What shipped,
and what broke.

Everything that changed from Shilpi 1.9.5 to 1.9.6.

Security

• Page, template and global CSS can no longer close its style element with a mixed-case closing tag. Authors and contributors can no longer store script through CSS.
• Query loops list only publicly viewable post types, so private records such as Code Hub snippets can never be shown to visitors (filter: shilpi_loop_post_type_allowed).
• Dynamic tokens in link and source attributes drop unsafe schemes such as javascript:, and token values inside script or style can no longer close the element.
• The template shortcode renders only published templates, or templates the visitor may read.
• {post:content} no longer reveals password-protected posts.
• The OAuth consent screen shows where access will be sent.
• Public form submissions are rate limited per address (20 per 10 minutes by default, filter: shilpi_form_rate_limit) and capped at 100 fields.

What shipped

• One Assets screen with tabs for CSS, JSON and JS, Fonts and Icon Libraries. Validated .css project files behind a Security toggle, and per-document loading so a page downloads only the CSS and JS it uses.
• HTML Packages moved into the free Shilpi HTML Studio companion plugin. Existing imported packages keep working; install the plugin to keep managing them.
• Companion plugins can join the central Security screen, and the Shilpi React Studio integration contract is in place.
• MCP OAuth discovery works with more clients: standard protected-resource metadata, OpenID discovery, split home and admin hosts, and repaired double query strings.
• IcoFont Free and Web Awesome Free download on demand from shilpibuilder.com with pinned SHA-256 checksums, so the theme ZIP is smaller.
• Desktop preview keeps real desktop layouts even with both side panels open.
• Shilpi → Plugins → Refresh list now rebuilds the directory immediately.

Fixed

• Inline script and style blocks written by administrators, such as JSON-LD, are no longer emptied when a page is saved.
• Users without the unfiltered_html capability no longer erase a page JavaScript when they save it.
• Builder autosaves are sanitised exactly like a normal save.
• A register_meta notice logged on every request with WP_DEBUG on is gone.
• Project File Library rows stay aligned on desktop, tablet and mobile.
• Internal release notes are no longer shipped in the installable ZIP.

Install note: 1.9.6 contains everything from the 1.10 to 1.14 builds. If your site already runs one of those, install 1.9.6 with Appearance → Themes → Add New → Upload Theme and choose Replace current with uploaded.

What shipped

• Persistent document history, with a deleted page recoverable as a draft.
• The five newest versions of each document are kept; older ones are removed automatically, and existing history is trimmed on upgrade.
• Administrator-only “Delete all history”, behind an explicit confirmation. Current documents are never touched.
• Autosave now defaults to off and is configurable in seconds or minutes, with more reliable queued saves.
• Consistent, responsive design across seven Shilpi admin screens, and Settings grouped into clearer sections.
• Refreshed builder navigation, canvas controls, dropdown contrast, variable buttons and grouped keyboard shortcuts.
• Clear new-tab link controls, plus responsive image and priority settings.
• Application Password is now listed first and recommended for connecting an agent.

Fixed

• Retired CSS and JS URLs are preserved for cached HTML, and truncated generated files are detected and repaired.
• The Revision history dialog layout, and the duplicate Style destination card, which is gone.
• The scope of external CSS and production bundles is now stated clearly in Settings and the Dashboard.
• Wider regression coverage for companion plugin integration.

What shipped

• New Shilpi → Plugins screen: a directory of the free Shilpi add-ons, with install and activate in one click. Each plugin then updates itself from shilpibuilder.com through WordPress’s own Update URI mechanism — no licence key, no ZIP handling.
• Fixed Code Hub widening the whole admin page. One long line of code inside the editor was stretching the snippet card, the workspace and finally the page itself; the sideways scroll now stays inside the editor where it belongs.

What shipped

• shilpi_skill_catalog: an active plugin can provide a readonly, code-backed skill that appears in Shilpi → Skills, the MCP discovery prompt and the get_skill schema — with no database record left behind on deactivation.
• shilpi_agent_instruction_rules: a plugin can place a concise conditional routing rule inside the numbered “Instructions for the agent” brief.

What shipped

• Elements groups, Structure rows, Inspector sections and the responsive and state selectors now share the same geometry, stroke weight, alignment and expanded-state rotation.

What shipped

• Authenticated canvas requests now win the final template_include decision and render through Shilpi’s own document renderer.
• Ordinary WooCommerce and front-end routes are unchanged.

What shipped

• The component runtime, 24 builder elements and the 60KB commerce skin — about 3,200 lines — moved out of the theme and into Shilpi WooCommerce Kit. Install that plugin before updating a store.
• New extension points so a plugin can do what only the theme could before: shilpi_element_shortcode_translators, shilpi_element_groups and shilpi_known_css_classes.
• The manage_woocommerce MCP tool now comes from the plugin, registered through shilpi_mcp_tools like any other tool.

What shipped

• 36 scoped MCP tools are available to connected agents.
• Latest maintenance improvements and fixes for the Shilpi builder workflow.

What shipped

• 34 scoped MCP tools.
• SEO metadata through supported SEO plugins.
• WooCommerce storefront operations and templates.
• Menu and taxonomy management.
• Search, 404 and Loop templates.
• Site manifests, whole-site import and managed script load order.

What shipped

• 34 scoped MCP tools.
• SEO metadata through supported SEO plugins.
• WooCommerce storefront operations and templates.
• Menu and taxonomy management.
• Search, 404 and Loop templates.
• Site manifests, whole-site import and managed script load order.

• 30 MCP tools, up from 21.
• OAuth sign-in for MCP clients.
• Downloadable shilpi-theme and wordpress-core skills.
• Authenticated server test and improved import history.

• Central Security screen for temporary permissions.
• Reversible WordPress hardening controls.
• Sanitised SVG uploads.
• PHP snippets syntax-checked before activation.

• Three element states across the palette.
• Bulk controls for groups and the full palette.
• Improved builder element search.

• Inline or external fingerprinted CSS delivery.
• Production assets panel.
• Block Google Fonts requests.
• Improved local font manager.

• Native forms with stored submissions.
• Mail settings, SMTP and delivery log.
• Configurable submission retention.

• Header, Footer, Single, Archive and Part templates.
• Shortcodes for reusable parts.
• Dynamic post, author, site and ACF tokens.
• Query loops with native pagination.

• HTML, CSS and JavaScript storage model.
• Visual builder and structure tree.
• Design variables and global classes.
• Code Hub for managed site code.