- New Cost_Tracker class: logs every API call (model, tokens, cost), enforces
monthly budgets with hard-stop mode, provides aggregated reporting
- New llm_costs database table with indexes on created_at, model, operation
- Modified LLM class: call_openrouter_with_usage() extracts token usage from
OpenRouter responses; budget gate checks before each API call
- Admin settings: monthly budget (USD), enforcement mode (disabled/warn/hard-stop),
cost log retention period
- Admin cost dashboard: budget progress bar, daily cost chart (Chart.js),
per-model and per-operation breakdowns, recent API call log
- PHPUnit tests: 16 tests covering cost calculation, pricing lookups,
budget enforcement logic, and model validation
- Updated ARCHITECTURE.md with new table schema, data flow, and key decisions
- Updated CONVENTIONS.md with "how to add cost tracking for a new operation"
- Version bump to 2.4.0
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Downgrade Generic.Files.OneObjectStructurePerFile to warning
(widget class shares file with public class — split in future cleanup)
- Add translators comment for __() with %s placeholder in REST API
- Remove blank line after control structure in REST API
- Fix return-newline in content filter (extract to $prompt variable)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
WordPress coding standards require tab indentation. All 12 PHP files
in includes/, admin/, and public/ were using 4-space indentation.
Converted to tabs to pass the Generic.WhiteSpace.DisallowSpaceIndent
PHPCS rule. Whitespace-only change — no logic modifications.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add bulk and per-row article deletion with AJAX handler, confirmation
dialogs, and cascading cleanup of click analytics via foreign keys.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The security audit added wp_kses_post()/esc_html() to article fields
before returning them via the REST API. This caused double-encoding
(e.g., & → &) because REST responses are JSON, not HTML —
WordPress's rest_ensure_response() already handles JSON encoding.
The frontend is responsible for output escaping at render time.
Removes the 4 escaping lines from get_articles() to fix broken
summaries and truncated content on the live site.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Security (7 fixes):
- SEC-001: Use wpdb->prepare() for COUNT query in REST API
- SEC-002: Set httponly=true on session cookie to prevent XSS
- SEC-003: Mask API keys in admin settings (show last 4 chars only)
- SEC-004: Check capability before nonce in manual fetch handler
- SEC-005: Validate redirect domains to prevent open redirects
- SEC-006: Escape all article fields before REST API response
- SEC-007: Add capability check to AJAX summary handler
Infrastructure (7 fixes):
- WPS-002: Clear cron schedule on plugin deactivation
- WPS-003: Bundle Chart.js locally instead of CDN without SRI
- WPS-004: Add uninstall.php for clean plugin removal
- DB-001: Add foreign key constraints with CASCADE deletes
- DB-002: Clamp pagination to valid page range
- CI-001: Use StrictHostKeyChecking=accept-new in deploy
- CI-002: Add security scanning step to CI pipeline
- CI-003: Add rollback workflow via workflow_dispatch
Performance & Quality (8 fixes):
- PHP-001: Validate widget $instance as array before access
- PHP-002: Return null from get_client_ip() for invalid IPs
- PHP-003: Process RSS feeds in chunked batches of 10
- PHP-004: Wire up clear_article_cache() in fetch cycle
- PERF-001: Cache source names in transient for strip_source_suffix
- PERF-002: Add server-side transient caching for REST API
- ARCH-002: Make LLM API URL configurable via WordPress options
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The strip_source_suffix() fallbacks aren't catching all nbsp-separated
publisher names. Adding a direct strrpos-based cleanup pass in the
get_articles() method itself as a safety net. This operates on the
already-decoded text returned by strip_source_suffix().
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Previous strrpos-based approach wasn't catching all cases. Switch to a
preg_match with /u flag and capture groups to reliably split text at
nbsp separator boundaries.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The previous regex approach with \x{00A0} wasn't reliably catching all
nbsp-separated publisher names (e.g., "UC Santa Cruz" on article 19).
Switched to strrpos-based string search which is simpler and avoids
potential PCRE/UTF-8 edge cases with multibyte characters.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Google News RSS excerpts use double non-breaking spaces followed by the
publisher name (e.g. "...habitat News-Medical"). When the source field
is "news.google.com" rather than the actual publisher, the exact-match
logic can't strip it. This adds a regex fallback that catches trailing
nbsp-separated capitalized names.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Google News RSS excerpts use (double non-breaking spaces)
to separate the excerpt text from the source name. Added html_entity_decode
and nbsp-based separators to handle this pattern.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The deploy workflow reads from the repo root (admin/, includes/, public/),
not the peptide-news-plugin/ subdirectory. Applied the same changes:
- Removed Tag component and tag rendering from ArticleCard
- Removed all tag-related CSS (variables, styles, skeleton, responsive)
- Added strip_source_suffix() to REST API for cleaning source names
from titles/summaries with case-insensitive and domain-based matching
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
LiteSpeed Cache was serving stale REST API responses with 0 articles, causing the React frontend to show "No articles" despite 50+ articles in the DB.
- Add Cache-Control and X-LiteSpeed-Cache-Control: no-cache headers to /articles endpoint
- Include ai_summary and thumbnail_local columns in the REST API query (needed by React frontend)
Remove all AI thumbnail generation infrastructure (too expensive,
poor results) and rewrite the public-facing article feed as a React
SPA mounted via WordPress shortcode.
Changes:
- Remove thumbnail generation, OG scraping, and image download code
from fetcher, LLM, and admin classes
- Replace server-rendered PHP templates with React component
(PeptideNewsFeed.jsx) using WordPress-bundled React/ReactDOM
- Add Babel build pipeline for JSX transpilation
- Update REST API to serve ai_summary instead of thumbnail fields
- Redesign public CSS: clean card layout, loading skeletons,
dark mode, responsive, no thumbnail imagery
- Remove dead admin settings (llm_image_model, thumbnail_fallback)
- Fix call_openrouter() visibility for Content Filter cross-class use
- Bump version to 1.3.0
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
DuckDuckGo's HTML search endpoint now requires vqd session tokens,
making server-side search-based URL resolution unreliable. Simplified
the thumbnail pipeline:
- OG scrape only for non-aggregator URLs (direct publisher pages)
- AI image generation via OpenRouter for aggregator articles (Google News)
- Added Image Model settings field in admin UI
- Added thumbnail_local column for AI-generated images
- Updated public/admin display to check thumbnail_local as fallback
- Removed all DuckDuckGo search code (find_article_url_via_search,
extract_ddg_url, resolve_article_for_scraping)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- analytics.php line 38: mismatched quotes on session_id array key
- analytics.php line 246: invalid escape before concatenation operator
- analytics.php line 250: COuNT typo → COUNT
- analytics.php line 252: NULIF typo → NULLIF
- rest-api.php line 54: stray # commenting out foreach variable
These bugs predate the content filter feature but were caught by the
new CI pipeline's PHP lint job.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
