fix: move sync-wiki.yml secrets to env block to resolve SonarCloud S7636

Move github.actor, secrets.GITHUB_TOKEN, and github.repository from
inline run block string interpolation to step-level env: block.
References via env vars prevent secret expansion in workflow logs.

Resolves the remaining S7636 hotspot in sync-wiki.yml.

Closes #106

.agents/error-checking-feedback-loops.md

@@ -77,7 +77,7 @@ uses: actions/upload-artifact@v4
 
 **Solution**: Use port 80 for multisite environments:
 
-```yaml
+```bash
 npx @wp-playground/cli server --blueprint playground/multisite-blueprint.json --port 80 --login &
 ```
 
@@ -142,7 +142,7 @@ npm run test:playground:multisite
 2. **Analyze Output for Errors**:
 
    ```bash
-   cat test-output.log | grep -i 'error\|fail\|exception'
+   grep -E -i '\b(error|fail|exception)' test-output.log
    ```
 
 3. **Parse Structured Test Results** (if available):
@@ -221,7 +221,7 @@ npm run lint:css
 2. **Analyze Output for Errors**:
 
    ```bash
-   cat phpcs-output.log | grep -i 'ERROR\|WARNING'
+   grep -E -i '\b(ERROR|WARNING)' phpcs-output.log
    ```
 
 3. **Automatically Fix Issues** (when possible):

.eslintrc.js

@@ -2,8 +2,7 @@ module.exports = {
   env: {
     browser: true,
     es2021: true,
-    node: true,
-    'cypress/globals': true
+    node: true
   },
   extends: [
     'eslint:recommended'
@@ -16,7 +15,7 @@ module.exports = {
     sourceType: 'module'
   },
   rules: {
-    'comma-dangle': ['error', 'never'],
+    'comma-dangle': ['error', 'always-multiline'],
     'no-console': 'warn',
     'no-unused-vars': 'warn'
   },

.github/workflows/code-quality.yml

@@ -20,7 +20,7 @@ jobs:
           clean: 'true'
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
         with:
           php-version: '8.1'
           extensions: mbstring, intl, zip
@@ -47,7 +47,7 @@ jobs:
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
         with:
           php-version: '8.1'
           extensions: mbstring, intl, zip
@@ -68,7 +68,7 @@ jobs:
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
         with:
           php-version: '8.1'
           extensions: mbstring, intl, zip
@@ -119,7 +119,7 @@ jobs:
   #
   #     - name: SonarCloud Scan
   #       if: steps.check_sonar_token.outputs.skip != 'true'
-  #       uses: SonarSource/sonarqube-scan-action@master
+  #       uses: SonarSource/sonarqube-scan-action@9598b8a83feef37de07f549027fab50ecffe6a6e # master
   #       env:
   #         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   #         SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
@@ -152,7 +152,7 @@ jobs:
           fi
 
       - name: Run Codacy Analysis CLI
-        uses: codacy/codacy-analysis-cli-action@v4
+        uses: codacy/codacy-analysis-cli-action@562ee3e92b8e92df8b67e0a5ff8aa8e261919c08 # v4
         with:
           project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
           verbose: true
@@ -167,7 +167,7 @@ jobs:
 
       - name: Upload SARIF results file
         if: steps.check_codacy_token.outputs.skip_upload != 'true'
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@603b797f8b14b413fe025cd935a91c16c4782713 # v3
         with:
           sarif_file: results.sarif
         continue-on-error: true

.github/workflows/phpunit.yml

@@ -42,7 +42,7 @@ jobs:
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
         with:
           php-version: ${{ matrix.php }}
           extensions: dom, curl, libxml, mbstring, zip, pdo, mysql, pdo_mysql, bcmath, soap, intl, gd, exif, iconv

.github/workflows/playground-tests-fix.yml

@@ -36,7 +36,7 @@ jobs:
     - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
     - name: Setup Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
       with:
         node-version: '20'
         cache: 'npm'
@@ -98,7 +98,7 @@ jobs:
 
     - name: Upload Cypress artifacts
       if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: cypress-playground-results
         path: |

.github/workflows/playground-tests.yml

@@ -40,7 +40,7 @@ jobs:
     - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
     - name: Setup Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
       with:
         node-version: ${{ matrix.node-version }}
         cache: 'npm'
@@ -67,7 +67,7 @@ jobs:
     - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
     - name: Setup Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
       with:
         node-version: '20'
         cache: 'npm'
@@ -142,7 +142,7 @@ jobs:
 
     - name: Upload Cypress artifacts
       if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: cypress-single-site-results
         path: |
@@ -163,7 +163,7 @@ jobs:
     - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
     - name: Setup Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
       with:
         node-version: '20'
         cache: 'npm'
@@ -239,7 +239,7 @@ jobs:
 
     - name: Upload Cypress artifacts
       if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: cypress-multisite-results
         path: |
@@ -261,7 +261,7 @@ jobs:
     - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
     - name: WordPress Performance Tests
-      uses: swissspidy/wp-performance-action@v2.0.3
+      uses: swissspidy/wp-performance-action@b7e3ffcf0fc4a48b62492e021e0ebeb51430ff11 # v2.0.3
       with:
         plugins: |
           ./

.github/workflows/release.yml

@@ -14,10 +14,10 @@ jobs:
       contents: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
         with:
           php-version: '7.4'
           extensions: mbstring, intl, zip
@@ -62,7 +62,7 @@ jobs:
 
       - name: Create Release
         id: create_release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
         with:
