release: v0.10.0

Author: chubes4

CHANGELOG.md

@@ -2,6 +2,197 @@
 
 All notable changes to this project will be documented in this file. Entries are generated by homeboy from git commits.
 
+## [0.10.0] - 2026-06-26
+
+### Added
+- emit WordPress hotspot artifacts from fuzz suites
+- add WordPress fuzz hotspot artifact contract
+- expose WordPress fuzz suite executor
+
+### Changed
+- Expand live progress event counts
+- Add contained site sync browser SDK
+- Validate canonical fanout worker result refs
+- Bridge PHP workload files in fuzz suites
+- Support staged PHP workload files
+- Normalize Codebox live progress handoff events
+- Keep bench command in expanded runtime policy
+- Allow bench workloads to use WordPress commands
+- Harden browser handoff contracts
+- Return workload command results from fuzz executors
+- Preserve runtime workload fuzz results
+- Support bench request case artifacts
+- Normalize runtime requirement plugins for CLI fuzz runs
+- Support typed workload steps in CLI fuzz runs
+- Run CLI fuzz workloads through recipes
+- Execute runtime workload fuzz targets
+- Add Codebox query capture contract
+- Run generic agent task workflow
+- Read typed artifacts from snake case task result
+- Read typed artifacts from runtime outputs
+- Read typed artifacts from task result outputs
+- Read typed artifacts from raw runtime results
+- Normalize mapped typed artifact outputs
+- Add run plan progress snapshots
+- Cover deterministic fanout dependency execution
+- Define headless agent task public boundary
+- Stabilize public fuzz runtime capabilities
+- Add public browser preview SDK starter
+- Document public handoff abilities
+- Clean up public boundary docs and tests
+- Make browser executable sessions runnable
+- Hide internal agent runtime substrate from public contracts
+- Tighten public boundary docs
+- Add public browser runtime contract
+- Keep runtime substrate behind Codebox boundary
+- Add public fuzz workload CLI commands
+- Add artifact postprocess workload step
+- Add public runtime fuzz primitives
+- Preserve prepared runtime profiles
+- Validate browser session boot contracts
+- Capture editor block validity evidence
+- Emit public agent task result envelopes
+- Add Blocks Engine visual parity adapter
+- Document runtime provider CLI selection
+- Remove legacy Codebox ability aliases
+- Generate concrete REST and block fuzz samples
+- Expose WordPress fuzz contracts entrypoint
+- Add REST performance observation command
+- Add public API WP-CLI runtime wrappers
+- Fail closed for runtime-backed fuzz suites
+- Validate browser runtime materialization
+- Neutralize external orchestrator boundary
+- Add fuzz workload hook hotspot sampling
+- Neutralize agent outcome classification
+- Group REST DB query profile fingerprints
+- Neutralize Codebox workflow access token naming
+- Normalize WordPress page load modes
+- Add fuzz coverage plan artifacts
+- Normalize performance observation placeholders
+- Register Codebox abilities after lifecycle replay
+- Redact fuzz suite REST DB query samples
+- Capture fuzz suite REST DB queries through query filter
+- Ensure CLI build output is executable
+- Install packaged browser plugins via PHP
+- Capture REST DB profiler queries through query filter
+- Support browser function invocations
+- Use fresh browser recipe blueprints
+- Add fuzz runner capability contract
+- Add fuzz suite reset policy
+- Expose core PHP snippet package entrypoint
+- Align PHP DB inventory schema contract
+- Include browser recipes in blueprints
+- Return raw browser blueprints
+- Allow public prepared blueprint hydration
+- Accept snake case component source roots
+- Cache package classmap autoloads
+- Lazy-load package classmaps
+- Preserve prepared extra plugin sources
+- Bridge staged package classmaps
+- Eager-load installed package classmaps
+- Share recipe plugin preload for activation
+- Support measured fuzz artifact summaries
+- Report plugin autoload diagnostics on activation fatals
+- Preload plugin package autoloaders
+- Mirror Composer path repositories for source packages
+- Preserve vendors in prepared source staging
+- Register Agents API runtime adapter by default
+- Hydrate source packages with existing vendors
+- Skip active recipe plugin replay during setup
+- Preload Composer autoloaders for run-php plugins
+- Preload Composer autoloaders for plugin activation
+- Load Composer autoload before package init
+- Bridge package autoloaders to Composer autoload
+- Hydrate source packages with Composer plugins
+- Preserve source package vendor trees
+- Recover browser blueprint refs from contained-site input
+- Preserve generated package autoloaders
+- Stage agent task recipes in artifacts
+- Honor source roots for component contracts
+- Map runtime package options for Agents API
+- Support monorepo plugin source subpaths
+- Resolve runtime package sources in Codebox
+- Normalize runtime package task outcomes
+- Preserve activation when deduping extra plugins
+- Gate fuzz suites on runner capabilities
+- Honor runtime requirement extra plugins in task recipes
+- Clear REST route context during fuzz route refresh
+- Add browser playground session run primitive
+- Clean up runtime provider boundary
+- Refresh REST server after fuzz plugin activation
+- Initialize REST routes for JSON fuzz workloads
+- Execute JSON fuzz workloads
+- Add browser session evidence refs
+- Treat runtime replies as terminal answers
+- Support fuzz browser coverage primitive
+- Seed default Data Machine sandbox agent
+- Include substrate in agent task recipes
+- Mount Data Machine runtime substrate by default
+- Support database inventory fuzz primitive
+- Include Agents API in agent task runtime defaults
+- Support admin page fuzz primitive
+- Support REST route inventory fuzz steps
+- Make ability execution principal configurable
+- Standardize runtime command result envelopes
+- Normalize runtime local preview access
+- Add generic preview lease provider contract
+- Add runtime access contract
+- Keep runtime provider defaults neutral
+- Add inventory primitives and fuzz contract gates
+- Include bundled runtime plugin in agent tasks
+- Accept stable agent task CLI requests
+- Complete runtime contract manifest aliases
+- Report public preview lease metadata
+- Make preview hold cap configurable
+- Apply distribution runtime setup subset
+- Forward preview options through agent tasks
+- Add non-blocking preview leases
+- Export runtime contract manifest
+- Add fuzz coverage plan contracts
+- Document public fuzz suite target skips
+- Export runtime artifact normalizers
+- Decouple runtime invocation from Agents API
+- Add generic runtime fanout execution
+- Enforce run plan execution policy
+- Add generic agent task reusable workflow
+- Add WordPress block fuzz primitives
+- Add fuzz builder test script
+- Avoid duplicate workload facade stubs
+- Avoid duplicate runtime action test names
+- Add safe database inspection
+- Run fuzz cases through runtime actions
+- Summarize fuzz suite coverage
+- Improve admin discovery fuzz targets
+- Expand WordPress CRUD coverage
+- Add WordPress fuzz suite builders
+- Expose fuzz workload API facades
+- Split simulated and real page load commands
+- Expand WordPress database schema discovery
+- Add WordPress setup action primitives
+- Unify fuzz suite execution planning
+- Add public WordPress runtime helper facades
+- Implement WordPress workload ability runner
+- Document focused public Codebox entrypoints
+
+### Fixed
+- Fix recipe-run terminal exits
+- decouple agent task workflow contract
+- preserve skipped dependency artifact refs
+- stabilize public codebox envelopes
+- preserve bench extra plugin source roots
+- trim fuzz execution metadata payloads
+- execute runtime command fuzz cases
+- accept suite path for nested fuzz command
+- support nested fuzz suite recipe command
+- expose ensure plugin active runtime command
+- Fix browser local package target folders
+- Fix SQL fingerprint string redaction
+- Fix runtime task ability materialization
+- Fix admin fuzz menu globals
+- Fix admin fuzz page URLs
+- Fix recipe preview lease option type conflict
+- Fix runtime action public build
+
 ## [0.9.0] - 2026-06-21
 
