Merge branch 'develop' into trunk

Author: dkotter

.gitattributes

@@ -22,6 +22,7 @@
 package.json export-ignore
 package-lock.json export-ignore
 /composer.lock export-ignore
+/tsconfig.json export-ignore
 /webpack.config.js export-ignore
 
 # Don't include the dotfiles for distribution.

CHANGELOG.md

@@ -4,29 +4,45 @@ All notable changes to this project will be documented in this file, per [the Ke
 
 ## [Unreleased] - TBD
 
+## [0.2.1] - 2026-01-26
+### Added
+- Introduced a shared `AI_Service` layer to standardize provider access across experiments ([#101](https://github.com/WordPress/ai/pull/101)).
+
+### Changed
+- Documentation updates ([#195](https://github.com/WordPress/ai/pull/195)).
+
+### Fixed
+- Guarded against `preg_replace()` returning `null` to prevent content corruption in `normalize_content()` ([#177](https://github.com/WordPress/ai/pull/177)).
+
+### Security
+- Change our user permission checks to use `edit_post` instead of `read_post` ([GHSA-mxf5-gp98-93wv](https://github.com/WordPress/ai/security/advisories/GHSA-mxf5-gp98-93wv)).
+- Bumped `diff` from 4.0.2 to 4.0.4 ([#196](https://github.com/WordPress/ai/pull/196)).
+- Bumped `lodash-es` from 4.17.22 to 4.17.23 ([#198](https://github.com/WordPress/ai/pull/198)).
+- Bumped `lodash` from 4.17.21 to 4.17.23 ([#199](https://github.com/WordPress/ai/pull/199)).
+
 ## [0.2.0] – 2026-01-20
 
 ### Added
-– Core excerpt generation support for AI-powered summaries, including a new Excerpt Generation Experiment with editor UI ([#96](https://github.com/WordPress/ai/pull/96), [#143](https://github.com/WordPress/ai/pull/143)).
-- Abilities Explorer — a new admin screen to view and interact with registered AI abilities in the plugin ([#63](https://github.com/WordPress/ai/pull/63)).
-– Introduce foundational backend support for Content Summarization and Image Generation experiments (API-only; no UI yet) ([#134](https://github.com/WordPress/ai/pull/134), [#136](https://github.com/WordPress/ai/pull/136)).
-– Improve plugin documentation and onboarding with expanded WP.org readme content ([#135](https://github.com/WordPress/ai/pull/135)).
-– Add Playground preview support to build and PR workflows using the official WordPress action ([#144](https://github.com/WordPress/ai/pull/144)).
+- Core excerpt generation support for AI-powered summaries, including a new Excerpt Generation Experiment with editor UI ([#96](https://github.com/WordPress/ai/pull/96), [#143](https://github.com/WordPress/ai/pull/143)).
+- Abilities Explorer - a new admin screen to view and interact with registered AI abilities in the plugin ([#63](https://github.com/WordPress/ai/pull/63)).
+- Introduce foundational backend support for Content Summarization and Image Generation experiments (API-only; no UI yet) ([#134](https://github.com/WordPress/ai/pull/134), [#136](https://github.com/WordPress/ai/pull/136)).
+- Improve plugin documentation and onboarding with expanded WP.org readme content ([#135](https://github.com/WordPress/ai/pull/135)).
+- Add Playground preview support to build and PR workflows using the official WordPress action ([#144](https://github.com/WordPress/ai/pull/144)).
 
