fix: move sync-wiki.yml secrets to env block to resolve SonarCloud S7636

Move github.actor, secrets.GITHUB_TOKEN, and github.repository from inline run block string interpolation to step-level env: block. References via env vars prevent secret expansion in workflow logs. Resolves the remaining S7636 hotspot in sync-wiki.yml. Closes #106
fix: streamline npm lint and quality scripts (issue #109 ) (#116 )
2026-03-20 07:10:45 +00:00 · 2026-03-19 23:20:17 +00:00 · 2026-03-19 22:40:02 +00:00 · 2026-03-19 22:29:00 +00:00 · 2026-03-18 22:57:17 +00:00 · 2026-03-18 21:38:00 +00:00
30 changed files with 1813 additions and 577 deletions
--- a/.agents/error-checking-feedback-loops.md
+++ b/.agents/error-checking-feedback-loops.md
@@ -23,34 +23,39 @@ AI assistants can directly monitor GitHub Actions workflows using the GitHub API

 This helps identify failures and diagnose issues:

-```
+```text
 github-api /repos/{owner}/{repo}/actions/runs
 ```

 #### Step-by-Step Process

 1. **Get Recent Workflow Runs**:
-   ```
+
+   ```text
   github-api /repos/wpallstars/wp-plugin-starter-template-for-ai-coding/actions/runs
   ```

 2. **Filter for Failed Runs**:
-   ```
+
+   ```text
   github-api /repos/wpallstars/wp-plugin-starter-template-for-ai-coding/actions/runs?status=failure
   ```

 3. **Get Details for a Specific Run**:
-   ```
+
+   ```text
   github-api /repos/wpallstars/wp-plugin-starter-template-for-ai-coding/actions/runs/{run_id}
   ```

 4. **Get Jobs for a Workflow Run**:
-   ```
+
+   ```text
   github-api /repos/wpallstars/wp-plugin-starter-template-for-ai-coding/actions/runs/{run_id}/jobs
   ```

 5. **Analyze Job Logs** (if accessible via API):
-   ```
+
+   ```text
   github-api /repos/wpallstars/wp-plugin-starter-template-for-ai-coding/actions/jobs/{job_id}/logs
   ```

@@ -61,6 +66,7 @@ github-api /repos/{owner}/{repo}/actions/runs
 **Error**: `Missing download info for actions/upload-artifact@v3`

 **Solution**: Update to the latest version of the action:
+
 ```yaml
 uses: actions/upload-artifact@v4
 ```
@@ -70,7 +76,8 @@ uses: actions/upload-artifact@v4
 **Error**: `The current host is 127.0.0.1:8888, but WordPress multisites do not support custom ports.`

 **Solution**: Use port 80 for multisite environments:
-```yaml
+
+```bash
 npx @wp-playground/cli server --blueprint playground/multisite-blueprint.json --port 80 --login &
 ```

@@ -79,6 +86,7 @@ npx @wp-playground/cli server --blueprint playground/multisite-blueprint.json --
 **Error**: Invalid path syntax for artifacts

 **Solution**: Use multi-line format for better readability:
+
 ```yaml
 path: |
  cypress/videos
@@ -90,6 +98,7 @@ path: |
 **Problem**: Redundant workflow runs when multiple commits land quickly

 **Solution**: Add concurrency control to cancel in-progress runs:
+
 ```yaml
 concurrency:
  group: playground-tests-${{ github.ref }}
@@ -125,16 +134,19 @@ npm run test:playground:multisite
 ### Capturing and Analyzing Test Output

 1. **Run Tests with Output Capture**:
+
   ```bash
   npm run test:single > test-output.log 2>&1
   ```

 2. **Analyze Output for Errors**:
+
   ```bash
-   cat test-output.log | grep -i 'error\|fail\|exception'
+   grep -E -i '\b(error|fail|exception)' test-output.log
   ```

 3. **Parse Structured Test Results** (if available):
+
   ```bash
   cat cypress/results/results.json
   ```
@@ -146,6 +158,7 @@ npm run test:playground:multisite
 **Error**: `The current host is 127.0.0.1:8888, but WordPress multisites do not support custom ports.`

 **Solution**: Modify the port in the blueprint or test configuration:
+
 ```json
 {
  "features": {
@@ -159,6 +172,7 @@ npm run test:playground:multisite
 **Error**: `Timed out retrying after 4000ms: expected '<body...>' to have class 'wp-admin'`

 **Solution**: Update selectors to be more robust and handle login states:
+
 ```javascript
 cy.get('body').then(($body) => {
  if ($body.hasClass('login')) {
@@ -199,16 +213,19 @@ npm run lint:css
 ### Parsing Code Quality Tool Output

 1. **Run Code Quality Check**:
+
   ```bash
   composer run phpcs > phpcs-output.log 2>&1
   ```

 2. **Analyze Output for Errors**:
+
   ```bash
-   cat phpcs-output.log | grep -i 'ERROR\|WARNING'
+   grep -E -i '\b(ERROR|WARNING)' phpcs-output.log
   ```

 3. **Automatically Fix Issues** (when possible):
+
   ```bash
   composer run phpcbf
   ```
@@ -221,13 +238,13 @@ AI assistants can check these comments to identify and address issues.

 #### Accessing PR Comments via GitHub API

-```
+```text
 github-api /repos/wpallstars/wp-plugin-starter-template-for-ai-coding/pulls/{pull_number}/comments
 ```

 #### Accessing PR Review Comments

-```
+```text
 github-api /repos/wpallstars/wp-plugin-starter-template-for-ai-coding/pulls/{pull_number}/reviews
 ```

@@ -236,7 +253,8 @@ github-api /repos/wpallstars/wp-plugin-starter-template-for-ai-coding/pulls/{pul
 CodeRabbit provides AI-powered code review comments via the GitHub API.

 1. **Get PR Comments**:
-   ```
+
+   ```text
   github-api /repos/wpallstars/wp-plugin-starter-template-for-ai-coding/pulls/{pull_number}/comments
   ```

@@ -254,12 +272,14 @@ CodeRabbit provides AI-powered code review comments via the GitHub API.
 These tools provide automated code quality checks and post results as PR comments.

 1. **Check PR Status Checks**:
-   ```
+
+   ```text
   github-api /repos/wpallstars/wp-plugin-starter-template-for-ai-coding/commits/{sha}/check-runs
   ```

 2. **Get Detailed Reports** (if available via API):
-   ```
+
+   ```text
   github-api /repos/wpallstars/wp-plugin-starter-template-for-ai-coding/commits/{sha}/check-runs/{id}
   ```

@@ -275,7 +295,8 @@ These tools provide automated code quality checks and post results as PR comment
 SonarCloud provides detailed code quality and security analysis.

 1. **Check SonarCloud Status**:
-   ```
+
+   ```text
   github-api /repos/wpallstars/wp-plugin-starter-template-for-ai-coding/commits/{sha}/check-runs?check_name=SonarCloud
   ```

@@ -293,6 +314,7 @@ SonarCloud provides detailed code quality and security analysis.
 **Error**: `ERROR: Expected snake_case for function name, but found camelCase`

 **Solution**: Rename functions to follow snake_case convention:
+
 ```php
 // Before
 function getPluginVersion() { ... }
@@ -306,6 +328,7 @@ function get_plugin_version() { ... }
 **Error**: `ERROR: Missing doc comment for function`

 **Solution**: Add proper docblocks:
+
 ```php
 /**
 * Get the plugin version.
@@ -332,7 +355,8 @@ function get_plugin_version() { ... }
 #### Extracting Actionable Items from PR Comments

 1. **Collect All Feedback**:
-   ```
+
+   ```text
   github-api /repos/wpallstars/wp-plugin-starter-template-for-ai-coding/pulls/{number}/comments
   github-api /repos/wpallstars/wp-plugin-starter-template-for-ai-coding/pulls/{number}/reviews
   ```
@@ -364,7 +388,7 @@ function get_plugin_version() { ... }

 ### Complete Feedback Loop System

-```
+```text
 Code Changes ──► Local Testing ──► GitHub Actions
     │                │                  │
     ▼                ▼                  ▼
@@ -395,7 +419,7 @@ These can be directly accessed and processed.

 #### Example CodeRabbit Feedback

-```
+```text
 coderabbitai bot left a comment
 Actionable comments posted: 1

@@ -424,14 +448,14 @@ These tools provide structured feedback that can be systematically addressed.

 #### Example SonarCloud Feedback

-```
+```text
 SonarCloud Quality Gate failed
 - 3 Bugs
 - 5 Code Smells
 - 1 Security Hotspot
 ```

-#### Processing Steps
+#### SonarCloud Processing Steps

 1. **Access Detailed Reports**:
   * Use the SonarCloud API or web interface
@@ -479,6 +503,7 @@ AI assistants can contribute fixes upstream.
 ### Workflow for External Contributions

 1. **Clone the Repository Locally**:
+
   ```bash
   cd ~/Git
   git clone https://github.com/owner/repo.git
@@ -487,6 +512,7 @@ AI assistants can contribute fixes upstream.
   ```

 2. **Make Changes and Commit**:
+
   ```bash
   # Make your changes
   git add -A
@@ -498,6 +524,7 @@ AI assistants can contribute fixes upstream.
   ```

 3. **Fork and Push**:
+
   ```bash
   # Create a fork (if not already forked)
   gh repo fork owner/repo --clone=false --remote=true
@@ -510,6 +537,7 @@ AI assistants can contribute fixes upstream.
   ```

 4. **Create Pull Request**:
+
   ```bash
   gh pr create \
     --repo owner/repo \
--- a/.eslintrc.js
+++ b/.eslintrc.js
@@ -2,8 +2,7 @@ module.exports = {
  env: {
    browser: true,
    es2021: true,
-    node: true,
-    'cypress/globals': true
+    node: true
  },
  extends: [
    'eslint:recommended'
@@ -16,9 +15,23 @@ module.exports = {
    sourceType: 'module'
  },
  rules: {
+    'comma-dangle': ['error', 'always-multiline'],
    'no-console': 'warn',
    'no-unused-vars': 'warn'
  },
+  overrides: [
+    {
+      // cypress.config.js uses CommonJS (require/module.exports).
+      // Override sourceType to 'script' so ESLint does not flag require as undefined.
+      files: ['cypress.config.js', 'cypress.config.cjs'],
+      parserOptions: {
+        sourceType: 'script'
+      },
+      env: {
+        node: true
+      }
+    }
+  ],
  globals: {
    cy: 'readonly',
    Cypress: 'readonly',
--- a/.github/workflows/code-quality.yml
+++ b/.github/workflows/code-quality.yml
@@ -20,7 +20,7 @@ jobs:
          clean: 'true'

      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
        with:
          php-version: '8.1'
          extensions: mbstring, intl, zip
@@ -29,11 +29,6 @@ jobs:
      - name: Install dependencies
        run: composer install --prefer-dist --no-progress

