Divi 5 mega-menu hierarchy in one call, optionally assigning it to a theme location

Divi Theme Builder tools

• add Divi Theme Builder tools. List, create, and update native header, footer, and body templates
• add WPML translation tools. List a post's translations, create a linked translation, and update an existing translation while preserving its translation group

apply_builder_patch on Elementor 4.x atomic widgets now persists AND renders content edits targeted by type + match_content, not only by int

• fix apply_builder_patch on Elementor 4.x atomic widgets now persists AND renders content edits targeted by type + match_content, not only by internal id. The follow-up to 7.5.57 (which made the silent no-op honest): the root

apply_builder_patch (the v2 route) could report success: true with a full applied count while nothing actually persisted to the builder's ca

• fix apply_builder_patch (the v2 route) could report success: true with a full applied count while nothing actually persisted to the builder's canonical storage. On Elementor 4.x atomic widgets the patch applies to the extrac

create_page_duplicate and a full read_page_v2 on a very heavy Elementor page (~73K bytes of _elementor_data) could still time out at 180s

• fix create_page_duplicate and a full read_page_v2 on a very heavy Elementor page (~73K bytes of _elementor_data) could still time out at 180s. A prior partial fix (7.5.15) cut redundant builder-extraction work roughly in hal
• fix inject_builder_content on Beaver Builder could silently write empty stub modules (settings: {"type":"module"}, heading/button text and links gone) when a {"rows":[...]} payload ended up nested one level inside a list ins
• fix Duplicating a page whose postmeta held a serialized object of a since-removed plugin's class (e.g. Link Whisper's Wpil_Model_Link) fataled with a PHP Error, leaving an orphaned, unlinked draft behind. WordPress core's ow
• fix Duplicating a Bricks page didn't regenerate Bricks' own per-post CSS, so the copy could render visually broken (wrong corner-radius, colors, typography) because its CSS was still scoped to the original page's body.page-i
• fix The HTML-to-Elementor converter corrupted unitless line-height values into a fixed pixel size (line-height: 1.2 became 1.2px, crushing text), and **silently collapsed nested CSS Grid layouts into a single full-width colu
• fix batch_update on Oxygen 6 / Breakdance elements reported success but silently didn't persist a design (typography, spacing, layout) update, while the identical edit via a single update_element call worked correctly. batch

A successful ?rest_route= diagnostic fallback is now sticky

• fix A successful ?rest_route= diagnostic fallback is now sticky. Once respira_diagnose_connection proves the fallback works, subsequent calls in the session use it automatically instead of returning to the shadowed pretty /w

Changing a custom post type's author could still remove an unrelated meta description

• fix Changing a custom post type's author could still remove an unrelated meta description. 7.5.54 folded author reassignment into the guarded atomic save for posts, but the custom-post-type update path (update_custom_post) k

Changing a post author could trigger a second, unguarded WordPress save and let SEO/editorial hooks remove an unrelated meta description

• fix Changing a post author could trigger a second, unguarded WordPress save and let SEO/editorial hooks remove an unrelated meta description. Author input is now validated before any write and included in the same guarded wp
• fix Elementor Approve & Apply could be unnecessarily slow and leave its final state unclear. Approval used Elementor's site-wide files_manager->clear_cache() after merging one page, which can spend tens of seconds invalidati

A compact, verifiable result contract for targeted Elementor updates

• add A compact, verifiable result contract for targeted Elementor updates. update_element now returns applied, short before/after hashes and summaries, a bounded list of changed fields, the Elementor native-save trace, and pu
• fix An Elementor write could persist correctly while the public page kept serving stale content or CSS, yet the tool still returned success: true. The adapter intended to use Elementor's document API but tested save_elements

Two WordPress installs on the same hostname but different paths no longer collapse into one site

• fix Two WordPress installs on the same hostname but different paths no longer collapse into one site. Derived identities now include the path and non-default port; unresolved duplicate ids stop startup with a clear configura
• improved Custom Elementor widget guidance uses targeted native edits. Agents are told to read the live third-party widget control schema, find the stable element id, update only changed settings, and verify the result instead of

A native MCP write that timed out in the client and then succeeded on a replay-safe retry looked like one healthy call in the MCP quality da

• fix A native MCP write that timed out in the client and then succeeded on a replay-safe retry looked like one healthy call in the MCP quality dashboard. The durable queue keyed its local row and the central upsert by the sta
• fix Native MCP writes and approvals were classified as reads. Ability IDs such as respira/wordpress-update-element only lost the first namespace prefix during normalization, leaving wordpress_update_element, which did not ma

