=== ADI Site Bridge ===
Contributors: adiuvo
Tags: ai, assistant, content editing, acf, elementor, woocommerce
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.1.5
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Lets ADI (Adiuvo's desktop assistant) read and edit this site's content — with your approval for every change and a restore point for each one.

== Description ==

ADI Site Bridge connects your site to ADI, the desktop assistant from Adiuvo. Ask ADI "change the Adult class heading to …" and it finds the right field, shows you the change, waits for your approval, makes it, and keeps a restore point.

It works with the way your site is built:

* Classic editor and page builders that use shortcodes (WPBakery, Divi, Avada) — text between shortcodes.
* Block editor (Gutenberg) — paragraphs, headings, lists, buttons, images, custom HTML.
* Elementor — widgets by their Elementor id (headings, text, buttons, images, icon boxes, lists, accordions, tabs).
* Advanced Custom Fields (ACF PRO, ACF, Secure Custom Fields) — fields, groups, repeaters, flexible content sections, and options pages such as Site Settings.
* WooCommerce — simple products' regular and sale prices (always shown with your store currency), sale dates, SKU and stock; products' categories and tags (existing ones), product image and gallery (Media Library images), and simple products' own attribute values — all through WooCommerce's own product API. Variable products: each variation's prices (with your store currency), sale dates, SKU, stock, enabled/disabled and image, one change at a time; variations are never added or removed and their attributes never change.

What it never does:

* It never changes SEO titles, meta descriptions, social previews or schema (those stay with your SEO tool — Reflect for Adiuvo clients).
* It never adds, removes or reorders sections, blocks or widgets; never changes page addresses; never deletes permanently.
* It never acts beyond the permissions of the WordPress user you choose.
* It never changes store settings (currency, tax, shipping), orders, customers, coupons or payments.

== Installation ==

1. In WordPress, go to Plugins → Add New → Upload Plugin, choose `adi-site-bridge-<version>.zip`, install and activate.
2. Go to Settings → ADI Bridge → New connection. Give it a name and choose the WordPress user ADI acts as. **A dedicated Editor account is recommended**, not an administrator: the bridge itself can only read, edit, publish or trash content, and can't add scripts, embeds (iframes), forms, event handlers or javascript: links through ADI, whatever the role (markup already on a page is left as it is), but whoever holds the token can change anything that user can edit.
   On a WooCommerce store, products need WooCommerce's product permissions: use a dedicated **Shop Manager** account (or an Editor whose role has been given WooCommerce's product permissions).
3. Copy the token shown (it is shown only once) and the site address.
4. In ADI: Settings → Connections → WordPress Site → paste the address and the token → Connect.

If ADI reports that the token was refused although it's correct, and Last used stays at "never", your host may strip the Authorization header. Update ADI first: version 1.1.28 and later also send the token in a header hosts leave alone. On an older ADI, on Apache, add this line near the top of `.htaccess`:

    SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1

== Security ==

* Tokens are stored only as hashes and can be revoked any time (Settings → ADI Bridge → Revoke); revoking takes effect immediately.
* Every request runs as the chosen WordPress user, so WordPress's own permissions apply. Users without full HTML rights can't save embeds or scripts through ADI either.
* Pages open in the WordPress editor are not changed (your next save would overwrite ADI's change).
* Every change keeps a restore point (the 20 most recent per page); ADI can put a page back in one step.
* Browser requests from other sites are refused; ADI connects over HTTPS only.

== Changelog ==

= 0.1.5 =
* ADI can add CSS to a page or (as an Administrator) to the whole site: "make the Junior page's banner green". The CSS is kept by this plugin, not in your theme, added after the theme's styles, with a restore point for every change. Tools → ADI Styles shows every ADI stylesheet and its history, and can switch any of it, or all of it, off.
* ADI can change the theme's Customizer settings (Appearance → Customize: header bar text, footer links, colours, logos…) through the theme's own checks, and edit or switch off block, Text and Custom HTML widgets. Like the Customizer itself, this needs an Administrator connection. Every change has a restore point.
* ADI stylesheets never hold @import, images from other sites, script or data addresses, old browser script hooks or markup.

= 0.1.4 =
* Two changes to the same page at the same moment are saved one after the other, so neither can undo the other, and "only if it still holds what I read" now holds under load.
* Undoing ADI's last change (while nothing else on the page has changed) puts the page back exactly, including harmless markup pasted from a chat app that ADI itself never adds. Scripts, embeds, forms, buttons, inputs, event handlers and script links are still never put back through ADI.
* Changes through ADI can no longer add data-* attributes that script libraries run code from (htmx, Datastar, Bootstrap toggles…), code-like data-* values, page-covering positioned elements, or links whose real address is a script once entities are decoded. Plain data-* values (a booking widget's link, a gallery id) stay editable.
* Updates now appear on the WordPress Plugins screen like any other plugin, with one-click Update now and auto-updates. Only releases signed by Adiuvo are offered or installed.

= 0.1.3 =
* Connects on hosts that remove the standard Authorization header before WordPress sees it. Needs the latest ADI.

= 0.1.2 =
* WooCommerce: edit simple products' regular and sale prices (shown with the store currency), sale dates, SKU and stock; assign existing categories and tags; set the product image and gallery from the Media Library; edit simple products' own attribute values.
* WooCommerce variable products: edit each variation's prices, sale dates, SKU, stock, enabled/disabled status and image; the product's price range updates automatically. Variations are never added or removed.
* Every WooCommerce change keeps a restore point; stock is only put back from a restore point taken for a stock change, because orders change stock in between.
* Store settings (currency, tax, shipping), orders, customers, coupons and payments are never changed.

= 0.1.1 =
* Security: no connection can add scripts, embeds (iframes), forms, event handlers or links other than http(s), mailto and tel, whatever its WordPress role; markup already on a page stays as it is. A stolen connection token can still change text, but can no longer add code (scripts or embeds) to the site.
* Security: a restore puts back only what ADI itself edits (field values, Elementor content, featured image), leaving other plugins' data alone.
* Security: WordPress never offers a same-named plugin from wordpress.org as an update to this one (Update URI).
* The connection tells ADI that site content is data, never instructions.
* Settings → ADI Bridge warns when a connection is created for an administrator; an Editor is recommended.
* Error messages no longer include database error text.

= 0.1.0 =
* First release: MCP endpoint, connection tokens, Classic / Block editor / Elementor / ACF editing, restore points, cache purging, SEO protection.
