v0.4.0 — MCP servers + Integrations (Wave 2.3 + 2.2r)

Plugin v1 Final — completes the Wave 2 set (2.3 MCP servers + 2.2r Integrations with env vars) and passes the Wave 2.5 security scan.

Added

Wave 2.3 — MCP server declaration

• filesystem-pm — injects @modelcontextprotocol/server-filesystem into ~/.claude.json under key plugin-pm-essentials-filesystem-pm, pointing to ${WORKSPACE}/workspace/project. Requires npx in PATH.
• After install/update, a banner prompts you to restart Claude Code CLI to activate the MCP server.

Wave 2.2r — Integration: Todoist

• Declares TODOIST_PLUGIN_API_KEY env var under integrations[].env_vars.
• Appears in /integrations → Custom tab as "PM Essentials — Todoist" card with a "via plugin" badge and schema-driven Configure modal (password input, masked display, audit logs keys only).
• On uninstall, # plugin-pm-essentials section is automatically removed from .env (no leaked credentials).
• Note: health_check is intentionally omitted in v0.4.0. The Todoist REST API requires a Bearer Authorization header, which is not yet supported by the v1 HealthCheckSpec schema (headers support is a v2 follow-up).

Wave 2.5 — Security scan compliance

• All agent/skill markdown reviewed; no prompt injection, dangerous SQL, or shell exec patterns.
• Scan verdict: APPROVE.

Requires

EvoNexus core with Waves 2.3 + 2.2r + 2.5 schema support (branch feature/plugins-v1, merge pending). Installs cleanly on older cores — both mcp_servers and integrations are optional fields; the core will pick them up on upgrade.

Upgrading from v0.3.1

No breaking changes. Update in place via the Plugin Detail page. MCP server entry is appended to ~/.claude.json (backed up to ~/.claude.json.evonexus-backup-<ts>). Todoist integration appears disconnected until you paste your API key in Configure.

v0.3.1 — Projects date timezone fix

Fixed

• Projects page due-date timezone shift — the Projects page rendered due dates one day earlier than expected on negative-offset timezones (BRT / UTC-3 showed Jan 1 as Dec 31). _formatDate() and _isOverdue() now parse YYYY-MM-DD as a local date instead of handing the raw string to new Date() (which JS interprets as UTC midnight).

Upgrading from v0.3.0

No schema changes. No core requirements beyond v0.3.0. Update in place via the Plugin Detail page.

v0.3.0 — Custom pages + writable data

First release to use Wave 2.1 Custom pages — PM Essentials now ships four full-screen plugin pages that exercise the complete plugin UI surface in EvoNexus.

Added

Full-screen pages

• ui/pages/company.js — Company configuration form (name, logo, timezone, fiscal year)
• ui/pages/projects.js — Full CRUD for pm_essentials_projects
• ui/pages/kanban.js — HTML5-native drag-and-drop sprint kanban (no external libs, respects connect-src 'self' CSP)
• ui/pages/reports.js — Velocity bar chart + status breakdown via Canvas 2D (no CDN)

Routes: /plugins-ui/pm-essentials/<company|projects|kanban|reports>
Sidebar group: PM Essentials (collapsible, order 10).

New capabilities

• ui_pages — declares pages via ui_entry_points.pages[] + sidebar_groups[]
• writable_data — CRUD endpoints with column allowlist and optional JSON Schema validation
  • pm_essentials_projects (POST / PUT / DELETE)
  • pm_essentials_tasks (PUT only, used by kanban drag-drop)

New SQL tables

• pm_essentials_company_config (single-row, upsert via writable_data)
• pm_essentials_projects
• pm_essentials_sprints
• pm_essentials_tasks

Requires

EvoNexus core with Wave 2.1 schema support (branch feature/plugins-v1, merge pending):

• New Pydantic classes: PluginPage, PluginSidebarGroup, PluginWritableResource
• Endpoints: GET /api/plugin-ui-registry, POST/PUT/DELETE /api/plugins/<slug>/data/<resource_id>
• GET /api/tickets?source_plugin=<slug> filter
• Catch-all route /plugins-ui/:slug/* + PluginPageHost
• CSP hardening (connect-src 'self')

Installs cleanly on older cores — ui_pages and writable_data capabilities are optional; pages simply won't appear until the core is updated.

Notes

• Plugin pages are loaded via dynamic import() into the host scope (Shadow DOM inside each Custom Element). Session cookie is shared same-origin.
• Plugin state is namespaced in localStorage as plugin:pm-essentials:*.
• Navigation via window.EvoNexus.navigate() SDK (no window.location hacks).

v0.2.0 — Plugin & Agent identity

First release to use Wave 2.0 Plugin & Agent identity — EvoNexus now renders plugin icon in the plugin card/detail, and PM Nova shows her own avatar in the agent chat and listing.

Added

• ui/assets/icon.png — 128×128 PNG plugin icon (kanban-style flat design, Evolution green #00FFA7 on dark #0d1117). Served by the existing /plugins/pm-essentials/ui/<path> endpoint.
• ui/assets/avatars/pm-nova.png — 256×256 PNG avatar for PM Nova agent. Injected into the frontend agent registry via GET /api/agent-meta and rendered in chat bubbles and the /agents page.
• metadata.icon and agents[].avatar fields in plugin.yaml, both with *_sha256 for tamper detection (verified by plugin-health).

Notes

• Requires EvoNexus core with Wave 2.0 schema support (branch feature/plugins-v1, merge pending). Installs cleanly on older cores — metadata and agents are optional fields; the icon simply won't appear until the core is updated.
• Browser cache for assets is max-age=3600 immutable. After update from v0.1.x the new icon appears within 1 hour, or immediately on hard refresh.