PluginProbe
xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN / 1.3.3
xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN v1.3.3
1.3.3 1.3.2 1.3.1 1.3.0 1.2.4 trunk 1.0.0 1.0.1 1.0.2 1.0.3 1.0.4 1.0.5 1.0.6 1.0.7 1.0.8 1.0.9 1.1.0 1.1.1 1.1.2 1.1.3 1.1.4 1.1.5 1.1.6 1.1.7 1.1.8 All 29 releases
← All changes | includes/class-admin.php +262 -37 1.0.71.3.3 View file →
@@ -19,8 +19,11 @@
19 19 add_action( 'admin_menu', array( $this, 'register_menu' ) );
20 20 add_action( 'admin_enqueue_scripts', array( $this, 'enqueue' ) );
21 21 add_action( 'admin_enqueue_scripts', array( $this, 'enqueue_menu_styles' ) );
22 22 add_filter( 'admin_body_class', array( __CLASS__, 'admin_body_class' ) );
23 + // Add a "Settings" shortcut to the plugin's row on the Plugins screen,
24 + // deep-linking straight to the xSpeed dashboard. (FBS-83234)
25 + add_filter( 'plugin_action_links_' . plugin_basename( XSPEED_FILE ), array( __CLASS__, 'plugin_action_links' ) );
23 26 // Strip third-party admin notices on our screens only. Fires in
24 27 // `in_admin_header` (after `get_current_screen()` is populated
25 28 // but before notices render) so the screen check is reliable.
26 29 add_action( 'in_admin_header', array( __CLASS__, 'suppress_foreign_notices' ), 0 );
@@ -130,8 +133,32 @@
130 133 }
131 134 return $classes;
132 135 }
133 136
137 + /**
138 + * Prepend a "Settings" link to the plugin's action links on the Plugins
139 + * screen, deep-linking to the xSpeed dashboard. Only users who can reach
140 + * the settings page (`manage_options`, the same cap the menu uses) see it.
141 + *
142 + * @param array $links Existing action links (Deactivate, etc.).
143 + * @return array
144 + */
145 + public static function plugin_action_links( $links ) {
146 + if ( ! current_user_can( 'manage_options' ) ) {
147 + return $links;
148 + }
149 +
150 + $settings_link = sprintf(
151 + '<a href="%1$s">%2$s</a>',
152 + esc_url( admin_url( 'admin.php?page=' . self::PAGE_SLUG ) ),
153 + esc_html__( 'Settings', 'xspeed' )
154 + );
155 +
156 + array_unshift( $links, $settings_link );
157 +
158 + return $links;
159 + }
160 +
134 161 public function register_menu() {
135 162 $brand = self::branding();
136 163 // Use the white-label logo for the admin menu icon when set, so the
137 164 // rebrand carries to the menu mark too — not just the title. Falls
@@ -136,16 +163,22 @@
136 163 // Use the white-label logo for the admin menu icon when set, so the
137 164 // rebrand carries to the menu mark too — not just the title. Falls
138 165 // back to the built-in xSpeed SVG. (FBS-82222)
139 166 $menu_icon = ! empty( $brand['logo_svg'] ) ? $brand['logo_svg'] : self::menu_icon();
167 + // Menu label + page <title> both read the resolved brand name
168 + // ("xSpeed Cache" by default; a white-label brand is used verbatim).
169 + // Positioned just after Appearance
170 + // (WP core slot 60) — up with the site-management group, not buried
171 + // down by Settings and not pinned to the very top.
172 + $menu_label = self::menu_label( $brand );
140 173 add_menu_page(
141 174 $brand['name'],
142 - $brand['name'],
175 + $menu_label,
143 176 'manage_options',
144 177 self::PAGE_SLUG,
145 178 array( $this, 'render' ),
146 179 $menu_icon,
147 - 80
180 + 61
148 181 );
149 182
150 183 // Drop WP's auto-generated duplicate first submenu (which
151 184 // inherits the toplevel "xSpeed" title). The group deep-links
@@ -174,42 +207,41 @@
174 207 }
175 208 }
176 209
177 210 /**
178 - * Section deep-links rendered under the xSpeed menu. Mirrors the
179 - * React sidebar's group manifest (see src/components/sidebarGroups.ts)
180 - * so the WP admin rail reads as the same map as the in-app sidebar.