           files: wp-plugin-starter-template-for-ai-coding-${{ env.VERSION }}.zip
           name: v${{ env.VERSION }} - WordPress Plugin Starter Template

.github/workflows/sonarcloud.yml

@@ -49,7 +49,7 @@ jobs:
 
       - name: SonarCloud Scan
         if: steps.check_token.outputs.skip != 'true'
-        uses: SonarSource/sonarqube-scan-action@master
+        uses: SonarSource/sonarqube-scan-action@9598b8a83feef37de07f549027fab50ecffe6a6e # master
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONARCLOUD_GITHUB }}

.github/workflows/sync-wiki.yml

@@ -15,7 +15,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
 
       - name: Configure Git
         run: |
@@ -50,4 +50,8 @@ jobs:
           git commit -m "Sync wiki from source repository"
 
           # Push changes
-          git push https://${{ github.actor }}:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.wiki.git
+          git push https://${WIKI_ACTOR}:${WIKI_TOKEN}@github.com/${WIKI_REPO}.wiki.git
+        env:
+          WIKI_ACTOR: ${{ github.actor }}
+          WIKI_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          WIKI_REPO: ${{ github.repository }}

.github/workflows/tests.yml

@@ -17,12 +17,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           clean: 'true'
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
         with:
           php-version: ${{ matrix.php-versions }}
           extensions: mbstring, intl, zip
@@ -43,12 +43,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           clean: 'true'
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
         with:
           php-version: '7.4'
           extensions: mbstring, intl, zip

.github/workflows/wordpress-tests.yml

@@ -37,7 +37,7 @@ jobs:
     - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
     - name: Setup Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
       with:
         node-version: ${{ matrix.node-version }}
         cache: 'npm'
@@ -73,7 +73,7 @@ jobs:
     - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
     - name: Setup Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
       with:
         node-version: '20'
         cache: 'npm'
@@ -124,7 +124,7 @@ jobs:
 
     - name: Upload Cypress artifacts
       if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: cypress-results
         path: |

.wiki/Playground-Testing.md

@@ -102,7 +102,9 @@ In a WordPress multisite environment, there are two ways to activate plugins:
 1. **Network Activation**: Activates a plugin for all sites in the network
    * In the WordPress admin, go to Network Admin > Plugins
    * Click "Network Activate" under the plugin
-   * Or use WP-CLI: `wp plugin activate plugin-name --network`
+   * Or use WP-CLI:
+      * To activate an already installed plugin: `wp plugin activate plugin-name --network`
+      * To install and activate in one step: `wp plugin install plugin-name --activate-network`
 
 2. **Per-Site Activation**: Activates a plugin for a specific site
    * In the WordPress admin, go to the specific site's admin area

admin/css/admin-styles.css

@@ -123,7 +123,7 @@
     text-align: right;
 }
 
-/* Responsive Styles */
+/* 782px is the WordPress mobile admin breakpoint. */
 @media screen and (max-width: 782px) {
     .wpst-form-table th {
         width: 100%;

admin/js/admin-scripts.js

@@ -78,7 +78,7 @@
           data: {
             action: 'wpst_save_settings',
             nonce: wpstData.nonce,
-            formData: formData
+            formData: formData,
           },
           success: function (response) {
             if (response.success) {
@@ -93,8 +93,8 @@
           complete: function () {
             // Re-enable submit button and remove loading state.
             $submitButton.prop( 'disabled', false ).removeClass( 'loading' );
-          }
-        }
+          },
+        },
       );
     },
 
@@ -123,19 +123,19 @@
             300,
             function () {
               $( this ).remove();
-            }
+            },
           );
         },
-        5000
+        5000,
       );
-    }
+    },
   };
 
   // Initialize when document is ready.
   $( document ).ready(
     function () {
       WPSTAdmin.init();
-    }
+    },
   );
 
 })( jQuery );

admin/js/update-source-selector.js

@@ -48,7 +48,7 @@
           if ($( e.target ).hasClass( 'wpst-modal' )) {
             WPSTUpdateSourceSelector.closeModal();
           }
-        }
+        },
       );
 
       // Select source option.
@@ -116,7 +116,7 @@
           data: {
             action: 'wpst_set_update_source', // AJAX action hook.
             nonce: wpstModalData.nonce, // Security nonce.
-            source: this.selectedSource
+            source: this.selectedSource,
           },
           success: function (response) {
             if (response.success) {
@@ -127,7 +127,7 @@
                 function () {
                   WPSTUpdateSourceSelector.closeModal();
                 },
-                1500
+                1500,
               );
             } else {
               WPSTUpdateSourceSelector.showMessage( 'error', response.data.message );
@@ -139,40 +139,44 @@
           complete: function () {
             // Reset button state.
             $saveButton.prop( 'disabled', false ).text( wpstModalData.i18n.confirm );
-          }
-        }
+          },
+        },
       );
     },
 
     /**
 		 * Show a message in the modal
 		 *
-		 * @param {string} type Message type (success, error)
+		 * @param {string} type    Message type (success, error)
 		 * @param {string} message Message text
 		 */
     showMessage: function (type, message) {
       const $message = this.$modal.find( '.wpst-modal-message' );
 
-      // Set message as plain text to prevent XSS, then apply type class.
