Bug fix for external script handling. Update recommended.<\/p>","1.3.0":"
New per-artifact API allowlist feature. Artifacts that call external APIs can now declare trusted origins via an HTML pragma comment rather than a server-side CSP filter.<\/p>","1.1.0":"
Rebrand release. If you use the BotCreds Agent Artifacts<\/strong> gives AI agents a permanent home for their outputs.<\/p>\n\n Post a single HTML file to the REST API. The plugin parses it, extracts scripts and styles, saves them as static files, enqueues them properly via WordPress APIs, and serves the result at a clean public URL with strict security headers. No build tools. No infrastructure. One API call.<\/p>\n\n From the caller's perspective: POST HTML, get URL. Everything else happens server-side.<\/p>\n\n Deployment<\/strong><\/p>\n\n Security<\/strong><\/p>\n\n Developer Hooks<\/strong><\/p>\n\n OpenClaw (AI personal assistant)<\/strong><\/p>\n\n OpenClaw agents can deploy interactive dashboards, daily digests, data visualizations, and mini-apps in a single tool call. Generate the HTML, POST it, get the URL \u2014 no manual steps, no context switching.<\/p>\n\n For artifacts that fetch live data, add a pragma comment to the HTML and the CSP is updated automatically:<\/p>\n\n For recurring reports (daily digests, weekly summaries), store the artifact ID after the first deploy and update in place on subsequent runs. The URL never changes.<\/p>\n\n Claude Code (terminal-based coding agent)<\/strong><\/p>\n\n Claude Code sessions can invoke a shell deploy script directly after generating output. Add a Codex (OpenAI coding agent)<\/strong><\/p>\n\n Same pattern as Claude Code. Add deployment instructions to your GitHub Actions (versioned project)<\/strong><\/p>\n\n For projects that build a static HTML output \u2014 dashboards, reports, documentation, changelogs \u2014 a GitHub Actions workflow can deploy to an artifact on every push to The response Include the fetch pragma in your HTML \u2014 no configuration needed:<\/p>\n\n Yes. Any HTTP client that can POST JSON with Basic Auth (username + Application Password) works. No SDK or special library required. curl, Python's urllib, Node's fetch \u2014 anything goes.<\/p><\/dd>\n Artifact pages are served with a Content Security Policy that blocks external script injection and cross-origin fetch\/XHR by default. The CSP is filterable ( The following CDNs are in the default Two options:<\/p>\n\n Option 1 \u2014 HTML pragma (recommended):<\/strong> Add a comment to your submitted HTML:\n <\/p>\n\n The plugin strips the comment from output and adds the origin to Option 2 \u2014 Deploy-time meta field:<\/strong> Pass Both options accept only POST to The plugin allows a superset of Only Administrators by default. To grant access to additional roles:<\/p>\n\n Yes. Place Yes. Artifacts created before v1.0 (stored as raw HTML) are still rendered via a legacy fallback path. No migration needed.<\/p><\/dd>\n Use the oc_artifacts_csp<\/code> or oc_artifacts_allowed_html<\/code> filters, update them to botcreds_agent_artifacts_csp<\/code> and botcreds_agent_artifacts_allowed_html<\/code>. All data (post type, meta keys, REST endpoints) is unchanged.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3578746,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3578746,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3578746,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.3.6","1.3.7"],"block_files":[],"assets_screenshots":[],"screenshots":{"1":"An artifact deployed via the REST API, rendered at its public URL.","2":"The Artifacts list in WordPress admin."}},"plugin_section":[],"plugin_tags":[15643,2353,1556,244880,23853],"plugin_category":[],"plugin_contributors":[83862],"plugin_business_model":[],"class_list":["post-326764","plugin","type-plugin","status-publish","hentry","plugin_tags-agents","plugin_tags-ai","plugin_tags-api","plugin_tags-artifacts","plugin_tags-rest-api","plugin_contributors-jboydston","plugin_committers-jboydston"],"banners":{"banner":"https:\/\/ps.w.org\/botcreds-agent-artifacts\/assets\/banner-772x250.png?rev=3578746","banner_2x":"https:\/\/ps.w.org\/botcreds-agent-artifacts\/assets\/banner-1544x500.png?rev=3578746","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/botcreds-agent-artifacts\/assets\/icon-128x128.png?rev=3578746","icon_2x":false,"generated":false},"screenshots":[],"raw_content":"\nHow It Works<\/h4>\n\n