-      - name: Install WordPress Coding Standards
-        run: |
-          composer require --dev wp-coding-standards/wpcs dealerdirect/phpcodesniffer-composer-installer
-          vendor/bin/phpcs --config-set installed_paths vendor/wp-coding-standards/wpcs
-
      - name: Run PHPCS
        run: composer phpcs
        continue-on-error: true
@@ -52,7 +47,7 @@ jobs:
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
        with:
          php-version: '8.1'
          extensions: mbstring, intl, zip
@@ -61,9 +56,6 @@ jobs:
      - name: Install dependencies
        run: composer install --prefer-dist --no-progress

-      - name: Install PHPStan WordPress stubs
-        run: composer require --dev szepeviktor/phpstan-wordpress
-
      - name: Run PHPStan
        run: composer phpstan
        continue-on-error: true
@@ -76,7 +68,7 @@ jobs:
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
        with:
          php-version: '8.1'
          extensions: mbstring, intl, zip
@@ -127,7 +119,7 @@ jobs:
  #
  #     - name: SonarCloud Scan
  #       if: steps.check_sonar_token.outputs.skip != 'true'
-  #       uses: SonarSource/sonarqube-scan-action@master
+  #       uses: SonarSource/sonarqube-scan-action@9598b8a83feef37de07f549027fab50ecffe6a6e # master
  #       env:
  #         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  #         SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
@@ -160,7 +152,7 @@ jobs:
          fi

      - name: Run Codacy Analysis CLI
-        uses: codacy/codacy-analysis-cli-action@v4
+        uses: codacy/codacy-analysis-cli-action@562ee3e92b8e92df8b67e0a5ff8aa8e261919c08 # v4
        with:
          project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
          verbose: true
@@ -175,7 +167,7 @@ jobs:

      - name: Upload SARIF results file
        if: steps.check_codacy_token.outputs.skip_upload != 'true'
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@603b797f8b14b413fe025cd935a91c16c4782713 # v3
        with:
          sarif_file: results.sarif
        continue-on-error: true
--- a/.github/workflows/phpunit.yml
+++ b/.github/workflows/phpunit.yml
@@ -42,7 +42,7 @@ jobs:
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
        with:
          php-version: ${{ matrix.php }}
          extensions: dom, curl, libxml, mbstring, zip, pdo, mysql, pdo_mysql, bcmath, soap, intl, gd, exif, iconv
--- a/.github/workflows/playground-tests-fix.yml
+++ b/.github/workflows/playground-tests-fix.yml
@@ -36,7 +36,7 @@ jobs:
    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

    - name: Setup Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
      with:
        node-version: '20'
        cache: 'npm'
@@ -98,7 +98,7 @@ jobs:

    - name: Upload Cypress artifacts
      if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
      with:
        name: cypress-playground-results
        path: |
--- a/.github/workflows/playground-tests.yml
+++ b/.github/workflows/playground-tests.yml
@@ -40,7 +40,7 @@ jobs:
    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

    - name: Setup Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
      with:
        node-version: ${{ matrix.node-version }}
        cache: 'npm'
@@ -67,7 +67,7 @@ jobs:
    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

    - name: Setup Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
      with:
        node-version: '20'
        cache: 'npm'
@@ -142,7 +142,7 @@ jobs:

    - name: Upload Cypress artifacts
      if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
      with:
        name: cypress-single-site-results
        path: |
@@ -163,7 +163,7 @@ jobs:
    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

    - name: Setup Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
      with:
        node-version: '20'
        cache: 'npm'
@@ -239,7 +239,7 @@ jobs:

    - name: Upload Cypress artifacts
      if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
      with:
        name: cypress-multisite-results
        path: |
@@ -261,7 +261,7 @@ jobs:
    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

    - name: WordPress Performance Tests
-      uses: swissspidy/wp-performance-action@v2.0.3
+      uses: swissspidy/wp-performance-action@b7e3ffcf0fc4a48b62492e021e0ebeb51430ff11 # v2.0.3
      with:
        plugins: |
          ./
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,10 +14,10 @@ jobs:
      contents: write
    steps:
      - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0

      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
        with:
          php-version: '7.4'
          extensions: mbstring, intl, zip
@@ -62,7 +62,7 @@ jobs:

      - name: Create Release
        id: create_release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
        with:
          files: wp-plugin-starter-template-for-ai-coding-${{ env.VERSION }}.zip
          name: v${{ env.VERSION }} - WordPress Plugin Starter Template
--- a/.github/workflows/sonarcloud.yml
+++ b/.github/workflows/sonarcloud.yml
@@ -49,7 +49,7 @@ jobs:

      - name: SonarCloud Scan
        if: steps.check_token.outputs.skip != 'true'
-        uses: SonarSource/sonarqube-scan-action@master
+        uses: SonarSource/sonarqube-scan-action@9598b8a83feef37de07f549027fab50ecffe6a6e # master
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONARCLOUD_GITHUB }}
--- a/.github/workflows/sync-wiki.yml
+++ b/.github/workflows/sync-wiki.yml
@@ -15,7 +15,7 @@ jobs:
      contents: write
    steps:
      - name: Checkout source code
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0

      - name: Configure Git
        run: |
@@ -50,4 +50,8 @@ jobs:
          git commit -m "Sync wiki from source repository"

          # Push changes
-          git push https://${{ github.actor }}:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.wiki.git
+          git push https://${WIKI_ACTOR}:${WIKI_TOKEN}@github.com/${WIKI_REPO}.wiki.git
+        env:
+          WIKI_ACTOR: ${{ github.actor }}
+          WIKI_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          WIKI_REPO: ${{ github.repository }}
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -17,12 +17,12 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          clean: 'true'

      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
        with:
          php-version: ${{ matrix.php-versions }}
          extensions: mbstring, intl, zip
@@ -34,11 +34,8 @@ jobs:
      - name: Install dependencies
        run: composer install --prefer-dist --no-progress

-      # - name: Debug test file content
-      #   run: echo "--- Debugging tests/test-admin.php lines 75-95 ---" && sed -n '75,95p' tests/test-admin.php && echo "--- End Debugging ---"
-
-      # - name: Run tests
-      #   run: ./vendor/bin/phpunit
+      - name: Run tests
+        run: ./vendor/bin/phpunit

  code-style:
    name: Code Style
@@ -46,12 +43,12 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          clean: 'true'

      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
        with:
          php-version: '7.4'
          extensions: mbstring, intl, zip
--- a/.github/workflows/wordpress-tests.yml
+++ b/.github/workflows/wordpress-tests.yml
@@ -37,7 +37,7 @@ jobs:
    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

    - name: Setup Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
      with:
        node-version: ${{ matrix.node-version }}
        cache: 'npm'
@@ -73,7 +73,7 @@ jobs:
    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

    - name: Setup Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
      with:
        node-version: '20'
        cache: 'npm'
@@ -124,7 +124,7 @@ jobs:

    - name: Upload Cypress artifacts
      if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
      with:
        name: cypress-results
        path: |
--- a/.gitignore
+++ b/.gitignore
@@ -63,3 +63,6 @@ temp/
 coverage/
 .phpunit.result.cache
 .agents/loop-state/
+
+# Local tool configs
+.superset/
--- a/.wiki/Coding-Standards.md
+++ b/.wiki/Coding-Standards.md
@@ -67,7 +67,7 @@ if ($condition) {
 ### Documentation

