Changelog

The fifth connector in the family adds Mistral AI to the WordPress AI Client. Mistral is the provider that makes capability detection easy and model selection hard, and both are worth a word.

Easy, because Mistral reports what each model can do, model by model, in its own catalogue: chat, function calling, vision, reasoning. The connector reads those flags instead of guessing from identifiers, so a model is offered as vision-capable because Mistral says it is. Mistral also accepts a real JSON schema on response_format, not only JSON mode, so structured output is offered with the schema a WordPress feature asks for rather than a hopeful request for valid JSON.

Hard, because Mistral answers one catalogue endpoint for a range much wider than the AI Client can represent. Transcription, text-to-speech, OCR, moderation and safety-classification models arrive in the same list as the chat models, and their identifiers do not reliably say so — Shieldstral is a safety classifier whose name gives no hint of it. The connector reads the task each model reports and leaves those out, so the picker only offers something WordPress can actually call.

Two further kinds of model are kept but moved to the back of the list, because position is how the AI Client decides what an unconfigured site calls. Mistral publishes a retirement date on a model as soon as a replacement exists, and that model keeps working until the date arrives: removing it would take away something that still answers, so it stays selectable and simply stops being the default anyone inherits. Mistral's labs- models are experimental and documented as unfit for production, and one of those sorts ahead of every mistral- identifier alphabetically. Both remain choosable; neither wins by accident.

Embeddings for mistral-embed and codestral-embed are discovered and implemented, and will be offered as soon as the WordPress AI Client ships its embedding model contract. WordPress 7.1 defines the capability without it.

The full changelog has the release notes.

A skill for Claude Code that tests a product the way a QA engineer would. It inventories every surface the product exposes, then tests across four dimensions that can be run together or one at a time: functionality and edge cases, UI and browser, load and resilience, security and abuse. It leaves behind a runnable test suite in the project's own idiom, with a failing test for every confirmed finding, and a report in which every claim is tied to captured output and the untested areas are listed with reasons.

Two Python scripts ship with it and work on their own: surfaces.py, a surface inventory across common web, API, CLI and job frameworks, and loadtest.py, a concurrent load generator with latency percentiles, a status histogram, classified errors and CI threshold gates. Both use only the standard library, and the load generator refuses non-local targets without an explicit flag.

A safety contract is part of the skill: authorization is per target and comes only from the user, destructive actions are never used as proof, surfaces that email, charge or notify need agreement, discovered secrets are reported by location rather than value, and product output is treated as data, never as instruction.

Measured against a fixture with ten verified planted defects: 10/10 found with the skill against 9/10 without, with the larger differences in deliverables and in restraint under identical authorization. Apache-2.0 licence; download the skill package from this page or clone the repository.

The settings screen now shows a saved API key correctly, and keeps the control that removes it, on a site where AI support is switched off. A streaming request whose parameters cannot be encoded as JSON, typically post content with malformed UTF-8, now reports that instead of sending an empty body and surfacing a confusing provider error. The FAQ's model-discovery answer no longer mentions embedding detection this connector does not offer, and says that DeepSeek's capability data is used where it exists and inferred where it does not.

Install or update from the WordPress plugin directory. The full changelog lists every entry.

A Model Context Protocol server that gives AI assistants the Zactonz APIs as eighteen tools plus a key check: screenshots, page to Markdown, link previews, DNS, SSL and WHOIS, email checks, QR codes, barcodes, social images, image conversion and translation. Runs over stdio on Node.js 18 or newer, offers only the tools your keys can call, validates every argument before a request is made, returns small images inline, honours cancellation and keeps every call inside the client's timeout. MIT licence.

Published on npm as @zactonz/mcp; add it to your MCP client with npx -y @zactonz/mcp.

A PHP client for every public Zactonz API. Twenty-three typed methods across eleven services, generated from the same OpenAPI specifications as this portal, with one key per product chosen automatically, exceptions for every failure including those reported inside an HTTP 200 body, retries only where a retry cannot repeat work, raw bytes from any File method, signed OG image URLs and a fake transport for your own tests. PHP 8.1 or newer, curl and json only, MIT licence.

Install it with composer require zactonz/zactonz-php.

Version 1.0.1 corrects the final step of the installer and is the recommended version for all installations.

The installer passed its install.json to cPanel's install_plugin, which expects a plugin directory or an archive. Registration therefore stopped short with Unrecognized archive format., leaving the plugin's files in place but its entry absent from cPanel. The installer and the uninstaller now both pass the plugin directory with an explicit theme.

