fix: resolve ShellCheck violations in shell scripts (#91)

- SC2155 (bin/localwp-setup.sh): declare local variables separately from
  command substitution assignments to avoid masking return values (13 fixes)
- SC2034 (bin/localwp-setup.sh): remove unused PLUGIN_TEXT_DOMAIN variable
- SC2162 (bin/localwp-setup.sh): add -r flag to read to avoid backslash mangling
- SC2154 (bin/setup-test-env.sh): add shellcheck disable for PHP variables in
  heredoc that ShellCheck incorrectly identifies as unassigned shell variables
- bin/setup-test-env.sh: remove self-modifying chmod +x $0 (unnecessary and
  bad practice; file permissions should be set once in version control)
- bin/setup-test-env.sh: change == to = in POSIX [ ] test expressions
- build.sh: add ./ prefix to directory glob copies for clarity
- build.sh: use subshell (cd build || exit 1; zip ...) instead of bare cd/cd..
  to avoid SC2103 and ensure working directory is always restored

Fixes part of #20 (shell script quality issues)

.agents/error-checking-feedback-loops.md

@@ -77,7 +77,7 @@ uses: actions/upload-artifact@v4
 
 **Solution**: Use port 80 for multisite environments:
 
-```yaml
+```bash
 npx @wp-playground/cli server --blueprint playground/multisite-blueprint.json --port 80 --login &
 ```
 
@@ -142,7 +142,7 @@ npm run test:playground:multisite
 2. **Analyze Output for Errors**:
 
    ```bash
-   cat test-output.log | grep -i 'error\|fail\|exception'
+   grep -i 'error\|fail\|exception' test-output.log
    ```
 
 3. **Parse Structured Test Results** (if available):
@@ -221,7 +221,7 @@ npm run lint:css
 2. **Analyze Output for Errors**:
 
    ```bash
-   cat phpcs-output.log | grep -i 'ERROR\|WARNING'
+   grep -i 'ERROR\|WARNING' phpcs-output.log
    ```
 
 3. **Automatically Fix Issues** (when possible):

.eslintrc.js

@@ -16,7 +16,7 @@ module.exports = {
     sourceType: 'module'
   },
   rules: {
-    'comma-dangle': ['error', 'never'],
+    'comma-dangle': ['error', 'always-multiline'],
     'no-console': 'warn',
     'no-unused-vars': 'warn'
   },

.github/workflows/code-quality.yml

@@ -20,7 +20,7 @@ jobs:
           clean: 'true'
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
         with:
           php-version: '8.1'
           extensions: mbstring, intl, zip
@@ -47,7 +47,7 @@ jobs:
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
         with:
           php-version: '8.1'
           extensions: mbstring, intl, zip
@@ -68,7 +68,7 @@ jobs:
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
         with:
           php-version: '8.1'
           extensions: mbstring, intl, zip
@@ -119,7 +119,7 @@ jobs:
   #
   #     - name: SonarCloud Scan
   #       if: steps.check_sonar_token.outputs.skip != 'true'
-  #       uses: SonarSource/sonarqube-scan-action@master
+  #       uses: SonarSource/sonarqube-scan-action@9598b8a83feef37de07f549027fab50ecffe6a6e # master
   #       env:
   #         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   #         SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
@@ -152,7 +152,7 @@ jobs:
           fi
 
       - name: Run Codacy Analysis CLI
-        uses: codacy/codacy-analysis-cli-action@v4
+        uses: codacy/codacy-analysis-cli-action@562ee3e92b8e92df8b67e0a5ff8aa8e261919c08 # v4
         with:
           project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
           verbose: true
@@ -167,7 +167,7 @@ jobs:
 
       - name: Upload SARIF results file
         if: steps.check_codacy_token.outputs.skip_upload != 'true'
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@603b797f8b14b413fe025cd935a91c16c4782713 # v3
         with:
           sarif_file: results.sarif
         continue-on-error: true

.github/workflows/phpunit.yml

@@ -42,7 +42,7 @@ jobs:
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
         with:
           php-version: ${{ matrix.php }}
           extensions: dom, curl, libxml, mbstring, zip, pdo, mysql, pdo_mysql, bcmath, soap, intl, gd, exif, iconv

.github/workflows/playground-tests-fix.yml

@@ -36,7 +36,7 @@ jobs:
     - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
     - name: Setup Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
       with:
         node-version: '20'
         cache: 'npm'
@@ -98,7 +98,7 @@ jobs:
 
     - name: Upload Cypress artifacts
       if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: cypress-playground-results
         path: |

.github/workflows/playground-tests.yml

@@ -40,7 +40,7 @@ jobs:
     - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
     - name: Setup Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
       with:
         node-version: ${{ matrix.node-version }}
         cache: 'npm'
@@ -67,7 +67,7 @@ jobs:
     - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
     - name: Setup Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
       with:
         node-version: '20'
         cache: 'npm'
@@ -142,7 +142,7 @@ jobs:
 
     - name: Upload Cypress artifacts
       if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: cypress-single-site-results
         path: |
@@ -163,7 +163,7 @@ jobs:
     - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
     - name: Setup Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
       with:
         node-version: '20'
         cache: 'npm'
@@ -239,7 +239,7 @@ jobs:
 
     - name: Upload Cypress artifacts
       if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: cypress-multisite-results