-      $message.text( message ).removeClass( 'success error' ).addClass( type ).show();
+      // Validate type against allow-list to prevent class injection vulnerabilities.
+      const allowedTypes = [ 'success', 'error' ];
+      const safeType = allowedTypes.includes( type ) ? type : 'error';
+
+      // Set message as plain text to prevent XSS, then apply validated type class.
+      $message.text( message ).removeClass( 'success error' ).addClass( safeType ).show();
 
       // Hide message after a delay for success messages.
-      if (type === 'success') {
+      if (safeType === 'success') {
         setTimeout(
           function () {
             $message.fadeOut( 300 );
           },
-          3000
+          3000,
         );
       }
-    }
+    },
   };
 
   // Initialize when document is ready.
   $( document ).ready(
     function () {
       WPSTUpdateSourceSelector.init();
-    }
+    },
   );
 
 })( jQuery );

bin/install-wp-tests.sh

@@ -117,6 +117,7 @@ install_test_suite() {
 	# set up testing suite if it doesn't yet exist
 	if [ ! -d "$WP_TESTS_DIR" ]; then
 		mkdir -p "$WP_TESTS_DIR"
+		rm -rf /tmp/wordpress-develop
 		if ! git clone --quiet --depth=1 --branch "$GIT_REF" https://github.com/WordPress/wordpress-develop.git /tmp/wordpress-develop; then
 			echo "Error: Failed to clone wordpress-develop at branch/tag $GIT_REF" >&2
 			exit 1

bin/localwp-setup.sh

@@ -28,7 +28,6 @@ set -e
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_DIR="$(dirname "$SCRIPT_DIR")"
 PLUGIN_SLUG="wp-plugin-starter-template"
-PLUGIN_TEXT_DOMAIN="wp-plugin-starter-template"
 
 # LocalWP paths (macOS)
 LOCAL_SITES_DIR="$HOME/Local Sites"
@@ -51,363 +50,375 @@ NC='\033[0m' # No Color
 
 # Helper functions
 log_info() {
-    echo -e "${BLUE}[INFO]${NC} $1"
+	echo -e "${BLUE}[INFO]${NC} $1"
 }
 
 log_success() {
-    echo -e "${GREEN}[SUCCESS]${NC} $1"
+	echo -e "${GREEN}[SUCCESS]${NC} $1"
 }
 
 log_warning() {
-    echo -e "${YELLOW}[WARNING]${NC} $1"
+	echo -e "${YELLOW}[WARNING]${NC} $1"
 }
 
 log_error() {
-    echo -e "${RED}[ERROR]${NC} $1"
+	echo -e "${RED}[ERROR]${NC} $1"
 }
 
 log_step() {
-    echo -e "${CYAN}[STEP]${NC} $1"
+	echo -e "${CYAN}[STEP]${NC} $1"
 }
 
 # Check if LocalWP is installed
 check_localwp() {
-    if [ ! -d "$LOCAL_APP" ]; then
-        log_error "LocalWP is not installed at $LOCAL_APP"
-        log_info "Download from: https://localwp.com/"
-        exit 1
-    fi
-    
-    if [ ! -f "$LOCAL_WP_CLI" ]; then
-        log_error "WP-CLI not found in LocalWP installation"
-        exit 1
-    fi
-    
-    local version=$("$LOCAL_WP_CLI" --version 2>/dev/null || echo "unknown")
-    log_info "LocalWP WP-CLI version: $version"
+	if [ ! -d "$LOCAL_APP" ]; then
+		log_error "LocalWP is not installed at $LOCAL_APP"
+		log_info "Download from: https://localwp.com/"
+		exit 1
+	fi
+
+	if [ ! -f "$LOCAL_WP_CLI" ]; then
+		log_error "WP-CLI not found in LocalWP installation"
+		exit 1
+	fi
+
+	local version
+	version=$("$LOCAL_WP_CLI" --version 2>/dev/null || echo "unknown")
+	log_info "LocalWP WP-CLI version: $version"
 }
 
 # Get site path
 get_site_path() {
-    local site_name="$1"
-    echo "$LOCAL_SITES_DIR/$site_name"
+	local site_name="$1"
+	echo "$LOCAL_SITES_DIR/$site_name"
 }
 
 # Get WordPress path within site
 get_wp_path() {
-    local site_name="$1"
-    local site_path=$(get_site_path "$site_name")
-    
-    # LocalWP uses app/public for WordPress files
-    echo "$site_path/app/public"
+	local site_name="$1"
+	local site_path
+	site_path=$(get_site_path "$site_name")
+
+	# LocalWP uses app/public for WordPress files
+	echo "$site_path/app/public"
 }
 
 # Check if site exists
 site_exists() {
-    local site_name="$1"
-    local site_path=$(get_site_path "$site_name")
-    [ -d "$site_path" ]
+	local site_name="$1"
+	local site_path
+	site_path=$(get_site_path "$site_name")
+	[ -d "$site_path" ]
 }
 
 # Get plugin destination path
 get_plugin_path() {
-    local site_name="$1"
-    local wp_path=$(get_wp_path "$site_name")
-    echo "$wp_path/wp-content/plugins/$PLUGIN_SLUG"
+	local site_name="$1"
+	local wp_path
+	wp_path=$(get_wp_path "$site_name")
+	echo "$wp_path/wp-content/plugins/$PLUGIN_SLUG"
 }
 
 # Sync plugin files to LocalWP site
 sync_plugin() {
-    local site_name="$1"
-    local plugin_dest=$(get_plugin_path "$site_name")
-    
-    if ! site_exists "$site_name"; then
-        log_error "Site '$site_name' does not exist"
-        return 1
-    fi
-    
-    log_info "Syncing plugin to $site_name..."
