` — paste that div into the editor.
Template: `templates/article-format.html`
## Channel Categorization Rules (曹小芬 2026-07-01)
| Article Type | Channel | ID |
|-------------|---------|-----|
| 考试政策、通知、考试历 | 政策信息 > 广东政策 | 198 |
| 语文备考技巧/经验 | 复习资料 > 语文 > 备考经验 | 216 |
| 数学备考技巧/经验 | 复习资料 > 数学 > 备考经验 | 219 |
| 英语备考技巧/经验 | 复习资料 > 英语 > 备考经验 | 222 |
| 语文资料分享 | 复习资料 > 语文 > 资料分享 | 215 |
| 数学资料分享 | 复习资料 > 数学 > 资料分享 | 218 |
| 英语资料分享 | 复习资料 > 英语 > 资料分享 | 221 |
| 3+证书报考 | 3+证书 > 报考相关 | 227 |
| 3+证书填报 | 3+证书 > 填报相关 | 226 |
| 技能证书 | 3+证书 > 技能证书 | 180 |
**DO NOT** put 备考/复习类 articles in 考前辅导 > 辅导培训 (176).
## Channel matching
- Always use `channel_id` (int), never `channel` (name string)
- Multiple channels can share the same name at different tree levels
- Leaf channels (no children) are the publish targets — content in parent channels won't display
- **⚠️ channel_id=1 is type='link' (redirect), NOT a publish target!** Articles created there write to DB but never get page URLs (404). Use type='channel' or 'list' channels only.
- Channel reference: `references/gdcjgk-channels.md`
- Full channel tree: `references/gdcjgk-channels-full.md`
## Pre-publish review notification
Before publishing, send a WeCom notification for human review:
```bash
python3 ~/.hermes/scripts/pre_publish_review.py '[{"title":"...","channel":"栏目名","channel_id":227,"url":"https://..."}]'
```
Uses webhook `d4de64e1-efaa-4f03-a833-ad85c1d6de5b`. Formats as markdown with backend edit link.
- **⚠️ BEWARE of `type='link'` channels** (e.g. channel_id=1 政策资讯). They redirect to an `outlink` URL and NEVER generate article pages — API returns success but all articles 404. Filter: only use `type='channel'` or `type='list'`. Check `references/gdcjgk-channels.md` for verified targets.
- Real channels in gdcjgk.net: 4=考前辅导, 32=招生动态, 176=辅导培训, 198=广东政策, 226=3+证书填报相关, 227=3+证书报考相关, 294=依学考报考相关
## Database reference
| Table | Purpose |
|-------|---------|
| `fa_cms_archives` | Articles (posts) |
| `fa_cms_channel` | Categories/channels (tree via `pid`) |
| `fa_config` | System + addon configuration |
| `fa_cms_model` | Content models |
Channel tree structure: `id`, `type` (channel/list/link), `pid` (parent ID), `name`.
## Thumbnail
Random image from site's own `fa_attachment` history:
```python
import json, random
with open('/home/agentuser/.hermes/data/image_library.json') as f:
images = json.load(f)
image = random.choice(images) # 4,179 images from fa_attachment table
```
Pass as `image` param to the publish API. Images are from `https://gdcjgk.net/uploads/...` — already hosted, no upload needed.
## Data cross-reference for content
When building articles that need admission data (majors, scores, schools, enrollment numbers), use the technique in `references/data-cross-reference.md` — cross-references the `2025` diyform table (2,731 majors) against the `fa_cms_archives` model_id=2 school table (106 schools), matched with external data sources.
## Publishing workflow (草稿 + 人工审核)
### 0. Pre-publish fact verification (MANDATORY — do NOT skip)
Before creating the draft, load the `fact-check` skill and verify:
- All dates/times against official sources (eea.gd.gov.cn, 微信公众号「广东省教育考试院」)
- All numbers (录取分数, 排位, 招生计划) against local CSV data first, then official policy documents
- All exam names, institution names, and policy terms are exact (no paraphrasing from memory)
**PITFALL**: Creating a draft before verifying facts means the reviewer (user) will catch errors you should have caught. The user expects the draft to be accurate — they are reviewing for editorial quality, not fact-checking from scratch. If the user has to ask "where did this date come from?", you failed step 0.