 * All classes, methods, and functions should be documented using PHPDoc
-* Include a description of the parameters, return values, and possible exceptions
+* Include descriptions of parameters, return values, and any exceptions thrown

 ```php
 /**
@@ -271,7 +271,7 @@ To ensure your code passes the quality checks from these tools, follow these gui
 3. **Using AI Assistants with Code Quality Tools**
   * When you receive feedback from code quality tools, you can use AI assistants to help address the issues
   * Copy the output from the code quality tool and paste it into your AI assistant chat
-   * Ask the AI to help you understand and resolve the issues
+   * Request the AI's assistance to interpret and resolve the reported issues
   * Example prompt:

     ```text
--- a/.wiki/Contributing.md
+++ b/.wiki/Contributing.md
@@ -106,7 +106,7 @@ When you receive feedback from these code quality tools, you can use AI assistan

 1. Copy the output from the code quality tool
 2. Paste it into your AI assistant chat
-3. Ask the AI to help you understand and resolve the issues
+3. Request the AI's assistance to interpret and resolve the reported issues
 4. Apply the suggested fixes
 5. Commit the changes and verify that the issues are resolved

@@ -143,7 +143,7 @@ To ensure your code meets the quality standards, run these commands before submi
 * Check JavaScript coding standards: `npm run lint:js`
 * Check CSS coding standards: `npm run lint:css`

-These checks will help identify and fix issues before they are caught by the automated code quality tools in the pull request process.
+These checks will assist in identifying and resolving issues before they are caught by the automated code quality tools in the pull request process.

 ## Documentation

--- a/.wiki/Playground-Testing.md
+++ b/.wiki/Playground-Testing.md
@@ -24,9 +24,10 @@ The easiest way to test our plugin with WordPress Playground is to use the onlin
 [playground-single]: https://playground.wordpress.net/?blueprint-url=https://raw.githubusercontent.com/wpallstars/wp-plugin-starter-template-for-ai-coding/main/playground/blueprint.json&_t=2
 [playground-multisite]: https://playground.wordpress.net/?blueprint-url=https://raw.githubusercontent.com/wpallstars/wp-plugin-starter-template-for-ai-coding/main/playground/multisite-blueprint.json&_t=2

-These links automatically set up WordPress with multisite enabled and WP_DEBUG enabled.
+Both links automatically set up WordPress with WP_DEBUG enabled and the Plugin Toggle and
+Kadence Blocks plugins pre-installed and activated.

-Both the Plugin Toggle and Kadence Blocks plugins are pre-activated.
+The multisite link additionally enables WordPress multisite and network-activates both plugins.

 ## WP-CLI Commands for WordPress Playground

@@ -101,14 +102,16 @@ In a WordPress multisite environment, there are two ways to activate plugins:
 1. **Network Activation**: Activates a plugin for all sites in the network
   * In the WordPress admin, go to Network Admin > Plugins
   * Click "Network Activate" under the plugin
-   * Or use WP-CLI: `wp plugin install plugin-name --activate-network`
+   * Or use WP-CLI:
+      * To activate an already installed plugin: `wp plugin activate plugin-name --network`
+      * To install and activate in one step: `wp plugin install plugin-name --activate-network`

 2. **Per-Site Activation**: Activates a plugin for a specific site
   * In the WordPress admin, go to the specific site's admin area
   * Go to Plugins and activate the plugin for that site only
   * Or use WP-CLI: `wp plugin activate plugin-name --url=site-url`

-Our multisite blueprint uses network activation for the Plugin Toggle plugin as an example.
+Our multisite blueprint uses network activation for both the Plugin Toggle and Kadence Blocks plugins.

 ## Running Tests with WordPress Playground

--- a/README.md
+++ b/README.md
@@ -376,7 +376,7 @@ When you receive feedback from these code quality tools, you can use AI assistan

 1. Copy the output from the code quality tool
 2. Paste it into your AI assistant chat
-3. Ask the AI to help you understand and resolve the issues
+3. Request the AI's assistance to interpret and resolve the reported issues
 4. Apply the suggested fixes
 5. Commit the changes and verify that the issues are resolved

--- a/admin/css/admin-styles.css
+++ b/admin/css/admin-styles.css
@@ -123,8 +123,8 @@
    text-align: right;
 }

-/* Responsive Styles */
-@media screen and (width <= 782px) {
+/* 782px is the WordPress mobile admin breakpoint. */
+@media screen and (max-width: 782px) {
    .wpst-form-table th {
        width: 100%;
        display: block;
--- a/admin/js/admin-scripts.js
+++ b/admin/js/admin-scripts.js
@@ -78,7 +78,7 @@
          data: {
            action: 'wpst_save_settings',
            nonce: wpstData.nonce,
-            formData: formData
+            formData: formData,
          },
          success: function (response) {
            if (response.success) {
@@ -93,8 +93,8 @@
          complete: function () {
            // Re-enable submit button and remove loading state.
            $submitButton.prop( 'disabled', false ).removeClass( 'loading' );
-          }
-        }
+          },
+        },
      );
    },

@@ -123,19 +123,19 @@
            300,
            function () {
              $( this ).remove();
-            }
+            },
          );
        },
-        5000
+        5000,
      );
-    }
+    },
  };

  // Initialize when document is ready.
  $( document ).ready(
    function () {
      WPSTAdmin.init();
-    }
+    },
  );

 })( jQuery );
--- a/admin/js/update-source-selector.js
+++ b/admin/js/update-source-selector.js
@@ -48,7 +48,7 @@
          if ($( e.target ).hasClass( 'wpst-modal' )) {
            WPSTUpdateSourceSelector.closeModal();
          }
-        }
+        },
      );

      // Select source option.
@@ -116,7 +116,7 @@
          data: {
            action: 'wpst_set_update_source', // AJAX action hook.
            nonce: wpstModalData.nonce, // Security nonce.
-            source: this.selectedSource
+            source: this.selectedSource,
          },
          success: function (response) {
            if (response.success) {
@@ -127,7 +127,7 @@
                function () {
                  WPSTUpdateSourceSelector.closeModal();
                },
-                1500
+                1500,
              );
            } else {
              WPSTUpdateSourceSelector.showMessage( 'error', response.data.message );
@@ -139,40 +139,44 @@
          complete: function () {
            // Reset button state.
            $saveButton.prop( 'disabled', false ).text( wpstModalData.i18n.confirm );
-          }
-        }
+          },
+        },
      );
    },

    /**
 		 * Show a message in the modal
 		 *
-		 * @param {string} type Message type (success, error)
+		 * @param {string} type    Message type (success, error)
 		 * @param {string} message Message text
 		 */
    showMessage: function (type, message) {
      const $message = this.$modal.find( '.wpst-modal-message' );

-      // Set message as plain text to prevent XSS, then apply type class.
-      $message.text( message ).removeClass( 'success error' ).addClass( type ).show();
+      // Validate type against allow-list to prevent class injection vulnerabilities.
+      const allowedTypes = [ 'success', 'error' ];
+      const safeType = allowedTypes.includes( type ) ? type : 'error';
+
+      // Set message as plain text to prevent XSS, then apply validated type class.
+      $message.text( message ).removeClass( 'success error' ).addClass( safeType ).show();

      // Hide message after a delay for success messages.
-      if (type === 'success') {
+      if (safeType === 'success') {
        setTimeout(
          function () {
            $message.fadeOut( 300 );
          },
-          3000
+          3000,
        );
      }
-    }
+    },
  };

  // Initialize when document is ready.
  $( document ).ready(
    function () {
      WPSTUpdateSourceSelector.init();
-    }
+    },
  );

 })( jQuery );
--- a/bin/install-wp-tests.sh
+++ b/bin/install-wp-tests.sh
@@ -117,6 +117,7 @@ install_test_suite() {
 	# set up testing suite if it doesn't yet exist
 	if [ ! -d "$WP_TESTS_DIR" ]; then
 		mkdir -p "$WP_TESTS_DIR"
+		rm -rf /tmp/wordpress-develop
 		if ! git clone --quiet --depth=1 --branch "$GIT_REF" https://github.com/WordPress/wordpress-develop.git /tmp/wordpress-develop; then
 			echo "Error: Failed to clone wordpress-develop at branch/tag $GIT_REF" >&2
 			exit 1
--- a/bin/localwp-setup.sh
+++ b/bin/localwp-setup.sh
@@ -28,7 +28,6 @@ set -e
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_DIR="$(dirname "$SCRIPT_DIR")"
 PLUGIN_SLUG="wp-plugin-starter-template"
-PLUGIN_TEXT_DOMAIN="wp-plugin-starter-template"

 # LocalWP paths (macOS)
 LOCAL_SITES_DIR="$HOME/Local Sites"
@@ -51,363 +50,375 @@ NC='\033[0m' # No Color

 # Helper functions
 log_info() {
-    echo -e "${BLUE}[INFO]${NC} $1"
+	echo -e "${BLUE}[INFO]${NC} $1"
 }

 log_success() {
-    echo -e "${GREEN}[SUCCESS]${NC} $1"
+	echo -e "${GREEN}[SUCCESS]${NC} $1"
 }

 log_warning() {
-    echo -e "${YELLOW}[WARNING]${NC} $1"
+	echo -e "${YELLOW}[WARNING]${NC} $1"
 }

 log_error() {
-    echo -e "${RED}[ERROR]${NC} $1"
+	echo -e "${RED}[ERROR]${NC} $1"
 }

 log_step() {
-    echo -e "${CYAN}[STEP]${NC} $1"
+	echo -e "${CYAN}[STEP]${NC} $1"
 }

 # Check if LocalWP is installed
 check_localwp() {
-    if [ ! -d "$LOCAL_APP" ]; then
-        log_error "LocalWP is not installed at $LOCAL_APP"
-        log_info "Download from: https://localwp.com/"
-        exit 1
-    fi
-    
-    if [ ! -f "$LOCAL_WP_CLI" ]; then
-        log_error "WP-CLI not found in LocalWP installation"
-        exit 1
-    fi
-    
-    local version=$("$LOCAL_WP_CLI" --version 2>/dev/null || echo "unknown")
-    log_info "LocalWP WP-CLI version: $version"
+	if [ ! -d "$LOCAL_APP" ]; then
+		log_error "LocalWP is not installed at $LOCAL_APP"
+		log_info "Download from: https://localwp.com/"
+		exit 1
+	fi
+
+	if [ ! -f "$LOCAL_WP_CLI" ]; then
+		log_error "WP-CLI not found in LocalWP installation"
+		exit 1
+	fi
+
+	local version
+	version=$("$LOCAL_WP_CLI" --version 2>/dev/null || echo "unknown")
+	log_info "LocalWP WP-CLI version: $version"
 }

 # Get site path
 get_site_path() {
-    local site_name="$1"
-    echo "$LOCAL_SITES_DIR/$site_name"
+	local site_name="$1"
+	echo "$LOCAL_SITES_DIR/$site_name"
