WordPress.Security.EscapeOutput.OutputNotEscaped (x3):
- Lines 110+148: inline esc_url( admin_url() ) directly in echo; drop pre-assigned $form_url
- Line 128: replace $disabled variable with literal-conditional
( $is_const ? ' disabled aria-disabled="true"' : '' ) — no dynamic value
PEAR.Functions.FunctionCallSignature.ContentAfterOpenBracket (x1):
- Line 116: move esc_html( opening to its own line so arg starts on next line
Full file audit: no other unescaped echo found; $nonce data-attr uses esc_attr(),
$ajax_url uses esc_url(), inline <script> has existing phpcs:ignore.
No behavior change; password input still renders empty.
CHANGELOG [0.2.3]: one-line note — output-escaping hardening in key manager renderer.
Agent-Session: geomonitor / 2026-06-15
CSS-only: dark page bg over #wpcontent/#wpbody-content + header + proxy-note on the PR Vision screens (scoped via the pr-vision hook guard; no leak to other admin pages).
QA: APPROVE — qa-reviews/pr-vision/2026-06-14-28e3ce65761bd6dd16ae5725b6b54f2910c381db.md
Agent-Session: pr-vision v0.2.2 merge
- #wpcontent / #wpbody / #wpbody-content set to dark page bg (#14181C)
on both PR Vision screens; WP default left-padding on #wpcontent removed
- .wrap>h1 text colour set to light token (#EEF2F5) so the dashboard H1
renders on dark, not white
- .notice.prv-proxy-note overridden to dark surface with teal left border
- Scoped strictly: entire block delivered via wp_add_inline_style('wp-admin',...)
inside PRV_Admin_Page::enqueue_assets() which guards on strpos($hook, 'pr-vision')
— fires only on the two PR Vision screens; does not touch WP admin bar or menu
- No logic change; files <300 lines; CHANGELOG + version bump included
Rename to PR Vision (PRV_/pr-vision); fix www-strip char-mask in competitor display (str_starts_with); make PHPCS a CI gate; remove dead in-run cache.
QA: APPROVE — qa-reviews/pr-vision/2026-06-13-c633fdb9e1541386a713a6de12d2ee2ae4239640.md
Agent-Session: pr-vision rename v0.1.1 merge
