PluginProbe
xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN / 1.3.3
xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN v1.3.3
1.3.3 1.3.2 1.3.1 1.3.0 1.2.4 trunk 1.0.0 1.0.1 1.0.2 1.0.3 1.0.4 1.0.5 1.0.6 1.0.7 1.0.8 1.0.9 1.1.0 1.1.1 1.1.2 1.1.3 1.1.4 1.1.5 1.1.6 1.1.7 1.1.8 All 29 releases
← All changes | includes/modules/Score/ScoreModule.php +283 -61 1.2.41.3.3 View file →
@@ -27,8 +27,9 @@
27 27 defined( 'ABSPATH' ) || exit;
28 28
29 29 use XSpeed\Module;
30 30 use XSpeed\Modules\Mcp\Mcp_Hub;
31 +use XSpeed\Modules\Mcp\Mcp_Pairing;
31 32 use XSpeed\Scan;
32 33 use XSpeed\Score;
33 34 use XSpeed\Settings_Manager;
34 35
@@ -37,17 +38,31 @@
37 38 public const SLUG = 'score';
38 39 public const TIER = self::TIER_FREE;
39 40 public const VERSION = '1.1.0';
40 41
42 + /**
43 + * No On/Off state (#425).
44 + *
45 + * The default reports the `enabled` setting, which put an "Off" pill on a
46 + * panel whose Test button works regardless — the press is the consent and
47 + * flips the setting itself. A run-on-demand panel has no meaningful
48 + * on/off, exactly like Health; the setting stays as the internal gate for
49 + * non-press callers (optimize runs, GTmetrix polling), it just is not a
50 + * state this panel wears.
51 + */
52 + public function is_active(): ?bool {
53 + return null;
54 + }
55 +
41 56 public function ui_metadata(): array {
42 57 return array(
43 - 'label' => 'Speed Test',
58 + 'label' => __( 'Speed Test', 'xspeed' ),
44 59 'icon' => 'Gauge',
45 60 // Provider-neutral: the panel runs whichever provider the site has
46 61 // configured (PageSpeed Insights by default, no API key needed).
47 62 // The Hub-run test has its own copy and is gated behind
48 63 // hub_speed_test_enabled(), so this line must not promise it.
49 - 'description' => 'Run a PageSpeed Insights or GTmetrix audit from the dashboard and keep the history next to your TTFB benchmark.',
64 + 'description' => __( 'Run a PageSpeed Insights or GTmetrix audit from the dashboard and keep the history next to your TTFB benchmark.', 'xspeed' ),
50 65 'custom_panel' => 'ScorePanel',
51 66 );
52 67 }
53 68
@@ -55,12 +70,23 @@
55 70 return array(
56 71 'enabled' => array(
57 72 'type' => 'bool',
58 73 'default' => false,
59 - 'label' => 'Enable external scores',
60 - // Off by default and stated plainly: this is the only part
61 - // of the plugin that talks to a third party on your behalf.
62 - 'description' => 'Lets you run a PageSpeed Insights or GTmetrix audit from this dashboard. Nothing is sent anywhere until you press Test.',
74 + // Meaningful for the surfaces it still reaches (REST schema,
75 + // CLI settings, a wp-config override): it names what the
76 + // value permits, not a switch nobody sees.
77 + 'label' => __( 'Allow speed tests', 'xspeed' ),
78 + // Off by default, but pressing Test IS the consent: the first
79 + // run turns this on rather than refusing (#425). What it
80 + // still guards is everything that is NOT a Test press — an
81 + // optimize run measuring its own effect, for instance.
82 + // Switch it off (REST/CLI) and nothing contacts a provider.
83 + 'description' => __( 'Turns on automatically the first time you run a speed test — the button press is the consent. Switch it off to stop every feature, including optimize runs, from contacting a score provider.', 'xspeed' ),
84 + // No dashboard control: the Test press manages it, and a
85 + // visible switch that gates a button elsewhere was the
86 + // confusion #425 removed. Hidden fields are skipped by the
87 + // panel renderer and by settings search.
