New: Novamira CLI, the best way to connect a coding agent to WordPress. See it →
Changelog

Every release, in detail.

Release notes for Novamira and Novamira Pro.

v1.11.3

Latest
  • New: The Configuration page now asks for the AI client before the authentication method, shows every supported client, and explains technically why an authentication method or cloud-only client cannot work in the current environment.
  • New: Novamira detects Kinsta, WP Engine, Hostinger, SiteGround, Pantheon, and Cloudflare security layers that may classify direct connections from cloud AI clients as bot traffic. Application Password is recommended where appropriate, while OAuth remains available with a dismissible technical warning and an editable support email template.
  • New: A dedicated Manage Connections page brings OAuth connected apps and Novamira Application Passwords together, with their usage details and revoke actions.
  • New: Command-line tools can sign in with a device code when their browser runs on another machine, such as a shell reached over SSH or inside a container. The tool shows a short code, and you approve it from any device where you are signed in to this site. Only approve a code you started yourself.
  • New: Before deactivation, Novamira warns when sandbox files may be powering site functionality, provides a copyable prompt for moving them to persistent storage, and lets administrators choose whether uninstall should remove OAuth data and revoke Novamira Application Passwords across all users.
  • Tweak: Codex in ChatGPT Desktop and Codex CLI now have separate setup instructions, and the consumer Gemini CLI entry has moved to Antigravity CLI with its current MCP configuration format.
  • Tweak: simplify troubleshooting for blocked OAuth connections.
  • Tweak: AI clients now receive the WordPress user ID behind their connection and are warned not to modify Novamira or revoke the credentials keeping that connection active.
  • Fix: Claude Code connection commands now register the MCP server globally for the current user.
  • Fix: The Block Editor Queue no longer fails every batch with a "Blocked a frame with origin ... from accessing a cross-origin frame" error. When the hidden block editor iframe cannot be read, the queue now serializes with the block runtime of the queue page itself and reports why the iframe was unavailable, instead of failing the batch.
  • Minor Fixes

v1.11.2

  • Fix: Abilities that take no parameters, such as reading the active design or listing the design library, now work with AI clients that send no input at all, where they previously returned an invalid input error.
  • Fix: WP-CLI now runs on Windows, including Local (Local by Flywheel) sites. Set NOVAMIRA_WP_CLI_COMMAND or use the novamira_wp_cli_command filter when detection is not enough.
  • Fix: Background WP-CLI jobs on Windows return their job ID and the command's real exit code, and no longer corrupt paths or arguments containing %, !, quotation marks or accented characters.
  • Fix: A wp.bat launcher is used only when its wp-cli.phar sits beside it, so command arguments never pass through the Windows command interpreter.
  • Fix: OAuth key generation failures now report what OpenSSL refused and how to fix it, and "wp novamira oauth-keys generate" creates the keys from a working PHP environment.
  • Minor Fixes

v1.11.1

  • Fix: OAuth connections no longer ask users to reconnect for additional permissions.

v1.11.0

  • New: Introduced REST API endpoints for the Novamira CLI. More information: novamira.ai/cli.
  • Fix: Running PHP through an AI agent no longer logs a PHP warning on every call, which on some server setups flooded the error log and made large operations return a gateway error even though the change had already been saved.
  • Minor Fixes

v1.10.1

  • New: The one-click .mcpb bundle download for Claude Desktop is available again; it requires Claude Desktop 1.24012.1 or later.
  • New: A Troubleshoot page runs on-demand checks on your site's AI connection and points at what to fix, including whether a CDN, firewall, or security plugin in front of the site is filtering AI clients. It produces a copyable report.
  • New: A dashboard notice warns administrators when a change on the site stops a previously working AI connection from authenticating, so a connection that suddenly breaks does not go unnoticed.
  • Tweak: Developers can raise the limit of 50 simultaneous OAuth connections with the novamira_oauth_max_clients filter.
  • Fix: OAuth sign-in now works for AI clients that request the discovery documents with the resource path appended or inserted, as current connectors do, and on WordPress installed in a subdirectory, where those requests previously returned a "page not found" error.
  • Fix: Imported design directions now recognize heading and body fonts declared as CSS custom properties or labelled lines, so a design no longer saves without an activatable font pair.
  • Minor Fixes

v1.10.0

  • New: Novamira Design. AI agents establish one saved design direction for your site and build every page within it, guarded by anti-slop checks; the new Design page lets you preview, import, edit and activate directions. Companion skills cover the workflow, from the design brief to the finished pages.
  • Minor Fixes

