{"id":311005,"date":"2026-06-26T06:49:51","date_gmt":"2026-06-26T06:49:51","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/acrossai-abilities-manager\/"},"modified":"2026-07-17T16:29:43","modified_gmt":"2026-07-17T16:29:43","slug":"acrossai-abilities-manager","status":"publish","type":"plugin","link":"https:\/\/de-at.wordpress.org\/plugins\/acrossai-abilities-manager\/","author":15295430,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"0.0.9","stable_tag":"0.0.9","tested":"7.0.2","requires":"6.9","requires_php":"8.1","requires_plugins":null,"header_name":"AcrossAI Abilities Manager","header_author":"raftaar1191","header_description":"Manage and customize the abilities of AcrossAI on your WordPress site. Tailor the AI's capabilities to suit your needs, enhancing user experience and engagement.","assets_banners_color":"","last_updated":"2026-07-17 16:29:43","external_support_url":"","external_repository_url":"","donate_link":"https:\/\/github.com\/acrosswp\/acrossai-abilities-manager","header_plugin_uri":"https:\/\/acrossai.co\/","header_author_uri":"https:\/\/profiles.wordpress.org\/raftaar1191\/","rating":0,"author_block_rating":0,"active_installs":0,"downloads":321,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"0.0.1":{"tag":"0.0.1","author":"raftaar1191","date":"2026-06-26 06:49:29"},"0.0.2":{"tag":"0.0.2","author":"raftaar1191","date":"2026-07-02 12:04:52"},"0.0.3":{"tag":"0.0.3","author":"raftaar1191","date":"2026-07-02 12:30:19"},"0.0.4":{"tag":"0.0.4","author":"raftaar1191","date":"2026-07-03 22:38:31"},"0.0.5":{"tag":"0.0.5","author":"raftaar1191","date":"2026-07-04 01:29:09"},"0.0.6":{"tag":"0.0.6","author":"raftaar1191","date":"2026-07-13 14:09:04"},"0.0.7":{"tag":"0.0.7","author":"raftaar1191","date":"2026-07-13 18:14:55"},"0.0.8":{"tag":"0.0.8","author":"raftaar1191","date":"2026-07-17 00:32:32"},"0.0.9":{"tag":"0.0.9","author":"raftaar1191","date":"2026-07-17 16:29:43"}},"upgrade_notice":{"0.0.9":"<p>Adds eight new abilities: six under FileManager for zip-based backup \/ restore workflows (<code>zip-create<\/code>, <code>zip-upload<\/code>, <code>zip-extract<\/code>, <code>zip-download<\/code>, <code>zip-list<\/code>, <code>zip-delete<\/code>) plus <code>plugin-update<\/code> and <code>theme-update<\/code> that finally let AI clients apply pending WordPress core updates through the Abilities API. All new abilities enforce <code>manage_options<\/code>; mutating abilities additionally honour <code>DISALLOW_FILE_MODS<\/code>. Zip extraction rejects zip-slip archives (any entry containing <code>..<\/code>, an absolute path, a backslash, or a null byte). Zip uploads are validated for the <code>PK<\/code> magic signature before finalization. A new <code>wp-content\/uploads\/acrossai-backups\/<\/code> directory is created on first use, hardened with an <code>.htaccess<\/code> that blocks PHP execution but permits <code>.zip<\/code> downloads (required so the URLs returned by <code>zip-create<\/code> remain reachable). No breaking changes to existing abilities, REST endpoints, capability requirements, or database schema. Safe upgrade.<\/p>","0.0.8":"<p>IMPORTANT: this release <strong>removes the Freemius integration entirely<\/strong> \u2014 the plugin no longer sends any data to Freemius and no longer offers a Connect \/ Login \/ Buy affordance on the Add-ons page. If you previously connected a Freemius account tied to this plugin, that connection is now inert; stale <code>fs_*<\/code> or <code>freemius_*<\/code> rows in <code>wp_options<\/code> are safe to delete manually. Also: the Add-ons page now shows only free WordPress.org companion plugins (and no longer lists this plugin itself); the Library page compacts its title + bulk-action buttons onto one horizontal row; and <code>acrossai-co\/main-menu<\/code> bumps <code>0.0.14 \u2192 0.0.23<\/code>. No breaking changes to REST endpoints, capability requirements, or database schema. Safe upgrade.<\/p>","0.0.7":"<p>Adds Library page bulk Enable All \/ Disable All buttons scoped to the active tab, URL-synced tabs (<code>?tab=<\/code>) for deep-linkable views, and a readonly ability preview on disabled cards. No breaking changes; no database schema changes; no new REST endpoints; no new capability requirements. <code>mode<\/code> and per-slug selections are preserved through disable \/ enable cycles. Safe upgrade.