88 + 'hidden' => true,
63 89 ),
64 90 'provider' => array(
65 91 'type' => 'enum',
66 92 'default' => 'psi',
@@ -68,17 +94,16 @@
68 94 'option_labels' => array(
69 95 'psi' => 'PageSpeed Insights',
70 96 'gtmetrix' => 'GTmetrix',
71 97 ),
72 - 'label' => 'Provider',
73 - 'description' => 'PageSpeed Insights works without an API key. GTmetrix requires one.',
74 - 'dependsOn' => array( 'field' => 'enabled' ),
98 + 'label' => __( 'Provider', 'xspeed' ),
99 + 'description' => __( 'PageSpeed Insights works without an API key. GTmetrix requires one.', 'xspeed' ),
75 100 ),
76 101 'psi_api_key' => array(
77 102 'type' => 'secret',
78 103 'default' => '',
79 - 'label' => 'PageSpeed API key (optional)',
80 - 'description' => 'Only needed if you hit Google\'s anonymous rate limit. Free from cloud.google.com.',
104 + 'label' => __( 'PageSpeed API key (optional)', 'xspeed' ),
105 + 'description' => __( 'Only needed if you hit Google\'s anonymous rate limit. Free from cloud.google.com.', 'xspeed' ),
81 106 // Rendered as a trailing "Check the documentation" link —
82 107 // descriptions themselves are plain text (#111).
83 108 'doc_url' => 'https://xspeedcache.com/docs/pagespeed-insights-integration/',
84 109 'dependsOn' => array(
@@ -88,10 +113,10 @@
88 113 ),
89 114 'gtmetrix_api_key' => array(
90 115 'type' => 'secret',
91 116 'default' => '',
92 - 'label' => 'GTmetrix API key',
93 - 'description' => 'Required — GTmetrix has no anonymous mode. Found in your GTmetrix account settings.',
117 + 'label' => __( 'GTmetrix API key', 'xspeed' ),
118 + 'description' => __( 'Required — GTmetrix has no anonymous mode. Found in your GTmetrix account settings.', 'xspeed' ),
94 119 'dependsOn' => array(
95 120 'field' => 'provider',
96 121 'value' => 'gtmetrix',
97 122 ),
@@ -98,18 +123,17 @@
98 123 ),
99 124 'test_url' => array(
100 125 'type' => 'url',
101 126 'default' => '',
102 - 'label' => 'URL to test',
103 - 'description' => 'Leave empty to test your home page.',
104 - 'dependsOn' => array( 'field' => 'enabled' ),
127 + 'label' => __( 'URL to test', 'xspeed' ),
128 + 'description' => __( 'Leave empty to test your home page.', 'xspeed' ),
105 129 ),
106 130 'default_strategy' => array(
107 131 'type' => 'enum',
108 132 'default' => 'mobile',
109 133 'options' => array( 'mobile', 'desktop' ),
110 - 'label' => 'Strategy',
111 - 'description' => 'PageSpeed Insights only. Mobile is what Google ranks on.',
134 + 'label' => __( 'Strategy', 'xspeed' ),
135 + 'description' => __( 'PageSpeed Insights only. Mobile is what Google ranks on.', 'xspeed' ),
112 136 'dependsOn' => array(
113 137 'field' => 'provider',
114 138 'value' => 'psi',
115 139 ),
@@ -409,18 +433,10 @@
409 433 * POST, never GET: this spends someone else's rate limit and takes up
410 434 * to a minute. A GET would be prefetched by a browser.