 }

 # Get WordPress path within site
 get_wp_path() {
-    local site_name="$1"
-    local site_path=$(get_site_path "$site_name")
-    
-    # LocalWP uses app/public for WordPress files
-    echo "$site_path/app/public"
+	local site_name="$1"
+	local site_path
+	site_path=$(get_site_path "$site_name")
+
+	# LocalWP uses app/public for WordPress files
+	echo "$site_path/app/public"
 }

 # Check if site exists
 site_exists() {
-    local site_name="$1"
-    local site_path=$(get_site_path "$site_name")
-    [ -d "$site_path" ]
+	local site_name="$1"
+	local site_path
+	site_path=$(get_site_path "$site_name")
+	[ -d "$site_path" ]
 }

 # Get plugin destination path
 get_plugin_path() {
-    local site_name="$1"
-    local wp_path=$(get_wp_path "$site_name")
-    echo "$wp_path/wp-content/plugins/$PLUGIN_SLUG"
+	local site_name="$1"
+	local wp_path
+	wp_path=$(get_wp_path "$site_name")
+	echo "$wp_path/wp-content/plugins/$PLUGIN_SLUG"
 }

 # Sync plugin files to LocalWP site
 sync_plugin() {
-    local site_name="$1"
-    local plugin_dest=$(get_plugin_path "$site_name")
-    
-    if ! site_exists "$site_name"; then
-        log_error "Site '$site_name' does not exist"
-        return 1
-    fi
-    
-    log_info "Syncing plugin to $site_name..."
-    
-    # Create plugin directory if it doesn't exist
-    mkdir -p "$plugin_dest"
-    
-    # Sync files using rsync (excludes dev files)
-    rsync -av --delete \
-        --exclude 'node_modules' \
-        --exclude 'vendor' \
-        --exclude '.git' \
-        --exclude 'dist' \
-        --exclude 'tests' \
-        --exclude 'cypress' \
-        --exclude '.github' \
-        --exclude '.agents' \
-        --exclude '.wiki' \
-        --exclude 'reference-plugins' \
-        --exclude '*.zip' \
-        --exclude '.playground.*' \
-        --exclude 'composer.lock' \
-        --exclude 'package-lock.json' \
-        "$PROJECT_DIR/" "$plugin_dest/"
-    
-    log_success "Plugin synced to: $plugin_dest"
+	local site_name="$1"
+	local plugin_dest
+	plugin_dest=$(get_plugin_path "$site_name")
+
+	if ! site_exists "$site_name"; then
+		log_error "Site '$site_name' does not exist"
+		return 1
+	fi
+
+	log_info "Syncing plugin to $site_name..."
+
+	# Create plugin directory if it doesn't exist
+	mkdir -p "$plugin_dest"
+
+	# Sync files using rsync (excludes dev files)
+	rsync -av --delete \
+		--exclude 'node_modules' \
+		--exclude 'vendor' \
+		--exclude '.git' \
+		--exclude 'dist' \
+		--exclude 'tests' \
+		--exclude 'cypress' \
+		--exclude '.github' \
+		--exclude '.agents' \
+		--exclude '.wiki' \
+		--exclude 'reference-plugins' \
+		--exclude '*.zip' \
+		--exclude '.playground.*' \
+		--exclude 'composer.lock' \
+		--exclude 'package-lock.json' \
+		"$PROJECT_DIR/" "$plugin_dest/"
+
+	log_success "Plugin synced to: $plugin_dest"
 }

 # Create a new LocalWP site
 create_site() {
-    local multisite=false
-    
-    # Parse arguments
-    while [[ $# -gt 0 ]]; do
-        case "$1" in
-            --multisite)
-                multisite=true
-                shift
-                ;;
-            *)
-                shift
-                ;;
-        esac
-    done
-    
-    local site_name="$SINGLE_SITE_NAME"
-    local domain="$SINGLE_SITE_DOMAIN"
-    local mode="single site"
-    
-    if [ "$multisite" = true ]; then
-        site_name="$MULTISITE_NAME"
-        domain="$MULTISITE_DOMAIN"
-        mode="multisite"
-    fi
-    
-    check_localwp
-    
-    local site_path=$(get_site_path "$site_name")
-    
-    if site_exists "$site_name"; then
-        log_warning "Site '$site_name' already exists at: $site_path"
-        log_info "Use 'npm run localwp:reset' to reset it, or 'npm run localwp:sync' to update files"
-        return 0
-    fi
-    
-    echo ""
-    echo "============================================"
-    echo "  LocalWP Site Setup ($mode)"
-    echo "============================================"
-    echo ""
-    echo "This script will guide you through creating a"
-    echo "LocalWP site for testing the plugin."
-    echo ""
-    echo "Site Details:"
-    echo "  Name:   $site_name"
-    echo "  Domain: $domain"
-    echo "  Path:   $site_path"
-    echo ""
-    
-    log_step "Creating LocalWP Site"
-    echo ""
-    log_info "LocalWP doesn't have a CLI for site creation."
-    log_info "Please create the site manually in LocalWP:"
-    echo ""
-    echo "1. Open LocalWP application"
-    echo "2. Click the '+' button to create a new site"
-    echo "3. Use these settings:"
-    echo "   - Site name: ${CYAN}$site_name${NC}"
-    echo "   - Local site domain: ${CYAN}$domain${NC}"
-    echo "   - PHP version: 8.0 or higher"
-    echo "   - Web server: nginx (preferred)"
-    echo "   - MySQL version: 8.0+"
-    
-    if [ "$multisite" = true ]; then
-        echo ""
-        echo "4. After site creation, convert to multisite:"
-        echo "   - Open Site Shell in LocalWP"
-        echo "   - Run: wp core multisite-convert --subdomains=0"
-        echo "   - Update wp-config.php if needed"
-    fi
-    
-    echo ""
-    log_info "After creating the site, run: npm run localwp:sync"
-    echo ""
-    
-    # Wait for user to create site
-    read -p "Press Enter after you've created the site in LocalWP..."
-    
-    if site_exists "$site_name"; then
-        log_success "Site detected at: $site_path"
-        sync_plugin "$site_name"
-        
-        # Install recommended plugins
-        install_recommended_plugins "$site_name"
-        
-        show_site_info "$site_name" "$domain" "$multisite"
-    else
-        log_warning "Site not found at expected location"
-        log_info "Expected path: $site_path"
-        log_info "You can run 'npm run localwp:sync' later to sync files"
-    fi
+	local multisite=false
+
+	# Parse arguments
+	while [[ $# -gt 0 ]]; do
+		case "$1" in
+		--multisite)
+			multisite=true
+			shift
+			;;
+		*)
+			shift
+			;;
+		esac
+	done
+
+	local site_name="$SINGLE_SITE_NAME"
+	local domain="$SINGLE_SITE_DOMAIN"
+	local mode="single site"
+
+	if [ "$multisite" = true ]; then
+		site_name="$MULTISITE_NAME"
+		domain="$MULTISITE_DOMAIN"
+		mode="multisite"
+	fi
+
+	check_localwp
+
+	local site_path
+	site_path=$(get_site_path "$site_name")
+
+	if site_exists "$site_name"; then
+		log_warning "Site '$site_name' already exists at: $site_path"
+		log_info "Use 'npm run localwp:reset' to reset it, or 'npm run localwp:sync' to update files"
+		return 0
+	fi
+
+	echo ""
+	echo "============================================"
+	echo "  LocalWP Site Setup ($mode)"
+	echo "============================================"
+	echo ""
+	echo "This script will guide you through creating a"
+	echo "LocalWP site for testing the plugin."
+	echo ""
+	echo "Site Details:"
+	echo "  Name:   $site_name"
+	echo "  Domain: $domain"
+	echo "  Path:   $site_path"
+	echo ""
+
+	log_step "Creating LocalWP Site"
+	echo ""
+	log_info "LocalWP doesn't have a CLI for site creation."
+	log_info "Please create the site manually in LocalWP:"
+	echo ""
+	echo "1. Open LocalWP application"
+	echo "2. Click the '+' button to create a new site"
+	echo "3. Use these settings:"
+	echo "   - Site name: ${CYAN}$site_name${NC}"
+	echo "   - Local site domain: ${CYAN}$domain${NC}"
+	echo "   - PHP version: 8.0 or higher"
+	echo "   - Web server: nginx (preferred)"
+	echo "   - MySQL version: 8.0+"
+
+	if [ "$multisite" = true ]; then
+		echo ""
+		echo "4. After site creation, convert to multisite:"
+		echo "   - Open Site Shell in LocalWP"
+		echo "   - Run: wp core multisite-convert --subdomains=0"
+		echo "   - Update wp-config.php if needed"
+	fi
+
+	echo ""
+	log_info "After creating the site, run: npm run localwp:sync"
+	echo ""
+
+	# Wait for user to create site
+	read -r -p "Press Enter after you've created the site in LocalWP..."
+
+	if site_exists "$site_name"; then
+		log_success "Site detected at: $site_path"
+		sync_plugin "$site_name"
+
+		# Install recommended plugins
+		install_recommended_plugins "$site_name"
+
+		show_site_info "$site_name" "$domain" "$multisite"
+	else
+		log_warning "Site not found at expected location"
+		log_info "Expected path: $site_path"
+		log_info "You can run 'npm run localwp:sync' later to sync files"
+	fi
 }

 # Install recommended plugins (matching Playground blueprint)
 install_recommended_plugins() {
-    local site_name="$1"
-    local wp_path=$(get_wp_path "$site_name")
-    
-    log_info "Note: Install these plugins to match Playground environment:"
-    echo "  - Plugin Toggle (plugin-toggle)"
-    echo "  - Kadence Blocks (kadence-blocks)"
-    echo ""
-    log_info "You can install them via LocalWP's WP Admin or Site Shell"
+	local site_name="$1"
+	local wp_path
+	wp_path=$(get_wp_path "$site_name")
+
+	log_info "Note: Install these plugins to match Playground environment:"
+	echo "  - Plugin Toggle (plugin-toggle)"
+	echo "  - Kadence Blocks (kadence-blocks)"
+	echo ""
+	log_info "You can install them via LocalWP's WP Admin or Site Shell"
 }

 # Show site information
 show_site_info() {
-    local site_name="$1"
-    local domain="$2"
-    local multisite="$3"
-    
-    local site_path=$(get_site_path "$site_name")
-    local plugin_path=$(get_plugin_path "$site_name")
-    
-    echo ""
-    echo "============================================"
-    echo "  LocalWP Site Ready"
-    echo "============================================"
-    echo "  Site:        $site_name"
-    echo "  URL:         http://$domain"
-    echo "  Admin:       http://$domain/wp-admin/"
-    echo "  Plugin Path: $plugin_path"
-    echo "============================================"
-    
-    if [ "$multisite" = true ]; then
-        echo "  Network Admin: http://$domain/wp-admin/network/"
-        echo "============================================"
-    fi
-    
-    echo ""
-    log_info "Remember to:"
-    echo "  1. Start the site in LocalWP"
-    echo "  2. Activate the plugin in WordPress admin"
-    echo "  3. Run 'npm run localwp:sync' after making changes"
-    echo ""
+	local site_name="$1"
+	local domain="$2"
+	local multisite="$3"
+
+	local site_path
+	site_path=$(get_site_path "$site_name")
+	local plugin_path
+	plugin_path=$(get_plugin_path "$site_name")
+
+	echo ""
+	echo "============================================"
+	echo "  LocalWP Site Ready"
+	echo "============================================"
+	echo "  Site:        $site_name"
