LiteSpeed Cache was serving stale REST API responses with 0 articles, causing the React frontend to show "No articles" despite 50+ articles in the DB.
- Add Cache-Control and X-LiteSpeed-Cache-Control: no-cache headers to /articles endpoint
- Include ai_summary and thumbnail_local columns in the REST API query (needed by React frontend)
Hostinger GIT integration has a persistent backend bug that prevents using the correct plugin directory name. This replaces it with SSH-based deployment:
- Sync deploy branch with clean plugin runtime files
- SSH into Hostinger and git pull deploy branch directly
- Purge LiteSpeed cache after successful deploy
Remove all AI thumbnail generation infrastructure (too expensive,
poor results) and rewrite the public-facing article feed as a React
SPA mounted via WordPress shortcode.
Changes:
- Remove thumbnail generation, OG scraping, and image download code
from fetcher, LLM, and admin classes
- Replace server-rendered PHP templates with React component
(PeptideNewsFeed.jsx) using WordPress-bundled React/ReactDOM
- Add Babel build pipeline for JSX transpilation
- Update REST API to serve ai_summary instead of thumbnail fields
- Redesign public CSS: clean card layout, loading skeletons,
dark mode, responsive, no thumbnail imagery
- Remove dead admin settings (llm_image_model, thumbnail_fallback)
- Fix call_openrouter() visibility for Content Filter cross-class use
- Bump version to 1.3.0
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
DuckDuckGo's HTML search endpoint now requires vqd session tokens,
making server-side search-based URL resolution unreliable. Simplified
the thumbnail pipeline:
- OG scrape only for non-aggregator URLs (direct publisher pages)
- AI image generation via OpenRouter for aggregator articles (Google News)
- Added Image Model settings field in admin UI
- Added thumbnail_local column for AI-generated images
- Updated public/admin display to check thumbnail_local as fallback
- Removed all DuckDuckGo search code (find_article_url_via_search,
extract_ddg_url, resolve_article_for_scraping)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Google News RSS stores encrypted article URLs that cannot be resolved
server-side (JS SPA, no HTTP redirects, encrypted base64 IDs). Replace
the failed decode/parse strategies with DuckDuckGo search-based lookup
using article title + publisher name to find actual article pages, then
scrape OG images from those pages.
- Add find_article_url_via_search() using DuckDuckGo HTML endpoint
- Add resolve_article_for_scraping() combining redirect + search fallback
- Mark failed lookups with '_no_image' sentinel to avoid repeated retries
- Backfill button resets sentinels to allow manual re-scraping
- Clean up verbose debug instrumentation from prior attempts
- Update frontend to handle '_no_image' sentinel gracefully
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace batchexecute API with direct fetch + HTML parsing strategies:
data-n-au attributes, anchor href extraction, meta refresh, JS redirect.
Add verbose debug output to diagnose server-side response from Google News.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace broken base64 decoding with Google's internal batchexecute API
endpoint to resolve encrypted article IDs to actual publisher URLs.
This is the approach used by known Google News decoder libraries.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Temporary debug version that returns query counts, URL resolution results,
and OG scraping outcomes to identify why thumbnail scraping returns 0.
Also adds Google News URL decoder (base64/protobuf approach).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The OG image scraper was using Google News redirect URLs (source_url) directly,
which don't serve og:image tags. Added resolve_scrape_url() to follow redirects
(including meta-refresh and JS redirects) to reach the actual publisher page
before scraping. Also added a backfill AJAX endpoint and admin button to
re-scrape thumbnails for existing articles.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Google News RSS feeds report every article as coming from
"news.google.com" because the source was extracted from the feed URL
rather than the individual article. This adds a multi-strategy
resolver that extracts the real publisher name via:
1. SimplePie <source> element (Google News provides this)
2. Title suffix parsing ("Headline - Source" format)
3. HTTP HEAD redirect resolution as a fallback
Also adds a one-click "Fix Article Sources" backfill button on the
settings page to correct existing articles in the database.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Addresses QA Agent 2 findings:
- Add :focus outline on title and thumbnail links for keyboard navigation
- Wrap excerpt paragraph in conditional to avoid empty <p> when both
ai_summary and excerpt are missing
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Rewrites public CSS to match actual .pn-* class names from the PHP
template and changes the default shortcode layout from card/grid to a
horizontal list: fixed-width thumbnail on the left, title + summary on
the right. Includes compact variant for widgets and responsive
stacking on small screens.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The Peptide_News_Loader class was referenced by class-peptide-news.php
but never committed, causing a fatal error on plugin activation.