         path: |
@@ -261,7 +261,7 @@ jobs:
     - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
     - name: WordPress Performance Tests
-      uses: swissspidy/wp-performance-action@v2.0.3
+      uses: swissspidy/wp-performance-action@b7e3ffcf0fc4a48b62492e021e0ebeb51430ff11 # v2.0.3
       with:
         plugins: |
           ./

.github/workflows/release.yml

@@ -14,10 +14,10 @@ jobs:
       contents: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
         with:
           php-version: '7.4'
           extensions: mbstring, intl, zip
@@ -62,7 +62,7 @@ jobs:
 
       - name: Create Release
         id: create_release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
         with:
           files: wp-plugin-starter-template-for-ai-coding-${{ env.VERSION }}.zip
           name: v${{ env.VERSION }} - WordPress Plugin Starter Template

.github/workflows/sonarcloud.yml

@@ -49,7 +49,7 @@ jobs:
 
       - name: SonarCloud Scan
         if: steps.check_token.outputs.skip != 'true'
-        uses: SonarSource/sonarqube-scan-action@master
+        uses: SonarSource/sonarqube-scan-action@9598b8a83feef37de07f549027fab50ecffe6a6e # master
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONARCLOUD_GITHUB }}

.github/workflows/sync-wiki.yml

@@ -15,7 +15,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
 
       - name: Configure Git
         run: |

.github/workflows/tests.yml

@@ -17,12 +17,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           clean: 'true'
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
         with:
           php-version: ${{ matrix.php-versions }}
           extensions: mbstring, intl, zip
@@ -43,12 +43,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           clean: 'true'
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
         with:
           php-version: '7.4'
           extensions: mbstring, intl, zip

.github/workflows/wordpress-tests.yml

@@ -37,7 +37,7 @@ jobs:
     - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
     - name: Setup Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
       with:
         node-version: ${{ matrix.node-version }}
         cache: 'npm'
@@ -73,7 +73,7 @@ jobs:
     - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
     - name: Setup Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
       with:
         node-version: '20'
         cache: 'npm'
@@ -124,7 +124,7 @@ jobs:
 
     - name: Upload Cypress artifacts
       if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: cypress-results
         path: |

.wiki/Playground-Testing.md

@@ -102,7 +102,7 @@ In a WordPress multisite environment, there are two ways to activate plugins:
 1. **Network Activation**: Activates a plugin for all sites in the network
    * In the WordPress admin, go to Network Admin > Plugins
    * Click "Network Activate" under the plugin
-   * Or use WP-CLI: `wp plugin activate plugin-name --network`
+   * Or use WP-CLI: `wp plugin activate plugin-name --network` (for installed plugins), or `wp plugin install plugin-name --activate-network` (to install and activate)
 
 2. **Per-Site Activation**: Activates a plugin for a specific site
    * In the WordPress admin, go to the specific site's admin area

admin/css/admin-styles.css

@@ -124,6 +124,8 @@
 }
 
 /* Responsive Styles */
+
+/* 782px is the WordPress mobile admin breakpoint. */
 @media screen and (max-width: 782px) {
     .wpst-form-table th {
         width: 100%;

admin/js/admin-scripts.js

@@ -78,7 +78,7 @@
           data: {
             action: 'wpst_save_settings',
             nonce: wpstData.nonce,
-            formData: formData
+            formData: formData,
           },
           success: function (response) {
             if (response.success) {
@@ -93,8 +93,8 @@
           complete: function () {
             // Re-enable submit button and remove loading state.
             $submitButton.prop( 'disabled', false ).removeClass( 'loading' );
-          }
-        }
+          },
+        },
       );
     },
 
@@ -123,19 +123,19 @@
             300,
             function () {
               $( this ).remove();
-            }
+            },
           );
         },
-        5000
+        5000,
       );
-    }
+    },
   };
 
   // Initialize when document is ready.
   $( document ).ready(
     function () {
       WPSTAdmin.init();
-    }
+    },
   );
 
 })( jQuery );

admin/js/update-source-selector.js

@@ -48,7 +48,7 @@
           if ($( e.target ).hasClass( 'wpst-modal' )) {
             WPSTUpdateSourceSelector.closeModal();
           }
-        }
+        },
       );
 
       // Select source option.
@@ -116,7 +116,7 @@
           data: {
             action: 'wpst_set_update_source', // AJAX action hook.
             nonce: wpstModalData.nonce, // Security nonce.
-            source: this.selectedSource
+            source: this.selectedSource,
           },
           success: function (response) {
             if (response.success) {
@@ -127,7 +127,7 @@
                 function () {
                   WPSTUpdateSourceSelector.closeModal();
                 },
-                1500
+                1500,
               );
             } else {
               WPSTUpdateSourceSelector.showMessage( 'error', response.data.message );
@@ -139,40 +139,44 @@
           complete: function () {
             // Reset button state.