-    
-    # Create plugin directory if it doesn't exist
-    mkdir -p "$plugin_dest"
-    
-    # Sync files using rsync (excludes dev files)
-    rsync -av --delete \
-        --exclude 'node_modules' \
-        --exclude 'vendor' \
-        --exclude '.git' \
-        --exclude 'dist' \
-        --exclude 'tests' \
-        --exclude 'cypress' \
-        --exclude '.github' \
-        --exclude '.agents' \
-        --exclude '.wiki' \
-        --exclude 'reference-plugins' \
-        --exclude '*.zip' \
-        --exclude '.playground.*' \
-        --exclude 'composer.lock' \
-        --exclude 'package-lock.json' \
-        "$PROJECT_DIR/" "$plugin_dest/"
-    
-    log_success "Plugin synced to: $plugin_dest"
+	local site_name="$1"
+	local plugin_dest
+	plugin_dest=$(get_plugin_path "$site_name")
+
+	if ! site_exists "$site_name"; then
+		log_error "Site '$site_name' does not exist"
+		return 1
+	fi
+
+	log_info "Syncing plugin to $site_name..."
+
+	# Create plugin directory if it doesn't exist
+	mkdir -p "$plugin_dest"
+
+	# Sync files using rsync (excludes dev files)
+	rsync -av --delete \
+		--exclude 'node_modules' \
+		--exclude 'vendor' \
+		--exclude '.git' \
+		--exclude 'dist' \
+		--exclude 'tests' \
+		--exclude 'cypress' \
+		--exclude '.github' \
+		--exclude '.agents' \
+		--exclude '.wiki' \
+		--exclude 'reference-plugins' \
+		--exclude '*.zip' \
+		--exclude '.playground.*' \
+		--exclude 'composer.lock' \
+		--exclude 'package-lock.json' \
+		"$PROJECT_DIR/" "$plugin_dest/"
+
+	log_success "Plugin synced to: $plugin_dest"
 }
 
 # Create a new LocalWP site
 create_site() {
-    local multisite=false
-    
-    # Parse arguments
-    while [[ $# -gt 0 ]]; do
-        case "$1" in
-            --multisite)
-                multisite=true
-                shift
-                ;;
-            *)
-                shift
-                ;;
-        esac
-    done
-    
-    local site_name="$SINGLE_SITE_NAME"
-    local domain="$SINGLE_SITE_DOMAIN"
-    local mode="single site"
-    
-    if [ "$multisite" = true ]; then
-        site_name="$MULTISITE_NAME"
-        domain="$MULTISITE_DOMAIN"
-        mode="multisite"
-    fi
-    
-    check_localwp
-    
-    local site_path=$(get_site_path "$site_name")
-    
-    if site_exists "$site_name"; then
-        log_warning "Site '$site_name' already exists at: $site_path"
-        log_info "Use 'npm run localwp:reset' to reset it, or 'npm run localwp:sync' to update files"
-        return 0
-    fi
-    
-    echo ""
-    echo "============================================"
-    echo "  LocalWP Site Setup ($mode)"
-    echo "============================================"
-    echo ""
-    echo "This script will guide you through creating a"
-    echo "LocalWP site for testing the plugin."
-    echo ""
-    echo "Site Details:"
-    echo "  Name:   $site_name"
-    echo "  Domain: $domain"
-    echo "  Path:   $site_path"
-    echo ""
-    
-    log_step "Creating LocalWP Site"
-    echo ""
-    log_info "LocalWP doesn't have a CLI for site creation."
-    log_info "Please create the site manually in LocalWP:"
-    echo ""
-    echo "1. Open LocalWP application"
-    echo "2. Click the '+' button to create a new site"
-    echo "3. Use these settings:"
-    echo "   - Site name: ${CYAN}$site_name${NC}"
-    echo "   - Local site domain: ${CYAN}$domain${NC}"
-    echo "   - PHP version: 8.0 or higher"
-    echo "   - Web server: nginx (preferred)"
-    echo "   - MySQL version: 8.0+"
-    
-    if [ "$multisite" = true ]; then
-        echo ""
-        echo "4. After site creation, convert to multisite:"
-        echo "   - Open Site Shell in LocalWP"
-        echo "   - Run: wp core multisite-convert --subdomains=0"
-        echo "   - Update wp-config.php if needed"
-    fi
-    
-    echo ""
-    log_info "After creating the site, run: npm run localwp:sync"
-    echo ""
-    
-    # Wait for user to create site
-    read -p "Press Enter after you've created the site in LocalWP..."
