fix: Prevent get_the_excerpt() from triggering the_content filter

- get_the_excerpt() internally calls the_content filter when generating auto-excerpts
- When in shortcode context, now uses raw post_excerpt or wp_trim_words() instead
- This was the remaining recursion path causing memory exhaustion

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -0,0 +1,195 @@
+name: Create Release Package
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  build-release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.3'
+          extensions: mbstring, xml, zip, intl, gettext
+          tools: composer:v2
+
+      - name: Get version from tag
+        id: version
+        run: |
+          VERSION=${GITHUB_REF_NAME#v}
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "Building version: $VERSION"
+
+      - name: Validate composer.json
+        run: composer validate --strict
+
+      - name: Install Composer dependencies (production)
+        run: |
+          composer config platform.php 8.3.0
+          composer install --no-dev --optimize-autoloader --no-interaction
+
+      - name: Install gettext
+        run: apt-get update && apt-get install -y gettext
+
+      - name: Compile translations
+        run: |
+          for po in languages/*.po; do
+            if [ -f "$po" ]; then
+              mo="${po%.po}.mo"
+              echo "Compiling $po to $mo"
+              msgfmt -o "$mo" "$po"
+            fi
+          done
+
+      - name: Verify plugin version matches tag
+        run: |
+          PLUGIN_VERSION=$(grep -oP "Version:\s*\K[0-9]+\.[0-9]+\.[0-9]+" wp-fedistream.php | head -1)
+          TAG_VERSION=${{ steps.version.outputs.version }}
+          if [ "$PLUGIN_VERSION" != "$TAG_VERSION" ]; then
+            echo "Error: Plugin version ($PLUGIN_VERSION) does not match tag version ($TAG_VERSION)"
+            exit 1
+          fi
+          echo "Version verified: $PLUGIN_VERSION"
+
+      - name: Create release directory
+        run: mkdir -p releases
+
+      - name: Build release package
+        run: |
+          VERSION=${{ steps.version.outputs.version }}
+          PLUGIN_NAME="wp-fedistream"
+          RELEASE_FILE="releases/${PLUGIN_NAME}-${VERSION}.zip"
+
+          # Move to parent directory for proper zip structure
+          cd ..
+
+          # Create zip with proper WordPress plugin structure
+          zip -r "${PLUGIN_NAME}/${RELEASE_FILE}" "${PLUGIN_NAME}" \
+            -x "${PLUGIN_NAME}/.git/*" \
+            -x "${PLUGIN_NAME}/.gitea/*" \
+            -x "${PLUGIN_NAME}/.github/*" \
+            -x "${PLUGIN_NAME}/.vscode/*" \
+            -x "${PLUGIN_NAME}/.claude/*" \
+            -x "${PLUGIN_NAME}/.gitea/*" \
+            -x "${PLUGIN_NAME}/CLAUDE.md" \
+            -x "${PLUGIN_NAME}/wp-core" \
+            -x "${PLUGIN_NAME}/wp-core/*" \
+            -x "${PLUGIN_NAME}/wp-plugins" \
+            -x "${PLUGIN_NAME}/wp-plugins/*" \
+            -x "${PLUGIN_NAME}/releases/*" \
+            -x "${PLUGIN_NAME}/composer.lock" \
+            -x "${PLUGIN_NAME}/*.log" \
+            -x "${PLUGIN_NAME}/.gitignore" \
+            -x "${PLUGIN_NAME}/.gitmodules" \
+            -x "${PLUGIN_NAME}/.editorconfig" \
+            -x "${PLUGIN_NAME}/phpcs.xml*" \
+            -x "${PLUGIN_NAME}/phpunit.xml*" \
+            -x "${PLUGIN_NAME}/tests/*" \
+            -x "${PLUGIN_NAME}/*.po~" \
+            -x "${PLUGIN_NAME}/*.bak" \
+            -x "*.DS_Store"
+
+          cd "${PLUGIN_NAME}"
+          echo "Created: ${RELEASE_FILE}"
+
+      - name: Generate checksums
+        run: |
+          VERSION=${{ steps.version.outputs.version }}
+          RELEASE_FILE="releases/wp-fedistream-${VERSION}.zip"
+
+          cd releases
+          sha256sum "wp-fedistream-${VERSION}.zip" > "wp-fedistream-${VERSION}.zip.sha256"
+
+          echo "SHA256:"
+          cat "wp-fedistream-${VERSION}.zip.sha256"
+
+      - name: Verify package structure
+        run: |
+          set +o pipefail
+          VERSION=${{ steps.version.outputs.version }}
+          echo "Package contents:"
+          unzip -l "releases/wp-fedistream-${VERSION}.zip" | head -50 || true
+
+          # Verify main file is at correct location
+          if unzip -l "releases/wp-fedistream-${VERSION}.zip" | grep -q "wp-fedistream/wp-fedistream.php"; then
+            echo "✓ Main plugin file at correct location"
+          else
+            echo "✗ Error: Main plugin file not found at wp-fedistream/wp-fedistream.php"
+            exit 1
+          fi
+
+          # Verify vendor directory is included
+          if unzip -l "releases/wp-fedistream-${VERSION}.zip" | grep -q "wp-fedistream/vendor/"; then
+            echo "✓ Vendor directory included"
+          else
+            echo "✗ Error: Vendor directory not found"
+            exit 1
+          fi
+
+      - name: Extract changelog for release notes
+        id: changelog
+        run: |
+          VERSION=${{ steps.version.outputs.version }}
+          # Extract changelog section for this version
+          NOTES=$(sed -n "/^## \[${VERSION}\]/,/^## \[/p" CHANGELOG.md | sed '$ d' | tail -n +2)
+          if [ -z "$NOTES" ]; then
+            NOTES="Release version ${VERSION}"
+          fi
+          # Save to file for multi-line output
+          echo "$NOTES" > release_notes.txt
+          echo "Release notes extracted"
+
+      - name: Create Gitea Release
+        env:
+          GITEA_TOKEN: ${{ secrets.SRC_GITEA_TOKEN }}
+        run: |
+          VERSION=${{ steps.version.outputs.version }}
+          TAG_NAME=${{ github.ref_name }}
+          PRERELEASE="false"
+          if [[ "$TAG_NAME" == *-* ]]; then
+            PRERELEASE="true"
+          fi
+
+          # Read release notes
+          BODY=$(cat release_notes.txt)
+
+          # Create release via Gitea API
+          RELEASE_RESPONSE=$(curl -s -X POST \
+            -H "Authorization: token ${GITEA_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d "{\"tag_name\": \"${TAG_NAME}\", \"name\": \"Release ${VERSION}\", \"body\": $(echo "$BODY" | jq -Rs .), \"draft\": false, \"prerelease\": ${PRERELEASE}}" \
+            "${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}/releases")
+
+          RELEASE_ID=$(echo "$RELEASE_RESPONSE" | jq -r '.id')
+
+          if [ "$RELEASE_ID" == "null" ] || [ -z "$RELEASE_ID" ]; then
+            echo "Failed to create release:"
+            echo "$RELEASE_RESPONSE"
+            exit 1
+          fi
+
+          echo "Created release ID: $RELEASE_ID"
+
+          # Upload attachments
+          for file in "releases/wp-fedistream-${VERSION}.zip" "releases/wp-fedistream-${VERSION}.zip.sha256"; do
+            if [ -f "$file" ]; then
+              FILENAME=$(basename "$file")
+              echo "Uploading $FILENAME..."
+              curl -s -X POST \
+                -H "Authorization: token ${GITEA_TOKEN}" \
+                -H "Content-Type: application/octet-stream" \
+                --data-binary "@$file" \
+                "${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}/releases/${RELEASE_ID}/assets?name=${FILENAME}"
+              echo "Uploaded $FILENAME"
+            fi
+          done
+
+          echo "Release created successfully: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/releases/tag/${TAG_NAME}"

