Justflows 0.3.6: themed sign-in, categories and tags, and plugins your AI agent can use

Justflows 0.3.6 is out, two days after 0.3.5. This one is about who can get in, and where: members get sign-in pages that look like your site, staff get an admin sign-in that a custom admin path really hides, and AI agents get access to plugins, but only where a plugin allows it. Posts also get categories and tags, finally. Here are the highlights. The full changelog is on GitHub.

/login, /register, /forgot-password and /reset-password now render inside your theme, with your header, footer and styles. They are four normal pages of the new built-in Sign-in content type (Content → Sign-in), so you edit them in the page builder like anything else. Each one holds an Account form block that does the actual work.

Before 0.3.6, moving the admin under Security → Admin URL hid the admin pages, but /login still accepted staff passwords and even returned the hidden path after a successful sign-in. Moving the admin stopped neither password guessing nor kept the path secret.

Now staff sign in only at <admin path>/login, in the admin's own design, and /admin/* answers 404 once the path is moved. A staff account on the member page gets exactly the answer a wrong password gets, before any two-factor prompt. Member pages never mail staff a reset link, and a reset link only works on the surface it was mailed for. Read more in Two doors: how sign-in works in Justflows 0.3.6.

Heads-up: this also applies on the default /admin path. If you bookmarked /login to get into the admin, use /admin/login now.

Content → Categories & Tags manages terms: add, rename, change the slug, nest categories, and delete (child categories move up a level). Every site gets category and tag for posts, and administrators can add their own taxonomies and choose which content types use each one.

There is a walkthrough in Categories, tags and custom taxonomies.

A plugin route can now be offered to agents as an MCP tool with a new mcp route option. The tool runs the route's own handler with the agent's session, so the plugin's checks apply unchanged. It is listed only on sites where the plugin is active and only to sessions with the capability it names. Routes without the option are never offered.

The thinking behind this is in Letting AI agents into plugins, without letting them out of the site.

// Survives a restart, runs on one process, retried with backoff
await ctx.jobs.enqueue("sync-catalog", { since });

This release adds two database migrations: 0047_taxonomy_content_types and 0048_job_queue. Staff on sites that still use /login for the admin need to switch to /admin/login (or your custom admin path), and plugin authors with handler-only MCP tools need to move them to routes. Read the full release notes before you upgrade.