-    
-    if site_exists "$site_name"; then
-        log_success "Site detected at: $site_path"
-        sync_plugin "$site_name"
-        
-        # Install recommended plugins
-        install_recommended_plugins "$site_name"
-        
-        show_site_info "$site_name" "$domain" "$multisite"
-    else
-        log_warning "Site not found at expected location"
-        log_info "Expected path: $site_path"
-        log_info "You can run 'npm run localwp:sync' later to sync files"
-    fi
+	local multisite=false
+
+	# Parse arguments
+	while [[ $# -gt 0 ]]; do
+		case "$1" in
+		--multisite)
+			multisite=true
+			shift
+			;;
+		*)
+			shift
+			;;
+		esac
+	done
+
+	local site_name="$SINGLE_SITE_NAME"
+	local domain="$SINGLE_SITE_DOMAIN"
+	local mode="single site"
+
+	if [ "$multisite" = true ]; then
+		site_name="$MULTISITE_NAME"
+		domain="$MULTISITE_DOMAIN"
+		mode="multisite"
+	fi
+
+	check_localwp
+
+	local site_path
+	site_path=$(get_site_path "$site_name")
+
+	if site_exists "$site_name"; then
+		log_warning "Site '$site_name' already exists at: $site_path"
+		log_info "Use 'npm run localwp:reset' to reset it, or 'npm run localwp:sync' to update files"
+		return 0
+	fi
+
+	echo ""
+	echo "============================================"
+	echo "  LocalWP Site Setup ($mode)"
+	echo "============================================"
+	echo ""
+	echo "This script will guide you through creating a"
+	echo "LocalWP site for testing the plugin."
+	echo ""
+	echo "Site Details:"
+	echo "  Name:   $site_name"
+	echo "  Domain: $domain"
+	echo "  Path:   $site_path"
+	echo ""
+
+	log_step "Creating LocalWP Site"
+	echo ""
+	log_info "LocalWP doesn't have a CLI for site creation."
+	log_info "Please create the site manually in LocalWP:"
+	echo ""
+	echo "1. Open LocalWP application"
+	echo "2. Click the '+' button to create a new site"
+	echo "3. Use these settings:"
+	echo "   - Site name: ${CYAN}$site_name${NC}"
+	echo "   - Local site domain: ${CYAN}$domain${NC}"
+	echo "   - PHP version: 8.0 or higher"
+	echo "   - Web server: nginx (preferred)"
+	echo "   - MySQL version: 8.0+"
+
+	if [ "$multisite" = true ]; then
+		echo ""
+		echo "4. After site creation, convert to multisite:"
+		echo "   - Open Site Shell in LocalWP"
+		echo "   - Run: wp core multisite-convert --subdomains=0"
+		echo "   - Update wp-config.php if needed"
+	fi
+
+	echo ""
+	log_info "After creating the site, run: npm run localwp:sync"
+	echo ""
+
+	# Wait for user to create site
+	read -r -p "Press Enter after you've created the site in LocalWP..."
+
+	if site_exists "$site_name"; then
+		log_success "Site detected at: $site_path"
+		sync_plugin "$site_name"
+
+		# Install recommended plugins
+		install_recommended_plugins "$site_name"
+
+		show_site_info "$site_name" "$domain" "$multisite"
+	else
+		log_warning "Site not found at expected location"
+		log_info "Expected path: $site_path"
+		log_info "You can run 'npm run localwp:sync' later to sync files"
+	fi
 }
 
 # Install recommended plugins (matching Playground blueprint)
 install_recommended_plugins() {
-    local site_name="$1"
-    local wp_path=$(get_wp_path "$site_name")
-    
-    log_info "Note: Install these plugins to match Playground environment:"
-    echo "  - Plugin Toggle (plugin-toggle)"
-    echo "  - Kadence Blocks (kadence-blocks)"
-    echo ""
-    log_info "You can install them via LocalWP's WP Admin or Site Shell"
+	local site_name="$1"
+	local wp_path
+	wp_path=$(get_wp_path "$site_name")
+
+	log_info "Note: Install these plugins to match Playground environment:"
+	echo "  - Plugin Toggle (plugin-toggle)"
+	echo "  - Kadence Blocks (kadence-blocks)"
+	echo ""
+	log_info "You can install them via LocalWP's WP Admin or Site Shell"
 }
 
 # Show site information
 show_site_info() {
-    local site_name="$1"
-    local domain="$2"
-    local multisite="$3"
-    
-    local site_path=$(get_site_path "$site_name")
-    local plugin_path=$(get_plugin_path "$site_name")
-    
-    echo ""
-    echo "============================================"
-    echo "  LocalWP Site Ready"
-    echo "============================================"
-    echo "  Site:        $site_name"
-    echo "  URL:         http://$domain"
-    echo "  Admin:       http://$domain/wp-admin/"
-    echo "  Plugin Path: $plugin_path"
-    echo "============================================"
-    
-    if [ "$multisite" = true ]; then
-        echo "  Network Admin: http://$domain/wp-admin/network/"
-        echo "============================================"
-    fi
-    
-    echo ""
-    log_info "Remember to:"
-    echo "  1. Start the site in LocalWP"
-    echo "  2. Activate the plugin in WordPress admin"
-    echo "  3. Run 'npm run localwp:sync' after making changes"
-    echo ""
+	local site_name="$1"
+	local domain="$2"
+	local multisite="$3"
+
+	local site_path
+	site_path=$(get_site_path "$site_name")
+	local plugin_path
+	plugin_path=$(get_plugin_path "$site_name")
+
+	echo ""
+	echo "============================================"
+	echo "  LocalWP Site Ready"
+	echo "============================================"
+	echo "  Site:        $site_name"
+	echo "  URL:         http://$domain"
+	echo "  Admin:       http://$domain/wp-admin/"
+	echo "  Plugin Path: $plugin_path"
+	echo "============================================"
+
+	if [ "$multisite" = true ]; then
+		echo "  Network Admin: http://$domain/wp-admin/network/"
+		echo "============================================"
+	fi
+
+	echo ""
+	log_info "Remember to:"
+	echo "  1. Start the site in LocalWP"
+	echo "  2. Activate the plugin in WordPress admin"
+	echo "  3. Run 'npm run localwp:sync' after making changes"
+	echo ""
 }
 
 # Reset site to clean state
 reset_site() {
-    local site_name="${1:-$SINGLE_SITE_NAME}"
-    
-    if ! site_exists "$site_name"; then
-        log_error "Site '$site_name' does not exist"
-        exit 1
-    fi
-    
-    log_warning "This will delete the plugin files and resync them."