181 - * Each entry points at the first module slug in that group; the
182 - * React app's hash router lands the user on that module, which is
183 - * the first row of that group's sidebar section — no manual scrolling.
211 + * Section deep-links rendered under the xSpeed menu.
184 212 *
185 - * If you add a group to React's SIDEBAR_GROUPS, add it here too. The
186 - * two arrays are intentionally co-located in PR review (same change
187 - * touches both) rather than DRY'd through a generated config file —
188 - * this is the only PHP↔TS coupling and it's tiny.
213 + * This is deliberately a SHORT LIST, not a mirror of React's
214 + * SIDEBAR_GROUPS. It used to mirror all eight groups 1:1, which made the
215 + * WP admin rail a second, competing copy of the in-app sidebar — the same
216 + * map rendered twice, one of them permanently expanded and pushing every
217 + * other plugin's menu down the page.
189 218 *
190 - * @return array<string,string> map of first-module-hash → group label.
219 + * What stays are the entry points a user navigates to from OUTSIDE the
220 + * app: the dashboard itself, the two areas people arrive at with a
221 + * specific errand (AI & agents to connect an assistant, Settings), and the
222 + * wizard. Everything else — Cache, Optimization, Network, Health &
223 + * insights, Tools — is one click away in the app's own sidebar, which is
224 + * where in-app navigation belongs.
225 + *
226 + * So adding a group to React's SIDEBAR_GROUPS no longer means adding it
227 + * here. The two lists are intentionally different lengths now.
228 + *
229 + * Setup Wizard is NOT in this array — it's a real submenu page registered
230 + * by Onboarding::register_menu() on `admin_menu` at priority 20, so it
231 + * lands after these entries.
232 + *
233 + * @return array<string,string> map of route hash → menu label.
191 234 */
192 235 private static function deep_link_items() {
193 - // Mirrors the dashboard sidebar groups (SIDEBAR_GROUPS in
194 - // sidebarGroups.ts) 1:1, in the same order. Each key is the first
195 - // module slug of that group (the anchor the submenu deep-links to).
196 - // Keep these two lists in sync — they're the only PHP↔TS coupling.
197 - // Anchors must be slugs that are always present in the /modules
198 - // payload so the hash resolves on Free too: 'ai-provider' (AI group;
199 - // injected as a locked placeholder on Free via the upsell manifest)
200 - // and 'multisite' (Pro Add-ons; resolves to the real module on a
201 - // licensed multisite). NOTE: must match a slug React actually
202 - // renders — 'ai-privacy' was removed from the groups, so anchoring
203 - // AI there opened nothing (FBS-82743 #2). (FBS-82096)
236 + // Keys are route hashes (`/<group-id>`); the submenu loop prepends '#'.
237 + // React (nav.ts parseRoute) resolves `#/<group-id>` to that landing;
238 + // legacy `#slug` links still redirect, so old bookmarks keep working —
239 + // including bookmarks to the groups no longer listed here.
204 240 return array(
205 - 'cache' => __( 'Cache', 'xspeed' ),
206 - 'minify' => __( 'Performance', 'xspeed' ),
207 - 'cdn' => __( 'Network', 'xspeed' ),
208 - 'health' => __( 'Insights', 'xspeed' ),
209 - 'database' => __( 'Tools', 'xspeed' ),
210 - 'ai-provider' => __( 'AI', 'xspeed' ),
211 - 'multisite' => __( 'Pro Add-ons', 'xspeed' ),
241 + '/overview' => __( 'Overview', 'xspeed' ),
242 + '/ai-agents' => __( 'AI & agents', 'xspeed' ),
243 + '/settings' => __( 'Settings', 'xspeed' ),
212 244 );
213 245 }
214 246
215 247 /**
@@ -221,9 +253,9 @@
221 253 * @since 1.5.0
222 254 */
223 255 public static function branding() {
224 256 $defaults = array(
225 - 'name' => 'xSpeed',
257 + 'name' => 'xSpeed Cache',
226 258 'footer_credit' => null, // null = show the default WPDeveloper credit.