Divi 4: a row nested inside a column (a "specialty" layout) could lose its specialty structure during from-scratch page generation, leaving

• fix Divi 4: a row nested inside a column (a "specialty" layout) could lose its specialty structure during from-scratch page generation, leaving the section unopenable in the Visual Builder even though the frontend and update

Beaver Builder: build_page could produce a page that renders completely blank while every safety check reported success

• fix Beaver Builder: build_page could produce a page that renders completely blank while every safety check reported success. A typed row node whose columns/cols key held column specs (the documented shape) skipped the mandat
• fix Elementor: editing a widget's children could silently do nothing, and restoring the pre-edit snapshot afterward would not always undo the damage. update_element's generic children update key was never renamed to Elemento

Hosted MCP Beaver Builder injections no longer collapse a real node array into one empty module

• fix Hosted MCP Beaver Builder injections no longer collapse a real node array into one empty module. The hosted tool's object-valued content schema led clients to send the valid round-trip shape {content:[...]}. Beaver's nor

Oxygen 6: editing an element's design (typography, spacing, layout) after it was already built silently dropped almost every property except

• fix Oxygen 6: editing an element's design (typography, spacing, layout) after it was already built silently dropped almost every property except color. update_element's own design update key is a nested bucket (design.typogr

tools/list no longer performs three sequential live site checks

• fix tools/list no longer performs three sequential live site checks. WooCommerce detection, ACF detection, and builder filtering share one cached, two-second-bounded context fetch, avoiding first-handshake disconnects on slo

Bricks append lost a new html element's settings

• fix Bricks append lost a new html element's settings. inject_builder_content in append mode (and build_page) wrote a fresh type: "html" element with its markup stranded under settings.html/settings.content — keys Bricks' rea
• fix Divi 4 corrupted a row nested inside a column. build_divi_shortcodes() emitted a row built as the child of a column with the *same* shortcode tag names (et_pb_row/et_pb_column) as its own parent row. Respira's shortcode
• fix A truncated write could leave a corrupted partial structure behind. update_builder_module() wrote to the database *before* checking whether the save was truncated, so a caught truncation error still left whatever partial
• fix update_module could report success on a write that changed nothing. The response only reflected the absence of a thrown error, never confirming the write actually landed. Ported the same false-success no-op detector upda

Replay-safe writes across both Respira REST and the native MCP endpoint

• add Replay-safe writes across both Respira REST and the native MCP endpoint. Mutations carrying an Idempotency-Key acquire a credential-scoped atomic lock and cache their successful response for ten minutes. A retry with the
• add Timeout-safe native MCP background writes. Every native write schema now accepts _respira_async: true; the call returns a job id immediately, WordPress executes the ability under the original user and key scope through W
• add Native connection self-diagnostic. respira_diagnose_connection reports the real transport mode (independent stateless HTTP POSTs, not a persistent write channel), stable session, PHP limits, plugin/client versions, idemp
• add Durable native MCP quality telemetry. A started event is persisted before ability execution and completed in place afterward, so proxy/PHP terminations show as incomplete instead of disappearing. Delivery runs off the re
• add Write-stage timing for update_element. Responses now separate target resolution, builder detection, before/after snapshots, canonical reads, builder write, cache/verification, and total duration so a slow host can be dis
• change Native MCP sessions now survive stateless POST boundaries. Clients can echo Mcp-Session-Id; clients that do not are correlated through a six-hour credential/user-agent fingerprint stored only inside WordPress. Stable ses

Plugin delete/install/update could fatal with an undefined-function error

• fix Plugin delete/install/update could fatal with an undefined-function error. delete_plugins()/Plugin_Upgrader call WordPress's filesystem-credential functions directly, which a normal wp-admin page load has already bootstr
• fix Divi 5 contact forms lost every custom field. respira_add_form wrote the caller's fields array as a flat attribute on the divi/contact-form module, but Divi 5 renders custom fields from divi/contact-field **child** modul
• fix ACF repeater/flexible-content writes went missing from ACF's own read path. Sending a repeater or flexible-content field through the generic meta parameter on update_page/update_post/update_custom_post/create_custom_post
• fix Bricks header/footer/template content was invisible to search and query tools. Bricks stores that content under one of several possible meta keys depending on the install (_bricks_page_content_2, _bricks_page_header_2, _
• fix Oxygen 6 code blocks stayed empty on the canvas. create_code_block() wrote content under the meta key for the pre-swap element type instead of html_code, the key OxygenElements\HtmlCode actually reads, so the block exist
• fix batch_update validation errors were missing their HTTP status code. A failed element lookup or an unknown operation in a batch returned a WP_Error with no explicit status, which WordPress then defaults to 500 — turning a