<\/p>","0.0.6":"<p>IMPORTANT: this release absorbs the companion <code>acrossai-core-abilities<\/code> plugin \u2014 deactivate and uninstall that plugin after upgrading to avoid duplicate ability registrations. BREAKING for downstream integrators: 17 category slugs rebranded <code>acrossai-core-abilities-<\/code> \u2192 <code>acrossai-abilities-manager-<\/code> and 176 ability slugs <code>acrossai-core-abilities\/<\/code> \u2192 <code>acrossai-abilities-manager\/<\/code>; update any MCP\/REST\/WP-CLI callers that referenced the legacy slugs. Ability payload shapes and permission callbacks unchanged. Also promotes Themes \/ Blocks \/ Plugins \/ Users \/ Database \/ Cron \/ Cache \/ File Manager to their own Library page tabs, bumps <code>acrossai-co\/main-menu<\/code> to <code>0.0.14<\/code>, and rotates Freemius credentials.<\/p>","0.0.5":"<p>Dependency-only release: refreshes the bundled <code>acrossai-co\/main-menu<\/code> package to <code>0.0.11<\/code>. No functional changes to this plugin. Safe upgrade.<\/p>","0.0.4":"<p>IMPORTANT for add-on developers: Library display fields <code>sub_group<\/code>, <code>sub_group_label<\/code>, and <code>tab_group<\/code> must now be nested under <code>$args[&amp;#039;meta&amp;#039;][&amp;#039;acrossai&amp;#039;]<\/code> when calling <code>wp_register_ability()<\/code>. The old top-level shape is silently dropped \u2014 cards will render without their sub-group heading or custom tab placement until you migrate. End users and site administrators are not affected; no data migration, no DB or REST changes. Also swaps the WordPress.org plugin icon to an SVG and drops the directory banners.<\/p>","0.0.3":"<p>Fixes the 0.0.2 activation error on WordPress.org installs \u2014 the release ZIP now includes the Composer autoloader. No functional or user-facing changes vs 0.0.2. If you hit the &quot;Composer autoloader is missing&quot; error on 0.0.2, delete the plugin folder and reinstall 0.0.3.<\/p>","0.0.2":"<p>IMPORTANT: (1) This release does NOT migrate Access Control rules from previous versions. If you had configured any Access Control rules on abilities, audit and reconfigure them after upgrading. Pre-existing rules remain in the database (in the orphaned <code>{prefix}wpb_access_control<\/code> table) but are no longer applied. (2) Ability execution logging has been removed \u2014 the Logs admin page is gone; ability-execution denials are no longer recorded by this plugin. Install a compatible logging plugin if you need this signal.<\/p>","0.0.1":"<p>Initial release.<\/p>"},"ratings":[],"assets_icons":{"icon.svg":{"filename":"icon.svg","revision":3595583,"resolution":false,"location":"assets","locale":false}},"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["0.0.1","0.0.2","0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","0.0.9"],"block_files":[],"assets_screenshots":[],"screenshots":{"1":"The Abilities Manager admin page \u2014 searchable, sortable ability table.","2":"The edit drawer \u2014 tri-state override controls for each ability field.","3":"Bulk actions toolbar for allow\/disallow\/reset across multiple abilities.","4":"The Ability Library page \u2014 enable\/disable add-on ability groups.","5":"The Add-ons page \u2014 browse free companion plugins."}},"plugin_section":[],"plugin_tags":[251511,268952,1912,2353,174442],"plugin_category":[],"plugin_contributors":[140910],"plugin_business_model":[],"class_list":["post-311005","plugin","type-plugin","status-publish","hentry","plugin_tags-abilities","plugin_tags-ability-management","plugin_tags-access-control","plugin_tags-ai","plugin_tags-site-management","plugin_contributors-raftaar1191","plugin_committers-raftaar1191"],"banners":[],"icons":{"svg":"https:\/\/ps.w.org\/acrossai-abilities-manager\/assets\/icon.svg?rev=3595583","icon":"https:\/\/ps.w.org\/acrossai-abilities-manager\/assets\/icon.svg?rev=3595583","icon_2x":false,"generated":false},"screenshots":[],"raw_content":"<!--section=description-->\n<p>AcrossAI Abilities Manager gives site administrators full visibility and control over every ability registered via the WordPress Abilities API (<code>wp_get_ability()<\/code>).<\/p>\n\n<p><strong>Features:<\/strong><\/p>\n\n<ul>\n<li><strong>Browse all abilities<\/strong> \u2014 a searchable, sortable, paginated table listing every registered ability with slug, provider, source, and current status.<\/li>\n<li><strong>Toggle allow\/disallow<\/strong> \u2014 enable or disable any ability site-wide with a single click. Changes are saved instantly without a page reload.