AutomateIndex

Changelog

0.3.13

• Snapshot eligible pre-existing physical robots.txt content before AutomateIndex manages the file.
• Restore the byte-exact original during approved deletion, remove only files AutomateIndex created, and preserve later owner edits.
• Add an authenticated restore-preparation endpoint so the Wizard confirms cleanup before deactivating and deleting the exact plugin.

0.3.12

• Discover and bind the exact site-specific WordPress REST root instead of assuming a root /wp-json installation.
• Support canonical subdirectory, custom-prefix, and query-form REST routes while keeping every unadvertised alias fail-closed.
• Report the exact paid Markdown and JSON endpoints in setup, status, and heartbeat so AutomateIndex can bind generation, safety proof, and activation to one route contract.

0.3.11

• Move AgentToll Markdown and JSON serving to exact WordPress REST API routes that preserve the original HTTP method on managed hosts.
• Register and reject HEAD, POST, PUT, PATCH, DELETE, OPTIONS diagnostics, and PROPFIND explicitly before payment headers or upstream work.
• Hard-disable the legacy /automateindex/markdown and /automateindex/json pretty routes, including stale rewrite and public query-var aliases.
• Flush the rewrite contract once after plugin updates so older paid-route rewrites cannot survive the safety cutover.

0.3.10

• Restrict generated-file method proof markers to the exact canonical /llms.txt path so query-var and trailing-slash aliases cannot mint diagnostic evidence.
• Move connector heartbeat delivery to a verified five-minute WordPress cron event so cold public file and paid-route requests never wait on a heartbeat connection.
• Keep synthetic installation and integrity checks out of crawler analytics so verification remains truthful and cannot wait on a background analytics connection.
• Repair missing or stale heartbeat schedules automatically after upgrades, and clear the schedule on deactivation or uninstall.

0.3.9

• Run exact-route method diagnostics before every heartbeat, upstream request, or analytics write so managed-host latency cannot invalidate a safe proof.
• Expose the current connector version on controlled structured-access responses.

0.3.8

• Make AgentToll routes strictly GET-only and isolate HEAD before any payment or upstream work.
• Strengthen exact-route proof responses for per-method, cache-safe verification.

0.3.7

• Prove HTTP method isolation on both exact structured-access routes instead of using a generated-file path as a proxy.

0.3.6

• Forward short-lived AutomateIndex activation probes to structured routes so completed installs can activate Base mainnet access automatically without making a payment.

0.3.5

• Add a nonce-bound, same-path no-op proof for managed-host HTTP method behavior.
• Keep dashboard verification traffic synthetic so Checks cannot inflate real crawler analytics.
• Make structured HEAD challenge-only and never forward payment authorization without a response body.
• Fail closed for unknown structured-route methods and keep disabled routes from advertising preflight support.

0.3.4

• Keep generated-file responses private and uncacheable on managed hosts.
• Return explicit method-not-allowed responses when unsupported methods reach WordPress.
• Prevent POST requests from being proxied into read-only structured-access fetches.

0.3.3

• Keep paid structured-access routes active after in-place upgrades even when WordPress rewrite rules are stale.
• Prevent managed hosts from canonicalizing paid routes into ordinary page responses.

0.3.2

• Preserve the complete x402 requirements challenge in WWW-Authenticate for paid-route discovery crawlers.

0.3.1

• Preserve browser-agent CORS preflights on managed hosts that normalize OPTIONS to GET before WordPress receives the request.

0.3.0

• Support current x402 V2 and legacy V1 payment headers on structured-access routes.
• Preserve complete payment challenges, authorizations, and settlement receipts without truncation.
• Add browser-agent CORS preflight handling and expose the required payment response headers.

0.2.9

• Require exact managed-file hash proof before replacing an existing root robots.txt file.
• Preserve custom physical and virtual robots.txt policies even when they mention AutomateIndex.
• Merge WordPress core admin crawl rules into AutomateIndex-managed physical and virtual robots.txt output.

0.2.8

• Limit structured-access payment retry forwarding to the public x402 payment signature and AutomateIndex payment reference headers.
• Keep internal AutomateIndex and development-only payment headers out of production structured-access retries.
• Add a one-step setup token fallback for hosts that block the automated WordPress approval or setup request.

0.2.7

• Safely publish an AutomateIndex-managed root robots.txt on hosts that serve a physical root file before WordPress routes.
• Avoid overwriting custom robots.txt policies and report a clear status when manual owner review is needed.
• Remove the unchanged AutomateIndex-managed root robots.txt file when the plugin is deleted.

0.2.6

• Clarify the AutomateIndex connector workflow and public listing copy.
• Refresh WordPress.org public listing copy and plugin icon assets.
• Harden request handling and setup sanitization.
• Preserve valid connector secrets while stripping unsafe control characters.

0.2.5

• Prepare WordPress.org submission package.
• Rename public plugin identity to AutomateIndex.
• Add WordPress.org readme metadata and GPL license declaration.
• Avoid rendering the saved provider secret in the WordPress settings form.

0.2.4

• Add authenticated setup endpoint for the AutomateIndex WordPress Wizard.
• Add setup redaction and heartbeat proof.