Windows absolute paths and file:// URIs work in upload_media

• fix Windows absolute paths and file:// URIs work in upload_media
• fix delete_media now forwards approval_token and force, allowing the approval flow to complete

Interrupted writes are no longer retried as if they were reads

• fix Interrupted writes are no longer retried as if they were reads. Every connector mutation now carries a stable Idempotency-Key. Reads still retry transient 5xx and connection failures, but writes retry only 502/503/504 re
• fix Telemetry delivery survives short network and dashboard outages. Failed batches return to a bounded queue with exponential backoff instead of being discarded. A rejected scoped token is cleared and reminted on the next a
• change Local WordPress API keys no longer authenticate central telemetry. With plugin 7.5.46+, the connector exchanges its local credential inside WordPress for a revocable rp_mcp_* token bound to that licensed site. Local resp
• change Connection-quality events can distinguish retry from sweep. Events now include a per-process-secret HMAC of canonical arguments, stable session/call metadata, transport mode, connector/plugin versions, separate tool and

Every respira_acf_* tool was unreachable

• fix Every respira_acf_* tool was unreachable. normalizeToolName() rewrites respira_* names to wordpress_* before dispatch, but the ACF dispatcher only matched the original names. Normalized ACF names now map back to their re
• fix Dashboard site-token 401s lost their specific reason. Invalid/stale token and inactive-license WP error codes now survive as the thrown error name instead of collapsing into a generic Error telemetry bucket

Eight STAGGS product-configurator tools, bringing the WooCommerce surface to 87 tools

• add Eight STAGGS product-configurator tools, bringing the WooCommerce surface to 87 tools. Agents can inspect configurator status, enable or disable it per product, and read/write allow-listed attribute and plugin state with

WebMCP: WooCommerce add-on v3.2 configurator tools (STAGGS)

• add WebMCP: WooCommerce add-on v3.2 configurator tools (STAGGS). The native connector registry gains 8 tools (configurator status, product enable/disable, attribute items read/write through Carbon Fields, allow-listed plugin

"Get the add-on" led paying customers to a marketing page

• fix "Get the add-on" led paying customers to a marketing page. A customer who purchased a subscription including the WooCommerce Add-on clicked the button in wp-admin and landed on the add-on's marketing page with no downloa

Add-ons screen showed "21 tools" for the WooCommerce add-on regardless of version

• fix Add-ons screen showed "21 tools" for the WooCommerce add-on regardless of version. The badge was hardcoded to the pre-v3.0 surface, so an up-to-date site running add-on v3.1 (79 tools) still advertised 21 in its own admi

Stale launch banners retired

• fix Stale launch banners retired. The "Skills are live" (v4.0.9) and "v5.2.0 Elemental is here" one-off notices computed their 7-day display window from an option stamped on first render, so every fresh install replayed mont

Native connector (WebMCP) support for WooCommerce Add-on v3.1 "Agent-Ready Commerce"

• add Native connector (WebMCP) support for WooCommerce Add-on v3.1 "Agent-Ready Commerce". The plugin's native MCP connector now registers and dispatches the 23 new v3.1 tools: feeds (configure/generate/status/validate/catego

A customer whose free trial had expired had no visible way to enter a newly-purchased license key

• fix A customer whose free trial had expired had no visible way to enter a newly-purchased license key. The license screen only showed the key-entry field when no key was present or the status was inactive; an expired trial k

Native connector (WebMCP/ChatGPT) now surfaces the WooCommerce add-on's full v3.0.1 surface: 56 tools, up from 21

• add Native connector (WebMCP/ChatGPT) now surfaces the WooCommerce add-on's full v3.0.1 surface: 56 tools, up from 21. The 35 additions mirror the MCP server: catalog, pricing, inventory and storefront tools that were previo
• fix Version skew between the plugin and the WooCommerce add-on can no longer advertise tools the add-on can't execute. The 20 tools whose REST routes only exist in add-on v3.0+ are hidden from tools/list when an older add-on

