Every release,
every story.

A "Developer settings" tab in the plugin admin

• add A "Developer settings" tab in the plugin admin, with a switch to **require authentication to list tools**. 7.5.30 added the respira_mcp_public_discovery option that locks anonymous tools/list on the native remote MCP end
• fix Builder detection: a site that once had Beaver Builder, or inherited its data through a migration, is no longer misreported as Beaver. The detector stopped trusting a leftover _fl_builder_version option that Beaver does

The native remote MCP endpoint can require authentication for tool-catalog discovery

• sec The native remote MCP endpoint can require authentication for tool-catalog discovery. POST /wp-json/respira/v1/mcp with tools/list returned the full tool catalog to unauthenticated callers by design, so OAuth-discovery c

Beaver Builder round-trip writes could collapse a multi-row, multi-column layout into a single one-column stack

• fix Beaver Builder round-trip writes could collapse a multi-row, multi-column layout into a single one-column stack. complexify_structure()'s auto-wrap pass decided whether to wrap the top-level node list in a synthetic row/
• fix A Beaver Builder update_element/update_module write that silently changed nothing was never flagged as a no-op. The write_was_noop safety net (since 7.0.61/7.0.64) compares a canonical storage signature before and after

Large-page reads no longer look like a dead server

• fix Large-page reads no longer look like a dead server. When a read on a big page (read_page, read_post, extract_builder_content, ...) exceeded the per-request HTTP timeout, the timeout fired before the 100 KiB response-size

Client-facing sites no longer ship the WebMCP browser bridge to logged-out visitors

• sec Client-facing sites no longer ship the WebMCP browser bridge to logged-out visitors. The front-end bridge previously loaded on every public page (advertising that the site is agent-editable) and fired an anonymous 401 in
• sec The MCP tool catalog can no longer be enumerated by subscriber-level logins. The adapter transport's discovery permission was raised from read (any logged-in user) to manage_options (administrators), filterable via the n
• sec The public /respira/v1/ping and /status liveness endpoints no longer disclose the WordPress core version to anonymous callers. Core version is a CVE-targeting hint; it is now returned only to authenticated callers. The l

wordpress_move_element, wordpress_remove_element, wordpress_reorder_elements now accept edit_target/editTarget/confirm_live_edit

• fix wordpress_move_element, wordpress_remove_element, wordpress_reorder_elements now accept edit_target/editTarget/confirm_live_edit. These three tools could return confirmation_required on a published original page with no

A duplicate produced by Elementor 4 could go blank after an update_element write

• fix A duplicate produced by Elementor 4 could go blank after an update_element write. A node whose Elementor type could not be resolved during extraction was stamped with the internal sentinel unknown, and reconstruction wro
• fix Divi 4: an element-level write could corrupt global_colors_info and _builder_version on every other module on the page. The shortcode-attribute parser auto-JSON-decoded global_colors_info="{}" (the common no-color-bound
• fix Divi: apply_builder_patch (and any write that triggers a Divi 5-to-4 downconvert) renamed third-party module shortcodes, breaking them. A bare (non-namespaced) module type was always treated as Divi 5 shorthand and prefi
• fix Divi 5: one update_element write could corrupt every divi/blurb module on the page. A last-resort text-fallback helper returned a module's plain body text for any requested field, including title and image, not just body

WP Rocket pages are now purged automatically after a live write, like every other supported cache

• fix WP Rocket pages are now purged automatically after a live write, like every other supported cache. purge_frontend_caches() already cleared WP Super Cache, W3 Total Cache, WP Fastest Cache, LiteSpeed, Autoptimize, SG Opti

Site-down fatal on Composer-at-root (Bedrock) installs running WordPress 6.9+/7.0

• fix Site-down fatal on Composer-at-root (Bedrock) installs running WordPress 6.9+/7.0. When the plugin is installed via Composer at the site root (Bedrock and similar layouts), Composer resolved the wordpress/abilities-api d

"A duplicate already exists" blocked a valid edit on sites with a broken persistent object cache

• fix "A duplicate already exists" blocked a valid edit on sites with a broken persistent object cache. The duplicate guard that stops you editing an original while a pending duplicate is open ran through WP_Query. On managed

OAuth / claude.ai connector "credentials rejected even after refresh" on single sites with a custom-role admin

• fix OAuth / claude.ai connector "credentials rejected even after refresh" on single sites with a custom-role admin. The dashboard-site-token / OAuth path resolves which WordPress user to run as by looking for the stored admi
• fix Rotate / Revoke buttons in Respira → Setup did nothing. AgentRow rendered the rotate/revoke buttons as onClick={() => onRotate && onRotate(agent)}, but every place that renders <AgentRow> omitted the onRotate/onRevoke pr

ChatGPT (developer mode) tool calls no longer loop on "Connect / Approve"

• fix ChatGPT (developer mode) tool calls no longer loop on "Connect / Approve". After a successful OAuth connection, calling a tool in ChatGPT re-triggered the whole sign-in flow on every attempt, so a write like an image upl

Client logos on the One-click install screen showed as broken images

• fix Client logos on the One-click install screen showed as broken images. oneclick-grid.jsx resolved logo paths by sniffing the DOM for an unbundled admin/assets/v71/src/screens/*.jsx script tag. Since the admin now ships as

A valid OAuth/dashboard connection could get misreported as "not authenticated" on multisite, sending the connecting client into an endless

• fix A valid OAuth/dashboard connection could get misreported as "not authenticated" on multisite, sending the connecting client into an endless reconnect loop. When a dashboard-issued token (claude.ai connector, OAuth-native

inject_builder_content responses now report exactly what arrived and was written

• add inject_builder_content responses now report exactly what arrived and was written (received_top_level_count + received_element_count, echoed in the message too). Why: a tool call truncated by the AI client itself (a model