 ### Added

package.json

@@ -1,6 +1,6 @@
 {
   "name": "wp-codebox-workspace",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "private": true,
   "type": "module",
   "exports": {

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@automattic/wp-codebox-cli",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "WP Codebox CLI — secure WordPress code execution from anywhere. Run disposable Playground sandboxes from any host: CLI, CI, mobile, Node service, or WP plugin.",
   "type": "module",
   "bin": {

packages/runtime-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@automattic/wp-codebox-core",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

packages/runtime-playground/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@automattic/wp-codebox-playground",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

packages/wordpress-plugin/wp-codebox.php

@@ -3,7 +3,7 @@
  * Plugin Name: WP Codebox
  * Plugin URI: https://github.com/Automattic/wp-codebox
  * Description: Secure coding environments inside WordPress. WordPress ability surface for launching disposable WP Codebox Playground sandboxes that can't touch your host site.
- * Version: 0.9.0
+ * Version: 0.10.0
  * Requires at least: 6.9
  * Requires PHP: 8.2
  * Author: Automattic
@@ -15,7 +15,7 @@
 	die;
 }
 
-define( 'WP_CODEBOX_PLUGIN_VERSION', '0.9.0' );
+define( 'WP_CODEBOX_PLUGIN_VERSION', '0.10.0' );
 define( 'WP_CODEBOX_PLUGIN_PATH', plugin_dir_path( __FILE__ ) );
 define( 'WP_CODEBOX_PLUGIN_URL', plugin_dir_url( __FILE__ ) );