Sarcio

define('SARCIO_SITE_KEY', 'pk_your_site');
define('SARCIO_SIDECAR_KEY', 'sk_…');
define('SARCIO_SIDECAR_DSN', 'unix:///run/sarcio/sarcio.sock');
define('SARCIO_SHIM_TOKEN', '…');

Changelog

0.17.0

• Other plugins can now add to what the assistant can do through one small, versioned way in (for developers: the sarcio_loaded action). The older sarcio_assistant_abilities filter still works and is marked deprecated.
• When a change under Recent changes was made by another plugin that is switched off now, the list says so and how to undo it, instead of only leaving out the Undo button.

0.16.5

• A new first screen under Sarcio: change your site by asking, see it on a private preview, undo it any time. Start free (14 days, no card needed) or connect an account you already have.
• Until the site is connected, administrators see a short note on the Plugins screen and the Dashboard pointing to Set up Sarcio. Close it once and it stays closed for you.
• When you deactivate Sarcio you can tell us what didn’t work, in one click. It is optional: nothing is sent unless you press Send and deactivate.

0.16.4

• The reporter script always loads from https://control.sarcio.io/sarcio.js. The Sarcio server address setting is gone, and nothing in the plugin can move the script elsewhere.
• Every REST route names its permission check where it is registered.
• WooCommerce’s own product and order abilities that Sarcio already covers are left to Sarcio’s, which preview and undo. No other plugin’s ability may delete something for good or mark an order refunded through the assistant.

0.16.3

• Across sites: a change your agency writes for several sites is only prepared here as a preview and waits under Sarcio → Requests, marked as your agency’s, until an administrator presses Apply. It is never applied by the scheduled check, including when the agency asked for it to go live, and an undo the agency asks for waits the same way. These changes are limited to content, menus, media, products, comments, categories, SEO and the site’s look: never plugins, themes, users or site settings.
• The assistant no longer suggests CSS: the hand-off to the Additional CSS editor is gone. It styles through the site styles, the theme’s own options and style rules.
• Content the assistant writes is filtered like an author’s, for everyone, and a theme option it changes must be a plain value from a plain field.
• Live fixes has a Turn off button, after you confirm it is you.
• The preview escapes what it shows, and the Dashboard boxes accept only a real colour.

0.16.2

• The assistant shows your preview in a panel beside the chat: your own site’s pages, with your changes in place, opened by Show beside the chat and on its own after a change is previewed. Show live and Show my changes flip the page in the panel and keep your place on it, without touching the chat. Links move around your site inside the panel. On a narrow screen the panel slides up as a sheet. If your site does not allow itself to be shown inside another page, the panel says so and offers Look at the site in a new tab.

0.16.1

• The preview bar has a Show live switch: flip the page you are on between your changes and the live site, and back, as often as you like. It stays as you left it while you move around the site, only in your browser, and never applies or discards anything.

0.16.0

• Safe updates: the assistant updates a plugin or theme from WordPress.org with checks. First whether it can run here (the PHP and WordPress versions it needs, file changes allowed, disk space, a big update that also changes its data), then a look at your key pages (home, shop, cart, checkout, a product, contact, your menu) before and after. If something breaks (a crash, a server error, the checkout or the way to pay gone), the earlier version is put back by itself; if something only looks different, the update is kept for you to decide. Either way it lands in the Inbox with Keep, Put the earlier version back or Try again.
• The list of waiting updates shows what those checks found for each one.
• Updating a plugin from the assistant keeps it switched on; before, WordPress left it off until the next page load.
• Checkout watch: with Sarcio noticed on, a WooCommerce checkout page that shows no checkout form or no way to pay counts as a failure, and a broken checkout opens a report sooner and marked Urgent. Urgent reports come first in the Inbox.

