Every release.
Documented.

Plugin Deployer hardening + binary upload sanitizer.

Patch release focused on the desktop Plugin Deployer flow and the marketing-site binary upload pipeline.

• Fixed — readEntryCreds() in desktop was called with a string name instead of an entry object, causing TypeError: creds.site.replace in Plugin Deployer
• Fixed — make-plugin-zip.py was nuking vendor/firebase/php-jwt/src/ because it excluded src/ at all depths; split into EXCLUDE_ROOT_DIRS vs EXCLUDE_ANY_DIRS
• Fixed — WordPress sanitize_file_name() was renaming .exe.blockmap → .exe_.blockmap; custom sanitizer in binary-upload.php preserves double-extension artifacts
• Improved — desktop sidebar i18n fallback (was showing keys like nav.deployer when translation missing)
• Improved — selected-site persistence across desktop pages via localStorage

License system + customer accounts + EU VAT.

Full e-commerce stack on the marketing site: account dashboard, PayPal checkout, OSS-compliant VAT for 27 EU countries, Italian regime forfettario support, B2B reverse charge with VIES validation, branded HTML emails, admin invoice backoffice. Coupon system with admin management.

• Added — xaflo-licenses/v1 REST namespace: signup, signin, /me, /buy-pro, /tax/quote, /vies-check, /paypal/capture, /free-checkout, /coupon/check
• Added — Ed25519-signed license tokens (libsodium); embedded public key in desktop verifies locally with no phone-home
• Added — customer account dashboard at /account/: license cards with progress bars, order history, invoice downloads
• Added — PayPal Smart Buttons checkout with server-side capture verification (anti-tampering)
• Added — EU OSS scheme: 27 country VAT rates, automatic country detection, VIES B2B validation, Italian forfettario toggle
• Added — admin Tools → Xaflo Invoices: 6 stat cards, filter bar, CSV export, printable HTML invoice, OSS quarterly summary
• Added — admin Tools → Xaflo Coupons: percent / fixed / FREE coupons, usage caps, validity window, scope (new vs renewal)
• Added — branded HTML emails for license delivery + 30/7/1 day expiry warnings (daily cron)
• Added — desktop License page with countdown, renew CTA, paste-token activation

Maintenance mode + remote control panel.

Take any connected site offline from Xaflo Desktop with a styled 503 page. New REST endpoints for plugin install / activate / deactivate, debug.log tailing and theme file read/write.

• Added — MaintenanceController with GET/POST/DELETE /maintenance endpoints + styled drop-in 503 page + IP bypass allow-list
• Added — server-rendered admin page Xaflo → Maintenance for one-click toggle (works even if the React bundle is broken)
• Added — Desktop pages: Plugins (list/activate/deactivate), Files (theme file browser + editor), Maintenance (remote toggle)
• Added — Desktop sidebar grouping (Remote · Workshop · System) for cleaner navigation
• Added — /debug/log REST endpoint with severity filtering and clear action
• Added — Console page in Desktop with debug.log tailing, auto-refresh, severity filter
• Improved — sanitize for double-extension artifact filenames (preserves .exe.blockmap)

Self-hosted auto-update.

The plugin now polls https://wpconnect.xaflo.com/updates/v1/wp-claude-bridge.json every 12h and surfaces upgrades through WordPress’ standard update UI. No more wp.org dependency.

• Added — XafloWpConnectServicesUpdater with pre_set_site_transient_update_plugins, plugins_api, upgrader_pre_download hooks
• Added — SHA-256 integrity verification before unpacking
• Added — Xaflo Update Server companion plugin serving plugin + desktop manifests
• Added — Desktop Plugin Deployer: push a .zip from your machine to N sites with one click
• Added — Allowlist host check on update URL (only *.xaflo.com trusted)
• Added — Check for updates action link on the WP plugins.php row

The Xaflo launch.

First stable release. 74 WordPress tools, 23 JWT scopes, auto-backups, audit log, Windows / macOS / Linux desktop builds. Rebranded from wp-claude-bridge internal codename to Xaflo WP Connect.

• Added — Pricing, Changelog, Press & Brand pages
• Added — JSON-LD schema.org @graph + security.txt + sitemap robot directives
• Added — Custom NSIS installer with upgrade detection (preserves settings/tokens on in-place update)
• Added — Auto-update on the .exe via electron-updater + differential blockmap
• Fixed — pre-built React bundle compatibility (kept legacy wpcb/v1 namespace)

Multilingual + analytics.

WPML + Polylang adapters. 10 analytics endpoints (top posts, no-traffic, keywords, referrers, period comparison, category trends).

Backup + audit system.

Automatic snapshots before destructive writes. Full audit log with payload & actor tracking. wp_backup_restore rollback in one call.

First public preview.

Bridge between Claude Code and WordPress over MCP. 40 tools. JWT auth. Read-only by default.