docs(agents): forbid string-editing post_content, add /edit-block-content - #23
Open
Schmandarine wants to merge 1 commit into
Open
docs(agents): forbid string-editing post_content, add /edit-block-content#23Schmandarine wants to merge 1 commit into
Schmandarine wants to merge 1 commit into
Conversation
…tent An agent changing a field value on a live page has had no guidance, so the obvious approach — str_replace on post_content — silently strips one backslash level from the block's attribute JSON. Every escape degrades into literal page text: & becomes u0026, \r\n becomes rn. It stays valid JSON, so nothing errors and it ships. Adds the /edit-block-content skill (snapshot, parse_blocks, wp_slash, verify, diff, plus recovery for already-corrupted content), and states the rule in AGENTS.md and the setup skill so it ships to consumers via npx skills add brmbh/wordpress. The verify grep is the load-bearing part: a rule an agent can check beats one it can only remember. Refs: #22
Schmandarine
added
documentation
Collaborator
Author
|
Follow-up filed: #24 — the |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #22
Docs only — no code, no behaviour change.
What's here
packages/cli/AGENTS/edit-block-content.md/edit-block-content— the safe procedure for changing a block's field values on a live pageAGENTS.mdWhat NOT to do+ skills-table rowskills/wordpress/SKILL.mdnpx skills add brmbh/wordpressThe procedure it mandates
wp_slash()is the load-bearing call:wp_update_post()andwp_insert_post()runwp_unslash()on their input, so handing them clean content strips one backslash level and turns every block-attribute escape into literal page text (&→u0026,\r\n→rn).And the verify step, which is what actually prevents recurrence:
The skill also covers recovery, because the instinctive fix makes it worse: deleting the junk tokens in the ACF field destroys the original character with no trace, which is exactly what happened downstream of the incident in #22.
Notes for review
AGENTS/*.mdbybrmbh add skills, so there's no registration list to update —/edit-block-contentappears on the next install.@brmbh/clipublish.doctorcheck that scans a whole site for these artifacts is deliberately not in here — noted as out of scope on No guardrail against string-editing post_content — silently corrupts block attributes #22, worth its own issue.