Merge audit/wpcs-modernization: security fix + WPCS/PHP 8.3 modernization

Author: ifahimreza

.github/workflows/ci.yml

@@ -0,0 +1,42 @@
+name: CI
+
+on:
+  push:
+    branches: [ main, master ]
+  pull_request:
+
+jobs:
+  lint:
+    name: PHPCS (WPCS + PHP compat)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.3'
+          coverage: none
+          tools: composer
+      - name: Install dependencies
+        run: composer install --no-interaction --no-progress
+      - name: Lint
+        run: composer lint
+
+  test:
+    name: PHPUnit (PHP ${{ matrix.php }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        php: [ '8.1', '8.2', '8.3' ]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php }}
+          coverage: none
+          extensions: pdo, sqlite3, pdo_sqlite
+          tools: composer
+      - name: Install dependencies
+        run: composer install --no-interaction --no-progress
+      - name: Test
+        run: composer test

admin/build/index.asset.php

@@ -1 +1 @@
-<?php return array('dependencies' => array('react', 'wp-api-fetch', 'wp-components', 'wp-element', 'wp-i18n'), 'version' => '06ce75edc13b6a24cc84');
+<?php return array('dependencies' => array('react', 'wp-api-fetch', 'wp-components', 'wp-element', 'wp-i18n'), 'version' => 'd51e160d34e478fb3cd6');

admin/build/index.js

@@ -94,9 +94,14 @@ function buildConfig( app, password ) {
 	const header = `Authorization: Basic ${ auth }`;
 
 	switch ( app ) {
-		// One CLI command, native HTTP transport.
+		// One CLI command, native HTTP transport. User scope, not the default
+		// local scope: local binds the server to the exact directory string the
+		// command runs in, so it silently fails to load from any other folder
+		// (or even the same folder reached via different path casing). A site
+		// credential belongs to the user, not to whatever cwd they happened to
+		// be in — user scope makes "run claude in any folder" actually true.
 		case 'claude-code':
-			return `claude mcp add ${ SLUG } --transport http ${ MCP_URL } \\\n  --header "${ header }"`;
+			return `claude mcp add ${ SLUG } --scope user --transport http ${ MCP_URL } \\\n  --header "${ header }"`;
 
 		// ChatGPT connects by URL from its Connectors screen — hand over the
 		// address and the sign-in details as plain fields to fill in.

admin/src/components/ConnectWizard.jsx

@@ -9,14 +9,20 @@
 	"require-dev": {
 		"phpunit/phpunit": "^9.6",
 		"wp-phpunit/wp-phpunit": "^6.9",
-		"yoast/phpunit-polyfills": "^2.0"
+		"yoast/phpunit-polyfills": "^2.0",
+		"wp-coding-standards/wpcs": "^3.1",
+		"phpcompatibility/phpcompatibility-wp": "^2.1",
+		"dealerdirect/phpcodesniffer-composer-installer": "*"
 	},
 	"config": {
 		"allow-plugins": {
-			"composer/installers": true
+			"composer/installers": true,
+			"dealerdirect/phpcodesniffer-composer-installer": true
 		}
 	},
 	"scripts": {
-		"test": "phpunit"
+		"test": "phpunit",
+		"lint": "phpcs",
+		"lint:fix": "phpcbf"
 	}
 }