<\/li>\n<li><strong>Edit ability metadata<\/strong> \u2014 override <code>readonly<\/code>, <code>destructive<\/code>, <code>idempotent<\/code>, <code>show_in_rest<\/code>, <code>show_in_mcp<\/code>, <code>mcp_type<\/code>, and <code>mcp_servers<\/code> fields per ability using a tri-state system (Yes \/ No \/ Inherit from registry).<\/li>\n<li><strong>Reset overrides<\/strong> \u2014 restore any ability back to its registry defaults with one click.<\/li>\n<li><strong>Bulk actions<\/strong> \u2014 allow, disallow, or reset up to 50 abilities at once.<\/li>\n<li><strong>Ability Library<\/strong> \u2014 enable or disable add-on ability groups from a dedicated Library page, with All\/Specific mode controls per group.<\/li>\n<li><strong>Add-ons page<\/strong> \u2014 browse, install, and manage free and premium add-ons directly from the WordPress admin. Powered by <a href=\"https:\/\/github.com\/WPBoilerplate\/wpb-addons-page\">wpb-addons-page<\/a>.<\/li>\n<li><strong>MCP server list<\/strong> \u2014 view all registered MCP servers when the MCP Adapter plugin is active.<\/li>\n<\/ul>\n\n<p>All overrides are stored in a dedicated database table. The WordPress ability registry is never modified \u2014 only the fields that differ from registry defaults are persisted.<\/p>\n\n<p><strong>Security:<\/strong><\/p>\n\n<ul>\n<li>All endpoints require <code>manage_options<\/code> capability.<\/li>\n<li>All state-changing requests are protected by WordPress nonce verification.<\/li>\n<li>All input is sanitized; all output is escaped.<\/li>\n<\/ul>\n\n<p><strong>Third-party integrations (optional):<\/strong><\/p>\n\n<ul>\n<li><strong>MCP Adapter plugin<\/strong> \u2014 if active, the plugin displays a list of registered MCP servers inside the ability edit panel. No data is sent to any external service. The MCP Adapter plugin communicates only with your own WordPress installation.<\/li>\n<\/ul>\n\n<p>This plugin makes no external HTTP requests. The Add-ons page lists free companion plugins hosted on WordPress.org; installing one uses the standard WordPress plugin installer, which contacts WordPress.org directly.<\/p>\n\n<h3>External Services<\/h3>\n\n<p>This plugin makes no external HTTP requests on its own.<\/p>\n\n<p>The Add-ons page lists free companion plugins hosted on WordPress.org. Installing a listed add-on uses the standard WordPress plugin installer, which contacts WordPress.org on your behalf using WordPress core APIs \u2014 no external service is involved on the plugin's side.<\/p>\n\n<h3>Privacy Policy<\/h3>\n\n<p>This plugin does not collect, store, or transmit any user data.<\/p>\n\n<p>No data is sent to any external server without explicit user action.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the <code>acrossai-abilities-manager<\/code> folder to <code>\/wp-content\/plugins\/<\/code>.<\/li>\n<li>Activate the plugin through the <strong>Plugins<\/strong> menu in WordPress.<\/li>\n<li>Navigate to <strong>AcrossAI Abilities Manager<\/strong> in the WordPress admin menu.<\/li>\n<\/ol>\n\n<p><strong>Add-ons:<\/strong><\/p>\n\n<ol>\n<li>Go to <strong>AcrossAI \u2192 Add-ons<\/strong> to browse available companion plugins.<\/li>\n<li>All add-ons are free and hosted on WordPress.org; each card offers a one-click Install \/ Activate \/ Deactivate action via the standard WordPress plugin installer.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"does%20this%20plugin%20support%20multisite%3F\"><h3>Does this plugin support Multisite?<\/h3><\/dt>\n<dd><p>No. This plugin has not been tested on WordPress Multisite installations.<\/p><\/dd>\n<dt id=\"does%20this%20plugin%20modify%20the%20wordpress%20ability%20registry%3F\"><h3>Does this plugin modify the WordPress ability registry?<\/h3><\/dt>\n<dd><p>No. The plugin stores only overrides \u2014 fields that differ from the registry defaults. The ability registry itself (<code>wp_get_ability()<\/code>) is never modified.<\/p><\/dd>\n<dt id=\"what%20happens%20when%20i%20reset%20an%20override%3F\"><h3>What happens when I reset an override?<\/h3><\/dt>\n<dd><p>The override row is deleted from the database. The ability will inherit its values from the registry again.<\/p><\/dd>\n<dt id=\"what%20is%20the%20ability%20library%3F\"><h3>What is the Ability Library?