             $saveButton.prop( 'disabled', false ).text( wpstModalData.i18n.confirm );
-          }
-        }
+          },
+        },
       );
     },
 
     /**
 		 * Show a message in the modal
 		 *
-		 * @param {string} type Message type (success, error)
+		 * @param {string} type    Message type (success, error)
 		 * @param {string} message Message text
 		 */
     showMessage: function (type, message) {
       const $message = this.$modal.find( '.wpst-modal-message' );
 
-      // Set message as plain text to prevent XSS, then apply type class.
-      $message.text( message ).removeClass( 'success error' ).addClass( type ).show();
+      // Validate type against allow-list to prevent class injection vulnerabilities.
+      const allowedTypes = [ 'success', 'error' ];
+      const safeType = allowedTypes.includes( type ) ? type : 'error';
+
+      // Set message as plain text to prevent XSS, then apply validated type class.
+      $message.text( message ).removeClass( 'success error' ).addClass( safeType ).show();
 
       // Hide message after a delay for success messages.
-      if (type === 'success') {
+      if (safeType === 'success') {
         setTimeout(
           function () {
             $message.fadeOut( 300 );
           },
-          3000
+          3000,
         );
       }
-    }
+    },
   };
 
   // Initialize when document is ready.
   $( document ).ready(
     function () {
       WPSTUpdateSourceSelector.init();
-    }
+    },
   );
 
 })( jQuery );

bin/install-wp-tests.sh

@@ -117,6 +117,7 @@ install_test_suite() {
 	# set up testing suite if it doesn't yet exist
 	if [ ! -d "$WP_TESTS_DIR" ]; then
 		mkdir -p "$WP_TESTS_DIR"
+		rm -rf /tmp/wordpress-develop
 		if ! git clone --quiet --depth=1 --branch "$GIT_REF" https://github.com/WordPress/wordpress-develop.git /tmp/wordpress-develop; then
 			echo "Error: Failed to clone wordpress-develop at branch/tag $GIT_REF" >&2
 			exit 1

bin/localwp-setup.sh

@@ -28,7 +28,6 @@ set -e
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_DIR="$(dirname "$SCRIPT_DIR")"
 PLUGIN_SLUG="wp-plugin-starter-template"
-PLUGIN_TEXT_DOMAIN="wp-plugin-starter-template"
 
 # LocalWP paths (macOS)
 LOCAL_SITES_DIR="$HOME/Local Sites"
@@ -51,363 +50,375 @@ NC='\033[0m' # No Color
 
 # Helper functions
 log_info() {
-    echo -e "${BLUE}[INFO]${NC} $1"
+	echo -e "${BLUE}[INFO]${NC} $1"
 }
 
 log_success() {
-    echo -e "${GREEN}[SUCCESS]${NC} $1"
+	echo -e "${GREEN}[SUCCESS]${NC} $1"
 }
 
 log_warning() {
-    echo -e "${YELLOW}[WARNING]${NC} $1"
+	echo -e "${YELLOW}[WARNING]${NC} $1"
 }
 
 log_error() {
-    echo -e "${RED}[ERROR]${NC} $1"
+	echo -e "${RED}[ERROR]${NC} $1"
 }
 
 log_step() {
-    echo -e "${CYAN}[STEP]${NC} $1"
+	echo -e "${CYAN}[STEP]${NC} $1"
 }
 
 # Check if LocalWP is installed
 check_localwp() {
-    if [ ! -d "$LOCAL_APP" ]; then
-        log_error "LocalWP is not installed at $LOCAL_APP"
-        log_info "Download from: https://localwp.com/"
-        exit 1
-    fi
-    
-    if [ ! -f "$LOCAL_WP_CLI" ]; then
-        log_error "WP-CLI not found in LocalWP installation"
-        exit 1
-    fi
-    
-    local version=$("$LOCAL_WP_CLI" --version 2>/dev/null || echo "unknown")
-    log_info "LocalWP WP-CLI version: $version"
+	if [ ! -d "$LOCAL_APP" ]; then
+		log_error "LocalWP is not installed at $LOCAL_APP"
+		log_info "Download from: https://localwp.com/"
+		exit 1
+	fi
+
+	if [ ! -f "$LOCAL_WP_CLI" ]; then
+		log_error "WP-CLI not found in LocalWP installation"
+		exit 1
+	fi
+
+	local version
+	version=$("$LOCAL_WP_CLI" --version 2>/dev/null || echo "unknown")
+	log_info "LocalWP WP-CLI version: $version"
 }
 
 # Get site path
 get_site_path() {
-    local site_name="$1"
-    echo "$LOCAL_SITES_DIR/$site_name"
+	local site_name="$1"
+	echo "$LOCAL_SITES_DIR/$site_name"
 }
 
 # Get WordPress path within site
 get_wp_path() {
-    local site_name="$1"
-    local site_path=$(get_site_path "$site_name")
-    
-    # LocalWP uses app/public for WordPress files
-    echo "$site_path/app/public"
+	local site_name="$1"
+	local site_path
+	site_path=$(get_site_path "$site_name")
+
+	# LocalWP uses app/public for WordPress files
+	echo "$site_path/app/public"
 }
 
 # Check if site exists
 site_exists() {
-    local site_name="$1"
-    local site_path=$(get_site_path "$site_name")
-    [ -d "$site_path" ]
+	local site_name="$1"
+	local site_path
+	site_path=$(get_site_path "$site_name")
+	[ -d "$site_path" ]
 }
 
 # Get plugin destination path
 get_plugin_path() {
-    local site_name="$1"
-    local wp_path=$(get_wp_path "$site_name")
-    echo "$wp_path/wp-content/plugins/$PLUGIN_SLUG"
+	local site_name="$1"
+	local wp_path
+	wp_path=$(get_wp_path "$site_name")
+	echo "$wp_path/wp-content/plugins/$PLUGIN_SLUG"
 }
 
 # Sync plugin files to LocalWP site
 sync_plugin() {
-    local site_name="$1"
-    local plugin_dest=$(get_plugin_path "$site_name")
-    
-    if ! site_exists "$site_name"; then
-        log_error "Site '$site_name' does not exist"
-        return 1
-    fi
-    
-    log_info "Syncing plugin to $site_name..."