### 1. Create draft
```python
data = {
"channel_id": "226", # from gdcjgk-channels.md
"title": "...",
"content": "
...
",
"image": "https://gdcjgk.net/uploads/xxx.jpg", # random from image_library.json
"status": "draft", # DRAFT — not publicly visible
"diyname": "slug-name"
}
urllib.request.urlopen(urllib.request.Request(
"https://gdcjgk.net/addons/cms/api/index",
data=urllib.parse.urlencode(data).encode()
))
```
### 2. Verify draft (should return 404)
```bash
curl -s -o /dev/null -w "%{http_code}" "https://gdcjgk.net/channel-slug/ARTICLE_ID.html"
# Expected: 404 (draft = not public)
```
### 3. Send WeCom review notification
```bash
curl -s "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=***" \
-H "Content-Type: application/json" \
-d '{"msgtype":"markdown","markdown":{"content":"## 🔔 新文章待审核\n...\n📝 [后台编辑](https://gdcjgk.net/rCIwxpQnNh.php/cms/archives/edit/ids/ID)"}}'
```
### 4. Reviewer changes status from draft → normal in backend
### Testing
```bash
curl -X POST "https://SITE/addons/cms/api/index" \
-d "channel_id=227&title=测试&content=
测试
&status=draft"
```
## Multi-Domain FastAdmin
A single FastAdmin installation can serve multiple domains (e.g. `gdcjgk.net` and `gaozhigaokao.net` pointing to the same backend). Admin sessions may be shared across domains if they share the same PHP session storage, but **credentials can differ per domain** — user `gdcjgk` may exist on one domain but not the other. Always confirm which domain the user is logged into before requesting cookies.
**RELIABLE ADMIN ENTRY: `gaozhigaokao.net`.** The `gdcjgk.net` domain is behind Cloudflare with aggressive WAF that blocks datacenter IPs (returns Cloudflare 403, error code 1010), making server-side API calls impossible. Use `gaozhigaokao.net` for admin access and API calls when available. Note: `gaozhigaokao.net` may have API key protection enabled (`"请先在后台配置API密钥"`) while `gdcjgk.net` has it commented out — the two domains may run slightly different code copies even though they share the database.
### Pitfall: User's browser cookie doesn't work from server
Even with the correct `PHPSESSID` from the user's browser, curl requests from the server will be rejected ("请登录后操作"). PHP sessions can be bound to the client's IP, User-Agent, or other server-side validation. **Do not spend time debugging cookie transfer** — if the API is unreachable from the server, fall back to providing the formatted HTML at a public URL and instructing the user to paste it into the backend editor manually via `F12` → Console → `document.cookie` → copy → paste HTML.
### Pitfall: gdcjgk.net API blocked from datacenter
When `gdcjgk.net` is protected by Cloudflare, the server cannot reach `/addons/cms/api/index` (returns Cloudflare 403). Fallback options in order:
1. Try `gaozhigaokao.net/addons/cms/api/index` if it shares the same database
2. If that requires API key, provide HTML at `https://rss.gdcjgk.net/static/
.html` for manual paste\n\n## Admin Panel Login (editing existing articles)
The built-in API only **creates** articles — it cannot update or read existing ones. Editing requires admin panel access. However, if `xss_clean()` was removed from the codebase (as in Api.php), the admin login may also be broken.
### Pitfall: AdminLog.php xss_clean breaks login
If `xss_clean()` was stripped from the CMS but `AdminLog.php` still calls it, the admin login flow crashes at step 5 below, returning HTTP 500 even with correct credentials:
1. CSRF token check → OK
2. Captcha validation → OK
3. Username/password check → OK
4. Session initialization → partial
5. **AdminLog hook records login** → **FATAL: `Call to undefined function xss_clean()`**
6. Response → HTTP 500, session NOT committed
**How to tell**: if login returns 500 with `xss_clean` in the error body, the credentials WERE correct but the hook crashed. The PHP session cookies (`PHPSESSID`, `server_name_session`) are set but contain NO admin authentication — you cannot access the dashboard with them.
