e4c51ee89d
class-prv-key-manager-renderer.php rendered placeholder="sk-or-..." on
the write-only password input, leaking the provider key format in page HTML.
This caused the smoke-suite write-only invariant assertion to fail (CI run
2026-06-17 job 81824705096: expect(html).not.toContain("sk-or-")). The
placeholder now reads "Paste provider API key" — neutral, no key-format
prefix, no provider information exposed in rendered HTML.
The value="" write-only invariant was already correct. The encrypted-at-rest
storage was already correct. This fixes the sole remaining output surface.
Full-codebase audit confirms no other path emits the decrypted key:
- No wp_localize_script calls anywhere in the plugin
- No REST endpoints registered
- No data attributes containing key fields
- All get_key() callers use the plaintext server-side only (HTTP auth header)
- error_log() in probe executor logs HTTP status only, never the key value
Agent-Session: prv-key-leak-fix-20260619
PR Vision
An internal WordPress plugin that runs weekly server-side LLM probes to measure whether peptiderepo.com is cited by AI assistants across core peptides.
v0.1.0 — AI-visibility dashboard only. Internal use; no public-facing output.
Purpose
GEO (Generative Engine Optimization) is peptiderepo.com's #1 strategic goal. This plugin provides the measurement instrument: weekly LLM probes → time-series storage → admin trendline + per-peptide standings.
The displayed metric is a directional proxy — API probes do not replicate the consumer ChatGPT/Gemini experience (different retrieval, personalisation, and system prompts), but they provide a consistent, trackable signal.
Required wp-config.php constants
// OpenRouter API key (sk-or-…) — required for all providers.
define( 'PRV_OPENROUTER_API_KEY', 'sk-or-YOUR_KEY_HERE' );
// Cloudflare AI Gateway routing (optional — falls back to direct OpenRouter).
define( 'PRV_CF_ACCOUNT_ID', 'YOUR_CF_ACCOUNT_ID' );
define( 'PRV_CF_GATEWAY_ID', 'YOUR_GATEWAY_NAME' );
Never commit these values. They are read at runtime from wp-config.php only.
Architecture
See ARCHITECTURE.md for the full file tree, data flow, and design decisions.
Admin page
Navigate to PR Vision in the WordPress admin sidebar (manage_options required).
The page shows:
- A proxy-metric disclaimer note.
- A Chart.js trendline of the visibility score across runs.
- A per-peptide standings table (cited?, our position, top competitor domains).
- Month-to-date cost vs. the monthly cap.
- A "Run now" button to trigger an on-demand probe run.
Scheduling
A weekly WP-Cron event (prv_weekly_probe) is registered on plugin activation and cleared on deactivation. Probe runs (cron or manual) respect the hard monthly budget cap.
Cost cap
Default cap: $5.00 USD/month (configurable via the prv_monthly_budget_usd option). The runner checks the month-to-date spend before each API call and stops gracefully when the cap is reached — partial runs are recorded, never over-spend.
Uninstall
Uninstalling the plugin drops the {prefix}prv_ai_visibility table and deletes all prv_* options. Deactivation only clears the cron schedule.
Developer notes
- PHP 8.1+ required. No runtime Composer dependencies.
- All classes prefixed
PRV_. All options/hooks prefixedprv_. - Files are kept under 300 lines; one class per file.
- See
CONVENTIONS.mdfor naming patterns and extension guides. - See
CONTEXT.mdfor the domain glossary including the visibility score formula.