 ### Changed
-– Rely on the Abilities API bundled with WordPress 6.9 and remove the previously bundled dependency (minimum WP version updated) ([#107](https://github.com/WordPress/ai/pull/107)).
-– Reorganize Playground blueprints and update demo paths to align with WordPress.org conventions ([#137](https://github.com/WordPress/ai/pull/137)).
-– Improve and clarify plugin documentation, descriptions, screenshots, and in-context messaging ([#69](https://github.com/WordPress/ai/pull/69), [#158](https://github.com/WordPress/ai/pull/158), [#161](https://github.com/WordPress/ai/pull/161), [#162](https://github.com/WordPress/ai/pull/162), [#164](https://github.com/WordPress/ai/pull/164)).
-– Update and align runtime and development dependencies, including `preact`, `qs`, `express`, and React overrides ([#165](https://github.com/WordPress/ai/pull/165), [#166](https://github.com/WordPress/ai/pull/166), [#171](https://github.com/WordPress/ai/pull/171)).
-– Replace custom Plugin Check setup with the official GitHub workflow for more reliable enforcement ([#139](https://github.com/WordPress/ai/pull/139)).
+- Rely on the Abilities API bundled with WordPress 6.9 and remove the previously bundled dependency (minimum WP version updated) ([#107](https://github.com/WordPress/ai/pull/107)).
+- Reorganize Playground blueprints and update demo paths to align with WordPress.org conventions ([#137](https://github.com/WordPress/ai/pull/137)).
+- Improve and clarify plugin documentation, descriptions, screenshots, and in-context messaging ([#69](https://github.com/WordPress/ai/pull/69), [#158](https://github.com/WordPress/ai/pull/158), [#161](https://github.com/WordPress/ai/pull/161), [#162](https://github.com/WordPress/ai/pull/162), [#164](https://github.com/WordPress/ai/pull/164)).
+- Update and align runtime and development dependencies, including `preact`, `qs`, `express`, and React overrides ([#165](https://github.com/WordPress/ai/pull/165), [#166](https://github.com/WordPress/ai/pull/166), [#171](https://github.com/WordPress/ai/pull/171)).
+- Replace custom Plugin Check setup with the official GitHub workflow for more reliable enforcement ([#139](https://github.com/WordPress/ai/pull/139)).
 
 ### Fixed
-– Resolve UI and messaging issues on the AI Experiments settings screen ([#130](https://github.com/WordPress/ai/pull/130), [#132](https://github.com/WordPress/ai/pull/132)).
-– Ensure AI Experiments are visible even when no credentials are configured ([#173](https://github.com/WordPress/ai/pull/173)).
-– Fix Plugin Check, linting, and CI failures introduced by updated tooling and workflows ([#150](https://github.com/WordPress/ai/pull/150), [#163](https://github.com/WordPress/ai/pull/163), [#167](https://github.com/WordPress/ai/pull/167), [#176](https://github.com/WordPress/ai/pull/176)).
+- Resolve UI and messaging issues on the AI Experiments settings screen ([#130](https://github.com/WordPress/ai/pull/130), [#132](https://github.com/WordPress/ai/pull/132)).
+- Ensure AI Experiments are visible even when no credentials are configured ([#173](https://github.com/WordPress/ai/pull/173)).
+- Fix Plugin Check, linting, and CI failures introduced by updated tooling and workflows ([#150](https://github.com/WordPress/ai/pull/150), [#163](https://github.com/WordPress/ai/pull/163), [#167](https://github.com/WordPress/ai/pull/167), [#176](https://github.com/WordPress/ai/pull/176)).
 
 ### Developer
-– Cleanup and standardize scaffold, linting, TypeScript, and CI configuration to better align with WordPress Coding Standards ([#172](https://github.com/WordPress/ai/pull/172)).
+- Cleanup and standardize scaffold, linting, TypeScript, and CI configuration to better align with WordPress Coding Standards ([#172](https://github.com/WordPress/ai/pull/172)).
 
 ## [0.1.1] - 2025-12-01
 ### Added
@@ -64,5 +80,7 @@ First public release of the AI Experiments plugin, introducing a framework for e
 - Utilities Ability for common AI tasks and testing
 
 [Unreleased]: https://github.com/wordpress/ai/compare/trunk...develop
+[0.2.1]: https://github.com/wordpress/ai/compare/0.2.0...0.2.1
+[0.2.0]: https://github.com/wordpress/ai/compare/0.1.1...0.2.0
 [0.1.1]: https://github.com/wordpress/ai/compare/0.1.0...0.1.1
 [0.1.0]: https://github.com/wordpress/ai/tree/0.1.0

CONTRIBUTING.md

@@ -142,7 +142,7 @@ This issue is for tracking changes for the X.Y.Z release.  Target release date:
 
 - [ ] Review and merge #.
 