Sites added on the dashboard after connector startup self-heal into the live session

• fix Sites added on the dashboard after connector startup self-heal into the live session. list_sites and switch_site refresh the account inventory, merge missing sites by id/normalized URL, and work under both file config an

23 new WooCommerce tools — Agent-Ready Commerce (79 total, up from 56)

• add 23 new WooCommerce tools — Agent-Ready Commerce (79 total, up from 56). Requires add-on v3.1.0. Product feeds in six formats with a store llms.txt (configure_feed, generate_feed, get_feed_status, validate_feed, set_feed_

35 new WooCommerce tools — the add-on's full commerce surface (56 total, up from 21)

• add 35 new WooCommerce tools — the add-on's full commerce surface (56 total, up from 21). Completes the commerce rollout that began in June; thanks to D.S. for flagging that his MCP client was not seeing the full surface. Ne
• improved A missing /woocommerce/ route now explains itself. When a Woo tool hits a site running an add-on older than the tool, the rest_no_route error is enriched with "update the Respira WooCommerce Add-on (v3.0+)" instead of th

Released 2026-07-16.

• change Released 2026-07-16.
• add Product configurator tools (STAGGS). 8 tools: configurator status, per-product enable/disable, attribute-group listing, option-items read and write (through the STAGGS/Carbon Fields helpers, so storage stays consistent), and an allow-listed
• add "What an agent could do here" card on the Respira ARC screen: eight copyable real prompts covering catalog fixes, pricing previews, cart links, agent-order reporting and storefront design.

Released 2026-07-16.

• change Released 2026-07-16.
• change the Respira ARC screen is light-only and matches the standard wp-admin chrome (the dark variant read as a foreign app and had contrast problems).
• add official platform logos (Google, OpenAI, Meta, Pinterest, TikTok) on the format chips and submit links.
• change the fix-prompt button is smaller ("Fix with AI") with a tooltip explaining what the prompt does and what Respira is.

Released 2026-07-16.

• change Released 2026-07-16.
• add Submit links on the feed table. Each feed row links to the right platform dashboard (Merchant Center, OpenAI merchants, Meta Commerce Manager, Pinterest, TikTok) with a one-line where-to-paste instruction on hover.
• add A quiet footer with credits and links (add-on, ARC, docs, support), and the agent-tools panel links to the full tool list.

Released 2026-07-16.

• change Released 2026-07-16.
• add Fix prompts on the quality card. Every failing readiness check now carries a copy-ready prompt for your AI assistant (Claude, ChatGPT, Cursor). Paste it into an assistant connected through Respira and the agent fixes what the check flags, s
• add Product picker for cart links. Choose products by name (variations grouped under their parent, prices shown) instead of typing product IDs. Large catalogs show the first 200 by name.
• add The page title now carries the Respira ARC wordmark, set in Alan Sans (bundled, no external font requests).

Released 2026-07-16.

• change Released 2026-07-16.
• add a small provenance line under the Respira ARC page title, so a screenshot instantly shows whether the screen is rendered by this add-on or by the free Respira ARC plugin.

Released 2026-07-16. Agent-Ready Commerce: AI assistants can now find, read, and sell from your store. 79 MCP tools (up from 56).

• change Released 2026-07-16. Agent-Ready Commerce: AI assistants can now find, read, and sell from your store. 79 MCP tools (up from 56).
• add Product feeds in six formats. Google Shopping XML (Merchant Center scheduled fetch; Bing accepts the same file), OpenAI/ChatGPT JSONL, Meta CSV, Pinterest CSV, TikTok CSV, and generic CSV, plus a store llms.txt at the site root. Built in th
• add Readiness becomes a fix loop. readiness_fixlist turns the AI-readiness scan into an ordered work queue mapping every failing check to the tool that fixes it; set_image_alt writes the alt text that fails most; update_product gains global_uni
• add Assisted checkout with attribution. create_cart_link builds signed multi-item cart URLs: the shopper's cart fills server-side and lands on your own checkout; tampered signatures are rejected. Orders are attributed via WooCommerce native att
• add Subscriptions, Bookings, Memberships write tools (14). Tested against the real extensions. Status transitions validated against what each extension allows, booking reschedules include a conflict scan, everything is dry-run by default with s
• add Respira ARC admin screen under WooCommerce → Respira ARC: feed URLs with copy buttons, catalog quality score, cart link generator, agent-origin orders, in light and dark admin schemes.

