Shortcodes mapping guide

Create a mapping

Open Cointacted → Shortcodes. Add a mapping and provide a terminal command, group, description, registered shortcode tag, optional default attributes, argument policy, visibility, and output mode. Save, then open Social Terminal and confirm the command appears for an intended user.

This plugin is an allowlist, not a generic shortcode console. It never accepts an arbitrary shortcode tag from terminal input. The administrator chooses the tag in advance; the server resolves the saved mapping, verifies access, constructs the shortcode from sanitized values, renders it, and converts the result into terminal-safe lines.

Worked mapping example

Suppose another plugin registers [member_badges user="current"]. In Cointacted → Shortcodes, create a command such as badges, select the registered member_badges tag, save user=current as a fixed default, disable visitor-supplied attributes, require a signed-in user, and choose text output. Save and run badges from a non-administrator test account.

The mapping should return only the sanitized badge output for the current actor. It must not allow badges user=42, a different shortcode tag, nested shortcodes, scripts, or a capability change unless those inputs were deliberately exposed by a reviewed argument policy.

Before publishing any mapping, record:

• the plugin that owns the shortcode and the minimum compatible version;
• every fixed attribute and every user-supplied attribute;
• the guest, role, or capability policy;
• the expected empty state and maximum useful output size;
• one allowed test and one denied test performed with a separate account.

Arguments and output

Keep user arguments disabled unless the selected shortcode has a documented, bounded attribute contract. Default attributes are useful for fixing a known view, identifier, or presentation mode. When arguments are allowed, test empty, malformed, repeated, and unauthorized values.

Use text output for concise shortcode results. Use the table-friendly mode only when the shortcode returns predictable row-like content. Complex interactive forms, scripts, account controls, payments, or nonce-bearing HTML are poor terminal mappings because terminal output is sanitized and is not a full page runtime.

Visibility

Mappings can be available to guests, signed-in users, administrators, roles, or capability-qualified users. Social Terminal applies its normal command normalization and dispatch guards, and Shortcodes rechecks mapping access on execution. Always test with a separate low-privilege account; an administrator test does not prove public visibility is safe.

MCP boundary

The read-only cointacted_shortcodes.get_status MCP tool may report mapping counts, missing shortcode tags, visibility categories, and readiness. It does not render shortcode output. Frontend MCP command execution is explicitly blocked because presentation-oriented shortcodes do not yet have a reviewed server-safe remote renderer.

Troubleshooting

• Command absent: confirm Social Terminal is active, the command name is valid, and the current user matches visibility.
• Missing shortcode: activate the plugin that registers the selected tag, then revisit the mapping status.
• Empty output: run the shortcode on a private WordPress test page and verify its required attributes and current-user assumptions.
• Formatting looks wrong: select the appropriate output mode and simplify the source shortcode output.
• REST execution rejected: use the terminal runtime with its nonce/access context; the public route still validates the mapping and actor.
• MCP refuses execution: this is intentional in version 1.0.25.

Removing this plugin removes the command bridge, not the third-party shortcode or its underlying content.