<\/h3><\/dt>\n<dd><p>The Library page lets you enable or disable ability groups registered by add-on plugins. Each group shows an ON\/OFF master toggle and an All\/Specific mode selector. In Specific mode, individual ability slots can be toggled independently.<\/p><\/dd>\n<dt id=\"what%20is%20the%20mcp%20adapter%20integration%3F\"><h3>What is the MCP Adapter integration?<\/h3><\/dt>\n<dd><p>If the MCP Adapter plugin is active on your site, AcrossAI Abilities Manager will display the list of registered MCP servers in the ability edit panel. This is entirely optional \u2014 the plugin works without the MCP Adapter.<\/p><\/dd>\n<dt id=\"does%20this%20plugin%20make%20external%20http%20requests%3F\"><h3>Does this plugin make external HTTP requests?<\/h3><\/dt>\n<dd><p>No. The plugin makes no external HTTP requests itself. The Add-ons page lists free companion plugins hosted on WordPress.org; installing one uses the standard WordPress plugin installer, which contacts WordPress.org on your behalf using WordPress core APIs.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>0.0.9<\/h4>\n\n<ul>\n<li><strong>New \u2014 six Zip abilities under FileManager for backup \/ restore workflows.<\/strong> <code>acrossai-abilities-manager\/zip-create<\/code> archives a plugin, theme, uploads folder, mu-plugins folder, or any ABSPATH-relative path into <code>wp-content\/uploads\/acrossai-backups\/&lt;random&gt;.zip<\/code> and returns the download URL + SHA-256. <code>zip-upload<\/code> accepts a zip via base64, chunked (up to 8 MB per chunk \/ 64 MB per session, filterable), or a remote URL and finalizes it into the same directory after validating the <code>PK\\x03\\x04<\/code> magic bytes. <code>zip-extract<\/code> extracts a zip already on disk or fetched from a URL into a resolved target directory (plugin \/ theme \/ uploads \/ mu-plugins \/ path); every archive entry is audited for zip-slip (<code>..<\/code> segments, absolute paths, backslashes, null bytes) before extraction. <code>zip-download<\/code> returns a fresh URL + metadata for any managed zip. <code>zip-list<\/code> paginates the managed directories, newest first. <code>zip-delete<\/code> removes a zip from the managed directories idempotently. The backups directory is hardened on first use with an <code>.htaccess<\/code> that blocks PHP execution while keeping <code>.zip<\/code> downloads reachable, plus an empty <code>index.php<\/code> for enumeration defense. All abilities enforce <code>manage_options<\/code>; every mutating ability honours <code>DISALLOW_FILE_MODS<\/code> via the shared <code>File_Mods_Guard<\/code>. See PR #TBD.<\/li>\n<li><strong>New \u2014 <code>acrossai-abilities-manager\/plugin-update<\/code> and <code>acrossai-abilities-manager\/theme-update<\/code> abilities.<\/strong> The Plugins and Themes categories previously shipped an <code>update-check<\/code> reporter but no way to apply updates through the abilities API. The new abilities wrap WP core <code>Plugin_Upgrader::bulk_upgrade()<\/code> \/ <code>Theme_Upgrader::bulk_upgrade()<\/code> (same pattern as the existing <code>plugin-install<\/code> \/ <code>theme-install<\/code>), accept an array of plugin files \/ slugs or theme stylesheets, and return per-slug results with <code>from_version<\/code>, <code>to_version<\/code>, <code>updated<\/code>, and <code>message<\/code>. Plugin_Update additionally requires <code>update_plugins<\/code>; Theme_Update additionally requires <code>update_themes<\/code>. Idempotent: re-running when no update is available reports <code>updated_count: 0<\/code> with a clean success envelope.<\/li>\n<li><strong>Shared utilities: <code>Backups_Storage<\/code> and <code>Zip_Target_Resolver<\/code>.<\/strong> New helpers under <code>includes\/Abilities\/Utilities\/<\/code>. <code>Backups_Storage<\/code> manages the <code>acrossai-backups\/<\/code> and <code>acrossai-staging\/<\/code> directories under <code>wp-content\/uploads\/<\/code>, generates enumeration-resistant random filenames, resolves managed paths with <code>realpath()<\/code> boundary checks, and computes SHA-256 for the listing \/ download responses. <code>Zip_Target_Resolver<\/code> maps <code>(target_type, target)<\/code> to an absolute filesystem path \u2014 plugin slugs resolve via <code>Plugin_Helpers<\/code> (existing fuzzy resolver), theme stylesheets via <code>Theme_Helpers<\/code>, <code>uploads<\/code> via <code>wp_get_upload_dir()<\/code>, <code>mu-plugins<\/code> via <code>WPMU_PLUGIN_DIR<\/code>, and <code>path<\/code> values via a strict inside-ABSPATH realpath check.