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "lib/wc-licensed-product-client"]
+	path = lib/wc-licensed-product-client
+	url = ../wc-licensed-product-client.git

CHANGELOG.md

@@ -7,6 +7,65 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.4.4] - 2026-02-02
+
+### Fixed
+
+- **Fix excerpt-triggered recursion** - `get_the_excerpt()` internally calls `the_content` filter when generating auto-excerpts
+  - When in shortcode context, now uses raw `$post->post_excerpt` or generates simple excerpt with `wp_trim_words()` instead
+  - This was the remaining recursion path causing memory exhaustion in `class-wp-hook.php`
+
+## [0.4.3] - 2026-02-02
+
+### Fixed
+
+- **Further memory leak fix** - v0.4.2 fix was still incomplete
+  - Changed `$in_shortcode_context` boolean to `$shortcode_context_depth` counter to properly handle nested shortcodes
+  - Added shortcode context protection to `template-wrapper.php` for single page views
+  - This fixes the remaining recursion path where `the_content` filter was still being applied when viewing single FediStream posts (artists, albums, tracks, playlists)
+
+## [0.4.2] - 2026-02-02
+
+### Fixed
+
+- **Complete fix for memory leak** - v0.4.1 fix was incomplete
+  - Added `$in_shortcode_context` flag to TemplateLoader to track when we're rendering shortcodes
+  - All shortcode render methods now call `enter_shortcode_context()` before loading data
+  - When in shortcode context, `the_content` filter is always skipped to prevent recursive shortcode processing
+  - This prevents infinite recursion when post content contains FediStream shortcodes
+
+## [0.4.1] - 2026-02-02
+
+### Fixed
+
+- **Critical memory leak** causing "Allowed memory size exhausted" errors in Twig's StagingExtension
+  - Root cause: `apply_filters('the_content')` in `get_post_data()` triggered shortcode processing, causing infinite recursion when post content contained FediStream shortcodes
+  - Added recursion depth tracking with `MAX_RECURSION_DEPTH = 3` to prevent runaway nesting
+  - Nested items now skip `the_content` filter, using `wp_kses_post()` instead
+  - Nested data loading (albums within artists, tracks within albums) is now properly bounded
+
+### Changed
+
+- Made `get_artist_data()`, `get_album_data()`, `get_track_data()`, and `get_playlist_data()` public methods in TemplateLoader (previously private but called externally)
+- These methods now accept both `int` post IDs and `WP_Post` objects for flexibility
+- Added `$load_nested` parameter to control whether nested items are fully loaded or just counted
+
+## [0.4.0] - 2026-01-29
+
+### Added
+
+- Gitea Actions CI/CD pipeline for automated release package creation
+  - Triggered by `v*` tags
+  - PHP 8.3 environment with production dependencies
+  - Automatic translation compilation (.po to .mo)
+  - Version verification (plugin version must match tag)
+  - WordPress-compliant zip structure
+  - SHA256 checksum generation
+  - Package structure verification
+  - Changelog extraction for release notes
+  - Automatic Gitea release creation with attachments
+  - Pre-release detection for tags containing `-`
+
 ## [0.3.0] - 2026-01-29
 