0.15.0

• The assistant styles one element with style rules (a selector, one property and a value, kept as data and checked by WordPress’s own CSS filter), changes a classic theme’s own Customizer options with the theme’s own checks, and hands anything else to WordPress’s Additional CSS editor as a suggestion you review and publish yourself. It no longer writes Additional CSS, and the site styles refuse CSS text.
• The Inbox and Live fixes pages are drawn by WordPress itself: your server fetches this site’s reports and fixes with your own Sarcio sign-in, instead of showing Sarcio’s screens in a frame.
• The list of the assistant’s changes, the monthly report page and the dashboard box show each person only the changes their own WordPress role would let them make; administrators still see every change. Scheduled changes are listed to the person who scheduled them and to administrators.
• Changes written for several sites (Across sites) are taken only after an administrator turns that on under Settings → Sarcio. It is off by default, including on sites that took them before.
• The reporter script always loads from the Sarcio server; the “Reporter script address” setting is gone.
• Data handed to the page’s scripts is escaped for the page, and the response rewrite of a live fix closes its output buffer itself.

0.14.1

• Other plugins’ abilities (MainWP’s among them) are offered on every assistant turn, not only when something else on the page had already asked WordPress for them.
• A change another plugin makes only with your go-ahead (a MainWP update run, for one) shows its tick box on the card, so Apply works.
• The Share for review box counts the notes it has.

0.14.0

• On a MainWP dashboard, the assistant works the whole portfolio through MainWP’s own abilities: a change that MainWP can dry-run is shown first and made only when you tick the box, and one that needs MainWP’s confirmation gets it from that same box.
• Your own preview gets the note bar too: pin a note on anything you would change and ask the assistant what the notes say. A request sent to the agency carries the notes pinned on its preview, shown on Sarcio → Requests.

0.13.2

• The review bar sits above the Report a bug button, with Leave a note first.

0.13.1

• WordPress’s own settings (the site title and tagline among them) are available to the assistant when an ask across sites runs from the scheduler, not only from the admin screen.

0.13.0

• Across sites: an agency writes a change once in Sarcio and picks the sites; every few minutes each site’s plugin picks up its task, runs the assistant as the administrator who connected the site, and either leaves the change in Sarcio → Requests for a person or applies it and reports back, with undo on every site from Sarcio. Nothing arrives unasked: the plugin pulls with the site’s own key, and only a connected administrator can run anything.
• Share a preview for review: a link that shows the preview as it stands, for a week, to anyone holding it, with a way to pin a note on any spot of any page. No WordPress login needed; the assistant reads the notes back.
• A scheduled change can repeat every day, week or month.
• The assistant reads the site’s recent activity, from Simple History or Stream where installed, and the monthly report shows it.

0.12.0

• The assistant can look at who can sign in (names and roles, never emails or passwords), change a user’s role with undo, invite someone by email and remove a user handing their content to another, each confirmed first.
• It reads WordPress’s Site Health and checks the site for images without alt text, links on its own pages that no longer answer and pages without a search description, then fixes what it can: alt text on several images at once, previewed and undoable.
• It changes the words in a classic text or block widget, Elementor’s global colours (previewed, every element using the colour follows), the text of synced patterns, and schedules a draft to publish at a time you pick.
• It updates themes one at a time with a way back for WordPress.org themes, and asks a backup plugin that offers it (Jetpack Backup and others) for a backup before any plugin or theme update.
• Earlier versions of a block theme’s site styles can be listed and restored.
• The monthly report gains what happened on the site (pages published, comments moderated, updates) and today’s Site Health.
• Settings → Sarcio lists the other plugins offering abilities here and the ones never offered because they run code.

0.11.0

• The assistant moderates comments (approve, hold, spam, trash, in bulk, undoable), manages categories, tags and product categories, puts a page back to one of its earlier versions, and shows and changes redirects through the Redirection plugin.
• On a WooCommerce shop it says what sold and moves orders along with a note; it never refunds. With Gravity Forms it lists forms and recent entries and changes where a form’s emails go; entries are read for the question asked and never kept in a saved conversation.
• It updates plugins one at a time after a ticked box, and puts a WordPress.org plugin back to the version it had on undo.
• Page caches (WP Rocket, LiteSpeed, W3 Total Cache, WP Super Cache, Cache Enabler, WP Fastest Cache, Autoptimize, SiteGround, WP Engine, Breeze) are cleared after every applied change, and on request.
• Abilities other plugins register that would run code or read files on the server are never offered to the assistant.
• Three Dashboard boxes: what needs a person, what failed for visitors (Sarcio noticed), and what the assistant can do with the plugins on this site, each with a request to try.

