saddle.php

<?php
/**
 * Plugin Name:       Saddle
 * Plugin URI:        https://saddle.to
 * Description:       Let Claude, ChatGPT and Cursor work on your site through MCP. Each app starts read-only, and every delete asks you first.
 * Version:           1.5.2
 * Requires at least: 6.9
 * Requires PHP:      7.4
 * Author:            PlugPress
 * Author URI:        https://saddle.to
 * License:           GPL-2.0-or-later
 * License URI:       https://www.gnu.org/licenses/gpl-2.0.html
 * Text Domain:       saddle
 * Domain Path:       /languages
 *
 * @package Saddle
 */

defined( 'ABSPATH' ) || exit;

define( 'SADDLE_VERSION', '1.5.2' );
define( 'SADDLE_FILE', __FILE__ );
define( 'SADDLE_DIR', plugin_dir_path( __FILE__ ) );
define( 'SADDLE_URL', plugin_dir_url( __FILE__ ) );
define( 'SADDLE_MIN_WP', '6.9' );
// The admin app's extension-contract version (admin/src/extensions.js).
// Deliberately decoupled from SADDLE_VERSION: addons feature-detect this
// constant (never a plugin-version floor), and it bumps ONLY on breaking
// changes to the wp.hooks seams or the ui context object.
//
// 2 (the unified admin, #274): the in-page nav is gone, so a
// `saddle.admin.tabs` entry renders as a section on Settings instead of a
// page of its own; `screens`, `homeCards`, `connectionCards` and the `mount`
// action are new. Everything a v1 addon registers still renders.
define( 'SADDLE_SHELL_VERSION', 2 );

// The saddle/wc-* tools use only WooCommerce's CRUD API (wc_get_products,
// wc_get_orders), never raw post/postmeta queries, so they are safe with
// High-Performance Order Storage on.
add_action(
	'before_woocommerce_init',
	static function () {
		if ( class_exists( '\Automattic\WooCommerce\Utilities\FeaturesUtil' ) ) {
			\Automattic\WooCommerce\Utilities\FeaturesUtil::declare_compatibility( 'custom_order_tables', __FILE__, true );
		}
	}
);

