Skip to content

Haiku 5.5, consent v3 and widget page preview - #6

Merged
bigjohnn1 merged 11 commits into
mainfrom
dev
Oct 10, 2026
Merged

bigjohnn1 merged 11 commits into
mainfrom
dev

Conversation

@bigjohnn1

Copy link
Copy Markdown
Member

Changes

  • AI: every text task runs on Claude Haiku 5.5 (@ai-sdk/anthropic). The ChatGPT visibility probe stays on OpenAI, and Claude visibility uses Haiku instead of Sonnet. Haiku gets thinking headroom on top of each call-site maxOutputTokens, and the copy desk no longer fails on length caps that Anthropic does not enforce.
  • Media: cover imageUrl allows 2048 characters, like MediaAsset.url. AI illustrations keep their description in alt only.
  • Consent v3: the decision is bound to the publication's services. Views and shares are consent-gated on the server and use the HttpOnly analytics_session cookie. The browser fingerprint is removed. Visitors will be asked again after deploy.
  • Widgets: live page preview in the editor. Tenant override through the preview query works only on platform hosts.

Before deploy

  • ANTHROPIC_API_KEY (or NUXT_ANTHROPIC_API_KEY) is set in production. Without it, all text AI fails.
  • The privacy policy lists Anthropic as a processor.

Verification

Typecheck, lint and prettier pass, and 700 tests pass in the touched areas. A Haiku article was generated end to end locally (research, writing, review, revision, images, poll). The consent gate on /view was checked live: no consent, denied, granted and stale configuration.

Every text task moves from GPT-5.6/GPT-6 Luna to claude-haiku-5-5 through
@ai-sdk/anthropic. The ChatGPT visibility probe stays on OpenAI, and Claude
visibility now measures with Haiku at low effort instead of Sonnet.

- aiModel picks the provider per task and gives Haiku thinking headroom on
  top of each call-site budget, since thinking shares max_tokens
- aiWebSearchTool(task, depth) returns the matching provider's search tool
- aiReasoning(effort) carries options for both providers
- the fact-check guard and its hint now require ANTHROPIC_API_KEY
Anthropic structured output does not enforce length limits, so a seventh
issue or a long note failed the whole manual generation. The caps now live
in the field descriptions and reviewArticle trims the notes itself.
External and stock media are hotlinked and MediaAsset.url allows 2048
characters, but Article and ArticleSeries capped imageUrl at 255, so a
Wikimedia cover from the library could not be saved. The column is TEXT;
only the ZenStack validation changes.
A generated picture documents nothing, so its writer-provided description
under the image only repeated the alt text. The figcaption now holds just
the AI disclosure label, which tenants without disclosure drop entirely.
Consent version 3 records the publication, its GA4 ID and its advertising
provider, so changing any of them asks again. Optional services only run
with a matching, current decision.

- article views and shares need analytics consent on the server too and use
  a separate HttpOnly analytics_session cookie; withdrawal deletes it
- votes and feedback keep anon_session, issued only on interaction; the
  browser fingerprint (@fingerprintjs) is gone
- GA4 loads after analytics consent without Signals or ad personalization;
  AdSense and GAM load after advertising consent, non-personalized
- cookie settings are reachable from the footer
The editor groups widgets by placement and previews the draft inside the
real publication page (home or a featured article, desktop or mobile) in a
same-origin iframe. The frame talks to the editor over a validated
postMessage bridge and blocks clicks and form submits.

On platform hosts, ?widgetPreview=1&widgetPreviewSite=<domain> resolves
that tenant's public site; a tenant domain ignores the query so it can
never render another tenant's chrome. The preview hides dashboard chrome,
consent, ads and dev tools and is noindex. The preset picker (Gallery) is
replaced by a categorized preset library with live thumbnails.
- consent and widget components drop visual utilities from Nuxt UI
  primitives (block buttons, ULink for the footer settings action),
  label their switches by id, and use USkeleton instead of a spinner
- the announcement editor styles TipTap through editorProps classes
  instead of a scoped <style>
- the preview slot chip is a UButton; the tiles that cover a live preview
  keep a transparent native button and are allowlisted with the reason
- appEntry tests pass a route query, as real routes always have one
- CI typecheck gets a 6 GB heap; vue-tsc has hit OOM since 2026-10-09
Text tasks now run on Anthropic while images and embeddings stay on OpenAI,
so naming one vendor made the processor list untrue. GDPR allows
categories of recipients; the policy now says AI model providers (US).
The terms page printed a hardcoded Czech-formatted '1. 1. 2026' in every
language instead of legal.updatedAt.
Both documents drop from 13 to 10 sections (139 kB to 57 kB across four
locales). What remains is what the law or a platform requires: consumer
withdrawal and ADR, GDPR recipients, transfers, retention and rights, the
LinkedIn retention limits and the Shopify deletion flow. The operator's
identity moves to the last section.

The app copy lacked the Google Search Console section that Google OAuth
verification for webmasters.readonly needs; it is back in short form, with
the Limited Use statement, and the cs/en copies match ../landing again.
The smoke job builds on Node and hit the default V8 heap; the production
image builds on Bun and is unaffected.
@bigjohnn1
bigjohnn1 merged commit 9574559 into main Oct 10, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant