Blogger Publishing
Publish program showcases / articles to a Google Blogger blog via the Blogger v3 API. Covers OAuth setup, discovering the blog ID, writing Blogger-safe HTML, and auto-publishing.
When to use
- User wants to share a program/project on their Google blog
- User wants an article, review, or analysis post written for the blog (model reviews, tech news, comparisons)
- "자동발행" (auto-publish) or "블로그에 올려줘" / "블로그글로 써" requests
- Writing styled HTML that must survive Blogger's sanitizer
OAuth setup (one-time)
Requires the google-workspace skill's setup.py for client-secret storage, but Blogger needs its OWN scope. Two paths:
Path A — manual code copy (FRAGILE, avoid)
setup.py --auth-url prints an auth URL; user authorizes, gets redirected to localhost:1 (ERR_UNSAFE_PORT — normal), copies code= from the address bar, pastes back via setup.py --auth-code.
PITFALL: auth codes expire in ~minutes. Users routinely take too long copying from a screenshot → invalid_grant on token exchange. If it fails twice, switch to Path B immediately.
Path B — local HTTP server auto-capture (PREFERRED)
Run a script that starts a local HTTP server on a real port (e.g. 8765), opens the browser with redirect_uri=http://localhost:8765, captures the code automatically on callback, and exchanges it. No copy-paste, no expiry race. See scripts/google-auth-auto.py.
Both paths need:
- Google Cloud project + Blogger API enabled
- OAuth client (type Desktop app) → client_id + client_secret
- Test users must include the user's Google account while app is in "Testing" (https://console.cloud.google.com/auth/audience) — otherwise "Access blocked: app has not completed verification" / not-a-test-user errors.
Discover the blog ID
GET https://www.googleapis.com/blogger/v3/users/self/blogs
Authorization: Bearer <access_token>
Returns items[].id and items[].url. Don't guess the blog ID from the URL — query it.
Publish a post
POST https://www.googleapis.com/blogger/v3/blogs/{blog_id}/posts/
Authorization: Bearer <token>
Content-Type: application/json
{"title": "...", "content": "<html>", "labels": [...], "status": "LIVE"}
Response url is the live post link. status: "LIVE" publishes immediately; "DRAFT" stages it.
- Match the blog's existing label taxonomy (hit 2026-08-07): before publishing a follow-up/related post, fetch an existing post on the same topic via
GET /blogs/{id}/posts/bypath?path=/YYYY/MM/<slug>.html and reuse its labels array instead of inventing new ones (e.g. the URXR vs Quest 3 comparison reused the URXR intro post's ['킥스타터','하드웨어','XR']). Keeps category feeds consistent.
Blogger-safe HTML (CRITICAL)
Blogger's sanitizer strips <script> tags entirely. So:
- NO JavaScript. No interactive widgets.
- Use inline
style="" attributes + a top <style> block for CSS animations (keyframes survive). Inline styles are the most reliable.
- CSS animations (marquee tickers, hover transforms) DO work — keep them.
- Web fonts via
@import url(...) in a <style> block work.
- Tables need explicit
border-collapse + inline cell borders to render cleanly.
- Wrap everything in one root
<div> with a namespaced class (e.g. .jb-root) to avoid bleeding into the blog theme.
Self-contained card rule (CRITICAL)
Blog post content must ALWAYS have its own background on the root wrapper div — never rely on the blog theme's background. The blog may be white, dark, or switched later; the post must look correct regardless.
- Review-mode page background (user request 2026-08): add
html,body{background:#444444} to the post's <style> block (create one if the post is all-inline-styles). Locally opening the .html in a browser then shows a dark page (white text readable) instead of the browser's white default. On the live blog this is a NO-OP as long as the color matches the template's body background (this blog: body{background-color:#444444}) — check the template first; if the blog were light-themed, use a light page bg instead. This keeps the saved file reviewable while leaving the published page untouched.
- Dark-themed posts (암실, 네이버 필터): root div gets
background:#151209 (or matching dark) + padding + border + box-shadow.
- Light-themed posts (제본소 paper): root div gets
background:#F4EFE2 + border + box-shadow — appears as a paper card on any background.
- ALL inner text colors must contrast against the post's OWN background, not the blog's.
- User preference: blog overall should be dark-themed. Posts are self-contained cards floating on it.
Writing tone (CRITICAL — user correction 2026-08)
DEFAULT LANGUAGE IS NOW ENGLISH (user decision 2026-08-05): write blog posts in English by default. Same rules below apply — the conversational first-person blogger voice, just in English (the 4 converted AI/tech posts are the reference for the tone). Only write Korean when the user explicitly asks for a Korean post.
User explicitly said "너무 ai가 블로그만든거같지않게해줘". Posts must NOT read like AI output:
- Write like a tech blogger talking to readers. First-person, conversational, informal endings. Korean: ~해요, ~거든요, "실화?", "이게 무슨 소리냐면". English: "I actually stopped mid-changelog", "wait, for real?", casual closers like "I'll post again when third-party verification lands."
- Open with a personal reaction or hook ("changelog 읽다가 잠깐 멈췄습니다"), NOT a summary card.
- NO "3줄 요약" cards, NO emoji ticker banners, NO "한줄 평" sections — these scream AI-generated.
- Structure: narrative flow with embedded data. Tables/charts SUPPORT the story, not replace it.
- Honest caveats in plain language ("걸러 들어야 함", "아직 이릅니다") instead of bullet-pointed "주의사항" grids.
- End casually ("검증 나오면 다시 포스팅할게요"), not with a formal conclusion block.
Kickstarter / hardware product posts (user workflow 2026-08)
- Research: Kickstarter pages +
.json endpoint return 403 (blocked) — use web_search (EN+KO) + article coverage (Make:, TechTimes, Road to VR, All3DP, 3D Printing Industry, Tom's Hardware) + the vendor's official site. Never freeze live funding totals — link the campaign and say "changes hourly."
- Images: user wants MULTIPLE product-appearance photos AND sample-output photos (what the product produces — e.g. a full-color 3D print for a printer post). Full sourcing/verification recipe, post structure, and pricing-tier chart pattern:
references/kickstarter-product-posts.md.
- Review-first mode: when the user says "발행은 하지말고 만들어봐 검수부터하자" (or similar), save the local file, run the structural sanity check (tag balance, no
<script>, image URLs 200 + sane dims), open_preview the local file, mark header + footer "DRAFT — not yet published", and STOP. Publish only after explicit approval.
Comparison posts (A vs B) — balance rules (user request 2026-08-07)
When the user asks for a comparison post between two products ("비교글", "누가 이겨", "비교좀"), they explicitly want it balanced — never a one-sided hit piece ("너무 한쪽으로 치우치지않게"). Full structure, chart recipes, and sourcing: references/comparison-posts.md. Core rules:
- Both sides get real, specific wins with numbers. Include the counter-data that weakens your favorite (e.g. "URXR One is only ~11% more pixels than Quest 3 — the PPD gap comes from narrower FOV, a text-vs-immersion tradeoff").
