內容簡介
OnCue Liveblogging 是一款即時直播外掛，讓使用者能夠在 WordPress 控制台中創建事件並即時更新內容。透過簡單的佈局，使用者可以輕鬆地發布最新消息，並選擇額外的模組來擴展功能。
【主要功能】
• 即時直播更新，方便管理事件
• Slack 和 Telegram 整合，擴大信息傳遞
• 文章連結列表，增加曝光率
• 分享卡片，提升社交媒體互動
• 審核門檻，確保內容質量
外掛標籤
開發者團隊
原文外掛簡介
OnCue’s core is a real-time liveblog posted from the WordPress admin: create an
event, drop the OnCue block into a post, and post updates from the live console.
Everything beyond the core is an opt-in module, off by default:
Slack ingestion — a dedicated channel becomes the liveblog feed.
Telegram ingestion — a bot in a group (or DM) posts every message.
More Coverage — a linked-headline list of the publication’s own articles for the event.
Reader share cards — per-entry share row posting rich Open Graph cards.
Moderation gate — approval-before-publish per blog or per source.
A disabled module registers no REST routes and schedules no jobs; the attack
surface is exactly the set of enabled features.
Security note on stored secrets
OnCue encrypts stored channel credentials (Slack/Telegram tokens and secrets)
at rest with libsodium, on by default. The encryption key never lives in the
database, so a database dump alone cannot decrypt them. Key source:
ONCUE_ENCRYPTION_KEY in wp-config.php (a 32+ char random string) if you
set one — preferred, because you can rotate it independently of WordPress; or
your existing WordPress security keys (AUTH_KEY etc.), which are already in
wp-config.php — so encryption works with no extra setup on any properly
installed site.
Only a site with neither (no real salts and no dedicated key) falls back to
plaintext, and the Connections screen flags that loudly.
What is not encrypted, by design: liveblog entries and other public content
(they are served to readers; encrypting them would break the live stream), and
non-secret identifiers like the house-account user ID or the public Slack
client ID. Encrypting the whole database or disk is the host’s responsibility
(encrypted volumes / MySQL TDE), not a plugin’s.
Changing the key source (e.g. rotating WordPress salts without setting a
dedicated key) makes previously stored credentials undecryptable — re-enter
them under Connections if that happens.
Typography
The reader inherits the host theme’s fonts throughout, including buttons and
form controls. The generated share-card image uses the site’s own typeface
too: OnCue resolves the theme’s body font (theme.json / Font Library) to a
local TTF/OTF file for GD. If the theme ships fonts only as woff2 (which GD
cannot read), upload a TTF of the same family to the Font Library, or point
the oncue_card_font filter at a font file; otherwise the card falls back to
GD’s built-in font.
External services
OnCue does not phone home and ships with every integration off. It contacts a
third-party service only when you enable that integration and provide your own
account or API key, and only to deliver the feature you turned on. Nothing is
sent to OnCue’s authors. The services, what triggers a request, and what data
leaves your site:
Slack (ingestion / relay) — only if you connect Slack. Sends liveblog entries
you relay out, and receives messages from a channel you designate. Terms:
https://slack.com/legal — Privacy:
https://slack.com/trust/privacy/privacy-policy
Telegram (ingestion / relay / contributor sign-in) — only if you connect a
Telegram bot. Sends relayed entries and receives messages from the bot’s chat.
Separately, once a bot is connected, OnCue loads Telegram’s official login
widget script (https://telegram.org/js/telegram-widget.js) inside wp-admin so
contributors can link their Telegram account in one click; Telegram receives
the request for that script and the sign-in it performs. That script is never
loaded on the public side of your site, and never loaded at all until you
connect a bot. Contributors who prefer not to use it can link by opening the
bot in the Telegram app instead. Terms: https://telegram.org/tos — Privacy:
https://telegram.org/privacy
Twilio (SMS relay) — only if you connect Twilio. Sends entry text to the
numbers you configure. Terms: https://www.twilio.com/en-us/legal/tos —
Privacy: https://www.twilio.com/en-us/legal/privacy
Microsoft Teams / Google Chat / Signal (relay) — only if you connect them.
Sends relayed entry text to the webhook/space you configure. Microsoft:
https://www.microsoft.com/servicesagreement — Google:
https://policies.google.com/terms — Signal: https://signal.org/legal/
Bluesky / ATProto (curation / relay) — only if you connect a Bluesky account.
Searches public posts and, if enabled, mirrors marked entries out. Terms:
https://bsky.social/about/support/tos — Privacy:
https://bsky.social/about/support/privacy-policy
Threads / Meta (relay) — only if you connect a Threads account by pasting a
long-lived access token. Publishes the entries you mark into one thread on
that account (via graph.threads.net) and periodically refreshes the token.
Nothing is sent unless you enable Threads for an event and mark a post. Terms:
https://www.facebook.com/legal/terms — Privacy:
https://privacycenter.instagram.com/policy
YouTube Data API (coverage) — only if you add a YouTube API key. Sends search
queries for the event’s coverage. Terms: https://www.youtube.com/t/terms —
Google Privacy: https://policies.google.com/privacy
Google Analytics (Stats) — only if you enable the analytics bridge and/or add
a GA4 service-account key. Reader interactions flow through the Google tag
already on your pages (your tag’s consent tooling governs them); Stats reads
aggregate figures back from your own GA4 property. Terms:
https://marketingplatform.google.com/about/analytics/terms/us/ — Privacy:
https://policies.google.com/privacy
AI providers for the “Key highlights” summary (Crawler) — only if you choose a
provider and add your own key. The chosen event’s own updates and coverage are
sent to generate the summary. Anthropic:
https://www.anthropic.com/legal/consumer-terms /
https://www.anthropic.com/legal/privacy — OpenAI:
https://openai.com/policies/terms-of-use /
https://openai.com/policies/privacy-policy — Google Gemini:
https://ai.google.dev/gemini-api/terms /
https://policies.google.com/privacy — Self-hosted / OpenAI-compatible: governed
by the endpoint you point it at.
Development
The complete, unminified sources for the block editor and console bundles ship
in src/ inside this plugin, alongside the webpack.config.js used to build
them.
npm install && npm run build builds the block editor and console bundles.
npm run env:start boots a local WordPress with the plugin active (requires Docker).