Bulk operations now actually snapshot before writing

• fix Bulk operations now actually snapshot before writing. bulk_pages_operation (find_and_replace, strip_inline_styles, custom) called create_snapshot(), a method that has never existed on Respira_Snapshots — the real method

Divi 4: build_page / inject_builder_content no longer silently drop children described with vocabulary aliases

• fix Divi 4: build_page / inject_builder_content no longer silently drop children described with vocabulary aliases. A payload using rows / cols / columns / modules / elements / innerBlocks instead of the canonical children r
• fix Divi 4: explicit or alias-inferred column nodes under a row are normalized into the emitter's native contract (flat row children + column_structure + per-column counts) instead of being nested inside auto-minted columns.
• fix Divi 4: a children-dropped write now fails loudly. New unconditional tripwire compares the post-normalization element count against the emitted opening-shortcode count and returns respira_children_dropped (nothing writte

move_element, duplicate_element, remove_element, batch_update, and reorder_elements now honor the duplicate/approval workflow

• fix move_element, duplicate_element, remove_element, batch_update, and reorder_elements now honor the duplicate/approval workflow. Only update_element was routing writes through the edit_target resolver; these five tools wro
• fix Bricks: reading a listed bricks_template post no longer 404s. Root-caused live: a pre_get_posts filter (e.g. WPML's WPML_Query_Filter) can silently rewrite post_type on custom post types it doesn't recognize as translata
• fix Divi 5: shortcode-like content in a divi/text module now surfaces a warning instead of silently rendering as literal bracket text. divi/text never runs do_shortcode() (only divi/code does); the response now flags it and
• fix create-page-duplicate and full read-page-v2 no longer redo the same builder-extraction work multiple times per call. On a heavy Elementor page this was timing out at 180s (4x redundant extract_content() + 2x full the_con
• add Non-destructive way to detach a stale duplicate link. A page can get incorrectly flagged as a duplicate of an unrelated original (e.g. cloned from it as a starting template long ago). Previously the only options were des
• add respira_read_debug_log tool. Read-only, capability-gated the same as read_theme_file, tail-reads wp-content/debug.log (or a custom WP_DEBUG_LOG path) with lines/level/since/grep filters, capped at 2 MiB, with basic secre

ChatGPT now lists Respira's tools over the native MCP connector

• fix ChatGPT now lists Respira's tools over the native MCP connector. 7.5.13 added the OAuth discovery metadata (per-tool securitySchemes, 401 Bearer challenge) but tools/list was still behind authentication. ChatGPT / the Op

ChatGPT / OpenAI Apps SDK clients now discover Respira's tools over the native MCP connector

• fix ChatGPT / OpenAI Apps SDK clients now discover Respira's tools over the native MCP connector. The connector authorized and showed the namespace, but ChatGPT reported no callable tools because the endpoint did not adverti

Overview no longer shows "connect an agent" on a site that is already working through an account-level connection

• fix Overview no longer shows "connect an agent" on a site that is already working through an account-level connection (Cowork, claude.ai, ChatGPT). It now reads server-confirmed agent activity from respira.press, so a site w

wordpress_read_debug_log tool

• add wordpress_read_debug_log tool. Read-only, tail-reads wp-content/debug.log (or a configured custom WP_DEBUG_LOG path) with lines/level/since/grep filters, so an agent can diagnose a PHP fatal without SSH access. Paired pl
• add wordpress_detach_duplicate tool. Clears a stale duplicate-relationship marker (is_duplicate/original_id) on a page that was incorrectly flagged as a duplicate of an unrelated original, without deleting or overwriting any

inject_builder_content now accepts target_path + position

• add inject_builder_content now accepts target_path + position for chunked section building. When a fully styled section is too large to send in one call (some AI clients cap tool-call payload size), the agent can create the

list_sites now self-heals a stale site list

• fix list_sites now self-heals a stale site list. A long-lived server (Cowork especially) only knew the sites it had at startup, so a site added on the dashboard afterwards never appeared, and the user had to re-paste config

Connected apps card shows per-agent logos

• change Connected apps card shows per-agent logos. Each connected agent row now renders its brand mark (Claude, Claude Code, Cursor, Cowork, Codex, Windsurf, Antigravity, n8n, v0) in place of the generic agent glyph, name-matche

Divi: a nested-row page now renders and edits correctly, not just opens in the Visual Builder

• fix Divi: a nested-row page now renders and edits correctly, not just opens in the Visual Builder. 7.5.7 (generate path) and 7.5.9 (raw update_page path) marked the section specialty="on" and set specialty_columns, but left

redeem_token now fails loudly when the server is pinned to RESPIRA_CONFIG_B64

• fix redeem_token now fails loudly when the server is pinned to RESPIRA_CONFIG_B64. The config load order is RESPIRA_CONFIG_B64 -> RESPIRA_CONFIG_FILE -> ~/.respira/config.json, so when a server is configured via the env var,

Divi: a handcrafted shortcode written via update_page now gets the same nested-row fix

• fix Divi: a handcrafted shortcode written via update_page now gets the same nested-row fix. The 7.5.7 specialty normalization ran only when Respira serialized a structured node tree (build_page / inject with a structure). A

Divi: a shortcode generated into a Code module now runs instead of printing as text

• fix Divi: a shortcode generated into a Code module now runs instead of printing as text. When Respira generated a Divi page with a standalone non-Divi shortcode (for example a FluentCart [fluentcart_button]), it placed it in

Divi: nested rows generated from scratch stay editable in the Visual Builder

• fix Divi: nested rows generated from scratch stay editable in the Visual Builder. When Respira built a Divi 4 page with a row nested inside a column (for example a card grid inside a hero column), it emitted the inner row an

Divi: AI-generated pages stay editable in the Visual Builder

• fix Divi: AI-generated pages stay editable in the Visual Builder. When Respira built a Divi page from scratch, it encoded double quotes in shortcode attributes as the HTML entity (&quot;) instead of Divi's own %22, and left
• fix Divi: a shortcode placed in content runs instead of showing as text. A non-Divi shortcode (for example a store or cart button) dropped into a Divi Code module rendered as literal text, because Divi's Code module does not

Divi: third-party modules (Divi Flash and similar) can now be edited, not just preserved

• fix Divi: third-party modules (Divi Flash and similar) can now be edited, not just preserved. On a Divi page, modules added by third-party plugins (for example Divi Flash's difl_advanced_button and difl_advanced_blurb) were
• fix Elementor: a heavy-page save that did not actually persist now fails loud instead of reporting success. On very large Elementor pages, the check that confirms a write landed could read a copy of the data from the object

A failed connection check can no longer get stuck in your host's cache

• fix A failed connection check can no longer get stuck in your host's cache. On aggressively-cached hosts (Pressable, WP Engine, some CDNs), an authentication error from Respira's REST API could be cached at the edge and then

Editing Breakdance pages works again

• fix Editing Breakdance pages works again. On Breakdance 2.8.0, every edit (update_element, apply_builder_patch) failed with "Unknown Breakdance element type EssentialElements\\Section, not registered on this site", which blo

Divi 4 sites now tell the AI the right way to build a page

• fix Divi 4 sites now tell the AI the right way to build a page. On a Divi 4 site the builder-info call advertised the Divi 5 block schemas (divi/section, divi/heading, ...) as if they were the write format, with nothing sayi
• fix Agent-priming playbooks can read site and builder context. A playbook that opens by reading the site context and builder info (so later steps author in the right format) failed to even save, because get_site_context and

Connecting a site from the respira.press dashboard installs the key on the site again

• fix Connecting a site from the respira.press dashboard installs the key on the site again. Respira creates an API key and pushes it to your site when you connect from the dashboard. The route that receives it (/respira/v1/ad
• fix The setup and overview screens read clearly in both light and dark. The "paired agents" line on the setup wizard was too faint in dark mode, the live-tail and agent tiles went dark-on-dark on the light theme, and the "aw

The "WooCommerce detected" admin notice can now be dismissed for good

• fix The "WooCommerce detected" admin notice can now be dismissed for good. The one-click WooCommerce add-on prompt on the Plugins screen had no dismiss control, and WordPress's own dismiss only hides a notice for the current
• improved Safe-edit copies are cleaned up automatically instead of piling up under Pages. Approving an AI edit merges the change into the original page (keeping its URL and menu links). The safe-edit copy created for that edit, pl

remove_element can now target an element by its position in the tree

• fix remove_element can now target an element by its position in the tree. The identifier_type for remove_element was missing the path option that the other element tools already accept, so there was no way to remove an eleme

Beaver Builder duplicate/restore fataled with Cannot use object of type stdClass as array (box.php:61)

• fix Beaver Builder duplicate/restore fataled with Cannot use object of type stdClass as array (box.php:61). The write path (normalize_bb_layout_for_write) already coerced every compound module setting value (margin/padding/b

Breakdance still read detected:false on fully themeless "Breakdance Zero Theme" installs (follow-up to 7.4.24/7.4.25)

• fix Breakdance still read detected:false on fully themeless "Breakdance Zero Theme" installs (follow-up to 7.4.24/7.4.25). On these sites the plugin folder is not named breakdance (so the path scan missed), breakdance_settin

Breakdance CodeBlock rendered blank

• fix Breakdance CodeBlock rendered blank. Code passed to an EssentialElements\CodeBlock was stored under the agent vocabulary key (code/html/js/css), which Breakdance never reads — the renderer reads php_code/css_code/js_code
• fix Brizy write_was_noop / bytes_changed 0 false negative. get_canonical_storage_signature() did (string) get_post_meta($id, 'brizy', true), but the brizy meta is a serialized array — casting it to a string yields the litera
• fix restore-snapshot did not byte-revert Divi 4 pages. Divi 4 (shortcode) restores ran the lossy inject_content rebuild pass that re-serializes post_content from the simplified tree (re-ordered attrs, dropped unmodeled attrs

Breakdance detection on themeless ("Breakdance Zero Theme") sites

• fix Breakdance detection on themeless ("Breakdance Zero Theme") sites. detect() relied on version-specific runtime symbols and an exact breakdance/plugin.php slug, which a headless install can miss — so Breakdance reported d
• fix convert-html-to-builder no longer leaks layout JSON into post_content. When the requested builder had no working writer (almost always: the builder plugin is not active), the generic fallback JSON-encoded the structured

License activation no longer fails with "Invalid license key" on a valid key

• fix License activation no longer fails with "Invalid license key" on a valid key. The plugin called the licence API at the apex host (respira.press), which issues an apex-to-www redirect. On some hosts wp_remote_post does no

update-element no longer fails with atomic_write_unsupported on Elementor v4 flexbox pages

• fix update-element no longer fails with atomic_write_unsupported on Elementor v4 flexbox pages. The Elementor v4 style validator's breakpoint allow-list was missing desktop (and laptop). Real e-flexbox local styles carry an
• fix The Respira Changes (approvals) screen now surfaces the real reason an approval was blocked. The admin app's apiFetch rejected a failed request with the raw Response object instead of the parsed JSON body, so the error c

Divi 5 module schema refreshed against Divi 5.8 (108 to 109 modules)

• improved Divi 5 module schema refreshed against Divi 5.8 (108 to 109 modules). Re-scanned every Divi 5 module on a live Divi 5.8.0 install and updated the bundled schema the builder reads to know each module's editable groups. Th

"Module not found" on an update now hands the agent the page's actual modules to pick from

• improved "Module not found" on an update now hands the agent the page's actual modules to pick from. Completing the 7.4.18 / 7.4.19 self-correction work across the last common miss: updating a module by id, path, type or admin_la
• improved The plugin now declares which capabilities it actually exposes, so connected AI tools stop offering ones this install does not have. The server compatibility response now lists per-capability flags (for example pagespeed

apply-builder-patch now hands the agent the page's actual targets when a patch operation cannot find its element

• improved apply-builder-patch now hands the agent the page's actual targets when a patch operation cannot find its element. Continuing the 7.4.18 self-correction work: a patch operation that could not resolve its id/path/type iden

Path-parameter tools no longer send undefined in the URL when the AI uses a natural-but-different argument name

• fix Path-parameter tools no longer send undefined in the URL when the AI uses a natural-but-different argument name. read_page, read_post, create_page_duplicate, create_post_duplicate, get_snapshot and find_element read thei
• fix upload_media now works with a local file path argument, including Windows paths. Two issues: the tool expected file but commonly received filePath, and even with the right value the file reader only recognised Unix-style

Capability negotiation, Phase 2: the server now hides a route-skewed tool based on what the connected plugin actually exposes, not just its

• improved Capability negotiation, Phase 2: the server now hides a route-skewed tool based on what the connected plugin actually exposes, not just its version number. Building on 7.2.6: from plugin 7.4.20 the compatibility endpoint

Capability negotiation: tools whose plugin route the connected site is too old to have are no longer advertised

• improved Capability negotiation: tools whose plugin route the connected site is too old to have are no longer advertised. The server now hides version-skewed tools when the connected plugin predates the route they call, so the ag

A "no element found" response now hands the agent the page's actual elements to pick from

• improved A "no element found" response now hands the agent the page's actual elements to pick from. Locating an element by id, path, type or admin_label is the most-used and most-retried operation: an agent would guess an identif

Beaver Builder writes no longer fatal on compound settings

• fix Beaver Builder writes no longer fatal on compound settings. Respira stored compound Beaver settings (border, place_content, typography, dimension and friends) as objects, but Beaver reads every compound setting value wit
• fix Duplicating a Bricks section no longer throws. Bricks stores a flat element list where each element references its children by ID string, but the element-duplicate path used a nested-tree clone that expected each child t
• fix inject-builder-content now accepts raw HTML. Passing HTML (a string, or { html: "..." }) to inject-builder-content was refused with "did not map to any Beaver Builder nodes", even though convert-html-to-builder accepted
• fix Editing a Respira duplicate edits it in place. Hardened duplicate detection so a post that is already a Respira duplicate is always recognised and edited directly, instead of occasionally creating a duplicate of the dupl

update_module and apply_builder_patch can now complete the live-edit handshake

• fix update_module and apply_builder_patch can now complete the live-edit handshake. Both tools exposed edit_target but not confirm_live_edit, so a write to a published original returned confirmation_required with confirm_liv

Pasting a license key now works reliably and shows what happened

• fix Pasting a license key now works reliably and shows what happened. The "paste a license key" option on the Setup screen used a native browser dialog to paste into. Browsers suppress that dialog after it appears a couple o

Large builder injects get the full time window to finish

• fix Large builder injects get the full time window to finish. inject_builder_content is the heaviest write Respira makes (full structure complexify + CSS regen + a render-validation loopback), so on a large page it could exc

inject_builder_content no longer hangs on a slow large-page write

• fix inject_builder_content no longer hangs on a slow large-page write. It inherited the bare 30s request timeout while being the heaviest write the server makes, so a large page behind a host or edge request-time limit (for
• fix respira_search_docs fails fast instead of hanging. Its docs fetch to respira.press had no timeout, so on a slow or unreachable link (a QUIC-hostile network or a proxy) it could hang the tool to the client ceiling. It now

Bricks now matches its real control contract

• add Bricks now matches its real control contract. A scanner captures every Bricks element's full runtime control schema (75 elements, the complete control set) into a committed snapshot, and the element registry + schema now
• add Off-contract Bricks controls are flagged (warn mode). A settings validator checks each element's settings against its real control schema and surfaces unknown controls (with a "did you mean") in the write notes. It annot
• add The Bricks component library is reachable. Respira now reads the bricks_components option: find/replace and the SEO/readability analyzers resolve component instances (cid + properties) so component-owned text is no longe
• fix Bricks patterns mint native 6-character IDs. The pattern library still produced long prefixed ids; it now uses the same native 6-character generator as the rest of the Bricks write path, so pattern-injected elements matc
• fix HTML-to-builder keeps blockquotes. Converting HTML with a <blockquote> produced a plain text module that dropped the quote; the converter now keeps the <blockquote> wrapper and its class so theme quote styles apply
• fix HTML-to-builder preserves section order on nested layouts (Beaver). Sections wrapping nested <div>s were reordered because the converter produced invalid row-in-row structures the builder reflowed; the Beaver hierarchy p

Bricks elements now use Bricks' native 6-character IDs

• fix Bricks elements now use Bricks' native 6-character IDs. Every Respira path that created a Bricks element (build_page, HTML convert, section presets, in-place inserts) minted long respira_-prefixed ids of 21 or more chara
• fix SEO, schema, and readability checks now read Bricks content. Bricks stores the page in postmeta, not post_content, so the analyzers reported 0 words, 0 headings, no images, and no JSON-LD on Bricks pages that render fine
• fix Bricks content extraction no longer fails its own output schema. extract-builder-content could return a null warning on a valid Bricks page, which the MCP output schema rejected ("output[warning] is not of type string").
• fix Oxygen 6 accepts its real elements in build_page. Multi-element types the builder advertises (Columns, Column, Div, Grid, Accordion, Tabs, TextLink, and more) were rejected with a 422, because the write path validated wi
• fix HTML-to-builder convert keeps CSS classes and image sources. With preserve_tokens on, custom classes on the source HTML (for example .btn) were dropped, and content images came in without a source so they did not render.
• fix Duplicating a Beaver Builder page with PowerPack or UABB modules no longer corrupts it. The duplicate path copied the Beaver layout without the canonical type-reshape that the inject and restore paths use, so nested modu