 ### Added
@@ -175,7 +234,13 @@ Initial release of WP FediStream - a WordPress plugin for streaming music over A
 
 ---
 
-[Unreleased]: https://src.bundespruefstelle.ch/magdev/wp-fedistream/compare/v0.2.0...HEAD
+[Unreleased]: https://src.bundespruefstelle.ch/magdev/wp-fedistream/compare/v0.4.4...HEAD
+[0.4.4]: https://src.bundespruefstelle.ch/magdev/wp-fedistream/compare/v0.4.3...v0.4.4
+[0.4.3]: https://src.bundespruefstelle.ch/magdev/wp-fedistream/compare/v0.4.2...v0.4.3
+[0.4.2]: https://src.bundespruefstelle.ch/magdev/wp-fedistream/compare/v0.4.1...v0.4.2
+[0.4.1]: https://src.bundespruefstelle.ch/magdev/wp-fedistream/compare/v0.4.0...v0.4.1
+[0.4.0]: https://src.bundespruefstelle.ch/magdev/wp-fedistream/compare/v0.3.0...v0.4.0
+[0.3.0]: https://src.bundespruefstelle.ch/magdev/wp-fedistream/compare/v0.2.0...v0.3.0
 [0.2.0]: https://src.bundespruefstelle.ch/magdev/wp-fedistream/compare/v0.1.1...v0.2.0
 [0.1.1]: https://src.bundespruefstelle.ch/magdev/wp-fedistream/compare/v0.1.0...v0.1.1
 [0.1.0]: https://src.bundespruefstelle.ch/magdev/wp-fedistream/releases/tag/v0.1.0

CLAUDE.md

@@ -126,11 +126,48 @@ for po in languages/*.po; do msgfmt -o "${po%.po}.mo" "$po"; done
 #### What's Excluded
 
 - Git metadata (`.git/`)
-- Development files (`.vscode/`, `.claude/`, `CLAUDE.md`, `wp-core`, `wp-plugins`)
+- Development files (`.vscode/`, `.claude/`, `.gitea/`, `CLAUDE.md`, `wp-core`, `wp-plugins`)
 - Logs and cache files
 - Previous releases
 - `composer.lock` (but `vendor/` is included)
 
+#### CI/CD Pipeline (Gitea Actions)
+
+Automated release packages are created via Gitea Actions when a tag matching `v*` is pushed:
+
+**Workflow:** `.gitea/workflows/release.yml`
+
+**Trigger:** Push tag `vX.X.X` to repository
+
+**Steps:**
+
+1. Checkout code
+2. Setup PHP 8.3 with required extensions
+3. Install production Composer dependencies
+4. Compile translations (.po to .mo)
+5. Verify plugin version matches tag version
+6. Build release zip with proper WordPress structure
+7. Generate SHA256 checksums
+8. Verify package structure
+9. Extract changelog for release notes
+10. Create Gitea release with attachments
+
+**Required Secret:** `GITEA_TOKEN` - Personal access token with release permissions
+
+**Pre-release Detection:** Tags containing `-` (e.g., `v1.0.0-beta`) are marked as pre-release
+
+**To create a release:**
+
+```bash
+# Ensure version is updated in wp-fedistream.php (both header and constant)
+git checkout main
+git merge dev
+git tag -a v0.4.0 -m "Release v0.4.0"
+git push origin main --tags
+```
+
+The pipeline will automatically build and publish the release package.
+
 ---
 