-    
-    # Create plugin directory if it doesn't exist
-    mkdir -p "$plugin_dest"
-    
-    # Sync files using rsync (excludes dev files)
-    rsync -av --delete \
-        --exclude 'node_modules' \
-        --exclude 'vendor' \
-        --exclude '.git' \
-        --exclude 'dist' \
-        --exclude 'tests' \
-        --exclude 'cypress' \
-        --exclude '.github' \
-        --exclude '.agents' \
-        --exclude '.wiki' \
-        --exclude 'reference-plugins' \
-        --exclude '*.zip' \
-        --exclude '.playground.*' \
-        --exclude 'composer.lock' \
-        --exclude 'package-lock.json' \
-        "$PROJECT_DIR/" "$plugin_dest/"
-    
-    log_success "Plugin synced to: $plugin_dest"
+	local site_name="$1"
+	local plugin_dest
+	plugin_dest=$(get_plugin_path "$site_name")
+
+	if ! site_exists "$site_name"; then
+		log_error "Site '$site_name' does not exist"
+		return 1
+	fi
+
+	log_info "Syncing plugin to $site_name..."
+
+	# Create plugin directory if it doesn't exist
+	mkdir -p "$plugin_dest"
+
+	# Sync files using rsync (excludes dev files)
+	rsync -av --delete \
+		--exclude 'node_modules' \
+		--exclude 'vendor' \
+		--exclude '.git' \
+		--exclude 'dist' \
+		--exclude 'tests' \
+		--exclude 'cypress' \
+		--exclude '.github' \
+		--exclude '.agents' \
+		--exclude '.wiki' \
+		--exclude 'reference-plugins' \
+		--exclude '*.zip' \
+		--exclude '.playground.*' \
+		--exclude 'composer.lock' \
+		--exclude 'package-lock.json' \
+		"$PROJECT_DIR/" "$plugin_dest/"
+
+	log_success "Plugin synced to: $plugin_dest"
 }
 
 # Create a new LocalWP site
 create_site() {
-    local multisite=false
-    
-    # Parse arguments
-    while [[ $# -gt 0 ]]; do
-        case "$1" in
-            --multisite)
-                multisite=true
-                shift
-                ;;
-            *)
-                shift
-                ;;
-        esac
-    done
-    
-    local site_name="$SINGLE_SITE_NAME"
-    local domain="$SINGLE_SITE_DOMAIN"
-    local mode="single site"
-    
-    if [ "$multisite" = true ]; then
-        site_name="$MULTISITE_NAME"
-        domain="$MULTISITE_DOMAIN"
-        mode="multisite"
-    fi
-    
-    check_localwp
-    
-    local site_path=$(get_site_path "$site_name")
-    
-    if site_exists "$site_name"; then
-        log_warning "Site '$site_name' already exists at: $site_path"
-        log_info "Use 'npm run localwp:reset' to reset it, or 'npm run localwp:sync' to update files"
-        return 0
-    fi
-    
-    echo ""
-    echo "============================================"
-    echo "  LocalWP Site Setup ($mode)"
-    echo "============================================"
-    echo ""
-    echo "This script will guide you through creating a"
-    echo "LocalWP site for testing the plugin."
-    echo ""
-    echo "Site Details:"
-    echo "  Name:   $site_name"
-    echo "  Domain: $domain"
-    echo "  Path:   $site_path"
-    echo ""
-    
-    log_step "Creating LocalWP Site"
-    echo ""
-    log_info "LocalWP doesn't have a CLI for site creation."
-    log_info "Please create the site manually in LocalWP:"
-    echo ""
-    echo "1. Open LocalWP application"
-    echo "2. Click the '+' button to create a new site"
-    echo "3. Use these settings:"
-    echo "   - Site name: ${CYAN}$site_name${NC}"
-    echo "   - Local site domain: ${CYAN}$domain${NC}"
-    echo "   - PHP version: 8.0 or higher"
-    echo "   - Web server: nginx (preferred)"
-    echo "   - MySQL version: 8.0+"
-    
-    if [ "$multisite" = true ]; then
-        echo ""
-        echo "4. After site creation, convert to multisite:"
-        echo "   - Open Site Shell in LocalWP"
-        echo "   - Run: wp core multisite-convert --subdomains=0"
-        echo "   - Update wp-config.php if needed"
-    fi
-    
-    echo ""
-    log_info "After creating the site, run: npm run localwp:sync"
-    echo ""
-    
-    # Wait for user to create site
-    read -p "Press Enter after you've created the site in LocalWP..."
-    
-    if site_exists "$site_name"; then
-        log_success "Site detected at: $site_path"
-        sync_plugin "$site_name"
-        
-        # Install recommended plugins
-        install_recommended_plugins "$site_name"
-        
-        show_site_info "$site_name" "$domain" "$multisite"
-    else
-        log_warning "Site not found at expected location"
-        log_info "Expected path: $site_path"
-        log_info "You can run 'npm run localwp:sync' later to sync files"
-    fi
+	local multisite=false
+
+	# Parse arguments
+	while [[ $# -gt 0 ]]; do
+		case "$1" in
+		--multisite)
+			multisite=true
+			shift
+			;;
+		*)
+			shift
+			;;
+		esac
+	done
+
+	local site_name="$SINGLE_SITE_NAME"
+	local domain="$SINGLE_SITE_DOMAIN"
+	local mode="single site"
+
+	if [ "$multisite" = true ]; then
+		site_name="$MULTISITE_NAME"
+		domain="$MULTISITE_DOMAIN"
+		mode="multisite"
+	fi
+
+	check_localwp
+
+	local site_path
+	site_path=$(get_site_path "$site_name")
+
+	if site_exists "$site_name"; then
+		log_warning "Site '$site_name' already exists at: $site_path"
+		log_info "Use 'npm run localwp:reset' to reset it, or 'npm run localwp:sync' to update files"
+		return 0
+	fi
+
+	echo ""
+	echo "============================================"
+	echo "  LocalWP Site Setup ($mode)"
+	echo "============================================"
+	echo ""
+	echo "This script will guide you through creating a"
+	echo "LocalWP site for testing the plugin."
+	echo ""
+	echo "Site Details:"
+	echo "  Name:   $site_name"
+	echo "  Domain: $domain"
+	echo "  Path:   $site_path"
+	echo ""
+
+	log_step "Creating LocalWP Site"
+	echo ""
+	log_info "LocalWP doesn't have a CLI for site creation."
+	log_info "Please create the site manually in LocalWP:"
+	echo ""
+	echo "1. Open LocalWP application"
+	echo "2. Click the '+' button to create a new site"
+	echo "3. Use these settings:"
+	echo "   - Site name: ${CYAN}$site_name${NC}"
+	echo "   - Local site domain: ${CYAN}$domain${NC}"
+	echo "   - PHP version: 8.0 or higher"
+	echo "   - Web server: nginx (preferred)"
+	echo "   - MySQL version: 8.0+"
+
+	if [ "$multisite" = true ]; then
+		echo ""
+		echo "4. After site creation, convert to multisite:"
+		echo "   - Open Site Shell in LocalWP"
+		echo "   - Run: wp core multisite-convert --subdomains=0"
+		echo "   - Update wp-config.php if needed"
+	fi
+
+	echo ""
+	log_info "After creating the site, run: npm run localwp:sync"
+	echo ""
+
+	# Wait for user to create site
+	read -r -p "Press Enter after you've created the site in LocalWP..."