Cannot declare class WP_Ability_Category no longer fatals on Bedrock / from-source builds

• fix Cannot declare class WP_Ability_Category no longer fatals on Bedrock / from-source builds. The runtime collision guard added in 7.4.8 short-circuited whenever the bundled polyfill files carried the build-time class_exist

Bricks Components survive Respira writes

• fix Bricks Components survive Respira writes. A Component instance carries cid (the component template) and properties (per-instance overrides) at the element root. The write-path normalizer rebuilt every element from a fixe
• fix Bricks writes no longer report a false "no-op". The write-verification signature cast the Bricks postmeta array straight to a string ("Array"), so every write looked byte-identical (pre_write_bytes:6, bytes_changed:0) an
• fix HTML→Beaver convert builds real content, not a blank page. convert-html-to-builder with builder:beaver built the module tree but every module came back empty (blank page, success:true). Two causes: the beaver slug wasn't
• fix Beaver in-place tools. extract-builder-content returned diagnostics: null and failed the tool's object schema; it now always returns an object. add-html accepts html as an alias for content. The add-section column build
• fix Divi 5 Custom CSS edits stop reporting a false warning. update_module wrote the top-level css group correctly but flagged it unknown_attribute_group, which read as a silent drop. css is a universal Divi 5 group and is no
• fix build_page no longer rejects real full pages. The 200-element limit blocked a typical multi-section page (a 14-section Divi page is ~200+ nodes). Raised to 1000 (still filterable)

Oxygen 6 (Jenga) authoring intelligence

• add Oxygen 6 (Jenga) authoring intelligence. Oxygen Classic had an intelligence package; Oxygen 6 had none, so the agent rediscovered Oxygen's structure each run, often dumped whole pages into a single HTML block, and used t

Divi 5 Heading no longer renders "This content cannot be displayed."

• fix Divi 5 Heading no longer renders "This content cannot be displayed." When a heading's text was supplied via a generic content field, the level detection grabbed that text and wrote it into the heading-level attribute (wh
• fix Breakdance / Oxygen 6 writes are now verified against the database, not the object cache. The post-write check read the saved value back through WordPress's object cache, which update_post_meta primes in the same request
• change The manual license-key connect path is now a visible, first-class fallback. Connecting by signing in to respira.press is still the default, but the offline/manual option (paste a license key from your dashboard — no redi

Oxygen 6 "IO-TS decoding failed" no longer bricks the editor site-wide

• fix Oxygen 6 "IO-TS decoding failed" no longer bricks the editor site-wide. Oxygen 6.0.0 swapped Breakdance's lenient JSON parse for a strict io-ts decoder that rejects null where it expects an object/array. Imported header/
• fix Oxygen 6 now builds with the real Section / Heading / Button elements when the "Breakdance Elements for Oxygen" add-on is active. The builder previously collapsed every element to a handful of low-level core types (a hea
• fix Divi 5 no longer writes "Unknown Module" blocks from invented type names. When an AI described a page using made-up layout names (hero_section, feature_grid, cta_section) instead of real Divi types, Respira wrote them ve

Oxygen 6 (Jenga) handshake guidance

• add Oxygen 6 (Jenga) handshake guidance. The instructions now distinguish Oxygen 6 from Oxygen Classic and hand the agent the native Oxygen 6 element vocabulary, the oxygen_header / oxygen_footer / oxygen_template post types

Runtime Abilities API collision guard, in the plugin's own source

• fix Runtime Abilities API collision guard, in the plugin's own source. 7.4.6's per-class guard is injected into the bundled wordpress/abilities-api by a Composer post-install script, which a from-source composer install --no
• fix Oxygen Classic page JSON now matches an editor-saved page exactly. build_page wrote the canonical _ct_builder_json tree with a bare id root and no per-node depth / ct_depth; a natively saved Oxygen 4.9.x page uses ct_id

No more Cannot declare class WP_Ability_Category site-down on Bedrock/Kinsta (WP 6.9+/7.0)

• fix No more Cannot declare class WP_Ability_Category site-down on Bedrock/Kinsta (WP 6.9+/7.0). On Bedrock layouts ABSPATH has no trailing slash, so the 7.4.2 collision guard's ABSPATH . WPINC join produced a malformed path,
• fix One-click "Connect to respira.press" no longer dead-ends on "you are not allowed to access this page." The OAuth round-trip returned the browser to a hidden admin alias that WordPress de-registers, so the final redirect
• fix In-place Divi 5 edits no longer collapse settings-shaped multi-element content. validate_render_critical_attrs is now settings-aware, so the validated inject path (used when an agent rebuilds an existing page) accepts th

Patch. Divi 5 page generation now produces native, editable, rendering modules from the looser content shapes agents actually send. Before, a homepage request often came back as

• fix FIX: Divi 5 builds collapsed to plain text / a raw code block instead of native editable sections and modules. A new normalization pass lifts loose content synonyms (heading text, button text + url, paragraph content, ne
• fix FIX: native Divi 5 modules could render as empty containers. The normalized content is now written to the settings bucket (which the complexifier expands into the title.innerContent.desktop.value / content.innerContent.d
• fix FIX: a build whose attributes.content was a scalar string (e.g. divi/text) could fatal in the Divi 5 attribute-group deep-merge. The merge now runs only when the existing group is itself an array.

Patch. Oxygen 6 native page building. The agent now writes real, editable Oxygen 6 elements (sections, headings, text, buttons, images) instead of falling back to a single HTML

• fix FIX: Oxygen 6 page generation collapsed to a single HTML code block instead of native, editable sections and modules. Respira's build path emitted Breakdance EssentialElements\* element classes, which a pure Oxygen 6 sit
• fix FIX: update_element and extract/inject round-trips on Oxygen 6 could report success while persisting nothing — the edit landed in an attribute bucket the rebuild ignored. The Oxygen 6 build path now reads content from th

SmartCrawl Pro (WPMU DEV) SEO support

• add SmartCrawl Pro (WPMU DEV) SEO support. Respira now detects SmartCrawl and writes and reads its native _wds_* post and term meta — title, meta description, focus keyword, canonical, and the split index/follow robots flags
• fix Elementor v4 atomic styles applied through an explicit styles:{} block were generated but never worn by the element. The flat-CSS write path already linked the minted style id into the element's class list; the styles-bl
• fix Elementor global colours: the kit's system colours (primary, secondary, text, accent) could not be changed. update_elementor_global_colors only ever wrote custom_colors, so passing a system _id appended a duplicate custo
• fix Divi 5: a blurb's image was written to a group the renderer ignores, so it never appeared. Divi 5 reads the blurb image from imageIcon.innerContent.desktop.value.src and shows it only when useIcon is off; Respira wrote s
• fix Divi 5: the bar counter targeted a module slug Divi 5 does not register. The number/percent → barProgress routing was keyed on divi/bar-counter / divi/bar-counters-item, which do not exist, so a counter rendered at 0%. I
• fix Divi 5: an image's click-through link did not apply. image_url on divi/image wrote to …value.url, but Divi 5 reads the link from …value.linkUrl. It now writes linkUrl

Site-down fatal on WordPress 6.9+ ("Cannot declare class WP_Ability_Category")

• fix Site-down fatal on WordPress 6.9+ ("Cannot declare class WP_Ability_Category"). The bundled wordpress/abilities-api polyfill loaded through Composer's files-autoload the moment the plugin required vendor/autoload.php, wh

Security validator false positive

• fix Security validator false positive. The inline-event-handler pattern (/on\w+\s*=/i) matched onXXX= anywhere in content — including inside shortcode attribute values like button_text="Start minikursus for 222 kr.". The pat
• fix Playbooks not appearing in the ChatGPT tool list. get_ability_ids_for_adapter() called Respira_Playbooks::get_registered_ability_ids(), which reads from a static array populated during wp_abilities_api_init. That action
• fix Divi 5.7 Visual Builder opens blank after Respira writes. Divi 5.7 changed its VB initialisation to read content from the WordPress autosave revision ({post_id}-autosave-v1) rather than the _et_pb_page_content meta. Page
• fix Duplicated Divi 5.7 page appears empty in Visual Builder. Same root cause: newly duplicated pages have no autosave revision. Respira now seeds the revision at duplication time so the VB opens with the correct content
• fix Divi code module becomes inaccessible after a CSS or HTML update. The same autosave-revision gap applied to targeted element updates: updating a code module's content wrote the new post_content but left the autosave revi
• fix Divi 5 column widths collapse to 0px on a 3-column row. When an asymmetric flex column structure (e.g. 60/20/20) was distributed across 3 or more columns, the fractional percentages were computed correctly but the third

respira_redeem_token returned an empty response in non-Cowork agents

• fix respira_redeem_token returned an empty response in non-Cowork agents (e.g. Antigravity). The redeem path bypasses the normal tool-call wrapper and returned a plain object; non-Claude clients that expect the standard {con
• fix Cowork token redemption now surfaces a RESPIRA_CONFIG_B64 update hint. When the MCP server is configured via the RESPIRA_CONFIG_B64 environment variable (common in managed hosting setups), redeeming a new Cowork token wr
• add post_parent schema exposed on update_page, create_post, update_post, and build_page tools. The plugin has always forwarded post_parent to WordPress, but the MCP schema didn't declare the parameter, so agents couldn't set

Divi 5 builds with rich native modules by default

• add Divi 5 builds with rich native modules by default. The agent now advertises divi/heading, divi/text, divi/image, divi/button, and divi/blurb alongside the structural blocks. Before this, the only content block offered by
• add Dropped Divi 5 styling now fails loudly. When a style attribute is not supported on a Divi 5 module, the write still saves the content but now returns a clear dropped_settings summary naming exactly which styles did not
• change Connecting an AI assistant moved to the respira.press dashboard. The plugin's connect screen is now a status band plus one button that opens the dashboard MCP page with this site preselected (you land signed in). Pick yo

inject_builder_content now accepts target_path to add modules to an existing column

• add inject_builder_content now accepts target_path to add modules to an existing column. Pass the path of the target container (e.g. target_path: "sections[0].rows[0].columns[0]") along with content containing the new module
• fix Playbooks now appear in the streamable MCP tools/list. get_ability_ids_for_adapter() never read from the WP Abilities registry, so respira-playbooks/* IDs (registered dynamically at boot) were invisible to ChatGPT and Cl
• fix inject_builder_content now accepts target_path to add modules to an existing column. Pass the path of the target container (e.g. target_path: "sections[0].rows[0].columns[0]") along with content containing the new module
• fix Divi 5 column nodes now appear as columns[n] in path strings instead of modules[n]. build_path_string() previously used modules[n] for every node at depth 2 or deeper, making columns and leaf modules indistinguishable. A
• fix WebMCP input size limit raised from 100 KB to 10 MB. The wmcp_max_input_size default was set in 2023 before Divi 5 adoption. Pages with > ~50 KB of builder content failed silently with Tool execution failed. Raised to 10
• fix Elementor Pro Global Widgets no longer cause a PHP 500 after any page edit. simplify_structure() only preserved id/elType/settings/elements/widgetType/isInner, so the top-level templateID property on Global Widget elemen

