@diviops/mcp-server 0.2.10 → 0.2.12

package/README.md

@@ -141,7 +141,7 @@ The server connects via standard WordPress REST API and works with any environme
 | `diviops_save_to_library` | Save block markup to Divi Library |
 | `diviops_update_tb_layout` | Update a Theme Builder layout's block markup |
 | `diviops_create_tb_template` | Create Theme Builder template with header/footer and conditions |
-| `diviops_create_variable` | Create a design token variable. For `type=numbers` fluid tokens, pass `min`+`max` shorthand (anchors default to 320px/1920px) or explicit `targets` like `{"320px":"20px","1920px":"60px"}` — server generates arithmetically-correct `clamp()` instead of hand-written math that silently under-reaches the stated max. Px inputs only in this MVP; rem inputs should be converted to px (1rem=16px) before calling |
+| `diviops_create_variable` | Create a design token variable. For `type=numbers` fluid tokens, pass `min`+`max` shorthand (anchors default to 320px/1920px) or explicit `targets` like `{"320px":"20px","1920px":"60px"}` — server generates arithmetically-correct `clamp()` instead of hand-written math that silently under-reaches the stated max. All-px inputs emit px (root-agnostic). Rem inputs OR rem output require explicit opt-in: pass `output_unit="rem"` (accepts the 1rem=16px default) or `root_font_size_px:N` (declares your site's actual root font-size, e.g. `10` for `html { font-size: 62.5% }`, `20` for `html { font-size: 20px }`) |
 | `diviops_delete_variable` | Delete a variable by ID. Returns HTTP 409 when live references exist unless `force=true` (use `diviops_variables_scan_orphans` to find reference locations). Returns HTTP 403 for Divi's customizer-bound defaults (`gcid-primary-color`, `gcid-secondary-color`, `gcid-heading-color`, `gcid-body-color`, `gcid-link-color` — managed via WP Customizer) |
 | `diviops_create_canvas` | Create a canvas page |
 | `diviops_update_canvas` | Update canvas content |

package/dist/compatibility.d.ts

@@ -2,7 +2,7 @@
  * Version compatibility between MCP server and WP plugin.
  */
 /** Minimum WP plugin version this server requires. */
-export declare const MIN_PLUGIN_VERSION = "1.0.0-beta.28";
+export declare const MIN_PLUGIN_VERSION = "1.0.0-beta.30";
 /**
  * Compare two semver-like version strings (supports pre-release tags).
  *

package/dist/compatibility.js

@@ -2,7 +2,7 @@
  * Version compatibility between MCP server and WP plugin.
  */
 /** Minimum WP plugin version this server requires. */
-export const MIN_PLUGIN_VERSION = '1.0.0-beta.28';
+export const MIN_PLUGIN_VERSION = '1.0.0-beta.30';
 /**
  * Compare two semver-like version strings (supports pre-release tags).
  *

