Bridgistic 1.3.2 — LiteSpeed/Hostinger HMAC fix

Fixes HMAC authentication on LiteSpeed/Hostinger hosting.

Hostinger LiteSpeed rewrites X-Bridgistic-* headers to underscored X_Bridgistic_* variants, so signature verification never received the credentials and every API call failed with 401 bridgistic_auth_missing.

Header names are now normalized (_ → -, lowercased) before verification.

• Affects: Hostinger, LiteSpeed Enterprise, any stack that underscores custom header names
• Compatibility: no API/protocol change — existing clients unaffected
• Verified live on Hostinger-hosted production sites

Upgrade note: if you applied the manual one-line hot-patch to includes/rest/class-controller.php, you can safely update to 1.3.2 (the fix is now included).

Bridgistic v1.3.1

Bridgistic v1.3.1

Bridgistic v1.3.1 is a compatibility and security maintenance release for the
WPistic licensing rollout.

Fixed

• Fixed snapshot and restore path containment for new files and sibling folders;
  traversal now fails closed and has dedicated regression checks.
• Guarded the shared WPistic SDK loader so Bridgistic can run beside other
  WPistic-licensed plugins without redeclaring SDK classes.
• Made the shipped-bundle and release pipelines invoke npm, MCPB packaging,
  archive extraction, and tarball verification portably on Windows and Unix.
• Updated the local MCP server and Cloudflare Worker dependency trees to clear
  current package-security advisories.
• Kept every marketplace, MCP, cloud, package, and WordPress version source in
  sync at 1.3.1.

Compatibility

• No database migration is required.
• Existing Bridgistic keys, scopes, OAuth sessions, snapshots, schedules, and
  WPistic license activation state are preserved.
• The public connector remains https://mcp.bridgistic.app/mcp.

Verification

See TEST_REPORT_v1.3.1.md and SECURITY_CHECKLIST_v1.3.1.md in the release
assets. Checksums are published in SHA256SUMS.txt.

Bridgistic v1.3.0

Bridgistic v1.3.0

Bridgistic v1.3.0 is the WordPressistic-org launch release: the plugin is now a
licensed product with free and paid tiers under the WPistic licensing system,
and the cloud connector moves to its own home at mcp.bridgistic.app.

Upgrade is safe in place. Keys, scopes, logs, snapshots, playbooks, and
schedules are preserved. Existing cloud-connector sessions on the legacy
mcp.wpistic.cloud endpoint keep working during migration.

---

New

WPistic licensing — free and paid tiers

• License activation from the plugin's own License tab (admin.php?page=bridgistic-license)
• Free tier works without a license key; Pro features gate on a valid license
• Update channel control (stable) via the licensing client
• Licenses are issued from the WordPressistic platform

Cloud connector: mcp.bridgistic.app

• Dashboard default connector URL is now https://mcp.bridgistic.app/mcp
• OAuth redirect allowlist accepts both hosts during migration
• Cloud connector keys are labeled host-neutral ("Cloud connector")
• Worker route serves both mcp.bridgistic.app (primary) and mcp.wpistic.cloud (legacy)

Simpler admin

• Duplicate "Settings → Bridgistic License" menu entry removed — the plugin's
  own License tab is the single activation surface (SDK filter
  wpistic_sdk_show_settings_menu; admin-post handlers keep working for
  bookmarked URLs)

---

Fixed

• Cloud worker version constants synced to 1.3.0 (version-drift CI gate)
• All worker tests, docs, and READMEs updated to the new connector host

Upgrade notes

• If you previously saved the legacy connector URL, reconnecting from the
  dashboard picks the new default automatically.
• After upgrading, deactivate/reactivate your license only if activation
  status looks stale — activation state carries over.

SHA-256

See SHA256SUMS.txt in the release assets for per-artifact checksums.