Divi 5 build guidance points the agent at the rich native modules

• change Divi 5 build guidance points the agent at the rich native modules. The server's Divi 5 blurb now says heading, text, image, button, and blurb are advertised by default and safe to build with, and to prefer them over divi
• change No more per-inject Divi 4 vs Divi 5 round-trip. The editing contract now tells the agent to auto-detect the version from the page (respira_get_builder_info / respira_read_page, with the plugin already flipping into Divi
• add Dropped-styling warnings are hoisted to the top of build results. When a Divi 5 (or any builder) write drops style settings the builder does not recognise, wordpress_inject_builder_content, wordpress_build_page, and word

The plugin details screen no longer reports "Compatible up to: 6.7"

• fix The plugin details screen no longer reports "Compatible up to: 6.7". The update checker hardcoded a stale tested-up-to value, so WordPress 7.0 sites saw a "This plugin has not been tested with your current version of Wor
• improved Print / Save PDF on the activity report prints the report, not the admin screen. The button called window.print() on the live wp-admin page, so the PDF captured the whole admin chrome (the dark sidebar) and had no report

OAuth discovery now rides the REST API instead of /.well-known/

• fix OAuth discovery now rides the REST API instead of /.well-known/. Connecting Claude Desktop by URL runs an OAuth handshake that starts by fetching a small discovery document. That document was only served at /.well-known/

Playbook runs are bracketed in one snapshot session

• add Playbook runs are bracketed in one snapshot session. Every write a playbook step makes already captured a before + after snapshot; those snapshots now all join one session for the run, and the playbook result returns rec

Released 2026-05-27.

• change Released 2026-05-27.
• add Product brand support (product_brand taxonomy). The update-product and create-product abilities now accept brand_ids so an AI can assign or clear brands on a product the same way it already assigns categories and tags. Full CRUD endpoints l
• add Featured-image removal. The update-product ability now accepts image_id. Pass an attachment ID to set; pass 0 or null to remove the featured image. Previously the only image-related field on the response was a read-only URL; agents had no w
• schema Product response shape gains brand_ids, brands, and image_id. image is unchanged.

wp.org review fixes

• change Display name updated to "Inhale: MCP Abilities by Respira" so the author attribution is visible in wp-admin plugin lists. Slug inhale-mcp-abilities is unchanged.
• change Contributors field in readme.txt now lists urbankidro (the wp.org username that owns the plugin) instead of the brand string. The Author header still reads "Respira" so the visible attribution on the directory page is un
• change uninstall.php updated to remove the new primary key, the v0.4.0 migration flag, the canonical compat key, and every legacy key from v0.1.x and v0.2.x. Single-site and multisite sweep.

WordPress.org Plugin Directory submission

• change Canonical option key. v0.2.0+ stores the opted-in list under mcp_adapter_public_abilities — the same key proposed first-party in [WordPress/mcp-adapter#184](https://github.com/WordPress/mcp-adapter/pull/184). A one-shot
• change Brand-aligned chrome. Header with "by respira.press" Baskervville italic subtitle and a tiny version pill in the right-side toolbar. Light and dark themes both render with AA contrast
• change iOS-style toggle in the Status column for fast per-row inhale / exhale, on top of the standard wp-admin bulk-actions pattern
• change Foreign admin notices suppressed on the Inhale settings page only, so the screen stays focused on the one decision it exists to support
• change Hardened uninstall. Removes every option the plugin has ever written, single-site and multisite
• change Plugin Directory readiness pass. ABSPATH guards on every shipped PHP file. Every output escaped. Every state-changing request nonce-verified and capability-gated. No remote calls, no tracking, no obfuscation, no bundled

hardening pass

• change wp_die response code 403 + back link on the settings page permission denial path. Access logs and automated clients now see an authorization failure instead of a generic error
• change Row class escaping normalised: the abilities table's <tr class="…"> attribute is always rendered through esc_attr() instead of conditionally injecting the attribute fragment. No behavioral change, but conforms more stric

first public release

• change Discovers every ability registered via the WordPress Abilities API and lists them in a wp-admin native list table.
• change Standard wp-admin selection + bulk-action UX: row checkboxes are selection; Bulk Actions dropdown plus Apply commits Inhale or Exhale immediately. No save-changes step.
• change Row-hover quick actions for single-ability inhale or exhale.
• change Annotation badges on each ability (read-only, destructive, idempotent) sourced from the ability's declared meta; falls back to heuristic inference from the ability name when the registering plugin didn't tag it.
• change Filter views (All, Inhaled, Read-only, Destructive, Unannotated), a search box that matches across name / source / description, sortable columns, multi-select source filter, client-side pagination (20/50/100/All).
• change Sources summary card above the table listing every plugin or theme that registers abilities, with the count per source and deep-links to each source's wp-admin home.

Zero-touch Cowork onboarding (Open in Cowork)

• change .mcp.json sets RESPIRA_BOOTSTRAP_OK=1 so the npx server boots even without a config file present.
• change Existing RESPIRA_CONFIG_FILE, RESPIRA_AGENT_CLIENT, RESPIRA_AGENT_TRANSPORT env vars unchanged.
• change Version label bumped in plugin.json and README.md.
• change Server companion: [@respira/wordpress-mcp-server@6.11.6](https://github.com/webmyc/respira-wordpress/blob/main/mcp-server/CHANGELOG.md#6116---2026-05-11)
• change Zero-touch design doc: drafted 2026-05-10, shipping Family 3b

unified ~/.respira/config.json flow + connect-site rewrite

• change The skill-documented config shape ({url, apiKey}) crashed the MCP server silently on startup because the server required four fields (id, name, url, apiKey). User saw "MCP server still connecting…" forever.
• change The Cowork form echoed pasted API keys into the chat transcript, contradicting the skill's own privacy promise.
• change .mcp.json points RESPIRA_CONFIG_FILE at ~/.respira/config.json.
• change npm dependency pinned to @respira/wordpress-mcp-server@latest so the server schema fix lands immediately.
• change /respira:connect-site skill rewritten: check for ~/.respira/config.json, point user at the dashboard to download it if missing, restart Cowork, test. Includes a "if startup fails" branch that reads ~/.respira/last-startu
• change README.md and INSTALL.md updated to describe the unified flow.