+	echo "  URL:         http://$domain"
+	echo "  Admin:       http://$domain/wp-admin/"
+	echo "  Plugin Path: $plugin_path"
+	echo "============================================"
+
+	if [ "$multisite" = true ]; then
+		echo "  Network Admin: http://$domain/wp-admin/network/"
+		echo "============================================"
+	fi
+
+	echo ""
+	log_info "Remember to:"
+	echo "  1. Start the site in LocalWP"
+	echo "  2. Activate the plugin in WordPress admin"
+	echo "  3. Run 'npm run localwp:sync' after making changes"
+	echo ""
 }

 # Reset site to clean state
 reset_site() {
-    local site_name="${1:-$SINGLE_SITE_NAME}"
-    
-    if ! site_exists "$site_name"; then
-        log_error "Site '$site_name' does not exist"
-        exit 1
-    fi
-    
-    log_warning "This will delete the plugin files and resync them."
-    read -p "Continue? (y/n) " -n 1 -r
-    echo
-    
-    if [[ $REPLY =~ ^[Yy]$ ]]; then
-        local plugin_path=$(get_plugin_path "$site_name")
-        
-        log_info "Removing plugin files..."
-        rm -rf "$plugin_path"
-        
-        log_info "Resyncing plugin..."
-        sync_plugin "$site_name"
-        
-        log_success "Site reset complete"
-    else
-        log_info "Reset cancelled"
-    fi
+	local site_name="${1:-$SINGLE_SITE_NAME}"
+
+	if ! site_exists "$site_name"; then
+		log_error "Site '$site_name' does not exist"
+		exit 1
+	fi
+
+	log_warning "This will delete the plugin files and resync them."
+	read -p "Continue? (y/n) " -n 1 -r
+	echo
+
+	if [[ $REPLY =~ ^[Yy]$ ]]; then
+		local plugin_path
+		plugin_path=$(get_plugin_path "$site_name")
+
+		log_info "Removing plugin files..."
+		rm -rf "$plugin_path"
+
+		log_info "Resyncing plugin..."
+		sync_plugin "$site_name"
+
+		log_success "Site reset complete"
+	else
+		log_info "Reset cancelled"
+	fi
 }

 # Sync all existing sites
 sync_all() {
-    local synced=0
-    
-    for site_name in "$SINGLE_SITE_NAME" "$MULTISITE_NAME"; do
-        if site_exists "$site_name"; then
-            sync_plugin "$site_name"
-            synced=$((synced + 1))
-        fi
-    done
-    
-    if [ $synced -eq 0 ]; then
-        log_warning "No LocalWP sites found for this plugin"
-        log_info "Run 'npm run localwp:create' to create one"
-    else
-        log_success "Synced $synced site(s)"
-    fi
+	local synced=0
+
+	for site_name in "$SINGLE_SITE_NAME" "$MULTISITE_NAME"; do
+		if site_exists "$site_name"; then
+			sync_plugin "$site_name"
+			synced=$((synced + 1))
+		fi
+	done
+
+	if [ $synced -eq 0 ]; then
+		log_warning "No LocalWP sites found for this plugin"
+		log_info "Run 'npm run localwp:create' to create one"
+	else
+		log_success "Synced $synced site(s)"
+	fi
 }

 # Show info about all sites
 show_info() {
-    echo ""
-    echo "LocalWP Sites for $PLUGIN_SLUG"
-    echo "==============================="
-    
-    for site_name in "$SINGLE_SITE_NAME" "$MULTISITE_NAME"; do
-        local site_path=$(get_site_path "$site_name")
-        
-        if site_exists "$site_name"; then
-            echo ""
-            echo "  ${GREEN}✓${NC} $site_name"
-            echo "    Path: $site_path"
-            
-            local plugin_path=$(get_plugin_path "$site_name")
-            if [ -d "$plugin_path" ]; then
-                echo "    Plugin: ${GREEN}Installed${NC}"
-            else
-                echo "    Plugin: ${YELLOW}Not synced${NC}"
-            fi
-        else
-            echo ""
-            echo "  ${YELLOW}○${NC} $site_name (not created)"
-        fi
-    done
-    
-    echo ""
-    echo "Commands:"
-    echo "  npm run localwp:create           Create single site"
-    echo "  npm run localwp:create:multisite Create multisite"
-    echo "  npm run localwp:sync             Sync plugin files"
-    echo "  npm run localwp:reset            Reset plugin files"
-    echo ""
+	echo ""
+	echo "LocalWP Sites for $PLUGIN_SLUG"
+	echo "==============================="
+
+	for site_name in "$SINGLE_SITE_NAME" "$MULTISITE_NAME"; do
+		local site_path
+		site_path=$(get_site_path "$site_name")
+
+		if site_exists "$site_name"; then
+			echo ""
+			echo "  ${GREEN}✓${NC} $site_name"
+			echo "    Path: $site_path"
+
+			local plugin_path
+			plugin_path=$(get_plugin_path "$site_name")
+			if [ -d "$plugin_path" ]; then
+				echo "    Plugin: ${GREEN}Installed${NC}"
+			else
+				echo "    Plugin: ${YELLOW}Not synced${NC}"
+			fi
+		else
+			echo ""
+			echo "  ${YELLOW}○${NC} $site_name (not created)"
+		fi
+	done
+
+	echo ""
+	echo "Commands:"
+	echo "  npm run localwp:create           Create single site"
+	echo "  npm run localwp:create:multisite Create multisite"
+	echo "  npm run localwp:sync             Sync plugin files"
+	echo "  npm run localwp:reset            Reset plugin files"
+	echo ""
 }

 # Main command handler
 case "${1:-}" in
-    create)
-        shift
-        create_site "$@"
-        ;;
-    sync)
-        sync_all
-        ;;
-    reset)
-        shift
-        reset_site "$@"
-        ;;
-    info)
-        show_info
-        ;;
-    *)
-        echo "LocalWP Integration Script"
-        echo ""
-        echo "Usage:"
-        echo "  $0 create [--multisite]   Create a new LocalWP site"
-        echo "  $0 sync                   Sync plugin files to all sites"
-        echo "  $0 reset [site-name]      Reset site plugin to clean state"
-        echo "  $0 info                   Show info about LocalWP sites"
-        echo ""
-        echo "npm scripts:"
-        echo "  npm run localwp:create              Create single site"
-        echo "  npm run localwp:create:multisite    Create multisite"
-        echo "  npm run localwp:sync                Sync plugin files"
-        echo "  npm run localwp:reset               Reset plugin files"
-        echo ""
-        echo "URL Patterns:"
-        echo "  Single site: http://${PLUGIN_SLUG}-single.local"
-        echo "  Multisite:   http://${PLUGIN_SLUG}-multisite.local"
-        echo ""
-        exit 1
-        ;;
+create)
+	shift
+	create_site "$@"
+	;;
+sync)
+	sync_all
+	;;
+reset)
+	shift
+	reset_site "$@"
+	;;
+info)
+	show_info
+	;;
+*)
+	echo "LocalWP Integration Script"
+	echo ""
+	echo "Usage:"
+	echo "  $0 create [--multisite]   Create a new LocalWP site"
+	echo "  $0 sync                   Sync plugin files to all sites"
+	echo "  $0 reset [site-name]      Reset site plugin to clean state"
+	echo "  $0 info                   Show info about LocalWP sites"
+	echo ""
+	echo "npm scripts:"
+	echo "  npm run localwp:create              Create single site"
+	echo "  npm run localwp:create:multisite    Create multisite"
+	echo "  npm run localwp:sync                Sync plugin files"
+	echo "  npm run localwp:reset               Reset plugin files"
+	echo ""
+	echo "URL Patterns:"
+	echo "  Single site: http://${PLUGIN_SLUG}-single.local"
+	echo "  Multisite:   http://${PLUGIN_SLUG}-multisite.local"
+	echo ""
+	exit 1
+	;;
 esac
--- a/bin/setup-test-env.sh
+++ b/bin/setup-test-env.sh
@@ -1,126 +1,139 @@
 #!/bin/bash

-# Make this script executable
-chmod +x "$0"
-
 # Check if environment type is provided
 if [ -z "$1" ]; then
-    echo "Usage: $0 [single|multisite|playground-single|playground-multisite]"
-    exit 1
+	echo "Usage: $0 [single|multisite|playground-single|playground-multisite]"
+	exit 1
 fi

 ENV_TYPE=$1

 # Function to check if a command exists
 command_exists() {
-    command -v "$1" &> /dev/null
+	command -v "$1" &>/dev/null
+	return $?
 }

+# PID of the background Python HTTP server (set when started).
+PYTHON_PID=""
+
+# Function to clean up resources on exit.
+cleanup() {
+	if [ -n "$PYTHON_PID" ]; then
+		echo "Stopping Python HTTP server (PID: $PYTHON_PID)..."
+		kill "$PYTHON_PID" 2>/dev/null || true
+	fi
+	return 0
+}
+
+# Trap EXIT, INT, and TERM so the server is always stopped on script exit.
+trap cleanup EXIT INT TERM
+
 # Function to install wp-env if needed
 install_wp_env() {
-    if ! command_exists wp-env; then
-        echo "wp-env is not installed. Installing..."
-        npm install -g @wordpress/env
-    fi
+	if ! command_exists wp-env; then
+		echo "wp-env is not installed. Installing..."
+		npm install -g @wordpress/env
+	fi
 }

 # Function to install wp-playground if needed
 install_wp_playground() {
-    # Check if we have a local installation
-    if [ ! -d "node_modules/@wp-playground" ]; then
-        echo "WordPress Playground is not installed locally. Installing..."
-        npm install --save-dev @wp-playground/client @wp-playground/blueprints
-    fi
+	# Check if we have a local installation
+	if [ ! -d "node_modules/@wp-playground" ]; then
+		echo "WordPress Playground is not installed locally. Installing..."
+		npm install --save-dev @wp-playground/client @wp-playground/blueprints
+	fi
 }

-if [ "$ENV_TYPE" == "single" ]; then
-    echo "Setting up single site environment..."
+if [ "$ENV_TYPE" = "single" ]; then
+	echo "Setting up single site environment..."

-    # Install wp-env if needed
-    install_wp_env
+	# Install wp-env if needed
+	install_wp_env

-    # Start the environment
-    wp-env start
+	# Start the environment
+	wp-env start

-    # Wait for WordPress to be ready with a timeout
-    MAX_ATTEMPTS=30
-    ATTEMPT=0
-    echo "Waiting for WordPress to be ready..."
-    until wp-env run cli wp core is-installed || [ $ATTEMPT -ge $MAX_ATTEMPTS ]; do
-        ATTEMPT=$((ATTEMPT+1))
-        echo "Attempt $ATTEMPT/$MAX_ATTEMPTS..."
-        sleep 2
-    done
+	# Wait for WordPress to be ready with a timeout
+	MAX_ATTEMPTS=30
+	ATTEMPT=0
+	echo "Waiting for WordPress to be ready..."
+	until wp-env run cli wp core is-installed || [ $ATTEMPT -ge $MAX_ATTEMPTS ]; do
+		ATTEMPT=$((ATTEMPT + 1))
+		echo "Attempt $ATTEMPT/$MAX_ATTEMPTS..."
+		sleep 2
+	done

-    if [ $ATTEMPT -ge $MAX_ATTEMPTS ]; then
-        echo "Timed out waiting for WordPress to be ready."
-        exit 1
-    fi
+	if [ $ATTEMPT -ge $MAX_ATTEMPTS ]; then
+		echo "Timed out waiting for WordPress to be ready."
+		exit 1
+	fi

-    # Activate our plugin
-    if ! wp-env run cli wp plugin activate wp-plugin-starter-template-for-ai-coding; then
-        echo "Failed to activate plugin. Exiting."
-        exit 1
-    fi
+	# Activate our plugin
+	if ! wp-env run cli wp plugin activate wp-plugin-starter-template-for-ai-coding; then
+		echo "Failed to activate plugin. Exiting."
+		exit 1
+	fi

-    echo "WordPress Single Site environment is ready!"