<\/li>\n<li><strong>Zip_Upload chunk sweeper cron.<\/strong> A new daily cron (<code>acrossai_abilities_manager_zip_upload_sweep_chunks<\/code>) sweeps abandoned chunk sessions from <code>wp-content\/uploads\/acrossai-staging\/<\/code> after the configurable TTL (default: 1 day, filterable via <code>acrossai_abilities_manager_zip_upload_session_ttl<\/code>). Mirrors the existing Upload_Media sweeper.<\/li>\n<li><strong>New configurable limits.<\/strong> <code>acrossai_abilities_manager_zip_max_bytes<\/code> (default 512 MB) caps the decompressed size of any zip written or extracted. <code>acrossai_abilities_manager_zip_upload_chunk_max_bytes<\/code> (default 8 MB base64) and <code>acrossai_abilities_manager_zip_upload_session_max_bytes<\/code> (default 64 MB base64) cap the chunked upload flow.<\/li>\n<\/ul>\n\n<h4>0.0.8<\/h4>\n\n<ul>\n<li><strong>Freemius integration removed entirely.<\/strong> The <code>freemius\/wordpress-sdk<\/code> composer dependency is dropped (upstream <code>acrossai-co\/main-menu<\/code> 0.0.21+ no longer requires it). The plugin no longer sends any data to Freemius, no longer shows a Connect \/ Login \/ Buy affordance on the Add-ons page, and the entire Freemius vendored SDK tree (~2,000 files) is removed from the installable ZIP. If you previously connected a Freemius account tied to this plugin, that connection is now inert; any <code>fs_*<\/code> or <code>freemius_*<\/code> rows in <code>wp_options<\/code> are no longer read by anything and can be safely deleted (e.g. <code>wp option list --search='fs_*'<\/code> then <code>wp option delete &lt;name&gt;<\/code> for each). This supersedes the 0.0.6 changelog entry about Freemius credentials \u2014 those credentials are no longer used. See PR <a href=\"https:\/\/github.com\/acrossai-co\/acrossai-abilities-manager\/pull\/69\">#69<\/a>.<\/li>\n<li><strong>Add-ons page \u2014 free-only, and this plugin excluded from its own listing.<\/strong> The Add-ons page (<code>?page=acrossai-addons<\/code>) now lists only free companion plugins hosted on WordPress.org (Install \/ Activate \/ Deactivate via the standard WP plugin installer). This plugin no longer appears in its own Add-ons page \u2014 a small self-filter on the <code>acrossai_addons<\/code> hook removes it, since it's obviously already active when the page renders. Other AcrossAI companion plugins (MCP Manager, Model Manager, Turn Off AI Features) still list normally.<\/li>\n<li><strong>Library page \u2014 title and Enable All \/ Disable All buttons on a single horizontal row.<\/strong> The \"Ability Library\" page heading and the bulk-action buttons introduced in 0.0.7 (Feature 052) now share one line at the top of the page (title anchored left, buttons anchored right). Saves vertical space; matches administrator expectations for admin page layouts.<\/li>\n<li><strong>Dependencies: <code>acrossai-co\/main-menu<\/code> bumped from <code>0.0.14<\/code> to <code>0.0.23<\/code>.<\/strong> Three-hop bump (0.0.21 \u2192 0.0.22 \u2192 0.0.23) accumulated during the release cycle. Consumer API surface (<code>SettingsPage<\/code>, <code>MenuRegistrar<\/code>, <code>AddonsPageRenderer<\/code>) preserved across each hop; no code changes required beyond removing the old <code>\\AcrossAI_Addon\\AddonsPage<\/code> instantiation (class deleted upstream in 0.0.21 \u2014 its responsibilities moved into <code>\\AcrossAI_Main_Menu\\MenuRegistrar<\/code> which is registered automatically when the shared <code>SettingsPage<\/code> bootstrap runs).<\/li>\n<\/ul>\n\n<h4>0.0.7<\/h4>\n\n<ul>\n<li><strong>Library page \u2014 bulk Enable All \/ Disable All action buttons.<\/strong> A new right-aligned header row above the tab strip on <code>?page=acrossai-abilities-library<\/code> renders two side-by-side buttons that toggle every ability category currently in view with a single click. Actions are scoped to the active tab: on the <code>All<\/code> tab they touch every registered category; on a specific tab (Core, Blocks, Themes, Users, Cache, File Manager, Cron, Database, Plugins) they only touch categories whose ability metadata declares that <code>tab_group<\/code>. Categories in other tabs pass through byte-for-byte unchanged. Each category's mode (All \/ Specific) and per-slug selections are preserved on both actions \u2014 a Disable All \u2192 Enable All cycle is a lossless round-trip. Persisted via the existing <code>POST \/acrossai-abilities-library\/v1\/abilities\/config<\/code> REST route (<code>manage_options<\/code> + nonce, unchanged). See PR <a href=\"https:\/\/github.com\/acrossai-co\/acrossai-abilities-manager\/pull\/68\">#68<\/a>.