+
+	if site_exists "$site_name"; then
+		log_success "Site detected at: $site_path"
+		sync_plugin "$site_name"
+
+		# Install recommended plugins
+		install_recommended_plugins "$site_name"
+
+		show_site_info "$site_name" "$domain" "$multisite"
+	else
+		log_warning "Site not found at expected location"
+		log_info "Expected path: $site_path"
+		log_info "You can run 'npm run localwp:sync' later to sync files"
+	fi
 }
 
 # Install recommended plugins (matching Playground blueprint)
 install_recommended_plugins() {
-    local site_name="$1"
-    local wp_path=$(get_wp_path "$site_name")
-    
-    log_info "Note: Install these plugins to match Playground environment:"
-    echo "  - Plugin Toggle (plugin-toggle)"
-    echo "  - Kadence Blocks (kadence-blocks)"
-    echo ""
-    log_info "You can install them via LocalWP's WP Admin or Site Shell"
+	local site_name="$1"
+	local wp_path
+	wp_path=$(get_wp_path "$site_name")
+
+	log_info "Note: Install these plugins to match Playground environment:"
+	echo "  - Plugin Toggle (plugin-toggle)"
+	echo "  - Kadence Blocks (kadence-blocks)"
+	echo ""
+	log_info "You can install them via LocalWP's WP Admin or Site Shell"
 }
 
 # Show site information
 show_site_info() {
-    local site_name="$1"
-    local domain="$2"
-    local multisite="$3"
-    
-    local site_path=$(get_site_path "$site_name")
-    local plugin_path=$(get_plugin_path "$site_name")
-    
-    echo ""
-    echo "============================================"
-    echo "  LocalWP Site Ready"
-    echo "============================================"
-    echo "  Site:        $site_name"
-    echo "  URL:         http://$domain"
-    echo "  Admin:       http://$domain/wp-admin/"
-    echo "  Plugin Path: $plugin_path"
-    echo "============================================"
-    
-    if [ "$multisite" = true ]; then
-        echo "  Network Admin: http://$domain/wp-admin/network/"
-        echo "============================================"
-    fi
-    
-    echo ""
-    log_info "Remember to:"
-    echo "  1. Start the site in LocalWP"
-    echo "  2. Activate the plugin in WordPress admin"
-    echo "  3. Run 'npm run localwp:sync' after making changes"
-    echo ""
+	local site_name="$1"
+	local domain="$2"
+	local multisite="$3"
+
+	local site_path
+	site_path=$(get_site_path "$site_name")
+	local plugin_path
+	plugin_path=$(get_plugin_path "$site_name")
+
+	echo ""
+	echo "============================================"
+	echo "  LocalWP Site Ready"
+	echo "============================================"
+	echo "  Site:        $site_name"
+	echo "  URL:         http://$domain"
+	echo "  Admin:       http://$domain/wp-admin/"
+	echo "  Plugin Path: $plugin_path"
+	echo "============================================"
+
+	if [ "$multisite" = true ]; then
+		echo "  Network Admin: http://$domain/wp-admin/network/"
+		echo "============================================"
+	fi
+
+	echo ""
+	log_info "Remember to:"
+	echo "  1. Start the site in LocalWP"
+	echo "  2. Activate the plugin in WordPress admin"
+	echo "  3. Run 'npm run localwp:sync' after making changes"
+	echo ""
 }
 
 # Reset site to clean state
 reset_site() {
-    local site_name="${1:-$SINGLE_SITE_NAME}"
-    
-    if ! site_exists "$site_name"; then
-        log_error "Site '$site_name' does not exist"
-        exit 1
-    fi
-    
-    log_warning "This will delete the plugin files and resync them."
-    read -p "Continue? (y/n) " -n 1 -r
-    echo
-    
-    if [[ $REPLY =~ ^[Yy]$ ]]; then
-        local plugin_path=$(get_plugin_path "$site_name")
-        
-        log_info "Removing plugin files..."
-        rm -rf "$plugin_path"
-        
-        log_info "Resyncing plugin..."
-        sync_plugin "$site_name"
-        
-        log_success "Site reset complete"
-    else
-        log_info "Reset cancelled"
-    fi
+	local site_name="${1:-$SINGLE_SITE_NAME}"
+
+	if ! site_exists "$site_name"; then
+		log_error "Site '$site_name' does not exist"
+		exit 1
+	fi
+
+	log_warning "This will delete the plugin files and resync them."
+	read -p "Continue? (y/n) " -n 1 -r
+	echo
+
+	if [[ $REPLY =~ ^[Yy]$ ]]; then
+		local plugin_path
+		plugin_path=$(get_plugin_path "$site_name")
+
+		log_info "Removing plugin files..."
+		rm -rf "$plugin_path"
+
+		log_info "Resyncing plugin..."
