inc/integrations/capabilities/interface-domain-selling-capability.php-120-128 (1)

120-128: ⚠️ Potential issue | 🟡 Minor

Add PHPDoc documenting the expected return array structure.

The get_dns_records method returns a generic array with no documentation of the expected structure. Document the array keys and their types in the PHPDoc to guide future implementations. Consider referencing the structure used in Domain_Manager (e.g., entries, www_entries, network_ip, warnings) if that becomes the standard for implementations of this interface.

inc/apis/trait-mcp-abilities.php-570-570 (1)

570-570: ⚠️ Potential issue | 🟡 Minor

Use strpos() instead of str_contains() for broader compatibility.

The plugin requires PHP 7.4.30, but str_contains() was introduced in PHP 8.0. While the plugin includes symfony/polyfill-php80 which provides a polyfill, using strpos($type, '|') !== false would be more robust and eliminate reliance on the polyfill.

inc/functions/product.php-213-229 (1)

213-229: ⚠️ Potential issue | 🟡 Minor

Defensively cast filter output before in_array.
If a third‑party filter returns a non‑array, in_array() will throw a TypeError in PHP 8+. A lightweight cast prevents fatals while keeping strict checks.

Suggested fix

-	$types = apply_filters('wu_independent_billing_cycle_product_types', []);
+	$types = (array) apply_filters('wu_independent_billing_cycle_product_types', []);

readme.txt-152-154 (1)

152-154: ⚠️ Potential issue | 🟡 Minor

Tighten grammar and capitalization in the hosting note.
“webserver / setup / wordpress” reads rough and should follow standard usage.

✏️ Suggested edit

-For a private server with a dedicated IP, the webserver can be setup to serve the wordpress install by default and no extra steps are required for domain mapping.
+For a private server with a dedicated IP, the web server can be set up to serve the WordPress install by default, and no extra steps are required for domain mapping.

readme.txt-106-112 (1)

106-112: ⚠️ Potential issue | 🟡 Minor

Fix duplicated “subdirectory” wording in the FAQ.
The current answers repeat “subdirectory installs,” which makes the subdomain question confusing.

✏️ Suggested edit

-Yes. Ultimate Multisite supports both subdirectory installs and subdirectory installs.
+Yes. Ultimate Multisite supports subdirectory installs.
@@
-Yes. Ultimate Multisite supports both subdirectory installs and subdomain installs.
+Yes. Ultimate Multisite supports subdomain installs.

inc/integrations/providers/cpanel/class-cpanel-domain-mapping.php-238-238 (1)

238-238: ⚠️ Potential issue | 🟡 Minor

Typo: "ocurred" should be "occurred".

📝 Proposed fix

-		wu_log_add('integration-cpanel', __('Unexpected error ocurred trying to sync domains with CPanel', 'ultimate-multisite'), LogLevel::ERROR);
+		wu_log_add('integration-cpanel', __('Unexpected error occurred trying to sync domains with CPanel', 'ultimate-multisite'), LogLevel::ERROR);

inc/integrations/providers/cpanel/class-cpanel-domain-mapping.php-231-244 (1)

231-244: ⚠️ Potential issue | 🟡 Minor

Add null checks before accessing nested properties in log_calls.

The method accesses $results->cpanelresult->data and $results->cpanelresult->data[0] without verifying these properties exist. If the cPanel API returns an unexpected response structure, this could cause fatal errors.

🛡️ Proposed fix to add defensive checks

 public function log_calls($results): void {

+	if (!isset($results->cpanelresult) || !isset($results->cpanelresult->data)) {
+		wu_log_add('integration-cpanel', __('Unexpected response structure from CPanel API', 'ultimate-multisite'), LogLevel::ERROR);
+
+		return;
+	}
+
 	if (is_object($results->cpanelresult->data)) {
 		wu_log_add('integration-cpanel', $results->cpanelresult->data->reason);

 		return;
 	} elseif ( ! isset($results->cpanelresult->data[0])) {
 		wu_log_add('integration-cpanel', __('Unexpected error ocurred trying to sync domains with CPanel', 'ultimate-multisite'), LogLevel::ERROR);

 		return;
 	}

 	wu_log_add('integration-cpanel', $results->cpanelresult->data[0]->reason);
 }

tests/WP_Ultimo/Integrations/Integration_Test.php-138-141 (1)

138-141: ⚠️ Potential issue | 🟡 Minor

Fix lint warning for array arrow spacing.

