SophMate plugin changelog

Added

• Copilot Files — Added a Pro-only, first-class file workspace for private AI-created and uploaded files, with encrypted storage, immutable revisions, provenance, scoped access grants, metadata and tag management, search and filtering, archive/trash lifecycle controls, authenticated previews and downloads, responsive desktop/mobile layouts, and accessible Markdown, CSV, JSON, TXT, PDF, and image rendering.
• Added Copilot file tools for listing, searching, inspecting, and reading accessible files; privately creating Markdown, TXT, JSON, CSV, and PDF artifacts; and approval-governed metadata, sharing, status, and revision-restore operations. File contents are treated as untrusted input, reads are bounded, and encrypted keyword indexing avoids plaintext search indexes.
• Added end-to-end chat integration for Copilot Files, including a searchable composer picker, combined five-file attachment limits, persisted attachment references, streamed and reload-safe artifact cards, authenticated preview/download actions, and cross-conversation file discovery instead of relying on conversation memory.
• Added an opt-in, Pro-only SophMate MCP Server for securely connecting Claude Code and other remote MCP clients to site-scoped SophMate tools, with Streamable HTTP, OAuth 2.1 and expiring personal tokens, connection-specific tool allowlists and permissions, read-only and all-tools snapshot presets, rate limits, audit/privacy controls, action-plan-governed write operations, and a separately confirmed administrator-only mode for always executing while bypassing human approval policy.
• Added current OpenAI GPT-5.6 variants and Claude Sonnet 5 to the Copilot model catalog; the current Gemini 3.5 Flash, 3.1 Pro, and 3.1 Flash-Lite family remains available.
• Added a read-only sophmate.web.fetch AI tool for direct access to public HTTPS pages and textual APIs, with readable extraction, long-content chunking, link discovery, SSRF protection, bounded responses, and explicit untrusted-content labeling.
• Added a provider-neutral sophmate.web.search AI tool backed by native OpenAI Responses or Anthropic server search, with ranked citations, domain/locale/recency controls, active encrypted-credential reuse, cache and rate controls, budget accounting, and a search-then-fetch workflow.
• Added Google Gemini as a first-class LLM provider, with end-to-end support for provider setup, native streaming chat, structured output, tool calling, multimodal input, managed Agents, model selection, connection tests, and WordPress 7.0 Google connector credentials.
• Added a WordPress-first Site mode for installations without an active, supported WooCommerce version, including a shared capability profile, dependency-aware tools and automations, goal-based onboarding, WordPress-native Quick Actions, Site Insights, Site Brief onboarding, site-care watchers, and compatibility metadata for App Center apps.

Changed

• Made the sophmate.web.fetch AI-facing description explicitly instruct models to call it when users ask to fetch, open, read, inspect, or summarize a supplied website URL instead of searching for that URL.
• Adapted Home, Status, Copilot, Insights, Quick Actions, Playbooks, Agents, Workflows, Watchers, App Center, Theme Assistant, Marketing, Personalization, and Settings to present WordPress features first and expose commerce only when WooCommerce is ready or the user intentionally looks for it.
• Replaced missing optional-commerce error states with neutral, accessible dependency guidance and native WordPress plugin-management actions, while preserving blocked commerce configurations for automatic recovery after WooCommerce is reactivated.
• Made WP-Cron a supported Site-mode background backend and reserved Action Scheduler requirements for workloads that genuinely need it.