227 259 'hide_help_links' => false,
228 260 'logo_svg' => null, // null = use the built-in brand mark.
229 261 );
@@ -234,8 +266,19 @@
234 266 return array_merge( $defaults, $out );
235 267 }
236 268
237 269 /**
270 + * Label for the WordPress admin sidebar menu entry — the resolved brand
271 + * name verbatim ("xSpeed Cache" by default, or the white-label name).
272 + *
273 + * @param array{name:string} $brand Resolved branding array.
274 + * @return string
275 + */
276 + private static function menu_label( array $brand ) {
277 + return isset( $brand['name'] ) ? (string) $brand['name'] : 'xSpeed Cache';
278 + }
279 +
280 + /**
238 281 * URL of the SVG menu icon — the official xSpeed brand mark. Uses
239 282 * fill="currentColor" which renders black in <img> context; the inline
240 283 * style below recolors it via CSS filter for the WP admin menu states.
241 284 */
@@ -244,9 +287,23 @@
244 287 }
245 288
246 289 public function render() {
247 290 $dark = 'dark' === self::user_theme() ? ' dark' : '';
248 - printf( '<div id="xspeed-app" class="xspeed-root%s"></div>', esc_attr( $dark ) );
291 + // Pre-mount skeleton: the React bundle executes a beat after the page
292 + // paints, so without this the mount div is an empty dark void while it
293 + // loads. We render the xSpeed brand mark (pulsing) straight into the
294 + // mount node in PHP; createRoot().render() REPLACES these children the
295 + // instant React boots, so the skeleton disappears with no JS wiring.
296 + // The mark is the bundled icon.svg; `dark:invert` (scoped in
297 + // styles.css) keeps the currentColor mark visible on the dark shell.
298 + printf(
299 + '<div id="xspeed-app" class="xspeed-root%1$s"><div class="xspeed-boot" role="status" aria-label="%2$s"><img class="xspeed-boot-mark" src="%3$s" alt="%4$s" width="48" height="48" /><span class="screen-reader-text">%5$s</span></div></div>',
300 + esc_attr( $dark ),
301 + esc_attr__( 'Loading', 'xspeed' ),
302 + esc_url( XSPEED_URL . 'assets/icon.svg' ),
303 + esc_attr__( 'xSpeed', 'xspeed' ),
304 + esc_html__( 'Loading…', 'xspeed' )
305 + );
249 306 }
250 307
251 308 /**
252 309 * Enqueue the stylesheet that recolors the menu icon to match the WP
@@ -307,13 +364,25 @@
307 364 );
308 365 }
309 366 }
310 367
368 + // Redesign v2 design tokens + self-hosted fonts. Hand-written (not
369 + // Vite-bundled) so the @font-face url('./fonts/…') resolve relative to
370 + // assets/. admin.css depends on it so the CSS vars are defined first.
371 + $theme_css = XSPEED_DIR . 'assets/theme.css';
372 + if ( file_exists( $theme_css ) ) {
373 + wp_enqueue_style(
374 + 'xspeed-theme',
375 + XSPEED_URL . 'assets/theme.css',
376 + array(),
377 + XSPEED_VERSION . '.' . filemtime( $theme_css )
378 + );
379 + }
311 380 if ( file_exists( $asset_css ) ) {
312 381 wp_enqueue_style(
313 382 'xspeed-admin',
314 383 XSPEED_URL . 'assets/admin.css',
315 - array(),
384 + array( 'xspeed-theme' ),
316 385 XSPEED_VERSION . '.' . filemtime( $asset_css )
317 386 );
318 387 }
319 388
@@ -327,10 +396,23 @@
327 396 * @since 1.5.0
328 397 */
329 398 do_action( 'xspeed_admin_enqueue', $hook );
330 399
331 - wp_localize_script(
332 - 'xspeed-admin',
400 + // NOT wp_localize_script(). WP_Scripts::localize() casts every scalar
401 + // to a string (wp-includes/class-wp-scripts.php: `(string) $value`),
402 + // so an int arrives in JS as "21600" and a bool as "1" or "".
