=== Agent Adapt ===
Contributors: josephlines
Tags: woocommerce, ai agents, personal agent protocol, agentic commerce, oauth
Requires at least: 6.8
Tested up to: 7.1
Requires PHP: 8.1
Stable tag: 0.5.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Let your customers' personal AI agents shop your WooCommerce store, with access each customer grants and controls you keep.

== Description ==

More shoppers now ask an AI assistant to find a product, compare options or reorder something they bought before. Agent Adapt gives those assistants a proper way in to your WooCommerce store, so they don't have to scrape your pages or ask for your customer's password.

It implements the Personal Agent Protocol (Draft 0.1), an open standard for how a person's AI agent works with a business. Under the protocol, the agent proves who it is, the customer decides what it may do, and your store decides which agents it serves.

= What an agent can do without signing in =

* Search your catalogue and read product details, prices, stock and variations. Products you've hidden from search or the catalogue stay hidden.
* Read your published returns and refunds, terms, and privacy pages.
* Build a cart: add items, change quantities, remove lines, and apply or remove coupons. It's the same WooCommerce cart your store already uses, so your prices, taxes, stock rules and coupon rules all apply.
* Hand the cart back to the customer. The agent gets a link to your own checkout page, and the customer pays there, with your payment methods. Agents never take payment.

= What a signed-in agent can do =

When the customer asks their agent to use their account, the agent sends them to your store's own sign-in page. The customer signs in there, sees which agent is asking and what it wants, and approves or declines. The agent never sees the password. Once approved, the agent can:

* List the customer's orders and read an order's details.
* Cancel an order that hasn't been paid yet.
* Put a past order back in the cart.
* Read the customer's saved billing and shipping addresses.

Access lasts 90 days. The customer can end it at any time from My Account → Connected agents, and WooCommerce emails them each time a new agent connects. Changing their password or role disconnects every agent at once. Administrator and shop manager accounts can never be connected to an agent.

= The agent's own browser =

Some agents also open your website in a browser of their own. Agent Adapt lets that browser join the same visit, so the website, the agent and the customer all see one cart and one sign-in. That browser can browse and shop, but it can't open the dashboard, the login page, the customer's account details, saved payment methods or checkout.

= You stay in control =

* **WooCommerce → Agents** lists every agent that has used your store, with its activity over the last 30 days. Block an agent and it is refused immediately, everywhere.
* Orders that came through an agent show it in WooCommerce's order attribution, with the agent's domain as the source.
* **Tools → Site Health** checks the things that commonly break agent access, such as HTTPS, permalinks, a cache or firewall intercepting the discovery documents, or a host that strips the Authorization header. Each check says how to fix the problem.

= How agents find your store =

Agent Adapt publishes `/.well-known/poppy.json` and the standard OAuth server metadata at the root of your domain. Agents that follow the protocol read these, prove their identity with signed requests, and use short-lived tokens bound to their own keys (DPoP). There are no API keys to issue and nothing to configure.

= About the protocol =

The Personal Agent Protocol is a published draft, and its authors may change it. Agent Adapt follows the current draft and will track changes as they are published. Agent Adapt is independent and is not affiliated with or endorsed by the protocol's authors.

== Installation ==

1. Install and activate WooCommerce 10.0 or newer.
2. Install Agent Adapt from Plugins → Add New, or upload the zip, then activate it.
3. Open Tools → Site Health and fix anything Agent Adapt flags.

Your store is then discoverable at `https://your-store/.well-known/poppy.json`. Your store needs:

* WordPress 6.8 or newer
* WooCommerce 10.0 or newer
* PHP 8.1 or newer
* HTTPS on your store's own domain, with WordPress answering at the domain root
* Any permalink setting other than "Plain"

== Frequently Asked Questions ==

= Does Agent Adapt need WooCommerce? =

Yes. Agent Adapt requires WooCommerce 10.0 or newer. Until WooCommerce is active, it does nothing except show a notice in your dashboard.