- Flag vendor-estimated specs (~36 PPD est.) vs published ones (25 PPD) — in text AND chart captions.
- If the products don't actually compete (glasses vs headset = monitor vs console), say so explicitly — it's the fairest and most interesting framing.
- End with scenario-based decisions (games → A, work monitor → B, casual → split), not a single winner.
- Pre-flight: check NAS task folders + session_search for an existing post about either product — reuse already-hosted images (raw.githubusercontent URLs), avoid duplicate work, cross-link the earlier post.
App / software review posts (user workflow 2026-08-08)
First app-review post: Open Minis (iOS agent app). Reusable recipe — worked example in references/app-review-posts.md:
- Research: official site + App Store page (web_extract) + GitHub README + 1-2 in-depth press reviews + community takes. Cross-check everything against two or more sources.
- Capability-claim reality check (CRITICAL): verify marketing claims against platform limits before repeating them. "It controls your iPhone like OpenClaw" → iOS sandboxing forbids third-party cross-app UI automation; only the Android build (accessibility service + Shizuku) does full UI automation. Present what the product CAN vs CANNOT do as separate lists — this honesty is what makes the post credible, and it's usually the most interesting section.
- Screenshots from press CDNs: review pages (MacStories etc.) 403 non-browser UAs, but their image CDNs (cdn.macstories.net/...) serve fine with a browser UA. The
web_extract output already contains the CDN image URLs — mine the cached/truncated extraction content instead of re-fetching the page. Credit every shot: "(screenshot: )".
- Downscale before upload: press screenshots come at 2760-4170px; resize to ≤1100px wide (PIL LANCZOS) before uploading to blog-assets or the page loads slowly.
- Charts: for BYOK/free apps, a cost-per-test chart (Artificial Analysis data) is a strong economics angle; a matplotlib boxes+arrows flow diagram works for "what the agent can reach" explainers. Both dark-themed per the chart recipe.
- Structure: personal hook → what it is → how it works → reality check → power features → economics → what people say (attributed quotes) → numbered honest caveats → restrained verdict ("I'll post a follow-up after a month of real use").
- Labels: match the blog taxonomy (Open Minis post:
AI, iOS, 에이전트, 오픈소스). EN publish + KO archive with base64-embedded images per convention.
Images in posts (user preference — always include 3–4)
Posts should include 3–4 images. Never a wall-of-text post.
- Charts: matplotlib with dark theme (facecolor='#0d1117', text '#c9d1d9', accents '#58a6ff'/'#7ee787'/'#f0883e'). Korean font: Malgun Gothic (auto-detected on this Windows machine via
fm.findSystemFonts() → 'malgun').
- PITFALL (hit 2026-08):
bbox_inches="tight" in savefig can corrupt multi-panel figures — on one two-panel chart (log-scale axis + annotations) it produced a 1226×24935px canvas: the visible chart occupied the top sliver and the rest was blank, making the blog post scroll ~16,000px with an empty image block. Use fig.tight_layout() + plain fig.savefig(path, dpi=150, facecolor="#0d1117") instead, and ALWAYS verify the PNG dimensions (parse IHDR at bytes 16:24) before uploading — sanity assert w<2000 and h<2000. Also note raw.githubusercontent.com CDN can take 30–90s to serve an overwritten file; poll the raw URL until dimensions match.
- Windows/git-bash (hit 2026-08): the venv Python (
venv/Scripts/python.exe) is a native Windows binary — MSYS paths (/g/...) fail with "can't open file 'C:\g...'"; always pass native G:\... paths. And curl -o to Korean-character G:\ paths exits 23 — download images with Python urllib.request instead.
- Wikimedia Commons sourcing (hit 2026-08): direct
upload.wikimedia.org/.../thumb/.../NNNpx- URLs can 400 per-file ("Use thumbnail sizes listed") and 429 on rapid retries. Working pattern: https://commons.wikimedia.org/wiki/Special:FilePath/<Filename>?width=800 (redirects to a valid thumb); credit "(photo: Wikipedia Commons, CC BY-SA)" in the caption.
- Hosting: GitHub repo
wcpaka-lgtm/blog-assets (public). Upload via REST API (base64 PUT to /contents/images/<name>, branch main). Reference: https://raw.githubusercontent.com/wcpaka-lgtm/blog-assets/main/images/<name>.
- GitHub token location: there is NO env var and no
~/.git-credentials on this box. The wcpaka-lgtm PAT is embedded in the remote URL of ~/hermes-sync — extract it inside execute_code via Python subprocess: git remote get-url origin in that repo, then parse the userinfo part of https://<token>@github.com/.... The remote is token-ONLY form (https://ghp_XXX@github.com/..., no username:token colon) — parse with userinfo = url.split("://")[1].split("@")[0] then pat = userinfo.split(":",1)[1] if ":" in userinfo else userinfo. PITFALL (hit 2026-08): a ":" in userinfo check WITHOUT the else-fallthrough returns None for the token-only form and all GitHub calls 401 — always fall through to the whole userinfo as the token. IMPORTANT: the terminal tool MASKS secrets in its output (prints https://***@github.com), so extraction must happen in Python, not via terminal+grep. To overwrite an existing file via PUT you must pass its current sha (GET the path first). After upload, verify each raw.githubusercontent URL returns 200 before referencing it in the post. CDN propagation pitfall (2026-08): raw.githubusercontent.com lags a few seconds behind the API PUT — a 404 on the raw URL right after a 201 PUT is expected, NOT a failure. Verify via API first (GET /repos/{owner}/{repo}/contents/{path}?ref=main → 200 = uploaded), then retry the raw URL after a ~3s sleep.
- Captions: small centered caption under each image (font-size:12px, color:#484f58).
- Mix: self-made charts (matplotlib) + official/source images (curl download from vendor sites, credited).
- Product showcase posts (user preference 2026-08): MORE appearance images. For product-introduction posts (devices, hardware, crowdfunded gadgets) the user wants a real look-gallery, not one hero + charts. Include 3-4 appearance shots — front view, exploded/internal view, worn/in-use, lifestyle — on top of any charts (6-7 total images is fine for product posts; the 3-4 guideline is the floor for text posts, not a ceiling). Add them as a "What it actually looks like" section right after the hero, each with a credit caption.
- Sourcing product images: fetch the official site homepage + blog + press articles, extract
<img src>, og:image, and url(...) candidates with regex, filter out logos/icons/favicons/social badges, then download and verify dimensions (same PNG/JPG IHDR sanity check as charts). Official site asset folders (e.g. unseen-reality.com/images/...) give the cleanest product renders; tech-press articles add exploded views and use-case shots. Credit every source in the caption (e.g. "(source: Unseen Reality)").