/**
 * Load plugin classes.
 *
 * Note: Saddle_Ecosystem is intentionally NOT loaded — it is parked Phase 3
 * scope (see https://github.com/plugpressco/saddle/issues/12). Do not require it without reopening that decision.
 */
require_once SADDLE_DIR . 'includes/class-saddle-builders.php';
require_once SADDLE_DIR . 'includes/class-saddle-tree.php';
require_once SADDLE_DIR . 'includes/class-saddle-blocks-tree.php';
require_once SADDLE_DIR . 'includes/class-saddle-blocks-author.php';
require_once SADDLE_DIR . 'includes/class-saddle-blocks-schema.php';
require_once SADDLE_DIR . 'includes/class-saddle-recipes.php';
require_once SADDLE_DIR . 'includes/class-saddle-blocks-echo.php';
require_once SADDLE_DIR . 'includes/lint/interface-saddle-lint-accessor.php';
require_once SADDLE_DIR . 'includes/lint/interface-saddle-lint-style-accessor.php';
require_once SADDLE_DIR . 'includes/lint/interface-saddle-lint-link-accessor.php';
require_once SADDLE_DIR . 'includes/lint/class-saddle-lint.php';
require_once SADDLE_DIR . 'includes/lint/class-saddle-lint-rule.php';
require_once SADDLE_DIR . 'includes/lint/class-saddle-lint-color.php';
require_once SADDLE_DIR . 'includes/lint/class-saddle-lint-gutenberg-accessor.php';
require_once SADDLE_DIR . 'includes/lint/rules/class-rule-empty-title.php';
require_once SADDLE_DIR . 'includes/lint/rules/class-rule-button-contrast.php';
require_once SADDLE_DIR . 'includes/lint/rules/class-rule-ghost-button.php';
require_once SADDLE_DIR . 'includes/lint/rules/class-rule-double-background.php';
require_once SADDLE_DIR . 'includes/lint/rules/class-rule-mixed-accents.php';
require_once SADDLE_DIR . 'includes/lint/rules/class-rule-unaligned-buttons.php';
require_once SADDLE_DIR . 'includes/lint/rules/class-rule-section-padding.php';
require_once SADDLE_DIR . 'includes/lint/rules/class-rule-single-column-flow.php';
require_once SADDLE_DIR . 'includes/lint/rules/class-rule-featured-plan.php';
require_once SADDLE_DIR . 'includes/lint/rules/class-rule-text-contrast.php';
require_once SADDLE_DIR . 'includes/lint/rules/class-rule-missing-alt.php';
require_once SADDLE_DIR . 'includes/lint/rules/class-rule-heading-order.php';
require_once SADDLE_DIR . 'includes/lint/rules/class-rule-link-text.php';
require_once SADDLE_DIR . 'includes/render/interface-saddle-render-accessor.php';
require_once SADDLE_DIR . 'includes/render/class-saddle-render.php';
require_once SADDLE_DIR . 'includes/render/class-saddle-render-gutenberg-accessor.php';
require_once SADDLE_DIR . 'includes/builders/interface-saddle-builder-driver.php';
require_once SADDLE_DIR . 'includes/builders/class-saddle-builder-registry.php';
require_once SADDLE_DIR . 'includes/builders/divi/class-saddle-divi.php';
require_once SADDLE_DIR . 'includes/builders/divi/class-saddle-divi-tree.php';
require_once SADDLE_DIR . 'includes/builders/divi/class-saddle-divi-author.php';
require_once SADDLE_DIR . 'includes/builders/divi/class-saddle-divi-schema.php';
require_once SADDLE_DIR . 'includes/builders/divi/class-saddle-divi-echo.php';
require_once SADDLE_DIR . 'includes/builders/divi/class-saddle-divi-driver.php';
require_once SADDLE_DIR . 'includes/builders/divi/trait-saddle-divi-attr-resolution.php';
require_once SADDLE_DIR . 'includes/builders/divi/class-saddle-divi-view.php';
require_once SADDLE_DIR . 'includes/builders/divi/class-saddle-divi-bundle.php';
require_once SADDLE_DIR . 'includes/builders/divi/class-saddle-divi-recipes.php';
require_once SADDLE_DIR . 'includes/builders/divi/class-saddle-divi-lint-accessor.php';
require_once SADDLE_DIR . 'includes/builders/divi/class-saddle-divi-render-accessor.php';
require_once SADDLE_DIR . 'includes/builders/divi/class-saddle-divi-verify.php';
require_once SADDLE_DIR . 'includes/builders/divi/class-saddle-divi-context.php';
require_once SADDLE_DIR . 'includes/lint/rules/class-rule-sibling-monotony.php';
require_once SADDLE_DIR . 'includes/lint/rules/class-rule-preset-coupling.php';
require_once SADDLE_DIR . 'includes/lint/rules/class-rule-pinned-max-width.php';
require_once SADDLE_DIR . 'includes/lint/rules/class-rule-theme-css-class.php';
require_once SADDLE_DIR . 'includes/lint/rules/class-rule-unknown-module.php';
require_once SADDLE_DIR . 'includes/preview/class-saddle-preview.php';
require_once SADDLE_DIR . 'includes/verify/class-saddle-verify.php';
require_once SADDLE_DIR . 'includes/class-saddle-capabilities.php';
require_once SADDLE_DIR . 'includes/class-saddle-access.php';
require_once SADDLE_DIR . 'includes/class-saddle-approval.php';
require_once SADDLE_DIR . 'includes/class-saddle-context.php';
require_once SADDLE_DIR . 'includes/class-saddle-context-bundle.php';
require_once SADDLE_DIR . 'includes/class-saddle-playbook.php';
require_once SADDLE_DIR . 'includes/class-saddle-skills.php';
require_once SADDLE_DIR . 'includes/class-saddle-prompts.php';
require_once SADDLE_DIR . 'includes/class-saddle-memory.php';
require_once SADDLE_DIR . 'includes/class-saddle-log.php';
require_once SADDLE_DIR . 'includes/class-saddle-journal.php';
require_once SADDLE_DIR . 'includes/class-saddle-undo.php';
require_once SADDLE_DIR . 'includes/class-saddle-undo-steps.php';
require_once SADDLE_DIR . 'includes/class-saddle-rehearsal.php';
require_once SADDLE_DIR . 'includes/class-saddle-tool-modes.php';
require_once SADDLE_DIR . 'includes/class-saddle-post-types.php';
require_once SADDLE_DIR . 'includes/class-saddle-update-runner.php';
require_once SADDLE_DIR . 'includes/class-saddle-install-runner.php';
require_once SADDLE_DIR . 'includes/class-saddle-offer-runner.php';
require_once SADDLE_DIR . 'includes/class-saddle-directory.php';
require_once SADDLE_DIR . 'includes/class-saddle-unsplash.php';
require_once SADDLE_DIR . 'includes/class-saddle-connection.php';
require_once SADDLE_DIR . 'includes/class-saddle-http.php';
require_once SADDLE_DIR . 'includes/class-saddle-accessors.php';
require_once SADDLE_DIR . 'includes/class-saddle-integration-engine.php';
require_once SADDLE_DIR . 'includes/class-saddle-integrations.php';
require_once SADDLE_DIR . 'includes/class-saddle-services-connector.php';
require_once SADDLE_DIR . 'includes/class-saddle-service-sources.php';
require_once SADDLE_DIR . 'includes/class-saddle-services.php';
require_once SADDLE_DIR . 'includes/trait-saddle-mutation-log.php';
require_once SADDLE_DIR . 'includes/integrations/class-saddle-seo-advice.php';
require_once SADDLE_DIR . 'includes/integrations/yoast/class-saddle-yoast.php';
require_once SADDLE_DIR . 'includes/integrations/yoast/class-saddle-yoast-seo.php';
require_once SADDLE_DIR . 'includes/integrations/yoast/class-saddle-yoast-schema.php';
require_once SADDLE_DIR . 'includes/integrations/rank-math/class-saddle-rank-math.php';
require_once SADDLE_DIR . 'includes/integrations/rank-math/class-saddle-rank-math-seo.php';
require_once SADDLE_DIR . 'includes/integrations/aioseo/class-saddle-aioseo.php';
require_once SADDLE_DIR . 'includes/integrations/aioseo/class-saddle-aioseo-seo.php';
require_once SADDLE_DIR . 'includes/integrations/woocommerce/class-saddle-wc.php';
require_once SADDLE_DIR . 'includes/integrations/class-saddle-seo-skills.php';
require_once SADDLE_DIR . 'includes/class-saddle-mcp.php';
require_once SADDLE_DIR . 'includes/class-saddle-mcp-diagnostics.php';
require_once SADDLE_DIR . 'includes/class-saddle-connections.php';
require_once SADDLE_DIR . 'includes/class-saddle-connection-apps.php';