411 435 */
412 436 public function rest_run( \WP_REST_Request $request ) {
413 - $opts = Settings_Manager::get( self::SLUG );
437 + $opts = $this->consent_by_running( Settings_Manager::get( self::SLUG ) );
414 438
415 - if ( empty( $opts['enabled'] ) ) {
416 - return new \WP_Error(
417 - 'xspeed_score_disabled',
418 - __( 'External scores are turned off. Enable them first — this is the only feature that contacts a third party.', 'xspeed' ),
419 - array( 'status' => 409 )
420 - );
421 - }
422 -
423 439 $url = $this->resolve_url( (string) $request->get_param( 'url' ), $opts );
424 440 if ( '' === $url ) {
425 441 return new \WP_Error(
426 442 'xspeed_score_no_url',
@@ -436,12 +452,200 @@
436 452 return is_wp_error( $started ) ? $started : rest_ensure_response( $started );
437 453 }
438 454
439 455 $strategy = (string) ( $request->get_param( 'strategy' ) ?: $opts['default_strategy'] );
440 - return rest_ensure_response( Score::run_psi( $url, $strategy, (string) $opts['psi_api_key'] ) );
456 + $api_key = (string) $opts['psi_api_key'];
457 +
458 + // No key of their own → run it through the Hub when this site is
459 + // connected. The Hub holds a real Google key, so this is the path
460 + // that does NOT die on the shared anonymous quota (#426). When the
461 + // Hub can't take it, fall through to the anonymous direct call —
462 + // worse odds, but exactly what the plugin did before.
463 + if ( '' === trim( $api_key ) ) {
464 + $via_hub = $this->start_psi_via_hub( $url, $strategy );
465 + if ( null !== $via_hub ) {
466 + return $via_hub;
467 + }
468 + }
469 +
470 + return rest_ensure_response( Score::run_psi( $url, $strategy, $api_key ) );
441 471 }
442 472
443 473 /**
474 + * Record the Test press as the opt-in (#425).
475 + *
476 + * The five-step funnel — find the toggle, enable it, come back, press
477 + * Test — existed to make the outbound call opt-in. The press already is
478 + * the opt-in: it is an explicit, authenticated request to contact a
479 + * provider right now. So a run no longer refuses when the toggle is off;
480 + * it turns the toggle on and proceeds, and the toggle keeps its real job
481 + * of gating everything that is NOT a Test press (optimize runs measuring
482 + * their own effect, GTmetrix polling).
483 + *
484 + * @param array<string,mixed> $opts Current module settings.
485 + * @return array<string,mixed> Settings with `enabled` true.
486 + */
487 + private function consent_by_running( array $opts ): array {
488 + if ( empty( $opts['enabled'] ) ) {
489 + Settings_Manager::update( self::SLUG, array( 'enabled' => true ) );
490 + $opts['enabled'] = true;
491 + }
492 + return $opts;
493 + }
494 +
495 + /**
496 + * Start a keyless PSI audit through the Hub, or null when the Hub cannot
497 + * take it and the caller should fall back to the direct anonymous call.
498 + *
499 + * Null — fall back — only for "the Hub was never an option here": not
500 + * connected, PSI not configured on it, or unreachable. A real refusal
501 + * (rate-limited, a run already active) is surfaced, because retrying it
502 + * anonymously would spend the shared quota to report a worse error.
503 + *
504 + * The Hub audits the site's HOME page, so a custom test URL also skips
505 + * this path rather than silently testing a different page than asked.
506 + *
507 + * @return \WP_REST_Response|\WP_Error|null
508 + */
509 + private function start_psi_via_hub( string $url, string $strategy ) {
510 + if ( untrailingslashit( $url ) !== untrailingslashit( (string) home_url( '/' ) ) ) {
511 + return null;
512 + }
513 +
514 + $result = Mcp_Hub::psi_test( $strategy );
515 +
516 + if ( is_wp_error( $result ) ) {
517 + if ( in_array( $result->get_error_code(), array( 'not_connected', 'psi_not_configured', 'hub_unreachable' ), true ) ) {
518 + return null;
519 + }
520 + // A 401/403 means the pairing is dead (revoked, detached, stale
521 + // token) — for THIS feature that is the same as not connected,
522 + // not an error the Test button should wear.
