137 Commits
Author SHA1 Message Date
janniclas.loosenandClaude Opus 5.5 ca40e39b18 docs: Divi safeguard implementation plan
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-30 00:36:19 +02:00
janniclas.loosenandClaude Opus 5.5 94b8c7b338 docs: Divi safeguard design spec (version gate, Divi boundary, admin check)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-30 00:01:20 +02:00
janniclas.loosenandClaude Opus 5.5 066fe408ea docs: Etappe 3b rulings and security audit
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
2026-09-27 23:32:11 +02:00
janniclas.loosenandClaude Opus 5.5 66f012befd docs: check the page after restoring a layout revision in WordPress (re-review N-2)
A restore in the revision screen does not go through the plugin's cache
clear, so the Theme Builder guide asks to check the builder or the website
and to clear Divi's static CSS if the old state still shows.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
2026-09-27 23:25:59 +02:00
janniclas.loosenandClaude Opus 5.5 50cfa42358 docs: only the group switch keeps the Divi tools off Theme Builder layouts (audit I2)
The Theme Builder guide says that switching off single lit/tb-* tools does
not stop the lit-divi-* tools from editing layouts, and that "nur lesen"
also covers global modules in layouts. The decisions note records Q17 M1
and the restore_url answer of audit L3.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
2026-09-27 23:12:40 +02:00
janniclas.loosenandClaude Opus 5.5 14bc954ecc fix: Theme Builder minors of the final review (M-4, M-5, M-6, M-9, M-10, M-11, M-12 c)
- tb-list applies the detached limit after the edit filter (reads up to 500
  IDs) and notes when more are not listed (M-4); an invalid template_id is
  invalid input, shared with ThemeBuilderAccess::template() (M-5).
- Templates carry their status; tb-list notes that a live template outside
  publish (e.g. trashed) can only be switched off (M-10).
- changeableTemplate() refuses without canUse() first, like tb-list and
  tb-create-template; the layout/template refusal difference is documented
  (M-9).
- tb-create-template reads the default template from editableLiveTemplates()
  (M-11); the condition-ID character set (role slugs) is documented (M-6);
  tb-assign documents that a failed reattach keeps Divi's unused marks
  removed (M-12 c).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
2026-09-27 23:12:14 +02:00
janniclas.loosenandClaude Opus 5.5 e7bbe1e9d7 fix: find-similar marks replaceable matches and names excluded types (review M-3, M-7, M-8)
Every match carries replaceable: true only when it is identical and in a
page or post, the scope lit/library-make-global replaces; the description
and the guide say so. An excluded post type is answered like any
unavailable one, by its name (PostGuard::unavailableType()), and the
excluded list takes the Theme Builder types from DiviThemeBuilder::postTypes().

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
2026-09-27 23:09:13 +02:00
janniclas.loosenandClaude Opus 5.5 e64d32b1f1 fix: tb-assign reattaches only templates no Theme Builder post lists (audit L4)
"Detached" now means for lit/tb-assign what lit/tb-list shows as detached:
DiviThemeBuilder::isListedAnywhere() looks for any _et_template row (live,
draft or Theme Builder library post). A template another Theme Builder post
lists is refused with or without reattach; nothing is written.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
2026-09-27 23:06:35 +02:00
janniclas.loosenandClaude Opus 5.5 dcae2d4b91 fix: name the WordPress revision screen for library and layout revisions (audit L3)
lit/revision-restore takes only content types, so a write to a library entry
or a Theme Builder layout now answers with restore_url (wp-admin
revision.php for its revision_id), also per page in lit/divi-replace-text.
The guides and readme no longer present lit/revision-restore as the way back
for these types.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
2026-09-27 23:05:05 +02:00
janniclas.loosenandClaude Opus 5.5 43dc3fb889 fix: global usages follow the Theme Builder access (ruling Q17 M1)
GlobalUsages gets the Theme Builder access injected as a closure
(ThemeBuilderAccess::usageState(), wired at both construction sites through
DiviIntegration::globalUsages()). Theme Builder posts are named only while
the Theme Builder is visible to the account, otherwise only counted (also
in blocked_ids); a global edit that changes them needs canUse(), a writable
"Divi Theme Builder" group and edit_post. Without an injected access the
fail-safe default checks what canUse() checks. The duplicate
THEME_BUILDER_TYPES list gives way to DiviThemeBuilder::postTypes().