// Adapter-only. class-saddle-bundled-adapter.php is absent from every zip along
// with the library itself, so file_exists() makes it a no-op there, exactly as
// for class-saddle-updater.php. class-saddle-mcp-compat.php ships on purpose
// (#111): a site may run the official MCP Adapter plugin, which it patches.
foreach ( array( 'class-saddle-bundled-adapter.php', 'class-saddle-mcp-compat.php' ) as $saddle_adapter_file ) {
	if ( file_exists( SADDLE_DIR . 'includes/' . $saddle_adapter_file ) ) {
		require_once SADDLE_DIR . 'includes/' . $saddle_adapter_file;
	}
}
unset( $saddle_adapter_file );
require_once SADDLE_DIR . 'includes/oauth/class-saddle-oauth.php';
require_once SADDLE_DIR . 'includes/oauth/class-saddle-oauth-store.php';
require_once SADDLE_DIR . 'includes/oauth/class-saddle-oauth-discovery.php';
require_once SADDLE_DIR . 'includes/oauth/class-saddle-oauth-clients.php';
require_once SADDLE_DIR . 'includes/oauth/class-saddle-oauth-endpoints.php';
require_once SADDLE_DIR . 'includes/oauth/class-saddle-oauth-consent.php';
require_once SADDLE_DIR . 'includes/oauth/class-saddle-oauth-bearer.php';
require_once SADDLE_DIR . 'includes/class-saddle-first-look.php';
require_once SADDLE_DIR . 'includes/class-saddle-onboarding.php';
require_once SADDLE_DIR . 'includes/class-saddle-modules.php';
require_once SADDLE_DIR . 'includes/class-saddle-settings-registry.php';
require_once SADDLE_DIR . 'includes/class-saddle-settings-guard.php';
require_once SADDLE_DIR . 'includes/class-saddle-settings-view.php';
require_once SADDLE_DIR . 'includes/class-saddle-core-settings.php';
require_once SADDLE_DIR . 'includes/class-saddle-modules-view.php';
require_once SADDLE_DIR . 'includes/class-saddle-notices.php';
require_once SADDLE_DIR . 'includes/admin/class-saddle-rest.php';
require_once SADDLE_DIR . 'includes/admin/class-saddle-notices-admin.php';
require_once SADDLE_DIR . 'includes/admin/class-saddle-connections-rest.php';
require_once SADDLE_DIR . 'includes/admin/class-saddle-approvals-rest.php';
require_once SADDLE_DIR . 'includes/admin/class-saddle-tool-modes-rest.php';
require_once SADDLE_DIR . 'includes/admin/class-saddle-services-rest.php';
require_once SADDLE_DIR . 'includes/admin/class-saddle-onboarding-rest.php';
require_once SADDLE_DIR . 'includes/admin/class-saddle-modules-rest.php';
require_once SADDLE_DIR . 'includes/admin/class-saddle-nav-icons.php';
require_once SADDLE_DIR . 'includes/admin/class-saddle-module-nav.php';
require_once SADDLE_DIR . 'includes/admin/class-saddle-settings.php';