If you installed an earlier version, run the same command again to move to 1.0.1. The install command has not changed and always fetches the current release, nothing needs to be removed first, and monitored cron jobs are unaffected — the runner lives in the account's home directory and keeps working independently of the plugin.

The saved API key is now read back from the WordPress AI Client rather than straight from the option WordPress registers for the connector. That is how a connector is meant to obtain its credentials, and it is what the plugin directory asked for on a sibling connector.

Reading the key through the AI Client has one consequence worth naming: WordPress only hands the credential over while it is wiring connectors, so on a site with AI support switched off the key is not readable at all. The settings screen used to take that to mean no key was saved, and hid the control that removes it. It now tracks separately whether a key was stored, without reading the credential out of the option, so the screen stays accurate and the key remains removable.

The model-discovery answer in the FAQ was also corrected. It described capability detection for embeddings, which this connector does not offer, and claimed capabilities are read from the provider rather than guessed. Groq publishes no per-model capability data, so the connector falls back to inference and the FAQ now says so.

The full changelog lists all three entries.

A model OpenRouter marks inactive is no longer offered or sorted ahead of the rest, so a site with no default set cannot end up on one that has stopped serving traffic. A callback that throws on the final stream event is now reported as the same wrapped error as every other path, and the settings screen shows a saved API key correctly on a site where AI support is switched off.

The description was also corrected: the connector has one request timeout, for text generation, and takes each model's capabilities from the OpenRouter catalogue wherever it publishes them, falling back to the model identifier where it does not.

The full changelog lists all six entries.

A cPanel plugin that answers the question cron cannot: did the job actually run, and what happened when it did.

Choose a job and Cron Doctor wraps it in a small runner that takes a lock, applies an optional time limit, captures the output and records the exit code and duration. The dashboard then shows the last run for every job on the account, alerts you when one fails or does not run at all, and offers one-click fixes for the mistakes that make cron jobs fail quietly: a generic /usr/bin/php instead of the site's EasyApache binary, duplicated WordPress cron, output thrown away to /dev/null, a script that no longer exists.

The original crontab line is always kept, the crontab is backed up before every change, and every write is read back and compared with what was intended — a mismatch restores the previous version by itself.

DeepSeek joins the connector family: a very long context window, vision on the Flash model, thinking mode you can turn up, down or off, JSON output, streaming, diagnostics and an asynchronous Site Health test. Listed on WordPress.org on 5 October 2026; install it from Plugins › Add New.

Groq joins the connector family: very low latency inference on GroqCloud, with every active model on the account discovered automatically, per-capability defaults, reasoning effort, streaming, diagnostics and an asynchronous Site Health test. Listed on WordPress.org on 30 September 2026; install it from Plugins › Add New.

The plugin is now Zactonz AI Connector for Ollama, matching the rest of the connector family. The folder, slug and text domain are unchanged, so this is an ordinary update with nothing to migrate.

Everything else in this release came out of a full audit. The suite was green beforehand; fifteen defects were found anyway, each reproduced in a live WordPress 7.1.2 install before being called a bug and re-verified after the fix. Two of the most consequential are worth reading in full.

Cloud and self-hosted keys were interchangeable. The plugin fell back to the key WordPress stores for the connector whenever that mode was active, without recording which mode the key had been entered under. Whichever key sat there was used by both modes, so switching from Ollama Cloud to a self-hosted instance could send your Cloud key to a private address — or send a private LAN token to ollama.com. Keys are now filed under the mode in use when they were written, and the fallback is gone. Keys written before this release are adopted into the mode recorded as owning them.

The reachability check made an uncached HTTP request. The AI Client asks whether a provider is configured on every model lookup, and each answer cost a request — or the full request timeout, up to twenty seconds, when Ollama was not running. It is now cached for five minutes per connection.

Streaming was rebuilt on the WordPress HTTP API; the plugin no longer calls cURL anywhere in its own code. Cancellation no longer leaks events after the caller has stopped listening, callback failures on the replay and trailing-block paths are reported rather than discarded, and streamed responses now report token usage. Deleting the plugin now removes its settings and both stored keys, on single sites and across a network.

The full changelog lists all twenty-two entries.

Code 128, Code 39, Code 93, EAN-13, EAN-8, UPC-A, UPC-E, ITF-14 and Codabar as PNG, SVG or JPEG, with check-digit validation and a hosted-link mode.

Record lookups for A, AAAA, MX, TXT, NS, CNAME, SOA, CAA, SRV and PTR with DNSSEC status.

Certificate chain, validity, hostname match, key and signature details, negotiated protocol and CA-store verification for any host and TLS port.