-    echo "Site: http://localhost:8888"
-    echo "Admin login: admin / password"
+	echo "WordPress Single Site environment is ready!"
+	echo "Site: http://localhost:8888"
+	echo "Admin login: admin / password"

-elif [ "$ENV_TYPE" == "multisite" ]; then
-    echo "Setting up multisite environment..."
+elif [ "$ENV_TYPE" = "multisite" ]; then
+	echo "Setting up multisite environment..."

-    # Install wp-env if needed
-    install_wp_env
+	# Install wp-env if needed
+	install_wp_env

-    # Start the environment with multisite configuration
-    wp-env start --config=.wp-env.multisite.json
+	# Start the environment with multisite configuration
+	wp-env start --config=.wp-env.multisite.json

-    # Wait for WordPress to be ready with a timeout
-    MAX_ATTEMPTS=30
-    ATTEMPT=0
-    echo "Waiting for WordPress to be ready..."
-    until wp-env run cli wp core is-installed || [ $ATTEMPT -ge $MAX_ATTEMPTS ]; do
-        ATTEMPT=$((ATTEMPT+1))
-        echo "Attempt $ATTEMPT/$MAX_ATTEMPTS..."
-        sleep 2
-    done
+	# Wait for WordPress to be ready with a timeout
+	MAX_ATTEMPTS=30
+	ATTEMPT=0
+	echo "Waiting for WordPress to be ready..."
+	until wp-env run cli wp core is-installed || [ $ATTEMPT -ge $MAX_ATTEMPTS ]; do
+		ATTEMPT=$((ATTEMPT + 1))
+		echo "Attempt $ATTEMPT/$MAX_ATTEMPTS..."
+		sleep 2
+	done

-    if [ $ATTEMPT -ge $MAX_ATTEMPTS ]; then
-        echo "Timed out waiting for WordPress to be ready."
-        exit 1
-    fi
+	if [ $ATTEMPT -ge $MAX_ATTEMPTS ]; then
+		echo "Timed out waiting for WordPress to be ready."
+		exit 1
+	fi

-    # Create a test site
-    if ! wp-env run cli wp site create --slug=testsite --title="Test Site" --email=admin@example.com; then
-        echo "Failed to create test site. Exiting."
-        exit 1
-    fi
+	# Create a test site
+	if ! wp-env run cli wp site create --slug=testsite --title="Test Site" --email=admin@example.com; then
+		echo "Failed to create test site. Exiting."
+		exit 1
+	fi

-    # Network activate our plugin
-    if ! wp-env run cli wp plugin activate wp-plugin-starter-template-for-ai-coding --network; then
-        echo "Failed to activate plugin. Exiting."
-        exit 1
-    fi
+	# Network activate our plugin
+	if ! wp-env run cli wp plugin activate wp-plugin-starter-template-for-ai-coding --network; then
+		echo "Failed to activate plugin. Exiting."
+		exit 1
+	fi

-    echo "WordPress Multisite environment is ready!"
-    echo "Main site: http://localhost:8888"
-    echo "Test site: http://localhost:8888/testsite"
-    echo "Admin login: admin / password"
+	echo "WordPress Multisite environment is ready!"
+	echo "Main site: http://localhost:8888"
+	echo "Test site: http://localhost:8888/testsite"
+	echo "Admin login: admin / password"

-elif [ "$ENV_TYPE" == "playground-single" ]; then
-    echo "Setting up WordPress Playground single site environment..."
+elif [ "$ENV_TYPE" = "playground-single" ]; then
+	echo "Setting up WordPress Playground single site environment..."

-    # Install wp-playground if needed
-    install_wp_playground
+	# Install wp-playground if needed
+	install_wp_playground

-    # Create plugin zip
-    echo "Creating plugin zip..."
-    mkdir -p dist
-    zip -r dist/plugin.zip . -x "node_modules/*" "dist/*" ".git/*"
+	# Create plugin zip
+	echo "Creating plugin zip..."
+	mkdir -p dist
+	zip -r dist/plugin.zip . -x "node_modules/*" "dist/*" ".git/*"

-    # Update blueprint to use local plugin
-    cat > playground/blueprint.json << EOF
+	# Update blueprint to use local plugin
+	cat >playground/blueprint.json <<EOF
 {
  "landingPage": "/wp-admin/",
  "preferredVersions": {
@@ -148,46 +161,49 @@ elif [ "$ENV_TYPE" == "playground-single" ]; then
 }
 EOF

-    # Start WordPress Playground
-    echo "Starting WordPress Playground..."
-    if command_exists python3; then
-        python3 -m http.server 8888 --directory playground &
-        echo "Opening WordPress Playground in your browser..."
-        if command_exists open; then
-            open http://localhost:8888/index.html
-        elif command_exists xdg-open; then
-            xdg-open http://localhost:8888/index.html
-        elif command_exists start; then
-            start http://localhost:8888/index.html
-        else
-            echo "Please open http://localhost:8888/index.html in your browser"
-        fi
-    else
-        echo "Python3 is not installed. Please open playground/index.html in your browser."
-    fi
+	# Start WordPress Playground
+	echo "Starting WordPress Playground..."
+	if command_exists python3; then
+		python3 -m http.server 8888 --directory playground &
+		PYTHON_PID=$!
+		echo "Started Python HTTP server with PID: $PYTHON_PID"
+		echo "Opening WordPress Playground in your browser..."
+		if command_exists open; then
+			open http://localhost:8888/index.html
+		elif command_exists xdg-open; then
+			xdg-open http://localhost:8888/index.html
+		elif command_exists start; then
+			start http://localhost:8888/index.html
+		else
+			echo "Please open http://localhost:8888/index.html in your browser"
+		fi
+	else
+		echo "Python3 is not installed. Please open playground/index.html in your browser."
+	fi

-    # Wait for WordPress Playground to be ready
-    echo "Waiting for WordPress Playground to be ready..."
-    sleep 5
+	# Wait for WordPress Playground to be ready
+	echo "Waiting for WordPress Playground to be ready..."
+	sleep 5

-    echo "WordPress Playground Single Site environment is ready!"
-    echo "Site: http://localhost:8888"
-    echo "Admin login: admin / password"
-    echo "Press Ctrl+C to stop the server when done."
+	echo "WordPress Playground Single Site environment is ready!"
+	echo "Site: http://localhost:8888"
+	echo "Admin login: admin / password"
+	echo "Press Ctrl+C to stop the server when done."

-elif [ "$ENV_TYPE" == "playground-multisite" ]; then
-    echo "Setting up WordPress Playground multisite environment..."
+elif [ "$ENV_TYPE" = "playground-multisite" ]; then
+	echo "Setting up WordPress Playground multisite environment..."

-    # Install wp-playground if needed
-    install_wp_playground
+	# Install wp-playground if needed
+	install_wp_playground

-    # Create plugin zip
-    echo "Creating plugin zip..."
-    mkdir -p dist
-    zip -r dist/plugin.zip . -x "node_modules/*" "dist/*" ".git/*"
+	# Create plugin zip
+	echo "Creating plugin zip..."
+	mkdir -p dist
+	zip -r dist/plugin.zip . -x "node_modules/*" "dist/*" ".git/*"

-    # Update blueprint to use local plugin
-    cat > playground/multisite-blueprint.json << EOF
+	# Update blueprint to use local plugin
+	# shellcheck disable=SC2154
+	cat >playground/multisite-blueprint.json <<EOF
 {
  "landingPage": "/wp-admin/network/",
  "preferredVersions": {
@@ -255,35 +271,37 @@ elif [ "$ENV_TYPE" == "playground-multisite" ]; then
 }
 EOF

-    # Start WordPress Playground
-    echo "Starting WordPress Playground..."
-    if command_exists python3; then
-        python3 -m http.server 8888 --directory playground &
-        echo "Opening WordPress Playground in your browser..."
-        if command_exists open; then
-            open http://localhost:8888/multisite.html
-        elif command_exists xdg-open; then
-            xdg-open http://localhost:8888/multisite.html
-        elif command_exists start; then
-            start http://localhost:8888/multisite.html
-        else
-            echo "Please open http://localhost:8888/multisite.html in your browser"
-        fi
-    else
-        echo "Python3 is not installed. Please open playground/multisite.html in your browser."
-    fi
+	# Start WordPress Playground
+	echo "Starting WordPress Playground..."
+	if command_exists python3; then
+		python3 -m http.server 8888 --directory playground &
+		PYTHON_PID=$!
+		echo "Started Python HTTP server with PID: $PYTHON_PID"
+		echo "Opening WordPress Playground in your browser..."
+		if command_exists open; then
+			open http://localhost:8888/multisite.html
+		elif command_exists xdg-open; then
+			xdg-open http://localhost:8888/multisite.html
+		elif command_exists start; then
+			start http://localhost:8888/multisite.html
+		else
+			echo "Please open http://localhost:8888/multisite.html in your browser"
+		fi
+	else
+		echo "Python3 is not installed. Please open playground/multisite.html in your browser."
+	fi

-    # Wait for WordPress Playground to be ready
-    echo "Waiting for WordPress Playground to be ready..."
-    sleep 5
+	# Wait for WordPress Playground to be ready
+	echo "Waiting for WordPress Playground to be ready..."
+	sleep 5

-    echo "WordPress Playground Multisite environment is ready!"
-    echo "Main site: http://localhost:8888"
-    echo "Test site: http://localhost:8888/testsite"
-    echo "Admin login: admin / password"
-    echo "Press Ctrl+C to stop the server when done."
+	echo "WordPress Playground Multisite environment is ready!"
+	echo "Main site: http://localhost:8888"
+	echo "Test site: http://localhost:8888/testsite"
+	echo "Admin login: admin / password"
+	echo "Press Ctrl+C to stop the server when done."

 else
-    echo "Invalid environment type. Use 'single', 'multisite', 'playground-single', or 'playground-multisite'."
-    exit 1
+	echo "Invalid environment type. Use 'single', 'multisite', 'playground-single', or 'playground-multisite'."
+	exit 1
 fi
--- a/build.sh
+++ b/build.sh
@@ -46,9 +46,9 @@ cp -R README.md LICENSE CHANGELOG.md readme.txt composer.json "$BUILD_DIR/"
 # Copy directories
 echo "Copying directories..."
 mkdir -p "$BUILD_DIR/admin" "$BUILD_DIR/includes" "$BUILD_DIR/languages" "$BUILD_DIR/assets"
-cp -R admin/* "$BUILD_DIR/admin/"
-cp -R includes/* "$BUILD_DIR/includes/"
-cp -R languages/* "$BUILD_DIR/languages/"
+cp -R ./admin/* "$BUILD_DIR/admin/"
+cp -R ./includes/* "$BUILD_DIR/includes/"
+cp -R ./languages/* "$BUILD_DIR/languages/"

 # Create assets directory structure
 mkdir -p "$BUILD_DIR/assets/banner" "$BUILD_DIR/assets/icon" "$BUILD_DIR/assets/screenshots"
@@ -71,11 +71,12 @@ if [ -d "vendor" ]; then
 	cp -R vendor "$BUILD_DIR/"
 fi

-# Create ZIP file
+# Create ZIP file.
 echo "Creating ZIP file..."
-cd build || exit 1
-zip -r "../$ZIP_FILE" "$PLUGIN_SLUG" -x "*.DS_Store" -x "*.git*" -x "*.github*"
-cd ..
+(
+	cd build || exit 1
+	zip -r "../$ZIP_FILE" "$PLUGIN_SLUG" -x "*.DS_Store" -x "*.git*" -x "*.github*"
+)

 # Check if ZIP file was created successfully
 if [ -f "$ZIP_FILE" ]; then
@@ -83,11 +84,10 @@ if [ -f "$ZIP_FILE" ]; then
