The basic flow is like this...
1) Upon log in, connect to remote server and provide current version to see if there are any updates
2) If there are, download zip file in a temp folder, unzip to current app's directory directly overwriting current version
3) New files contain latest version number, so next time they log in, it will do check again, and since there won't be any changes, it does nothing
PHP has a function called ZipArchive which you can use to unzip files, but it's an add-on library and may not be included in all PHP builds by default. So if you are going to execute this through WP, then you can include WP context in your script, and then you'll be able to use all of WP's functions for unzipping files and stuff, and that will save you a lot of coding because WordPress contains all of the plumbing code.
Hope this makes sense.