peptide-search-ai/CHANGELOG.md

Changelog

All notable changes to the Peptide Search AI plugin will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[4.4.3] - 2026-04-14

Fixed

• Cost tracker $0.00 bug: DeepSeek models on OpenRouter omit the usage object from API responses, causing all token counts and costs to log as zero. Added character-based token estimation fallback (~3.75 chars/token for scientific English) so spend is always tracked.

Added

• token_source column in psa_api_logs table distinguishing measured (api) vs. estimated (estimated) token counts. Migrated via dbDelta on plugin activation.
• DeepSeek and Qwen model pricing in PSA_Cost_Tracker::estimate_cost(): deepseek/deepseek-v3.2, deepseek/deepseek-chat, deepseek/deepseek-r1, qwen/qwen3.6-plus:free.
• PSA_Cost_Tracker::get_monthly_estimated_count() method for querying how many API calls used estimates in a given month.
• Admin UI indicators for estimated data: amber warning icon on monthly summary ("includes estimates"), ~ prefix on estimated token/cost values in the log table, and tooltips explaining the estimation method.
• Diagnostic logging of raw usage field from OpenRouter for models that report zero tokens (temporary — remove after confirming).

Changed

• PSA_OpenRouter::send_request_once() now passes token_source to cost tracker alongside token counts.
• Version bump to 4.4.3.

[4.3.0] - Unreleased

Added

• Browsable Peptide Directory: [peptide_directory] shortcode renders a card-based grid with category filtering, search, pagination, and detail modal.
• Category Taxonomy: peptide_category taxonomy on the peptide CPT with 8 pre-populated terms (Tissue Repair, Lipid Metabolism, Aging Research, Dermatological, Metabolic, Growth Hormone, Immunology, Endocrine).
• 9 Extended Meta Fields: half-life, stability, solubility, vial size, storage (lyophilized/reconstituted), typical dose, cycle parameters, amino acid count.
• REST API Endpoint: GET /wp-json/peptide-search-ai/v1/compounds with search, category, pagination, and basic/full field sets for cross-plugin data access.
• Detail Modal: Accessible overlay triggered from directory cards showing full compound data, copyable sequence, PubChem link, and "View Full Page" link.
• Integration Hooks: psa_after_peptide_detail action, psa_directory_card_extras and psa_rest_compound_data filters for Peptide Community plugin.
• Category Auto-Assignment: AI generator now assigns peptide_category taxonomy terms during content generation.
• Admin Data Tools: "Migrate Existing Peptides to Categories" button and "Re-enrich Existing Peptides" button with background job queuing.
• Dark Mode Support: Directory styles work with data-theme="dark" via CSS custom properties.
• Category Badge Colors: Exported as CSS custom properties (--psa-cat-*) for reuse by other plugins.
• New file: includes/class-psa-directory.php — directory REST endpoint and shortcode.
• New file: assets/js/psa-directory.js — directory grid, filters, modal (vanilla JS).
• New file: assets/css/psa-directory.css — directory styles with responsive breakpoints.
• PHPUnit tests for PostType and Directory classes.

Changed

• Updated AI generation prompt to request extended fields (half-life, stability, storage, etc.).
• class-psa-post-type.php now includes taxonomy registration and EXTENDED_META_FIELDS constant.
• class-psa-template.php refactored into smaller private methods; shows extended research data on single peptide pages.
• class-psa-admin.php includes Data Tools section with migration and re-enrichment actions.
• peptide-search-ai.php registers new directory class, taxonomy, and conditional asset loading.
• Version bump to 4.3.0.

[4.2.0] - Unreleased

Added

• PHPUnit test execution in CI pipeline across PHP 7.4, 8.1, 8.3.
• HTTP health check and REST API smoke test after deployment.
• declare(strict_types=1) and typed parameters/return types on all class files.
• Consistent 3-question preamble docblocks on all classes (what / who calls / dependencies).
• @see cross-references at top of related class files.
• New PSA_OpenRouter class — extracted API communication layer from PSA_AI_Generator.
• New PSA_KB_Builder class — extracted KB article builder from PSA_AI_Generator.
• Internationalization (i18n) for all frontend JS strings via wp_localize_script.
• This CHANGELOG file.