Fixed

• Added provider-specific compatibility for the newest models: GPT-5.6 uses max_completion_tokens while legacy-compatible and local models retain max_tokens, Claude 5 models omit unsupported sampling parameters and expose classifier refusals as content filtering, Gemini 3.5 omits legacy sampling parameters, and shut-down Gemini model IDs migrate to supported successors. Filtered responses now discard partial text and tool calls across stored, cached, and live-streamed output.
• Hardened web fetch and search against recognizable credentials (including recursively encoded, nested, and parser-ambiguous query parameters), unsafe or looping redirects, multiplied request timeouts, known or heuristic binary payloads behind misleading content types, pathological HTML DOM breadth, cross-user/provider cache reuse and provider-configuration races, oversized structured or single-field responses and paused-turn replay state, omitted or failed-request usage accounting, mixed-answer refusals, incomplete provider responses, and Anthropic server-tool or paused-continuation failures returned with HTTP 200.
• Corrected Gemini thinking-token accounting, safety-block handling, malformed function-call rejection, thought-signature preservation, Google API-key error classification, JSON Schema compatibility, and resolved-endpoint connection testing.
• Prevented Site-mode pages, Copilot tool catalogs, slash commands, schedulers, hooks, direct deep links, and app runtimes from advertising or calling unavailable WooCommerce functionality.
• Corrected Site-mode readiness and attention counts so an absent optional WooCommerce integration does not make an otherwise healthy SophMate installation appear broken.

Added

• Added WordPress 7.0 AI Connector credential detection for OpenAI and Anthropic, with automatic connector-key usage during setup/runtime and a SophMate key override option.
• Added an auto-mode workflow option to bypass the site's approval policy for workflow tool actions, allowing trusted workflows to execute eligible tools without waiting for policy-based approval matches.
• Long-Running Background Tasks — Copilot can now propose durable background tasks for work that exceeds a chat turn (translate all products, audit every order, bulk-create posts) and hand them to a tick-based runner built on Action Scheduler (WP-Cron fallback with watchdog). Includes: launch card in chat with per-task model/worker-model selection and a hard token budget cap; batched execution (compiled task program with per-chunk model calls and grouped bulk action plans) and exploratory execution (checkpointed agent loop with transcript compaction and circuit breakers); blocking and queued approval modes with apply-on-approve, rejection feedback, and a finishing/reconciliation phase; scoped pre-authorization grants (tool + quantity caps + risk ceiling bounded by the granting operator's own approval capability, never-grantable policy for critical/deletion/refund/bulk-email actions, supervised trust-ramp that auto-revokes on any rejection); pilot batch review; a SophMate > Tasks admin page (live activity feed, approvals with approve-all-of-type, grants panel, items with retry, final report, steering box, pending-attention menu badge); completion reports posted back to the originating conversation; per-task and site-budget enforcement with an interactive-chat reserve; audit events, GDPR export/erasure, retention purge, Site Health-style scheduler awareness, and wp sophmate task WP-CLI commands. Feature-flagged (background_tasks) and premium-gated.

Fixed

• Reduced 128M memory-limit pressure by deferring admin REST route and scheduler bootstrap work, lazily resolving screen assets, adding opt-in runtime memory profiling, bounding list/export/support-bundle materialization, and checkpointing background batches before memory reserve exhaustion.

Added

SophMate 1.0.0 is the initial WordPress plugin release. It introduces the AI Copilot for natural-language WordPress and WooCommerce work, with conversation history, optional memory, @mentions, slash commands, and fullscreen admin chat. Teams can turn recommendations into approval-based action plans with risk levels, affected records, diff previews, and audit trails before anything changes on the site.

The release also includes Knowledge Base sources, tone guidance, built-in and custom playbooks, workflows, watchers, alerts, WooCommerce analytics, KPI reporting, top performers, WooCommerce assistant operations, Marketing Studio, Theme Assistant, image generation, and support reply drafting. Operators get diagnostics, support bundles, retention controls, Safe Mode, and WP-CLI tools for setup and maintenance.

Security and privacy

Version 1.0.0 ships with encrypted provider keys, capability-based access, nonce-protected REST endpoints, audit redaction, IP hashing, PII masking, and WordPress Privacy tools integration for export and erase requests. Start with Security and Key Rotation when credentials change, and use Diagnostics and Support when collecting safe support evidence.

Requirements

SophMate requires WordPress 6.0 or higher, PHP 8.2 or higher, and the OpenSSL extension for API key encryption. WooCommerce is optional, but required for commerce-specific products, orders, coupons, customers, and analytics workflows.

Upgrade notes

This is the first tagged V1 release. New installs should follow Install SophMate, then review CodeCanyon Licensing and Updates before production rollout.