Writing tone for AI/tech articles (USER PREFERENCE)
Write these in English by default (2026-08-05 onward). AI 모델·기술 블로그 글은 블로거가 혼자 흥분해서 쓰는 구어체로. AI가 만든 글처럼 보이면 안 됨. (For English: keep the same excited first-person blogger voice — "I actually stopped mid-changelog", honest caveats, restrained endings.)
- 격식체 나열 금지. "이게 무슨 소리냐면", "실화?", "잠깐 멈췄습니다" 같은 구어체.
- "3줄 요약" 카드, 이모지 티커 배너 금지.
- 서술 위주 + 표/차트 보조. 표만 나열하지 말 것.
- 이미지 3~4장 필수: matplotlib 차트(다크배경 #0d1117) + 원본 소스 이미지 혼합.
- 솔직한 caveat ("걸러 들어야 함", "방향성으로만"). 과장 없이.
- 개인 의견 인라인 ("개인적으로 눈에 들어온 건").
- 결론은 "아직 이릅니다" 식의 절제된 톤.
Design approach for this user
User wants posts "이쁘게 꾸며서" (prettily styled), not plain. Match the program's own aesthetic (e.g. 제본소 = retro 인쇄소: paper texture, crop marks, stamp badges, Black Han Sans + IBM Plex Sans KR + IBM Plex Mono). Structure: ticker banner → signboard header → feature cards → spec table → design note → CTA footer.
- Program showcases (제본소, 암실, 필터): match the program's aesthetic. 제본소 = retro 인쇄소 (paper texture, crop marks, stamp badges, Black Han Sans + IBM Plex Sans KR + IBM Plex Mono). Structure: signboard header → feature cards → spec table → design note → CTA footer.
- Article/review posts (model analysis, news): narrative blog tone (see Writing tone above). Dark card layout, inline data blocks, chart images. No rigid card-grid structure.
Interactive tools: GitHub Pages hosting pattern
Blogger strips <script>, so interactive HTML tools (제본소, filters, etc.) can't run inline. Pattern:
- Create a GitHub repo (e.g.
wcpaka-lgtm/txt2epub), push the index.html.
- Enable GitHub Pages (Settings → Pages → Deploy from branch → main).
- In the blog post, add a top section with:
- An
<iframe> embedding the Pages URL (works in Blogger, gives live demo in-post)
- Buttons: "🔗 새 탭에서 열기" / "💾 HTML 파일 다운로드" / "📦 GitHub 소스"
- When the tool is updated, push to the repo — Pages auto-deploys, blog post needs no change.
All three steps can be done via GitHub REST API in one execute_code (no git CLI needed):
gh("POST", "/user/repos", {"name": "<repo>", "private": False, "auto_init": False})
gh("PUT", f"/repos/{owner}/{repo}/contents/index.html",
{"message": "feat: ...", "content": base64.b64encode(html_bytes).decode(), "branch": "main"})
gh("POST", f"/repos/{owner}/{repo}/pages", {"source": {"branch": "main", "path": "/"}})
Pages URL: https://<owner>.github.io/<repo>/ (deploy takes ~1 min; verify with a GET).
Comment policy (USER PREFERENCE — always apply)
User wants all blog comments disabled. Blogger API does NOT support per-post comment control. Set it once globally:
- Blogger dashboard → Settings → Comments → "누가 댓글을 달 수 있나요?" → "없음" → Save.
- This applies to all existing and future posts. Remind the user to do this once if not already done.
Token refresh (access tokens expire ~1 hour)
If any Blogger API call returns 401 Unauthorized, the access token expired. Refresh inline before retrying — do NOT re-run the full OAuth flow. File paths on this box (2026-08 verified): token at %LOCALAPPDATA%/hermes/google_token.json; client secret at %LOCALAPPDATA%/hermes/google_client_secret.json — note the google_ prefix, the filename is NOT client_secret.json (that guess 404s). Set TOKEN_PATH/SECRET_PATH to these and do refresh + publish in ONE execute_code call so a stale token never breaks the publish mid-way:
import json, urllib.request, urllib.parse
tok = json.load(open(TOKEN_PATH))
cs = json.load(open(SECRET_PATH)); cs = cs.get("installed", cs.get("web", cs))
data = urllib.parse.urlencode({
"client_id": cs["client_id"], "client_secret": cs["client_secret"],
"refresh_token": tok["refresh_token"], "grant_type": "refresh_token"}).encode()
resp = urllib.request.urlopen(urllib.request.Request(
"https://oauth2.googleapis.com/token", data=data, method="POST"))
new = json.loads(resp.read())
tok["access_token"] = new["access_token"]
if "refresh_token" in new: tok["refresh_token"] = new["refresh_token"]
json.dump(tok, open(TOKEN_PATH, "w"), indent=2)
Best practice: do refresh + publish in ONE execute_code call so a stale token never breaks the publish mid-way.
PITFALL — the refresh token ITSELF expires (hit 2026-08-07): Google OAuth apps still in Testing status issue refresh tokens that die after ~7 days. Symptom: the refresh call to oauth2.googleapis.com/token returns HTTP 400 invalid_grant — "Token has been expired or revoked" (NOT a 401; inline refresh just repeats the 400). Fix: re-run scripts/google-auth-auto.py (Path B — opens browser, user clicks Allow, code auto-captured on localhost:8765, prints "토큰 저장 완료"), then re-run the refresh+publish flow. Expect this roughly weekly until the Google Cloud project leaves Testing — if a publish fails with invalid_grant, go straight to re-auth, don't debug the client.
Labels = categories ("게시판" requests)
Blogger has NO boards/categories — labels are the equivalent. When the user asks for a "게시판" or category organization:
- Add a shared umbrella label to every program post (this blog uses
오픈소스 프로그램) via the labels array on POST/PUT.
- Label feed URL:
https://<blog>.blogspot.com/search/label/<URL-encoded label> (spaces → %20).
- Update labels on existing posts: GET the post, set
data["labels"], PUT back to /blogs/{id}/posts/{postId}.
- For a visible sidebar menu: Blogger dashboard → 레이아웃 → 가젯 추가 → "라벨".
Convention on this blog: umbrella label
오픈소스 프로그램 on all program posts + 2-4 specific labels (e.g. 브라우저 도구, 유저스크립트, 이미지).
Translating existing posts to another language
When the user asks to convert existing posts to English or another language ("ai,테크 글 4개 영문으로 바꿔줘"):
- Identify the set: list all posts (
GET /blogs/{id}/posts?fetchBodies=false), pick by labels/content class, and confirm the count matches the user's number (their blog: AI/tech news posts carry AI/LLM/모델 리뷰-style labels; program showcases are a separate class).
- Backup first: for each post,
GET .../posts/{postId}?fetchBodies=true and save the raw JSON + HTML under G:\...\Hermes\<task-subfolder>\<name>_original.{json,html}. Translation is destructive — never start without a rollback path.
