=== SproutOS ===
Contributors: posimyththemes, sagarpatel124
Tags: ai, automation, mcp, sandbox, assistant
Requires at least: 6.5
Tested up to: 6.9
Requires PHP: 8.0
Stable tag: 0.1.0

License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Connect WordPress with AI-powered site tools, admin controls, automation features, analytics, and optional webhook integrations.

== Description ==

SproutOS is a modern WordPress plugin designed to help site owners, agencies, and developers work faster with AI-powered tools, flexible admin controls, and workflow-focused features.

It helps streamline website management, improve automation, and organize advanced site operations from a dedicated admin experience inside WordPress.

With SproutOS, you can configure smart site tools, manage feature access, monitor activity, set up notifications, and keep better control over how advanced functionality is used on your website.

The plugin does not require any external service to run its core admin experience. External requests are only made in specific optional situations described below.

= Why Use SproutOS? =

* Improve WordPress workflows with AI-powered tools and automation support.
* Control which advanced features are available in your site setup.
* Manage site activity with analytics and logging controls.
* Receive webhook and email notifications for selected events.
* Add safety-focused controls for advanced operations.

= Main Features =

* AI-powered workflow support for advanced WordPress use cases.
* Admin dashboard for connection settings, feature controls, analytics, and privacy options.
* Enable or disable feature groups based on your workflow.
* Support for custom advanced tools and controlled admin operations.
* Runtime protection for safer handling of advanced features.
* Activity tracking for usage, sessions, and related events.
* Webhook notifications for external monitoring and automation.
* Data-sharing controls for environment details sent to AI clients.

= Privacy And External Services =

* Analytics and logging settings are configurable by the site administrator.
* Webhook delivery is optional and disabled by default.
* If webhook notifications are enabled, selected event data is sent to the webhook endpoint configured by the administrator.
* Site owners are responsible for reviewing the privacy policy and terms of any external webhook service they choose to use.

== External Services ==

= Openverse (Stock Image Search) =

SproutOS includes an optional stock image search feature. When an administrator or AI tool calls the stock image search ability, the plugin sends a request to the Openverse API to retrieve freely licensed images.

**What data is sent:** The search query (keyword) and optional filters (page number, image type). No personal data, user data, or site-specific data is transmitted.

**When it is sent:** Only when the stock image search ability is explicitly invoked. It is never called automatically or on page load.

**Service provider:** Openverse, operated by the WordPress Foundation.

* Service URL: https://openverse.org/
* API endpoint: https://api.openverse.engineering/v1/images/
* Terms of Use: https://docs.openverse.org/terms_of_service.html
* Privacy Policy: https://wordpress.org/about/privacy/

= Webhook Notifications (Optional) =

If the administrator enables webhook notifications in SproutOS settings and provides a webhook URL, the plugin will send selected event data (such as tool call summaries) to that URL.

**What data is sent:** Event type, timestamp, and related tool/action metadata. No passwords or payment data are included.

**When it is sent:** Only when a matching event occurs and webhook delivery is enabled by the administrator.

**Service provider:** Determined entirely by the administrator. SproutOS does not operate a webhook endpoint.

== Installation ==

1. Upload the `sprout-os` plugin folder to the `/wp-content/plugins/` directory, or install the plugin through the WordPress admin plugin installer.
2. Activate `SproutOS` from the `Plugins` screen in WordPress.
3. Open the `SproutOS` menu in the WordPress admin area.
4. Review the available settings and configure the features you want to use.
5. Enable only the modules or tools required for your workflow.
6. Configure analytics, notifications, and related controls based on your site needs.
7. Test the enabled features before using them on a live website.


== Frequently Asked Questions ==

= What does SproutOS do? =

SproutOS helps improve WordPress workflows with AI-powered tools, automation support, admin controls, analytics, and flexible feature management.

= What is MCP? =

MCP stands for Model Context Protocol. SproutOS supports modern AI-connected workflows, but the plugin is also designed around practical WordPress management, controls, and automation features.

= Who is this plugin for? =

This plugin is useful for agencies, developers, and advanced WordPress users who want more control, automation, and modern workflow tools inside WordPress.

= Can I control which features are enabled? =

Yes. SproutOS includes module-based controls so you can enable or disable feature groups from the admin interface.

= Does SproutOS include advanced developer tools? =

Yes. SproutOS includes support for advanced workflows and controlled custom tooling for users who need deeper flexibility.