<\/li>\n<li><strong>URL-synced tabs on the Library page.<\/strong> The active tab is now reflected in the browser URL as <code>?tab=&lt;slug&gt;<\/code>. Deep-linkable, bookmarkable, and browser back \/ forward navigation re-syncs the visible tab. Direct-navigation to <code>?page=acrossai-abilities-library&amp;tab=themes<\/code> opens the Themes tab on first paint. Invalid tab values silently fall back to the default <code>All<\/code> view \u2014 no error, no console warning. The default <code>All<\/code> view keeps the canonical URL clean by removing the <code>tab<\/code> query arg entirely.<\/li>\n<li><strong>Disabled-card UI refresh on the Library page.<\/strong> Disabled category cards now show the master toggle + category label + chevron (visible whenever the category has at least one registered ability). Expanding the chevron on a disabled card reveals a readonly bullet-style preview of the abilities in that category (with descriptions). The All \/ Specific mode selector and interactive per-ability checkboxes remain hidden while the card is disabled \u2014 no interactive control can render on a disabled card even when the stored mode is <code>Specific<\/code>. The stored mode and per-slug selections are preserved so re-enabling restores the prior configuration exactly. Manual per-card disable and bulk <code>Disable All<\/code> produce identical card DOM.<\/li>\n<\/ul>\n\n<h4>0.0.6<\/h4>\n\n<ul>\n<li><strong>BREAKING (downstream integrators) \u2014 17 ability category slugs rebranded from <code>acrossai-core-abilities-&lt;domain&gt;<\/code> to <code>acrossai-abilities-manager-&lt;domain&gt;<\/code>, and 176 ability slugs rebranded from <code>acrossai-core-abilities\/&lt;verb&gt;<\/code> to <code>acrossai-abilities-manager\/&lt;verb&gt;<\/code>.<\/strong> The companion <code>acrossai-core-abilities<\/code> plugin's entire 201-file runtime (17 Category_Registrars, 176 ability classes, 8 helper classes, plus the extra-MIME-types admin field) is absorbed into this plugin. Every category and ability slug is renamed uniformly; ability payload shapes and permission callbacks are preserved verbatim. Downstream code (MCP servers, REST\/WP-CLI callers, integration tests) that referenced the legacy <code>acrossai-core-abilities-*<\/code> slugs by string must update on cutover. Ability payloads themselves are unchanged. See PR <a href=\"https:\/\/github.com\/acrossai-co\/acrossai-abilities-manager\/pull\/65\">#65<\/a>.<\/li>\n<li><strong>Absorbed extra-MIME-types Settings field lands under the Abilities tab.<\/strong> The companion plugin's Core settings tab is retired; its \"extra allowed upload MIME types\" field now renders inside the shared Settings \u2192 Abilities tab. The companion's separate uninstall opt-in is folded into the manager's existing single <code>acrossai_abilities_uninstall_delete_data<\/code> opt-in \u2014 no second checkbox appears. Activation-time migration copies the legacy option (<code>acrossai_core_abilities_extra_mimes<\/code> \u2192 <code>acrossai_abilities_manager_extra_mimes<\/code>), OR-monotonically folds the legacy uninstall opt-in into the manager's opt-in (never demotes a manager-true value), and deletes both legacy option rows. Existing admin configuration is preserved. See PR <a href=\"https:\/\/github.com\/acrossai-co\/acrossai-abilities-manager\/pull\/65\">#65<\/a>.<\/li>\n<li><strong>Retire the <code>acrossai-core-abilities<\/code> companion plugin.<\/strong> After upgrading to 0.0.6, deactivate and uninstall the standalone <code>acrossai-core-abilities<\/code> plugin \u2014 all 176 abilities are now provided by this manager plugin directly. Keeping both plugins active will emit duplicate-registration notices from the WP Abilities API on every request. Removal of the companion plugin folder from production sites is an operational task, separate from this release.<\/li>\n<li><strong>Library page \u2014 Themes \/ Blocks \/ Plugins \/ Users \/ Database \/ Cron \/ Cache \/ File Manager get their own tabs.<\/strong> The absorbed categories are promoted from the shared \"Core\" tab into their own top-level tabs on the Ability Library page (<code>?page=acrossai-abilities-library<\/code>). The \"Core\" tab stays pinned as the second option (immediately after \"All\") regardless of alphabetical ordering. The \"No abilities registered yet\" empty-state copy is updated for the new bundled reality.