\n
\/wp-json\/wp\/v2\/artifacts<\/code><\/li>\n<script><\/code> and <style><\/code> blocks and saves them as static files in wp-content\/uploads\/artifacts\/{id}\/<\/code><\/li>\nwp_enqueue_script()<\/code> \/ wp_enqueue_style()<\/code> \u2014 no inline scripts in rendered output<\/li>\nwp_kses()<\/code> and an expanded allowed-tags list (canvas, SVG, inputs, video, audio, data-* attributes)<\/li>\nyourdomain.com\/artifacts\/{slug}\/<\/code> with a strict Content Security Policy<\/li>\n<\/ol>\n\nFeatures<\/h4>\n\n
\n
\/wp-json\/wp\/v2\/artifacts\/{id}<\/code> and the public URL stays the same<\/li>\nartifact_description<\/code> field for internal documentation<\/li>\n<meta><\/code> tags and other <head><\/code> elements from submitted HTML are preserved in output<\/li>\n<script src=\"...\"><\/code> tags are registered as external dependencies and enqueued alongside local assets<\/li>\nfilemtime()<\/code> so browsers fetch updates automatically<\/li>\n\n
cdn.jsdelivr.net<\/code>, unpkg.com<\/code>, cdnjs.cloudflare.com<\/code>, esm.sh<\/code>, cdn.skypack.dev<\/code> \u2014 scripts and styles load from these without any configuration<\/li>\n<!-- artifact:fetch https:\/\/api.example.com --><\/code>) or a deploy-time meta field; the plugin adds them to connect-src<\/code> automatically<\/li>\nX-Content-Type-Options<\/code>, X-Frame-Options<\/code>, Referrer-Policy<\/code><\/li>\nartifact<\/code> capabilities are separate from standard post capabilities; only Administrators can create artifacts by default<\/li>\n<\/ul>\n\n\n
botcreds_agent_artifacts_csp<\/code> \u2014 filter the full CSP header value for any artifact<\/li>\nbotcreds_agent_artifacts_allowed_html<\/code> \u2014 filter the wp_kses<\/code> allowed-tags array<\/li>\nbotcreds_agent_artifacts_grant_to_role()<\/code> \u2014 helper to grant capabilities to additional roles<\/li>\nsingle-artifact.php<\/code> in your active theme to replace the render template<\/li>\n<\/ul>\n\nUse Cases<\/h4>\n\n
<!-- artifact:fetch https:\/\/api.openweathermap.org -->\n<\/code><\/pre>\n\nscripts\/deploy-artifact.sh<\/code> to your project and reference it in your CLAUDE.md<\/code> \u2014 Claude will use it to ship outputs without leaving the terminal. No manual copy-paste, no browser switching.<\/p>\n\nAGENTS.md<\/code> and Codex can write HTML, call the deploy script, and report the live URL \u2014 all in one agent run.<\/p>\n\nmain<\/code>. The artifact ID is stored as a repository variable so the public URL stays stable across all future deploys. Push \u2192 build \u2192 deploy \u2192 done.<\/p>\n\nExample: Deploy via REST API<\/h4>\n\n
curl -X POST \"https:\/\/your-site.com\/wp-json\/wp\/v2\/artifacts\" \\\n -u \"username:application-password\" \\\n -H \"Content-Type: application\/json\" \\\n -d '{\n \"title\": \"My App\",\n \"status\": \"publish\",\n \"meta\": {\n \"artifact_html\": \"<!DOCTYPE html><html><body><h1>Hello.<\/h1><\/body><\/html>\",\n \"artifact_description\": \"Built by my AI agent\"\n }\n }'\n<\/code><\/pre>\n\nlink<\/code> field is the public URL of the deployed artifact.<\/p>\n\nExample: Artifact with Live Data<\/h4>\n\n
<!-- artifact:fetch https:\/\/api.openweathermap.org -->\n<!DOCTYPE html>\n<html>\n<body>\n <div id=\"weather\"><\/div>\n <script>\n fetch('https:\/\/api.openweathermap.org\/data\/2.5\/weather?q=Denver&appid=YOUR_KEY')\n .then(r => r.json())\n .then(d => document.getElementById('weather').textContent = d.weather[0].description);\n <\/script>\n<\/body>\n<\/html>\n<\/code><\/pre>\n\nExample: GitHub Actions Deployment<\/h4>\n\n
name: Deploy Artifact\non:\n push:\n branches: [main]\njobs:\n deploy:\n runs-on: ubuntu-latest\n steps:\n - uses: actions\/checkout@v4\n - run: npm ci && npm run build\n - name: Deploy to Artifact\n env:\n WP_SITE: ${{ secrets.ARTIFACT_WP_SITE }}\n WP_USER: ${{ secrets.ARTIFACT_WP_USER }}\n WP_PASS: ${{ secrets.ARTIFACT_WP_PASS }}\n ARTIFACT_ID: ${{ vars.ARTIFACT_ID }}\n run: |\n PAYLOAD=$(jq -n --arg title \"My Dashboard\" --rawfile html dist\/index.html \\\n '{title: $title, status: \"publish\", meta: {artifact_html: $html}}')\n ENDPOINT=\"$WP_SITE\/wp-json\/wp\/v2\/artifacts\"\n [ -n \"$ARTIFACT_ID\" ] && ENDPOINT=\"$ENDPOINT\/$ARTIFACT_ID\"\n curl -sf -X POST \"$ENDPOINT\" -u \"$WP_USER:$WP_PASS\" \\\n -H \"Content-Type: application\/json\" -d \"$PAYLOAD\" | jq -r '.link'\n<\/code><\/pre>\n\n\n\n