+		sync_plugin "$site_name"
+
+		log_success "Site reset complete"
+	else
+		log_info "Reset cancelled"
+	fi
 }
 
 # Sync all existing sites
 sync_all() {
-    local synced=0
-    
-    for site_name in "$SINGLE_SITE_NAME" "$MULTISITE_NAME"; do
-        if site_exists "$site_name"; then
-            sync_plugin "$site_name"
-            synced=$((synced + 1))
-        fi
-    done
-    
-    if [ $synced -eq 0 ]; then
-        log_warning "No LocalWP sites found for this plugin"
-        log_info "Run 'npm run localwp:create' to create one"
-    else
-        log_success "Synced $synced site(s)"
-    fi
+	local synced=0
+
+	for site_name in "$SINGLE_SITE_NAME" "$MULTISITE_NAME"; do
+		if site_exists "$site_name"; then
+			sync_plugin "$site_name"
+			synced=$((synced + 1))
+		fi
+	done
+
+	if [ $synced -eq 0 ]; then
+		log_warning "No LocalWP sites found for this plugin"
+		log_info "Run 'npm run localwp:create' to create one"
+	else
+		log_success "Synced $synced site(s)"
+	fi
 }
 
 # Show info about all sites
 show_info() {
-    echo ""
-    echo "LocalWP Sites for $PLUGIN_SLUG"
-    echo "==============================="
-    
-    for site_name in "$SINGLE_SITE_NAME" "$MULTISITE_NAME"; do
-        local site_path=$(get_site_path "$site_name")
-        
-        if site_exists "$site_name"; then
-            echo ""
-            echo "  ${GREEN}✓${NC} $site_name"
-            echo "    Path: $site_path"
-            
-            local plugin_path=$(get_plugin_path "$site_name")
-            if [ -d "$plugin_path" ]; then
-                echo "    Plugin: ${GREEN}Installed${NC}"
-            else
-                echo "    Plugin: ${YELLOW}Not synced${NC}"
-            fi
-        else
-            echo ""
-            echo "  ${YELLOW}○${NC} $site_name (not created)"
-        fi
-    done
-    
-    echo ""
-    echo "Commands:"
-    echo "  npm run localwp:create           Create single site"
-    echo "  npm run localwp:create:multisite Create multisite"
-    echo "  npm run localwp:sync             Sync plugin files"
-    echo "  npm run localwp:reset            Reset plugin files"
-    echo ""
+	echo ""
+	echo "LocalWP Sites for $PLUGIN_SLUG"
+	echo "==============================="
+
+	for site_name in "$SINGLE_SITE_NAME" "$MULTISITE_NAME"; do
+		local site_path
+		site_path=$(get_site_path "$site_name")
+
+		if site_exists "$site_name"; then
+			echo ""
+			echo "  ${GREEN}✓${NC} $site_name"
+			echo "    Path: $site_path"
+
+			local plugin_path
+			plugin_path=$(get_plugin_path "$site_name")
+			if [ -d "$plugin_path" ]; then
+				echo "    Plugin: ${GREEN}Installed${NC}"
+			else
+				echo "    Plugin: ${YELLOW}Not synced${NC}"
+			fi
+		else
+			echo ""
+			echo "  ${YELLOW}○${NC} $site_name (not created)"
+		fi
+	done
+
+	echo ""
+	echo "Commands:"
+	echo "  npm run localwp:create           Create single site"
+	echo "  npm run localwp:create:multisite Create multisite"
+	echo "  npm run localwp:sync             Sync plugin files"
+	echo "  npm run localwp:reset            Reset plugin files"
+	echo ""
 }
 
 # Main command handler
 case "${1:-}" in
-    create)
-        shift
-        create_site "$@"
-        ;;
-    sync)
-        sync_all
-        ;;
-    reset)
-        shift
-        reset_site "$@"
-        ;;
-    info)
-        show_info
-        ;;
-    *)
-        echo "LocalWP Integration Script"
-        echo ""
-        echo "Usage:"
-        echo "  $0 create [--multisite]   Create a new LocalWP site"
-        echo "  $0 sync                   Sync plugin files to all sites"
-        echo "  $0 reset [site-name]      Reset site plugin to clean state"
-        echo "  $0 info                   Show info about LocalWP sites"
-        echo ""
-        echo "npm scripts:"
-        echo "  npm run localwp:create              Create single site"
-        echo "  npm run localwp:create:multisite    Create multisite"
-        echo "  npm run localwp:sync                Sync plugin files"
-        echo "  npm run localwp:reset               Reset plugin files"
-        echo ""
-        echo "URL Patterns:"
-        echo "  Single site: http://${PLUGIN_SLUG}-single.local"
-        echo "  Multisite:   http://${PLUGIN_SLUG}-multisite.local"
-        echo ""
-        exit 1
-        ;;
+create)
+	shift
+	create_site "$@"
+	;;
+sync)
+	sync_all
+	;;
+reset)
+	shift
+	reset_site "$@"
+	;;
+info)
+	show_info
+	;;
+*)
+	echo "LocalWP Integration Script"
+	echo ""
+	echo "Usage:"
+	echo "  $0 create [--multisite]   Create a new LocalWP site"
+	echo "  $0 sync                   Sync plugin files to all sites"
+	echo "  $0 reset [site-name]      Reset site plugin to clean state"
+	echo "  $0 info                   Show info about LocalWP sites"
+	echo ""
+	echo "npm scripts:"
+	echo "  npm run localwp:create              Create single site"
+	echo "  npm run localwp:create:multisite    Create multisite"
+	echo "  npm run localwp:sync                Sync plugin files"
+	echo "  npm run localwp:reset               Reset plugin files"
+	echo ""
+	echo "URL Patterns:"
+	echo "  Single site: http://${PLUGIN_SLUG}-single.local"
+	echo "  Multisite:   http://${PLUGIN_SLUG}-multisite.local"
+	echo ""
+	exit 1
+	;;
 esac

bin/setup-test-env.sh

@@ -1,8 +1,5 @@
 #!/bin/bash
 
-# Make this script executable
-chmod +x "$0"
-
 # Check if environment type is provided
 if [ -z "$1" ]; then
 	echo "Usage: $0 [single|multisite|playground-single|playground-multisite]"
@@ -49,7 +46,7 @@ install_wp_playground() {
 	fi
 }
 
-if [ "$ENV_TYPE" == "single" ]; then
+if [ "$ENV_TYPE" = "single" ]; then
 	echo "Setting up single site environment..."