/*
 * Self-hosted updates — PRESENT ONLY IN THE SELF-HOSTED BUILD.
 *
 * The WordPress.org build ships without `class-saddle-updater.php` (the zip
 * task drops it), because a plugin in the directory must not fetch its own
 * updates from a third-party host. The file's absence is the switch: there is
 * no constant to set and no option to forget, and an install that later
 * updates to a .org zip simply loses the file and falls back to WordPress's
 * native updates.
 */
if ( file_exists( SADDLE_DIR . 'includes/class-saddle-updater.php' ) ) {
	require_once SADDLE_DIR . 'includes/class-saddle-updater.php';
}

/**
 * Bootstrap container. Wires WordPress hooks to the plugin's components.
 */
final class Saddle {

	/**
	 * Boot the plugin.
	 */
	public static function init() {
		// Recover a stripped Basic Authorization header for REST/API requests so
		// core's Application Password auth still works on hosts that mangle it.
		// Must run before REST authentication; priority 1 on plugins_loaded.
		add_action( 'plugins_loaded', array( 'Saddle_Connection', 'recover_auth_header' ), 1 );

		// Credential scoping: a Saddle-issued Application Password only opens
		// Saddle's own endpoint — never wp/v2, wp-abilities/v1, or XML-RPC.
		add_filter( 'rest_request_before_callbacks', array( 'Saddle_Connection', 'scope_credentials' ), 10, 3 );
		add_action( 'wp_authenticate_application_password_errors', array( 'Saddle_Connection', 'block_xmlrpc_credentials' ), 10, 3 );

		// Make a bare 401 legible: a revoked/rejected key (reconnect) reads
		// differently from a stripped Authorization header (host config). Late
		// priority so core has already produced its auth result to relabel.
		add_filter( 'rest_authentication_errors', array( 'Saddle_Connection', 'explain_auth_error' ), 20 );

		// Self-hosted updates, when this is the self-hosted build. Scoped to
		// admin + cron: the update transient is only ever built there, and
		// cron is NOT optional — `wp_update_plugins` runs as a scheduled event,
		// so an is_admin()-only guard would silently kill background updates.
		if ( class_exists( 'Saddle_Updater' ) && ( is_admin() || wp_doing_cron() ) ) {
			Saddle_Updater::init();
		}

		// Always-on infrastructure (independent of the Abilities API).
		// The preview serving path stays up even when minting isn't — an
		// outstanding token must keep working for its full (short) life.
		Saddle_Preview::register();
		add_action( 'init', array( 'Saddle_Approval', 'register_cpt' ) );
		add_action( 'init', array( 'Saddle_Log', 'register_cpt' ) );
		add_action( 'init', array( 'Saddle_OAuth_Store', 'register_cpt' ) );
		add_action( 'init', array( 'Saddle_Skills', 'register_cpt' ) );
		add_action( 'init', array( 'Saddle_Memory', 'register_cpt' ) );

		// Skills index + core memory ride the same context every session
		// receives (the initialize handshake + get-instructions), via the
		// shared filter.
		add_filter( 'saddle_context_sections', array( 'Saddle_Skills', 'context_section' ) );

		// The build-a-page playbook, bundled with free on a block theme. It is
		// a skill rather than context prose so the how-to stays behind one
		// call instead of riding every session's token budget.
		add_filter( 'saddle_builtin_skills', array( 'Saddle_Playbook', 'register' ) );

		// The context bundle caches the site's working memory. Anything that
		// changes which blocks, patterns or templates exist must drop it; the
		// content signature catches the rest on the next read.
		add_action( 'activated_plugin', array( 'Saddle_Context_Bundle', 'flush' ) );
		add_action( 'deactivated_plugin', array( 'Saddle_Context_Bundle', 'flush' ) );
		add_action( 'switch_theme', array( 'Saddle_Context_Bundle', 'flush' ) );
		add_action( 'saddle_flush_cache', array( 'Saddle_Context_Bundle', 'flush' ) );
		add_filter( 'saddle_context_sections', array( 'Saddle_Memory', 'context_section' ) );
		add_action( 'rest_api_init', array( 'Saddle_REST_Admin', 'register_routes' ) );
		Saddle_Notices_Admin::register();
		add_action( 'rest_api_init', array( 'Saddle_Connection', 'register_routes' ) );
		add_action( 'rest_api_init', array( 'Saddle_MCP_Diagnostics', 'register_routes' ) );
		add_action( 'init', array( 'Saddle_Unsplash', 'register_taxonomy' ) );
		Saddle_Unsplash::register_admin_hooks();
		// Unsplash in Settings → Connectors, where core has the registry.
		Saddle_Services_Connector::register_hooks();
		// Priority 9: the Saddle menu exists before a sibling plugin adds to it
		// at the default 10. Its order is settled once every plugin has added
		// its items (see Saddle_Settings::order_submenu()).
		add_action( 'admin_menu', array( 'Saddle_Settings', 'register_menu' ), 9 );
		add_action( 'admin_menu', array( 'Saddle_Settings', 'order_submenu' ), 999 );
		add_action( 'admin_init', array( 'Saddle_Settings', 'redirect_legacy' ) );
		add_filter( 'plugin_action_links_' . plugin_basename( SADDLE_FILE ), array( 'Saddle_Settings', 'action_links' ) );
		add_action( 'admin_enqueue_scripts', array( 'Saddle_Modules', 'register_palette' ), 1 );
		add_action( 'admin_enqueue_scripts', array( 'Saddle_Settings', 'enqueue_assets' ) );
		add_action( Saddle_Approval::GC_HOOK, array( 'Saddle_Approval', 'gc' ) );
		add_action( Saddle_Approval::GC_HOOK, array( 'Saddle_Log', 'gc' ) );
		add_action( Saddle_Approval::GC_HOOK, array( 'Saddle_Memory', 'gc' ) );
		add_action( Saddle_Approval::GC_HOOK, array( 'Saddle_OAuth_Store', 'gc' ) );