403 + //
404 + // That silently broke the Pro prewarm scheduler: it guards with
405 + // `typeof gmtOffset === 'number'`, which a string fails, so the site's
406 + // UTC offset was treated as 0 and every one-off warm was scheduled
407 + // against UTC instead of site time — hours late on any non-UTC site,
408 + // under a label that confidently read "Site time (UTC)".
409 + //
410 + // wp_add_inline_script() with wp_json_encode() preserves types, so
411 + // numbers stay numbers and booleans stay booleans. Worth doing beyond
412 + // the one field: every future numeric or boolean config value would
413 + // hit the same trap. (#105)
414 + self::print_config(
333 415 'XSpeedConfig',
334 416 array(
335 417 'restUrl' => esc_url_raw( rest_url( Rest_Api::NAMESPACE_V1 ) ),
336 418 'nonce' => wp_create_nonce( 'wp_rest' ),
@@ -343,8 +425,19 @@
343 425 // 'pro' when xspeed-pro is active + speaks our API
344 426 // version (see Tier_Registry); 'free' otherwise.
345 427 // 'trial' reserved for future license-server work.
346 428 'tier' => class_exists( '\\XSpeed\\Tier_Registry' ) && Tier_Registry::pro_active() ? 'pro' : 'free',
429 + // Three-state Pro status so gated UI can show the RIGHT message:
430 + // 'not_installed' — Pro plugin not active → "Upgrade to Pro"
431 + // 'unlicensed' — Pro active, no valid license → "Activate license"
432 + // 'active' — Pro active + licensed → (modules unlocked)
433 + // Free can't read Pro's license directly (Free never references
434 + // Pro), so Pro filters this via `xspeed_pro_state`. Default:
435 + // not_installed when Pro is absent; 'active' when Pro is present
436 + // (Pro downgrades to 'unlicensed' when its license isn't valid).
437 + 'proState' => self::pro_state(),
438 + // Setup Wizard URL, surfaced in the sidebar profile popover.
439 + 'wizardUrl' => admin_url( 'admin.php?page=' . Onboarding::PAGE_SLUG ),
347 440 'bootstrap' => self::bootstrap_payload(),
348 441 )
349 442 );
350 443 }
@@ -349,12 +442,68 @@
349 442 );
350 443 }
351 444
352 445 /**
446 + * Emit a JS global for the admin bundle with types intact.
447 + *
448 + * The type-preserving replacement for wp_localize_script(), which
449 + * stringifies every scalar. Attached to the `xspeed-admin` handle as a
450 + * `before` script so it is defined by the time the bundle executes —
451 + * exactly the ordering guarantee localize gave us.
452 + *
453 + * Shared by the dashboard and the onboarding wizard so neither can drift
454 + * back to the stringifying path.
455 + *
456 + * @param string $var_name JS global to define.
457 + * @param array $data Payload; encoded with wp_json_encode().
458 + */
459 + public static function print_config( string $var_name, array $data ): void {
460 + $json = wp_json_encode( $data );
461 + if ( false === $json ) {
462 + // Never emit a broken assignment — the bundle reads this global
463 + // on mount and a syntax error here blanks the whole screen.
464 + $json = '{}';
465 + }
466 + wp_add_inline_script(
467 + 'xspeed-admin',
468 + 'var ' . $var_name . ' = ' . $json . ';',
469 + 'before'
470 + );
471 + }
472 +
473 + /**
353 474 * Pre-rendered settings + status payload, baked into the page so the
354 475 * React app can mount with real values instead of showing a loading state
355 476 * while it waits for /settings and /status REST calls.
