=== MevvCode ===
Contributors: mevvsoft
Tags: code snippets, php, javascript, css, safe mode
Requires at least: 6.6
Tested up to: 7.1
Requires PHP: 8.1
Stable tag: 1.3.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Run PHP, JavaScript, CSS, HTML and text snippets from a guarded, query-free file runtime.

== Description ==

MevvCode is a local-first WordPress snippet manager. Editable records compile into an atomic file generation and a small manifest, so the normal request path does not query a snippet table for source code.

The free edition includes:

* Unlimited PHP, JavaScript, CSS, HTML and text snippets.
* Global, front-end, admin, head, body-open, footer, content, shortcode, manual and once locations.
* PHP syntax checks, a last-known-good generation, runtime fault isolation and signed Safe Mode recovery.
* Visible AND/OR conditions, priorities, groups, tags, locks, search and bulk actions.
* Ten local revisions per snippet with restore.
* MevvCode JSON and readable PHP export, plus Code Snippets and WPCode import adapters.
* A sixty-entry starter library of working snippets — WooCommerce shipping, coupons, checkout, catalog, email and store admin, plus WordPress admin, performance, security, accessibility and content — with snippet packs that install a named group in one action.
* Generators and a standalone must-use loader.
* A staged, health-checked and reversible migration from Code Snippets.
* Role capabilities and a code-redacted, read-only REST API.

No telemetry is sent and no external CDN is loaded. Cloud and AI features exist only in the separately installed Pro companion and remain off until explicitly enabled.

= Code Snippets migration =

Migration does not begin by switching the old plugin off. MevvCode first imports into a staged set, preserves each source id and exact code, validates all formerly active PHP, snapshots the active-plugin list and current runtime, then compiles a complete generation. Code Snippets is deactivated only for the final cutover. A signed loopback health check commits the change; failure restores the former plugin list and manifest automatically.

The Code Snippets database tables are not deleted. A manual rollback remains available after a successful cutover.

== Installation ==

1. Upload the `mevvcode` directory to `/wp-content/plugins/`, or install `mevvcode-1.1.0.zip` through Plugins > Add New.
2. Activate MevvCode.
3. Open MevvCode in the WordPress admin menu.
4. Create and validate an inactive snippet before activating it.
5. If migrating, use MevvCode > Migration and complete the preview before cutover.

= The starter library =

Every bundled entry is a working snippet, not a placeholder, and each one states what it does and what visibly changes on the site. Values meant to be edited — thresholds, coupon codes, country lists — sit as plain constants at the top of the snippet.

Installing an entry, or a whole pack, files inactive drafts. Nothing from the library starts running until you activate it yourself on the Snippets screen. WooCommerce entries only register hooks, so installing one on a site without WooCommerce does nothing rather than causing an error; this is enforced by a test that loads every PHP entry with no WordPress or WooCommerce present.

== External services ==

This plugin connects to no third-party service. It has no telemetry, no
licence call, no remote font or CDN asset, and no AI or cloud provider.

One outbound HTTP request exists and it is addressed to your own site. During
a Code Snippets migration, after the new runtime has been compiled, MevvCode
requests your own home URL once with a signed one-time token appended
(`?mevvcode-health=<token>`) and reads the JSON reply.
Data sent: the signed token only — no site address beyond the one being
requested, no user data, no snippet code.
When: only when you press "Cut over" on the Migration screen.
Where: your own site, over the URL WordPress reports as `home_url()`. Nothing
leaves your server.

The paid MevvCode Pro companion is a separate plugin and is not part of this
package; the cloud and AI services it can use are declared in its own readme.

== Frequently Asked Questions ==

= Does a snippet database query run on every request? =

No. Editable records are compiled to an atomic file generation. The active request path reads the generated manifest and files.

= What happens when PHP contains a syntax error? =

It cannot replace the current known-good generation. The source stays editable and the dashboard reports the validation error.

= Can I go back to Code Snippets after migration? =

Yes. The source tables remain intact and the rollback action restores the prior active-plugin list and MevvCode manifest.