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
2026-09-27 23:00:36 +02:00
janniclas.loosenandClaude Opus 5.5 7590da4d96 fix: layout-edit dry runs name only editable live templates (ruling Q22)
ThemeBuilderEdits::showing() splits the live templates that show a layout
into editable ones (named under templates) and a hidden_templates count;
confirm is still decided on all of them, so a layout shown only by
uneditable templates still needs confirm. The live split is read once per
write for the confirm check and the field warnings, and field warnings now
also survive a non-confirm refusal such as the P9 backup refusal (M-12 a).
replace-text passes hidden_templates on; the write schema lists it.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
2026-09-27 22:57:45 +02:00
janniclas.loosenandClaude Opus 5.5 0b7a1c28ec test: Etappe 3b end-to-end smoke and acceptance checklist
tb-smoke.sh checks the Theme Builder tools, Pods field warnings (own
temporary pod, ruling Q6), find-similar, make-global, P13 and P10 through
the OAuth endpoint. The only enabled template targets a temporary draft
page; cleanup goes by exact IDs and the last section verifies the Theme
Builder list, enabled states and options equal the state before the run.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
2026-09-27 22:37:12 +02:00
janniclas.loosenandClaude Opus 5.5 3db96a3f5b docs: Theme Builder guide, instructions, readme and spec for 0.5.0
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-27 22:05:33 +02:00
janniclas.loosenandClaude Opus 5.5 4e959833b9 fix: identical means identical bytes – text parts count, pages and posts only (ruling Q25)
- Fingerprint::content() includes non-whitespace text parts (raw HTML between
  blocks, inner HTML of core blocks) and opaque blocks with all their bytes;
  structure() unchanged; find-similar "identical" follows
- make-global mode 2 also compares Fingerprint::canonical() bytes of each node
- sources and targets: post types page and post only (POST_TYPES)
- a rolled-back page N>1 keeps DiviSaver's "Revision X bleibt erhalten"
- guide: escaped divi/global-layout re-expanded by Divi's do_blocks in
  shortcode-module and WooCommerce text output documented as residual risk

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
2026-09-27 21:59:20 +02:00
janniclas.loosenandClaude Opus 5.5 0edb474d78 docs: Etappe 3b implementation plan (Theme Builder)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-27 12:16:15 +02:00
janniclas.loosenandClaude Opus 5.5 e049959482 docs: Etappe 3a rulings and security audit
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-27 04:57:43 +02:00
janniclas.loosenandClaude Opus 5.5 b6d791d46a fix: UsageMatcher reads Divi 4 shortcodes like WordPress and Divi, everywhere (ruling P24)
- G1: every decoded string value of a Divi 5 opener is scanned for shortcodes;
  outside the openers only the remaining content is.
- G2: attributes are parsed like shortcode_parse_atts() and global_module is
  cast with (int), as Divi does.
- G3: a non-empty global_module other than "0" that casts to 0 makes Divi
  render the newest layout, so it counts for every entry (fail closed).
- The prefilter LIKEs use LOWER(post_content), so they are case-insensitive
  under any collation.
- The guide describes the fail-closed rule without an absolute claim.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-27 04:53:54 +02:00
janniclas.loosenandClaude Opus 5.5 8f87ec6163 docs: library guide speaks of references in every place (P23)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-27 04:42:59 +02:00
janniclas.loosenandClaude Opus 5.5 fec5d9da7b fix: GlobalUsages finds every reference Divi renders, fail closed (F1, ruling P23)
Candidates come from one ID/status/type query: content with globalModule,
global_module or a JSON-escaped letter. Their content is read in chunks of
50 and parsed by UsageMatcher: Divi 5 openers are json-decoded (escaped keys
and values, leading zeros, any depth), and Divi 4 global_module attributes
are read in any quoting. An undecodable escaped opener counts as a possible
reference. Beyond 5000 candidates the rest count unread. The guide names
the formats and the wp_block parity. Also fixes the grammar of the
blocked-hidden count.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-27 04:42:46 +02:00
janniclas.loosenandClaude Opus 5.5 dcbd52e51d docs: acceptance note without CLI, with the editor connection and the read-only hint (M-15)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-27 04:24:01 +02:00
janniclas.loosenandClaude Opus 5.5 695f7b91ac docs: neutral client wording in the plugin header and the spec (T16)
The header says "mit OAuth für KI-Assistenten" like the readme; the spec names
the client neutrally and keeps claude.ai only where the connector is meant.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-27 04:21:25 +02:00