v1.9.2

  • New: ChatGPT support. Connect ChatGPT to your site with OAuth sign-in through its developer-mode custom connector.
  • Tweak: Overwriting a post through the Gutenberg pending-change flow is now treated as a destructive action, so your AI client asks before replacing content.
  • Tweak: Reading skills can no longer be turned off, so your skills always stay available even when other abilities are disabled.
  • Tweak: Calling an ability you've turned off now reports that it is switched off and can be re-enabled, instead of a confusing "not found".
  • Fix: Saving Gutenberg content no longer strips backslashes, which could corrupt blocks that rely on escaped characters.
  • Minor Fixes

v1.9.1

  • New: OAuth sign-in for AI clients. Claude and other MCP clients can connect through a standard OAuth authorization flow, approving access from your WordPress login. The Connect page walks you through each client with per-client setup steps.
  • Fix: Abilities Hub enable, disable, and bulk actions no longer fail with an "Invalid ability name" error on some sites.
  • Minor Fixes

v1.9.0

  • New: Novamira Chat, an AI agent that lives inside your WordPress dashboard. Describe what you want in plain language and it makes the change, showing you exactly what it will do and asking for your approval first. It runs on your own AI provider key, so there is no subscription and you pay only for what the AI uses. Use it on a staging site with backups. Requires WordPress 7 and your own AI provider API key.
  • Tweak: The write-file ability now rejects base64 and binary payloads, and points agents to the upload-link ability for large uploads.
  • Minor Fixes

v1.8.1

  • Fix: The Claude Desktop one-click bundle (.mcpb) is not connecting on recent Claude Desktop versions, so manual configuration is shown by default for now while we look for a solution.

v1.8.0

  • New: Novamira Visual, an experimental browser workspace where you watch your AI agent work on WordPress in real time. Instead of working out of sight, the agent opens your pages and the block editor in front of you. For development and staging sites. Elementor and Bricks support comes with Novamira Pro.
  • Minor Fixes

v1.7.1

  • New: Claude Desktop gets a one-click .mcpb bundle download that installs the MCP server without editing any config files.
  • New: The Connect page now asks you to pick your AI client first; the connection options (prompt, bundle, or manual JSON) appear only after that choice, tailored to the selected client.
  • Tweak: When AI Abilities are disabled, existing application passwords are listed below step 1 without the step 2 framing, so the setup flow is clearer.
  • Fix: WordPress 6.9 ability discovery no longer emits PHP notices for missing or late-registered ability categories.
  • Minor Fixes

v1.7.0

  • New: A Context page for giving AI agents stable, site-wide guidance they apply automatically on this site. If you also run Novamira Pro, this page appears once Pro is updated to 1.3.0 or later; until then Pro keeps providing custom instructions as before.
  • Minor Fixes

v1.6.0

  • New: A new Abilities Hub screen lists every ability available to AI agents, grouped by the plugin that provides it, so you can enable or disable each one individually.
  • Tweak: Gutenberg pages built by AI agents now consistently use native and third-party blocks, so the result stays editable in the block editor; previously they could sometimes place content in a single raw HTML block.
  • Tweak: Before building or restructuring a page, AI agents now confirm which approach you want to use (a page builder, the block editor, or the theme itself) instead of assuming one.
  • Tweak: The Configuration page now notes that the paste-to-agent prompt includes your application password, and links to the manual configuration if you prefer not to share it with the AI.
  • Minor Fixes

v1.5.1

  • Tweak: The Novamira admin bar item now includes a dropdown toggle for turning AI Abilities on and off.
  • Minor Fixes

v1.5.0

  • New: In the Gutenberg Block Editor AI agents can now create and edit third party blocks valid from the first save
  • Tweak: Large-file uploads and browser admin access now use header-based handoff flows, so generated endpoint URLs stay short and easier to reuse in tool commands.

v1.4.0

  • New: Gutenberg (Block Editor) support, AI agents can now author and edit posts, pages, templates, template parts, and navigation menus, with native blocks valid from the first save
  • New: The Configuration page now includes direct HTTP snippets for Claude and Codex clients that cannot use the default npx-based MCP setup.
  • Minor Fixes

v1.3.0

  • New: Skills. Create or upload Markdown playbooks your AI follows automatically on this site, including a built-in skill that teaches your AI to write new ones.
  • New: AI agents can now create short-lived, one-time WordPress admin access links for browser automation tools, without exposing admin passwords.
  • Tweak: The Sandbox files page now uses the same compact card layout as the Skills page, with an Enable/Disable toggle and file-type badges.
  • Minor Fixes

v1.2.1

  • New: AI agents can now run WP-CLI commands through Novamira, with support for background jobs.
  • Minor Fixes