		// The Divi context bundle stales on plugin churn (module packs) and
		// theme switches (Divi versions); its signature self-corrects even when
		// a hook is missed, but flushing keeps the next session fast and fresh.
		// The module-schema index is keyed on Divi version + active plugins, so
		// a pack updated in place needs an explicit clear too.
		add_action( 'activated_plugin', array( 'Saddle_Divi_Bundle', 'flush' ) );
		add_action( 'deactivated_plugin', array( 'Saddle_Divi_Bundle', 'flush' ) );
		add_action( 'switch_theme', array( 'Saddle_Divi_Bundle', 'flush' ) );
		add_action( 'upgrader_process_complete', array( 'Saddle_Divi_Schema', 'flush_index' ) );
		add_action( 'saddle_flush_cache', array( 'Saddle_Divi_Schema', 'flush_index' ) );
		add_action( 'saddle_flush_cache', array( 'Saddle_Divi_Bundle', 'flush' ) );

		// OAuth 2.1 authorization server. Off by default; Saddle_OAuth::register()
		// wires only the bearer resolver and the 401 challenge until the owner
		// turns it on, so a site that never connects ChatGPT never exposes an
		// OAuth surface. See includes/oauth/class-saddle-oauth.php for why this
		// exists alongside Application Passwords rather than replacing them.
		Saddle_OAuth::register();

		// The connection registry: which app each credential is, and whether it
		// has made its first tool call. Observes the MCP route on either
		// transport, and forgets a credential when it is revoked.
		Saddle_Connections::register();
		// Per-app access roles: the migration and the key clean-up.
		Saddle_Access::register();
		add_action( 'rest_api_init', array( 'Saddle_Connections_REST', 'register_routes' ) );
		add_action( 'rest_api_init', array( 'Saddle_Approvals_REST', 'register_routes' ) );
		add_action( 'rest_api_init', array( 'Saddle_Tool_Modes_REST', 'register_routes' ) );
		add_action( 'rest_api_init', array( 'Saddle_Services_REST', 'register_routes' ) );
		add_action( 'rest_api_init', array( 'Saddle_Modules_REST', 'register_routes' ) );

		// First-run and module onboarding state (#277).
		add_action( 'rest_api_init', array( 'Saddle_Onboarding_REST', 'register_routes' ) );

		// The background update runner: hooks its one-shot cron event so a run
		// queued by update-plugin / update-theme fires even when the abilities
		// themselves are not loaded on that request.
		Saddle_Update_Runner::init();

		// The change journal: records what each saddle/* tool replaces, so the
		// log entry for that call can be undone (saddle/undo-changes).
		Saddle_Journal::init();

		// Rehearsal mode wraps every write tool at registration, so it has to
		// be hooked before wp_abilities_api_init fires.
		Saddle_Rehearsal::init();
		Saddle_Tool_Modes::init();