 	echo "File path: $(pwd)/$ZIP_FILE"

 	# Deploy to local WordPress installation if environment variable is set
-	if [ -n "$WP_LOCAL_PLUGIN_DIR" ]; then
+	if [ -n "${WP_LOCAL_PLUGIN_DIR:-}" ]; then
 		printf '\nDeploying to local WordPress installation...\n'
-		echo "Deploying to local WordPress installation..."

-		# Remove existing plugin directory
+		# Remove existing plugin directory.
 		rm -rf "${WP_LOCAL_PLUGIN_DIR:?}/$PLUGIN_SLUG"

 		# Copy files to local WordPress installation
--- a/cypress.config.js
+++ b/cypress.config.js
@@ -12,6 +12,6 @@ module.exports = defineConfig({
    },
    // Add configuration for WordPress Playground
    experimentalWebKitSupport: true,
-    chromeWebSecurity: false
-  }
+    chromeWebSecurity: false,
+  },
 });
--- a/cypress/e2e/playground-single-site.cy.js
+++ b/cypress/e2e/playground-single-site.cy.js
@@ -1,5 +1,10 @@
 /* eslint-env mocha, jquery, cypress */
-describe('WordPress Playground Single Site Tests', () => {
+describe('WordPress Playground Single Site Tests', {
+  retries: {
+    runMode: 2,
+    openMode: 0,
+  },
+}, () => {
  beforeEach(() => {
    cy.visit('/', { timeout: 30000 });
  });
@@ -18,22 +23,22 @@ describe('WordPress Playground Single Site Tests', () => {
    cy.visit('/wp-admin/plugins.php', { timeout: 30000 });

    cy.get('body', { timeout: 15000 }).then(($body) => {
-      // Verify the starter template plugin exists and is activated.
-      if ($body.find('tr[data-slug="wp-plugin-starter-template-for-ai-coding"]').length) {
-        cy.get('tr[data-slug="wp-plugin-starter-template-for-ai-coding"]').should('exist');
-        cy.get('tr[data-slug="wp-plugin-starter-template-for-ai-coding"] .deactivate a').should('exist');
-      } else {
-        cy.log('Starter template plugin not found by slug, skipping check');
-      }
+      const hasPluginToggle = $body.text().includes('Plugin Toggle');
+      const hasKadenceBlocks = $body.text().includes('Kadence Blocks');

-      if ($body.text().includes('Plugin Toggle')) {
+      expect(
+        hasPluginToggle || hasKadenceBlocks,
+        'At least one blueprint plugin should be present in the plugins table',
+      ).to.be.true;
+
+      if (hasPluginToggle) {
        cy.contains('tr', 'Plugin Toggle').should('exist');
        cy.contains('tr', 'Plugin Toggle').find('.deactivate').should('exist');
      } else {
        cy.log('Plugin Toggle not found, skipping check');
      }

-      if ($body.text().includes('Kadence Blocks')) {
+      if (hasKadenceBlocks) {
        cy.contains('tr', 'Kadence Blocks').find('.deactivate').should('exist');
      } else {
        cy.log('Kadence Blocks plugin not found, skipping check');
--- a/package-lock.json
+++ b/package-lock.json
--- a/package.json
+++ b/package.json
@@ -28,7 +28,7 @@
    "test:phpunit": "composer test",
    "test:phpunit:multisite": "WP_MULTISITE=1 composer test",
    "build": "./build.sh",
-    "lint:js": "eslint cypress/",
+    "lint:js": "eslint cypress/ cypress.config.js",
    "lint:css": "stylelint \"**/*.css\" --allow-empty-input",
    "lint:php": "composer run-script phpcs",
    "lint:php:simple": "composer run-script phpcs:simple",
@@ -37,9 +37,10 @@
    "fix:php": "composer run-script phpcbf",
    "fix:php:simple": "composer run-script phpcbf:simple",
    "test:php": "composer run-script test",
-    "lint": "composer run-script lint",
+    "lint:php-all": "composer run-script lint",
+    "lint": "npm run lint:php-all && npm run lint:js && npm run lint:css",
    "fix": "composer run-script fix",
-    "quality": "npm run lint && npm run lint:css && npm run test:php"
+    "quality": "npm run lint && npm run test:php"
  },
  "repository": {
    "type": "git",
@@ -61,11 +62,11 @@
  "devDependencies": {
    "@wordpress/env": "^8.12.0",
    "@wp-playground/blueprints": "^3.0.22",
-    "@wp-playground/client": "^3.0.22",
    "@wp-playground/cli": "^3.0.22",
+    "@wp-playground/client": "^3.0.22",
    "cypress": "^13.17.0",
    "eslint": "^8.57.0",
-    "eslint-plugin-cypress": "^2.15.1",
+    "eslint-plugin-cypress": "^6.2.0",
    "stylelint": "^16.0.0",
    "stylelint-config-standard": "^36.0.0"
  }
--- a/phpcs-simple.xml
+++ b/phpcs-simple.xml
@@ -14,7 +14,7 @@
    <exclude-pattern>*/build/*</exclude-pattern>
    <exclude-pattern>*/dist/*</exclude-pattern>

-    <!-- Command line arguments -->
+    <!-- Command line arguments: combined short flags (-s shows sniff codes, -p shows progress) -->
    <arg value="sp"/>
    <arg name="extensions" value="php"/>
    <arg name="basepath" value="."/>
--- a/playground/index.html
+++ b/playground/index.html
@@ -21,6 +21,6 @@
    </style>
 </head>
 <body>
-    <iframe src="https://playground.wordpress.net/?blueprint-url=https://raw.githubusercontent.com/wpallstars/wp-plugin-starter-template-for-ai-coding/main/playground/blueprint.json&_t=2" title="WordPress Playground Single Site Environment"></iframe>
+    <iframe src="https://playground.wordpress.net/?blueprint-url=https://raw.githubusercontent.com/wpallstars/wp-plugin-starter-template-for-ai-coding/main/playground/blueprint.json" title="WordPress Playground Single Site Environment"></iframe>
 </body>
 </html>
--- a/readme.txt
+++ b/readme.txt
@@ -150,7 +150,7 @@ When you receive feedback from these code quality tools, you can use AI assistan

 1. Copy the output from the code quality tool
 2. Paste it into your AI assistant chat
-3. Ask the AI to help you understand and resolve the issues
+3. Request the AI's assistance to interpret and resolve the reported issues
 4. Apply the suggested fixes
 5. Commit the changes and verify that the issues are resolved
Author	SHA1	Message	Date
marcusquinn	29622dd54c	fix: move sync-wiki.yml secrets to env block to resolve SonarCloud S7636 Move github.actor, secrets.GITHUB_TOKEN, and github.repository from inline run block string interpolation to step-level env: block. References via env vars prevent secret expansion in workflow logs. Resolves the remaining S7636 hotspot in sync-wiki.yml. Closes #106	2026-03-20 07:10:45 +00:00
Marcus Quinn	1afa6b71d7	fix: streamline npm lint and quality scripts (issue #109 ) (#116 ) Rename 'lint' to 'lint:php-all' for clarity, make 'lint' run all linters (PHP, JS, CSS), and simplify 'quality' to avoid duplication. Addresses gemini review feedback from PR #103.	2026-03-19 23:20:17 +00:00
Marcus Quinn	8bb4784204	fix: relax PHPCS grep boundary to match plural summaries (issue #110 ) (#115 )	2026-03-19 22:40:02 +00:00
Marcus Quinn	b223165012	fix: align multisite activation phrasing in Playground docs (issue #111 ) (#114 ) * fix: align multisite activation phrasing in Playground docs (issue #111) * fix: align single-site playground activation assertion with blueprint plugins * fix: add retries for flaky playground single-site startup	2026-03-19 22:29:00 +00:00
Marcus Quinn	4228bcc330	fix: simplify responsive breakpoint comment in admin-styles.css (issue #93 ) (#105 ) * fix: remove redundant Responsive Styles comment in admin-styles.css (issue #93) Removes the generic '/* Responsive Styles /' comment that was redundant alongside the specific '/ 782px is the WordPress mobile admin breakpoint. /' comment, per Gemini Code Assist review feedback on PR #87. Closes #93 fix: add missing trailing commas to fix comma-dangle lint errors Fixes ESLint comma-dangle errors in: - cypress.config.js (lines 15-16): missing trailing commas on chromeWebSecurity property and closing e2e object brace - cypress/e2e/playground-single-site.cy.js (line 23): missing trailing comma on expect() message argument Also updates eslint-plugin-cypress from ^2.15.1 to ^6.2.0 to resolve peer dependency conflict that prevented local lint verification.	2026-03-18 22:57:17 +00:00
Marcus Quinn	7bac0dc63d	t096: fix unconditional plugin activation assertion in cypress test (#101 ) * fix: make plugin activation assertion unconditional in cypress test Addresses Gemini Code Assist review feedback on PR #84 (issue #96). The 'Plugin is activated' test was using an if/else guard that caused it to silently pass when the plugin row was missing. Replaced with a direct unconditional cy.get() + cy.within() assertion so the test fails clearly if the plugin is not found. Optional plugin checks (Plugin Toggle, Kadence Blocks) retain their conditional logic as those are genuinely optional in the test env. Closes #96 * fix: reduce duplicated Cypress assertion for SonarCloud * fix: lower Sonar new-code duplication in playground test	2026-03-18 21:38:00 +00:00
Marcus Quinn	7c272b5399	t095: fix package.json lint coverage and quality gate (#103 ) * fix: address PR #85 package.json review feedback (issue #95) * fix: add trailing commas to cypress.config.js for comma-dangle rule ESLint comma-dangle rule (always-multiline) requires trailing commas on the last property and closing brace of multiline objects. Adding lint:js coverage of cypress.config.js in package.json exposed these two missing trailing commas at lines 15 and 16. * fix: resolve ESLint errors blocking CI on PR #103 - Remove 'cypress/globals' env key from .eslintrc.js; this key requires eslint-plugin-cypress to be globally installed, which CI tools (Codacy, CodeFactor) do not have. Cypress globals are already declared explicitly in the globals block, making the env key redundant. - Remove trailing commas from cypress.config.js to comply with the comma-dangle: never ESLint rule defined in .eslintrc.js. - Update package-lock.json to include stylelint and stylelint-config-standard which were in devDependencies but missing from the lock file.	2026-03-18 21:33:54 +00:00
Marcus Quinn	81e5b14604	fix: consolidate duplicate deployment echo into single printf in build.sh (#99 ) Addresses Gemini review feedback from PR #80 (build.sh:88): replaces the redundant pair of printf+echo deployment messages with a single printf call, which is more concise and idiomatic for formatted shell output. Closes #97	2026-03-18 21:27:26 +00:00
Marcus Quinn	9dca8880cc	fix: use word boundaries in grep patterns to prevent false positives (#100 ) Address PR #86 review feedback from Gemini: - Line 145: replace 'grep -i error\|fail\|exception' with grep -E -i '\b(error\|fail\|exception)' - Line 224: replace 'grep -i ERROR\|WARNING' with grep -E -i '\b(ERROR\|WARNING)\b' Using \b word boundaries prevents substring matches (e.g. 'exception' in 'unexceptional') and removes the unnecessary cat pipe (UUOC). Closes #94	2026-03-18 21:27:22 +00:00