-## [Release steps](https://github.com/wordpress/ai/blob/develop/CONTRIBUTING.md#release-instructions)
+## [Release steps](https://github.com/WordPress/ai/blob/develop/CONTRIBUTING.md#release-instructions)
 
 - [ ] Branch: Starting from `develop`, cut a release branch named `release/X.Y.Z` for your changes.
 - [ ] Version bump: Bump the version number in `ai.php`, `package-lock.json`, and `readme.txt` if it does not already reflect the version being released.  In `includes/bootstrap.php`, ensure you're updating the `AI_EXPERIMENTS_VERSION` version constant.
@@ -153,14 +153,14 @@ This issue is for tracking changes for the X.Y.Z release.  Target release date:
 - [ ] New files: Check to be sure any new files/paths that are unnecessary in the production version are included in `.gitattributes`.
 - [ ] Merge: Make a non-fast-forward merge from your release branch to `develop` (or merge the pull request), then do the same for `develop` into `trunk` (`git checkout trunk && git merge --no-ff develop`).  `trunk` now contains the stable development version.
 - [ ] Push: Push your trunk branch to GitHub (e.g. `git push origin trunk`).
-- [ ] [Wait for build](https://xkcd.com/303/): Head to the [Actions](https://github.com/wordpress/ai/actions) tab in the repo and wait for it to finish if it hasn't already.  If it doesn't succeed, figure out why and start over.
+- [ ] [Wait for build](https://xkcd.com/303/): Head to the [Actions](https://github.com/WordPress/ai/actions) tab in the repo and wait for it to finish if it hasn't already.  If it doesn't succeed, figure out why and start over.
 - [ ] Check the build: Check out the `trunk` branch and test for functionality locally.
 - [ ] Test: Check the [end-to-end tests](https://github.com/WordPress/ai/actions/workflows/test.yml) are passing.  Only proceed if everything tests successfully.
-- [ ] Release: Create a [new release](https://github.com/wordpress/ai/releases/new), naming the tag and the release with the new version number, and targeting the `trunk` branch.  Paste the changelog for the release from [`CHANGELOG.md`](https://github.com/WordPress/ai/blob/develop/CHANGELOG.md) into the body of the release and include a link to `[View all items closed in the milestone](https://github.com/wordpress/ai/milestone/#?closed=1)`.  The release should now appear under [releases](https://github.com/wordpress/ai/releases).
+- [ ] Release: Create a [new release](https://github.com/WordPress/ai/releases/new), naming the tag and the release with the new version number, and targeting the `trunk` branch.  Paste the changelog for the release from [`CHANGELOG.md`](https://github.com/WordPress/ai/blob/develop/CHANGELOG.md) into the body of the release and include a link to `[View all items closed in the milestone](https://github.com/WordPress/ai/milestone/#?closed=1)`.  The release should now appear under [releases](https://github.com/WordPress/ai/releases).
 
 ## Post-release steps
 
-- [ ] Close milestone: Edit the [milestone](https://github.com/wordpress/ai/milestone/#) with release date (in the `Due date (optional)` field) and link to GitHub release (in the `Description field`), then close the milestone.
+- [ ] Close milestone: Edit the [milestone](https://github.com/WordPress/ai/milestone/#) with release date (in the `Due date (optional)` field) and link to GitHub release (in the `Description field`), then close the milestone.
 - [ ] Punt incomplete items: If any open issues or PRs which were milestoned for `X.Y.Z` do not make it into the release, update their milestone to `X.Y.Z+1`, `X.Y+1.0`, `X+1.0.0` or `Future Release`.
 - [ ] Announce: Publish release announcement post on Make/AI, cross-posting to Make/Core and Make/Test ([example](https://make.wordpress.org/ai/2025/11/27/announcing-the-ai-experiments-plugin-v0-1-0/)).
 - [ ] Profile badges: Grant new contributors the `Core AI Contributor` [profile badge](https://make.wordpress.org/ai/wp-admin/tools.php?page=profile-badges).

CREDITS.md

@@ -12,7 +12,7 @@ The following individuals are responsible for curating the list of issues, respo
 
 Thank you to all the people who have already contributed to this repository via bug reports, code, design, ideas, project management, translation, testing, etc.
 