 **For AI Assistants:**
@@ -184,6 +221,9 @@ When editing CLAUDE.md or other markdown files, follow these rules to avoid lint
 
 ```txt
 wp-fedistream/
+├── .gitea/
+│   └── workflows/
+│       └── release.yml        # CI/CD release pipeline
 ├── assets/
 │   ├── css/
 │   │   ├── admin.css          # Admin interface styles
@@ -464,3 +504,51 @@ wp-fedistream/
 - Package name is `magdev/wc-licensed-product-client` (not `wc-license-product-client`)
 - Uses Symfony HTTP Client via the license client package
 - License validation cached for 24 hours using WordPress transients
+
+### 2026-01-29 - CI/CD Pipeline v0.4.0
+
+**Summary:** Added Gitea Actions workflow for automated release package creation with multiple iterations to fix CI issues.
+
+**Features:**
+
+- Automated release builds triggered by `v*` tags
+- PHP 8.3 environment with required extensions
+- Production Composer dependency installation
+- Automatic translation compilation (.po to .mo)
+- Version verification (plugin version must match tag)
+- Proper WordPress plugin zip structure
+- SHA256 checksum generation
+- Package structure verification
+- Changelog extraction for release notes
+- Automatic Gitea release creation via API
+- Pre-release detection for tags containing `-`
+
+**Files Created:**
+
+- `.gitea/workflows/release.yml` - CI/CD release pipeline
+- `.gitmodules` - Git submodule configuration
+- `lib/wc-licensed-product-client/` - Submodule for private dependency
+
+**Files Modified:**
+
+- `CLAUDE.md` - Added CI/CD documentation and updated directory structure
+- `CHANGELOG.md` - Added v0.4.0 entry
+- `wp-fedistream.php` - Version bump to 0.4.0
+- `composer.json` - Changed to path repository for submodule
+- `README.md` - Updated for v0.4.0, added release/installation docs
+
+**CI/CD Fixes Applied:**
+
+1. `actions/gitea-release-action@v1` doesn't exist - use Gitea API directly with curl
+2. Private repo network issue - use git submodule with relative URL (`../wc-licensed-product-client.git`)
+3. Composer path repository for submodule dependency
+4. `msgfmt` not found - install gettext package
+5. SIGPIPE error (exit 141) - use `set +o pipefail` and `|| true`
+
+**Notes:**
+
+- Requires `SRC_GITEA_TOKEN` secret configured in repository settings
+- Uses `shivammathur/setup-php@v2` for PHP setup
+- Uses Gitea API directly for release creation (not GitHub Actions)
+- Submodule uses relative URL for CI compatibility
+- Composer symlinks from `lib/wc-licensed-product-client` to vendor

README.md

@@ -2,10 +2,11 @@
 
 Stream music over ActivityPub - Build your own music streaming platform for Musicians and Labels.
 
-[![Version](https://img.shields.io/badge/version-0.2.0-blue.svg)](CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-0.4.0-blue.svg)](CHANGELOG.md)
 [![PHP](https://img.shields.io/badge/PHP-%3E%3D8.3-purple.svg)](https://php.net)
 [![WordPress](https://img.shields.io/badge/WordPress-%3E%3D6.4-blue.svg)](https://wordpress.org)
 [![License](https://img.shields.io/badge/license-GPL--2.0%2B-green.svg)](https://www.gnu.org/licenses/gpl-2.0.html)
+[![CI/CD](https://img.shields.io/badge/CI%2FCD-Gitea%20Actions-green.svg)](https://src.bundespruefstelle.ch/magdev/wp-fedistream/actions)
 
 ## Description
 
@@ -31,29 +32,47 @@ WP FediStream is a WordPress plugin that enables musicians, bands, and labels to
 
 - PHP 8.3 or higher
 - WordPress 6.4 or higher
-- Composer (for development/installation)
+- Valid license key (required for frontend features)
 
 ### Optional
 
 - [ActivityPub Plugin](https://wordpress.org/plugins/activitypub/) - For Fediverse integration
 - [WooCommerce](https://woocommerce.com/) 10.0+ - For selling music
 
+## License Key
+
+WP FediStream requires a valid license key for frontend functionality (player, shortcodes, ActivityPub). The admin dashboard works without a license, allowing you to configure the plugin before activation.
+
+To obtain a license key, contact the author or purchase from the official website.
+
 ## Installation
 
-### From Source
+### From Release Package (Recommended)
 
-1. Clone or download the repository to your WordPress plugins directory:
+1. Download the latest release from the [Releases page](https://src.bundespruefstelle.ch/magdev/wp-fedistream/releases)
+
+2. Upload the ZIP file via **Plugins > Add New > Upload Plugin** in WordPress admin
+
+3. Activate the plugin under **Plugins > Installed Plugins**
+
+4. Navigate to **FediStream > Settings** and enter your license key
+
+5. Start using the plugin via the **FediStream** admin menu
+
+### From Source (Development)
+
+1. Clone the repository to your WordPress plugins directory:
 
    ```bash
    cd wp-content/plugins/
-   git clone https://src.bundespruefstelle.ch/magdev/wp-fedistream.git
+   git clone --recurse-submodules https://src.bundespruefstelle.ch/magdev/wp-fedistream.git
    ```
 
 2. Install Composer dependencies:
 
    ```bash
    cd wp-fedistream
-   composer install --no-dev
+   composer install
    ```
 
 3. Activate the plugin in WordPress admin under **Plugins > Installed Plugins**
@@ -133,6 +152,16 @@ wp-fedistream/
 └── wp-fedistream.php  # Plugin entry point
 ```
 
+## Releases
+
+Release packages are automatically built via Gitea Actions when a version tag is pushed. Each release includes:
+
+- Production-ready ZIP package with all dependencies
+- SHA256 checksum for verification
+- Changelog notes extracted from CHANGELOG.md
+
+Download releases from: <https://src.bundespruefstelle.ch/magdev/wp-fedistream/releases>
+
 ## Contributing
 
 This project is in early development. Contributions, bug reports, and feature requests are welcome.

composer.json

@@ -16,13 +16,13 @@
     },
     "repositories": [
         {
-            "type": "vcs",
+            "type": "path",
-            "url": "https://src.bundespruefstelle.ch/magdev/wc-licensed-product-client.git"
+            "url": "lib/wc-licensed-product-client"
         }
     ],
     "require": {
         "php": ">=8.3",
-        "magdev/wc-licensed-product-client": "^0.1",
+        "magdev/wc-licensed-product-client": "^0.2",
         "twig/twig": "^3.0"
     },
     "require-dev": {

composer.lock

@@ -4,15 +4,15 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "29e8e4e069b25dee0a610019a77dab50",
+    "content-hash": "0c8153ac31232ffe7f0af117cec865b4",
     "packages": [
         {
             "name": "magdev/wc-licensed-product-client",
-            "version": "v0.1.0",
+            "version": "v0.2.2",
-            "source": {
+            "dist": {
-                "type": "git",
+                "type": "path",
-                "url": "https://src.bundespruefstelle.ch/magdev/wc-licensed-product-client.git",
+                "url": "lib/wc-licensed-product-client",
-                "reference": "83037ea0c2d9e365cf9ec0ad50251d3ebc7e4782"
+                "reference": "f9281ec5fb23bf1993ab0240e0347c835009a10f"
             },
             "require": {
                 "php": "^8.3",
@@ -51,7 +51,9 @@
                 "issues": "https://src.bundespruefstelle.ch/magdev/wc-licensed-product-client/issues",
                 "source": "https://src.bundespruefstelle.ch/magdev/wc-licensed-product-client"
             },
-            "time": "2026-01-22T15:24:57+00:00"
+            "transport-options": {
+                "relative": true
+            }
         },
         {
             "name": "psr/cache",