<\/li>\n<li><strong>Dependencies: <code>acrossai-co\/main-menu<\/code> bumped from <code>0.0.11<\/code> to <code>0.0.14<\/code>.<\/strong> Adopts the Tabs base class extraction (0.0.14) and tab-scoped <code>option_group<\/code> (0.0.13) \u2014 the latter fixes the cross-tab option-clobber bug where saving one Settings tab silently wiped other tabs' options. See PR <a href=\"https:\/\/github.com\/acrossai-co\/acrossai-abilities-manager\/pull\/66\">#66<\/a>.<\/li>\n<li><strong>Freemius product identifiers rotated<\/strong> \u2014 <code>fs_product_id<\/code> changed from <code>31230<\/code> to <code>34418<\/code>, <code>fs_public_key<\/code> rotated to <code>pk_d61a7ddb1a619f7697fbb4fc397b6<\/code>. If you have a Freemius account tied to the previous product ID, reconnect on the Account submenu after upgrade.<\/li>\n<\/ul>\n\n<h4>0.0.5<\/h4>\n\n<ul>\n<li><strong>Dependencies: <code>acrossai-co\/main-menu<\/code> bumped to <code>0.0.11<\/code>.<\/strong> Picks up the latest AcrossAI shared parent menu \/ dashboard \/ settings \/ add-ons page code from that package. No plugin-owned code changes in this release \u2014 the bump is the only functional delta vs 0.0.4.<\/li>\n<\/ul>\n\n<h4>0.0.4<\/h4>\n\n<ul>\n<li><strong>BREAKING (add-on developers) \u2014 Library display fields moved from top-level <code>$args<\/code> into <code>$args['meta']['acrossai']<\/code>.<\/strong> The three Library-only fields introduced by Features 033 and 037 \u2014 <code>sub_group<\/code>, <code>sub_group_label<\/code>, and <code>tab_group<\/code> \u2014 are no longer read from the top level of the <code>$args<\/code> array passed to <code>wp_register_ability()<\/code>. They must now be nested under <code>$args['meta']['acrossai']<\/code>, matching the existing <code>meta.mcp<\/code> (MCP integration) and <code>meta.annotations<\/code> (WP-core annotations) convention. This is a hard cut with no back-compat shim: any add-on that still passes the fields at the top level will silently render its Library card without a sub-group heading or custom tab placement. Migration: change <code>'sub_group' =&gt; 'x'<\/code> to <code>'meta' =&gt; [ 'acrossai' =&gt; [ 'sub_group' =&gt; 'x' ] ]<\/code> (same for <code>sub_group_label<\/code> and <code>tab_group<\/code>). Only affects add-ons that extend <code>Ability_Definition<\/code> and use these Library display fields; abilities without them are unaffected. No end-user data migration, no DB schema change, no REST API change.<\/li>\n<li><strong>Plugin icon replaced with a vector (SVG) asset.<\/strong> The WordPress.org plugin directory now serves <code>.wordpress-org\/icon.svg<\/code> in place of the previous 128\u00d7128 \/ 256\u00d7256 JPG icons, so the icon renders sharp at any display density. Also removes the 772\u00d7250 and 1544\u00d7500 header banners from the directory listing \u2014 the plugin page will show the WordPress.org default header until banners are re-added. wp.org-assets-only change.<\/li>\n<\/ul>\n\n<h4>0.0.3<\/h4>\n\n<ul>\n<li><strong>Fix: plugin now activates on installs from WordPress.org.<\/strong> The 0.0.2 release ZIP shipped without the Composer autoloader (<code>vendor\/autoload_packages.php<\/code>) because the WordPress.org deploy workflow did not run <code>composer install<\/code> before uploading. Users installing 0.0.2 from the WordPress.org plugin directory saw the plugin activation guard trigger: <em>\"AcrossAI Abilities Manager cannot activate: the Composer autoloader is missing\u2026\"<\/em>. The 0.0.3 release ZIP includes the full production autoloader; no other code changes. If you already installed 0.0.2 and hit the activation error, delete the plugin folder and reinstall 0.0.3.<\/li>\n<\/ul>\n\n<h4>0.0.2<\/h4>\n\n<ul>\n<li><strong>Composer dependency refresh<\/strong> \u2014 <code>wpb-access-control<\/code> bumped to v2.0.0 (per-consumer database tables); <code>acrossai-co\/main-menu<\/code> bumped to v0.0.10 (now bundles the Add-ons page and includes the JS-side rebrand-sync fix that restores Install \/ Activate \/ Deactivate button behavior). The standalone <code>acrossai-co\/addons-page<\/code> package has been removed from direct dependencies; the same <code>AcrossAI_Addon\\AddonsPage<\/code> class now ships from the <code>main-menu<\/code> package.