Agentic Commerce for WooCommerce

The full machine-readable changelog lives at install.xpay.sh/woocommerce/CHANGELOG.md (Keep-a-Changelog format). The summary below is the WP.org-required mirror.

0.3.5

• New: /agents.md agent skill. A dedicated, machine-readable skill served at yourstore.com/agents.md that tells AI shopping agents (and skill-using assistants) exactly how to connect to your store: browse the live catalog over MCP or REST, look products up, and build a cart that hands the shopper off to your existing checkout. This is purpose-written connect-and-transact instructions — not a copy of /llms.txt. Served only once your store is connected; like our other discovery files it skips quietly if you already publish your own /agents.md.
• Safer /llms.txt merge (bug fix). When appending to an existing /llms.txt, the plugin now ignores non-text responses. Hybrid/headless storefronts and single-page themes that answer every URL with an HTML page no longer get that page pulled in as bogus “existing content” above our agent-shopping sections.
• Catalog link points at your branded agent surface. The /llms.txt catalog link now uses your store’s own agent-commerce surface instead of the shared feed host (same data, your brand).
• Optional AI shopping-bot routing. Realtime AI shopping assistants can be transparently routed to your structured catalog surface for cleaner, faster product data, while search/indexing crawlers stay on your store for citations. Centrally controlled and off by default — nothing changes for your site until xpay enables it for your store; it never affects humans, logged-in users, your cart, or checkout.

0.3.4

• Friendlier Connect screen. The pre-connect panel now leads with what you get — your products discoverable to ChatGPT, Claude, Gemini and Perplexity, with no code and no payment change — instead of a wall of acronyms. The technical detail (llms.txt, schema.org, ACP/UCP/AP2/MCP) is still there, moved to a small footnote.
• Upfront safety promise. The Connect screen now states plainly what this update verified end-to-end: the plugin never writes files to your site, doesn’t touch your theme or payments, appends to any existing /llms.txt rather than replacing it, and fully reverts the moment you deactivate.
• New transparency panel. Once connected, the General tab lists every external service the plugin contacts (agent-feed.xpay.sh, agent-commerce.xpay.sh, app.xpay.sh) and what each receives, alongside the Terms and Privacy links.
• Clearer telemetry opt-in. The anonymous-diagnostics prompt now explains the benefit to you — we can catch a silently broken AI connection (failed sync, blocked endpoint) before your products drop out of ChatGPT, Claude and Perplexity. Still off by default, still no customer or order data, still changeable any time.

0.3.3

• New: Run site diagnostics (Tools tab). One click loopback-checks the three things that silently block a connection at the web-server layer before WordPress even runs: the WordPress REST API (Pretty Permalinks), the plugin’s own REST routes, and the /.well-known/ discovery files. Each check shows a pass/fail with the HTTP status, and a failure gives you the exact fix — e.g. switch Permalinks off “Plain”, or (on Apache/ACME hosts that reserve /.well-known/) the query-arg fallback URL that agents can still use.
• No behaviour change to the connect flow itself. Diagnostics are network-only on the explicit button click; the Settings page still makes zero outbound calls on render.

0.3.2

• Good neighbour with other AI/SEO plugins. If your site already publishes its own llms.txt (for example via Yoast SEO AI, RankMath AI, AIOSEO, or your own setup), we now add our agent-shopping sections at the end of your file instead of replacing it. Everything you wrote is preserved exactly as you wrote it.
• Automatic detection. The plugin checks once a day whether another tool has started publishing one of the same discovery files we do. When it sees one, we step aside or append cleanly — no merchant action needed.
• Smoother connect experience. A handful of polish items in the Connect flow so the handshake is quicker and any stray retry doesn’t show up as a misleading error.
• Live updates from xpay. Once you’re connected, xpay can fine-tune small parts of your discovery setup (like an extra section of seasonal promotions on your llms.txt) without you needing to install another plugin update. Fully optional and reversible — nothing changes unless you tell us to or we both agree.

