# IM-Press v4.6.1+ Backlog

Tracking what landed in v4.6.0 vs. what's queued. Updated 2026-04-28 after
the agent's first + second + third amendments.

## Shipped in v4.6.0 ✅

- HTML importer auto-promotion (`mode=promoted`)
- Restore endpoint + promotion-info endpoint (ModSec-safe URLs, body params)
- `_imp_html_original` blob preservation
- Safe Deploy `template_mode` param (`blank_canvas` / `landing_page` / `theme_page` / `post_content_only`)
- Page render shim (CSS reset on `blank-page.php`, body classes, lifted-asset injection, admin bar suppression on landing pages)
- Static review pages (`/imp-preview/v1/static-review`) — theme-bypass, self-verifying, watermark, expiration
- Media upload wrapper (`/imp-media/v1/upload` multipart with rich URL response)
- OpenAPI `x-im-press-agent-notes` annotations
- Prompt-to-page `template_mode` param
- 4-hitech.info added to deploy fleet + smoke test
- All endpoints listed in OpenAPI spec automatically (verified: 4 imp-preview paths now in spec, cache busted fleet-wide)

## Queued for v4.6.1 — the agent's Second Amendment (post-v4.6.0 review)

### Amendment A — OpenAPI listing for static-review ✅ AUTO-RESOLVED
Already works — adding the namespace to `NAMESPACE_MAP` (which I did) makes it auto-list in the spec. Verified live. Closed.

### Amendment B — Rendered-page health checks (HIGH)
Extend `imp-preview/v1/static-review` self-verification beyond what's there now:
- ✅ Already: HTTP 200, token presence, sentinel words ("Latest Posts", "No posts found", "Page not found", "404")
- TODO: expected title appears in rendered output
- TODO: expected media URL appears in rendered output
- TODO: media URL itself returns 200 (HEAD request before generating page)
- TODO: `<video>` tags have non-empty `src` or valid `<source>` children
- TODO: return a `health` block in the response with `{ ok, warnings[], checked_at }`

### Amendment C — Fail-fast validation errors (HIGH)
- TODO: Pre-flight HEAD check on `video_url` / `image_url` before generating the page. If non-200, refuse and return `media_unreachable` with the URL.
- TODO: Replace freeform `error` strings with structured `error_code` + `message` shape:
  ```json
  { "success": false, "error_code": "video_url_required", "message": "..." }
  ```

### Amendment D — Versioned review packages (MEDIUM)
- TODO: Optional `project_slug` + `version` + `change_note` + `previous_versions[]` fields
- TODO: Deterministic filename: `{project_slug}-v{version}.html` instead of random tokens (or both — token for security, slug for human readability)
- TODO: Optional `latest_review_url` that always points to the highest-versioned review for a slug

### Amendment E — Contrast/readability guidance (MEDIUM)
**Important: NOT a forced "dark and punchy" theme.** Pure guidance, optional.
- TODO: Run optional readability checks on rendered output:
  - text/background contrast (WCAG check)
  - font-size warnings
  - too-much-text-per-card warning
  - Reels safe-zone warning for video previews
  - intro/outro readability

### Amendment F — Agent-safe compact response mode (LOW)
Mostly already done. Don't return rendered HTML by default. If a future endpoint includes rendered output, gate it behind `?include_rendered=true`.

## Queued for v4.6.1 — the agent's First Amendment (pre-v4.6.0)

These items from the original feedback weren't shipped in v4.6.0 because they're
distinct features rather than fixes to the static-review/auto-promote flow.

### #1 — Capabilities endpoint (HIGH)
- TODO: `GET /wp-json/imp-health/v1/capabilities`
  Returns: enabled modules, important routes, OpenAPI status, route cache timestamp, license tier — all in one JSON. Solves the "agent thinks site is on v4.3.1 from a stale cache" problem.

### #2 — OpenAPI ping endpoint (LOW)
- TODO: `GET /wp-json/imp-openapi/v1/ping` — tiny JSON confirmation before fetching the full spec, so an agent can pre-check availability without paying for the full spec body.