- Inventory images: split into (a) self-made matplotlib charts — almost certainly labeled in the source language, MUST be regenerated — and (b) official vendor images (Qwen/DeepSeek official blog charts are usually already English) — keep as-is. Rule of thumb: if it was rendered with matplotlib + Malgun Gothic for a Korean post, it has Korean text.
- Regenerate charts: the original chart scripts are usually NOT saved on disk (search the NAS Hermes folder first, expect nothing). Extract the data from the post's own visible text/tables and rebuild faithfully in the target language (same dark theme facecolor #0d1117, text #c9d1d9, accents #58a6ff/#7ee787/#f0883e). Mark estimates as estimates ("author's estimate"); reconstruction-only charts get an honest caption. Upload with a language prefix (
en_<name>.png) so the originals stay intact.
- Mirror the HTML: copy the original
<style> block and inline styles verbatim; translate only the text; swap <img src> to the new chart URLs. Keep the self-contained dark card root (background:#0d1117) per the self-contained card rule.
- Localize region-specific content: a "한국 사용자 필독" license warning becomes an "EU/UK/US/South Korea excluded territories" note — same facts, reframed for the new audience.
- PUT with title + content + labels — labels are NOT preserved across PUT (see Pitfalls below). Same post ID → same URL, so existing links keep working.
- Verify: GET each post (title, labels, status LIVE) and check every raw.githubusercontent.com image URL returns 200 (CDN lags a few seconds after upload — verify via the GitHub API first, then retry the raw URL).
- Tone carries over: translate the conversational blogger voice, don't flatten it into neutral prose — the user's style rules (구어체, honest caveats, no AI-flavored structure, casual endings) apply in English too. Keep emoji/section styling the same.
Quality loop (재귀개선)
When the user asks for recursive improvement of a published post ("재귀개선 한번돌려" / "재귀개선 시작해"), run the 3-reviewer fact/tone/HTML round documented in references/recursive-review-loop.md — parallel subagent reviewers, cross-validation against primary sources, apply, then playtest-verify the live post.
SEO / exposure (Blogger + Google Search Console)
When the user asks about blog traffic/exposure ("노출량 늘리기", "구글 검색"), diagnose FIRST, then set up GSC. Order of operations from a real setup (2026-08, opensourcefactory1 blog):
- Diagnose:
site:<blog> web search (indexing state), curl the homepage and grep for google-site-verification (GSC done?), gtag/G-XXXX (analytics?), og:description, twitter:card; check /<blog>/sitemap.xml and /feeds/posts/default?alt=rss return 200 (Blogger generates both automatically — 200 means the plumbing is fine).
- GSC is the #1 lever for a young blog (few posts, homepage barely indexed): verification → sitemap submit → URL inspection + indexing request per post. Individual posts typically aren't indexed until requested.
- Verification method for a blogspot subdomain: HTML tag ONLY (no DNS, no file upload). The tag goes in the theme
<head>.
- Blogger API v3 has NO template endpoint — theme edits cannot be automated; they are a user copy-paste job (Blogger 대시보드 → 테마 → ▾ → HTML 수정 → before
</head>). Package the whole injection (GSC tag placeholder + twitter:card) as one snippet file for the user.
- The
google_token.json OAuth scope is blogger-only (no webmasters scope) → no GSC API automation without re-consent. Don't promise API automation; guide the UI path (sitemap submit + URL inspection are 2 clicks each, 7 posts ≈ 2 min).
- Stale homepage snippet (old Korean description showing in search) = the blog description setting (Blogger 설정 → 기본 설정 → 설명), not a meta tag — changing it + re-requesting indexing on the homepage fixes the snippet in 1–3 days. English default per the language policy.
- Deliverables go in
G:\...\Hermes\<task-subfolder>\ per the work-products convention: snippet.html + guide (.md AND .txt) + post-urls.txt.
Full diagnostic command set, 3-step guide text, and the injection snippet: references/blogger-seo-exposure.md.
Pitfalls
- Don't freeze volatile live numbers in news posts (hit 2026-08): crowdfunding campaign totals (Kickstarter and similar) change hourly and the site may block direct scraping (403 on both the page and the .json endpoint). Never put a captured funding amount in a post that will age — link the campaign page and write "changes hourly — check the campaign" instead. Lock in only stable facts: tiers, prices, ship window, specs.
- PUT drops labels (hit 2026-08): updating a post via PUT with only
title + content silently clears its labels (GET after → labels: None), wiping the blog's category taxonomy. Always fetch the post first (or keep the original labels) and include the labels array in the PUT body. Hit live while translating 4 posts to English; had to re-PUT all of them with labels restored.
- read_file may flag Blogger-saved HTML as binary: post content saved straight from the API can carry
\r\r\n line endings (and/or a BOM), and read_file refuses it as binary. Read/decode via execute_code (open(path,'rb').read().decode('utf-8-sig')) instead.
--auth-url default scope set does NOT include blogger; the auto-capture script requests auth/blogger scope explicitly.- Token at
%LOCALAPPDATA%/hermes/google_token.json. If scope is wrong, re-run auth with blogger scope.
- 404 on
blogs/byurl?url=... usually means wrong/guessed URL — use users/self/blogs instead.
- Keep posts as a saved file so they're reusable/editable. Per user convention, all work products go under
G:\내 드라이브\NAS폴더\NASfolder\Hermes\<task-subfolder>\ (one subfolder per post, e.g. Hermes\qwen38-max-blog\ holding the HTML + images/) — never leave files in the home folder.
- PIL in-process stat lies right after save (hit 2026-08-08):
f.stat().st_size//1024 printed 0KB immediately after im.save(f) (file handle still open / size not flushed), while the file was actually 62-192KB. Verify final image sizes with a fresh ls in terminal before trusting them.
- Blogger
posts/bypath response has NO status field (hit 2026-08-08): keys are author/blog/content/etag/id/kind/labels/published/replies/selfLink/title/updated/url. Verify a publish by fetching the post by ID (GET /blogs/{id}/posts/{postId}) or by checking published + url presence — don't KeyError on p["status"].
- Press review pages block bots, their CDNs don't (hit 2026-08-08): MacStories returns 403 to non-browser UAs on the article page, but
cdn.macstories.net image URLs download fine with a browser UA. When web_extract succeeds on a page but direct urllib fetch 403s, the image URLs are already in the web_extract output — don't re-fetch the page, mine the extraction content (including the saved cache file).