includes/Frontend/Shortcodes.php

@@ -81,6 +81,9 @@ class Shortcodes {
      * @return string
      */
     public function render_artist( array $atts ): string {
+        // Enter shortcode context to prevent recursive shortcode processing during data loading.
+        TemplateLoader::enter_shortcode_context();
+
         $atts = shortcode_atts(
             array(
                 'id'          => 0,
@@ -95,6 +98,7 @@ class Shortcodes {
 
         $post = $this->get_post( $atts, 'fedistream_artist' );
         if ( ! $post ) {
+            TemplateLoader::exit_shortcode_context();
             return '';
         }
 
@@ -119,6 +123,9 @@ class Shortcodes {
      * @return string
      */
     public function render_album( array $atts ): string {
+        // Enter shortcode context to prevent recursive shortcode processing during data loading.
+        TemplateLoader::enter_shortcode_context();
+
         $atts = shortcode_atts(
             array(
                 'id'          => 0,
@@ -132,6 +139,7 @@ class Shortcodes {
 
         $post = $this->get_post( $atts, 'fedistream_album' );
         if ( ! $post ) {
+            TemplateLoader::exit_shortcode_context();
             return '';
         }
 
@@ -155,6 +163,9 @@ class Shortcodes {
      * @return string
      */
     public function render_track( array $atts ): string {
+        // Enter shortcode context to prevent recursive shortcode processing during data loading.
+        TemplateLoader::enter_shortcode_context();
+
         $atts = shortcode_atts(
             array(
                 'id'          => 0,
@@ -168,6 +179,7 @@ class Shortcodes {
 
         $post = $this->get_post( $atts, 'fedistream_track' );
         if ( ! $post ) {
+            TemplateLoader::exit_shortcode_context();
             return '';
         }
 
@@ -191,6 +203,9 @@ class Shortcodes {
      * @return string
      */
     public function render_playlist( array $atts ): string {
+        // Enter shortcode context to prevent recursive shortcode processing during data loading.
+        TemplateLoader::enter_shortcode_context();
+
         $atts = shortcode_atts(
             array(
                 'id'          => 0,
@@ -204,6 +219,7 @@ class Shortcodes {
 
         $post = $this->get_post( $atts, 'fedistream_playlist' );
         if ( ! $post ) {
+            TemplateLoader::exit_shortcode_context();
             return '';
         }
 
@@ -227,6 +243,9 @@ class Shortcodes {
      * @return string
      */
     public function render_latest_releases( array $atts ): string {
+        // Enter shortcode context to prevent recursive shortcode processing during data loading.
+        TemplateLoader::enter_shortcode_context();
+
         $atts = shortcode_atts(
             array(
                 'count'   => 6,
@@ -292,6 +311,9 @@ class Shortcodes {
      * @return string
      */
     public function render_popular_tracks( array $atts ): string {
+        // Enter shortcode context to prevent recursive shortcode processing during data loading.
+        TemplateLoader::enter_shortcode_context();
+
         $atts = shortcode_atts(
             array(
                 'count'   => 10,
@@ -359,6 +381,9 @@ class Shortcodes {
      * @return string
      */
     public function render_artists_grid( array $atts ): string {
+        // Enter shortcode context to prevent recursive shortcode processing during data loading.
+        TemplateLoader::enter_shortcode_context();
+
         $atts = shortcode_atts(
             array(
                 'count'   => 12,
@@ -426,6 +451,9 @@ class Shortcodes {
      * @return string
      */
     public function render_player( array $atts ): string {
+        // Enter shortcode context to prevent recursive shortcode processing during data loading.
+        TemplateLoader::enter_shortcode_context();
+
         $atts = shortcode_atts(
             array(
                 'track'    => 0,
@@ -471,6 +499,7 @@ class Shortcodes {
         }
 
         if ( empty( $tracks ) ) {
+            TemplateLoader::exit_shortcode_context();
             return '';
         }
 
@@ -528,13 +557,20 @@ class Shortcodes {
             return $this->get_unlicensed_message();
         }
 
+        // Enter shortcode context to prevent recursive shortcode processing.
+        TemplateLoader::enter_shortcode_context();
+
         try {
-            return $this->plugin->render( $template, $context );
+            $result = $this->plugin->render( $template, $context );
         } catch ( \Exception $e ) {
+            TemplateLoader::exit_shortcode_context();
             if ( WP_DEBUG ) {
                 return '<p class="fedistream-error">' . esc_html( $e->getMessage() ) . '</p>';
             }
             return '';
         }
+
+        TemplateLoader::exit_shortcode_context();
+        return $result;
     }
 }

