=== Nolimit Assistant ===
Contributors: kristianwind
Tags: health, security, maintenance, woocommerce, ai
Requires at least: 6.0
Tested up to: 7.1.2
Requires PHP: 7.4
Stable tag: 0.3.0
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Keeps WordPress and WooCommerce in good shape: continuous checks, known-vulnerability matching, and an optional AI assistant that explains what it found.

== Description ==

This plugin watches a WordPress or WooCommerce site for the problems that do
not announce themselves — an expired PHP branch, a payment method that quietly
stopped being available, a queue of shop actions that has stopped draining, a
plugin with a published vulnerability — and tells you which of them is worth
your attention today.

It is built around one idea: **the ordering matters more than the list.** A
site with thirty findings and no sense of priority produces the same outcome as
a site with no plugin at all. So everything here works towards one sentence at
the top of the screen that answers "does anything need me today".

= What it does without any AI at all =

The assistant is optional and off by default. With it switched off the plugin
still:

* Runs around twenty checks across security, performance, maintenance and shop
  health, on a schedule you choose.
* Tracks each finding over time, so you can see what is new, what has been open
  for a month, and what you already fixed.
* Matches installed versions of WordPress, plugins and themes against published
  vulnerability advisories, with CVE references.
* Orders the work by severity, and holds non-urgent work back during a change
  freeze — while still recommending security and payment fixes, which a freeze
  must never block.
* Walks you through setup and hardening with guides that check their own steps,
  so you only read the ones you have not already done.

= What the assistant adds =

Connected to a model, it writes a short briefing after each run, explains an
individual finding in plain language, and groups findings that share a cause.

You choose the provider. Anything OpenAI-compatible works — OpenAI, Anthropic,
DeepSeek, OpenRouter, Groq, Mistral, Together — as does a model running on your
own machine through Ollama or LM Studio, in which case nothing leaves your
network at all.

There are five levels, from off, through answering only when you ask, up to
acting on a short list of things you have explicitly permitted.

= What is sent, and what is not =

This plugin contains no analytics, no tracking and no phone-home. It does not
report that it is installed, and it never sends your site's address anywhere.

The assistant is the one exception, and it is an exception you switch on. When
it is on:

* You choose, per category, what may be included: findings, the plugin list,
  configuration values, file paths, measurements. Each is a separate switch and
  most default to off.
* Email addresses, IP addresses, card numbers, national ID numbers and anything
  shaped like an API key are removed before the request is built.
* Every single request is logged with the exact text that was sent, and you can
  read it under Activity. Not a summary of it — the text.
* A daily request limit and an optional monthly spend limit both refuse before
  a request is made, not after.

The vulnerability lookup is a separate switch for the same reason: asking a
public database about a plugin by name tells that database you have it
installed. No key, no account, and nothing identifying your site is sent — but
it is still information leaving the site, so it is your decision.

== Frequently Asked Questions ==

= Does this slow my site down? =

It does no work on a visitor's page load: no database queries of its own, no
HTTP requests, and no hooks in the page-rendering path. The checks run on a
schedule in the background, the check files are not even loaded on a front-end
request, admin styles load only on this plugin's own screens, and a model
request can never be made from a front-end request — that last one is enforced
in code, not merely intended.

= Can I use it without paying an AI provider? =

Yes. The checks, the findings, the priority ordering, the vulnerability
matching and the guides all work with the assistant switched off. And if you
want the assistant without a bill, point it at Ollama or LM Studio on your own
machine.

= What is a change freeze? =

A period when you deliberately stop making non-urgent changes because the cost
of breaking something is unusually high — most commonly from a couple of weeks
before Black Friday until early January, when a shop earns much of its year and
there is nobody at a desk to fix a bad deployment.

The plugin works the dates out on your site, including public holidays. During
a freeze it still reports everything and still recommends security and payment
fixes; it holds the rest back and tells you when the freeze ends.

= Does it work without WooCommerce? =

Yes. The shop checks register themselves only when WooCommerce is active, so a
plain WordPress site never sees a finding it cannot act on.

== Changelog ==

= 0.3.0 =
* New Setup screen. Nolimit plugins can now recommend settings for this site, and
  this plugin lists them in one place. Nothing is changed without a click from an
  administrator; anything that could affect visitors needs a ticked confirmation
  and is held back during a change freeze. Every change is checked afterwards,
  written to Activity and can be undone. Nolimit Security and Nolimit Cache
  already recommend settings; this plugin offers two of its own (the daily check
  and the vulnerability lookup). It never recommends a key or a limit.
  The explanation for each recommendation is fixed text for now.

= 0.2.11 =
* Tested against WordPress 7.1.2 and WooCommerce 11.1.2, and the headers now
  say so. WooCommerce shows the "WC tested up to" value to the shop owner as an
  untested-plugin banner, which is what somebody reads before deciding whether
  to press update — so a stale value warns about a plugin that was in fact
  tested. 207 assertions passed on PHP 7.4, 8.3 and 8.4, with no deprecation
  notices from this plugin on any of them.

