PluginDeck

Your WordPress plugins, under control.

Organize, understand, and manage your WordPress plugins from one smarter workspace.

Features • Architecture • Installation • Development • Privacy

---

Why PluginDeck?

The native WordPress Installed Plugins screen is foundational, but as sites grow, managing modern plugin stacks becomes increasingly challenging. Complex sites easily accumulate dozens of plugins from diverse sources with disparate update cadences and varying maintenance health.

PluginDeck enhances the native Plugins > Installed Plugins administration screen directly instead of introducing an unfamiliar, detached dashboard. It adds immediate clarity, instant discovery, maintenance health indicators, and local developer organization tools while keeping the WordPress core workflow completely intact.

Enhance, don't replace.
PluginDeck builds upon native WordPress tables, actions, and hooks. Deactivating PluginDeck immediately restores the default WordPress plugins experience without leaving database clutter or modified plugin files.

---

Features

Smarter Plugins Screen

• Enhanced & Compact Modes: Switch seamlessly between an expanded view featuring detailed intelligence badges and a dense, compact layout engineered for power users and developers.
• Smart Summary Chips: Get an instant overview of active, inactive, network-active, update-pending, and maintenance health totals directly above the table.
• Preserved Core Workflow: Native bulk actions, plugin row meta, action links, and core update/dependency companion notices are fully preserved.

Repository & Version Intelligence

• Release Currency: Displays installed versions alongside the latest repository versions and human-readable release intervals (e.g. Updated 3 weeks ago).
• Core & PHP Compatibility: View declared Tested up to WordPress versions and minimum PHP requirements at a glance.
• Source Classification: Accurately distinguishes official WordPress.org directory plugins from custom, drop-in, must-use, or third-party direct installations.

Explainable Maintenance Health

PluginDeck evaluates plugin health strictly using transparent, deterministic rules based on verified release history and core compatibility declarations:

• Healthy: Active maintenance cadence and compatible with modern WordPress releases.
• Attention: Flags plugins that have not received an update in 12+ months or are tested against older WordPress releases.
• High Risk: Highlights plugins with no repository release in 24+ months.
• Unavailable: Positively confirmed as absent or removed from the official WordPress.org directory.
• Unknown: Applied to custom, private, or external plugins without official repository records to prevent false alarms, as well as temporary API error states.

Important: High Risk is strictly an objective maintenance-cadence metric reflecting release dormancy. It is not an automated security audit, vulnerability scanner, or malware verdict.

Instant Search, Filters & Sorting

• Instant Client-Side Search: Search in real time across plugin titles, slugs, author names, file paths, and custom tags without reloading the page.
• Multi-Dimensional Filtering: Combine filters across Status (Active, Inactive, Network Active), Updates (Available), Health (Healthy, Attention, High Risk, Unavailable), and Source (WordPress.org, Custom).
• Deterministic Sorting: Sort plugins by Name (A–Z), Status (Active First, Inactive First), Updates Available, Maintenance Health (Risk First), or Last Release Date with persistent per-user preferences.

Local Organization: Notes & Tags

• Custom Tags: Categorize plugins using color-coded, searchable tags (e.g. e-commerce, client-site, utility).
• Per-Plugin Notes: Store private internal documentation and notes directly on plugin rows (up to 1,000 characters).
• Non-Destructive Storage: Stored securely as per-user metadata in your WordPress database with zero external sync.

Developer Tooling

• Quick Details Drawer: Inspect technical plugin headers, entry file paths, text domains, and update URIs in an accessible slide-out panel.
• Copy Plugin Info: Generate a clean, formatted plain-text technical snapshot with one click, ready to paste into issue trackers, documentation, or team chats.

---

Native by Design

PluginDeck follows strict engineering principles to maintain the stability of your WordPress site:

• Reorganize, don't destroy: Native and third-party action links and meta entries remain independently available in the DOM and are not discarded or reconstructed.
• Companion Row Integrity: Native update rows (.plugin-update-tr), dependency warnings, and core notices remain grouped and move logically with their parent plugin during sorting and filtering.
• Zero Admin Lock-in: Settings and preferences can be reset at any time.

---

Performance Architecture

PluginDeck adheres to a non-blocking asynchronous architecture:

Plugins Screen Request
       ↓
Scan Local Inventory (In-Memory)
       ↓
Read Cached Repository Intelligence (Options Cache)
       ↓
Evaluate Health Rules Deterministically (In-Memory)
       ↓
Immediate Screen Render (Zero Remote Blocking)

Guarantees

• Zero Remote Blocking: The Plugins screen render path never triggers blocking HTTP requests (wp_remote_get() or plugins_api()).
• Non-Blocking Background Crons: Missing or stale repository intelligence is queued and fetched asynchronously via dedicated background WP-Cron batches.
• Lightweight Client-Side Discovery: Search, filtering, and sorting operate entirely in-browser on the rendered DOM, introducing no additional server load or database queries during interaction.

---

Privacy & Local-First Philosophy

• No External Accounts: PluginDeck requires no registration, API keys, or accounts.
• No Telemetry or Tracking: Zero analytics, beacons, tracking pixels, or remote logging.
• No Cloud Infrastructure: PluginDeck runs entirely on your server; notes and tags are stored only in your local database.
• Official Repository Communication: The only external HTTP requests made are non-blocking queries from your server to the official api.wordpress.org endpoint to retrieve public release and compatibility metadata.