includes/Frontend/TemplateLoader.php

@@ -21,6 +21,60 @@ if ( ! defined( 'ABSPATH' ) ) {
  */
 class TemplateLoader {
 
+    /**
+     * Recursion depth for get_post_data calls.
+     *
+     * @var int
+     */
+    private static int $recursion_depth = 0;
+
+    /**
+     * Maximum allowed recursion depth.
+     *
+     * @var int
+     */
+    private const MAX_RECURSION_DEPTH = 3;
+
+    /**
+     * Shortcode rendering context depth counter.
+     * When > 0, the_content filter is skipped to prevent recursive shortcode processing.
+     * Using a counter instead of boolean to handle nested shortcodes properly.
+     *
+     * @var int
+     */
+    private static int $shortcode_context_depth = 0;
+
+    /**
+     * Enter shortcode rendering context.
+     * Call this before rendering shortcode content to prevent recursive shortcode processing.
+     *
+     * @return void
+     */
+    public static function enter_shortcode_context(): void {
+        ++self::$shortcode_context_depth;
+    }
+
+    /**
+     * Exit shortcode rendering context.
+     * Call this after shortcode rendering is complete.
+     *
+     * @return void
+     */
+    public static function exit_shortcode_context(): void {
+        if ( self::$shortcode_context_depth > 0 ) {
+            --self::$shortcode_context_depth;
+        }
+    }
+
+    /**
+     * Check if we're in a shortcode rendering context.
+     *
+     * @return bool
+     */
+    public static function is_in_shortcode_context(): bool {
+        return self::$shortcode_context_depth > 0;
+    }
+
     /**
      * Constructor.
      */
@@ -191,34 +245,57 @@ class TemplateLoader {
     /**
      * Get post data for template.
      *
-     * @param \WP_Post $post Post object.
+     * @param \WP_Post $post       Post object.
+     * @param bool     $skip_nested Whether to skip loading nested items (albums, tracks, etc.).
      * @return array Post data.
      */
-    public static function get_post_data( \WP_Post $post ): array {
+    public static function get_post_data( \WP_Post $post, bool $skip_nested = false ): array {
+        // Track recursion to prevent infinite loops from shortcodes in content.
+        ++self::$recursion_depth;
+
+        // Skip the_content filter if:
+        // 1. We're in a shortcode context (prevents recursive shortcode processing)
+        // 2. We're at depth > 1 (nested data loading)
+        $skip_content_filter = self::$shortcode_context_depth > 0 || self::$recursion_depth > 1;
+
+        // When skipping content filter, also use raw excerpt to avoid get_the_excerpt()
+        // triggering the_content filter internally when generating auto-excerpts.
+        if ( $skip_content_filter ) {
+            $excerpt = $post->post_excerpt;
+            if ( empty( $excerpt ) ) {
+                // Generate a simple excerpt without triggering the_content filter.
+                $excerpt = wp_trim_words( wp_strip_all_tags( $post->post_content ), 55, '…' );
+            }
+        } else {
+            $excerpt = get_the_excerpt( $post );
+        }
+
         $data = array(
             'id'        => $post->ID,
             'title'     => get_the_title( $post ),
-            'content'   => apply_filters( 'the_content', $post->post_content ),
+            'content'   => $skip_content_filter ? wp_kses_post( $post->post_content ) : apply_filters( 'the_content', $post->post_content ),
-            'excerpt'   => get_the_excerpt( $post ),
+            'excerpt'   => $excerpt,
             'permalink' => get_permalink( $post ),
             'thumbnail' => get_the_post_thumbnail_url( $post->ID, 'large' ),
             'date'      => get_the_date( '', $post ),
             'author'    => get_the_author_meta( 'display_name', $post->post_author ),
         );
 
-        // Add post type specific data.
+        // Add post type specific data (skip nested items if at max depth).
+        $load_nested = ! $skip_nested && self::$recursion_depth < self::MAX_RECURSION_DEPTH;
+
         switch ( $post->post_type ) {
             case 'fedistream_artist':
-                $data = array_merge( $data, self::get_artist_data( $post->ID ) );
+                $data = array_merge( $data, self::get_artist_data( $post->ID, $load_nested ) );
                 break;
             case 'fedistream_album':
-                $data = array_merge( $data, self::get_album_data( $post->ID ) );
+                $data = array_merge( $data, self::get_album_data( $post->ID, $load_nested ) );
                 break;
             case 'fedistream_track':
                 $data = array_merge( $data, self::get_track_data( $post->ID ) );
                 break;
             case 'fedistream_playlist':
-                $data = array_merge( $data, self::get_playlist_data( $post->ID ) );
+                $data = array_merge( $data, self::get_playlist_data( $post->ID, $load_nested ) );
                 break;
         }
 
@@ -226,16 +303,23 @@ class TemplateLoader {
         $data['genres'] = self::get_terms( $post->ID, 'fedistream_genre' );
         $data['moods']  = self::get_terms( $post->ID, 'fedistream_mood' );
 
+        --self::$recursion_depth;
+
         return $data;
     }
 
     /**
      * Get artist-specific data.
      *
-     * @param int $post_id Post ID.
+     * @param int|\WP_Post $post_id     Post ID or WP_Post object.
+     * @param bool         $load_nested Whether to load nested albums.
      * @return array Artist data.
      */
-    private static function get_artist_data( int $post_id ): array {
+    public static function get_artist_data( int|\WP_Post $post_id, bool $load_nested = true ): array {
+        // Support both post ID and WP_Post object.
+        if ( $post_id instanceof \WP_Post ) {
+            $post_id = $post_id->ID;
+        }
         $type    = get_post_meta( $post_id, '_fedistream_artist_type', true ) ?: 'solo';
         $types   = array(
             'solo'       => __( 'Solo Artist', 'wp-fedistream' ),
@@ -244,23 +328,48 @@ class TemplateLoader {
             'collective' => __( 'Collective', 'wp-fedistream' ),
         );
 