Static analysis flagged the extra spacing before => here.

🧹 Proposed fix

-			'CONST_A'  => 'value_a',
-			'UNKNOWN'  => 'should_be_ignored',
+			'CONST_A' => 'value_a',
+			'UNKNOWN' => 'should_be_ignored',

tests/WP_Ultimo/Integrations/Integration_Test.php-175-185 (1)

175-185: ⚠️ Potential issue | 🟡 Minor

Clean up credentials saved in this test to avoid cross-test leakage.

This test saves credentials on a new Integration instance, but only the main $this->integration is cleared in tearDown().

🧼 Proposed fix

 		$integration->save_credentials(['ALT_B' => 'val']);

 		$this->assertTrue($integration->is_setup());
+
+		$integration->delete_credentials();

inc/integrations/providers/wpmudev/class-wpmudev-integration.php-55-67 (1)

55-67: ⚠️ Potential issue | 🟡 Minor

Add credential validation before making the API request.

Without checking if $site_id or $api_key are empty, the request fires with a malformed URL or missing authorization, resulting in a cryptic API error instead of a clear validation message.

🛡️ Proposed fix

 		$site_id = $this->get_credential('WPMUDEV_HOSTING_SITE_ID');

 		$api_key = get_site_option('wpmudev_apikey');
+
+		if (empty($site_id) || empty($api_key)) {
+			return new \WP_Error(
+				'wpmudev-missing-credentials',
+				__('WPMU DEV credentials are missing.', 'ultimate-multisite')
+			);
+		}

inc/integrations/providers/gridpane/class-gridpane-domain-mapping.php-118-128 (1)

118-128: ⚠️ Potential issue | 🟡 Minor

Same issue: missing error handling for domain removal.

For consistency with other provider implementations, consider adding logging for success/failure.

inc/integrations/providers/enhance/class-enhance-domain-mapping.php-190-196 (1)

190-196: ⚠️ Potential issue | 🟡 Minor

Missing response handling for DELETE request.

The on_remove_domain method logs "removal request sent" but doesn't verify if the DELETE request succeeded. The add operation (lines 130-136) checks the response - consider applying the same pattern here.

🛡️ Proposed fix to add response handling

-	$this->get_enhance()->send_enhance_api_request(
+	$delete_response = $this->get_enhance()->send_enhance_api_request(
 		'/orgs/' . $org_id . '/websites/' . $website_id . '/domains/' . $domain_id,
 		'DELETE'
 	);

-	wu_log_add('integration-enhance', sprintf('Domain %s removal request sent', $domain));
+	if (isset($delete_response['error'])) {
+		wu_log_add('integration-enhance', sprintf('Failed to remove domain %s: %s', $domain, $delete_response['error']));
+	} else {
+		wu_log_add('integration-enhance', sprintf('Domain %s removed successfully', $domain));
+	}
 }

inc/integrations/class-base-capability-module.php-69-72 (1)

69-72: ⚠️ Potential issue | 🟡 Minor

Potential error if get_integration() called before set_integration().

The $integration property is typed but not initialized. Calling get_integration() before set_integration() will throw a TypeError. Consider initializing with a nullable type or adding a guard.

🛡️ Proposed fix to add defensive check

 public function get_integration(): Integration {

+	if (! isset($this->integration)) {
+		throw new \LogicException('Integration not set. Call set_integration() first.');
+	}
+
 	return $this->integration;
 }

inc/integrations/providers/gridpane/class-gridpane-domain-mapping.php-97-107 (1)

97-107: ⚠️ Potential issue | 🟡 Minor

Missing error handling for API response.