-    read -p "Continue? (y/n) " -n 1 -r
-    echo
-    
-    if [[ $REPLY =~ ^[Yy]$ ]]; then
-        local plugin_path=$(get_plugin_path "$site_name")
-        
-        log_info "Removing plugin files..."
-        rm -rf "$plugin_path"
-        
-        log_info "Resyncing plugin..."
-        sync_plugin "$site_name"
-        
-        log_success "Site reset complete"
-    else
-        log_info "Reset cancelled"
-    fi
+	local site_name="${1:-$SINGLE_SITE_NAME}"
+
+	if ! site_exists "$site_name"; then
+		log_error "Site '$site_name' does not exist"
+		exit 1
+	fi
+
+	log_warning "This will delete the plugin files and resync them."
+	read -p "Continue? (y/n) " -n 1 -r
+	echo
+
+	if [[ $REPLY =~ ^[Yy]$ ]]; then
+		local plugin_path
+		plugin_path=$(get_plugin_path "$site_name")
+
+		log_info "Removing plugin files..."
+		rm -rf "$plugin_path"
+
+		log_info "Resyncing plugin..."
+		sync_plugin "$site_name"
+
+		log_success "Site reset complete"
+	else
+		log_info "Reset cancelled"
+	fi
 }
 
 # Sync all existing sites
 sync_all() {
-    local synced=0
-    
-    for site_name in "$SINGLE_SITE_NAME" "$MULTISITE_NAME"; do
-        if site_exists "$site_name"; then
-            sync_plugin "$site_name"
-            synced=$((synced + 1))
-        fi
-    done
-    
-    if [ $synced -eq 0 ]; then
-        log_warning "No LocalWP sites found for this plugin"
-        log_info "Run 'npm run localwp:create' to create one"
-    else
-        log_success "Synced $synced site(s)"
-    fi
+	local synced=0
+
+	for site_name in "$SINGLE_SITE_NAME" "$MULTISITE_NAME"; do
+		if site_exists "$site_name"; then
+			sync_plugin "$site_name"
+			synced=$((synced + 1))
+		fi
+	done
+
+	if [ $synced -eq 0 ]; then
+		log_warning "No LocalWP sites found for this plugin"
+		log_info "Run 'npm run localwp:create' to create one"
+	else
+		log_success "Synced $synced site(s)"
+	fi
 }
 
 # Show info about all sites
 show_info() {
-    echo ""
-    echo "LocalWP Sites for $PLUGIN_SLUG"
-    echo "==============================="
-    
-    for site_name in "$SINGLE_SITE_NAME" "$MULTISITE_NAME"; do
-        local site_path=$(get_site_path "$site_name")
-        
-        if site_exists "$site_name"; then
-            echo ""
-            echo "  ${GREEN}✓${NC} $site_name"
-            echo "    Path: $site_path"
-            
-            local plugin_path=$(get_plugin_path "$site_name")
-            if [ -d "$plugin_path" ]; then
-                echo "    Plugin: ${GREEN}Installed${NC}"
-            else
-                echo "    Plugin: ${YELLOW}Not synced${NC}"
-            fi
-        else
-            echo ""
-            echo "  ${YELLOW}○${NC} $site_name (not created)"
-        fi
-    done
-    
-    echo ""
-    echo "Commands:"
-    echo "  npm run localwp:create           Create single site"
-    echo "  npm run localwp:create:multisite Create multisite"
-    echo "  npm run localwp:sync             Sync plugin files"
-    echo "  npm run localwp:reset            Reset plugin files"
-    echo ""
+	echo ""
+	echo "LocalWP Sites for $PLUGIN_SLUG"
+	echo "==============================="
+
+	for site_name in "$SINGLE_SITE_NAME" "$MULTISITE_NAME"; do
+		local site_path
+		site_path=$(get_site_path "$site_name")
+
+		if site_exists "$site_name"; then
+			echo ""
+			echo "  ${GREEN}✓${NC} $site_name"
+			echo "    Path: $site_path"
+
+			local plugin_path
+			plugin_path=$(get_plugin_path "$site_name")
+			if [ -d "$plugin_path" ]; then
+				echo "    Plugin: ${GREEN}Installed${NC}"
+			else
+				echo "    Plugin: ${YELLOW}Not synced${NC}"
+			fi
+		else
+			echo ""
+			echo "  ${YELLOW}○${NC} $site_name (not created)"
+		fi
+	done
+
+	echo ""
+	echo "Commands:"
+	echo "  npm run localwp:create           Create single site"
+	echo "  npm run localwp:create:multisite Create multisite"
+	echo "  npm run localwp:sync             Sync plugin files"
+	echo "  npm run localwp:reset            Reset plugin files"
+	echo ""
 }
 
 # Main command handler
 case "${1:-}" in
-    create)
-        shift
-        create_site "$@"
-        ;;
-    sync)
-        sync_all
-        ;;
-    reset)
-        shift
-        reset_site "$@"
-        ;;
-    info)
-        show_info
-        ;;
-    *)
-        echo "LocalWP Integration Script"