Released 2026-07-16.

• change Released 2026-07-16.
• fix revert_pricing works end to end for the first time. Two defects, both present since the pricing tools shipped in v2.0: the tool passed a numeric snapshot id to the UUID-keyed snapshot store (so the lookup could never match, and the error ob

Released 2026-07-16. The full commerce surface: 56 MCP tools (up from 21). Completes the v3.0 rollout that began in June: the release was built and published then, but the update was never offered to customer sites, which kept stores on the

• change Released 2026-07-16. The full commerce surface: 56 MCP tools (up from 21). Completes the v3.0 rollout that began in June: the release was built and published then, but the update was never offered to customer sites, which kept stores on the
• add 15 commerce tools now reachable over MCP. The catalog, pricing, inventory, and storefront endpoints (advanced product listing, natural-language product search, catalog health, bulk product/price/stock updates, sale scheduling, pricing rollb
• add Brand tools. list/get/create/update/delete-brand REST routes and MCP tools (the abilities existed since 2.2.0; now they're reachable everywhere).
• add Variations and attributes. set_product_attributes (global or custom, creates missing terms), generate_variations (cartesian product, skips existing, capped at 100/call), create_variation, set_variation_gallery (variation image + gallery whe
• add Coupons and customers. list/create/update_coupon (discount types, expiry, usage limits, product/email restrictions) and create/update_customer (billing and shipping addresses; passwords auto-generate and are never returned).
• add Order notes and refunds. add_order_note (private by default), get_order_refunds, and create_order_refund which is DRY-RUN BY DEFAULT: it previews the refund until you pass dry_run: false, and never touches the payment gateway unless refund_

Released 2026-05-27.

• change Released 2026-05-27.
• add Product brand support (product_brand taxonomy). The update-product and create-product abilities now accept brand_ids so an AI can assign or clear brands on a product the same way it already assigns categories and tags. Full CRUD endpoints l
• add Featured-image removal. The update-product ability now accepts image_id. Pass an attachment ID to set; pass 0 or null to remove the featured image. Previously the only image-related field on the response was a read-only URL; agents had no w
• schema Product response shape gains brand_ids, brands, and image_id. image is unchanged.

wp.org review fixes

• change Display name updated to "Inhale: MCP Abilities by Respira" so the author attribution is visible in wp-admin plugin lists. Slug inhale-mcp-abilities is unchanged.
• change Contributors field in readme.txt now lists urbankidro (the wp.org username that owns the plugin) instead of the brand string. The Author header still reads "Respira" so the visible attribution on the directory page is un
• change uninstall.php updated to remove the new primary key, the v0.4.0 migration flag, the canonical compat key, and every legacy key from v0.1.x and v0.2.x. Single-site and multisite sweep.

WordPress.org Plugin Directory submission

• change Canonical option key. v0.2.0+ stores the opted-in list under mcp_adapter_public_abilities — the same key proposed first-party in [WordPress/mcp-adapter#184](https://github.com/WordPress/mcp-adapter/pull/184). A one-shot
• change Brand-aligned chrome. Header with "by respira.press" Baskervville italic subtitle and a tiny version pill in the right-side toolbar. Light and dark themes both render with AA contrast
• change iOS-style toggle in the Status column for fast per-row inhale / exhale, on top of the standard wp-admin bulk-actions pattern
• change Foreign admin notices suppressed on the Inhale settings page only, so the screen stays focused on the one decision it exists to support
• change Hardened uninstall. Removes every option the plugin has ever written, single-site and multisite
• change Plugin Directory readiness pass. ABSPATH guards on every shipped PHP file. Every output escaped. Every state-changing request nonce-verified and capability-gated. No remote calls, no tracking, no obfuscation, no bundled

hardening pass

• change wp_die response code 403 + back link on the settings page permission denial path. Access logs and automated clients now see an authorization failure instead of a generic error
• change Row class escaping normalised: the abilities table's <tr class="…"> attribute is always rendered through esc_attr() instead of conditionally injecting the attribute fragment. No behavioral change, but conforms more stric

first public release

• change Discovers every ability registered via the WordPress Abilities API and lists them in a wp-admin native list table.
• change Standard wp-admin selection + bulk-action UX: row checkboxes are selection; Bulk Actions dropdown plus Apply commits Inhale or Exhale immediately. No save-changes step.
• change Row-hover quick actions for single-ability inhale or exhale.
• change Annotation badges on each ability (read-only, destructive, idempotent) sourced from the ability's declared meta; falls back to heuristic inference from the ability name when the registering plugin didn't tag it.
• change Filter views (All, Inhaled, Read-only, Destructive, Unannotated), a search box that matches across name / source / description, sortable columns, multi-select source filter, client-side pagination (20/50/100/All).
• change Sources summary card above the table listing every plugin or theme that registers abilities, with the count per source and deep-links to each source's wp-admin home.