<\/li>\n<li><strong>Per-consumer access-control storage<\/strong> \u2014 this plugin now owns its own <code>{prefix}abilities_access_control<\/code> database table, keeping its rules fully isolated from any other plugin embedding the same access-control library. The dedicated table is created automatically on plugin activation.<\/li>\n<li><strong>Add-ons submenu URL changed<\/strong> \u2014 the Add-ons page slug is now <code>acrossai-addons<\/code> (was <code>wpb-addons<\/code>). Any bookmarks or external links pointing at <code>wp-admin\/admin.php?page=wpb-addons<\/code> should be updated to <code>wp-admin\/admin.php?page=acrossai-addons<\/code>. The submenu location and behavior are otherwise unchanged.<\/li>\n<li><strong>BREAKING \u2014 Access Control rules from earlier releases are NOT migrated.<\/strong> If you previously configured Access Control rules on any ability, those rules were stored in the shared <code>{prefix}wpb_access_control<\/code> table and are <strong>no longer read<\/strong> by this release. After upgrading, please audit every ability's Access Control panel and reconfigure any rules that were previously in place. The legacy table is left on disk (in case you need to reference the prior configuration) and can be dropped manually by a database administrator if desired: <code>DROP TABLE {prefix}wpb_access_control;<\/code> and <code>DELETE FROM {prefix}options WHERE option_name = 'wpb_access_control_db_version';<\/code>.<\/li>\n<li><strong>BREAKING \u2014 Ability execution logging removed.<\/strong> The dedicated Logs admin page, the log-retention Settings field, the <code>{prefix}acrossai_ability_logs<\/code> database table, and the <code>\/wp-json\/acrossai-abilities-log\/v1\/logger\/logs<\/code> REST endpoint are all removed. If you rely on ability-execution logging for security monitoring or auditing, install a compatible logging plugin or hook <code>wp_after_execute_ability<\/code> directly in your own consumer code \u2014 the upstream ability-execution events remain available. Bookmarks to <code>wp-admin\/admin.php?page=acrossai-abilities-logs<\/code> receive the standard \"page does not exist\" response. External integrations polling the removed REST endpoint receive 404. On existing installs, the legacy logs table and its schema-version option are orphaned; opt into the \"delete all data on uninstall\" setting to drop them cleanly, or run manually: <code>DROP TABLE {prefix}acrossai_ability_logs;<\/code> and <code>DELETE FROM {prefix}options WHERE option_name IN ('acrossai_abilities_log_retention_days', 'acrossai_ability_logs_db_version');<\/code>.<\/li>\n<\/ul>\n\n<h4>0.0.1<\/h4>\n\n<ul>\n<li>Initial release.<\/li>\n<li>Sitewide Ability Management: browse, toggle, edit, reset, bulk-action.<\/li>\n<li>Ability Library: enable\/disable add-on ability groups with All\/Specific mode controls.<\/li>\n<li>Add-ons page powered by wpb-addons-page with Freemius integration.<\/li>\n<li>MCP server listing via MCP Adapter integration.<\/li>\n<\/ul>","raw_excerpt":"Manage every WordPress ability registered on your site \u2014 view, search, override, and bulk-control ability metadata from a single admin page.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/de-at.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/311005","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/de-at.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/de-at.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/de-at.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=311005"}],"author":[{"embeddable":true,"href":"https:\/\/de-at.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/raftaar1191"}],"wp:attachment":[{"href":"https:\/\/de-at.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=311005"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/de-at.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=311005"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/de-at.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=311005"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/de-at.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=311005"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/de-at.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=311005"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/de-at.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=311005"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}