		// The MCP surface and abilities require core's Abilities API (WP 6.9+).
		if ( self::abilities_api_available() ) {
			require_once SADDLE_DIR . 'includes/abilities/core-content.php';
			require_once SADDLE_DIR . 'includes/abilities/blocks.php';
			require_once SADDLE_DIR . 'includes/abilities/site-editor.php';
			require_once SADDLE_DIR . 'includes/abilities/site-editor-writes.php';
			require_once SADDLE_DIR . 'includes/abilities/site.php';
			require_once SADDLE_DIR . 'includes/abilities/updates.php';
			require_once SADDLE_DIR . 'includes/abilities/installs.php';
			require_once SADDLE_DIR . 'includes/abilities/core-updates.php';
			require_once SADDLE_DIR . 'includes/abilities/users.php';
			require_once SADDLE_DIR . 'includes/abilities/context.php';
			require_once SADDLE_DIR . 'includes/abilities/lint.php';
			require_once SADDLE_DIR . 'includes/abilities/render.php';
			require_once SADDLE_DIR . 'includes/abilities/verify.php';
			require_once SADDLE_DIR . 'includes/abilities/memory.php';
			require_once SADDLE_DIR . 'includes/abilities/undo.php';
			require_once SADDLE_DIR . 'includes/abilities/modules.php';
			require_once SADDLE_DIR . 'includes/abilities/menus.php';
			require_once SADDLE_DIR . 'includes/abilities/unsplash.php';
			require_once SADDLE_DIR . 'includes/abilities/yoast.php';
			require_once SADDLE_DIR . 'includes/abilities/rank-math.php';
			require_once SADDLE_DIR . 'includes/abilities/aioseo.php';
			require_once SADDLE_DIR . 'includes/abilities/woocommerce.php';
			require_once SADDLE_DIR . 'includes/abilities/divi.php';
			require_once SADDLE_DIR . 'includes/abilities/divi-design.php';
			require_once SADDLE_DIR . 'includes/abilities/divi-templates.php';
			require_once SADDLE_DIR . 'includes/abilities/divi-bundle.php';
			add_action( 'wp_abilities_api_categories_init', 'saddle_register_ability_category' );
			add_action( 'wp_abilities_api_init', 'saddle_register_abilities' );
			add_action( 'wp_abilities_api_init', 'saddle_register_block_abilities' );
			add_action( 'wp_abilities_api_init', 'saddle_register_site_editor_abilities' );
			add_action( 'wp_abilities_api_init', 'saddle_register_site_editor_write_abilities' );
			add_action( 'wp_abilities_api_init', 'saddle_register_site_abilities' );
			add_action( 'wp_abilities_api_init', 'saddle_register_update_abilities' );
			add_action( 'wp_abilities_api_init', 'saddle_register_install_abilities' );
			add_action( 'wp_abilities_api_init', 'saddle_register_core_update_abilities' );
			add_action( 'wp_abilities_api_init', 'saddle_register_user_abilities' );
			add_action( 'wp_abilities_api_init', 'saddle_register_context_abilities' );
			add_action( 'wp_abilities_api_init', 'saddle_register_lint_abilities' );
			add_action( 'wp_abilities_api_init', 'saddle_register_render_abilities' );
			add_action( 'wp_abilities_api_init', 'saddle_register_verify_abilities' );
			add_action( 'wp_abilities_api_init', 'saddle_register_memory_abilities' );
			add_action( 'wp_abilities_api_init', 'saddle_register_undo_abilities' );
			add_action( 'wp_abilities_api_init', 'saddle_register_module_abilities' );
			add_filter( 'saddle_context_sections', array( 'Saddle_Module_Abilities', 'context_section' ) );
			add_action( 'wp_abilities_api_init', 'saddle_register_menu_abilities' );
			add_action( 'wp_abilities_api_init', 'saddle_register_unsplash_abilities' );
			// Native SEO and WooCommerce integrations register at 30 behind
			// saddle_register_ability_once(): an older add-on that still
			// registers these names at 20 keeps its copy, with no duplicates.
			add_action( 'wp_abilities_api_init', 'saddle_register_yoast_abilities', 30 );
			add_action( 'wp_abilities_api_init', 'saddle_register_rankmath_abilities', 30 );
			add_action( 'wp_abilities_api_init', 'saddle_register_aioseo_abilities', 30 );
			add_action( 'wp_abilities_api_init', 'saddle_register_wc_abilities', 30 );
			add_action( 'wp_abilities_api_init', 'saddle_register_divi_abilities', 30 );
			add_action( 'wp_abilities_api_init', 'saddle_register_divi_design_abilities', 30 );
			add_action( 'wp_abilities_api_init', 'saddle_register_divi_template_abilities', 30 );
			add_action( 'wp_abilities_api_init', 'saddle_register_divi_bundle_abilities', 30 );
			// First-party integration wrappers run late (30) so the partner
			// plugins' own abilities exist to discover.
			add_action( 'wp_abilities_api_init', array( 'Saddle_Integrations', 'register_wrappers' ), 30 );
			add_filter( 'saddle_context_sections', array( 'Saddle_Integrations', 'context_section' ) );
			add_filter( 'saddle_context_sections', array( 'Saddle_Services', 'context_section' ) );
			Saddle_Seo_Skills::register();
			Saddle_Divi_Context::register();

			// Wire the MCP transport after all plugins have loaded. This MUST be
			// deferred (see setup_mcp_transport) so the bundled adapter can't
			// collide with a standalone mcp-adapter plugin.
			add_action( 'plugins_loaded', array( __CLASS__, 'setup_mcp_transport' ) );
		} else {
			// Priority 0: prints before the notice quarantine opens on
			// Saddle's own screen (Saddle_Settings::setup_notice_quarantine).
			add_action( 'admin_notices', array( __CLASS__, 'abilities_api_notice' ), 0 );
		}
	}