= Does SproutOS include analytics or logging? =

Yes. The plugin includes analytics and activity tracking features so you can monitor feature usage, calls, errors, and related events.

= Can I send webhook notifications? =

Yes. SproutOS includes webhook notification settings so you can send selected events to supported external endpoints for monitoring or automation.

= Does this plugin contact external services by default? =

No. SproutOS does not require an external service for its core features. Optional external requests are only made if an administrator enables webhook notifications and configures a webhook URL.

= Is SproutOS safe for live websites? =

SproutOS is designed with admin controls and safety-focused settings, but you should still enable only the features you need and test advanced options carefully before using them on a live website.

== Changelog ==

= 0.1.0 =

* Add : AI Memory system — agents can now save, search, retrieve, and manage persistent memories across sessions.
* Improvement : Dashboard design improvements across the admin panel for better clarity and layout consistency.
* Fix : Sandbox path issue causing incorrect file resolution on some server setups.
* Fix : Security related bug fix and improvement.
* Fix : Minor bug fix and improvement.

= 0.0.3 =

* Add : MCP Connect : Node/npm install guide popup with OS-specific steps on all Setup Instructions panels
* Add : Dashboard : CSS to suppress third-party admin notices and banners on SproutOS and TheePlus pages
* Add : readme.txt : External Services section documenting Openverse API and webhook notifications

* Improvement : Write Blocking : Enforce write restrictions via wp_before_execute_ability for all MCP adapters universally
* Improvement : AI Abilities : All 192 ability labels updated to [Category] Action prefix format for clarity
* Improvement : WooCommerce Abilities : Renamed category from sprout-woocommerce to woocommerce-sprout and registered group correctly
* Improvement : Execute PHP : Replace global SAVEQUERIES define with scoped $wpdb->save_queries and restore after capture
* Improvement : Custom JS Ability : Store JS in post meta and output via wp_add_inline_script instead of raw script tags
* Improvement : Sandbox Loader : Sandbox and backup data moved from plugin folder to wp_upload_dir() uploads directory

* Fix : Sandbox Loader : Add wp_verify_nonce verification to sprout_mcp_safe_mode URL parameter
* Fix : Plugin Abilities : Remove direct misc.php core file includes, replace with WP_Filesystem() calls
* Fix : Upload Media : Remove direct core file includes, add WP_Filesystem() initialisation
* Fix : Upload SVG : Remove direct core file includes, add WP_Filesystem() initialisation
* Fix : Abilities Register : Remove variable parameters passed through __() to fix i18n handling
* Fix : Admin Pages : Capture ob_get_clean() output explicitly before passing to wp_send_json_success
* Fix : Composer Libs : Add ABSPATH guard to installed.php and .htaccess to block direct web access

= 0.0.2 =

* Added Capabilities Profile selector (Ultra-minimal / Minimal / Standard / Full) so admins can pick how much of the tool catalogue is exposed to MCP clients upfront. Defaults to Minimal.
* Added the sprout-bridge tools (discover-tools, inspect-tool, dispatch-tool) as first-class MCP-visible tools so agents on light profiles can still reach the full library on demand.
* Added plugin-presence gating: Elementor, Bricks, and WooCommerce abilities now register only when the underlying plugin/theme is active.
* Removed approval-queue + confirmation-token systems. Snapshots are now the single recovery path for destructive changes.
* Removed safety-mode setting and anomaly tripwire to simplify configuration.
* Sandbox PHP execution is now opt-in (default off).
* Hardened path-traversal boundary checks in the filesystem helpers and admin AJAX handler so sibling directories cannot bypass the prefix-match.
* Hardened sprout/list-directory to honour the same sensitive-file guard that sprout/read-file already enforces.

= 0.0.1 =

* Initial public release.
* Added WordPress admin management screens and workflow controls.
* Added AI-powered feature controls and module settings.
* Added advanced runtime protection and recovery handling.
* Added analytics, webhook notifications, and activity controls.

== Upgrade Notice ==

= 0.0.2 =

Adds Capabilities Profile selector (default: Minimal). Retires approval-queue and confirmation-token systems in favour of snapshot-based recovery. Patches two path-traversal hardening issues. Visit Settings → Safety to switch to Standard or Full profile.

= 0.0.1 =

Initial release of SproutOS with AI-powered workflow tools, admin controls, analytics, notifications, and safety-focused settings.