-        $albums = get_posts(
+        $albums      = array();
-            array(
+        $album_count = 0;
-                'post_type'      => 'fedistream_album',
+
-                'posts_per_page' => -1,
+        if ( $load_nested ) {
-                'post_status'    => 'publish',
+            $album_posts = get_posts(
-                'meta_key'       => '_fedistream_album_artist',
+                array(
-                'meta_value'     => $post_id,
+                    'post_type'      => 'fedistream_album',
-                'orderby'        => 'meta_value',
+                    'posts_per_page' => -1,
-                'meta_query'     => array(
+                    'post_status'    => 'publish',
-                    array(
+                    'meta_key'       => '_fedistream_album_artist',
-                        'key'     => '_fedistream_album_release_date',
+                    'meta_value'     => $post_id,
-                        'compare' => 'EXISTS',
+                    'orderby'        => 'meta_value',
+                    'meta_query'     => array(
+                        array(
+                            'key'     => '_fedistream_album_release_date',
+                            'compare' => 'EXISTS',
+                        ),
                     ),
-                ),
+                    'order'          => 'DESC',
-                'order'          => 'DESC',
+                )
-            )
+            );
-        );
+            $album_count = count( $album_posts );
+            $albums      = array_map(
+                function ( $album ) {
+                    return self::get_post_data( $album, true ); // Skip further nesting.
+                },
+                $album_posts
+            );
+        } else {
+            // Just get the count without loading full data.
+            $album_count = (int) get_posts(
+                array(
+                    'post_type'      => 'fedistream_album',
+                    'posts_per_page' => -1,
+                    'post_status'    => 'publish',
+                    'meta_key'       => '_fedistream_album_artist',
+                    'meta_value'     => $post_id,
+                    'fields'         => 'ids',
+                )
+            );
+            $album_count = is_array( $album_count ) ? count( $album_count ) : 0;
+        }
 
         return array(
             'artist_type'       => $type,
@@ -270,18 +379,23 @@ class TemplateLoader {
             'website'           => get_post_meta( $post_id, '_fedistream_artist_website', true ),
             'social_links'      => get_post_meta( $post_id, '_fedistream_artist_social_links', true ) ?: array(),
             'members'           => get_post_meta( $post_id, '_fedistream_artist_members', true ) ?: array(),
-            'albums'            => array_map( array( __CLASS__, 'get_post_data' ), $albums ),
+            'albums'            => $albums,
-            'album_count'       => count( $albums ),
+            'album_count'       => $album_count,
         );
     }
 
     /**
      * Get album-specific data.
      *
-     * @param int $post_id Post ID.
+     * @param int|\WP_Post $post_id     Post ID or WP_Post object.
+     * @param bool         $load_nested Whether to load nested tracks.
      * @return array Album data.
      */
-    private static function get_album_data( int $post_id ): array {
+    public static function get_album_data( int|\WP_Post $post_id, bool $load_nested = true ): array {
+        // Support both post ID and WP_Post object.
+        if ( $post_id instanceof \WP_Post ) {
+            $post_id = $post_id->ID;
+        }
         $type      = get_post_meta( $post_id, '_fedistream_album_type', true ) ?: 'album';
         $types     = array(
             'album'       => __( 'Album', 'wp-fedistream' ),
@@ -293,24 +407,49 @@ class TemplateLoader {
         );
         $artist_id = get_post_meta( $post_id, '_fedistream_album_artist', true );
 
-        $tracks = get_posts(
+        $tracks       = array();
-            array(
+        $total_tracks = 0;
-                'post_type'      => 'fedistream_track',
+
-                'posts_per_page' => -1,
+        if ( $load_nested ) {
-                'post_status'    => 'publish',
+            $track_posts = get_posts(
-                'meta_key'       => '_fedistream_track_album',
+                array(
-                'meta_value'     => $post_id,
+                    'post_type'      => 'fedistream_track',
-                'orderby'        => 'meta_value_num',
+                    'posts_per_page' => -1,
-                'meta_query'     => array(
+                    'post_status'    => 'publish',
-                    'relation' => 'AND',
+                    'meta_key'       => '_fedistream_track_album',
-                    array(
+                    'meta_value'     => $post_id,
-                        'key'     => '_fedistream_track_number',
+                    'orderby'        => 'meta_value_num',
-                        'compare' => 'EXISTS',
+                    'meta_query'     => array(
+                        'relation' => 'AND',
+                        array(
+                            'key'     => '_fedistream_track_number',
+                            'compare' => 'EXISTS',
+                        ),
                     ),
-                ),
+                    'order'          => 'ASC',
-                'order'          => 'ASC',
+                )
-            )
+            );
-        );
+            $total_tracks = count( $track_posts );
+            $tracks       = array_map(
+                function ( $track ) {
+                    return self::get_post_data( $track, true ); // Skip further nesting.
+                },
+                $track_posts
+            );
+        } else {
+            // Just get the count without loading full data.
+            $track_ids    = get_posts(
+                array(
+                    'post_type'      => 'fedistream_track',
+                    'posts_per_page' => -1,
+                    'post_status'    => 'publish',
+                    'meta_key'       => '_fedistream_track_album',
+                    'meta_value'     => $post_id,
+                    'fields'         => 'ids',
+                )
+            );
+            $total_tracks = is_array( $track_ids ) ? count( $track_ids ) : 0;
+        }
 
         return array(
             'album_type'       => $type,
@@ -322,19 +461,23 @@ class TemplateLoader {
             'artist_url'       => $artist_id ? get_permalink( $artist_id ) : '',
             'upc'              => get_post_meta( $post_id, '_fedistream_album_upc', true ),
             'catalog_number'   => get_post_meta( $post_id, '_fedistream_album_catalog_number', true ),
-            'total_tracks'     => count( $tracks ),
+            'total_tracks'     => $total_tracks,
             'total_duration'   => (int) get_post_meta( $post_id, '_fedistream_album_total_duration', true ),
-            'tracks'           => array_map( array( __CLASS__, 'get_post_data' ), $tracks ),
+            'tracks'           => $tracks,
         );
     }
 