The on_add_domain method calls the GridPane API but doesn't check the response or log failures. Other providers (like Rocket and Enhance) include logging for success/failure states.

🛡️ Proposed fix to add error handling

 public function on_add_domain(string $domain, int $site_id): void {

-	$this->get_gridpane()->send_gridpane_api_request(
+	$response = $this->get_gridpane()->send_gridpane_api_request(
 		'application/add-domain',
 		[
 			'server_ip'  => $this->get_gridpane()->get_credential('WU_GRIDPANE_SERVER_ID'),
 			'site_url'   => $this->get_gridpane()->get_credential('WU_GRIDPANE_APP_ID'),
 			'domain_url' => $domain,
 		]
 	);
+
+	if (is_wp_error($response) || (isset($response['success']) && ! $response['success'])) {
+		wu_log_add('integration-gridpane', sprintf('[Add Domain] %s: Failed', $domain));
+	}
 }

inc/integrations/providers/cloudflare/class-cloudflare-domain-mapping.php-236-261 (1)

236-261: ⚠️ Potential issue | 🟡 Minor

Early return in removal loop prevents removing www variant.

Similar to on_add_subdomain, if the first domain removal fails or has no DNS entries, the method returns early (lines 247-248, 257-258), preventing the www variant from being processed. This could leave orphaned DNS records.

Proposed fix

 		foreach ($domains_to_remove as $original_subdomain) {
 			$dns_entries = $this->get_cloudflare()->cloudflare_api_call(
 				"client/v4/zones/$zone_id/dns_records/",
 				'GET',
 				[
 					'name' => $original_subdomain,
 					'type' => 'CNAME',
 				]
 			);

 			if (is_wp_error($dns_entries) || ! $dns_entries->result) {
-				return;
+				continue;
 			}

 			$dns_entry_to_remove = $dns_entries->result[0];

 			$results = $this->get_cloudflare()->cloudflare_api_call("client/v4/zones/$zone_id/dns_records/$dns_entry_to_remove->id", 'DELETE');

 			if (is_wp_error($results)) {
 				wu_log_add('integration-cloudflare', sprintf('Failed to remove subdomain "%s" from Cloudflare. Reason: %s', $subdomain, $results->get_error_message()), LogLevel::ERROR);

-				return;
+				continue;
 			}

inc/integrations/providers/cloudflare/class-cloudflare-domain-mapping.php-186-195 (1)

186-195: ⚠️ Potential issue | 🟡 Minor

Early return in loop prevents adding www variant on failure.

If adding the first subdomain fails, the return statement on line 191 exits the entire method, skipping the www variant. Consider using continue instead to attempt all domains, or handle partial failures differently.

Proposed fix

 			if (is_wp_error($results)) {
 				wu_log_add('integration-cloudflare', sprintf('Failed to add subdomain "%s" to Cloudflare. Reason: %s', $subdomain, $results->get_error_message()), LogLevel::ERROR);

-				return;
+				continue;
 			}

inc/integrations/providers/cloudways/class-cloudways-domain-mapping.php-251-277 (1)

251-277: ⚠️ Potential issue | 🟡 Minor

Encode domain names in DNS lookup requests.
Concatenating raw domain strings into a query URL can break lookups if the domain contains special characters. URL-encode the domain using rawurlencode(). For international domain names (IDNs), consider converting to ASCII form first using idn_to_ascii() to ensure proper Punycode representation before encoding.

🔧 Safer DNS request

- $response = wp_remote_get('https://dns.google/resolve?name=' . $domain_name);
+ $response = wp_remote_get('https://dns.google/resolve?name=' . rawurlencode($domain_name));

inc/integrations/class-integration-registry.php-338-372 (1)

338-372: ⚠️ Potential issue | 🟡 Minor

Escape dynamic values before rendering in settings HTML.