0.3.1

• REST endpoints constructed via rest_url(). The fallback UCP manifest now calls rest_url(‘xpay/ucp/v1’) / rest_url(‘xpay/mcp’) instead of hardcoding home_url(‘/wp-json/…’), so the plugin respects sites that customize the REST prefix. Per the WP.org Determining Locations guideline.
• Tested against WordPress 7.0 + WooCommerce 10.8.1 on a clean sandbox with WP_DEBUG=true.

0.3.0

• Privacy: no outbound calls on Settings page load. The Connect panel no longer pre-registers a nonce with the xpay backend when the page renders. The nonce is generated, the attempt is stamped, and the merchant is redirected to the xpay onboarding flow only after the Connect store button is clicked. Matches WordPress.org’s no-phoning-home guideline.
• Requires Plugins: woocommerce header. Declares the WooCommerce dependency via the WP 6.5 plugin-dependencies mechanism so the plugin won’t activate without WooCommerce present. Existing manual activation check remains as defence-in-depth for pre-6.5 sites.
• Inline admin script removed. The Connect button no longer emits an inline <script> tag; click-time telemetry is recorded server-side in the redirect handler instead.

0.2.4

• Tabbed Settings → xpay UI. Five tabs replace the single-screen layout: General (status + slug + last sync + disconnect + telemetry opt-in), Capabilities (per-UCP-capability toggles), Payments (map enabled WC gateways to UCP payment_handlers[]), Links (auto-detect privacy/TOS/about/contact/shipping with per-row override), Tools (view UCP profile, view full audit, test connection, refresh catalog now, telemetry debug log toggle). URL is bookmarkable via ?tab=.
• Capability toggles wired into /.well-known/ucp. Switching off any of checkout / fulfillment / discount / order removes the entry from the emitted UCP manifest. Default (no option set) = all enabled, so existing installs don’t regress on upgrade.
• payment_handlers[] now populated from the Payments tab. Each enabled gateway emits as {id, label, type:”merchant_gateway”} so UCP-aware agents can negotiate payment surfaces against the methods you actually accept.
• ucp.links array. Privacy, TOS, About, Contact, Shipping URLs are auto-detected (WordPress privacy_policy_url + common page slugs) and overridable on the Links tab; emitted in the manifest as {rel, href} pairs.

0.2.3

• MCP transport advertised in /.well-known/ucp. Native MCP-speaking agents (Claude, ChatGPT Operator, Shopify AI Toolkit) discover the endpoint at agent-commerce.xpay.sh/mcp/{slug} without further configuration. Three tools available: search_catalog (BM25-ranked over title + description), get_product (lookup by SKU or numeric product ID), create_cart (returns a signed deeplink that pre-populates checkout on your store).
• One-click connect via WooCommerce’s /wc-auth/v1/authorize OAuth. When you click Connect store, the xpay onboarding page opens WooCommerce’s built-in approval popup. You approve there once and WordPress hands xpay read-only API credentials directly — no Settings → Advanced → REST API trip, no copy-paste. The manual paste flow remains available as a fallback.
• Disconnect notifies the backend. Clicking Disconnect now fires a non-blocking DELETE /v1/merchants/{slug} so your account is marked disconnected and the cached agent-feed catalog is archived. Local cleanup happens regardless of whether the backend acks.
• UCP manifest fixes for strict-validator compliance: extends is now an array ([“dev.ucp.shopping.checkout”]) rather than a string per the 2026-04-08 spec; capability spec URLs are uniformly date-prefixed; payment_handlers: [] placeholder added for parity with the ecosystem.
• Clear apology + guidance when a Connect attempt fails. If you start a Connect flow but the handshake doesn’t complete, the Settings → xpay page now shows an explicit apology and a clear “click Connect again” CTA, and our ops team is notified automatically so we can recover if anything weird happens.

0.2.2

• Fixed onboarding-finalize 500/timeout that left merchants in a half-provisioned state. The Lambda now has a 15-second timeout and an 8s AbortSignal on the callback fetch into your WordPress site. The nonce is no longer burned until the plugin acknowledges receipt, so a re-click is always safe within the 30-minute TTL. The plugin-side rest_finalize is now idempotent on (slug, api_key) replay. Initial catalog resync moved to wp_schedule_single_event + non-blocking wp_remote_post so the REST response returns in under a second on hosts whose outbound HTTPS to xpay is slow.