523 + $data = $result->get_error_data();
524 + if ( is_array( $data ) && in_array( (int) ( $data['status'] ?? 0 ), array( 401, 403 ), true ) ) {
525 + return null;
526 + }
527 + return $this->hub_result( $result );
528 + }
529 +
530 + $run_id = isset( $result['run']['id'] ) ? (string) $result['run']['id'] : '';
531 +
532 + // No run id means nothing can ever be polled — writing a marker here
533 + // would orphan it (may_poll() rejects an empty test_id before the
534 + // staleness check, so it would never expire either). A 202 without an
535 + // id is a malformed Hub response; say so rather than pretend a test
536 + // is pending.
537 + if ( '' === $run_id ) {
538 + return new \WP_Error(
539 + 'hub_error',
540 + __( 'xSpeed Hub accepted the test but returned no run id. Please try again.', 'xspeed' ),
541 + array( 'status' => 502 )
542 + );
543 + }
544 +
545 + // The Hub answers 202 before the audit runs; the result arrives via
546 + // the same pending/poll machinery GTmetrix already uses.
547 + update_option(
548 + Score::PENDING_OPTION,
549 + array(
550 + 'test_id' => $run_id,
551 + 'url' => $url,
552 + 'started' => time(),
553 + 'provider' => 'hub-psi',
554 + ),
555 + false
556 + );
557 +
558 + return rest_ensure_response(
559 + array(
560 + 'ok' => true,
561 + 'provider' => 'psi',
562 + 'source' => 'hub',
563 + 'state' => 'queued',
564 + 'test_id' => $run_id,
565 + 'url' => $url,
566 + 'strategy' => $strategy,
567 + 'pending' => true,
568 + )
569 + );
570 + }
571 +
572 + /**
573 + * Poll an in-flight Hub-run PSI audit.
574 + *
575 + * psi_runs() has already copied any finished run into the local history,
576 + * so resolving here is: find our run, see whether it is still going, and
577 + * drop the marker the moment it is not.
578 + *
579 + * @param array<string,mixed> $pending The stored pending marker.
580 + * @return array<string,mixed>|\WP_Error
581 + */
582 + private function poll_hub_psi( array $pending ) {
583 + $result = Mcp_Hub::psi_runs();
584 + if ( is_wp_error( $result ) ) {
585 + return $result;
586 + }
587 +
588 + $mine = null;
589 + foreach ( (array) ( $result['runs'] ?? array() ) as $run ) {
590 + if ( is_array( $run ) && (string) ( $run['id'] ?? '' ) === (string) $pending['test_id'] ) {
591 + $mine = $run;
592 + break;
593 + }
594 + }
595 +
596 + $state = is_array( $mine ) ? (string) ( $mine['status'] ?? '' ) : '';
597 +
598 + if ( 'queued' === $state || 'running' === $state ) {
599 + return array(
600 + 'ok' => true,
601 + 'provider' => 'psi',
602 + 'source' => 'hub',
603 + 'state' => $state,
604 + 'test_id' => (string) $pending['test_id'],
605 + 'pending' => true,
606 + );
607 + }
608 +
609 + // Terminal — done, error, or the Hub no longer lists it at all.
610 + delete_option( Score::PENDING_OPTION );
611 +
612 + if ( 'error' === $state ) {
613 + $row = array(
614 + 'ok' => false,
615 + 'provider' => 'psi',
616 + 'source' => 'hub',
617 + 'state' => 'error',
618 + 'pending' => false,
619 + 'error' => (string) ( $mine['error'] ?? __( 'The audit did not produce a result.', 'xspeed' ) ),
620 + );
621 + Score::record(
622 + array(
623 + 'ok' => false,
624 + 'provider' => 'psi',
625 + 'ts' => time(),
626 + 'url' => (string) ( $pending['url'] ?? '' ),
627 + 'strategy' => 'mobile',
628 + 'score' => null,
629 + 'metrics' => array(),
630 + 'issues' => array(),
631 + 'error' => $row['error'],
632 + 'source' => 'hub',
633 + )
634 + );
635 + return $row;
636 + }
637 +
638 + return array(
639 + 'ok' => true,
640 + 'provider' => 'psi',
641 + 'source' => 'hub',
642 + 'state' => 'completed',
643 + 'pending' => false,
644 + );
645 + }
646 +
647 + /**
444 648 * Poll an in-flight GTmetrix test.