0.10.0

• The assistant can change the settings other plugins register with WordPress, through each plugin’s own checks, previewed and undoable; settings that hold keys, tokens or passwords are hidden and cannot be changed from the assistant.
• Abilities other plugins register with WordPress (the Abilities API) are offered to the assistant beside Sarcio’s own, each switchable off in the settings; one a plugin marks destructive needs a ticked box first.

0.9.9

• The assistant changes the text on pages built with Divi, and drops Divi’s cached styles for the page.
• Sarcio → Requests applies, declines and withdraws through plain forms.

0.9.8

• The External services section describes Sarcio noticed, which the Sarcio dashboard can turn on per site: the widget then reports what failed on a page view, and a failure several visitors hit opens a report by itself.

0.9.7

• Requests: with “Who applies changes” set to administrators under Settings → Sarcio → Assistant, an editor previews a change as usual and sends it to the agency instead of applying it. Administrators apply or decline it under Sarcio → Requests, the Sarcio workspace Inbox lists it, and the person who asked is emailed either way. The changes themselves never leave the site.

0.9.6

• White label: an agency sets its name, logo and colour in its Sarcio workspace, and the plugin shows them on the screens a client sees (the menu, the assistant, the preview bar, the Report a bug button, the monthly report).

0.9.5

• Scheduled changes: on the preview, Schedule… makes the changes at a time you pick and, if you like, changes them back at a second time. Scheduled changes are listed beside the chat and can be cancelled until they run.

0.9.4

• Sarcio → Report: what changed on the site in a month, the assistant’s changes and the fixes kept, fit to print or save as a PDF. Add email addresses under Settings → Sarcio and the report arrives on the first of each month.

0.9.3

• The assistant can set a page’s search title and description through Yoast SEO or Rank Math, set a page’s featured image, and change an image’s alt text.

0.9.2

• The assistant changes the text on pages built with Elementor: it reads the widgets’ text, previews the change on your site and undoes it like any other.

0.9.1

• Applying a previewed change no longer fails when the preview was open in the same browser.
• The preview bar sits below the WordPress admin bar.

0.9.0

• On a block theme, the assistant can change the text in the header, footer and other template parts (a phone number, an opening line), saved as your site’s own copy of the part the way the Site Editor does; the theme’s files are never written, and undo removes the copy.
• Any single previewed change can be left out before you apply the rest.
• Settings → Sarcio → Assistant lets an administrator turn off any of the things the assistant can do, for everyone on the site.

0.8.0

• The assistant lays its changes over a preview of your site that only you can see. Look at the site with the changes in place, keep asking for more, then apply them all at once or discard them. Nothing is live until you apply.
• Conversations are saved on your site, per person, and can be picked up again from the list on the Assistant page.
• A long conversation keeps going: the oldest messages are summarised instead of forgotten.

0.7.2

• Works on every WordPress release the plugin supports (6.0 and later), and the WordPress.org Plugin Check passes clean.

0.7.1

• Every change the assistant proposes, makes or lists under Recent changes shows what changed as a highlighted before-and-after of the page’s text, with the changed words marked.
• Coupons can limit uses per customer.
• The assistant goes straight to the change you asked for instead of asking first; the Apply button is the confirmation.

0.7.0

• Sarcio → Assistant: ask for everyday changes to your site in plain words. The assistant shows each change before it is made, applies it only when you press Apply, and lists every change with an Undo button. It covers pages, posts and products, menus, extra styles and site styles, WooCommerce settings and coupons, and turning plugins on and off (installs only from WordPress.org, with your tick for each plugin).
• The same changes are offered to WordPress 6.9’s Abilities API, so an MCP client connected to your site can use them too.

0.6.2

• Kept fixes show code in their description as code.
• The Report a bug button’s default icon is a plain chat bubble, and a picked part of the page is described in plain words.

0.6.1

• Fixed: kept page fixes did not apply when the plugin was installed with Composer. The small script that applies them is now printed into the page from the plugin itself.

