=== Nolimit Assistant ===
Contributors: kristianwind
Tags: health, security, maintenance, woocommerce, ai
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.2.2
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Keeps WordPress and WooCommerce in good shape: continuous checks, known-vulnerability matching, and an optional AI assistant that explains what it found.

== Description ==

This plugin watches a WordPress or WooCommerce site for the problems that do
not announce themselves — an expired PHP branch, a payment method that quietly
stopped being available, a queue of shop actions that has stopped draining, a
plugin with a published vulnerability — and tells you which of them is worth
your attention today.

It is built around one idea: **the ordering matters more than the list.** A
site with thirty findings and no sense of priority produces the same outcome as
a site with no plugin at all. So everything here works towards one sentence at
the top of the screen that answers "does anything need me today".

= What it does without any AI at all =

The assistant is optional and off by default. With it switched off the plugin
still:

* Runs around twenty checks across security, performance, maintenance and shop
  health, on a schedule you choose.
* Tracks each finding over time, so you can see what is new, what has been open
  for a month, and what you already fixed.
* Matches installed versions of WordPress, plugins and themes against published
  vulnerability advisories, with CVE references.
* Orders the work by severity, and holds non-urgent work back during a change
  freeze — while still recommending security and payment fixes, which a freeze
  must never block.
* Walks you through setup and hardening with guides that check their own steps,
  so you only read the ones you have not already done.

= What the assistant adds =

Connected to a model, it writes a short briefing after each run, explains an
individual finding in plain language, and groups findings that share a cause.

You choose the provider. Anything OpenAI-compatible works — OpenAI, Anthropic,
DeepSeek, OpenRouter, Groq, Mistral, Together — as does a model running on your
own machine through Ollama or LM Studio, in which case nothing leaves your
network at all.

There are five levels, from off, through answering only when you ask, up to
acting on a short list of things you have explicitly permitted.

= What is sent, and what is not =

This plugin contains no analytics, no tracking and no phone-home. It does not
report that it is installed, and it never sends your site's address anywhere.

The assistant is the one exception, and it is an exception you switch on. When
it is on:

* You choose, per category, what may be included: findings, the plugin list,
  configuration values, file paths, measurements. Each is a separate switch and
  most default to off.
* Email addresses, IP addresses, card numbers, national ID numbers and anything
  shaped like an API key are removed before the request is built.
* Every single request is logged with the exact text that was sent, and you can
  read it under Activity. Not a summary of it — the text.
* A daily request limit and an optional monthly spend limit both refuse before
  a request is made, not after.

The vulnerability lookup is a separate switch for the same reason: asking a
public database about a plugin by name tells that database you have it
installed. No key, no account, and nothing identifying your site is sent — but
it is still information leaving the site, so it is your decision.

== Frequently Asked Questions ==

= Does this slow my site down? =

It does no work on a visitor's page load: no database queries of its own, no
HTTP requests, and no hooks in the page-rendering path. The checks run on a
schedule in the background, the check files are not even loaded on a front-end
request, admin styles load only on this plugin's own screens, and a model
request can never be made from a front-end request — that last one is enforced
in code, not merely intended.

= Can I use it without paying an AI provider? =

Yes. The checks, the findings, the priority ordering, the vulnerability
matching and the guides all work with the assistant switched off. And if you
want the assistant without a bill, point it at Ollama or LM Studio on your own
machine.

= What is a change freeze? =

A period when you deliberately stop making non-urgent changes because the cost
of breaking something is unusually high — most commonly from a couple of weeks
before Black Friday until early January, when a shop earns much of its year and
there is nobody at a desk to fix a bad deployment.

The plugin works the dates out on your site, including public holidays. During
a freeze it still reports everything and still recommends security and payment
fixes; it holds the rest back and tells you when the freeze ends.

= Does it work without WooCommerce? =

Yes. The shop checks register themselves only when WooCommerce is active, so a
plain WordPress site never sees a finding it cannot act on.

== Changelog ==

= 0.2.2 =
* Times are shown as timestamps instead of "4 hours ago". WordPress translates
  the duration and this plugin ships no translation, so on a Danish site the
  screen read "4 timer ago" — one sentence, half in each language. Nine places.
* Tables survive a phone: they scroll sideways, and values that are one thing
  to a reader — a timestamp, a model id — no longer break at every dot.

= 0.2.1 =
* The word in the shared menu is now the plugin's own name, set in one place
  and asserted separately from the page it opens. A sibling plugin had one
  string doing both jobs, renamed it to read well beside its tabs, and quietly
  became "Overview" in a menu shared by five plugins.

= 0.2.0 =
* One menu entry instead of six. Five plugins with five submenus each produced
  seventeen entries, with Activity twice and Settings three times, and nothing
  in the labels said which plugin they belonged to. The screens are tabs now.
* Every existing admin.php?page= link still works: the pages are registered and
  then removed from the menu, not left unregistered.

= 0.1.4 =
* Repairs an update row that was poisoned by a neighbouring plugin before this
  version was installed. The earlier protection only won the race to write the
  row; a bad row already stored survived the upgrade until it expired, so the
  fix could arrive and the screen stay wrong.

= 0.1.3 =
* The protection added in 0.1.2 is now measured rather than asserted: the test
  registers an unguarded neighbour of exactly the shape found on a live site
  and checks who gets the last word. At the old priority the neighbour wins and
  the download address behind this plugin's row becomes the neighbour's zip.

= 0.1.2 =
* Registers last on the shared update hook, so a neighbouring plugin on the
  same host cannot overwrite this plugin's row in the updates list. Measured on
  a live site: four plugins were all offered another plugin's version, with its
  icon, by one unguarded copy.

= 0.1.1 =
* Test connection now works. It calls the plugin's own REST route, and a REST
  request is not an admin page load, so the button refused itself with "A model
  request cannot be made from a front-end page load."
* The menu says Assistant rather than AI Manager.

= 0.1.0 =
* First release.