Changed

• PSA_AI_Generator now delegates to PSA_OpenRouter and PSA_KB_Builder (reduced from 827 to ~470 lines).
• Updated test suite to call PSA_OpenRouter::parse_response() instead of removed private method.
• Updated ARCHITECTURE.md and CONVENTIONS.md to reflect new class structure.
• Bumped minimum PHP recommendation to 7.4+ with strict type enforcement.

Removed

• Deprecated PSA_Error class and class-psa-error.php (unused, no callers).

[4.1.0] - 2026-04-10

Added

• AES-256-CBC encryption for API keys stored in the database (PSA_Encryption class).
• Cost/token tracking with wp_psa_api_logs custom table (PSA_Cost_Tracker class).
• Monthly budget system with hard-stop enforcement.
• Dry-run mode for cost estimation before API calls.
• Admin UI for API usage summary and recent call logs.
• Monthly budget configuration field in settings.

Fixed

• PHPCS PreparedSQL errors in cost tracker queries.

[4.0.0] - 2026-04-10

Security

• SEC-001 CRITICAL: Removed spoofable X-Forwarded-For / X-Real-IP from IP detection; now trusts only CF-Connecting-IP + REMOTE_ADDR.
• SEC-004 HIGH: Added peptide name input validation with character whitelist and prompt injection blocking.
• SEC-006 HIGH: Added missing return after wp_send_json_success in pending retry max-retries block.
• SEC-007 MEDIUM: KB articles now respect the auto_publish setting instead of always publishing.
• SEC-009 MEDIUM: Replaced hardcoded page ID 73 with configurable kb_page_id setting.
• SEC-010 MEDIUM: Fixed cache invalidation transient name pattern (added underscore prefix).
• SEC-011 MEDIUM: Skipped sleep() during WP-Cron to avoid blocking PHP workers on rate limit retry.
• SEC-012 MEDIUM: Added global daily generation cap (50/day) to prevent cost overruns.
• SEC-013 LOW: Added @deprecated notice to unused PSA_Error class.

Added

• PHPUnit test infrastructure with bootstrap.php and 20 unit tests across 2 test files.
• ARCHITECTURE.md and CONVENTIONS.md documentation.

Fixed

• JavaScript typos breaking form submit and network error handling.
• CSS missing semicolons.
• PHPCS compliance: short ternaries, array formatting, Yoda conditions, tab indentation.

[3.0.0] - 2026-04-09

Added

• Dual-layer rate limiting (transient + object cache) for AJAX and REST endpoints.
• Cache generation counter for O(1) cache invalidation instead of expensive DELETE queries.
• PubChem data enrichment with molecular weight, formula, SMILES, and InChI.
• Background generation via WP-Cron (non-blocking).
• Retry logic with configurable max attempts for stale pending peptides.
• REST API endpoint (/wp-json/peptides/v1/search) for headless access.
• Multiple shortcode instances on the same page via data-psa-instance attribute.

Changed

• Search results cached with generation counter for fast invalidation.
• Batch post/meta priming to avoid N+1 queries in search results.

[2.0.0] - 2026-04-08

Added

• AI-powered peptide name validation (lightweight model before full generation).
• OpenRouter API integration for multi-model support.
• Custom Post Type (peptide) with 15+ meta fields.
• Admin settings page for API key, model selection, and behavior configuration.
• Single peptide page template with quick-facts table and source badges.
• Echo Knowledge Base article auto-creation from generated content.
• CSS design system with .psa-* namespace and BEM-inspired structure.

[1.0.0] - 2026-04-07

Added

• Initial release.
• Basic peptide search shortcode.
• AJAX-powered search with debounced input.
• Responsive mobile layout (600px breakpoint).