Also adds public/css/public-style.css which is enqueued by the public
class.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Hostinger's git pull fails with divergent branches when force-pushing
orphan commits. Switch to a linear commit strategy: checkout the
existing deploy branch, sync plugin files from main, and push normally.
This keeps Hostinger's git pull fast-forward compatible.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace broken SCP/SSH deploy (blocked by Hostinger firewall) with a
deploy-branch strategy. After CI passes, GitHub Actions pushes only
plugin files to the 'deploy' branch. Hostinger's built-in GIT
integration watches this branch via webhook and auto-pulls.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
FTP deploy timed out due to Hostinger blocking FTPS from external CI
servers. Switched to appleboy/scp-action using SSH on port 65002,
which is more reliable for CI/CD pipelines.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The deploy workflow references CI via `uses: ./.github/workflows/ci.yml`
which requires the CI workflow to have an `on: workflow_call` trigger.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add missing WordPress function stubs (current_user_can, esc_url_raw,
is_user_logged_in, get_current_user_id) and load LLM class in test
bootstrap so AdminTest model validation and RestApiTest permission
checks work correctly.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- analytics.php line 38: mismatched quotes on session_id array key
- analytics.php line 246: invalid escape before concatenation operator
- analytics.php line 250: COuNT typo → COUNT
- analytics.php line 252: NULIF typo → NULLIF
- rest-api.php line 54: stray # commenting out foreach variable
These bugs predate the content filter feature but were caught by the
new CI pipeline's PHP lint job.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Two-tier filtering during article fetch: keyword/pattern rules as a fast
first pass, then optional LLM classification for borderline cases via
OpenRouter. Configurable sensitivity (strict/moderate/lenient), editable
keyword lists, blocked domain list, and admin stats display. Includes
30 unit tests covering domain blocking, title/body keywords, URL paths,
edge cases, and prompt structure.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Introduces GitHub Actions workflows for continuous integration and
deployment. CI runs PHP linting (7.4, 8.1, 8.3), PHPCS with WordPress
coding standards, PHPUnit tests across PHP versions, and JS syntax
checks. Deployment to Hostinger via FTPS triggers on push to main
after all CI checks pass, with optional LiteSpeed cache purge.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The prepareCanvas wrapper fix (fee4f0f) required a version bump to
bust the LiteSpeed server cache that was serving the old admin-script.js
at the ?ver=1.2.0 URL. A Code Snippets filter on the live server now
rewrites the script version to 1.2.1-<timestamp>.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Chart.js with responsive:true + maintainAspectRatio:false requires
the parent container to have an explicit height. Without it, charts
grow unbounded. The prepareCanvas() helper wraps each canvas in a
height-constrained div before Chart initialization.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Charts were not rendering properly because admin-script.js targeted a
non-existent canvas ID (peptide-analytics-chart) instead of the actual
IDs (pn-trends-chart, pn-devices-chart, pn-sources-chart). The script
also used hardcoded demo data instead of the peptideNewsDashboardData
object exported from PHP.
Changes:
- Rewrite admin-script.js to initialise all three dashboard charts
(line, doughnut, bar) using the correct canvas IDs and PHP data
- Set maintainAspectRatio: false so explicit canvas heights are respected
- Add max-height CSS constraint on chart canvases to prevent unbounded
vertical growth
- Sync JS/CSS to admin/ root directory to match PEPTIDE_NEWS_PLUGIN_URL
asset path
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Use $wpdb->prepare() with esc_like() in clear_article_cache()
- Add strict base64_decode() validation with error handling
- Add isset()/is_array()/is_string() checks for nested array access
- Add wp_http_validate_url() SSRF prevention on all image downloads
- Add limit_response_size (5MB) on image URL downloads
- Set chmod 0644 after file_put_contents()
- Use $wpdb->prepare() with esc_like() in clear_article_cache()
- Add wp_http_validate_url() SSRF prevention in download_thumbnail()
- Add limit_response_size (5MB) on image downloads
- Set chmod 0644 after file_put_contents()
- Add transient-based concurrent fetch lock