botcreds-agent-artifacts<\/code> folder to \/wp-content\/plugins\/<\/code><\/li>\n\n
Does this work with any REST client or AI agent?<\/h3><\/dt>\n
Are artifacts sandboxed?<\/h3><\/dt>\n
botcreds_agent_artifacts_csp<\/code>) for custom use cases, and per-artifact API origins can be declared via the artifact:fetch<\/code> pragma or the artifact_connect_src<\/code> meta field.<\/p><\/dd>\nWhat scripts and CDNs are allowed without configuration?<\/h3><\/dt>\n
script-src<\/code> allowlist: cdn.jsdelivr.net<\/code>, unpkg.com<\/code>, cdnjs.cloudflare.com<\/code>, esm.sh<\/code>, cdn.skypack.dev<\/code>. External modules loaded from these CDNs work in artifact HTML without any additional configuration.<\/p><\/dd>\nHow do I allow my artifact to call an external API?<\/h3><\/dt>\n
connect-src<\/code>.<\/p>\n\nartifact_connect_src<\/code> as an array:\n \"meta\": { \"artifact_connect_src\": [\"https:\/\/api.example.com\"] }<\/p>\n\nhttps:\/\/<\/code> origins. No wildcards, no http:\/\/<\/code>.<\/p><\/dd>\nHow do I update an artifact without changing its URL?<\/h3><\/dt>\n
\/wp-json\/wp\/v2\/artifacts\/{id}<\/code> with the same fields. The existing asset files are cleared, new files are written, and the public URL (\/artifacts\/{slug}\/<\/code>) does not change.<\/p><\/dd>\nWhat HTML elements and attributes are allowed?<\/h3><\/dt>\n
wp_kses_allowed_html('post')<\/code> including <canvas><\/code>, <svg><\/code>, <path><\/code>, <input><\/code>, <button><\/code>, <select><\/code>, <option><\/code>, <label><\/code>, <video><\/code>, and <audio><\/code> with their common attributes. data-*<\/code> attributes are allowed on interactive elements. Additional tags and attributes can be added via the botcreds_agent_artifacts_allowed_html<\/code> filter.<\/p><\/dd>\nWho can create artifacts?<\/h3><\/dt>\n
botcreds_agent_artifacts_grant_to_role( 'editor' );\n<\/code><\/pre><\/dd>\nCan I use a custom template?<\/h3><\/dt>\n
single-artifact.php<\/code> in your active theme and it takes precedence over the plugin's default template. The plugin template is used as a fallback.<\/p><\/dd>\nWill my old artifacts still work after upgrading?<\/h3><\/dt>\n
How do I update the Content Security Policy?<\/h3><\/dt>\n
botcreds_agent_artifacts_csp<\/code> filter:<\/p>\n\nadd_filter( 'botcreds_agent_artifacts_csp', function( $csp, $post_id ) {\n return $csp . \"; worker-src 'self'\";\n}, 10, 2 );\n<\/code><\/pre><\/dd>\n\n<\/dl>\n\n\n1.3.4<\/h4>\n\n
\n
1.3.3<\/h4>\n\n
\n
1.3.2<\/h4>\n\n
\n
single-artifact.php<\/code> with botcreds_<\/code> to satisfy WordPress coding standards (PrefixAllGlobals)<\/li>\n1.3.1<\/h4>\n\n
\n
<script src=\"...\"><\/code> nodes are now correctly removed from the DOM before the body is serialized, preventing duplicate rendering<\/li>\n<\/ul>\n\n1.3.0<\/h4>\n\n
\n
<!-- artifact:fetch https:\/\/api.example.com --><\/code> pragma in submitted HTML<\/li>\nartifact_connect_src<\/code> meta field for deploy-time origin declaration via REST<\/li>\nhttps:\/\/<\/code> origins accepted (no wildcards, no http)<\/li>\nconnect-src<\/code> is now dynamically built from declared origins per artifact<\/li>\n<\/ul>\n\n1.2.0<\/h4>\n\n
\n
cdn.jsdelivr.net<\/code>, unpkg.com<\/code>, cdnjs.cloudflare.com<\/code>, esm.sh<\/code>, cdn.skypack.dev<\/code><\/li>\n<script src=\"...\"><\/code> tags are now extracted and enqueued as external script dependencies<\/li>\n<head><\/code> tags) from submitted HTML is preserved and injected into the artifact's <head><\/code><\/li>\nfilemtime()<\/code> for automatic browser cache invalidation<\/li>\nWP_Filesystem<\/code> for proper WordPress filesystem abstraction<\/li>\n<\/ul>\n\n1.1.0<\/h4>\n\n
\n
botcreds_agent_artifacts_csp<\/code>, botcreds_agent_artifacts_allowed_html<\/code><\/li>\nbotcreds_agent_artifacts_grant_to_role()<\/code><\/li>\nRequires at least<\/code> and Requires PHP<\/code> headers<\/li>\n1.0.0<\/h4>\n\n
\n
wp_kses()<\/code> with expanded allowed-tag list<\/li>\n0.3.0<\/h4>\n\n
\n
0.2.0<\/h4>\n\n
\n
0.1.0<\/h4>\n\n
\n