0.2.1

• /llms.txt ## Commerce protocols section is now gated on the xpay_wc_protocol_endpoints wp_option (backend-pushed during Connect). Agents that follow a URL from /llms.txt reach a working service or a structured 501 — never a bare 404.
• Companion: backend stubs at agent-commerce.xpay.sh/{ucp,acp,ap2,mcp}/… now return a 501 Not Implemented envelope with protocol, spec, merchant_slug, status, retry_after_seconds, and a docs link.
• Filter xpay_wc_protocol_endpoints lets a mu-plugin override.

0.2.0

• Aligned with the open commerce standards. Per-protocol surfaces (ACP, UCP, AP2, MCP) are now advertised in /llms.txt and hosted on xpay infrastructure. The plugin keeps the merchant’s domain to what genuinely belongs there: discovery files, JSON-LD, robots.txt allowlist.
• NEW: /.well-known/ucp (UCP business profile, spec 2026-04-08). This is the file Google, Shopify, Etsy, Wayfair, Target and Walmart fetch to negotiate capabilities with your store. The plugin generates a sensible default profile pointing at xpay-hosted UCP service endpoints; commercial-tier merchants can override the body + inject JWK signing keys via the xpay_wc_ucp_profile and xpay_wc_ucp_signing_keys options.
• Discovery layer is an extensible emitter registry. Each standard (/llms.txt, /.well-known/ucp, RFC 9728 OAuth metadata, A2A agent-card) is a registered emitter with a default-on/default-off flag and per-merchant override. Adding a new standard means adding a new emitter — no changes elsewhere in the plugin.
• Added watchlist emitters (off by default):
  • /.well-known/oauth-protected-resource (RFC 9728) — turns on automatically when UCP OAuth Identity Linking is enabled for the merchant on the xpay side.
  • /.well-known/agent-card.json (A2A 1.0, IANA-registered 2025-08-01) — opt-in via the xpay_wc_emit_agent_card option once A2A adoption matures in commerce.
• /llms.txt content refresh. Now links the agent-readable catalog, the per-protocol endpoints (ACP / UCP / AP2 / MCP), the cart-deeplink template, and top product categories. Markdown structure follows the llmstxt.org convention.
• Admin readiness checklist updated to reflect the standards-based architecture — the “AI assistants know where to send a buyer” row now points at the per-protocol endpoints listed in /llms.txt, not at a single discovery file.
• No breaking changes for merchants. Cart deeplink, catalog feed, JSON-LD injection, robots.txt allowlist, telemetry pipe and the WC REST onboarding flow are unchanged. The audit-readiness pills continue to all turn green after Connect.

0.1.12

• Plugin renamed to “Agentic Commerce for WooCommerce” (slug agentic-commerce-for-woocommerce).
  • Why: the previous name “xpay for WooCommerce” was rejected at WordPress.org submission as too similar to Nexi XPay (an established Italian payment-gateway plugin for WC by Nexi Payments, ~6,000 installs since 2017). WordPress.org’s similarity check matches on the brand string regardless of category, and Nexi has prior art.
  • What changed: Plugin Name header, Text Domain (agentic-commerce-for-woocommerce), main file name (agentic-commerce-for-woocommerce.php), /languages/agentic-commerce-for-woocommerce.pot, admin page slug, plugin folder name inside the zip. User-Agent header for outbound HTTP. Settings page H1.
  • What didn’t change: the product, the architecture, the xpay brand identity (still the author + still in admin nav as “xpay”), backend services (agent-feed.xpay.sh, agent-commerce.xpay.sh, etc.), or anything else functional.