**Server-side fix** — In `/www/wwwroot//application/admin/model/AdminLog.php` line 83, replace:
```php
'url' => substr(xss_clean(strip_tags(request()->url())), 0, 1500),
```
with:
```php
'url' => substr(strip_tags(request()->url()), 0, 1500),
```
**Workaround** — If the user has an active admin session in their browser, ask for their `PHPSESSID` and `server_name_session` cookies. The most reliable way to get both at once is via the browser Console (`F12` → Console → `document.cookie`), which returns all cookies as a single semicolon-separated string. The Application tab sometimes hides or filters cookies; `document.cookie` is foolproof.
Use the cookies to authenticate curl requests to the admin panel:
```bash
curl -s -b "PHPSESSID=xxx; server_name_session=yyy" \
"https://SITE/rCIwxpQnNh.php/cms/archives/edit/ids/3809"
```
**Captcha reading** — FastAdmin login requires a 4-character captcha. Read it with Qwen-VL via the `bl` CLI:
```bash
curl -s -c /tmp/cookies.txt 'https://SITE/rCIwxpQnNh.php/index/login' > /tmp/login.html
TOKEN=$(grep -oP 'name="__token__" value="\K[^"]+' /tmp/login.html)
curl -s -b /tmp/cookies.txt 'https://SITE/index.php?s=/captcha' -o /tmp/captcha.png
CAPTCHA=$(bl vision analyze --image /tmp/captcha.png \
--prompt "Read ONLY the 4-character captcha code. Output exactly 4 chars, preserve case." \
2>&1 | python3 -c "import sys,json; print(json.load(sys.stdin)['choices'][0]['message']['content'].strip())")
```
### Image hosting for article insertion
When the admin panel is unreachable but images need to be inserted into articles:
**PRIMARY PATH — Use `rss.gdcjgk.net/static/`** (Cloudflare-tunneled, reliably accessible):
```bash
# Copy image to we-mp-rss static directory
cp /path/to/image.png /home/ubuntu/project/we-mp-rss-main/static/image_name.png
```
Provide the user with the `![]()
` tag:
```html
```
**ALWAYS verify the URL before telling the user:**
```bash
curl -s -o /dev/null -w "HTTP %{http_code}\n" https://rss.gdcjgk.net/static/image_name.png
# Must return 200
```
**FALLBACK — `files.gdcjgk.net` (port 8088 HTTP server)** — Only use as backup; often blocked by Cloudflare:
```bash
cp /path/to/image.png ~/.hermes/image_name.png
# URL: https://files.gdcjgk.net/image_name.png
```
**PITFALL: `files.gdcjgk.net` 403 from Cloudflare** — This domain consistently returns Cloudflare edge 403 (`server: cloudflare`, `cf-ray` header) while `rss.gdcjgk.net` works through the same tunnel. Root cause is Cloudflare DNS proxy/WAF configuration, not the tunnel. Do NOT spend time debugging the tunnel — use the `rss.gdcjgk.net/static/` workaround immediately.
**PITFALL: HTTP server on 8088 hangs silently** — Python's `http.server` on port 8088 can enter a state where the process is alive (`ps aux` shows it) but all requests return "Empty reply from server" (curl exit code 52). Fix: kill the hung process and restart:
```bash
# Find and kill hung server
ps aux | grep 'http.server 8088' | grep -v grep | awk '{print $2}' | xargs kill
# Start fresh (use background=true in Hermes terminal)
cd ~/.hermes && python3 -m http.server 8088 --bind 0.0.0.0
```
See `references/image-hosting-workaround.md` for full troubleshooting flow including Cloudflare tunnel restart and 403 diagnosis.
See `references/admin-login-debugging.md` for a full session transcript including API exploration, cookie investigation, and the full PHP error trace from the xss_clean crash.
The user has provided the following instruction alongside the skill invocation: [IMPORTANT: You are running as a scheduled cron job. DELIVERY: Your final response will be automatically delivered to the user — do NOT use send_message or try to deliver the output yourself. Just produce your report/output as your final response and the system handles the rest. SILENT: If there is genuinely nothing new to report, respond with exactly "[SILENT]" (nothing else) to suppress delivery. Never combine [SILENT] with content — either report your findings normally, or say [SILENT] and nothing more.]