audience-first README rewrite

• change Edit a page without opening WP admin ("Update the headline on my client's homepage to say 'spring collection arriving'", about thirty seconds end to end)
• change Migrate a client site between page builders (sixteen supported paths, week of work into an afternoon)
• change Audit a site before a client meeting (SEO, AI search visibility, accessibility, mobile, technical debt, WooCommerce, with one-click fixes)
• change Clean up a media library in one pass (alt text, compression, dimensions)
• change Manage ten client sites from one conversation (multi-site context follows the conversation naturally)
• change No code changes.

README accuracy pass: 30 skills

• change 8 slash commands for the most common workflows
• change 30 auto activating skills, broken down as:
• change 1 visual reviewer sub agent that shows what changed after every edit
• change Full access to all 180+ Respira MCP tools through the bundled @respira/wordpress-mcp-server
• change All 12 supported page builders: Elementor, Divi 4, Divi 5, Bricks, Oxygen, Breakdance, Beaver Builder, WPBakery, Flatsome UX Builder, Brizy, Thrive Architect, Gutenberg
• change Restructured "What you get" with the correct skill count.

README hero KV + signup copy accuracy

• change Add the canonical Respira-for-Cowork hero image to the top of the README.
• change Drop the "free Lite tier available" line (Lite is not shipped yet).
• change Restate the trial as Maker, 7 days, no credit card required.
• change Show current version and respira.press/cowork link in the README header.
• change Bump plugin.json to 1.0.7.
• change v1.0.6: bundle 26 skills from agent-skills-wordpress, revert to name=respira (slug validation enforces lowercase).

Self-updater fatal on every WP cron tick. class-updater.php:104 called \Respira_License::get_license_key() which has never existed on the core License class — every site that activated the add-on threw Uncaught Error: Call to undefined meth

• fix Self-updater fatal on every WP cron tick. class-updater.php:104 called \Respira_License::get_license_key() which has never existed on the core License class — every site that activated the add-on threw Uncaught Error: Call to undefined meth

drop keytar, fix whoami after login, unstick terminal, warm welcome

• 3. [@respira/cli 0.1.3](https://www.npmjs.com/package/@respira/cli)
• 3. [@respira/sdk 0.1.3](https://www.npmjs.com/package/@respira/sdk)
• 3. [@respira/cli-core 0.1.3](https://www.npmjs.com/package/@respira/cli-core)

fix 307 redirect breaking respira auth login

• change [@respira/cli 0.1.2](https://www.npmjs.com/package/@respira/cli)
• change [@respira/sdk 0.1.2](https://www.npmjs.com/package/@respira/sdk)
• change [@respira/cli-core 0.1.2](https://www.npmjs.com/package/@respira/cli-core)

per-package READMEs on npm

• change [@respira/cli](https://www.npmjs.com/package/@respira/cli) — 9.4 kB README: marketing-forward, WP-CLI comparison, architecture summary, quick start, 34-command reference, AI agent integration, pricing.
• change [@respira/sdk](https://www.npmjs.com/package/@respira/sdk) — 5.7 kB README: developer-focused, createRespiraClient usage, anonymous mode, seven namespaces, builder-native examples, error taxonomy.
• change [@respira/cli-core](https://www.npmjs.com/package/@respira/cli-core) — 6.3 kB README: advanced/builder-facing, documents every frozen v0.1 export (ExecutionCycle, FrameworkHook, ToolChainFunction, TraceEmitter, CycleErro

Foundation release

• change Six-phase execution cycle: LoadContext -> PreHooks -> Resolve -> Execute -> PostHooks -> Return. Deterministic. Traceable. Every command runs through every phase
• change Five framework hook contracts, frozen for v0.1: before_resolve, filter_plan, before_execute, filter_result, after_execute. In v0.1 no callbacks register. v0.2 populates them. NullHookRegistry swaps for ManifestBackedHook
• change Typed ToolChainFunction<T> abstraction for all 34 commands. Each function declares capability (read | write | destructive), domain tags, and prerequisites
• change File-organization convention: one BaseCommand subclass per file, one ToolChainFunction per file, always co-located. Named export <camelCasePath>Function
• change Structured JSON tracing via --verbose, written to ~/.respira/traces/{invocationId}.json. Hard cap 10,000 entries per invocation
• change [@respira/cli 0.1.0](https://www.npmjs.com/package/@respira/cli)

Thrive Architect product pages — description edits didn't appear on the frontend — bulk_update_products with description / short_description wrote to post_content via WooCommerce setters, but Thrive Architect renders from its own wp_postmet

• fix Thrive Architect product pages — description edits didn't appear on the frontend — bulk_update_products with description / short_description wrote to post_content via WooCommerce setters, but Thrive Architect renders from its own wp_postmet

Product category CRUD endpoints and MCP tools (list/get/create/update/delete).

• add Product category CRUD endpoints and MCP tools (list/get/create/update/delete).
• add Product tag CRUD endpoints and MCP tools (list/get/create/update/delete).
• change Product create/update now supports category and tag assignment payloads for safer taxonomy-aware catalog workflows.

Release pipeline reliability: ensures fresh tag/release creation behavior.

• change Release pipeline reliability: ensures fresh tag/release creation behavior.
• change Security hardening parity with experimental-feature gating patterns in core plugin.

Initial WooCommerce add-on release.

• change Initial WooCommerce add-on release.