Marcus Quinn	ad03358e2a	fix: address PR #81 review feedback in Playground-Testing.md (issue #98 ) (#102 )	2026-03-18 21:27:12 +00:00
Marcus Quinn	7d0ee0adea	fix: resolve ShellCheck violations in shell scripts (#91 ) - SC2155 (bin/localwp-setup.sh): declare local variables separately from command substitution assignments to avoid masking return values (13 fixes) - SC2034 (bin/localwp-setup.sh): remove unused PLUGIN_TEXT_DOMAIN variable - SC2162 (bin/localwp-setup.sh): add -r flag to read to avoid backslash mangling - SC2154 (bin/setup-test-env.sh): add shellcheck disable for PHP variables in heredoc that ShellCheck incorrectly identifies as unassigned shell variables - bin/setup-test-env.sh: remove self-modifying chmod +x $0 (unnecessary and bad practice; file permissions should be set once in version control) - bin/setup-test-env.sh: change == to = in POSIX [ ] test expressions - build.sh: add ./ prefix to directory glob copies for clarity - build.sh: use subshell (cd build \|\| exit 1; zip ...) instead of bare cd/cd.. to avoid SC2103 and ensure working directory is always restored Fixes part of #20 (shell script quality issues)	2026-03-18 11:47:38 +00:00
Marcus Quinn	9fdfa7a8a9	fix: pin all GitHub Actions to full commit SHAs (resolves SonarCloud S7637) (#90 ) Pin all floating version tags (@v1, @v2, @v3, @v4, @master) to full commit SHAs across all workflow files to eliminate supply chain security risk. Actions pinned: - actions/checkout@v3 -> f43a0e5 (v3.6.0) in release.yml, sync-wiki.yml - actions/checkout@v4 -> 34e1148 (v4) in tests.yml - shivammathur/setup-php@v2 -> accd612 (v2) in all workflows - actions/setup-node@v4 -> 49933ea (v4) in playground-tests.yml, wordpress-tests.yml - actions/upload-artifact@v4 -> ea165f8 (v4) in playground-tests.yml, wordpress-tests.yml - softprops/action-gh-release@v1 -> de2c0eb (v1) in release.yml - codacy/codacy-analysis-cli-action@v4 -> 562ee3e (v4) in code-quality.yml - github/codeql-action/upload-sarif@v3 -> 603b797 (v3) in code-quality.yml - swissspidy/wp-performance-action@v2.0.3 -> b7e3ffc (v2.0.3) in playground-tests.yml - SonarSource/sonarqube-scan-action@master -> 9598b8a in sonarcloud.yml Closes #89	2026-03-18 04:58:57 +00:00
Marcus Quinn	d6dcda908c	fix: change comma-dangle rule to always-multiline per review feedback (#88 ) Addresses Gemini review feedback from PR #66 (issue #73). Changes 'comma-dangle' from 'never' to 'always-multiline' to improve maintainability — cleaner git diffs and easier line reordering. Updates admin/js files to comply with the new rule. Closes #73	2026-03-17 21:00:19 +00:00
Marcus Quinn	7640f01d0c	quality-debt: document 782px WordPress mobile admin breakpoint (#87 ) * fix: document 782px WordPress mobile admin breakpoint in media query Adds an inline comment explaining that 782px is the WordPress mobile admin breakpoint (wp-admin responsive threshold), addressing the maintainability feedback from Gemini in PR #68. Closes #69 * fix: add empty line before CSS comment to satisfy comment-empty-line-before rule CodeFactor flagged missing empty line before the breakpoint comment (comment-empty-line-before). Also simplifies comment text per Gemini Code Assist suggestion (removes redundant parenthetical). Fixes CodeFactor FAILURE and Codacy ACTION_REQUIRED on PR #87.	2026-03-17 20:50:19 +00:00
Marcus Quinn	632dda5952	fix: address PR #65 review feedback on error-checking-feedback-loops.md (#86 ) - Fix yaml code block to bash at line 80 (shell command, not YAML) - Remove useless cat pipe: use grep directly on test-output.log - Remove useless cat pipe: use grep directly on phpcs-output.log Closes #71	2026-03-17 20:45:53 +00:00
Marcus Quinn	8fda3f1163	fix: add lint:js to quality script (#85 ) Include JavaScript linting in the quality gate alongside PHP and CSS linting, as suggested in PR #55 review feedback (Gemini, medium). Closes #77	2026-03-17 20:37:05 +00:00
Marcus Quinn	79f78882a6	fix: remove redundant existence check, use cy.within() for scoped selector (#84 ) Addresses Gemini review feedback on PR #50 line 23: the .should('exist') check was redundant since the if-condition already confirms element presence. Refactored to use cy.within() to scope the .deactivate a check, eliminating selector repetition and improving readability. Closes #79	2026-03-17 20:29:00 +00:00
Marcus Quinn	e1ee99ac9c	fix: validate type parameter against allow-list in showMessage (#83 ) Adds allow-list validation for the 'type' parameter in showMessage() to prevent class injection vulnerabilities. The type is now checked against ['success', 'error'] before being passed to addClass(), with a safe fallback to 'error' for any unexpected values. Addresses review feedback from PR #47 (gemini-code-assist finding). Closes #76	2026-03-17 19:33:04 +00:00
Marcus Quinn	6300f1c545	fix: remove duplicate deployment echo in build.sh (#80 ) * fix: remove duplicate deployment echo in build.sh Remove duplicate 'Deploying to local WordPress installation...' message. Replace printf with echo "" for blank line separator to avoid \n rendering issues without -e flag. Closes #70 * fix: use ${WP_LOCAL_PLUGIN_DIR:-} for bash nounset safety in build.sh Addresses CodeRabbit Major review feedback on PR #80. Direct dereference of $WP_LOCAL_PLUGIN_DIR under set -u causes the script to exit when the variable is unset, even though local deployment is optional. Using ${WP_LOCAL_PLUGIN_DIR:-} safely handles the unset case without triggering nounset.	2026-03-17 19:33:00 +00:00
Marcus Quinn	c3738a3106	fix: remove stale /tmp/wordpress-develop before git clone (#82 ) Prevents git clone failure on re-runs when the destination directory already exists from a previous test suite installation. Closes #74	2026-03-17 19:26:41 +00:00
Marcus Quinn	e5d2994e40	docs: mention both WP-CLI network activation commands in Playground-Testing.md (#81 ) Address review feedback from PR #63 (gemini-code-assist): document both `wp plugin activate --network` (for installed plugins) and `wp plugin install --activate-network` (to install and activate in one step). Closes #72	2026-03-17 19:22:48 +00:00
marcusquinn	7eb7aedc39	chore: add .superset/ to .gitignore (local tool config)	2026-03-17 03:52:37 +00:00
Marcus Quinn	9cddf28c09	fix: use standard max-width media query syntax in admin-styles.css (issue #43 ) (#68 ) Replace invalid CSS media-feature range notation with universally-supported traditional syntax for better browser compatibility. - admin/css/admin-styles.css:127: (width <= 782px) → (max-width: 782px)	2026-03-17 01:17:05 +00:00
Marcus Quinn	a1e5b166ff	fix: address PR #10 CodeRabbit review feedback (issue #45 ) (#51 ) * fix: address PR #10 CodeRabbit review feedback - Fix SC2115 shellcheck warning in build.sh (use ${var:?} for safe rm -rf) - Fix SC2164 shellcheck warning in build.sh (cd build \|\| exit 1) - Standardise bullet points from hyphens to asterisks in .wiki/Contributing.md - Refine verb formality in readme.txt, README.md, .wiki/Contributing.md, .wiki/Coding-Standards.md - Clarify PHPDoc wording in .wiki/Coding-Standards.md - Add clarifying comment to phpcs-simple.xml arg value * fix: re-enable PHPUnit test step in tests.yml Tests were commented out in PR #10. PHPUnit test files exist in tests/phpunit/ and phpunit.xml is configured. Re-enabling the step so tests actually run in CI. Closes #45 * fix: remove redundant composer require steps in code-quality workflow szepeviktor/phpstan-wordpress, wp-coding-standards/wpcs, and dealerdirect/phpcodesniffer-composer-installer are already declared in composer.json require-dev. The extra 'composer require' steps after 'composer install' caused a second packagist.org network hit that timed out in CI, failing the PHPStan Static Analysis job. Fixes the Code Quality CI failure on PR #51 (issue #45).	2026-03-17 00:04:23 +00:00
Marcus Quinn	79829ddce0	fix: address PR #15 review feedback for error-checking-feedback-loops.md (issue #24 ) (#65 ) - Add blank lines around all fenced code blocks (MD031) - Add language specifiers to all bare fenced code blocks (MD040) - Rename duplicate 'Processing Steps' heading to 'SonarCloud Processing Steps' (MD024) Closes #24	2026-03-16 23:57:57 +00:00
Marcus Quinn	ef43525c4a	docs: fix inaccuracies in Playground-Testing.md (issue #27 ) (#63 ) - Correct blueprint description: single-site does not enable multisite; both blueprints activate Plugin Toggle and Kadence Blocks - Fix incorrect WP-CLI flag: --activate-network → --network - Update multisite blueprint description to name both network-activated plugins	2026-03-16 23:42:34 +00:00
Marcus Quinn	708acc39de	fix: add comma-dangle rule to .eslintrc.js to prevent trailing commas (issue #25 ) (#66 ) Add 'comma-dangle': ['error', 'never'] rule to .eslintrc.js to enforce no trailing commas in JavaScript files. This addresses the Codacy review findings from PR #15 that flagged trailing commas in object and array literals as ErrorProne issues. The rule ensures ESLint catches trailing commas automatically going forward. Closes #25	2026-03-16 23:41:05 +00:00
Marcus Quinn	40f6f596fa	fix: resolve ESLint sourceType mismatch for cypress.config.js (issue #31 ) (#64 ) Add overrides block in .eslintrc.js to parse cypress.config.js as CommonJS (sourceType: 'script') rather than ESM. The global sourceType: 'module' caused ESLint to flag require() as undefined, since require is not available in ESM scope. The project has no 'type: module' in package.json, so CommonJS is correct. Closes #31	2026-03-16 23:40:05 +00:00
Marcus Quinn	0b17fe8ad9	fix: remove stale cache-busting parameter from playground/index.html blueprint URL (#67 ) The CodeRabbit review of PR #15 flagged that playground/index.html had an iframe src pointing to the feature/testing-framework branch. That URL fix was applied in commit `f48276c` (updating to main branch). This commit also removes the stale cache-busting `_t=2` query parameter that was added during development. The blueprint URL now references the canonical main branch path without any ephemeral query parameters. Closes #36	2026-03-16 23:39:31 +00:00
Marcus Quinn	a8f968562c	fix: add graceful termination for Python HTTP server in playground modes (#62 ) Adds PYTHON_PID variable and cleanup() function with EXIT/INT/TERM trap to ensure the background Python HTTP server is always stopped when the script exits, whether normally or due to an unexpected interruption. Applies to both playground-single and playground-multisite branches. Closes #30	2026-03-16 23:08:34 +00:00