Zero-touch Cowork onboarding (Open in Cowork)

• change .mcp.json sets RESPIRA_BOOTSTRAP_OK=1 so the npx server boots even without a config file present.
• change Existing RESPIRA_CONFIG_FILE, RESPIRA_AGENT_CLIENT, RESPIRA_AGENT_TRANSPORT env vars unchanged.
• change Version label bumped in plugin.json and README.md.
• change Server companion: [@respira/wordpress-mcp-server@6.11.6](https://github.com/webmyc/respira-wordpress/blob/main/mcp-server/CHANGELOG.md#6116---2026-05-11)
• change Zero-touch design doc: drafted 2026-05-10, shipping Family 3b

unified ~/.respira/config.json flow + connect-site rewrite

• change The skill-documented config shape ({url, apiKey}) crashed the MCP server silently on startup because the server required four fields (id, name, url, apiKey). User saw "MCP server still connecting…" forever.
• change The Cowork form echoed pasted API keys into the chat transcript, contradicting the skill's own privacy promise.
• change .mcp.json points RESPIRA_CONFIG_FILE at ~/.respira/config.json.
• change npm dependency pinned to @respira/wordpress-mcp-server@latest so the server schema fix lands immediately.
• change /respira:connect-site skill rewritten: check for ~/.respira/config.json, point user at the dashboard to download it if missing, restart Cowork, test. Includes a "if startup fails" branch that reads ~/.respira/last-startu
• change README.md and INSTALL.md updated to describe the unified flow.

audience-first README rewrite

• change Edit a page without opening WP admin ("Update the headline on my client's homepage to say 'spring collection arriving'", about thirty seconds end to end)
• change Migrate a client site between page builders (sixteen supported paths, week of work into an afternoon)
• change Audit a site before a client meeting (SEO, AI search visibility, accessibility, mobile, technical debt, WooCommerce, with one-click fixes)
• change Clean up a media library in one pass (alt text, compression, dimensions)
• change Manage ten client sites from one conversation (multi-site context follows the conversation naturally)
• change No code changes.

README accuracy pass: 30 skills

• change 8 slash commands for the most common workflows
• change 30 auto activating skills, broken down as:
• change 1 visual reviewer sub agent that shows what changed after every edit
• change Full access to all 180+ Respira MCP tools through the bundled @respira/wordpress-mcp-server
• change All 12 supported page builders: Elementor, Divi 4, Divi 5, Bricks, Oxygen, Breakdance, Beaver Builder, WPBakery, Flatsome UX Builder, Brizy, Thrive Architect, Gutenberg
• change Restructured "What you get" with the correct skill count.

README hero KV + signup copy accuracy

• change Add the canonical Respira-for-Cowork hero image to the top of the README.
• change Drop the "free Lite tier available" line (Lite is not shipped yet).
• change Restate the trial as Maker, 7 days, no credit card required.
• change Show current version and respira.press/cowork link in the README header.
• change Bump plugin.json to 1.0.7.
• change v1.0.6: bundle 26 skills from agent-skills-wordpress, revert to name=respira (slug validation enforces lowercase).

Self-updater fatal on every WP cron tick. class-updater.php:104 called \Respira_License::get_license_key() which has never existed on the core License class — every site that activated the add-on threw Uncaught Error: Call to undefined meth

• fix Self-updater fatal on every WP cron tick. class-updater.php:104 called \Respira_License::get_license_key() which has never existed on the core License class — every site that activated the add-on threw Uncaught Error: Call to undefined meth

drop keytar, fix whoami after login, unstick terminal, warm welcome

• 3. [@respira/cli 0.1.3](https://www.npmjs.com/package/@respira/cli)
• 3. [@respira/sdk 0.1.3](https://www.npmjs.com/package/@respira/sdk)
• 3. [@respira/cli-core 0.1.3](https://www.npmjs.com/package/@respira/cli-core)