1---2name: blogger-publishing3description: Publish styled HTML posts to Google Blogger via API.4---56# Blogger Publishing78Publish program showcases / articles to a Google Blogger blog via the Blogger v3 API. Covers OAuth setup, discovering the blog ID, writing Blogger-safe HTML, and auto-publishing.910## When to use11- User wants to share a program/project on their Google blog12- User wants an article, review, or analysis post written for the blog (model reviews, tech news, comparisons)13- "자동발행" (auto-publish) or "블로그에 올려줘" / "블로그글로 써" requests14- Writing styled HTML that must survive Blogger's sanitizer1516## OAuth setup (one-time)17Requires the `google-workspace` skill's setup.py for client-secret storage, but Blogger needs its OWN scope. Two paths:1819### Path A — manual code copy (FRAGILE, avoid)20`setup.py --auth-url` prints an auth URL; user authorizes, gets redirected to `localhost:1` (ERR_UNSAFE_PORT — normal), copies `code=` from the address bar, pastes back via `setup.py --auth-code`.21**PITFALL:** auth codes expire in ~minutes. Users routinely take too long copying from a screenshot → `invalid_grant` on token exchange. If it fails twice, switch to Path B immediately.2223### Path B — local HTTP server auto-capture (PREFERRED)24Run a script that starts a local HTTP server on a real port (e.g. 8765), opens the browser with `redirect_uri=http://localhost:8765`, captures the code automatically on callback, and exchanges it. No copy-paste, no expiry race. See `scripts/google-auth-auto.py`.2526Both paths need:271. Google Cloud project + **Blogger API enabled**282. OAuth client (type **Desktop app**) → client_id + client_secret293. **Test users** must include the user's Google account while app is in "Testing" (https://console.cloud.google.com/auth/audience) — otherwise "Access blocked: app has not completed verification" / not-a-test-user errors.3031## Discover the blog ID32```python33GET https://www.googleapis.com/blogger/v3/users/self/blogs34Authorization: Bearer <access_token>35```36Returns `items[].id` and `items[].url`. Don't guess the blog ID from the URL — query it.3738## Publish a post39```python40POST https://www.googleapis.com/blogger/v3/blogs/{blog_id}/posts/41Authorization: Bearer <token>42Content-Type: application/json43{"title": "...", "content": "<html>", "labels": [...], "status": "LIVE"}44```45Response `url` is the live post link. `status: "LIVE"` publishes immediately; `"DRAFT"` stages it.46- **Match the blog's existing label taxonomy (hit 2026-08-07)**: before publishing a follow-up/related post, fetch an existing post on the same topic via `GET /blogs/{id}/posts/bypath?path=/YYYY/MM/<slug>.html` and reuse its `labels` array instead of inventing new ones (e.g. the URXR vs Quest 3 comparison reused the URXR intro post's `['킥스타터','하드웨어','XR']`). Keeps category feeds consistent.4748## Blogger-safe HTML (CRITICAL)49Blogger's sanitizer **strips `<script>` tags entirely**. So:50- NO JavaScript. No interactive widgets.51- Use **inline `style=""` attributes** + a top `<style>` block for CSS animations (keyframes survive). Inline styles are the most reliable.52- CSS animations (marquee tickers, hover transforms) DO work — keep them.53- Web fonts via `@import url(...)` in a `<style>` block work.54- Tables need explicit `border-collapse` + inline cell borders to render cleanly.55- Wrap everything in one root `<div>` with a namespaced class (e.g. `.jb-root`) to avoid bleeding into the blog theme.5657## Self-contained card rule (CRITICAL)58Blog post content must ALWAYS have its own background on the root wrapper div — never rely on the blog theme's background. The blog may be white, dark, or switched later; the post must look correct regardless.59- **Review-mode page background (user request 2026-08):** add `html,body{background:#444444}` to the post's `<style>` block (create one if the post is all-inline-styles). Locally opening the .html in a browser then shows a dark page (white text readable) instead of the browser's white default. On the live blog this is a NO-OP as long as the color matches the template's body background (this blog: `body{background-color:#444444}`) — check the template first; if the blog were light-themed, use a light page bg instead. This keeps the saved file reviewable while leaving the published page untouched.60- Dark-themed posts (암실, 네이버 필터): root div gets `background:#151209` (or matching dark) + padding + border + box-shadow.61- Light-themed posts (제본소 paper): root div gets `background:#F4EFE2` + border + box-shadow — appears as a paper card on any background.62- ALL inner text colors must contrast against the post's OWN background, not the blog's.63- User preference: blog overall should be dark-themed. Posts are self-contained cards floating on it.6465## Writing tone (CRITICAL — user correction 2026-08)66**DEFAULT LANGUAGE IS NOW ENGLISH (user decision 2026-08-05):** write blog posts in English by default. Same rules below apply — the conversational first-person blogger voice, just in English (the 4 converted AI/tech posts are the reference for the tone). Only write Korean when the user explicitly asks for a Korean post.67User explicitly said "너무 ai가 블로그만든거같지않게해줘". Posts must NOT read like AI output:68- Write like a tech blogger talking to readers. First-person, conversational, informal endings. Korean: ~해요, ~거든요, "실화?", "이게 무슨 소리냐면". English: "I actually stopped mid-changelog", "wait, for real?", casual closers like "I'll post again when third-party verification lands."69- Open with a personal reaction or hook ("changelog 읽다가 잠깐 멈췄습니다"), NOT a summary card.70- NO "3줄 요약" cards, NO emoji ticker banners, NO "한줄 평" sections — these scream AI-generated.71- Structure: narrative flow with embedded data. Tables/charts SUPPORT the story, not replace it.72- Honest caveats in plain language ("걸러 들어야 함", "아직 이릅니다") instead of bullet-pointed "주의사항" grids.73- End casually ("검증 나오면 다시 포스팅할게요"), not with a formal conclusion block.7475## Kickstarter / hardware product posts (user workflow 2026-08)76- Research: Kickstarter pages + `.json` endpoint return 403 (blocked) — use `web_search` (EN+KO) + article coverage (Make:, TechTimes, Road to VR, All3DP, 3D Printing Industry, Tom's Hardware) + the vendor's official site. Never freeze live funding totals — link the campaign and say "changes hourly."77- Images: user wants MULTIPLE product-appearance photos AND sample-output photos (what the product produces — e.g. a full-color 3D print for a printer post). Full sourcing/verification recipe, post structure, and pricing-tier chart pattern: `references/kickstarter-product-posts.md`.78- Review-first mode: when the user says "발행은 하지말고 만들어봐 검수부터하자" (or similar), save the local file, run the structural sanity check (tag balance, no `<script>`, image URLs 200 + sane dims), `open_preview` the local file, mark header + footer "DRAFT — not yet published", and STOP. Publish only after explicit approval.7980## Comparison posts (A vs B) — balance rules (user request 2026-08-07)81When the user asks for a comparison post between two products ("비교글", "누가 이겨", "비교좀"), they explicitly want it **balanced — never a one-sided hit piece** ("너무 한쪽으로 치우치지않게"). Full structure, chart recipes, and sourcing: `references/comparison-posts.md`. Core rules:82- Both sides get real, specific wins with numbers. Include the counter-data that weakens your favorite (e.g. "URXR One is only ~11% more pixels than Quest 3 — the PPD gap comes from narrower FOV, a text-vs-immersion tradeoff").83- Flag vendor-estimated specs (~36 PPD est.) vs published ones (25 PPD) — in text AND chart captions.84- If the products don't actually compete (glasses vs headset = monitor vs console), say so explicitly — it's the fairest and most interesting framing.85- End with scenario-based decisions (games → A, work monitor → B, casual → split), not a single winner.86- Pre-flight: check NAS task folders + session_search for an existing post about either product — reuse already-hosted images (raw.githubusercontent URLs), avoid duplicate work, cross-link the earlier post.8788## App / software review posts (user workflow 2026-08-08)89First app-review post: Open Minis (iOS agent app). Reusable recipe — worked example in `references/app-review-posts.md`:901. **Research**: official site + App Store page (web_extract) + GitHub README + 1-2 in-depth press reviews + community takes. Cross-check everything against two or more sources.912. **Capability-claim reality check (CRITICAL)**: verify marketing claims against platform limits before repeating them. "It controls your iPhone like OpenClaw" → iOS sandboxing forbids third-party cross-app UI automation; only the Android build (accessibility service + Shizuku) does full UI automation. Present what the product CAN vs CANNOT do as separate lists — this honesty is what makes the post credible, and it's usually the most interesting section.923. **Screenshots from press CDNs**: review pages (MacStories etc.) 403 non-browser UAs, but their image CDNs (cdn.macstories.net/...) serve fine with a browser UA. The `web_extract` output already contains the CDN image URLs — mine the cached/truncated extraction content instead of re-fetching the page. Credit every shot: "(screenshot: <publication>)".934. **Downscale before upload**: press screenshots come at 2760-4170px; resize to ≤1100px wide (PIL LANCZOS) before uploading to blog-assets or the page loads slowly.945. **Charts**: for BYOK/free apps, a cost-per-test chart (Artificial Analysis data) is a strong economics angle; a matplotlib boxes+arrows flow diagram works for "what the agent can reach" explainers. Both dark-themed per the chart recipe.956. **Structure**: personal hook → what it is → how it works → reality check → power features → economics → what people say (attributed quotes) → numbered honest caveats → restrained verdict ("I'll post a follow-up after a month of real use").967. **Labels**: match the blog taxonomy (Open Minis post: `AI`, `iOS`, `에이전트`, `오픈소스`). EN publish + KO archive with base64-embedded images per convention.9798## Images in posts (user preference — always include 3–4)99Posts should include 3–4 images. Never a wall-of-text post.100- **Charts**: matplotlib with dark theme (facecolor='#0d1117', text '#c9d1d9', accents '#58a6ff'/'#7ee787'/'#f0883e'). Korean font: Malgun Gothic (auto-detected on this Windows machine via `fm.findSystemFonts()` → 'malgun').101- **PITFALL (hit 2026-08): `bbox_inches="tight"` in `savefig` can corrupt multi-panel figures** — on one two-panel chart (log-scale axis + annotations) it produced a 1226×24935px canvas: the visible chart occupied the top sliver and the rest was blank, making the blog post scroll ~16,000px with an empty image block. Use `fig.tight_layout()` + plain `fig.savefig(path, dpi=150, facecolor="#0d1117")` instead, and ALWAYS verify the PNG dimensions (parse IHDR at bytes 16:24) before uploading — sanity assert `w<2000 and h<2000`. Also note raw.githubusercontent.com CDN can take 30–90s to serve an overwritten file; poll the raw URL until dimensions match.102- **Windows/git-bash (hit 2026-08)**: the venv Python (`venv/Scripts/python.exe`) is a native Windows binary — MSYS paths (`/g/...`) fail with "can't open file 'C:\g\...'"; always pass native `G:\...` paths. And `curl -o` to Korean-character G:\ paths exits 23 — download images with Python `urllib.request` instead.103- **Wikimedia Commons sourcing (hit 2026-08)**: direct `upload.wikimedia.org/.../thumb/.../NNNpx-` URLs can 400 per-file ("Use thumbnail sizes listed") and 429 on rapid retries. Working pattern: `https://commons.wikimedia.org/wiki/Special:FilePath/<Filename>?width=800` (redirects to a valid thumb); credit "(photo: Wikipedia Commons, CC BY-SA)" in the caption.104- **Hosting**: GitHub repo `wcpaka-lgtm/blog-assets` (public). Upload via REST API (base64 PUT to `/contents/images/<name>`, branch main). Reference: `https://raw.githubusercontent.com/wcpaka-lgtm/blog-assets/main/images/<name>`.105- **GitHub token location**: there is NO env var and no `~/.git-credentials` on this box. The wcpaka-lgtm PAT is embedded in the remote URL of `~/hermes-sync` — extract it inside execute_code via Python subprocess: `git remote get-url origin` in that repo, then parse the userinfo part of `https://<token>@github.com/...`. **The remote is token-ONLY form** (`https://ghp_XXX@github.com/...`, no `username:token` colon) — parse with `userinfo = url.split("://")[1].split("@")[0]` then `pat = userinfo.split(":",1)[1] if ":" in userinfo else userinfo`. PITFALL (hit 2026-08): a `":" in userinfo` check WITHOUT the else-fallthrough returns None for the token-only form and all GitHub calls 401 — always fall through to the whole userinfo as the token. IMPORTANT: the terminal tool MASKS secrets in its output (prints `https://***@github.com`), so extraction must happen in Python, not via terminal+grep. To overwrite an existing file via PUT you must pass its current `sha` (GET the path first). After upload, verify each raw.githubusercontent URL returns 200 before referencing it in the post. **CDN propagation pitfall (2026-08)**: raw.githubusercontent.com lags a few seconds behind the API PUT — a 404 on the raw URL right after a 201 PUT is expected, NOT a failure. Verify via API first (`GET /repos/{owner}/{repo}/contents/{path}?ref=main` → 200 = uploaded), then retry the raw URL after a ~3s sleep.106- **Captions**: small centered caption under each image (font-size:12px, color:#484f58).107- **Mix**: self-made charts (matplotlib) + official/source images (curl download from vendor sites, credited).108- **Product showcase posts (user preference 2026-08): MORE appearance images.** For product-introduction posts (devices, hardware, crowdfunded gadgets) the user wants a real look-gallery, not one hero + charts. Include 3-4 appearance shots — front view, exploded/internal view, worn/in-use, lifestyle — on top of any charts (6-7 total images is fine for product posts; the 3-4 guideline is the floor for text posts, not a ceiling). Add them as a "What it actually looks like" section right after the hero, each with a credit caption.109- **Sourcing product images**: fetch the official site homepage + blog + press articles, extract `<img src>`, `og:image`, and `url(...)