 
 	# Install wp-env if needed
@@ -83,7 +80,7 @@ if [ "$ENV_TYPE" == "single" ]; then
 	echo "Site: http://localhost:8888"
 	echo "Admin login: admin / password"
 
-elif [ "$ENV_TYPE" == "multisite" ]; then
+elif [ "$ENV_TYPE" = "multisite" ]; then
 	echo "Setting up multisite environment..."
 
 	# Install wp-env if needed
@@ -124,7 +121,7 @@ elif [ "$ENV_TYPE" == "multisite" ]; then
 	echo "Test site: http://localhost:8888/testsite"
 	echo "Admin login: admin / password"
 
-elif [ "$ENV_TYPE" == "playground-single" ]; then
+elif [ "$ENV_TYPE" = "playground-single" ]; then
 	echo "Setting up WordPress Playground single site environment..."
 
 	# Install wp-playground if needed
@@ -193,7 +190,7 @@ EOF
 	echo "Admin login: admin / password"
 	echo "Press Ctrl+C to stop the server when done."
 
-elif [ "$ENV_TYPE" == "playground-multisite" ]; then
+elif [ "$ENV_TYPE" = "playground-multisite" ]; then
 	echo "Setting up WordPress Playground multisite environment..."
 
 	# Install wp-playground if needed
@@ -205,6 +202,7 @@ elif [ "$ENV_TYPE" == "playground-multisite" ]; then
 	zip -r dist/plugin.zip . -x "node_modules/*" "dist/*" ".git/*"
 
 	# Update blueprint to use local plugin
+	# shellcheck disable=SC2154
 	cat >playground/multisite-blueprint.json <<EOF
 {
   "landingPage": "/wp-admin/network/",

build.sh

@@ -46,9 +46,9 @@ cp -R README.md LICENSE CHANGELOG.md readme.txt composer.json "$BUILD_DIR/"
 # Copy directories
 echo "Copying directories..."
 mkdir -p "$BUILD_DIR/admin" "$BUILD_DIR/includes" "$BUILD_DIR/languages" "$BUILD_DIR/assets"
-cp -R admin/* "$BUILD_DIR/admin/"
-cp -R includes/* "$BUILD_DIR/includes/"
-cp -R languages/* "$BUILD_DIR/languages/"
+cp -R ./admin/* "$BUILD_DIR/admin/"
+cp -R ./includes/* "$BUILD_DIR/includes/"
+cp -R ./languages/* "$BUILD_DIR/languages/"
 
 # Create assets directory structure
 mkdir -p "$BUILD_DIR/assets/banner" "$BUILD_DIR/assets/icon" "$BUILD_DIR/assets/screenshots"
@@ -73,9 +73,10 @@ fi
 
 # Create ZIP file.
 echo "Creating ZIP file..."
-cd build || exit 1
-zip -r "../$ZIP_FILE" "$PLUGIN_SLUG" -x "*.DS_Store" -x "*.git*" -x "*.github*"
-cd ..
+(
+	cd build || exit 1
+	zip -r "../$ZIP_FILE" "$PLUGIN_SLUG" -x "*.DS_Store" -x "*.git*" -x "*.github*"
+)
 
 # Check if ZIP file was created successfully
 if [ -f "$ZIP_FILE" ]; then
@@ -83,8 +84,8 @@ if [ -f "$ZIP_FILE" ]; then
 	echo "File path: $(pwd)/$ZIP_FILE"
 
 	# Deploy to local WordPress installation if environment variable is set
-	if [ -n "$WP_LOCAL_PLUGIN_DIR" ]; then
-		printf '\nDeploying to local WordPress installation...\n'
+	if [ -n "${WP_LOCAL_PLUGIN_DIR:-}" ]; then
+		echo ""
 		echo "Deploying to local WordPress installation..."
 
 		# Remove existing plugin directory.

cypress/e2e/playground-single-site.cy.js

@@ -20,8 +20,9 @@ describe('WordPress Playground Single Site Tests', () => {
     cy.get('body', { timeout: 15000 }).then(($body) => {
       // Verify the starter template plugin exists and is activated.
       if ($body.find('tr[data-slug="wp-plugin-starter-template-for-ai-coding"]').length) {
-        cy.get('tr[data-slug="wp-plugin-starter-template-for-ai-coding"]').should('exist');
-        cy.get('tr[data-slug="wp-plugin-starter-template-for-ai-coding"] .deactivate a').should('exist');
+        cy.get('tr[data-slug="wp-plugin-starter-template-for-ai-coding"]').within(() => {
+          cy.get('.deactivate a').should('exist');
+        });
       } else {
         cy.log('Starter template plugin not found by slug, skipping check');
       }

package.json

@@ -39,7 +39,7 @@
     "test:php": "composer run-script test",
     "lint": "composer run-script lint",
     "fix": "composer run-script fix",
-    "quality": "npm run lint && npm run lint:css && npm run test:php"
+    "quality": "npm run lint && npm run lint:js && npm run lint:css && npm run test:php"
   },
   "repository": {
     "type": "git",