356 477 */
478 + /**
479 + * Three-state Pro status for the gated UI ('not_installed' | 'unlicensed'
480 + * | 'active'). Free cannot read Pro's license (it never references Pro),
481 + * so the authoritative value comes from the `xspeed_pro_state` filter that
482 + * xspeed-pro hooks. The default here only distinguishes installed vs not —
483 + * when Pro is active, Pro itself downgrades the value to 'unlicensed' if
484 + * its license isn't valid.
485 + *
486 + * @return string
487 + */
488 + private static function pro_state(): string {
489 + $pro_present = class_exists( '\\XSpeed\\Tier_Registry' ) && Tier_Registry::pro_active();
490 + $default = $pro_present ? 'active' : 'not_installed';
491 +
492 + /**
493 + * Filter: xspeed_pro_state
494 + *
495 + * Lets the Pro plugin report its real license state so Free's gated
496 + * panels can show "Activate license" (Pro installed, unlicensed) vs
497 + * "Upgrade to Pro" (Pro not installed).
498 + *
499 + * @param string $state One of 'not_installed' | 'unlicensed' | 'active'.
500 + */
501 + $state = (string) apply_filters( 'xspeed_pro_state', $default );
502 +
503 + return in_array( $state, array( 'not_installed', 'unlicensed', 'active' ), true ) ? $state : $default;
504 + }
505 +
357 506 private static function bootstrap_payload() {
358 507 $opts = Settings::get();
359 508 $stats = Cache::get_stats();
360 509 // Static-rewrite probe state shipped to the React side so the
@@ -397,8 +546,16 @@
397 546 'gzip_active' => Gzip::probe_active(),
398 547 'nginx_snippet' => Gzip::nginx_snippet(),
399 548 ),
400 549 'rewrite_probe' => $rewrite_probe,
550 + // Separate Mobile Cache visibility (FBS-83145) — mirrors the
551 + // /status block so the dashboard callout renders on first paint
552 + // without waiting for a status re-fetch.
553 + 'mobile_separate' => array(
554 + 'enabled' => (bool) ( $opts['cache_enabled'] ? ( Settings_Manager::get( 'cache' )['mobile_separate'] ?? false ) : false ),
555 + 'blocking' => $rewrite_capable && 'mobile_separate' === Cache::static_rewrite_block_reason(),
556 + 'needs_review' => Cache::mobile_separate_needs_review(),
557 + ),
401 558 // One consolidated nginx server-block snippet aggregating
402 559 // every enabled module's directives (Cache static-rewrite,
403 560 // BrowserCache headers, GZIP, …). Null on non-nginx hosts
404 561 // or when no module contributes directives. Replaces the
@@ -403,17 +560,41 @@
403 560 // BrowserCache headers, GZIP, …). Null on non-nginx hosts
404 561 // or when no module contributes directives. Replaces the
405 562 // per-module "paste this snippet" notices.
406 563 'nginx_server_block' => Cache::full_nginx_server_block(),
564 + // Mirrors the /status block so the enable-time disclosure is
565 + // correct on FIRST PAINT. Without it the top-bar switch can be
566 + // clicked before a status fetch lands, and the one moment the
567 + // warning exists for — a leftover drop-in about to be
568 + // replaced — is exactly when it would be missing.
569 + 'dropin' => Page_Cache_Detector::dropin_disclosure(),
407 570 ),
408 571 // Registered Modules (Free + Pro). The React app discovers them
409 572 // here and renders one sidebar item + one panel per module that
410 573 // declares a settings schema. Hidden modules are filtered.
411 574 'modules' => self::modules_payload(),
575 + // xSpeed Hub connection snapshot so the Account panel + header chip
576 + // render the correct connected/not-connected state on FIRST PAINT —
577 + // no fetch, no "not connected → connected" flash. Null when the MCP
578 + // module is unavailable (the panel then falls back to /mcp/hub).