-[Darin Kotter (@dkotter)](https://github.com/dkotter), [Jeffrey Paul (@jeffpaul)](https://github.com/jeffpaul), [Jason Adams (@JasonTheAdams)](https://github.com/JasonTheAdams), [Dovid Levine (@justlevine)](https://github.com/justlevine),[Md Aminul Islam (@theaminuli)](https://github.com/theaminuli), [Felix Arntz (@felixarntz)](https://github.com/felixarntz), [Jonathan Desrosiers (@desrosj)](https://github.com/desrosj), [Mohamed Khaled (@Ref34t)](https://github.com/Ref34t), [Iqbal Hossain (iqbal-web)](https://github.com/iqbal-web), [Lina Wiezkowiak (@linawiezkowiak)](https://github.com/linawiezkowiak), [Rachael Cortellessa (@rachaelcortellessa)](https://github.com/rachaelcortellessa), [James LePage (@Jameswlepage)](https://github.com/Jameswlepage), [Tammie Lister (@karmatosed)](https://github.com/karmatosed), [Aki Hamano (@t-hamano)](https://github.com/t-hamano), [Blake Bertuccelli-Booth (@bbertucc)](https://github.com/bbertucc), [Mujeebu Rahman (@mujuonly)](https://github.com/mujuonly), [Mukesh Panchal (@mukeshpanchal27)](https://github.com/mukeshpanchal27), [Pascal Birchler (@swissspidy)](https://github.com/swissspidy), [Dhruvang Shah (@dhruvang21)](https://github.com/dhruvang21), [Aslam Doctor (@aslamdoctor)](https://github.com/aslamdoctor), [John Parris (@mindctrl)](https://github.com/mindctrl), [James Morrison (@jamesmorrison)](https://github.com/jamesmorrison), [Paul Bearne (@pbearne)](https://github.com/pbearne), [Matt Cromwell (@mathetos)](https://github.com/mathetos), [Huzaifa Al Mesbah (@huzaifaalmesbah)](https://github.com/huzaifaalmesbah), [Mehraz Morshed (@mehrazmorshed)](https://github.com/mehrazmorshed), [JuanMa Garrido (@juanmaguitar)](https://github.com/juanmaguitar), [Adam Zieliński (@adamziel)](https://github.com/adamziel), [Weston Ruter (@westonruter)](https://github.com/westonruter), [Jonathan Bossenger (@jonathanbossenger)](https://github.com/jonathanbossenger).
+[Darin Kotter (@dkotter)](https://github.com/dkotter), [Jeffrey Paul (@jeffpaul)](https://github.com/jeffpaul), [Jason Adams (@JasonTheAdams)](https://github.com/JasonTheAdams), [Dovid Levine (@justlevine)](https://github.com/justlevine),[Md Aminul Islam (@theaminuli)](https://github.com/theaminuli), [Felix Arntz (@felixarntz)](https://github.com/felixarntz), [Jonathan Desrosiers (@desrosj)](https://github.com/desrosj), [Mohamed Khaled (@Ref34t)](https://github.com/Ref34t), [Iqbal Hossain (iqbal-web)](https://github.com/iqbal-web), [Lina Wiezkowiak (@linawiezkowiak)](https://github.com/linawiezkowiak), [Rachael Cortellessa (@rachaelcortellessa)](https://github.com/rachaelcortellessa), [James LePage (@Jameswlepage)](https://github.com/Jameswlepage), [Tammie Lister (@karmatosed)](https://github.com/karmatosed), [Aki Hamano (@t-hamano)](https://github.com/t-hamano), [Blake Bertuccelli-Booth (@bbertucc)](https://github.com/bbertucc), [Mujeebu Rahman (@mujuonly)](https://github.com/mujuonly), [Mukesh Panchal (@mukeshpanchal27)](https://github.com/mukeshpanchal27), [Pascal Birchler (@swissspidy)](https://github.com/swissspidy), [Dhruvang Shah (@dhruvang21)](https://github.com/dhruvang21), [Aslam Doctor (@aslamdoctor)](https://github.com/aslamdoctor), [John Parris (@mindctrl)](https://github.com/mindctrl), [James Morrison (@jamesmorrison)](https://github.com/jamesmorrison), [Paul Bearne (@pbearne)](https://github.com/pbearne), [Matt Cromwell (@mathetos)](https://github.com/mathetos), [Huzaifa Al Mesbah (@huzaifaalmesbah)](https://github.com/huzaifaalmesbah), [Mehraz Morshed (@mehrazmorshed)](https://github.com/mehrazmorshed), [JuanMa Garrido (@juanmaguitar)](https://github.com/juanmaguitar), [Adam Zieliński (@adamziel)](https://github.com/adamziel), [Weston Ruter (@westonruter)](https://github.com/westonruter), [Jonathan Bossenger (@jonathanbossenger)](https://github.com/jonathanbossenger), [Juan Aldasoro (@juanfra)](https://github.com/juanfra), [Casey Manos (@caseymanos)](https://github.com/caseymanos), [Stephanie Walters (@PypWalters)](https://github.com/PypWalters).
 
