=== Devenia MCP Updater ===
Contributors: devenia
Tags: mcp, updates, automation, private, plugins
Requires at least: 6.8
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 0.1.5
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Private update channel and automatic sync for Devenia MCP and Abilities plugins.

== Description ==

Devenia MCP Updater connects Devenia MCP plugins to a private manifest and WordPress' native plugin update system.

It only accepts packages from the Devenia downloads channel and requires a matching SHA256 plus a passed WordPress.org Plugin Check gate in the manifest.

The goal is simple: WordPress sites should keep their MCP/Abilities plugin layer in sync automatically.

= What It Does =

* Adds private MCP plugin updates to WordPress' normal plugin update checks
* Enables unattended auto-updates for manifest-managed plugins
* Verifies package SHA256 before WordPress installs a ZIP
* Reconciles stale duplicate folders for manifest-managed plugins, such as `plugin-master`
* Ignores manifest entries that are missing a passed Plugin Check report
* Stores compact updater status

= Requirements =

* WordPress 6.8 or newer
* PHP 7.4 or newer
* WordPress filesystem updates working on the target site
* Network access to the Devenia private downloads channel
* Staged package ZIPs and Plugin Check reports generated by the Devenia release pipeline

= Manifest =

The updater reads the private manifest from:

`https://downloads.devenia.com/devenia-mcp-manifest.json`

Accepted manifest entries must include plugin file, version, package URL, SHA256 hash, and a passed Plugin Check status for the same SHA256.

= Safety Model =

* Only manifest-listed plugins are managed
* Only package URLs under the Devenia downloads path are accepted
* Every package is hash-verified before installation
* Stale duplicate folders are removed only when the canonical manifest plugin is installed
* Failed or stale Plugin Check reports block manifest entries
* If the manifest cannot be read, installed plugins are left untouched

= Release Gate =

Normal MCP/Abilities plugins must pass dev WordPress.org Plugin Check before entering the private manifest.

This plugin is the private update bootstrap for plugins that cannot be hosted on WordPress.org. Plugin Check is expected to flag it for changing update routines. That expected failure is allowed only for the known updater restriction codes. Any other Plugin Check error blocks release.

== Installation ==

1. Upload the plugin ZIP via WordPress Admin > Plugins > Add New > Upload Plugin
2. Activate the plugin
3. Trigger a normal WordPress update check or wait for WordPress cron

This plugin has no settings screen. It is controlled by the private manifest.

== Frequently Asked Questions ==

= Does this update every plugin on a site? =

No. It only manages known MCP/Abilities plugins listed in the Devenia manifest.

= Can an unchecked ZIP be installed? =

Not through this updater. The manifest entry must include a passed Plugin Check report for the same SHA256 as the package.

= What happens if the manifest is unavailable? =

The updater records a manifest error status and leaves the installed plugins unchanged.

== Changelog ==

= 0.1.5 =
* Mark the canonical plugin active for the next request during duplicate cleanup instead of loading a second copy in the current request.

= 0.1.4 =
* Deactivate stale duplicate plugin copies before activating the canonical manifest plugin to avoid duplicate PHP declarations.

= 0.1.3 =
* Detect and remove stale duplicate folders for manifest-managed plugins after activation, plugin upgrades, and periodic admin checks.
* Move active state from a stale duplicate folder to the canonical manifest plugin before deleting the duplicate.

= 0.1.2 =
* Accept only the canonical `https://downloads.devenia.com/<plugin>.zip` package channel at runtime.

= 0.1.1 =
* Move the private manifest and package channel to `https://downloads.devenia.com/`

= 0.1.0 =
* Initial private MCP update channel
* Add manifest-managed WordPress update integration
* Enable auto-update for known MCP/Abilities plugins
* Verify package SHA256 before install
* Require a passed Plugin Check gate for manifest entries
* Record compact updater status