579 + 'hub' => self::hub_payload(),
412 580 );
413 581 }
414 582
415 583 /**
584 + * xSpeed Hub connection snapshot for the dashboard bootstrap. Guarded so the
585 + * dashboard never hard-depends on the MCP module. Same shape as GET /mcp/hub.
586 + *
587 + * @return array<string,mixed>|null
588 + */
589 + private static function hub_payload() {
590 + if ( ! class_exists( '\XSpeed\Modules\Mcp\Mcp_Hub' ) ) {
591 + return null;
592 + }
593 + return \XSpeed\Modules\Mcp\Mcp_Hub::public_status();
594 + }
595 +
596 + /**
416 597 * Serialize every available Module for the React dashboard. Each entry
417 598 * carries enough to render: identity (slug + tier), UI metadata (label,
418 599 * icon, optional description), current settings, and the typed schema
419 600 * the panel uses to render controls.
@@ -437,16 +618,60 @@
437 618 // panel — i.e., truly nothing to render in the dashboard.
438 619 if ( empty( $schema ) && empty( $custom_panel ) ) {
439 620 continue;
440 621 }
622 + $settings = Settings_Manager::get_public( $slug );
623 +
441 624 $entry = array(
442 625 'slug' => $slug,
443 626 'tier' => $module->tier(),
444 627 'version' => $module->version(),
628 + // Promoted from inside `settings` so the payload is
629 + // self-describing. Consumers kept tripping on this — the Hub
630 + // rendered every module "Inactive" until it learned to look
631 + // inside the settings bag. `settings.enabled` is kept below
632 + // for back-compat; this is the same value, not a second
633 + // source of truth. Modules with no `enabled` key (status
634 + // panels like Health) report null rather than a misleading
635 + // false. (#146)
636 + 'enabled' => array_key_exists( 'enabled', $settings )
637 + ? (bool) $settings['enabled']
638 + : null,
639 + // Whether the module is actually DOING something, which is not
640 + // the same question as `enabled` above. "On" has several shapes
641 + // -- page caching lives in the global option, Minify and Lazy
642 + // are on when any flag is set, MCP when it is connected -- so
643 + // each module answers for itself via is_active(). Consumers
644 + // that want "what is switched on?" (the sidebar's "N on" badge)
645 + // must read THIS, not `enabled`, which only ever described the
646 + // modules that happen to store that one key. null means the
647 + // module has no meaningful on/off and should be excluded from
648 + // any count rather than treated as off. (#363)
649 + 'active' => $module->is_active(),
650 + // One sentence explaining the line above, computed next to it
651 + // so the two cannot disagree. The UI shows it behind an (i)
652 + // beside the status pill: "On" is a bare assertion otherwise,
653 + // and least obvious exactly where it matters -- Media
654 + // Optimization reads On while its two most prominent switches
655 + // are off, because three other flags are on. (#363)
656 + 'active_reason' => $module->active_reason(),
445 657 'label' => $meta['label'] ?? ucfirst( $slug ),
446 658 'icon' => $meta['icon'] ?? 'Square',
447 659 'description' => $meta['description'] ?? '',
448 - 'settings' => Settings_Manager::get( $slug ),
660 + // Short label for the module's own tab when it hosts a tabbed
661 + // page (FBS-83633). Only set on host modules.
662 + 'tab_label' => $meta['tab_label'] ?? null,
663 + // Public view: real values except secret fields, which are masked.
664 + // The dashboard bundle localizes this into page HTML, so a raw
665 + // credential here would be readable from view-source. (#115)
666 + 'settings' => $settings,
667 + // Where each value actually came from: a wp-config.php constant,
668 + // the option row, or the schema default. The panel renders a
669 + // constant-sourced field read-only and names the constant, so it
670 + // can never present an editable box over a value the site is not
671 + // using. Every module gets this, not just the ones that declare
672 + // constants today. (#398)
673 + 'setting_origins' => Settings_Manager::origins( $slug ),
449 674 'schema' => $schema,
450 675 'notices' => $module->ui_notices(),
451 676 'custom_panel' => $meta['custom_panel'] ?? null,
452 677 );