445 649 *
446 650 * GET because it is a read of state we already started — the browser
447 651 * calls it every few seconds while a test is queued.
@@ -449,12 +653,13 @@
449 653 public function rest_status() {
450 654 $opts = Settings_Manager::get( self::SLUG );
451 655 $pending = get_option( Score::PENDING_OPTION, array() );
452 656
453 - // Same opt-in gate as rest_run(). Without it, `status` — which is
454 - // also the CLI's DEFAULT action — polled GTmetrix with the feature
455 - // switched off and no API key, which falsified readme.txt's promise
456 - // that nothing is sent while it is off.
657 + // Same opt-in gate as the rest of the module. Without it, `status` —
658 + // which is also the CLI's DEFAULT action — polled GTmetrix with the
659 + // feature switched off and no API key, which falsified readme.txt's
660 + // promise that nothing is sent while it is off. (A Hub-run test polls
661 + // only the Hub the site is deliberately connected to.)
457 662 if ( ! $this->may_poll( $opts, $pending ) ) {
458 663 return rest_ensure_response(
459 664 array(
460 665 'pending' => false,
@@ -463,19 +668,11 @@
463 668 )
464 669 );
465 670 }
466 671
467 - if ( ! is_array( $pending ) || empty( $pending['test_id'] ) ) {
468 - return rest_ensure_response(
469 - array(
470 - 'pending' => false,
471 - 'state' => 'idle',
472 - 'latest' => Score::latest(),
473 - )
474 - );
475 - }
476 -
477 - $polled = Score::poll_gtmetrix( (string) $opts['gtmetrix_api_key'] );
672 + $polled = 'hub-psi' === ( $pending['provider'] ?? '' )
673 + ? $this->poll_hub_psi( $pending )
674 + : Score::poll_gtmetrix( (string) $opts['gtmetrix_api_key'] );
478 675 if ( is_wp_error( $polled ) ) {
479 676 return $polled;
480 677 }
481 678
@@ -497,33 +694,35 @@
497 694 );
498 695 }
499 696
500 697 /**
501 - * May we contact GTmetrix to poll the in-flight test?
698 + * May we contact anyone to poll the in-flight test?
502 699 *
503 - * Three conditions, all necessary: the feature is on, an API key exists
504 - * (there is no anonymous GTmetrix), and the pending marker is real and
505 - * not stale. A marker with no expiry turned one failed start into a
506 - * permanent poll loop against a third party.
700 + * The pending marker must be real and not stale — a marker with no expiry
701 + * turned one failed start into a permanent poll loop against a third
702 + * party. Beyond that, who we may poll depends on who ran the test: a
703 + * GTmetrix test needs the feature on and an API key (there is no
704 + * anonymous GTmetrix); a Hub-run test needs only the Hub connection the
705 + * site already has — the Hub is not a third party the toggle guards.
507 706 *
508 707 * @param array<string,mixed> $opts Module settings.
509 708 * @param mixed $pending The stored pending marker.
510 709 */
511 710 private function may_poll( array $opts, $pending ): bool {
512 - if ( empty( $opts['enabled'] ) || '' === trim( (string) $opts['gtmetrix_api_key'] ) ) {
513 - return false;
514 - }
515 711 if ( ! is_array( $pending ) || empty( $pending['test_id'] ) ) {
516 712 return false;
517 713 }
518 - // A GTmetrix test that hasn't resolved within the window is not going
519 - // to; drop the marker rather than poll it forever.
714 + // A test that hasn't resolved within the window is not going to;
715 + // drop the marker rather than poll it forever.