0.1.11

• Cleared 4 PCP PrefixAllGlobals warnings:
  • uninstall.php now runs in an anonymous-closure IIFE — no top-level $option_keys / $key globals.
  • class-xpay-schema.php :: render_product() uses a local $xpay_product and skips the global $product declaration entirely. Direct wc_get_product(get_the_ID()) works on PDPs without WC’s template-loop side effect.
  • class-xpay-plugin.php :: woocommerce_active() uses raw get_option(‘active_plugins’) + multisite merge + class_exists(‘WooCommerce’) instead of filtering WP core’s active_plugins hook. Same behavior, no false-positive.

0.1.10

• Tested up to WordPress 6.9 (PCP flagged 6.7 as below current). No code changes — verified compatibility on a real WC 9.x install.
• Short description trimmed to 141 chars (PCP cap is 150).
• Removed load_plugin_textdomain() call. Discouraged since WP 4.6 — WordPress.org-hosted plugins get translations loaded automatically by core via the plugin slug.
• Excluded non-canonical markdown files (INSTAWP_TEST_WALKTHROUGH.md, README.md) from the release zip. The plugin zip should only contain files needed at runtime; READMEs and walkthroughs are repo-only.

0.1.9

• Documentation URLs migrated docs.xpay.sh/products/woocommerce/* → docs.xpay.sh/merchants/woocommerce/*. Merchants is the bucket; WooCommerce is one (of many future) integrations inside it. Future Shopify / BigCommerce docs will live as siblings.
• No plugin functionality changed — readme + admin-UI links updated.

0.1.8

• Punchier Description hero — leads with the buyer-side framing (“Your next customer is asking ChatGPT, not Google”) instead of an abstract claim.
• Pricing link updated everywhere to https://www.xpay.sh/pricing/?tab=agentic-commerce.
• New documentation site at docs.xpay.sh/merchants/woocommerce — multi-page walkthrough covering install, WC REST API key generation, connect flow, privacy & telemetry, audit readiness checklist, and a troubleshooting guide. readme backlinks the docs at the right moments.
• GitHub backlinks throughout the readme + FAQ (issue tracker, source browse).

0.1.7

• xpaysh/xpay-for-woocommerce GitHub repo flipped public. Restored repo link references in readme.txt FAQ and “Source code” section so reviewers and merchants can browse the unminified source directly. GPLv2-or-later unchanged.

0.1.6

• Removed GitHub repo link references from readme.txt to avoid a broken-link impression for reviewers (the source repo was private). Plugin is still GPLv2-or-later — the zip is the canonical, unminified source.

0.1.5

• Query-arg fallback for the discovery file: hosts that intercept /.well-known/ (some shared hosts, CDN edges, ACME setups) can now serve the discovery file at /?xpay_route=acp. Discoverable via the Link header on the home page.
• Post-activation redirect to Settings → xpay now fires on any activation when the store hasn’t connected yet, not only on the very first activation. Skipped on bulk-activate.

0.1.4

• WC HPOS + Cart/Checkout Blocks compatibility declared.
• First-activation redirect to Settings → xpay.
• Privacy + Terms pages at install.xpay.sh/woocommerce/{privacy,terms}.html.
• Plugin URI: xpay.sh/sellers/woocommerce → www.xpay.sh/merchants/woocommerce/.

0.1.3

• PHPCS WordPress-standard clean: 0 errors / 1 cosmetic warning.
• phpcs.xml.dist ruleset added.
• languages/xpay-for-woocommerce.pot generated.
• WP.org listing assets (banner / icon / 5 screenshots).

0.1.2

• Slug renamed xpay-woocommerce → xpay-for-woocommerce (Guideline 17).
• Telemetry now opt-in via first-activation admin notice; default OFF (Guideline 7).
• Settings → xpay → Privacy toggle.
• readme.txt External services and Privacy sections added.

0.1.1

• Fire-and-forget lifecycle telemetry pipe (was always-opt-out; reworked to opt-in in 0.1.2).

0.1.0

• Initial release. WP plugin scaffold; /llms.txt and /.well-known/agentic-commerce.json; JSON-LD on PDP / shop / home; robots.txt allowlist; cart-deeplink handler; webhook-driven resync; admin page with connect flow and audit-readiness checklist.