janniclas.loosenandClaude Opus 5.5 395049ec97 fix: global-edit rules for every library entry that pages show (L2)
Divi renders any referenced et_pb_layout, whatever its scope term. A normal
entry with usages now gets the dry run, confirm, P8a, backup and the
site-wide GlobalItem scope; lit-divi-delete's notice and the library-list
detail name its pages too. The usage scan is the same single query.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-27 04:14:58 +02:00
janniclas.loosenandClaude Opus 5.5 8aacc5dc4f fix: P8a blocks Theme Builder layouts without Divi's theme_builder role (L6)
et_header_layout, et_body_layout, et_footer_layout and et_template showing a
global entry now block a confirmed edit unless et_pb_is_allowed('theme_builder'),
like Divi's own check for TB layouts.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-27 04:13:14 +02:00
janniclas.loosenandClaude Opus 5.5 e8f69f67ea fix: bounded usage scan and count-only unreadable posts in global edits (L1, L4)
GlobalUsages runs one query per request (ID, status, type – no content),
checks read_post/edit_post in chunks of 200 with a primed and released post
cache, lists at most 50 readable posts and refuses a confirmed global edit
above 2000 live references (unsupported, edit in the Divi builder). Posts the
caller may not read appear only as hidden_count / blocked_hidden_count;
blocked_ids names readable posts only.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-27 04:12:38 +02:00
janniclas.loosenandClaude Opus 5.5 bd28c32513 docs: state the P13 limit honestly in the library guide (I-2)
With the library group disabled the entries stay unreadable and unwritable, but
page outline, node-get and render summary still name global module IDs; full
hiding follows in 3b.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-27 04:07:24 +02:00
janniclas.loosenandClaude Opus 5.5 1b42f9b640 fix: lit/divi-node-copy from a library entry needs the insert rights (I-1, L5)
A library entry as source now requires LibraryAccess::canInsert() (add_library,
writable library group) and follows lit-library-insert's Tools-tab state
(disabled -> unsupported). DiviPageLoader::library() gets its caller.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-27 04:06:56 +02:00
janniclas.loosenandClaude Opus 5.5 186f7af7ca test: end-to-end smoke and acceptance note for the Divi Library (3a)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-27 03:51:12 +02:00
janniclas.loosenandClaude Opus 5.5 2729e2800e docs: guides, readme and spec for the Divi Library (v0.4.0)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-27 03:33:38 +02:00
janniclas.loosenandClaude Opus 5.5 8808a7dcdb feat: lit/divi-dynamic-sources with text-like fields only (E12, F4)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-27 03:22:13 +02:00
janniclas.loosenandClaude Opus 5.5 6f6c691b5d feat: lit/divi-node-copy between pages and library entries
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-27 03:12:57 +02:00
janniclas.loosenandClaude Opus 5.5 7fe91c2bdb feat: lit-library-insert as copy or global instance in the builder's format (E5)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-27 02:27:16 +02:00
janniclas.loosenandClaude Opus 5.5 5035092805 feat: lit/library-save creates library entries like Divi (E4)
Reuses NewDraft for insert and rollback (P6), requires edit_global_library
for scope global (P7), refuses opaque and global roots before wrapping (P11)
and checks the node with StoredNodeGuard. The source page is never written.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-27 02:12:50 +02:00
janniclas.loosenandClaude Opus 5.5 8fa285a265 fix: the Lottie source is builder-only for users without unfiltered_html (P19)
lottie.innerContent (src → data-lottie-src) makes the frontend load an
animation whose expressions lottie-web runs with eval; it joins the S7 gate
in ValueCleaner, which covers removals and StoredNodeGuard.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-27 02:06:38 +02:00
janniclas.loosenandClaude Opus 5.5 9d92808918 fix: interactions are builder-only for users without unfiltered_html (P16)
Divi's frontend applies the interaction effect "Attribute" with setAttribute
(e.g. an onclick handler) and sets cookies; *.decoration.interactions joins
the S7 gate in ValueCleaner, which also covers removals and StoredNodeGuard.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-27 01:54:25 +02:00
janniclas.loosenandClaude Opus 5.5 b7c714939d feat: group Divi-Bibliothek with lit/library-list
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-27 01:29:37 +02:00
janniclas.loosenandClaude Opus 5.5 cfc81ddbb2 docs: Etappe 3a implementation plan (Bibliothek)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-27 00:10:27 +02:00
janniclas.loosenandClaude Opus 5.5 30788f2841 docs: Etappe 3 decisions draft with user answers