` candidates with regex, filter out logos/icons/favicons/social badges, then download and verify dimensions (same PNG/JPG IHDR sanity check as charts). Official site asset folders (e.g. unseen-reality.com/images/...) give the cleanest product renders; tech-press articles add exploded views and use-case shots. Credit every source in the caption (e.g. "(source: Unseen Reality)").110111## Writing tone for AI/tech articles (USER PREFERENCE)112**Write these in English by default (2026-08-05 onward).** AI 모델·기술 블로그 글은 **블로거가 혼자 흥분해서 쓰는 구어체**로. AI가 만든 글처럼 보이면 안 됨. (For English: keep the same excited first-person blogger voice — "I actually stopped mid-changelog", honest caveats, restrained endings.)113- 격식체 나열 금지. "이게 무슨 소리냐면", "실화?", "잠깐 멈췄습니다" 같은 구어체.114- "3줄 요약" 카드, 이모지 티커 배너 금지.115- 서술 위주 + 표/차트 보조. 표만 나열하지 말 것.116- 이미지 3~4장 필수: matplotlib 차트(다크배경 #0d1117) + 원본 소스 이미지 혼합.117- 솔직한 caveat ("걸러 들어야 함", "방향성으로만"). 과장 없이.118- 개인 의견 인라인 ("개인적으로 눈에 들어온 건").119- 결론은 "아직 이릅니다" 식의 절제된 톤.120121## Design approach for this user122User wants posts "이쁘게 꾸며서" (prettily styled), not plain. Match the program's own aesthetic (e.g. 제본소 = retro 인쇄소: paper texture, crop marks, stamp badges, Black Han Sans + IBM Plex Sans KR + IBM Plex Mono). Structure: ticker banner → signboard header → feature cards → spec table → design note → CTA footer.123- **Program showcases** (제본소, 암실, 필터): match the program's aesthetic. 제본소 = retro 인쇄소 (paper texture, crop marks, stamp badges, Black Han Sans + IBM Plex Sans KR + IBM Plex Mono). Structure: signboard header → feature cards → spec table → design note → CTA footer.124- **Article/review posts** (model analysis, news): narrative blog tone (see Writing tone above). Dark card layout, inline data blocks, chart images. No rigid card-grid structure.125126## Interactive tools: GitHub Pages hosting pattern127Blogger strips `<script>`, so interactive HTML tools (제본소, filters, etc.) can't run inline. Pattern:1281. Create a GitHub repo (e.g. `wcpaka-lgtm/txt2epub`), push the `index.html`.1292. Enable GitHub Pages (Settings → Pages → Deploy from branch → main).1303. In the blog post, add a top section with:131 - An `<iframe>` embedding the Pages URL (works in Blogger, gives live demo in-post)132 - Buttons: "🔗 새 탭에서 열기" / "💾 HTML 파일 다운로드" / "📦 GitHub 소스"1334. When the tool is updated, push to the repo — Pages auto-deploys, blog post needs no change.134135All three steps can be done via GitHub REST API in one execute_code (no git CLI needed):136```python137gh("POST", "/user/repos", {"name": "<repo>", "private": False, "auto_init": False})138gh("PUT", f"/repos/{owner}/{repo}/contents/index.html",139 {"message": "feat: ...", "content": base64.b64encode(html_bytes).decode(), "branch": "main"})140gh("POST", f"/repos/{owner}/{repo}/pages", {"source": {"branch": "main", "path": "/"}})141```142Pages URL: `https://<owner>.github.io/<repo>/` (deploy takes ~1 min; verify with a GET).143144## Comment policy (USER PREFERENCE — always apply)145User wants **all blog comments disabled**. Blogger API does NOT support per-post comment control. Set it once globally:146- Blogger dashboard → Settings → Comments → "누가 댓글을 달 수 있나요?" → **"없음"** → Save.147- This applies to all existing and future posts. Remind the user to do this once if not already done.148149## Token refresh (access tokens expire ~1 hour)150If any Blogger API call returns **401 Unauthorized**, the access token expired. Refresh inline before retrying — do NOT re-run the full OAuth flow. **File paths on this box (2026-08 verified)**: token at `%LOCALAPPDATA%/hermes/google_token.json`; client secret at `%LOCALAPPDATA%/hermes/google_client_secret.json` — note the `google_` prefix, the filename is NOT `client_secret.json` (that guess 404s). Set `TOKEN_PATH`/`SECRET_PATH` to these and do refresh + publish in ONE execute_code call so a stale token never breaks the publish mid-way:151```python152import json, urllib.request, urllib.parse153tok = json.load(open(TOKEN_PATH))154cs = json.load(open(SECRET_PATH)); cs = cs.get("installed", cs.get("web", cs))155data = urllib.parse.urlencode({156 "client_id": cs["client_id"], "client_secret": cs["client_secret"],157 "refresh_token": tok["refresh_token"], "grant_type": "refresh_token"}).encode()158resp = urllib.request.urlopen(urllib.request.Request(159 "https://oauth2.googleapis.com/token", data=data, method="POST"))160new = json.loads(resp.read())161tok["access_token"] = new["access_token"]162if "refresh_token" in new: tok["refresh_token"] = new["refresh_token"]163json.dump(tok, open(TOKEN_PATH, "w"), indent=2)164```165Best practice: do refresh + publish in ONE execute_code call so a stale token never breaks the publish mid-way.166167**PITFALL — the refresh token ITSELF expires (hit 2026-08-07):** Google OAuth apps still in **Testing** status issue refresh tokens that die after **~7 days**. Symptom: the refresh call to `oauth2.googleapis.com/token` returns **HTTP 400 `invalid_grant` — "Token has been expired or revoked"** (NOT a 401; inline refresh just repeats the 400). Fix: re-run `scripts/google-auth-auto.py` (Path B — opens browser, user clicks Allow, code auto-captured on localhost:8765, prints "토큰 저장 완료"), then re-run the refresh+publish flow. Expect this roughly weekly until the Google Cloud project leaves Testing — if a publish fails with invalid_grant, go straight to re-auth, don't debug the client.168169## Labels = categories ("게시판" requests)170Blogger has NO boards/categories — **labels** are the equivalent. When the user asks for a "게시판" or category organization:1711. Add a shared umbrella label to every program post (this blog uses `오픈소스 프로그램`) via the `labels` array on POST/PUT.1722. Label feed URL: `https://<blog>.blogspot.com/search/label/<URL-encoded label>` (spaces → `%20`).1733. Update labels on existing posts: GET the post, set `data["labels"]`, PUT back to `/blogs/{id}/posts/{postId}`.1744. For a visible sidebar menu: Blogger dashboard → 레이아웃 → 가젯 추가 → "라벨".175Convention on this blog: umbrella label `오픈소스 프로그램` on all program posts + 2-4 specific labels (e.g. `브라우저 도구`, `유저스크립트`, `이미지`).176177## Translating existing posts to another language178When the user asks to convert existing posts to English or another language ("ai,테크 글 4개 영문으로 바꿔줘"):1791801. **Identify the set**: list all posts (`GET /blogs/{id}/posts?fetchBodies=false`), pick by labels/content class, and confirm the count matches the user's number (their blog: AI/tech news posts carry AI/LLM/모델 리뷰-style labels; program showcases are a separate class).1812. **Backup first**: for each post, `GET .../posts/{postId}?fetchBodies=true` and save the raw JSON + HTML under `G:\...\Hermes\<task-subfolder>\<name>_original.{json,html}`. Translation is destructive — never start without a rollback path.1823. **Inventory images**: split into (a) self-made matplotlib charts — almost certainly labeled in the source language, MUST be regenerated — and (b) official vendor images (Qwen/DeepSeek official blog charts are usually already English) — keep as-is. Rule of thumb: if it was rendered with matplotlib + Malgun Gothic for a Korean post, it has Korean text.1834. **Regenerate charts**: the original chart scripts are usually NOT saved on disk (search the NAS Hermes folder first, expect nothing). Extract the data from the post's own visible text/tables and rebuild faithfully in the target language (same dark theme facecolor #0d1117, text #c9d1d9, accents #58a6ff/#7ee787/#f0883e). Mark estimates as estimates ("author's estimate"); reconstruction-only charts get an honest caption. Upload with a language prefix (`en_<name>.png`) so the originals stay intact.1845. **Mirror the HTML**: copy the original `<style>` block and inline styles verbatim; translate only the text; swap `<img src>` to the new chart URLs. Keep the self-contained dark card root (`background:#0d1117`) per the self-contained card rule.1856. **Localize region-specific content**: a "한국 사용자 필독" license warning becomes an "EU/UK/US/South Korea excluded territories" note — same facts, reframed for the new audience.1867. **PUT with title + content + labels** — labels are NOT preserved across PUT (see Pitfalls below). Same post ID → same URL, so existing links keep working.1878. **Verify**: GET each post (title, labels, status LIVE) and check every raw.githubusercontent.com image URL returns 200 (CDN lags a few seconds after upload — verify via the GitHub API first, then retry the raw URL).1889. **Tone carries over**: translate the conversational blogger voice, don't flatten it into neutral prose — the user's style rules (구어체, honest caveats, no AI-flavored structure, casual endings) apply in English too. Keep emoji/section styling the same.189190## Quality loop (재귀개선)191When the user asks for recursive improvement of a published post ("재귀개선 한번돌려" / "재귀개선 시작해"), run the 3-reviewer fact/tone/HTML round documented in `references/recursive-review-loop.md` — parallel subagent reviewers, cross-validation against primary sources, apply, then playtest-verify the live post.192193## SEO / exposure (Blogger + Google Search Console)194When the user asks about blog traffic/exposure ("노출량 늘리기", "구글 검색"), diagnose FIRST, then set up GSC. Order of operations from a real setup (2026-08, opensourcefactory1 blog):1951. **Diagnose**: `site:<blog>` web search (indexing state), curl the homepage and grep for `google-site-verification` (GSC done?), `gtag`/`G-XXXX` (analytics?), `og:description`, `twitter:card`; check `/<blog>/sitemap.xml` and `/feeds/posts/default?alt=rss` return 200 (Blogger generates both automatically — 200 means the plumbing is fine).1962. **GSC is the #1 lever for a young blog** (few posts, homepage barely indexed): verification → sitemap submit → URL inspection + indexing request per post. Individual posts typically aren't indexed until requested.1973. **Verification method for a blogspot subdomain**: HTML tag ONLY (no DNS, no file upload). The tag goes in the theme `<head>`.1984. **Blogger API v3 has NO template endpoint** — theme edits cannot be automated; they are a user copy-paste job (Blogger 대시보드 → 테마 → ▾ → HTML 수정 → before `</head>`). Package the whole injection (GSC tag placeholder + `twitter:card`) as one snippet file for the user.1995. **The `google_token.json` OAuth scope is blogger-only** (no `webmasters` scope) → no GSC API automation without re-consent. Don't promise API automation; guide the UI path (sitemap submit + URL inspection are 2 clicks each, 7 posts ≈ 2 min).2006. **Stale homepage snippet** (old Korean description showing in search) = the blog **description setting** (Blogger 설정 → 기본 설정 → 설명), not a meta tag — changing it + re-requesting indexing on the homepage fixes the snippet in 1–3 days. English default per the language policy.2017. Deliverables go in `G:\...\Hermes\<task-subfolder>\` per the work-products convention: snippet.html + guide (.md AND .txt) + post-urls.txt.202Full diagnostic command set, 3-step guide text, and the injection snippet: `references/blogger-seo-exposure.md`.203204## Pitfalls205- **Don't freeze volatile live numbers in news posts (hit 2026-08)**: crowdfunding campaign totals (Kickstarter and similar) change hourly and the site may block direct scraping (403 on both the page and the .json endpoint). Never put a captured funding amount in a post that will age — link the campaign page and write "changes hourly — check the campaign" instead. Lock in only stable facts: tiers, prices, ship window, specs.206- **PUT drops labels (hit 2026-08)**: updating a post via PUT with only `title` + `content` silently clears its `labels` (GET after → `labels: None`), wiping the blog's category taxonomy. Always fetch the post first (or keep the original labels) and include the `labels` array in the PUT body. Hit live while translating 4 posts to English; had to re-PUT all of them with labels restored.207- **read_file may flag Blogger-saved HTML as binary**: post content saved straight from the API can carry `\r\r\n` line endings (and/or a BOM), and read_file refuses it as binary. Read/decode via execute_code (`open(path,'rb').read().decode('utf-8-sig')`) instead.208- `--auth-url` default scope set does NOT include blogger; the auto-capture script requests `auth/blogger` scope explicitly.209- Token at `%LOCALAPPDATA%/hermes/google_token.json`. If scope is wrong, re-run auth with blogger scope.210- 404 on `blogs/byurl?url=...` usually means wrong/guessed URL — use `users/self/blogs` instead.211- Keep posts as a saved file so they're reusable/editable. Per user convention, all work products go under `G:\내 드라이브\NAS폴더\NASfolder\Hermes\<task-subfolder>\` (one subfolder per post, e.g. `Hermes\qwen38-max-blog\` holding the HTML + images/) — never leave files in the home folder.212- **PIL in-process stat lies right after save (hit 2026-08-08)**: `f.stat().st_size//1024` printed `0KB` immediately after `im.save(f)` (file handle still open / size not flushed), while the file was actually 62-192KB. Verify final image sizes with a fresh `ls` in terminal before trusting them.213- **Blogger `posts/bypath` response has NO `status` field (hit 2026-08-08)**: keys are author/blog/content/etag/id/kind/labels/published/replies/selfLink/title/updated/url. Verify a publish by fetching the post by ID (`GET /blogs/{id}/posts/{postId}`) or by checking `published` + `url` presence — don't KeyError on `p["status"]`.214- **Press review pages block bots, their CDNs don't (hit 2026-08-08)**: MacStories returns 403 to non-browser UAs on the article page, but `cdn.macstories.net` image URLs download fine with a browser UA. When web_extract succeeds on a page but direct urllib fetch 403s, the image URLs are already in the web_extract output — don't re-fetch the page, mine the extraction content (including the saved cache file).
wcpaka-lgtm