你是广东春季高考信息网(gdcjgk.net)的内容编辑。基于 we-mp-rss 数据库最新文章，自动完成每日文章发布。
## 执行步骤
### 1. 提取选题
复制数据库: cp ~/project/we-mp-rss-data/db.db /tmp/db.db
查询最近36小时文章:
sqlite3 /tmp/db.db "SELECT a.id, a.title, a.url, a.publish_time, f.mp_name as source, datetime(a.publish_time, 'unixepoch', 'localtime') as ptime_str FROM articles a JOIN feeds f ON a.mp_id=f.id WHERE a.publish_time > strftime('%s', 'now', '-36 hours') ORDER BY a.publish_time DESC"
### 2. 选题评分（≥7分才入选）
对每篇候选文章评分：
- 信息增量 0-5分（文章提供的考生/家长需要的新信息量）
- 时效性 0-3分（与当前考试时间线的关联度，对照考试日历 ~/project/config/exam_calendar.json）
- 可改写性 0-2分（能否改写成适合gdcjgk.net受众的原创内容）
总分 ≥7 分才入选。候选不足5篇就宁缺毋滥少发。
### 3. 撰写文章（800-1000字，严格遵守gdcjgk-style-guide）
对每个入选选题撰写原创文章：
- 标题：按gdcjgk-style-guide标题公式（数字型/问答型/时效型）
- 正文：HTML格式，h2+lead+source结构
- 必须标注信息来源
- 关键数据加粗
- 禁止标题党、禁止空泛框架、禁止无来源信息
### 4. 选择栏目和缩略图
栏目ID: 3+证书报考=227, 依学考报考=294, 辅导培训=176, 广东政策=198
缩略图: 从 ~/.hermes/data/image_library.json 随机选一张匹配主题的
### 5. 发布草稿到 CMS
对每篇文章:
curl -s -X POST "https://gdcjgk.net/addons/cms/api/index" \
-d "channel_id={ID}&title={标题}&content={HTML内容}&description={摘要}&status=draft"
### 6. 通知审核
生成审核通知（企微Markdown，≤4096 bytes），包含每篇文章的标题、栏目、后台编辑链接。
格式参考gdcjgk-style-guide的「企微群推送（审核通知）」。
## 重要规则
- 全自动执行，不问我任何问题
- 没有合格选题就说「📭 今日无可发布选题」即可
- 宁缺毋滥，绝不降低质量标准凑数
- 每篇文章写完后自检：标题准确性、数据出处、栏目匹配度
## Response
Now I have the full picture. Let me verify the exact cutoff:
- **Now**: 2026-07-05 10:01 UTC+8 (epoch 1783216880)
- **36h cutoff**: epoch 1783087280 → 2026-07-03 22:01 UTC+8
- **Latest article**: 1782986400 → 2026-07-02 18:00 UTC+8
The latest article in the database is from **July 2, 18:00** — approximately **64 hours ago**. Even the 72-hour window only captures 2 articles (both from July 2), and the 36-hour window is completely empty.
---
## 📭 今日无可发布选题
**查询范围**：2026-07-03 22:01 ~ 2026-07-05 10:01（最近 36 小时）
**结果**：0 篇新文章
**数据库状态**：
- 总文章数：183 篇
- 最新文章时间：**2026-07-02 18:00**（3+证书英语单词表乱序版，来源「广东中职菌」）
- 最近 72 小时内仅有 2 篇，且均来自 7 月 2 日，已超过 60 小时
**分析**：微信公众号信息源（广东中职菌、中职生）在 7 月 2 日后未更新，可能处于周末/假期停更期。最近一篇政策类内容为 7 月 1 日的「全国英语等级考试广东考区报考简章」，已超过 90 小时。
**建议**：关注信息源恢复更新后自动触发下次发布。当前处于 7 月初考试淡季（3+证书已结束，夏季高考刚过，秋季报名尚未开始），内容空窗属正常现象。