$url (line 347-352) and $integration->get_title() (line 357) are interpolated into HTML without proper escaping. The $url should be wrapped with esc_url() before output in the href attribute, and get_title() should be escaped with esc_html() in the sprintf. While wp_kses() in the field renderer allows <a> tags, it does not validate href attribute values.

🛡️ Suggested hardening

- $html = $integration->is_enabled()
- 	? sprintf('<div class="wu-self-center wu-text-green-800 wu-mr-4"><span class="dashicons-wu-check"></span> %s</div>', __('Activated', 'ultimate-multisite'))
- 	: '';
+ $html = $integration->is_enabled()
+ 	? sprintf('<div class="wu-self-center wu-text-green-800 wu-mr-4"><span class="dashicons-wu-check"></span> %s</div>', esc_html__('Activated', 'ultimate-multisite'))
+ 	: '';

- $url = wu_network_admin_url(
- 	'wp-ultimo-hosting-integration-wizard',
- 	[
- 		'integration' => $slug,
- 	]
- );
+ $url = esc_url(
+ 	wu_network_admin_url(
+ 		'wp-ultimo-hosting-integration-wizard',
+ 		[
+ 			'integration' => $slug,
+ 		]
+ 	)
+ );

- $html .= sprintf('<a href="%s" class="button-primary">%s</a>', $url, __('Configuration', 'ultimate-multisite'));
+ $html .= sprintf('<a href="%s" class="button-primary">%s</a>', $url, esc_html__('Configuration', 'ultimate-multisite'));

- $title = sprintf(__('%s Integration', 'ultimate-multisite'), $integration->get_title());
+ $title = sprintf(esc_html__('%s Integration', 'ultimate-multisite'), esc_html($integration->get_title()));

- __('Go to the setup wizard to setup this integration.', 'ultimate-multisite')
+ esc_html__('Go to the setup wizard to setup this integration.', 'ultimate-multisite')

inc/integrations/capabilities/interface-domain-selling-capability.php (1)

130-149: Consider adding complementary methods for completeness.

The interface defines add_dns_record but lacks update_dns_record and delete_dns_record methods. Similarly, enable_whois_privacy exists without a corresponding disable_whois_privacy method.

For a complete CRUD-style API surface and to match the pattern used with enable_domain_lock/disable_domain_lock, consider adding:

public function update_dns_record(string $domain_name, string $record_id, array $record_data): array;
public function delete_dns_record(string $domain_name, string $record_id): array;
public function disable_whois_privacy(string $domain_name): array;

inc/apis/trait-mcp-abilities.php (1)

856-880: Consider whether unknown fields should error or warn.

Returning an error for unknown fields provides good feedback for LLMs but may hurt forward compatibility. If an MCP client sends a newer field that the server doesn't recognize yet, the entire update fails rather than applying known fields.

An alternative approach: log/note unknown fields in the response but still apply valid changes. This maintains the "partial update" pattern common in REST APIs.

If the strict behavior is intentional for MCP tooling, this is fine as-is.

inc/integrations/providers/cpanel/class-cpanel-domain-mapping.php (1)

188-188: Empty on_remove_subdomain method could benefit from a brief comment.

While the empty implementation is consistent with other providers (GridPane, Closte), adding a brief comment explaining why it's a no-op would improve maintainability.

📝 Suggested improvement

-public function on_remove_subdomain(string $subdomain, int $site_id): void {}
+public function on_remove_subdomain(string $subdomain, int $site_id): void {
+	// CPanel handles subdomain removal automatically.
+}

inc/integrations/providers/serverpilot/class-serverpilot-integration.php (2)

118-127: Inconsistent body encoding when $data is empty.

When $data is empty, body is set to an empty array [] while Content-Type is application/json. This inconsistency may cause issues with some API servers that expect either no body or an empty JSON object for requests with a JSON content type.

