HarperFlow

Changelog

1.5.0

• Docs: added an External Services disclosure (the third-party HarperFlow hosts this
  plugin talks to, exactly what data is sent, and when) and bumped Tested up to 7.0.
• i18n: user-facing admin and front-end strings are now translatable under the
  harperflow text domain.
• Hardening: escapers are applied inline at every output site, and the FAQPage JSON-LD
  now encodes with JSON_HEX_TAG so a </script> in a question can never break out.
  No behavior change — lint/robustness only.

1.4.2

• Security: the “Open dashboard (SSO)” handshake now also refuses a non-https API URL, so
  the signed request is only ever sent over https. Completes the https enforcement started
  in 1.4.1 (which covered the connect handshake and the Advanced override) by applying the
  same guard to the third and last outbound call.

1.4.1

• Security: the Advanced API URL override now requires https:// — a non-secure override
  is rejected at save time with a clear error, and the one-click connect refuses to send
  your Application Password to a non-https API URL even if an old/injected setting has
  one (checked before minting the password, so nothing is created needlessly).
• Clarity: “Treat this code like a password — don’t share it” warning next to the pairing
  code field. Whoever redeems the code first links your site to their HarperFlow account.

1.4.0

• New: true one-click connect. Enter the pairing code from your HarperFlow dashboard and
  click Connect — the plugin mints a WordPress Application Password via core
  (WP_Application_Passwords) and registers this site automatically. You never create or
  copy a password. Replaces the previous “paste your SSO key” step; the returned SSO
  secret is stored in the same option, so the existing HMAC style-preservation, one-click
  SSO, and SEO features work unchanged.
• New: Disconnect button — revokes the HarperFlow Application Password and clears the
  stored SSO secret. Reconnect anytime with a fresh pairing code.
• Clear errors for the WordPress < 5.6 / Application-Passwords-disabled cases (with a
  fallback to connecting from the HarperFlow dashboard).

1.3.1

• Security: bind style-preservation to a per-site HMAC signature (sso_secret)
  instead of the forgeable _hf_authored meta flag. Authors cannot inject inline
  CSS without a valid HarperFlow integration signature.
• Enhancement: allow color-mix(), clamp(), min(), max() CSS function values
  emitted by the adaptive renderer via the safecss_filter_attr_allow_css filter,
  with a tight security guard blocking url(), expression(), and javascript:.
• Hardening: wrap wp_kses in try/finally so an unexpected throw cannot leak the
  expanded CSS allowlist into other filters in the same request.

1.3.0

• New: preserve HarperFlow’s inline-styled article components on REST writes for
  HarperFlow-authored posts only, while keeping scripts, iframes, event handlers,
  and unsafe URL schemes stripped.

1.2.0

• New: one-click SSO from wp-admin — “Open HarperFlow Dashboard (SSO)” signs you straight into your HarperFlow dashboard (no password). Paste the SSO key shown in the dashboard after connecting this site. Single-use, short-lived login tokens; minted server-to-server.

1.1.0

• New: HarperFlow admin dashboard page (wp-admin → HarperFlow) — connection status,
  recent HarperFlow articles with their GEO metadata, and a link into the web
  dashboard. Read-only; never mutates site data. Purely additive over 1.0.0.

1.0.0

• Initial release: REST-exposed HarperFlow meta, Yoast/Rank Math interop, health
  route, scoped TL;DR + FAQ rendering, FAQPage JSON-LD.