-        echo ""
-        echo "Usage:"
-        echo "  $0 create [--multisite]   Create a new LocalWP site"
-        echo "  $0 sync                   Sync plugin files to all sites"
-        echo "  $0 reset [site-name]      Reset site plugin to clean state"
-        echo "  $0 info                   Show info about LocalWP sites"
-        echo ""
-        echo "npm scripts:"
-        echo "  npm run localwp:create              Create single site"
-        echo "  npm run localwp:create:multisite    Create multisite"
-        echo "  npm run localwp:sync                Sync plugin files"
-        echo "  npm run localwp:reset               Reset plugin files"
-        echo ""
-        echo "URL Patterns:"
-        echo "  Single site: http://${PLUGIN_SLUG}-single.local"
-        echo "  Multisite:   http://${PLUGIN_SLUG}-multisite.local"
-        echo ""
-        exit 1
-        ;;
+create)
+	shift
+	create_site "$@"
+	;;
+sync)
+	sync_all
+	;;
+reset)
+	shift
+	reset_site "$@"
+	;;
+info)
+	show_info
+	;;
+*)
+	echo "LocalWP Integration Script"
+	echo ""
+	echo "Usage:"
+	echo "  $0 create [--multisite]   Create a new LocalWP site"
+	echo "  $0 sync                   Sync plugin files to all sites"
+	echo "  $0 reset [site-name]      Reset site plugin to clean state"
+	echo "  $0 info                   Show info about LocalWP sites"
+	echo ""
+	echo "npm scripts:"
+	echo "  npm run localwp:create              Create single site"
+	echo "  npm run localwp:create:multisite    Create multisite"
+	echo "  npm run localwp:sync                Sync plugin files"
+	echo "  npm run localwp:reset               Reset plugin files"
+	echo ""
+	echo "URL Patterns:"
+	echo "  Single site: http://${PLUGIN_SLUG}-single.local"
+	echo "  Multisite:   http://${PLUGIN_SLUG}-multisite.local"
+	echo ""
+	exit 1
+	;;
 esac

bin/setup-test-env.sh

@@ -1,8 +1,5 @@
 #!/bin/bash
 
-# Make this script executable
-chmod +x "$0"
-
 # Check if environment type is provided
 if [ -z "$1" ]; then
 	echo "Usage: $0 [single|multisite|playground-single|playground-multisite]"
@@ -49,7 +46,7 @@ install_wp_playground() {
 	fi
 }
 
-if [ "$ENV_TYPE" == "single" ]; then
+if [ "$ENV_TYPE" = "single" ]; then
 	echo "Setting up single site environment..."
 
 	# Install wp-env if needed
@@ -83,7 +80,7 @@ if [ "$ENV_TYPE" == "single" ]; then
 	echo "Site: http://localhost:8888"
 	echo "Admin login: admin / password"
 
-elif [ "$ENV_TYPE" == "multisite" ]; then
+elif [ "$ENV_TYPE" = "multisite" ]; then
 	echo "Setting up multisite environment..."
 
 	# Install wp-env if needed
@@ -124,7 +121,7 @@ elif [ "$ENV_TYPE" == "multisite" ]; then
 	echo "Test site: http://localhost:8888/testsite"
 	echo "Admin login: admin / password"
 
-elif [ "$ENV_TYPE" == "playground-single" ]; then
+elif [ "$ENV_TYPE" = "playground-single" ]; then
 	echo "Setting up WordPress Playground single site environment..."
 
 	# Install wp-playground if needed
@@ -193,7 +190,7 @@ EOF
 	echo "Admin login: admin / password"
 	echo "Press Ctrl+C to stop the server when done."
 
-elif [ "$ENV_TYPE" == "playground-multisite" ]; then
+elif [ "$ENV_TYPE" = "playground-multisite" ]; then
 	echo "Setting up WordPress Playground multisite environment..."
 
 	# Install wp-playground if needed
@@ -205,6 +202,7 @@ elif [ "$ENV_TYPE" == "playground-multisite" ]; then
 	zip -r dist/plugin.zip . -x "node_modules/*" "dist/*" ".git/*"
 
 	# Update blueprint to use local plugin
+	# shellcheck disable=SC2154
 	cat >playground/multisite-blueprint.json <<EOF
 {
   "landingPage": "/wp-admin/network/",

build.sh

@@ -46,9 +46,9 @@ cp -R README.md LICENSE CHANGELOG.md readme.txt composer.json "$BUILD_DIR/"
 # Copy directories
 echo "Copying directories..."
 mkdir -p "$BUILD_DIR/admin" "$BUILD_DIR/includes" "$BUILD_DIR/languages" "$BUILD_DIR/assets"
-cp -R admin/* "$BUILD_DIR/admin/"
-cp -R includes/* "$BUILD_DIR/includes/"
-cp -R languages/* "$BUILD_DIR/languages/"
+cp -R ./admin/* "$BUILD_DIR/admin/"
+cp -R ./includes/* "$BUILD_DIR/includes/"
+cp -R ./languages/* "$BUILD_DIR/languages/"
 
 # Create assets directory structure
 mkdir -p "$BUILD_DIR/assets/banner" "$BUILD_DIR/assets/icon" "$BUILD_DIR/assets/screenshots"
@@ -73,9 +73,10 @@ fi
 
 # Create ZIP file.
 echo "Creating ZIP file..."