### #5 — Public review draft state (HIGH — overlaps Amendment B/C)
- TODO: Token-based draft preview state for unpublished WP pages (separate from static-review which is for static HTML files). For WP pages the agent wants the site owner to review before publishing.

### #6 — Permalink diagnostic (MEDIUM)
- TODO: `GET /wp-json/imp-health/v1/permalink-check?page_id=N`
  Confirms an agent's constructed URL actually serves the post it expects. Catches "API returns 200 but browser shows Latest Posts" before a link is sent to a human.

### #7 — Rollback URL in Safe Deploy response (LOW)
- TODO: Include restore/history links directly in safe-update response (currently agents have to call `/imp-deploy/v1/history/{id}` separately).

### #8 — Agent smoke-test endpoint (HIGH)
- TODO: `GET /wp-json/imp-health/v1/agent-smoke-test`
  Single endpoint that reports: auth ok, Safe Deploy reachable, media writable, OpenAPI live, SEO Workspace live, permalinks healthy, ModSec detected. Replaces the manual "test 6 endpoints to know if a site is healthy" pattern.

### #9 — Preview thumbnail generation (LOW)
- TODO: Auto-extract poster frame from uploaded video (ffmpeg if available, else fallback). Or accept agent-provided thumbnail.

### #10 — Reel pack endpoint (MEDIUM)
- TODO: `POST /imp-preview/v1/reel-pack` — video + thumbnail + caption + hashtags + CTA + draft support page in one call.

### #11 — Cleaner agent docs inside WP admin (LOW)
- TODO: WP admin page showing "How agents should use this site" with endpoints, examples, app-password instructions.

## Queued for v4.6.1 — Admin UI (deferred from v4.6.0 per John 2026-04-28)

Both items are pure WP-admin glue around already-shipped REST endpoints. They make
v4.6.0 features discoverable to humans who don't read OpenAPI specs.

### Static Reviews admin page (~150 lines)
- TODO: IM-Press → Static Reviews
- Table: title, recommended URL (clickable), created, expires, Delete button
- Create form: title, asset URL, style picker, watermark text, expires-in-days
- Wraps `imp-preview/v1/static-review` REST endpoints

### Promotion meta box on page edit screen (~80 lines)
- TODO: Right sidebar on imported pages showing "Auto-promoted on [date] · N styles + N scripts lifted · [Restore Original] button"
- Only renders when `_impress_promoted` post meta is set
- Restore button hits the existing `/im-press/v1/import-html/restore` endpoint

### Lifted styles editor (~250 lines)
- TODO: CodeMirror panel in page editor sidebar showing the lifted CSS, editable
- Saves to `_imp_promoted_head_styles` post meta

### Body class field (~40 lines)
- TODO: Visible field in page sidebar for `_imp_body_class`

## Queued from Session 62 (pre-existing leftovers)

### Theme auto-updater
- TODO: Build update checking for the Passthrough theme INTO IM-Press (`class-theme-updater.php` or extend `class-updater.php`). Hook `pre_set_site_transient_update_themes`, check against airobotbuild.com, extend `im_press_update_server` WP option with a `theme` section.
- See: `~/CODE-BRIEFING-SESSION62.md` Task 2

### hi-techsecuritysolutions.com fleet addition
- TODO: Add `~/public_html/website_11ab7bb0` (currently on v4.3.1 per filesystem) to deploy script and smoke test. Verify license + bring to current version.
- See: `~/CODE-BRIEFING-SESSION62.md` Task 3

## Notes

- **OpenAPI auto-listing**: any new endpoint registered with `register_rest_route( 'imp-X/v1', ... )` will auto-list in the spec as long as the namespace is added to `IMPress\OpenAPI::NAMESPACE_MAP`. This is the rule for all future endpoints.
- **ModSec-friendly URL design**: avoid POST to `/path/{numeric}`. Prefer body-param IDs. The `/restore/{id}` → `/restore` (body) refactor in v4.6.0 confirmed this. Apply to all future write endpoints.
- **Case-sensitive tokens**: `wp_generate_password( N, false )` returns mixed-case alphanumerics. Validate with `preg_match( '/^[a-zA-Z0-9]{8,32}$/', … )`, NOT `sanitize_key` (which lowercases).