♻️ Proposed fix

 $post_fields = [
 	'timeout'  => 45,
 	'blocking' => true,
 	'method'   => $method,
-	'body'     => $data ? wp_json_encode($data) : [],
+	'body'     => $data ? wp_json_encode($data) : '',
 	'headers'  => [
 		'Authorization' => 'Basic ' . base64_encode($this->get_credential('WU_SERVER_PILOT_CLIENT_ID') . ':' . $this->get_credential('WU_SERVER_PILOT_API_KEY')), // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode
 		'Content-Type'  => 'application/json',
 	],
 ];

---

57-66: test_connection could provide more actionable error details.

The method returns a generic error message when wu_get_isset($response, 'error') is truthy, discarding any details from the API response. Consider including the actual error from the response for debugging.

♻️ Suggested improvement

 public function test_connection() {

 	$response = $this->send_server_pilot_api_request('', [], 'GET');

-	if (is_wp_error($response) || wu_get_isset($response, 'error')) {
-		return new \WP_Error('serverpilot-error', __('Could not connect to ServerPilot.', 'ultimate-multisite'));
+	if (is_wp_error($response)) {
+		return $response;
+	}
+
+	$error_message = wu_get_isset($response, 'error');
+	if ($error_message) {
+		return new \WP_Error('serverpilot-error', is_array($error_message) ? wp_json_encode($error_message) : $error_message);
 	}

 	return true;
 }

inc/integrations/providers/hestia/class-hestia-domain-mapping.php (2)

172-183: Handle potential wp_json_encode failure.

If $result is a resource or contains circular references, wp_json_encode can return false, which would log "false" instead of something meaningful.

♻️ Suggested improvement

-	wu_log_add('integration-hestia', sprintf('[%s] %s', $action_label, is_scalar($result) ? (string) $result : wp_json_encode($result)));
+	$log_result = is_scalar($result) ? (string) $result : wp_json_encode($result);
+	wu_log_add('integration-hestia', sprintf('[%s] %s', $action_label, $log_result ?: __('Unable to encode response', 'ultimate-multisite')));

---

149-149: Empty subdomain handlers could use explanatory comments.

While the empty implementations are valid (Hestia may handle subdomains differently), brief comments would clarify this is intentional behavior.

📝 Suggested improvement

-public function on_add_subdomain(string $subdomain, int $site_id): void {}
+public function on_add_subdomain(string $subdomain, int $site_id): void {
+	// Hestia does not require explicit subdomain registration.
+}

-public function on_remove_subdomain(string $subdomain, int $site_id): void {}
+public function on_remove_subdomain(string $subdomain, int $site_id): void {
+	// Hestia does not require explicit subdomain removal.
+}

Also applies to: 160-160

tests/WP_Ultimo/Integrations/Providers/Hestia_Domain_Mapping_Test.php (3)

64-77: Test doesn't verify the actual domain being added.

The test verifies the command name and credentials but doesn't assert that the domain 'example.com' is correctly passed to the API call (should be in $args[2]).

💚 Proposed improvement

 public function test_on_add_domain_calls_add_alias_command(): void {

 	$this->integration->expects($this->atLeast(1))
 		->method('send_hestia_request')
 		->willReturnCallback(function (string $cmd, array $args) {
 			$this->assertSame('v-add-web-domain-alias', $cmd);
 			$this->assertSame('admin', $args[0]);
 			$this->assertSame('mysite.com', $args[1]);
+			$this->assertSame('example.com', $args[2]);

 			return 0;
 		});

 	$this->module->on_add_domain('example.com', 1);
 }

---

126-135: Test may not correctly verify test_connection delegation.

The test expects send_hestia_request to be called, but Hestia_Domain_Mapping::test_connection() delegates to $this->get_hestia()->test_connection(). Since test_connection is not in the onlyMethods list (line 17), the real Hestia_Integration::test_connection() method will be called, which in turn calls send_hestia_request. This works but could be made more explicit by either mocking test_connection directly or adding it to onlyMethods.

---

1-6: Consider adding file and class docblocks for consistency.

While test files often omit docblocks, adding them would maintain consistency with the production code style used throughout this codebase.

inc/integrations/providers/enhance/class-enhance-integration.php (1)

180-184: Consider redacting sensitive data from logs.