---

What PluginDeck Is Not

To maintain clarity and set appropriate expectations, PluginDeck is:

• Not a vulnerability scanner: It does not audit plugin code for security vulnerabilities, CVEs, or zero-days.
• Not a malware removal tool: It does not scan file systems for malicious payloads or backdoors.
• Not an automated replacer: It does not deactivate, activate, or update plugins automatically without your explicit command.
• Not a remote SaaS manager: It does not connect to external site management clouds.

---

Requirements

• WordPress: 6.0 or higher
• PHP: 7.4 or higher (compatible with PHP 8.0, 8.1, 8.2, 8.3, and 8.4)
• Multisite: Fully compatible with single-site and WordPress Multisite network installations.

---

Installation

From Release Archive

1. Download or build the distribution package plugindeck.zip using the packaging tool:

   composer package

2. In your WordPress admin panel, navigate to Plugins > Add New > Upload Plugin.
3. Choose the generated dist/plugindeck.zip file and click Install Now.
4. Click Activate Plugin.
5. Go to Plugins > Installed Plugins to use the enhanced workspace.

Developer Setup

To contribute or run PluginDeck locally from source:

1. Clone the repository into your WordPress wp-content/plugins/ directory:

   git clone git@github.com:mojaadev/plugindeck.git plugindeck
   cd plugindeck

2. Install developer tools via Composer:

   composer install

3. Run the automated test suites to verify your environment:

   composer test
   composer test:js

---

Development & Quality

PluginDeck maintains strict quality gates across PHP and JavaScript:

Command	Purpose
composer validate --strict	Validates composer.json schema and configuration strictness.
composer lint	Lints all PHP files across src/, tests/, and scripts/ using php -l.
composer test	Executes the PHPUnit test suite covering unit, integration, and lifecycle tests.
composer test:js	Executes the standalone JavaScript test suite (no npm dependencies needed).
composer phpcs	Audits code against official WordPress Coding Standards (WordPress-Core).
composer package	Builds a clean, production-ready WordPress distribution ZIP at dist/plugindeck.zip.

---

Project Architecture

plugindeck/
├── assets/                  # Scoped CSS stylesheets and client-side JavaScript
│   ├── css/admin-plugins.css
│   └── js/admin-plugins.js
├── languages/               # Gettext translation templates (.pot)
├── scripts/                 # CLI utilities (linting, distribution packaging)
│   ├── lint.php
│   └── package.php
├── src/                     # PSR-4 namespaced PHP source files
│   ├── Admin/               # Admin menus, settings registry, and table controllers
│   ├── Contracts/           # Service and provider interfaces
│   ├── Health/              # HealthEngine and deterministic health evaluation rules
│   ├── Inventory/           # Plugin discovery, header parsing, and state analysis
│   ├── Lifecycle/           # Activator, Deactivator, and Uninstaller routines
│   ├── Organization/        # Note and tag persistence stores
│   ├── Repository/          # WordPress.org API integration, caching, and background queues
│   ├── Storage/             # Type-safe options and transient wrappers
│   ├── Support/             # Capabilities and environment helpers
│   ├── Bootstrap.php        # Environment constants and version checking
│   └── Plugin.php           # Singleton orchestrator and service container
├── tests/                   # PHPUnit and JavaScript verification test suites
│   ├── js/discovery.test.js # DOM filtering, sorting, and grouping test runner
│   └── Unit/                # Isolated PHP unit tests
├── autoload.php             # Production PSR-4 autoloader (zero external dependencies)
├── plugindeck.php           # Main WordPress plugin bootstrap file
├── readme.txt               # WordPress.org-compliant plugin directory documentation
└── uninstall.php            # Native WordPress uninstall entry point

---

Data & Storage Lifecycle

PluginDeck uses standard WordPress storage APIs and requires no custom database tables:

• Settings & Cache: Stored in wp_options using the plugindeck_ prefix. Repository metadata caches are non-autoloaded.
• User Preferences: View modes (plugindeck_view_mode), sort preferences (plugindeck_sort_mode), and organization data (plugindeck_plugin_metadata) are saved in wp_usermeta.
• Background Jobs: Uses standard WP-Cron (plugindeck_background_refresh_event) with transient execution locking (plugindeck_repo_refresh_lock).
• Uninstall Data Policy: By default, user notes, tags, and preferences are preserved when the plugin is deactivated or deleted. To permanently purge all PluginDeck data on deletion, enable Delete PluginDeck data on uninstall in Settings > PluginDeck.

---

Multisite Support

PluginDeck is hardened for WordPress Multisite:

• Network Admin: Super Administrators can manage network plugins at Network Admin > Plugins with dedicated manage_network_plugins capability checks.
• Sub-Site Isolation: Single-site administrators manage their local views and notes independently without cross-site data exposure.
• Network Cleanup: When opted-in, the uninstaller safely cleans options and transients across network sites using safe blog context restoration.

---

Contributing

Contributions, feedback, and bug reports are welcome!

1. Fork the repository and create your branch from develop.
2. Ensure your changes adhere to WordPress Coding Standards and pass all quality gates:

   composer lint && composer test && composer test:js && composer phpcs

3. Open a Pull Request against the develop branch with a clear description of your changes.

---

Security

If you discover a potential security issue within PluginDeck, please report it responsibly by opening an issue on GitHub or reaching out through the contact channels on mojaadev.site.

---

License

PluginDeck is open-source software licensed under the GNU General Public License v2.0 or later.

---

Built and maintained with care by mojaadev.