v1.2.0

  • New: AI agents can now upload plugin, theme, media, and other large files more easily.
  • New: A "paste to your AI agent" block on the Configuration page lets you copy a short description and have your AI client set up the MCP server connection for you, instead of editing JSON config files by hand.
  • New: The Configuration page warns when AI Abilities are turned on against what looks like a production site, with a reminder to keep them on staging or development copies only.
  • New: If you already have a saved application password (for example from a password manager), a new field on the Configuration page lets you paste it directly and skip generating a new one.
  • New: Local HTTPS development sites with self-signed certificates are detected automatically, and the generated client configs include the small flag Node.js needs to accept the certificate.
  • New: When the site is on a local hostname over HTTP, the Application Passwords notice now explains the exact line to add to wp-config.php to enable them.
  • Tweak: Redesigned the Configuration page into three numbered cards (Enable AI Abilities, Application Password, Connect Your AI Client) so the setup reads top to bottom.
  • Tweak: The MCP endpoint is now /wp-json/mcp/novamira. The previous /wp-json/mcp/mcp-adapter-default-server keeps working for AI clients that are already connected, no action needed.
  • Tweak: Per-client JSON snippets are collapsed by default behind a "Need the JSON config for a specific client?" link, since most setups now use the paste-to-agent block.
  • Tweak: AI agents working with data-modeling plugins (ACF, JetEngine, Pods, ACPT, Meta Box, Toolset, CPT UI, WooCommerce, etc.) are now told to use the plugin's own UI or API instead of registering post types, taxonomies, or fields directly in PHP, avoiding broken slugs and labels later.
  • Fix: PHP notices about duplicate ability registration on every wp-cron tick no longer appear in the error log.
  • Minor Fixes

v1.1.2

  • New: Configuration instructions for the OpenAI Codex CLI MCP client.
  • Fix: The Novamira ON admin bar indicator now only appears for administrators who can manage Novamira settings.
  • Minor Fixes

v1.1.1

  • Improvement: The Configuration page now detects when Application Passwords have been disabled by a security plugin (e.g. Solid Security, Wordfence) and shows a clear explanation instead of the generic HTTPS/local-environment message.
  • Improvement: Moved the AI Abilities on/off switch to the top of the Configuration page making clear they are needed for the MCP to work.
  • Improvement: When an AI agent sends invalid input, the error message now includes the specific per-property details the agent needs to correct it — so the agent can fix its own mistake in one try instead of guessing or asking the user.
  • Minor Fixes

v1.1.0

  • Fix: Recursive directory listings no longer fail when a folder contains a broken shortcut (symlink) — the listing now skips over it gracefully and includes the rest of the results.
  • Improvement: AI agents now reliably receive site context and usage instructions, even on MCP clients that previously ignored them during connection setup.
  • Improvement: Updated the bundled MCP Adapter library to version 0.5.0.
  • Fix: Ability failures are now surfaced as proper errors instead of being masked by a success response.
  • Minor Fixes

v1.0.3

  • Fix: Sandbox crash detection failed to detect fatal errors thrown indirectly from WordPress core or third-party code called by a sandbox file.

v1.0.2

  • Fix: Sandbox crash detection now uses a shutdown handler instead of a file marker, eliminating false positives from concurrent requests and external code calling exit().
  • Fix: Execute-ability coerced empty parameters (`{}`) to `null`, causing "input is not of type object" validation errors for abilities with all-optional properties.
  • Remove: PHP syntax validation from write-file and edit-file abilities — the sandbox already catches syntax errors at runtime, making pre-write validation redundant.
  • Minor Fixes

v1.0.1

  • New: Configuration instructions for 7 additional MCP clients: Cline, Roo Code, Kilo Code, GitHub Copilot, Amazon Q, Gemini CLI, and Antigravity.
  • New: MCP server name now defaults to the site domain for easier multi-site setups.
  • New: MCP server instructions include site locale and multilingual context.
  • Fix: Admin page header spacing.

v1.0.0

  • 🎉 First stable release.

v1.0.0-rc4

  • New: Domain-locking for AI abilities — the site hostname is stored when abilities are enabled. If the domain changes (e.g. a staging database is restored on a different server), abilities automatically deactivate and an admin notice explains what happened.
  • New: MCP server instructions — AI agents now receive context about the WordPress environment (version, active plugins) during MCP initialization.
  • Minor fixes.

v1.0.0-rc3

  • Fix: Shell quoting in the Claude Code mcp add command — the MCP server URL and other env values were not properly quoted, causing syntax errors when pasting the generated command.

v1.0.0-rc2

  • Minor fixes.

v1.0.0-rc1

  • Release candidate for 1.0.
  • Eight abilities: execute-php, read-file, write-file, edit-file, delete-file, disable-file, enable-file, list-directory.
  • PHP sandbox with crash recovery and safe mode.