Changelog
Every release of the YOLO plugin, newest first — from the first line of code to today.
CDN-resilient health check — no false reverts
On sites behind Cloudflare or a WAF, the post-update safety check could mistake a CDN challenge for a broken site and roll back a perfectly good update. Now YOLO probes your origin directly, confirms health via the REST API, and reverts only on a proven fatal — a CDN 5xx or blocked loopback is kept and flagged, never falsely reverted. Adds a {"revert":false} option for sites that prefer to verify themselves, and the fix hardens every safety path: updates, activations, theme switches and AI-extension writes.
Sanitized SVG uploads (opt-in)
A new Allow SVG uploads switch (off by default) accepts .svg files in the media library and asset area — and sanitizes every SVG on upload, stripping scripts, event handlers and remote references. With the switch off, SVG stays blocked as before. You can now also give a connection key a name when you generate it.
Safe plugin & theme updates
YOLO now updates your plugins and themes safely: it snapshots the files first, runs a homepage + REST health check, and automatically rolls a bad update back to the previous version. A new bulk update walks everything with an update available, each rolled back independently — so keeping your whole stack current can’t take the site down.
Docs: Claude Skill & Kits
The in-plugin Help page now covers connecting Claude with a downloadable skill and sharing extensions & kits between sites.
Kit-sharing security hardening
A post-release review of Extension Kits: /kits/import now requires the code scope (it was unreachable via REST), and a remote kit’s member count is capped on import. No critical issues were found.
Admin redesign, Claude Skill & Extension Kits
A big release. A guided Set-up wizard and a clearer section nav, with AI extensions as a first-class area. Connect with one-click Cursor/VS Code, a no-setup paste-a-prompt path, or a downloadable Claude Skill that works in Claude Code, Claude Desktop and the Claude web app. New Extension Kits bundle several AI-built extensions behind one revocable link and install them all on another site, each through the usual safety gate. Plus an opt-out email when an extension is auto-quarantined.
Protect UX clarity
When Protect is off, the Advanced individual-lock checkboxes are greyed out with a clear “not active” note — so ticked-but-unenforced locks can’t be mistaken for active protection.
Security hardening (follow-ups)
Low-severity fixes: conflict-annotation scope gate, path-stripped quarantine/restore errors, a symlink-escape check in the file sandbox, off-site providers re-validate the destination at fetch time, and the recovery endpoint is removed on intentional deactivation.
Security hardening (red-team sweep)
A stronger SSRF guard (re-validates HTTP redirects and IPv4-mapped-IPv6/NAT64), Protect-lock coverage on FSE template reverts and theme-file PHP, and syntax-linting of all executable PHP theme files.
Clear the project log
A “Clear log” button (with confirmation) in wp-admin → Activity to wipe the status and all entries for a fresh start.
Block-theme guidance
Clearer agent instructions on content-vs-theme layering and the front-page.html shadowing trap, so AI-built block themes don’t bake page content into templates.
Code Snippets bridge polish
Paused and quarantined extensions are now visible via the API, an introspect hint surfaces the port, and a corrected safe-swap recipe.
Code Snippets bridge
A read-only inventory of your Code Snippets (GET /introspect/code-snippets) plus a guide recipe to port PHP snippets into managed extensions, with a safe deactivate-source swap.
Shareable extensions
Move an AI-built extension between sites without re-prompting — export or import it as a single file, or flip on a revocable share link another site installs straight from and re-pulls updates with one click. Every import runs the same safety gate as a normal code write.
Launch hardening
A self-cleaning uninstall (with opt-in removal of all data, backups & extensions), an activation pre-flight that checks your WordPress and PHP versions, tidied distribution metadata, and a published responsible-disclosure security policy.
Build & edit block themes
Author a complete FSE block theme from a file map (templates, parts, theme.json) and edit its files in place — syntax-linted, health-checked, and undo-able.
Bricks builder support
Native Bricks pages, alongside Elementor and core blocks — YOLO is now builder-agnostic. The active builder is reported in the API so an agent picks the right path.
Loader reliability
Stopped false-positive extension quarantines on busy hosts — a worker recycle, timeout or OOM kill no longer disables a perfectly good extension.
Site introspection
A read-only, secret-safe way for your AI to learn the ground truth about your site: installed plugins and versions, what they register, and how they’re configured.
Managed extensions
Custom code now behaves like a real plugin — activate, deactivate, and a clean uninstall that removes the tables, options and scheduled tasks it created.
Safer extension writes
Write-time syntax linting plus fail-safe quarantine and restore, so a bad snippet can never quietly take the site down.
Elementor pages & full collaboration
First-class Elementor page authoring (read-modify-write), full-site collaboration conflict coverage, and a plain-English Conflicts review screen.
Collaboration
Safe concurrent editing for multiple people and AIs at once — clashes are detected and queued instead of silently overwriting each other.
Admin redesign
A cleaner control room: full-width app-bar with section navigation.
Protect mode & Custom GPTs
Lock parts of your site before handing over the keys, and connect a Custom GPT via OpenAPI Actions.
Security hardening
Tamper-evident audit log (HMAC hash-chain), SSRF guards, zip-bomb limits on restore, and locked-down asset uploads.
Self-healing loader
Broken extensions are auto-quarantined to keep the site up, with a guard against false positives from one-off crashes.
Project log
A shared, AI-readable record of what’s been done, in progress, and decided — so context survives switching AI tools or working as a team.
Encrypted off-site restore
Restore directly from off-site storage, with client-side public-key encryption so unattended backups stay private.
Off-site backups
Automatic off-site backups to S3-compatible or generic storage — encrypted and unattended.
Emergency recovery
A break-glass page that can get your site bootable again even if wp-admin is down.
Safety core
Auto-rollback on fatal plugin/theme changes, a tamper-evident audit hash-chain, redo, and robust, portable backup & restore (integrity-verified, cross-domain and cross-prefix).
Scoped & read-only tokens
Seven granular scopes (read, content, design, backup, restore, code, install) so you grant exactly what you intend, per token.
Launch
The foundation, in one day: a token-authed API to build and manage a whole WordPress site — content, full design (templates, parts, global styles), media, menus and settings, with per-change snapshots & undo; backup/restore with URL rewriting; code & self-extension with auto-rollback; a plugin/theme installer; a built-in MCP server + OpenAPI; and a one-paste starter prompt.