Abilities Bridge

Endringslogg

1.4.0

• New: durable background chat. Sending a message now runs as a tracked background job on the server instead of one long browser request – slow answers always arrive. Reload the page or close the tab mid-generation and the chat reattaches; come back later and the finished answer is waiting in the conversation
• New: Stop is instant. Stopping a generation immediately frees the conversation so you can ask again right away; a step already running at the provider may still finish (and be billed) – its result is discarded, and the chat says so honestly
• New: live progress while the AI works («Calling ability: …», elapsed time), with an explicit run-in-foreground fallback for hosts where background processing is unavailable
• New: Claude 5 models – Opus 5 (recommended default for new users), Sonnet 5, and Fable 5, with previous models available under Legacy; every user’s saved model choice is preserved
• New: OpenAI GPT-5.6 Terra (recommended default for new users), Sol (higher quality), and Luna (fastest and cheapest), using provider-native background mode for durable chats; previous OpenAI models remain available under Legacy and every user’s saved choice is preserved
• New: if Fable 5’s stricter safety system declines an ordinary request, an administrator-enabled setting retries the answer once on Opus 5 and discloses the substitution right in the chat; the setting defaults on and explains that the fallback is a second billable AI request
• Improved: Settings now clearly separate API-billed built-in chat keys from Claude and ChatGPT account connections; the ChatGPT connection diagnostic no longer asks for an unrelated OpenAI API key
• Improved: Built-in Chat now provides matching Anthropic and OpenAI connection-test buttons with selected-model feedback and a clear notice that each test sends one short, billable API request
• New: interrupted OpenAI generations are recovered – the plugin retrieves finished (already billed) results from OpenAI’s servers after a worker or connection loss instead of abandoning them
• Improved: abilities that change data are never automatically re-run after a crash or interruption; the chat reports the uncertainty instead of risking a duplicate action
• Improved: gateway timeouts (HTTP 408/504/524) are no longer retried automatically – a retry could submit a second billed generation for an answer that may already exist
• Improved: Claude 5 models get a larger response budget automatically so their internal reasoning cannot truncate visible answers
• Security: OAuth redirect addresses are now validated as exact domain suffixes – look-alike domains (e.g. claude.ai.example.com) are rejected
• Security: the OAuth rate limiter no longer trusts spoofable forwarded-IP headers (sites behind a proxy can opt in via the abilities_bridge_trusted_proxy_header filter), and brute-force lockouts are scoped per client and address so an attacker can no longer lock a legitimate client out
• Fixed: API authentication and rate-limit errors from Claude now show their real message immediately instead of a generic «invalid response» retried four times
• Fixed: two administrators generating MCP credentials at the same time can no longer overwrite or discard each other’s one-time secret (per-user storage)
• Fixed: two simultaneous OAuth sign-ins can no longer erase each other’s in-flight state (the pending store is now serialized)
• Fixed: if the database cannot grant the OAuth pending-store lock, authorization now stops with a temporary retry message instead of writing without serialization and risking a lost sign-in
• Fixed: uninstalling on a multisite network now removes tables, options, attachments, and scheduled events from every site, not just the main one
• Fixed: uninstall validation now permits both durable chat-job tables to be removed instead of silently leaving them behind
• Fixed: uninstall now clears the correct daily-cleanup scheduled event
• Privacy: the readme now discloses background job metadata stored locally and OpenAI’s server-side retention of background-mode responses

1.3.3

• Fixed the one-time display of newly generated MCP client credentials never appearing on sites with a broken or evicting external object cache (e.g. LiteSpeed/Redis/Memcached object caching). The pending credentials are now stored in the database instead of a transient, shown once, then deleted
• Fixed OAuth authorization failing with «Authorization request has expired or is invalid» on the same sites: in-flight authorization requests and consent tokens are now stored in the database instead of transients, so connecting Claude or ChatGPT works even when the host’s object cache is broken, restarted, or evicting

1.3.2

• MCP discovery (initialize, tools/list, ping) now requires authentication for every client, the same as running a tool; the unauthenticated pre-OAuth discovery added in 1.3.1 has been removed. This fixes Claude custom connectors (which connect authenticate-first); ChatGPT connects the same way via OAuth
• Unauthenticated MCP requests now return an HTTP 401 with a WWW-Authenticate challenge so MCP clients reliably start the OAuth flow

1.3.1

• MCP discovery (initialize, tools/list, ping) is now available before OAuth so remote app builders such as ChatGPT Apps can discover actions and then authenticate; running a tool still requires authentication
• Ability names are now mapped to MCP-safe tool names and resolved back by lookup, fixing tool calls for abilities whose names contain underscores
• Chat now returns a useful summary of tool results when the AI provider completes a tool action but returns no final text, instead of getting stuck on a «response pending» message
• Simplified the floating chat bubble by removing the in-bubble provider and model selectors
• Replaced browser confirm/alert popups in the admin chat with inline messages and a two-click delete confirmation

1.3.0

• Added chat image attachments — upload images or capture a browser-approved screenshot in the main chat and floating bubble (JPEG/PNG/WebP, up to 3 per message)
• Added an «Enable image attachments» setting to turn the upload and screenshot feature on or off
• Added Claude Opus 4.8 support and relabeled Opus 4.7
• Context-usage warning now scales to the model’s context window instead of firing at fixed token counts
• Private attachment storage with server-side validation and authenticated, ownership-checked serving; files are cleaned up on conversation delete and plugin uninstall
• Replaced hardcoded Connected Plugins detection with the documented abilities_bridge_plugin_integrations contract
• Added validation, safe per-callback discovery, disabled integration cards, profile-aware approvals, and partial approval messages
• Added cleanup notice for old beacon-send/* approvals from pre-release Beacon Send integrations
• Breaking change for private/pre-release partner integrations: providers must register themselves through the integration filter

1.2.1

• Added Claude Opus 4.7 model support (most intelligent option)
• Added GPT-5.5 model support (now the default OpenAI option)
• Added Connected Plugins admin page for discovering and approving Abilities Bridge integrations
• Added per-model guidance text in the chat bubble and dashboard
• Conversation lookup, delete, and restore are now scoped to the current user — admins can no longer access other admins» conversations by ID
• OAuth consent now uses request-bound, single-use consent tokens with 5-minute transients
• Memory tool path validator no longer accepts paths sharing the /memories prefix but living outside the namespace (e.g. /memoriesXYZ)
• Default OpenAI model updated from GPT-5.4 to GPT-5.5

1.2.0

• Added WP AI Client credential integration for shared API keys via WordPress Connectors
• Added WP AI Client integration test page
• Added separate settings flows for Anthropic MCP and OpenAI ChatGPT MCP
• Added direct OpenAI ChatGPT MCP flow from built-in WordPress MCP endpoint
• Added floating chat bubble for administrators
• MCP OAuth client storage is now profile-aware
• MCP tools/list now filters visible tools using authenticated permissions
• OpenAI chat integration migrated to the Responses API

1.1.1

• Added GPT-5.4 model support
• Updated default OpenAI model to GPT-5.4

1.1.0

• Added OpenAI as an alternative AI provider
• Added Learn More tab with overview video and resources
• Updated Pro Features tab with Concierge Service and Site Abilities Plugin

1.0.0

• Initial release
• MCP server for WordPress Abilities execution
• Memory tool with database storage
• OAuth 2.0 authentication
• Admin chat interface