	/**
	 * Wire the MCP transport, deferred to `plugins_loaded`.
	 *
	 * The bundled WP\MCP library must NOT load during Saddle's own plugin-include
	 * phase. If a standalone mcp-adapter plugin is also active, whichever loads
	 * the library first would make the other's un-guarded `require_once
	 * Autoloader.php` fatal on class redeclaration. By waiting until
	 * plugins_loaded — after every plugin main file is included — a standalone
	 * copy (if any) has already defined WP\MCP and we defer to it. Only when no
	 * copy exists do we load Saddle's bundle.
	 *
	 * The official adapter serves the MCP endpoint; if it can't load at all,
	 * Saddle's built-in transport takes over. Both serve /saddle/v1/mcp, and the
	 * tier + approval gate live in the abilities regardless of transport.
	 */
	public static function setup_mcp_transport() {
		// Saddle declares exactly one MCP endpoint: /saddle/v1/mcp. The adapter
		// also stands up a shared one at /wp-json/mcp/mcp-adapter-default-server
		// (discover-abilities, get-ability-info, execute-ability) for every
		// ability marked `mcp.public` — with no transport permission callback,
		// so none of the legible 401s, OAuth challenge or traffic trace Saddle's
		// own endpoint has (issue #86). Saddle's tools are no longer marked
		// public (saddle_ability_meta()), so they never appear there.
		//
		// That server is not Saddle's to switch off for everyone, though:
		// Gravity Forms' "Site MCP" mode and any plugin like it serve their
		// tools through it (issue #219). So it is dropped only on a site where
		// nothing else exposes an ability to it — a Saddle-only site keeps the
		// single endpoint #86 decided on. Third-party hook, the adapter's name;
		// it fires on the bundled copy and on a standalone one alike, which is
		// why it sits outside the class_exists() below.
		add_action( 'mcp_adapter_init', array( 'Saddle_MCP', 'limit_default_server' ), 5 );

		// Absent from the WordPress.org build, together with the library it
		// loads. Guarded at the point of use, per the house rule — a guard that
		// is always true hides the mistake it was meant to catch.
		if ( class_exists( 'Saddle_Bundled_Adapter' ) ) {
			Saddle_Bundled_Adapter::load();
		}

		// The traffic recorder is transport-agnostic and belongs on both paths:
		// the build most likely to need it is the one without the adapter.
		Saddle_MCP_Diagnostics::register();

		// Spec conformance Saddle owns on BOTH transports: a JSON-RPC
		// notification on our route must be answered 202 with no body, and on
		// the adapter path that answer would otherwise be the MCP Adapter
		// plugin's, at whatever version the site happens to have (#155).
		add_action( 'rest_api_init', array( 'Saddle_MCP', 'register_spec_guards' ) );

		// Whichever transport ends up serving, /saddle/v1/mcp must exist. Runs
		// after the adapter's own init (rest_api_init 15), so by then we know
		// whether our server came up on it.
		add_action( 'rest_api_init', array( 'Saddle_MCP', 'ensure_route' ), 99 );

		if ( self::adapter_available() ) {
			// The class being loadable does not mean the adapter is running.
			// Gravity Forms 3.1 ships the adapter in its autoloader on every
			// request but only calls instance() when its own MCP setting is on,
			// which it is not by default — so mcp_adapter_init never fired,
			// Saddle registered nothing, and the endpoint was a 404 on every
			// site that installed it. instance() is an idempotent singleton:
			// if the owner of that copy already started it, this is a no-op.
			if ( method_exists( '\\WP\\MCP\\Core\\McpAdapter', 'instance' ) ) {
				\WP\MCP\Core\McpAdapter::instance();
			}

			// Third-party hook, owned by the MCP Adapter plugin — its name is
			// theirs, and this is the documented way to register a server with
			// it. Reached only when that plugin is present.
			add_action( 'mcp_adapter_init', array( 'Saddle_MCP', 'register_adapter_server' ) );

			// Shims the adapter's session and protocol-header strictness.
			//
			// The guard stays — it is the house rule — but it no longer fails
			// quietly. This exact class_exists() returned false in every build
			// for a month because the zip excluded the file, and the only
			// symptom reachable from outside was ChatGPT reporting that the
			// site has no callable actions (#111). A guard whose false branch
			// is invisible is how that lasted, so the false branch now says so
			// where the owner and a support conversation can both see it.
			if ( class_exists( 'Saddle_MCP_Compat' ) ) {
				Saddle_MCP_Compat::register();
			} else {
				// Noted, not recorded: the health record is rewritten wholesale
				// on mcp_adapter_init, a few hooks later, so anything written
				// here would be erased on precisely the sites where the adapter
				// is present — the only sites where this matters.
				Saddle_MCP_Diagnostics::note_compat_missing();
			}
		} else {
			add_action( 'rest_api_init', array( 'Saddle_MCP', 'register_routes' ) );
		}
	}

