OnCue Liveblogging

OnCue’s core is a real-time liveblog posted from the WordPress admin: create an
event, drop the OnCue block into a post, and post updates from the live console.
Everything beyond the core is an opt-in module, off by default:

• Slack ingestion — a dedicated channel becomes the liveblog feed.
• Telegram ingestion — a bot in a group (or DM) posts every message.
• More Coverage — a linked-headline list of the publication’s own articles for the event.
• Reader share cards — per-entry share row posting rich Open Graph cards.
• Moderation gate — approval-before-publish per blog or per source.

A disabled module registers no REST routes and schedules no jobs; the attack
surface is exactly the set of enabled features.

Security note on stored secrets

OnCue encrypts stored channel credentials (Slack/Telegram tokens and secrets)
at rest with libsodium, on by default. The encryption key never lives in the
database, so a database dump alone cannot decrypt them. Key source:

• ONCUE_ENCRYPTION_KEY in wp-config.php (a 32+ char random string) if you
  set one — preferred, because you can rotate it independently of WordPress; or
• your existing WordPress security keys (AUTH_KEY etc.), which are already in
  wp-config.php — so encryption works with no extra setup on any properly
  installed site.

Only a site with neither (no real salts and no dedicated key) falls back to
plaintext, and the Connections screen flags that loudly.

What is not encrypted, by design: liveblog entries and other public content
(they are served to readers; encrypting them would break the live stream), and
non-secret identifiers like the house-account user ID or the public Slack
client ID. Encrypting the whole database or disk is the host’s responsibility
(encrypted volumes / MySQL TDE), not a plugin’s.

Changing the key source (e.g. rotating WordPress salts without setting a
dedicated key) makes previously stored credentials undecryptable — re-enter
them under Connections if that happens.

Typography

The reader inherits the host theme’s fonts throughout, including buttons and
form controls. The generated share-card image uses the site’s own typeface
too: OnCue resolves the theme’s body font (theme.json / Font Library) to a
local TTF/OTF file for GD. If the theme ships fonts only as woff2 (which GD
cannot read), upload a TTF of the same family to the Font Library, or point
the oncue_card_font filter at a font file; otherwise the card falls back to
GD’s built-in font.

External services

OnCue does not phone home and ships with every integration off. It contacts a
third-party service only when you enable that integration and provide your own
account or API key, and only to deliver the feature you turned on. Nothing is
sent to OnCue’s authors. The services, what triggers a request, and what data
leaves your site:

• Slack (ingestion / relay) — only if you connect Slack. Sends liveblog entries
  you relay out, and receives messages from a channel you designate. Terms:
  https://slack.com/legal — Privacy:
  https://slack.com/trust/privacy/privacy-policy
• Telegram (ingestion / relay / contributor sign-in) — only if you connect a
  Telegram bot. Sends relayed entries and receives messages from the bot’s chat.
  Separately, once a bot is connected, OnCue loads Telegram’s official login
  widget script (https://telegram.org/js/telegram-widget.js) inside wp-admin so
  contributors can link their Telegram account in one click; Telegram receives
  the request for that script and the sign-in it performs. That script is never
  loaded on the public side of your site, and never loaded at all until you
  connect a bot. Contributors who prefer not to use it can link by opening the
  bot in the Telegram app instead. Terms: https://telegram.org/tos — Privacy:
  https://telegram.org/privacy
• Twilio (SMS relay) — only if you connect Twilio. Sends entry text to the
  numbers you configure. Terms: https://www.twilio.com/en-us/legal/tos —
  Privacy: https://www.twilio.com/en-us/legal/privacy
• Microsoft Teams / Google Chat / Signal (relay) — only if you connect them.
  Sends relayed entry text to the webhook/space you configure. Microsoft:
  https://www.microsoft.com/servicesagreement — Google:
  https://policies.google.com/terms — Signal: https://signal.org/legal/
• Bluesky / ATProto (curation / relay) — only if you connect a Bluesky account.
  Searches public posts and, if enabled, mirrors marked entries out. Terms:
  https://bsky.social/about/support/tos — Privacy:
  https://bsky.social/about/support/privacy-policy
• Threads / Meta (relay) — only if you connect a Threads account by pasting a
  long-lived access token. Publishes the entries you mark into one thread on
  that account (via graph.threads.net) and periodically refreshes the token.
  Nothing is sent unless you enable Threads for an event and mark a post. Terms:
  https://www.facebook.com/legal/terms — Privacy:
  https://privacycenter.instagram.com/policy
• YouTube Data API (coverage) — only if you add a YouTube API key. Sends search
  queries for the event’s coverage. Terms: https://www.youtube.com/t/terms —
  Google Privacy: https://policies.google.com/privacy
• Google Analytics (Stats) — only if you enable the analytics bridge and/or add
  a GA4 service-account key. Reader interactions flow through the Google tag
  already on your pages (your tag’s consent tooling governs them); Stats reads
  aggregate figures back from your own GA4 property. Terms:
  https://marketingplatform.google.com/about/analytics/terms/us/ — Privacy:
  https://policies.google.com/privacy
• AI providers for the “Key highlights” summary (Crawler) — only if you choose a
  provider and add your own key. The chosen event’s own updates and coverage are
  sent to generate the summary. Anthropic:
  https://www.anthropic.com/legal/consumer-terms /
  https://www.anthropic.com/legal/privacy — OpenAI:
  https://openai.com/policies/terms-of-use /
  https://openai.com/policies/privacy-policy — Google Gemini:
  https://ai.google.dev/gemini-api/terms /
  https://policies.google.com/privacy — Self-hosted / OpenAI-compatible: governed
  by the endpoint you point it at.

Development

The complete, unminified sources for the block editor and console bundles ship
in src/ inside this plugin, alongside the webpack.config.js used to build
them.

• npm install && npm run build builds the block editor and console bundles.
• npm run env:start boots a local WordPress with the plugin active (requires Docker).