# WordPress Plugin Development Agent

Agent: `wordpress-plugin-agent`
Project: `translate-press-zone`

Workflow
- Load `wordpress-php-integration` first for every implementation task.
- Load only additional required skills.
- Keep implementation in one agent context.
- Never write tests or temporary files to root folder, write them to ./tests/ and ./tmp/
- Never write documentation into the root folder or code folders unless instructed to, write it into ./docs/ 

Skills
- `wordpress-php-integration`
- `database-operations`
- `frontend-javascript`
- `frontend-styling-scss`
- `settings-management`
- `admin-panel-fullstack`
- `api-integration`
- `users-permissions`
- `wpml-integration`
- `backend-integration`
- `verification`

Loading marker
- `[LOADED SKILLS: wordpress-php-integration, ...]`

Task mapping
- PHP/hooks/templates/security: `wordpress-php-integration`
- DB/schema/migrations/queries: `database-operations`
- JS/AJAX/DOM/a11y events: `frontend-javascript`
- SCSS/dark mode/responsive/a11y styles: `frontend-styling-scss`
- Options/forms/secret storage: `settings-management`
- Admin views/components/routes: `admin-panel-fullstack`
- External API/webhooks/rate limits: `api-integration`
- Roles/capabilities/route auth: `users-permissions`
- WPML bridge/provider hooks: `wpml-integration`
- Backend infrastructure/API keys/testing: `backend-integration`
- Playwright E2E testing/visual verification: `verification`

Release gates
- `presszone_translate_` prefix and `translate-press-zone` text domain
- Input sanitization + output escaping
- Nonce + capability checks
- No inline CSS (PHP views, JS `el()` calls, `.style.*` assignments — all banned)
- Accessibility requirements met (label/for pairs, aria-controls on tabs, tabpanel roles, focus traps)
- All outbound HTTP uses `wp_safe_remote_*` (never `wp_remote_*`)
- No unconditional `error_log()` — must be behind `WP_DEBUG` check
- No `esc_sql()` — only `$wpdb->prepare()`
- No duplicate `@keyframes` — use canonical `presszone-multilingual-spin`
- No deprecated ARIA (`aria-grabbed`, `aria-dropeffect`)
- Webhook HMAC in `permission_callback`, not handler body
- `wp_kses` allowlists never include `'style' => true`
- `uninstall.php` covers ALL options (audit every `update_option`/`add_option`)
- Health endpoints require `manage_options`, not `is_user_logged_in`
- `return` after every `wp_send_json_error()`/`wp_send_json_success()`
- Column allowlist on all `$wpdb->update()` calls
- **NEVER write standard CSS files, always use SCSS (.scss)**
- **ALWAYS rebuild assets after SCSS changes (`npm run build`)**

Build
- `npm run build:css`
- `cd admin && npm run build`