radar: improve wordpress:plugin-update v1.1.0

[masoudgolchin]

Opened by the Skill Analyzer — week 2026-W32. Human review is the gate; nothing merges on its own.

Action: improve wordpress:plugin-update → v1.1.0 (minor)
Change: Fixed five plugin-update template bugs: base64 SSH quoting, baseline-delta health, bounded networkidle, MultiSite routes, and premium-plugin pinning.

Why this decision was made: Five concrete template bugs from workweek fork that each defeat the QA harness: base64 wp-cli, baseline-delta health, networkidle timeout, MultiSite routes, premium-plugin pin. Push fix back to fork.

The problems that caused it — every quote below was checked character-for-character against the real session transcript before this decision was made:

1. [F-057] The skill gave wrong instructions — had to be redone · local:plugin-update — session 47954600 · workweek-website · skill.failed
   • What happened: The skill's shared SSH transport (config.mjs) breaks on WP Engine's managed SSH gateway, which strips one layer of quoting, silently breaking the data-integrity HARD gate and admin-session minting.
   • Their words (verbatim, verified against the transcript): "This silently broke data-integrity.mjs, which is a HARD rollback gate, and mint-admin-session.mjs entirely."
   • Smallest fix the judge saw: Document that remote wp-cli commands must be base64-encoded (not raw-quoted) since managed hosts like WP Engine re-parse and strip quoting, and note this in the Preflight/SSH section.
2. [F-058] The skill gave wrong instructions — had to be redone · local:plugin-update — session 47954600 · workweek-website · skill.failed
   • What happened: The shipped health.spec.ts template gates on an absolute zero JS-error count instead of baseline-delta, so pre-existing site errors would cause every future plugin update to auto-rollback.
   • Their words (verbatim, verified against the transcript): "This site has two pre-existing ones (Unexpected token ';' and analytics is not defined), so every plugin update would have auto-rolled-back."
   • Smallest fix the judge saw: Instruct Setup to make the health check baseline-delta like the broken-links check, comparing against a captured pre-existing-errors baseline rather than asserting zero.
3. [F-059] The skill gave wrong instructions — had to be redone · local:plugin-update — session 47954600 · workweek-website · skill.failed
   • What happened: The shipped visual.spec.ts template waits on an unbounded networkidle load state, so pages with streaming/podcast embeds hang until the full 90s test timeout instead of falling through.
   • Their words (verbatim, verified against the transcript): "Found it: line 23 waits for networkidle with no timeout, so the .catch() can never fire within the test window — it hangs until the 90s test timeout."
   • Smallest fix the judge saw: Bound waitForLoadState("networkidle") with an explicit timeout in the shipped visual.spec.ts template so pages with persistent connections don't stall the whole test budget.
4. [F-060] The skill is missing a step — had to be redone · local:plugin-update — session 47954600 · workweek-website · skill.missing-instruction
   • What happened: Setup's route-discovery step (S5) only samples the main site's sitemap, leaving all subsites of a MultiSite network unQA'd — a plugin update could break 12 microsites and still pass green.
   • Their words (verbatim, verified against the transcript): "A plugin update that broke a creator microsite would pass QA completely green."
   • Smallest fix the judge saw: Add a Setup step to detect MultiSite (wp site list) and require at least one baseline route per distinct subsite/theme, not just the main site's sitemap.
5. [F-061] The skill is missing a step — slowed down · local:plugin-update — session 47954600 · workweek-website · skill.missing-instruction
   • What happened: E6's version-pinned wp plugin update <slug> --version=<to> assumes wordpress.org-hosted plugins; it fails outright for premium/off-directory plugins like Gravity Forms, which the skill never flags.
   • Their words (verbatim, verified against the transcript): "Version-pinning routes through the wordpress.org API, and Gravity Forms is premium/off-directory, so there's nothing to pin against."
   • Smallest fix the judge saw: Note in E6 that premium/off-directory plugins can't be version-pinned via WP-CLI's npm registry lookup, and give the unpinned wp plugin update <slug> fallback for that case.

Edits applied (anchored — nothing outside these anchors changed):

• insert_after @ "Prints a version → green. Permission denied (publickey) → the local …"
• insert_after @ "Eyeball the captured PNGs — a baseline of a broken page poisons every …"
• insert_after @ "It finds the sitemap (via robots.txt, falling back to common paths),…"
• insert_after @ "npm run plugin-update:visual # viewport screenshot diff vs co…"
• replace @ "Use the read-back version as <to> for the promotion (E10). One p…"

Size: 37722 → 40125 chars

Expectation (checked automatically next run, written back into CHANGELOG.md):
Plugin-update templates no longer auto-rollback on pre-existing errors, hang on networkidle, or skip subsites/premium plugins.
findings.skill.failed for wordpress:plugin-update: baseline 3 → target 0.

Versions bumped: skill 1.1.0 · wordpress 1.1.1 · marketplace 2.12.2.