Request and response bodies are logged in full, which could expose API tokens or other sensitive information in log files. Consider redacting or limiting what's logged.

🔒 Proposed fix to redact sensitive data

-	wu_log_add('integration-enhance', sprintf('Making %s request to: %s', $method, $api_url));
-
-	if (! empty($data)) {
-		wu_log_add('integration-enhance', sprintf('Request data: %s', wp_json_encode($data)));
-	}
+	wu_log_add('integration-enhance', sprintf('Making %s request to: %s', $method, $api_url));
+
+	if (! empty($data) && defined('WP_DEBUG') && WP_DEBUG) {
+		wu_log_add('integration-enhance', sprintf('Request data: %s', wp_json_encode($data)));
+	}

inc/integrations/providers/cpanel/class-cpanel-integration.php (1)

67-76: Consider providing more specific error details.

When the connection test fails, the error message is generic. Including the actual API error (if available) would help administrators troubleshoot.

💡 Proposed enhancement for better error reporting

 public function test_connection() {

 	$results = $this->load_api()->api2('Cron', 'fetchcron', []);

 	if (isset($results->cpanelresult->data) && ! isset($results->cpanelresult->error)) {
 		return true;
 	}

-	return new \WP_Error('cpanel-error', __('Could not connect to cPanel.', 'ultimate-multisite'));
+	$error_message = isset($results->cpanelresult->error)
+		? $results->cpanelresult->error
+		: __('Could not connect to cPanel.', 'ultimate-multisite');
+
+	return new \WP_Error('cpanel-error', $error_message);
 }

inc/integrations/providers/wpengine/class-wpengine-domain-mapping.php (1)

87-102: Silent failure when WPE_API unavailable.

When WPE_API class doesn't exist, the method returns silently without logging. This makes debugging difficult when domain mapping fails on WP Engine environments.

🔧 Proposed fix to add logging

 public function on_add_domain(string $domain, int $site_id): void {

 	$this->get_wpengine()->load_dependencies();

 	if (! class_exists('WPE_API')) {
+		wu_log_add('integration-wpengine', 'WPE_API class not available - domain mapping requires WP Engine environment');
+
 		return;
 	}

 	$api = new \WPE_API();

 	$api->set_arg('method', 'domain');

 	$api->set_arg('domain', $domain);

-	$api->get();
+	$result = $api->get();
+
+	wu_log_add('integration-wpengine', sprintf('[Add Domain] %s: Request sent', $domain));
 }

inc/integrations/providers/cloudflare/class-cloudflare-integration.php (1)

133-145: Missing JSON decode error handling and request timeout.

The json_decode() call on line 137 can return null if the response body is invalid JSON, but this isn't checked before returning. Additionally, consider adding a timeout parameter to wp_remote_request for predictable behavior.

Proposed fix

 		$response = wp_remote_request(
 			$endpoint_url,
 			[
 				'method'      => $method,
 				'body'        => 'GET' === $method ? $data : wp_json_encode($data),
 				'data_format' => 'body',
+				'timeout'     => 45,
 				'headers'     => [
 					'Authorization' => sprintf('Bearer %s', $this->get_credential('WU_CLOUDFLARE_API_KEY')),
 					'Content-Type'  => 'application/json',
 				],
 			]
 		);

 		if ( ! is_wp_error($response)) {
 			$body = wp_remote_retrieve_body($response);

 			if (wp_remote_retrieve_response_code($response) === 200) {
-				return json_decode($body);
+				$decoded = json_decode($body);
+				if (null === $decoded && json_last_error() !== JSON_ERROR_NONE) {
+					return new \WP_Error('cloudflare-json-error', 'Invalid JSON response from Cloudflare');
+				}
+				return $decoded;
 			} else {

inc/integrations/providers/rocket/class-rocket-integration.php (1)

218-223: GET requests don't append query parameters.