 ## Libraries
 

ai.php

@@ -11,7 +11,7 @@
  * Plugin Name:       AI Experiments
  * Plugin URI:        https://github.com/WordPress/ai
  * Description:       AI experiments and capabilities for WordPress.
- * Version:           0.2.0
+ * Version:           0.2.1
  * Requires at least: 6.9
  * Requires PHP:      7.4
  * Author:            WordPress.org Contributors

docs/DEVELOPER_GUIDE.md

@@ -37,8 +37,6 @@ cd ai
 composer install && npm i && npm run build
 ```
 
-> **Note:** The `wordpress/wp-ai-client` package will be added to `composer.json` once it's officially released. For now, the plugin scaffolding is ready for integration.
-
 3. **Activate the plugin:**
 
 Through WordPress admin or via WP-CLI:

docs/experiments/excerpt-generation.md

@@ -94,7 +94,7 @@ The ability checks permissions based on the input:
 
 - **If `context` is a post ID:**
   - Verifies the post exists
-  - Checks `current_user_can( 'read_post', $post_id )`
+  - Checks `current_user_can( 'edit_post', $post_id )`
   - Ensures the post type has `show_in_rest` enabled
 
 - **If `context` is not a post ID:**
@@ -376,7 +376,7 @@ npm run test:php
 
 ### AI Model Selection
 
-- The ability uses `get_preferred_models()` to determine which AI models to use
+- The ability uses `get_preferred_models_for_text_generation()` to determine which AI models to use
 - Models are tried in order until one succeeds
 - Temperature is set to 0.7 for consistent but creative results
 

includes/Abilities/Excerpt_Generation/Excerpt_Generation.php

@@ -14,7 +14,7 @@
 use WordPress\AI_Client\AI_Client;
 
 use function WordPress\AI\get_post_context;
-use function WordPress\AI\get_preferred_models;
+use function WordPress\AI\get_preferred_models_for_text_generation;
 use function WordPress\AI\normalize_content;
 
 /**
@@ -148,8 +148,8 @@ protected function permission_callback( $args ) {
 				);
 			}
 
-			// Ensure the user has permission to read this particular post.
-			if ( ! current_user_can( 'read_post', $post_id ) ) {
+			// Ensure the user has permission to edit this particular post.
+			if ( ! current_user_can( 'edit_post', $post_id ) ) {
 				return new WP_Error(
 					'insufficient_capabilities',
 					esc_html__( 'You do not have permission to generate excerpts for this post.', 'ai' )
@@ -229,7 +229,7 @@ static function ( $key, $value ) {
 		return AI_Client::prompt_with_wp_error( $content )
 			->using_system_instruction( $this->get_system_instruction() )
 			->using_temperature( 0.7 )
-			->using_model_preference( ...get_preferred_models() )
+			->using_model_preference( ...get_preferred_models_for_text_generation() )
 			->generate_text();
 	}
 }

includes/Abilities/Summarization/Summarization.php

@@ -14,7 +14,7 @@
 use WordPress\AI_Client\AI_Client;
 
 use function WordPress\AI\get_post_context;
-use function WordPress\AI\get_preferred_models;
+use function WordPress\AI\get_preferred_models_for_text_generation;
 use function WordPress\AI\normalize_content;
 
 /**
@@ -164,8 +164,8 @@ protected function permission_callback( $args ) {
 				);
 			}
 
-			// Ensure the user has permission to read this particular post.
-			if ( ! current_user_can( 'read_post', $post_id ) ) {
+			// Ensure the user has permission to edit this particular post.
+			if ( ! current_user_can( 'edit_post', $post_id ) ) {
 				return new WP_Error(
 					'insufficient_capabilities',
 					esc_html__( 'You do not have permission to summarize this post.', 'ai' )
@@ -246,7 +246,7 @@ static function ( $key, $value ) {
 		return AI_Client::prompt_with_wp_error( $content )
 			->using_system_instruction( $this->get_system_instruction( 'system-instruction.php', array( 'length' => $length ) ) )
 			->using_temperature( 0.9 )
-			->using_model_preference( ...get_preferred_models() )
+			->using_model_preference( ...get_preferred_models_for_text_generation() )
 			->generate_text();
 	}
 }