From b1b575e63429d3943a2ccfcd33b517ccdb7604ea Mon Sep 17 00:00:00 2001
From: opencode <bot@example.com>
Date: Mon, 3 Aug 2026 21:05:05 +0800
Subject: [PATCH] fix: fetch pending with token in query string to survive
 LiteSpeed caching

---
 tools/vps-worker/README.md  | 2 +-
 tools/vps-worker/worker.php | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/tools/vps-worker/README.md b/tools/vps-worker/README.md
index 7b45a30..299fe0b 100644
--- a/tools/vps-worker/README.md
+++ b/tools/vps-worker/README.md
@@ -66,7 +66,7 @@ This directory contains the **v2.6.0 Standalone VPS Worker**, designed for high-
 All endpoints require either WordPress admin authentication OR a valid `X-Peptide-News-Token: <your-token>` header:
 
 - `GET /wp-json/peptide-news/v1/worker/pending?limit=20`  
-  Returns pending articles requiring AI analysis.
+  Returns pending articles requiring AI analysis. The worker fetches this with the token also in the query string (`&token=...`) so the cached response is namespaced by the secret, which survives shared-host LiteSpeed caching that ignores `X-LiteSpeed-Cache-Control: no-cache`; the header is still sent alongside.
 - `POST /wp-json/peptide-news/v1/worker/update`  
   Updates an article with completed AI summaries, tags, and scientific rigor scores.
 - `POST /wp-json/peptide-news/v1/worker/ingest`  
diff --git a/tools/vps-worker/worker.php b/tools/vps-worker/worker.php
index 0cff0c4..c7c9f51 100644
--- a/tools/vps-worker/worker.php
+++ b/tools/vps-worker/worker.php
@@ -87,7 +87,7 @@ function wp_rest_call( string $url, string $token, string $method = 'GET', array
 
 if ( $action === 'pending' ) {
 	vps_log( "Fetching pending articles from {$wp_url}/wp-json/peptide-news/v1/worker/pending ..." );
-	$res = wp_rest_call( "{$wp_url}/wp-json/peptide-news/v1/worker/pending?limit={$batch}", $token );
+	$res = wp_rest_call( "{$wp_url}/wp-json/peptide-news/v1/worker/pending?limit={$batch}&token={$token}", $token );
 	if ( ! $res || empty( $res['success'] ) ) {
 		vps_log( "Failed to retrieve pending articles." );
 		exit( 1 );
@@ -105,7 +105,7 @@ if ( $action === 'process-llm' ) {
 		exit( 1 );
 	}
 	vps_log( "Pulling up to {$batch} pending articles from WordPress..." );
-	$res = wp_rest_call( "{$wp_url}/wp-json/peptide-news/v1/worker/pending?limit={$batch}", $token );
+	$res = wp_rest_call( "{$wp_url}/wp-json/peptide-news/v1/worker/pending?limit={$batch}&token={$token}", $token );
 	if ( ! $res || empty( $res['success'] ) || empty( $res['data'] ) ) {
 		vps_log( "No pending articles found or failed to retrieve." );
 		exit( 0 );