     /**
      * Get track-specific data.
      *
-     * @param int $post_id Post ID.
+     * @param int|\WP_Post $post_id Post ID or WP_Post object.
      * @return array Track data.
      */
-    private static function get_track_data( int $post_id ): array {
+    public static function get_track_data( int|\WP_Post $post_id ): array {
+        // Support both post ID and WP_Post object.
+        if ( $post_id instanceof \WP_Post ) {
+            $post_id = $post_id->ID;
+        }
         $album_id   = get_post_meta( $post_id, '_fedistream_track_album', true );
         $audio_file = get_post_meta( $post_id, '_fedistream_track_audio_file', true );
         $artists    = get_post_meta( $post_id, '_fedistream_track_artists', true ) ?: array();
@@ -374,16 +517,21 @@ class TemplateLoader {
     /**
      * Get playlist-specific data.
      *
-     * @param int $post_id Post ID.
+     * @param int|\WP_Post $post_id     Post ID or WP_Post object.
+     * @param bool         $load_nested Whether to load nested tracks.
      * @return array Playlist data.
      */
-    private static function get_playlist_data( int $post_id ): array {
+    public static function get_playlist_data( int|\WP_Post $post_id, bool $load_nested = true ): array {
+        // Support both post ID and WP_Post object.
+        if ( $post_id instanceof \WP_Post ) {
+            $post_id = $post_id->ID;
+        }
         global $wpdb;
 
-        $table   = $wpdb->prefix . 'fedistream_playlist_tracks';
+        $table    = $wpdb->prefix . 'fedistream_playlist_tracks';
         $duration = (int) get_post_meta( $post_id, '_fedistream_playlist_total_duration', true );
 
-        // Get tracks.
+        // Get track IDs.
         // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
         $track_ids = $wpdb->get_col(
             $wpdb->prepare(
@@ -392,11 +540,15 @@ class TemplateLoader {
             )
         );
 
-        $tracks = array();
+        $tracks      = array();
-        foreach ( $track_ids as $track_id ) {
+        $track_count = count( $track_ids );
-            $track = get_post( $track_id );
+
-            if ( $track && 'publish' === $track->post_status ) {
+        if ( $load_nested && ! empty( $track_ids ) ) {
-                $tracks[] = self::get_post_data( $track );
+            foreach ( $track_ids as $track_id ) {
+                $track = get_post( $track_id );
+                if ( $track && 'publish' === $track->post_status ) {
+                    $tracks[] = self::get_post_data( $track, true ); // Skip further nesting.
+                }
             }
         }
 
@@ -404,7 +556,7 @@ class TemplateLoader {
             'visibility'         => get_post_meta( $post_id, '_fedistream_playlist_visibility', true ) ?: 'public',
             'collaborative'      => (bool) get_post_meta( $post_id, '_fedistream_playlist_collaborative', true ),
             'federated'          => (bool) get_post_meta( $post_id, '_fedistream_playlist_federated', true ),
-            'track_count'        => count( $tracks ),
+            'track_count'        => $load_nested ? count( $tracks ) : $track_count,
             'total_duration'     => $duration,
             'duration_formatted' => $duration >= 3600
                 ? sprintf( '%d:%02d:%02d', floor( $duration / 3600 ), floor( ( $duration % 3600 ) / 60 ), $duration % 60 )

includes/Frontend/template-wrapper.php

@@ -13,6 +13,9 @@ if ( ! defined( 'ABSPATH' ) ) {
 use WP_FediStream\Plugin;
 use WP_FediStream\Frontend\TemplateLoader;
 
+// Enter shortcode context to prevent recursive shortcode processing in post content.
+TemplateLoader::enter_shortcode_context();
+
 // Get template context.
 $context = TemplateLoader::get_context();
 
@@ -75,4 +78,7 @@ get_header();
 </main>
 
 <?php
+// Exit shortcode context.
+TemplateLoader::exit_shortcode_context();
+
 get_footer();

wp-fedistream.php

@@ -3,7 +3,7 @@
  * Plugin Name: WP FediStream
  * Plugin URI: https://src.bundespruefstelle.ch/magdev/wp-fedistream
  * Description: Stream music over ActivityPub - Build your own music streaming platform for Musicians and Labels.
- * Version: 0.3.0
+ * Version: 0.4.4
  * Requires at least: 6.4
  * Requires PHP: 8.3
  * Author: Marco Graetsch
@@ -26,7 +26,7 @@ if ( ! defined( 'ABSPATH' ) ) {
  *
  * @var string
  */
-define( 'WP_FEDISTREAM_VERSION', '0.3.0' );
+define( 'WP_FEDISTREAM_VERSION', '0.4.4' );
 
 /**
  * Plugin file path.