For GET requests, the $data parameter is ignored since the body is only set for POST/PUT/PATCH methods. If GET requests need query parameters, they won't be included. Currently test_connection() calls with empty data, so this works, but future GET calls with data would silently lose the parameters.

Proposed fix

 		if (! empty($data) && in_array($method, ['POST', 'PUT', 'PATCH'], true)) {
 			$args['body'] = wp_json_encode($data);
+		} elseif (! empty($data) && 'GET' === $method) {
+			$url = add_query_arg($data, $url);
 		}

inc/integrations/providers/cloudways/class-cloudways-integration.php (1)

172-216: API requests proceed with empty token if authentication fails.

If get_cloudways_access_token() returns an empty string (due to failed authentication), send_cloudways_request() will still proceed with the API call using an empty Bearer token. This results in a less descriptive error from Cloudways rather than an early failure with a clear authentication error message.

Proposed fix

 	public function send_cloudways_request(string $endpoint, array $data = [], string $method = 'POST') {

 		$token = $this->get_cloudways_access_token();

+		if (empty($token)) {
+			return new \WP_Error('cloudways-auth-failed', __('Failed to authenticate with Cloudways API', 'ultimate-multisite'));
+		}
+
 		$endpoint = '/' . ltrim($endpoint, '/');

inc/integrations/providers/runcloud/class-runcloud-integration.php (3)

48-51: Inconsistent string function usage.

This file uses strpos() for string detection while other integration files (Rocket, Cloudways) use str_contains(). For consistency and readability, consider using str_contains().

Proposed fix

 	public function detect(): bool {

-		return strpos(ABSPATH, 'runcloud') !== false;
+		return str_contains(ABSPATH, 'runcloud');
 	}

---

151-158: Logging full API responses may expose sensitive data.

The log message includes the full response body, which could contain sensitive information (tokens, credentials, or user data). Consider logging only non-sensitive metadata or redacting sensitive fields.

Proposed fix

 		$log_message = sprintf(
-			"Request: %s %s\nStatus: %s\nResponse: %s",
+			"Request: %s %s\nStatus: %s",
 			$method,
 			$url,
-			wp_remote_retrieve_response_code($response),
-			wp_remote_retrieve_body($response)
+			wp_remote_retrieve_response_code($response)
 		);
 		wu_log_add('integration-runcloud', $log_message);

---

170-183: Inconsistent return type in maybe_return_runcloud_body().

When the input is a WP_Error, the method returns a string (the error message) instead of propagating the WP_Error. This makes error handling inconsistent for callers. The docblock indicates it should return mixed|\WP_Error, but it returns a string for errors.

Proposed fix

 	public function maybe_return_runcloud_body($response) {

 		if (is_wp_error($response)) {
-			return $response->get_error_message();
+			return $response;
 		}

tests/WP_Ultimo/Integrations/Providers/GridPane_Domain_Mapping_Test.php (1)

119-128: Test may not correctly verify delegation behavior.

This test mocks send_gridpane_api_request and expects it to be called once, but test_connection() in GridPane_Domain_Mapping delegates to $this->get_gridpane()->test_connection(). If GridPane_Integration::test_connection() is not mocked and it internally calls send_gridpane_api_request, this works. However, the test assertion assertNotNull($result) is weak—it doesn't verify the actual return value or that delegation occurred correctly.

Consider mocking test_connection() directly on the integration to verify proper delegation:

Proposed fix

 	public function test_test_connection_delegates_to_integration(): void {

-		$this->integration->expects($this->once())
-			->method('send_gridpane_api_request')
-			->willReturn(['success' => true]);
+		$this->integration = $this->getMockBuilder(GridPane_Integration::class)
+			->onlyMethods(['send_gridpane_api_request', 'get_credential', 'test_connection'])
+			->getMock();
+
+		$this->integration->method('test_connection')
+			->willReturn(true);
+
+		$this->module->set_integration($this->integration);

 		$result = $this->module->test_connection();

-		$this->assertNotNull($result);
+		$this->assertTrue($result);
 	}