0.6.0

• Keep this fix: save a live fix on your site for good. Kept fixes keep working even if the site is no longer connected to Sarcio, and are listed under Sarcio → Kept fixes, where you can turn them off or remove them.
• The Sarcio menu shows how many reports are waiting, and a Sarcio box on the WordPress Dashboard sums them up.
• Simpler review screens inside WordPress: what the visitor reported, the fix in plain words, Preview, Approve and go live.
• The preview banner floats over the page instead of pushing it down.

0.5.0

• Sign in once: connecting keeps you signed in to the Sarcio Inbox inside WordPress, with no second sign-in. Approving a patch there still asks for your Sarcio password or an authenticator code.
• Everyone who reviews patches can connect their own Sarcio account from the Sarcio menu, not only the administrator who connected the site.
• Connecting happens in the same tab and brings you straight back to the Inbox.
• A short introduction on the Sarcio page when the site is not connected yet, and a simpler Inbox with no extra header.
• The Sarcio menu shows the Sarcio mark, in your admin colour scheme.
• Fixed: a site name with an ampersand reached Sarcio as “&”.

0.4.1

• Style the reporter button: icon or text, icon, color, position and a dark panel, with a live preview.
• The Sarcio menu now reads Inbox, Live patches and Settings, the same words as the Sarcio dashboard, and the introduction explains what you need before you open the Inbox here. It can be turned off again under Advanced settings.
• Fixed: turning on the Inbox in wp-admin, or connecting with the button, switched the reporter off.

0.4.0

• Connect to Sarcio: one button signs you in (or signs you up) and connects the site, with nothing to copy.
• Optional review screens in wp-admin: reports, plain-language drafted patches, preview, approve, reject and redraft, from your Sarcio workspace, turned on by an administrator.
• Previewing a server patch applies it for your own browser only, so you can try it on the live site before approving.
• The settings page shows this month’s AI drafts and credits against your plan, with a link to add more, and links to the right page of your Sarcio dashboard.

0.3.4

• Setup is now two keys. Settings → Sarcio opens with a plain-language status box (connected or not, when the site last checked for patches, how many are active, and a Check for patches now button) and asks only for the site key and the secret key; everything else moved under Advanced settings.
• The Sarcio server address defaults to Sarcio’s own, so a site key alone is enough for the bug reporter and page patches.
• The site checks for new server patches every 30 seconds by default (was 60), and right after the settings are saved.

0.3.3

• Fixed: installed with Composer outside wp-content/plugins, the plugin pointed the screenshot library at a URL that can’t be served. It now uses its bundled copy only when the plugin’s files are web-reachable, and otherwise lets the reporter widget load the library itself.

0.3.2

• Fixed: installed with Composer, the plugin could resolve a shim older than 0.3 and stop every page with a fatal error once a sidecar key was set. It now requires the 0.3.1 shim, and if an older one is present anyway the server tier stays off instead.

0.3.1

• Removed opcache file swaps (signed replacement PHP files). The plugin no longer writes to your site’s files, and the File swaps and State directory settings and wp sarcio sync-files are gone.
• The screenshot library, html2canvas 1.4.1, is now bundled with the plugin instead of loaded from the unpkg CDN.
• The External services section now describes the direct-mode patch requests.

0.3.0

• Server-side patching without the sidecar: enter the site’s sidecar key and the plugin fetches, verifies and applies your signed server patches itself, on any host. The sidecar remains the fast path where a service can run.
• New settings: Sidecar key and Refresh interval. New command: wp sarcio pull. The settings screen and wp sarcio status show which transport is in use and the last pull.
• Requires the bundled shim core 0.3.

0.2.2

• The plugin URI now points at the plugin’s own guide, distinct from the author URI (a WordPress.org submission requirement).

0.2.1

• Passes the WordPress Plugin Check: direct-access guard on the helpers file, no reliance on a WordPress 6.5 polyfill, prefixed uninstall globals, and the reasons for the remaining direct file and socket operations stated in place.

0.2.0

• The plugin, including the bundled PHP shim core, is now licensed GPL-2.0-or-later.
• Adds a WordPress.org readme with the external services disclosure.
• Settings page and request handling tidied for the WordPress coding standards.

0.1.x

• Early releases distributed directly to Sarcio customers.