AcrossAI Abilities Manager

Changelog

Unreleased

(nothing yet)

0.0.34 – 2026-09-18

The largest release so far: 25 features, 19 new tabs and around 400 new abilities. The theme is reach and honesty – most of the popular plugins a site actually runs can now be driven directly, each behind this plugin’s own permission floor, and every ability that cannot do something says why and names the route that works instead.

Breaking changes

• Abilities now require administrator rights unless you say otherwise. If anyone below administrator drives this site through an AI client – a shop manager running a store, for example – they lose access on update until an administrator grants it. Set a rule on the individual ability under User Access, or move the site-wide floor with the acrossai_default_ability_capability filter.
• Why: every plugin chose its own lock, and nobody was checking them. Measured across the abilities installed on one site: three registered with no permission check at all, two were open to any logged-in subscriber, and one that writes content was open at contributor level. This plugin now decides who may run an ability, whoever registered it.
• Setting access used to be able to remove the lock. Choosing “Everyone” on an ability replaced its built-in check with one that allowed anybody – an action that reads as tightening actually opened the door. Access rules now sit on top of a floor that cannot be removed by accident.

New tabs

• Store (WooCommerce) – 34 abilities. The catalogue, pricing, stock, orders, customers, coupons, tax, shipping and store settings, plus WooCommerce’s own seven adopted into the same tab. Variable products can now be created at all, which WooCommerce’s own abilities cannot do.
• Backups – 9 abilities. Whether this site can be recovered: what exists, when it last ran and whether it worked, whether the archives are reachable over HTTP, and taking, labelling, deleting or restoring one. Works with UpdraftPlus and All-in-One WP Migration through one set of abilities.
• Yoast SEO – 64 abilities, and Yoast’s own two now have a home.
• LiteSpeed Cache – 61 abilities.
• Contact Form 7 – 25 abilities, and WPForms’ own abilities now have a home with an off switch for form writing.
• WPCode – 24 abilities, adopting the five WPCode already had.
• Cookie Consent – 22 abilities, with an honest account gate rather than silent failure.
• The Events Calendar – 18 abilities and Event Tickets – 16, with capacity modelled and personal data gated.
• Advanced Custom Fields – 16 abilities, joining the existing ACF tab.
• Translations – 14 abilities.
• Email Delivery – 4 abilities, plus a home for the ones the mail plugin ships, and Akismet’s own abilities adopted.
• Classic Editor – 4 abilities for what nothing else can reach.

Safety

• Fixed: editing a WooCommerce product or order through the generic content tools silently corrupted the store. Writing a price through content/update-cpt-item left the price the shop actually charges on the old value, and saving the product correctly afterwards did not repair it. Orders were worse: WooCommerce no longer keeps them in the posts table, so the write changed a row nothing reads and was later deleted. Both are now refused, naming the ability that does work.
• A backup archive that anyone can download is a total compromise, and this now checks for it. Both backup plugins drop a .htaccess to prevent it; on nginx, IIS and Caddy that file is never read, so the protection is present, looks correct, and does nothing.
• Restoring says plainly that it cannot be undone, and records what the site looked like beforehand so what was given up is visible.

The abilities screen

• Integration tabs are now named after the plugin they drive, and abilities registered by other plugins now belong to a toolset instead of vanishing into a catch-all.
• One screen, one access model. The registration gate is gone; tabs were regrouped into task groups, and deep links to retired tabs fall back to “All”.
• Fixed: WPCode’s own five abilities were never actually adopted into its tab – the prefix could not match.

For the complete detail of this release – all 156 entries – and the full history of every earlier release, see changelog.txt inside the plugin, or
https://github.com/acrossaico/acrossai-abilities-manager/blob/main/changelog.txt

0.0.33 – 2026-08-28

Release theme: closing the cheap-edit loop. A follow-up to 0.0.32 that closes the last two gaps between “locate a block cheaply” and “modify it cheaply”. Two changes, both surgical and backwards-compatible.

return_content:false default now covers the two block-tree writers. blocks/add-block and blocks/update-post-block gain the same return_content:{boolean, default:false} input as the six content writers (PR #152) and nine block-editor writers (PR #153). When false (default), the response’s block object strips its innerHTML, innerContent, and innerBlocks — leaving blockName, attrs, and path — and content_bytes reports the saved innerHTML size. Container blocks (columns, cover, group) previously echoed their entire innerBlocks subtree; now they don’t unless the caller passes return_content:true. BREAKING for callers reading response.block.innerHTML on these two abilities — pass return_content:true explicitly. Every other block-tree read/write (mutate-block-tree, replace-block-text, remove-block, duplicate-block, move-block) already returned lightweight envelopes and is unchanged.

blocks/get-post-blocks gains scoping inputs. Three new optional inputs close the “read one block’s markup” gap between blocks/get-post-blocks (full tree, full content) and blocks/outline-post-blocks (scoped but never returns content). path: int[] scopes the response to a subtree (uses the same raw parse_blocks() index scheme as add-block / update-post-block / remove-block, so returned paths interchange). depth: integer bounds descent below the subtree root (-1 unlimited, 0 subtree root only, N below). include_html: boolean (default true = backwards-compat) strips innerHTML + innerContent from every returned node when false. Backwards-compatible: existing callers passing only post_id see identical responses. An unresolvable path returns a standard error envelope with error_code: invalid_path naming which depth failed and how many blocks exist at that level.

0.0.32 – 2026-08-28

Release theme: token-efficient AI callers. Two closely related shifts. First, response payloads shrink dramatically for the common “small edit” and “just tell me the block structure” intents. Second, ability descriptions gain author-declared hints pointing AI callers at cheaper sibling abilities when their intent maps to one. Every change is either strictly additive or opt-out only via an admin toggle — no ability’s execute() behaviour changes.

Token-efficiency default for six content writers. content/create-page, content/update-page, content/create-post, content/update-post, content/create-cpt-item, content/update-cpt-item gain a new optional input return_content:boolean, default:false. When false (the default), the response’s page / post / item object strips three large fields — post_content, post_content_filtered, post_excerpt — and adds content_bytes:integer so callers still see the saved payload size at a glance.

Why. A single-word edit on a ~97 KB page via content/update-page previously round-tripped ~60 K LLM tokens (the caller sent the whole new body and the ability echoed the same body back). With this default, the echo drops to ~0 tokens — the caller pays only for the upload it already had to make. Fine-grained edits via blocks/update-post-block remain ~10× cheaper still because they never touch the surrounding content.

BREAKING for callers reading response.page.post_content (or .post / .item equivalents). Existing callers that need the saved content back — e.g. to diff against what they sent — must pass return_content:true explicitly. The three stripped fields remain queryable via content/get-page / content/get-post after the write.

Not affected. Every other content ability (get / list / delete / block-tree operations / meta ops) is unchanged. The block-tree writers (blocks/update-post-block, blocks/add-block, etc.) already returned just the modified block, not the whole page — nothing to strip.

Same default now applies to nine block-editor writers. blocks/create-block-pattern, blocks/create-block-template, blocks/update-block-template, blocks/create-block-template-part, blocks/update-block-template-part, blocks/create-block-style-variation, blocks/update-block-style-variation, blocks/create-global-style, and blocks/update-global-style gain the same return_content:boolean, default:false input. Response objects (pattern / template / part / variation / record) strip the large content (pattern/template/template-part markup) or data (variation/theme.json JSON) field by default and add content_bytes:integer. For Variation_Db::to_row and Global_Styles_Db::to_row, the writers now pass the caller’s $return_content through instead of hardcoding true — the helpers skip decode_content() when the payload isn’t wanted (CPU saving on the hot path). BREAKING for callers reading response.pattern.content, response.template.content, response.part.content, response.variation.data, or response.record.data — pass return_content:true explicitly. blocks/update-block-pattern is unchanged — it already returned a lightweight location descriptor.

New ability blocks/outline-post-blocks. Returns a flat, depth-first index of a post’s block tree — canonical path, block type, child count, byte size, and a short text preview — without any block content. Cheap way for an LLM caller to locate a block before editing it: blocks/get-post-blocks on a large page can be hundreds of kilobytes because it returns every block’s full innerHTML; this ability returns kilobytes for the same post. Paths use the same raw-parse_blocks() index scheme as Block_Tree, so a path returned here is drop-in usable with blocks/add-block, blocks/update-post-block, and blocks/remove-block. Paths are positional — a write can re-serialize the post and shift raw indices — so the response includes post_modified_gmt for staleness detection; re-outline after each write rather than caching paths. Filters (block_names, contains, max_text, depth, include_attrs, max_results) compose. contains matches only within the extracted text preview (up to max_text characters); raise max_text for deeper substring searches. Whitespace nodes (parse_blocks entries with null blockName) are excluded from output but still consume index positions — same convention Block_Tree already uses. readonly, idempotent, non-destructive.

New — Ability Suggestions framework (Feature 095). Ability authors can now declare a small list of other abilities an AI caller might use instead — a token-saving hint mechanism mirroring Feature 088’s suggested_plugins(). Each ability class can override a new protected method suggested_abilities() returning array<int, array{slug: string, reason: string, saves?: string}>; entries surface under args.meta.acrossai.suggested_abilities on mcp-adapter-get-ability-info (not on discover-abilities — details-only surface, avoids discovery bloat). Hints are strictly advisory — nothing about the original ability’s execution changes. Four initial ability overrides ship in this release: content/update-page, content/update-post, content/update-cpt-item each suggest blocks/outline-post-blocks + blocks/update-post-block for narrow edits (~29K tokens saved on a 97 KB page); blocks/get-post-blocks suggests blocks/outline-post-blocks when only paths are needed (~28K tokens saved on the same page). New admin toggle “Disable ability suggestions” on the Abilities settings tab (between “Plugin Suggestions” and “Uninstall Settings”) strips the field site-wide (option key acrossai_disable_ability_suggestions, default 0 = feature enabled). Uninstall cleans up the option when “delete all data” is on. An ability with no override produces a byte-identical payload to what it produced before Feature 095 — no schema drift, no phantom empty list.

Ten more suggested_abilities() overrides added to the Feature 095 hint catalog. content/get-page, content/get-post, content/get-cpt-item each hint that blocks/outline-post-blocks is far cheaper (~20×) when the caller only needs to locate a block or see the structure. blocks/read-theme-json hints that blocks/get-style-guide returns a normalized token summary (~5–8×) when the caller wants design tokens, not the raw spec. options/list-options, media/list-media, users/list-users, blocks/list-block-templates, blocks/list-block-patterns, blocks/list-global-styles each hint that their corresponding targeted-read siblings (options/get-option, media/get-media, users/get-user, blocks/read-block-template, blocks/read-block-pattern, blocks/read-global-style) are 5–30× cheaper when the caller already knows the identifier — list is for discovery, get/read is for retrieval.

Earlier releases

Every release before 0.0.32 is recorded in full in changelog.txt, shipped inside the plugin and readable at
https://github.com/acrossaico/acrossai-abilities-manager/blob/main/changelog.txt