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-26 23:05:34 +02:00
janniclas.loosenandClaude Opus 5.5 2c553d2f0b docs: readme and guides name no specific chatbot
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-26 22:25:13 +02:00
janniclas.loosenandClaude Opus 5.5 dff3b20977 docs: Etappe 2b rulings, security audit and trial feedback
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-26 22:18:23 +02:00
janniclas.loosenandClaude Opus 5.5 097fef2e32 fix: final review minors m-1 to m-8
- m-1: the no-change Divi result carries preview_url/edit_url too
- m-2: overview names replace-text's per-page tree_rev
- m-3: divi-shortform documents validation_failed vs not_found for unknown IDs
- m-4: DiviWriter/DiviPageLoader final (no mocks left), neutral NewDraft
  log detail, snapshots are Etappe 4
- m-5: Tested up to 7.1, changelog completed
- m-6: content-create warns when the extras changed the stored layout
- m-7: deleting a whole section outlines nothing instead of the next one
- m-8: uninstall removes the user meta lit_mcp_log_per_page; readme lists it

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
2026-09-26 19:35:24 +02:00
janniclas.loosenandClaude Opus 5.5 7f361304ae fix(security): URL import with own range check and a generic error (audit M3, cheap part)
PublicAddress blocks every private/reserved IPv4 and IPv6 range
(169.254/16, 100.64/10, fc00::/7, fe80::/10, IPv4-mapped/NAT64/6to4 by
their embedded address, ...) independent of the core version; checked
before the request and on every redirect (Requests before_redirect).
Network failures return only "Die Datei konnte nicht geladen werden.";
the detail goes to the error log. DNS-rebinding pinning stays deferred.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
2026-09-26 19:27:11 +02:00
janniclas.loosenandClaude Opus 5.5 0531a5ffb1 docs: lit-divi-catalog shows both result shapes (trial)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
2026-09-26 19:23:47 +02:00
janniclas.loosenandClaude Opus 5.5 db40f4efa7 feat: lit/menu-create returns the new menu's menu_rev (trial)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
2026-09-26 19:23:07 +02:00
janniclas.loosenandClaude Opus 5.5 26108bc9a9 feat: short-form level for every module with a heading title (trial)
contact-form, cta, toggle, accordion-item, slide, number-counter and
team-member (name) take level like heading/blurb; paths from Divi's
conversion outlines, checked live with divi-shortform-check.php. A test
keeps the guide's field table in sync with ShortformMap.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
2026-09-26 19:20:23 +02:00
janniclas.loosenandClaude Opus 5.5 37ecb036ba docs: acceptance note matches M2, adds trial reset and connection/tab checks (review I-2)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
2026-09-26 19:19:15 +02:00
janniclas.loosenandClaude Opus 5.5 482575b732 fix: a nested row gets its own auto label (ledger T3)
A row inside a column is labelled "<Abschnitt> – Zeile (innen)" instead of
repeating its outer row's "<Abschnitt> – Zeile". Guide updated.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
2026-09-26 18:36:47 +02:00
janniclas.loosenandClaude Opus 5.5 eda592548e fix: builder column classes only – no 4_5, all breakpoints checked (S49)
New rows no longer accept 4_5 (the builder does not offer it). On update,
the flexType of every non-desktop breakpoint (tablet, phone, …) is
format-checked against the builder list like desktop. Guide updated.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
2026-09-26 18:34:45 +02:00
janniclas.loosenandClaude Opus 5.5 e005d83a3d docs: S7 exception applies only to pages not yet in Divi's saved form
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-26 17:26:04 +02:00
janniclas.loosenandClaude Opus 5.5 e0ab6f53e5 docs: D11 superseded by the single Divi save path (Task 9)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-26 17:17:55 +02:00
janniclas.loosenandClaude Opus 5.5 10c98cd3c6 docs: Divi guides shortform/placeholders, hints name the write tools; test: Divi write end-to-end; version 0.3.0
- Hints (PostPresenter::DIVI_NOTE, outline, catalog) and server instructions (tree_rev rule)
  name the Divi write tools; guides divi-shortform and divi-placeholders, additions to
  divi-structure, divi-attrs, overview (tool groups, 'nur lesen'), workflows, content-types.
- D7 wording and the S7 exception in readme, guides and spec 1.3/5.2; readme 0.3.0.
- ToolNamingTest: every referenced guide topic exists; overview lists exactly the topics.
- tests/Integration/divi-write-smoke.sh: all write tools via OAuth, editor without
  unfiltered_html with benign probes (S6), Divi's own save filters on the new fixture
  synthetic-divi-filters.html (S7); admin-render.php accepts the new wrap class.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
2026-09-26 17:13:59 +02:00