fix 307 redirect breaking respira auth login

• change [@respira/cli 0.1.2](https://www.npmjs.com/package/@respira/cli)
• change [@respira/sdk 0.1.2](https://www.npmjs.com/package/@respira/sdk)
• change [@respira/cli-core 0.1.2](https://www.npmjs.com/package/@respira/cli-core)

per-package READMEs on npm

• change [@respira/cli](https://www.npmjs.com/package/@respira/cli) — 9.4 kB README: marketing-forward, WP-CLI comparison, architecture summary, quick start, 34-command reference, AI agent integration, pricing.
• change [@respira/sdk](https://www.npmjs.com/package/@respira/sdk) — 5.7 kB README: developer-focused, createRespiraClient usage, anonymous mode, seven namespaces, builder-native examples, error taxonomy.
• change [@respira/cli-core](https://www.npmjs.com/package/@respira/cli-core) — 6.3 kB README: advanced/builder-facing, documents every frozen v0.1 export (ExecutionCycle, FrameworkHook, ToolChainFunction, TraceEmitter, CycleErro

Foundation release

• change Six-phase execution cycle: LoadContext -> PreHooks -> Resolve -> Execute -> PostHooks -> Return. Deterministic. Traceable. Every command runs through every phase
• change Five framework hook contracts, frozen for v0.1: before_resolve, filter_plan, before_execute, filter_result, after_execute. In v0.1 no callbacks register. v0.2 populates them. NullHookRegistry swaps for ManifestBackedHook
• change Typed ToolChainFunction<T> abstraction for all 34 commands. Each function declares capability (read | write | destructive), domain tags, and prerequisites
• change File-organization convention: one BaseCommand subclass per file, one ToolChainFunction per file, always co-located. Named export <camelCasePath>Function
• change Structured JSON tracing via --verbose, written to ~/.respira/traces/{invocationId}.json. Hard cap 10,000 entries per invocation
• change [@respira/cli 0.1.0](https://www.npmjs.com/package/@respira/cli)

Storefront intelligence is now FSE-first with page-builder fallback. On a block theme, analysing a shop page returns real structural analysis against the native archive-product template instead of "no page builder detected". The two badge t

• change Storefront intelligence is now FSE-first with page-builder fallback. On a block theme, analysing a shop page returns real structural analysis against the native archive-product template instead of "no page builder detected". The two badge t
• change Sale and low-stock badges are POSITIONED: they anchor inside the product image, matching WooCommerce's own card structure, instead of being appended after the add-to-cart button. If a badge is already present the write is refused as a no-op
• change Added product-card field addressing: discover the card's composition and set attributes on one named field, by canonical WooCommerce block name. Attributes are intersected with the installed block's registered attributes, so an unrecognised
• change update_checkout_layout no longer returns "no page builder detected" on a block theme. It returns the honest capability error its sibling tools already returned.
• change The missing-changes error no longer advertises a parameter that does not exist. It names only the keys the handler reads.
• change The legacy woocommerce/product-query block is recognised during discovery, so a store on an older card block is no longer told it has no product grid.

Fatal error on HPOS stores (PHP 8). The daily license check, which also gathers a small agent-orders summary for the dashboard, could run on the plugins_loaded hook before WooCommerce initialized its order data store. On stores using High-P

• fix Fatal error on HPOS stores (PHP 8). The daily license check, which also gathers a small agent-orders summary for the dashboard, could run on the plugins_loaded hook before WooCommerce initialized its order data store. On stores using High-P

Thrive Architect product pages — description edits didn't appear on the frontend — bulk_update_products with description / short_description wrote to post_content via WooCommerce setters, but Thrive Architect renders from its own wp_postmet

• fix Thrive Architect product pages — description edits didn't appear on the frontend — bulk_update_products with description / short_description wrote to post_content via WooCommerce setters, but Thrive Architect renders from its own wp_postmet

Product category CRUD endpoints and MCP tools (list/get/create/update/delete).

• add Product category CRUD endpoints and MCP tools (list/get/create/update/delete).
• add Product tag CRUD endpoints and MCP tools (list/get/create/update/delete).
• change Product create/update now supports category and tag assignment payloads for safer taxonomy-aware catalog workflows.

Release pipeline reliability: ensures fresh tag/release creation behavior.

• change Release pipeline reliability: ensures fresh tag/release creation behavior.
• change Security hardening parity with experimental-feature gating patterns in core plugin.

Initial WooCommerce add-on release.

• change Initial WooCommerce add-on release.