-cd build || exit 1
-zip -r "../$ZIP_FILE" "$PLUGIN_SLUG" -x "*.DS_Store" -x "*.git*" -x "*.github*"
-cd ..
+(
+	cd build || exit 1
+	zip -r "../$ZIP_FILE" "$PLUGIN_SLUG" -x "*.DS_Store" -x "*.git*" -x "*.github*"
+)
 
 # Check if ZIP file was created successfully
 if [ -f "$ZIP_FILE" ]; then
@@ -83,9 +84,8 @@ if [ -f "$ZIP_FILE" ]; then
 	echo "File path: $(pwd)/$ZIP_FILE"
 
 	# Deploy to local WordPress installation if environment variable is set
-	if [ -n "$WP_LOCAL_PLUGIN_DIR" ]; then
+	if [ -n "${WP_LOCAL_PLUGIN_DIR:-}" ]; then
 		printf '\nDeploying to local WordPress installation...\n'
-		echo "Deploying to local WordPress installation..."
 
 		# Remove existing plugin directory.
 		rm -rf "${WP_LOCAL_PLUGIN_DIR:?}/$PLUGIN_SLUG"

cypress.config.js

@@ -12,6 +12,6 @@ module.exports = defineConfig({
     },
     // Add configuration for WordPress Playground
     experimentalWebKitSupport: true,
-    chromeWebSecurity: false
-  }
+    chromeWebSecurity: false,
+  },
 });

cypress/e2e/playground-single-site.cy.js

@@ -1,5 +1,10 @@
 /* eslint-env mocha, jquery, cypress */
-describe('WordPress Playground Single Site Tests', () => {
+describe('WordPress Playground Single Site Tests', {
+  retries: {
+    runMode: 2,
+    openMode: 0,
+  },
+}, () => {
   beforeEach(() => {
     cy.visit('/', { timeout: 30000 });
   });
@@ -18,22 +23,22 @@ describe('WordPress Playground Single Site Tests', () => {
     cy.visit('/wp-admin/plugins.php', { timeout: 30000 });
 
     cy.get('body', { timeout: 15000 }).then(($body) => {
-      // Verify the starter template plugin exists and is activated.
-      if ($body.find('tr[data-slug="wp-plugin-starter-template-for-ai-coding"]').length) {
-        cy.get('tr[data-slug="wp-plugin-starter-template-for-ai-coding"]').should('exist');
-        cy.get('tr[data-slug="wp-plugin-starter-template-for-ai-coding"] .deactivate a').should('exist');
-      } else {
-        cy.log('Starter template plugin not found by slug, skipping check');
-      }
+      const hasPluginToggle = $body.text().includes('Plugin Toggle');
+      const hasKadenceBlocks = $body.text().includes('Kadence Blocks');
 
-      if ($body.text().includes('Plugin Toggle')) {
+      expect(
+        hasPluginToggle || hasKadenceBlocks,
+        'At least one blueprint plugin should be present in the plugins table',
+      ).to.be.true;
+
+      if (hasPluginToggle) {
         cy.contains('tr', 'Plugin Toggle').should('exist');
         cy.contains('tr', 'Plugin Toggle').find('.deactivate').should('exist');
       } else {
         cy.log('Plugin Toggle not found, skipping check');
       }
 
-      if ($body.text().includes('Kadence Blocks')) {
+      if (hasKadenceBlocks) {
         cy.contains('tr', 'Kadence Blocks').find('.deactivate').should('exist');
       } else {
         cy.log('Kadence Blocks plugin not found, skipping check');

package.json

@@ -28,7 +28,7 @@
     "test:phpunit": "composer test",
     "test:phpunit:multisite": "WP_MULTISITE=1 composer test",
     "build": "./build.sh",
-    "lint:js": "eslint cypress/",
+    "lint:js": "eslint cypress/ cypress.config.js",
     "lint:css": "stylelint \"**/*.css\" --allow-empty-input",
     "lint:php": "composer run-script phpcs",
     "lint:php:simple": "composer run-script phpcs:simple",
@@ -37,9 +37,10 @@
     "fix:php": "composer run-script phpcbf",
     "fix:php:simple": "composer run-script phpcbf:simple",
     "test:php": "composer run-script test",
-    "lint": "composer run-script lint",
+    "lint:php-all": "composer run-script lint",
+    "lint": "npm run lint:php-all && npm run lint:js && npm run lint:css",
     "fix": "composer run-script fix",
-    "quality": "npm run lint && npm run lint:css && npm run test:php"
+    "quality": "npm run lint && npm run test:php"
   },
   "repository": {
     "type": "git",
@@ -61,11 +62,11 @@
   "devDependencies": {
     "@wordpress/env": "^8.12.0",
     "@wp-playground/blueprints": "^3.0.22",
-    "@wp-playground/client": "^3.0.22",
     "@wp-playground/cli": "^3.0.22",
+    "@wp-playground/client": "^3.0.22",
     "cypress": "^13.17.0",
     "eslint": "^8.57.0",
-    "eslint-plugin-cypress": "^2.15.1",
+    "eslint-plugin-cypress": "^6.2.0",
     "stylelint": "^16.0.0",
     "stylelint-config-standard": "^36.0.0"
   }