=== Cursor Connect ===
Contributors: dizwebdesign
Tags: cursor, ai, rest-api, automation, application-passwords
Requires at least: 6.4
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.2.24
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Connect Cursor to WordPress with an admin-controlled permission matrix.

== Description ==

Cursor Connect exposes a permissioned REST API so Cursor can inspect and (when allowed) manage a WordPress site. The API uses HTTP Basic authentication (Connect username + Application Password). There is no separate integration per product — any client that can call the REST API with those credentials could use it, but the plugin UI and setup wizard are built for Cursor.

* Setup wizard for Connect user + Application Password
* Capability matrix (content, media, plugins, themes, tools, and more)
* Analyze / dry-run mode to block writes
* Activity audit log
* Settings backup / restore
* Optional soft registration with the WordPress Abilities API when available

== Installation ==

1. Upload the `cursor-connect` folder to `/wp-content/plugins/`
2. Activate **Cursor Connect**
3. Complete the setup wizard (Connect user, Application Password, enable API)
4. Paste credentials into your Cursor workspace or local env file

== Frequently Asked Questions ==

= Does this require DWD Plugins Hub? =

No. Hub is optional for menu placement. Without Hub, Cursor Connect uses its own admin menu.

= Do I need HTTPS? =

Yes for Application Passwords on public sites (or a local/development environment where WordPress allows them).

== Changelog ==

= 1.2.24 =
* Run WordPress.org Plugin Check (PCP) through Connect: GET/POST `/plugins/check` (static checks only; requires Plugin Check active on the site).
* Permission `plugins.check` (read/analyze; on by default). Health includes Plugin Check status.
* Tested up to WordPress 7.1.

= 1.2.23 =
* Multisite: network activation/deactivation/uninstall loops per-site options; `wp_initialize_site` bootstrap for new subsites.

= 1.2.22 =
* Security: ignore unsigned heartbeat site_token updates (token only via verified signed path).

= 1.2.21 =
* Security: bind Connect REST to dedicated Connect user (or manage_options if unset); enforce WP caps on plugin/theme/media mutations; options_get read allowlist only.
* Security: ignore unsigned remote wipe banned flag (signed commands only).

= 1.2.20 =
* Fix remaining WP 6.7 early textdomain notice: hub registry and abilities labels use plain English until after init.

= 1.2.19 =
* Register abilities on wp_abilities_api_init; load textdomain on init; defer hub caps sync; allow package updates from the site host.

= 1.2.18 =
* Image uploads go to DWD Gallery first when that plugin is active; WordPress Media Library remains the fallback for non-images and failed ingest.

= 1.2.14 =
* DWD plugin compatibility: field maps (Project Manager tasks, Events Calendar), custom taxonomies on content API, `dwd_plugins` in health/site overview, extensibility filters.

= 1.2.13 =
* Content API: `project_id` and `task_status` for Project Manager `pm_task` posts.

= 1.2.12 =
* Content API: allow admin-visible custom post types (e.g. Project Manager projects and tasks).

= 1.2.11 =
* Honest copy: Cursor-first wording; clarify REST API + Application Password (no separate per-product agent integrations).

= 1.2.10 =
* Use the Cursor Connect / DWD icon in the admin menu and on Connect screen headings.

= 1.2.9 =
* Help is WordPress contextual Help only (Connect Cursor, coverage, limits, tips); removed the popup help modal.

= 1.2.8 =
* Admin Help: WordPress contextual Help tabs, dashboard Help corner control, coverage / limits / admin tips in the help modal.

= 1.2.7 =
* Tested up to WordPress 7.0 (Plugin Check).

= 1.2.6 =
* Plugin Check compliance: readme.txt, WP 6.4+ requirement alignment, safer file editor writes, sanitization / i18n tidy-ups.

= 1.2.5 =
* Central sanitization helpers, uninstall cleanup, update-chain parity.

= 1.2.4 =
* Setup wizard API-enabled notice refresh after step 4.

= 1.2.3 =
* Requires at least WordPress 6.0 header correction (superseded by 6.4 in 1.2.6).

== Upgrade Notice ==

= 1.2.11 =
Documentation and UI copy now describe Cursor Connect accurately (Cursor + REST API).

= 1.2.10 =
Shows the plugin icon in the admin menu and Connect headings.

= 1.2.9 =
Help lives in the WordPress Help panel (top right); popup modal removed.

= 1.2.8 =
Adds admin Help tabs covering capabilities, limits, and tips.

= 1.2.7 =
Documents Tested up to WordPress 7.0.

= 1.2.6 =
Recommended update for Plugin Check / WordPress.org guideline alignment.