= Does uninstalling delete my snippets? =

No. User-authored snippet records and rollback material are retained unless you deliberately remove them.

= Is cloud access required? =

No. The free plugin is fully local and does not contact a cloud service for normal operation.

== Privacy ==

The free edition does not send snippet code, usage analytics or personal data to the publisher. Administrators choose whether to install Pro and separately opt in to cloud workspaces or AI review. Runtime error records never contain snippet source code, licence keys or request secrets.

== Changelog ==

= 1.3.1 =

* Every disk write — snippet records, compiled generations, revisions, snapshots, the standalone loader and migration state — now goes through the WordPress filesystem API instead of bare PHP calls. Behaviour is unchanged on a normal host; the plugin no longer assumes it may write directly.
* CSS snippets are printed the way WordPress prints its own Custom CSS, and JavaScript snippets through the core inline-script printer, so a snippet body still reaches the page byte for byte while the surrounding tag is built by WordPress.
* Text snippets are escaped on output. HTML snippets are unchanged: they are markup you authored and are printed verbatim.
* Input handling on every dashboard action was tightened: nonce verification now sits in the handler that reads the request, uploads are validated as uploads, and every query and form value is unslashed and sanitised at the point of use. Snippet source itself is deliberately untouched.
* Direct file access protection added to every PHP file.
* Library: the accessible skip link is one entry again instead of two. It carries its own focus styling, so it can no longer be installed in a state where the link is visible on every page; it stands aside on block themes, where WordPress already prints a working skip link; and its wording comes from WordPress' own catalogue, so it is translated everywhere the site is. The separate "Skip link style" entry, which existed only to keep the link from being broken, is replaced by a visible keyboard focus outline that is worth installing on its own.

= 1.3.0 =

* Starter library grown from ten entries to sixty, most of them WooCommerce store rules: shipping and free-shipping thresholds, coupon and pricing limits, checkout field and validation changes, catalog visibility, transactional email wording, store-admin tidying, performance and hardening. Every entry states what it does and what visibly changes, and every one is a working snippet — an automated gate runs the compiler's own syntax check over each PHP entry and loads all of them with no WordPress or WooCommerce present, so nothing in the library can fatal on a store that lacks WooCommerce.
* Snippet packs: install a named group of related entries in one action. A pack is all-or-nothing, and installs exactly what a single install does — inactive drafts. Bulk-installed code never starts running on its own.
* The Library screen now groups entries by category, states the effect of each one, and says plainly that installing files a draft rather than activating it.
* The Conditions screen documents the country rule: where the country comes from, and that MevvCode never sends a visitor IP address to an outside lookup service or stores one.

= 1.2.0 =

* Version bump to keep the free and Pro editions in lockstep. The new AI snippet generation and live pixel event capture live entirely in the Pro companion; the free runtime is unchanged.

= 1.1.2 =

* Ship a store-hosted update mechanism for the free edition. Not on WordPress.org, this plugin had no way to learn a new version existed.

= 1.1.1 =

* Ship the dashboard, migration flow, safety states and errors in seventeen more locales: German (DE/CH, plus a formal variant), Spanish (ES/MX/AR/CL/CO), French, Italian, Japanese, Dutch (NL/BE), Polish and Portuguese (PT/BR), and Russian.

= 1.1.0 =

* Add complete Turkish translations for the Free dashboard, migration flow, errors and WordPress plugin row.
* Add Settings, Documentation and Support links to the WordPress plugin list.
* Ship editable PO, compiled MO and POT language catalogues in the installable package.

= 1.0.1 =

* Preserve literal percentage sequences in imported snippet names and metadata.
* Match Code Snippets' early WordPress execution phase during cutover.

= 1.0.0 =

* Initial release.
* Atomic file runtime for PHP, JavaScript, CSS, HTML and text snippets.
* Safe Mode, fault isolation, conditions, revisions, roles and read-only REST.
* Portable import/export, starter library and standalone loader.
* Reversible Code Snippets migration with signed health verification.
