4.1.0: trimmed Insights payload for free plugins, plugin URL

[shazzad]

V4 only, changed in place (4.0.0 shipped today, no plugin uses it yet). V1 (src/*.php) and V2 (src/V2) are byte-identical: git diff main -- src/V2 src/*.php is empty.

Payload

Key	Consent (free, V4\Insights)	Commercial (V4\Integration)
event, mode, token, plugin_version, plugin_status	yes	yes
site.url/name/locale/multisite/is_local	yes	yes
wp.version/memory_limit/theme	yes	yes
wp.debug_mode	removed	yes
server.php_version/db_version/server_software/php_memory_limit	yes	yes
server.max_execution_time/upload_max_filesize	removed	yes
plugins.active[] (slug, name, version, new url)	yes	yes
plugins.active_count/inactive_count	removed	yes
admin (email, name)	removed	yes
users	removed	yes
license	—	when licensing is on
meta	when set	when set

url is the plugin's Plugin URI header through esc_url_raw(), '' when absent.

Consent notice

"What we collect" now matches the consent payload line for line:

• Site URL, name and language, whether it is a multisite, and whether it looks like a local development site
• WordPress version and memory limit
• Active theme (name, version and parent theme)
• Server environment (PHP and database versions, server software, PHP memory limit)
• Active plugins: name, version and plugin URL

The generic "Usage statistics specific to {name}" line appears only when the plugin sends meta and passes no notice.items. Given items replace it.

Plugin Check guard

Every src/V4/ file now guards with defined( 'ABSPATH' ) instead of \defined( 'ABSPATH' ). Plugin Check scans vendor/, and its direct-file-access check doesn't recognise the backslash form. The isolation tests now check for the new form.

Server follow-up (not in this PR)

shazzad/plugin-repo track currently cuts each plugins.active entry down to slug, name and version (docs/v4-api.md). Until the server keeps url, it drops the value it receives. Every other field is optional on the server, and active_count falls back to the number of entries.

Tests

• composer test (PHP 8.3): 504 tests, 1542 assertions, OK (the 9 risky tests were already risky on main)
• php:7.4-cli vendor/bin/phpunit: same result
• New or changed: consent payload has exactly the allowed keys, with each dropped key checked for absence by name; commercial payload keeps every group; url present in both modes; the notice list equals the consent payload; the meta line with items, without items, and with only invalid items; the optin body sent after Allow is the trimmed payload.

🤖 Generated with Claude Code