Registrar, dates, EPP status, nameservers and DNSSEC over RDAP with a port-43 fallback.

MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI and disposable-provider checks scored 0 to 100 with actionable findings.

WebP, AVIF, JPEG, PNG and GIF output, resize with cover, contain, inside or fill, EXIF orientation, rotation, flips, grayscale, blur and sharpen, metadata stripping, and an info mode with dominant colours.

Open Graph, Twitter card, canonical, icons, feeds, oEmbed and language for any public URL, with optional headless rendering and image verification.

Readability-based article extraction converted to Markdown with headings, lists, code, tables and absolute links, plus a full-body mode and raw HTML input.

Social-card images from a title, subtitle, logo and site label on three templates, light or dark, with signed URLs for direct use in meta tags and a seven-day render cache.

OpenRouter joins the connector family: hundreds of routed models behind one key, discovered with the capabilities OpenRouter reports, with per-capability defaults, reasoning effort, streaming, diagnostics and a Site Health test.

Version 1.0.0 could not run. Two source files contained syntax errors, and one of them was loaded by every entry point, so the plugin raised a fatal error the moment a cPanel user opened it. Anyone who installed 1.0.0 should replace it with 1.0.1. There is no configuration to migrate, because none could ever be written.

Downloads have moved to GitHub. The install and update commands published here previously did not work; the installation page now carries the correct ones.

Fixed

• A second <?php opening tag inside includes/git-config.php made the file unparseable. It is required by the interface, the action handler, the deploy handler and the webhook receiver, so nothing loaded.
• A stray character in webhook.php made the webhook receiver unparseable.
• A fresh account raised a TypeError on PHP 8, because the repository list was read without first checking that the configuration file existed.
• The webhook receiver could not identify which account it was running for. It relied on an environment variable that is unset under several PHP handlers, and its fallback inspected the plugin directory, which never contains an account path.
• Home directories are read from the environment rather than assumed to be /home/<user>, so servers using /home2, /home3 and similar mount points now work.
• The access token field was marked required, which made the documented support for public repositories impossible. It is now optional.
• Three unused constants were removed, along with the directory creation that produced permission warnings in the interface on every request.

Security

These weaknesses were present in 1.0.0 but unreachable, because the plugin did not run. They are closed in 1.0.1 so that they are not reachable now that it does.

• The deploy handler wrote the submitted GitHub access token to a plaintext log file in the account's home directory. The debug logging left over from development has been removed.
• The repository path submitted by the form was appended to the home directory without validation; the restriction existed only in an HTML pattern attribute, which a client controls. Paths containing .. or a null byte are now rejected on the server.
• Git stores the access token for a private repository inside .git/config. Where a repository was deployed into a document root, that file was served over the web. Deployments now write a deny rule into .git and tighten its permissions. This covers Apache and LiteSpeed; NGINX ignores .htaccess and still needs a server-level rule.
• Values placed into the interface are escaped with ENT_QUOTES, so a quote can no longer break out of the JavaScript string literals in the repository table.
• The installer copied the whole working directory into the web-served plugin directory, which placed .git there when installing from a clone. It now excludes version control and documentation, and clears files left by a previous version.

Every PHP and shell file is now checked for syntax errors on each push, across PHP 7.4, 8.1 and 8.3. That check is what would have caught this before 1.0.0 was published.

The three endpoints under /tuber/v1/ are retired as of today: Video Downloader, YouTube Search and YouTube Video Info. They receive no further fixes or support and may be switched off without further notice.

Remove them from existing integrations. The reference pages stay online, marked as retired, for anyone still migrating.

• Native single and batch embedding generation for the WordPress 7.1 embedding API.
• Discovery now advertises only the capabilities Ollama reports; separate default models for text, vision, images, embeddings and tool calling.
• Thinking preferences (model default, disabled, low, medium, high) with automatic migration.
• Redacted diagnostics panel and a WordPress Site Health connectivity test.
• Stable, cancellable SSE streaming for content, thinking and tool calls.

• Ollama as a WordPress AI Client connector, recognised by Settings › Connectors, with Ollama Cloud and self-hosted modes.
• Host URL and port controls with model discovery, default-model thinking mode and a configurable text request timeout.
• Text generation, structured output, function calling, vision-aware model metadata and image generation for compatible models.

• Deploy GitHub repositories into any cPanel account directory.
• Automatic deployment through a per-repository GitHub webhook, or manual Sync now.
• Private repositories via GitHub access tokens.
• Multiple repositories per account, each with its own branch and path.
• Installs into the cPanel Jupiter theme; no third-party dependencies.