= Can an agent spend a customer's money? =

No. An agent can build a cart, but payment always happens on your own checkout page, completed by the customer. Agent Adapt never handles card details.

= Can an agent see customer data without permission? =

No. Without the customer's sign-in and approval, an agent sees only what any visitor sees: your catalogue, your policies and its own cart. Account data such as orders and addresses needs the customer's approval on your sign-in page, and the customer can withdraw it at any time.

= Can I stop a particular agent? =

Yes. Block it under WooCommerce → Agents. Its tokens stop working immediately, and it can't start new visits until you unblock it.

= Can staff accounts be connected to an agent? =

No. Only customer and subscriber accounts can be connected. An account with store-management or administrative capabilities is refused at sign-in. If an account gains such a capability later, its agent connections stop working.

= Does it work with page caching and CDNs? =

Yes. Agent responses are marked private, so shared caches never store them, and the agent's browser carries a WooCommerce session cookie, which caching plugins and CDNs already exclude from caching. If a cache or security layer blocks `/.well-known/` or `/agent-adapt/`, Site Health tells you which paths to exclude.

= Does it work with the block checkout and HPOS? =

Yes. Agent Adapt declares compatibility with WooCommerce's block cart and checkout and with High-Performance Order Storage.

== External services ==

Agent Adapt sends no data about your store or your customers to us or to any analytics or advertising service.

To verify an agent, your store contacts that agent's own servers. A personal agent identifies itself with an HTTPS address it controls. When an agent first uses your store, and again when its cached copy expires, your store fetches two public documents from addresses the agent publishes: its client metadata document and its public signing keys (a JSON Web Key Set). These requests send nothing but the request for the document: no cookies, credentials, store data or customer data. Requests to private and local network addresses are refused. The documents are cached for a limited time.

If the agent's metadata names a logo, your sign-in and approval pages show it, so the customer's browser loads that image from the agent's server, with no referrer.

Which agents your store contacts depends on which agents your customers use, so there is no single provider. Each agent operator's own terms of service and privacy policy apply to the documents and images it serves. The approval page shows each agent's name and the domain where it publishes its documents, and you can block any agent under WooCommerce → Agents.

Site Health's checks also make requests to your own store, over its public address, to confirm that agents can reach it. These never leave your own site.

== Changelog ==

= 0.5.0 =
* For developers: the agentadapt_event_recorded action fires each time an agent event is recorded, with the stored event's ID, so an add-on can react to what agents do.

= 0.4.0 =
* Every token request that names a resource this store doesn't serve is now refused with invalid_target, not only requests that start a Session.
* For developers: a filter lets an add-on name resources that take Bearer tokens, as the protocol allows for MCP servers. The free plugin names none, so it issues only proof-of-possession (DPoP) tokens.

= 0.3.0 =
* Order details now include each line's item ID.
* For developers: new filters let an add-on refuse an agent request, cap the access an agent can be granted at sign-in, or turn an agent away. Each one can only narrow what agents may do, never widen it.

= 0.2.0 =
* First public release, implementing the Personal Agent Protocol (Draft 0.1).
* Discovery: `/.well-known/poppy.json` and OAuth server metadata.
* Agent identity: verified client metadata and signing keys, signed client assertions, and DPoP-bound tokens.
* Without sign-in: product search and details, store policies, the cart (items, quantities and coupons), and handing the cart to the customer for checkout, with the agent recorded in WooCommerce's order attribution.
* Customer sign-in, both by redirect and with a device code, on the store's own pages, with an approval screen, 90-day access, My Account → Connected agents, and an email when an agent connects.
* Signed-in: order history and details, cancelling unpaid orders, reordering, and saved addresses.
* The agent's own browser joins the same visit and cart, and is kept out of the dashboard, account details, payment methods and checkout.
* WooCommerce → Agents screen, with activity and blocking.
* Site Health checks for HTTPS, root install, permalinks, discovery, the Authorization header, and "Coming soon" mode.

= 0.1.0 =
* Initial development release: plugin skeleton with PHP, WordPress and WooCommerce compatibility checks.