	/**
	 * Whether the official WordPress MCP Adapter library is available, at a
	 * version Saddle can serve on.
	 *
	 * @return bool
	 */
	public static function adapter_available() {
		return class_exists( '\\WP\\MCP\\Core\\McpAdapter' ) && self::adapter_is_current();
	}

	/**
	 * Whether the loaded adapter has the API Saddle's server is built on.
	 *
	 * WooCommerce 11 bundles MCP Adapter 0.1.0 and autoloads it on every
	 * request. That copy has no McpPrompt::fromArray(), so handing it the
	 * route fatalled every REST request on the site, admin included. It also
	 * lacks the three hooks Saddle's server depends on:
	 * `mcp_adapter_initialize_response` (the site context in the handshake),
	 * `mcp_adapter_tools_list` (only the tools this app may call) and
	 * `mcp_adapter_prompts_list`. All four arrived together in 0.5.0, and the
	 * method is the one Saddle calls, so it is the probe. With an older copy
	 * the built-in transport serves the route and Saddle never starts that
	 * adapter itself.
	 *
	 * MCP Adapter 0.7.0 moved the other way (#340): McpServer::get_tools(),
	 * get_resources() and get_prompts() now need the request's negotiated
	 * protocol schema, and the handshake and list filters carry new record
	 * types. Saddle's server code is written against the 0.5–0.6 API, and on
	 * 0.7.0 it fatalled every request. Until it supports the new API, a
	 * server whose get_tools() wants arguments is treated like a copy that is
	 * too old: the built-in transport serves the route.
	 *
	 * @param string $prompt_class The adapter's prompt class. A parameter only so the probe can be tested.
	 * @param string $server_class The adapter's server class. A parameter only so the probe can be tested.
	 * @return bool
	 */
	public static function adapter_is_current( $prompt_class = '\\WP\\MCP\\Domain\\Prompts\\McpPrompt', $server_class = '\\WP\\MCP\\Core\\McpServer' ) {
		if ( ! method_exists( $prompt_class, 'fromArray' ) || ! method_exists( $server_class, 'get_tools' ) ) {
			return false;
		}

		try {
			return 0 === ( new ReflectionMethod( ltrim( $server_class, '\\' ), 'get_tools' ) )->getNumberOfRequiredParameters();
		} catch ( ReflectionException $e ) {
			return false;
		}
	}


	/**
	 * Whether core's Abilities API is present.
	 *
	 * @return bool
	 */
	public static function abilities_api_available() {
		return function_exists( 'wp_register_ability' ) && function_exists( 'wp_register_ability_category' );
	}

	/**
	 * Admin notice shown when the Abilities API is missing.
	 */
	public static function abilities_api_notice() {
		if ( ! current_user_can( 'activate_plugins' ) ) {
			return;
		}
		echo '<div class="notice notice-error"><p>';
		printf(
			/* translators: %s: minimum WordPress version. */
			esc_html__( 'Saddle requires WordPress %s or later (the core Abilities API). The MCP server is disabled until you upgrade.', 'saddle' ),
			esc_html( SADDLE_MIN_WP )
		);
		echo '</p></div>';
	}

	/**
	 * Activation: set the default (read) tier without overwriting an existing
	 * choice, register the CPT so its rewrite/state is known, and schedule GC.
	 */
	public static function activate() {
		// Default-safe: new installs start at the read tier. Never override an
		// existing value here — that would silently downgrade a configured site.
		if ( false === get_option( Saddle_Capabilities::OPTION, false ) ) {
			add_option( Saddle_Capabilities::OPTION, Saddle_Capabilities::DEFAULT_TIER );
		}

		Saddle_Approval::register_cpt();

		if ( ! wp_next_scheduled( Saddle_Approval::GC_HOOK ) ) {
			wp_schedule_event( time() + HOUR_IN_SECONDS, 'hourly', Saddle_Approval::GC_HOOK );
		}
	}

	/**
	 * Deactivation: clear the scheduled token garbage-collection event.
	 */
	public static function deactivate() {
		$timestamp = wp_next_scheduled( Saddle_Approval::GC_HOOK );
		if ( $timestamp ) {
			wp_unschedule_event( $timestamp, Saddle_Approval::GC_HOOK );
		}
		// A queued update run must not fire while Saddle is inactive. The run
		// records stay (uninstall removes them).
		wp_clear_scheduled_hook( Saddle_Update_Runner::HOOK );

		// Nothing confines Saddle's keys while it is off, so they go now and
		// apps connect again after reactivation (#319).
		Saddle_Connection::revoke_issued_keys();
	}
}

register_activation_hook( __FILE__, array( 'Saddle', 'activate' ) );
register_deactivation_hook( __FILE__, array( 'Saddle', 'deactivate' ) );

Saddle::init();