Chimy’s AI Coding Lab

Description

Chimy’s AI Coding Lab is the platform core of the WP Maker plugin series: module management, unified REST API, security hardening, and ACF infrastructure. A modern React-based SPA admin is built in and replaces the native WordPress admin experience within its own menu, so no separate admin plugin is required. The Plate-based rich text editor, batch processing queue, WatermelonDB data synchronization, WP-Cron management, Transients management, the site & optimization module (image compression, WebP generation, REST API access control, site icon), the authentication system (SPA login/registration, phone login, QR code login, password recovery), AI capabilities (service connectors, chat completion, vision/OCR, batch content completion, AI article generation), the app configuration APIs (feature toggles, navigation entries, version management), and app resource hosting are all built in. Since 2.0.0, every former wp-maker-* companion plugin has been merged into this single plugin.

No companion plugins are required: what used to ship as the wp-maker-* plugin series (admin SPA, authentication, app management, AI, system tools, site & optimization, rich text editor, resource hosting) is now delivered together in this one plugin.

Core Capabilities

• Modular platform — manifest.json-driven module discovery, registration, and enablement management; both built-in modules and external plugins can register
• Built-in SPA admin — Notion-style React admin with content management, saved database views, media library, comments, users, a command palette, and consolidated settings; served from the bundled build/ directory over the wpmaker/v1/admin/* REST API
• Site & optimization built in — post editor (wpautop, featured images), site icon customization, media upload enhancements (SVG/JSON, renaming, EXIF stripping, dimension caps), image compression, WebP sidecar generation with front-end replacement, and IP-based REST API access control
• Application support — private-site APIs (site creation/search/details), CORS support; WatermelonDB sync endpoints built in
• Built-in editor & system tools — Plate full-screen rich text editor; batch processing queue with Action Scheduler (batching, progress tracking, cancel/retry), WP-Cron management, and Transients management
• AI & app modules built in — AI service connectors with chat completion, vision/OCR, batch content completion, and AI article generation; app configuration APIs for the companion app (feature toggles, navigation entries, version management); app resource hosting with an apps directory and entry points
• Local avatars — preset SVG avatars available on the profile page
• Security — malicious request blocking, SQL injection protection, XSS protection, directory traversal protection, login rate limiting, XML-RPC disabling; one-click temporary shutdown from the SPA dashboard

Modular Architecture

All modules are described by manifest.json with metadata and SPA menu configuration, managed by ModuleManager.

External plugins can register via ModuleManager:

\WPMaker\Core\ModuleManager::registerModulePath( __DIR__ );

REST API Namespaces

• wpmaker/v1/admin/* — platform administration (options, modules, system, network, categories, comments, users, etc.)
• wpmaker/v1/sync/* — WatermelonDB data sync (pull/push, built in)
• wpmaker/v1/sites/* — private-site APIs (built in)
• wpmaker/v1/login, /register, /qr-login/*, /auth/* — authentication, QR code login, and token management (built in)

Dependencies

• No required companion plugins — all former wp-maker-* companion plugins are built in. Custom code can hook into the batch processing queue via the wpmaker_batch_handle_* handlers
• Bundled libraries: Action Scheduler, erusev/parsedown, chillerlan/php-qrcode

Technical Requirements

• PHP 7.4 or higher
• WordPress 6.0 or higher

External services

This plugin does not contact any external service on its own. Previous versions optionally fetched a component catalog from Gitee inside the Case Portal; that feature has been removed.

Privacy

This plugin does not collect user data, does not perform remote telemetry, and does not send any information to the author’s server.

• CORS — cross-origin response headers are configured to support app requests; no data is actively sent out

All external interactions are enabled explicitly by the site administrator; the plugin itself has no phone-home behavior.