520 716 $started = isset( $pending['started'] ) ? (int) $pending['started'] : 0;
521 717 if ( $started > 0 && ( time() - $started ) > Score::PENDING_MAX_AGE ) {
522 718 delete_option( Score::PENDING_OPTION );
523 719 return false;
524 720 }
525 - return true;
721 + if ( 'hub-psi' === ( $pending['provider'] ?? '' ) ) {
722 + return '' !== Mcp_Pairing::site_token();
723 + }
724 + return ! empty( $opts['enabled'] ) && '' !== trim( (string) $opts['gtmetrix_api_key'] );
526 725 }
527 726
528 727 /**
529 728 * Fall back to the home page when no URL is configured — testing "my
@@ -804,12 +1003,11 @@
804 1003 return;
805 1004 }
806 1005
807 1006 if ( 'run' === $action ) {
808 - if ( empty( $opts['enabled'] ) ) {
809 - \WP_CLI::error( 'External scores are turned off. Enable the score module first — this is the only feature that contacts a third party.' );
810 - return;
811 - }
1007 + // Running the command IS the opt-in — same consent rule as the
1008 + // dashboard's Test button (#425).
1009 + $opts = $this->consent_by_running( $opts );
812 1010
813 1011 $url = $this->resolve_url( isset( $assoc['target'] ) ? (string) $assoc['target'] : '', $opts );
814 1012 $provider = isset( $assoc['provider'] ) ? (string) $assoc['provider'] : (string) $opts['provider'];
815 1013
@@ -823,10 +1021,25 @@
823 1021 return;
824 1022 }
825 1023
826 1024 $strategy = isset( $assoc['strategy'] ) ? (string) $assoc['strategy'] : (string) $opts['default_strategy'];
827 - $run = Score::run_psi( $url, $strategy, (string) $opts['psi_api_key'] );
1025 + $api_key = (string) $opts['psi_api_key'];
828 1026
1027 + // No key → prefer the Hub, same ladder as rest_run() (#426).
1028 + if ( '' === trim( $api_key ) ) {
1029 + $via_hub = $this->start_psi_via_hub( $url, $strategy );
1030 + if ( $via_hub instanceof \WP_Error ) {
1031 + \WP_CLI::error( $via_hub->get_error_message() );
1032 + return;
1033 + }
1034 + if ( null !== $via_hub ) {
1035 + \WP_CLI::success( 'PageSpeed audit started via xSpeed Hub. Poll with: wp xspeed score status' );
1036 + return;
1037 + }
1038 + }
1039 +
1040 + $run = Score::run_psi( $url, $strategy, $api_key );
1041 +
829 1042 if ( empty( $run['ok'] ) ) {
830 1043 \WP_CLI::error( (string) $run['error'] );
831 1044 return;
832 1045 }
@@ -844,15 +1057,24 @@
844 1057
845 1058 // status
846 1059 $pending = get_option( Score::PENDING_OPTION, array() );
847 1060 if ( $this->may_poll( $opts, $pending ) ) {
848 - $polled = Score::poll_gtmetrix( (string) $opts['gtmetrix_api_key'] );
1061 + $polled = 'hub-psi' === ( $pending['provider'] ?? '' )
1062 + ? $this->poll_hub_psi( $pending )
1063 + : Score::poll_gtmetrix( (string) $opts['gtmetrix_api_key'] );
849 1064 if ( is_wp_error( $polled ) ) {
850 1065 \WP_CLI::error( $polled->get_error_message() );
851 1066 return;
852 1067 }
853 1068 if ( ! empty( $polled['pending'] ) ) {
854 - \WP_CLI::log( sprintf( 'GTmetrix test %s is %s.', (string) $pending['test_id'], (string) ( $polled['state'] ?? 'running' ) ) );
1069 + \WP_CLI::log(
1070 + sprintf(
1071 + '%s test %s is %s.',
1072 + 'hub-psi' === ( $pending['provider'] ?? '' ) ? 'PageSpeed (Hub)' : 'GTmetrix',
1073 + (string) $pending['test_id'],
1074 + (string) ( $polled['state'] ?? 'running' )
1075 + )
1076 + );
855 1077 return;
856 1078 }
857 1079 }
858 1080