Files
airano-ir 43fd2201a0 feat(v3.13.0): settings live DB reads, remove Directus/Appwrite, admin stats
Settings fixes:
- MAX_SITES_PER_USER, USER_RATE_LIMIT_PER_MIN/HR now read from DB settings
  table (DB > ENV > default), so dashboard/settings changes apply without
  restart. Sync cache refreshed on every save or delete.
- /api/me reports the live DB value for max_sites_per_user.

Admin improvements:
- Admin users bypass per-user rate limiting entirely (role=admin or ADMIN_EMAILS).
- Admin Overview now shows platform stats: registered users, new users (7d),
  total user sites, available tools.

Plugin cleanup:
- Appwrite and Directus plugins removed from the active registry (8 plugins
  now: WordPress, WooCommerce, WordPress Specialist, Gitea, n8n, Supabase,
  OpenPanel, Coolify). Plugin code is retained for future re-enabling.
- Settings page plugin visibility list updated to match.

Mobile onboarding:
- Stepper steps on narrow viewports stack vertically with correct full border
  and rounded corners on each step.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-20 23:33:20 +02:00

96 lines
2.9 KiB
Markdown

# Reply to wp.org review email — paste into the email thread
Keep this short and direct. wp.org explicitly asks reviewers to skim, not read essays.
---
## Subject line (current round — class-prefix fix)
Re: It's time to move forward with the plugin review "airano" — airano-mcp-bridge
(Reply in the existing thread; don't open a new one.)
---
## Body — paste this for the SECOND review (class prefix fix)
```
Hi,
Thanks. Addressed in v2.10.3:
- Main class renamed from generic `SEO_API_Bridge` to `Airano_MCP_Bridge`
to use the plugin-specific prefix (your "unique prefixes" guideline).
All other elements already used the `airano` prefix as you noted.
This is an internal refactor — the class is only instantiated from the
file's bootstrap line and is never referenced by callers, so there's no
public-API impact.
Updated zip uploaded via "Add your plugin" while logged in as airano.
Thanks,
airano
```
### Reply for the FIRST review (already sent — kept here for reference)
This was the response to the initial pre-review email about ownership
+ media.php/permission_callback. Already sent.
```
Hi,
Thanks for the review. Two notes on the requested items:
1) Ownership / domain verification
The plugin's URI is https://mcp.example.com (the public site for
MCP Hub, the project this companion plugin pairs with). I publish to
both mcp.example.com and example.com; my account on
wordpress.org is "airano".
I've published the requested DNS TXT record at the plugin's domain:
Host: mcp.example.com
Type: TXT
Value: wordpressorg-airano-verification
Please verify with `dig TXT mcp.example.com +short` (the value
should appear within the TTL).
I have also already published https://wordpress.org/plugins/airano-mcp-seo-bridge/
under the same airano account. That plugin is the SEO-only ancestor of
this one. Once airano-mcp-bridge is approved I will release a final
update there pointing users to the new slug.
2) Code review items
Both code points have been addressed in v2.10.2:
- The redundant `wp-admin/includes/media.php` requires inside
/upload-chunk and /upload-and-attach are removed. Those callbacks
only use helpers from file.php (wp_tempnam, wp_handle_sideload) and
image.php (wp_generate_attachment_metadata).
- /upload-and-attach now has its own permission_callback,
`require_upload_and_attach_capability`, which enforces
`current_user_can('edit_post', $attach_to_post)` at the route gate
when attach_to_post is supplied (no longer hidden inside the
callback body), and rejects set_featured without a target post.
I've uploaded the corrected v2.10.2 zip via "Add your plugin" while
logged in as airano.
Happy to make further changes if anything else turns up on a closer read.
Thanks,
airano
```
---
## Before sending
- [ ] You've uploaded `airano-mcp-bridge.zip` (v2.10.3) via the same "Add your plugin" page while logged in as `airano`.
- [ ] You're replying *in the existing thread* with the body shown above.