= 0.2.10 =
* This plugin's card on the shared Nolimit dashboard was drawn grey instead of
  in its own colour, its two rows were labelled "0" and "1", and it had no Open
  button. Three keys were sent under names the shared renderer does not read,
  which is not an error anywhere — it just draws less.
* Shared menu 1.2.3. The status pill on that dashboard was white 11px text on a
  translucent white overlay: 3.6:1 where small text needs 4.5:1, on six of the
  eight colours in the family and on the grey a card without a colour gets. The
  overlay is dark now, which takes it to 7.1:1 here. Every plugin in the family
  adopts it in the same window — whichever copy loads first decides what a shop
  sees.

= 0.2.9 =
* Password managers no longer offer to fill the API-key field. The field said
  `autocomplete` and that is only a hint — a manager matches on the word "key"
  and fills it anyway, and since a filled value is not the mask, the form saves
  it. The site then holds a website password where the key belongs, every
  request fails with 401, and the screen still says a key is stored. If that
  describes yours, retype the key.

= 0.2.8 =
* For other plugins using this one's AI connection: an option the contract does
  not recognise is now reported in the debug log instead of being ignored. A
  dropped option produces a confident answer to a question that was never
  asked, which is harder to notice than an error.

= 0.2.7 =
* Shared menu 1.2.2. The previous fix sized the menu icon box at a fixed 36x34,
  but WordPress declares that box three different ways — open, folded, and
  below 960px — so the sign was centred in one state and off in the other two.
  The number is gone; the box fills its parent whatever size that is.

= 0.2.6 =
* Shared menu 1.2.1: the infinity sign sat above centre in the admin menu. The
  rule inherited padding sized for a 20px icon at line-height 1 while setting
  1.4, so the glyph's box was 42px inside a 34px parent.

= 0.2.5 =
* Shared menu 1.2.0. The menu glyph was escaped with a tool meant for HTML and
  printed into CSS, where it escaped nothing — a single backslash swallowed the
  closing quote and corrupted the rule. Every character is now a CSS numeric
  escape, so the value cannot leave the string whatever anyone sets.

= 0.2.4 =
* Takes version 1.1.0 of the shared menu file, which paints an infinity sign on
  the Nolimit menu instead of a cog. Every plugin in the family adopts it in the
  same window: whichever copy loads first decides what a shop sees, so a
  half-adopted change shows one icon or the other depending on activation order.

= 0.2.3 =
* Fixes "Sorry, you are not allowed to access this page" on every screen except
  the first. Collapsing the menu in 0.2.0 removed those pages from WordPress's
  own menu table, and WordPress uses that table to work out whether a page
  exists at all. They are parented to a hidden page instead.

= 0.2.2 =
* Times are shown as timestamps instead of "4 hours ago". WordPress translates
  the duration and this plugin ships no translation, so on a Danish site the
  screen read "4 timer ago" — one sentence, half in each language. Nine places.
* Tables survive a phone: they scroll sideways, and values that are one thing
  to a reader — a timestamp, a model id — no longer break at every dot.

= 0.2.1 =
* The word in the shared menu is now the plugin's own name, set in one place
  and asserted separately from the page it opens. A sibling plugin had one
  string doing both jobs, renamed it to read well beside its tabs, and quietly
  became "Overview" in a menu shared by five plugins.

= 0.2.0 =
* One menu entry instead of six. Five plugins with five submenus each produced
  seventeen entries, with Activity twice and Settings three times, and nothing
  in the labels said which plugin they belonged to. The screens are tabs now.
* Every existing admin.php?page= link still works: the pages are registered and
  then removed from the menu, not left unregistered.

= 0.1.4 =
* Repairs an update row that was poisoned by a neighbouring plugin before this
  version was installed. The earlier protection only won the race to write the
  row; a bad row already stored survived the upgrade until it expired, so the
  fix could arrive and the screen stay wrong.

= 0.1.3 =
* The protection added in 0.1.2 is now measured rather than asserted: the test
  registers an unguarded neighbour of exactly the shape found on a live site
  and checks who gets the last word. At the old priority the neighbour wins and
  the download address behind this plugin's row becomes the neighbour's zip.

= 0.1.2 =
* Registers last on the shared update hook, so a neighbouring plugin on the
  same host cannot overwrite this plugin's row in the updates list. Measured on
  a live site: four plugins were all offered another plugin's version, with its
  icon, by one unguarded copy.

= 0.1.1 =
* Test connection now works. It calls the plugin's own REST route, and a REST
  request is not an admin page load, so the button refused itself with "A model
  request cannot be made from a front-end page load."
* The menu says Assistant rather than AI Manager.

= 0.1.0 =
* First release.