package/dist/index.js

@@ -14,6 +14,7 @@ import { z } from "zod";
 import { WPClient } from "./wp-client.js";
 import { optimizeSchema } from "./schema-optimizer.js";
 import { createWpCli } from "./wp-cli.js";
+import { findForeignVarRefs, scanAttrsForForeignVarRefs, isolationErrorResult, } from "./validate-attrs.js";
 import { readFileSync, readdirSync } from "fs";
 import { join, dirname } from "path";
 import { fileURLToPath } from "url";
@@ -240,6 +241,9 @@ server.registerTool("diviops_update_page_content", {
             .describe("Full page content in WordPress block markup format (<!-- wp:divi/section -->...<!-- /wp:divi/section -->)"),
     },
 }, async ({ page_id, content }) => {
+    const hits = findForeignVarRefs(content, "content");
+    if (hits.length > 0)
+        return isolationErrorResult("diviops_update_page_content", hits);
     const result = await wp.request(`/page/${page_id}/content`, {
         method: "POST",
         body: { content },
@@ -296,6 +300,9 @@ server.registerTool("diviops_append_section", {
             .describe('Where to insert: "start" or "end" (default)'),
     },
 }, async ({ page_id, content, position }) => {
+    const hits = findForeignVarRefs(content, "content");
+    if (hits.length > 0)
+        return isolationErrorResult("diviops_append_section", hits);
     const result = await wp.request(`/page/${page_id}/append`, {
         method: "POST",
         body: { content, position: position ?? "end" },
@@ -330,6 +337,9 @@ server.registerTool("diviops_replace_section", {
             .describe("Which match to target (1-based, default: 1)"),
     },
 }, async ({ page_id, label, match_text, content, occurrence }) => {
+    const hits = findForeignVarRefs(content, "content");
+    if (hits.length > 0)
+        return isolationErrorResult("diviops_replace_section", hits);
     const body = { content, occurrence };
     if (label)
         body.label = label;
@@ -443,6 +453,9 @@ server.registerTool("diviops_update_module", {
             .describe("Attribute paths (dot notation) and their new values"),
     },
 }, async ({ page_id, label, match_text, auto_index, occurrence, attrs }) => {
+    const hits = scanAttrsForForeignVarRefs(attrs);
+    if (hits.length > 0)
+        return isolationErrorResult("diviops_update_module", hits);
     const body = { attrs };
     if (auto_index)
         body.auto_index = auto_index;
@@ -552,6 +565,11 @@ server.registerTool("diviops_create_page", {
             .describe("Post status"),
     },
 }, async ({ title, content, status }) => {
+    if (content) {
+        const hits = findForeignVarRefs(content, "content");
+        if (hits.length > 0)
+            return isolationErrorResult("diviops_create_page", hits);
+    }
     const result = await wp.request("/page/create", {
         method: "POST",
         body: { title, content: content ?? "", status: status ?? "draft" },
@@ -1285,7 +1303,7 @@ server.registerTool("diviops_list_variables", {
     };
 });
 server.registerTool("diviops_create_variable", {
-    description: 'Create a design token variable in the Divi Variable Manager. Colors (type "colors") use gcid-* IDs and hex values. Numbers/strings/etc use gvid-* IDs. For type="numbers" fluid tokens, pass min+max shorthand (anchors default to 320px/1920px) or explicit targets — server generates arithmetically-correct clamp() formulas. Px inputs only in this MVP; rem inputs must be converted to px (1rem=16px) before calling. Mutually exclusive with value.',
+    description: 'Create a design token variable in the Divi Variable Manager. Colors (type "colors") use gcid-* IDs and hex values. Numbers/strings/etc use gvid-* IDs. For type="numbers" fluid tokens, pass min+max shorthand (anchors default to 320px/1920px) or explicit targets — server generates arithmetically-correct clamp() formulas. All-px inputs emit px (safe default, root-agnostic). Rem inputs OR rem output require explicit opt-in: pass output_unit="rem" (accepts the 1rem=16px default) or root_font_size_px:N (declares your site\'s actual root font-size for correct rem emission on non-16px-root sites). Mutually exclusive with value.',
     inputSchema: {
         type: z
             .enum(["colors", "numbers", "strings", "images", "links", "fonts"])
@@ -1304,20 +1322,29 @@ server.registerTool("diviops_create_variable", {
         min: z
             .string()
             .optional()
-            .describe('Fluid minimum value in px (e.g. "20px"). Paired with max. Anchors default to 320px/1920px. type="numbers" only. Rem not supported — convert to px (1rem=16px) before calling.'),
+            .describe('Fluid minimum value (e.g. "20px" or "1.25rem"). Paired with max. Anchors default to 320px/1920px. Rem inputs require explicit opt-in via output_unit or root_font_size_px. type="numbers" only.'),
         max: z
             .string()
             .optional()
-            .describe('Fluid maximum value in px (e.g. "60px"). Paired with min.'),
+            .describe('Fluid maximum value (e.g. "60px" or "3.75rem"). Paired with min.'),
         targets: z
             .record(z.string(), z.string())
             .refine((m) => !m || Object.keys(m).length === 2, {
             message: "targets must contain exactly 2 viewport entries",
         })
             .optional()
-            .describe('Explicit two-anchor fluid spec, px only. Example: {"320px":"20px","1920px":"60px"} → clamp(20px, 12px + 2.5vw, 60px). Exactly 2 entries required. type="numbers" only. Mutually exclusive with min/max.'),
+            .describe('Explicit two-anchor fluid spec, object keyed by viewport width (px only). Example: {"320px":"20px","1920px":"60px"} → clamp(20px, 12px + 2.5vw, 60px). Exactly 2 entries required. type="numbers" only. Mutually exclusive with min/max. Rem values require explicit opt-in via output_unit or root_font_size_px.'),
+        output_unit: z
+            .enum(["rem", "px"])
+            .optional()
+            .describe('Unit for generated clamp formula. Omit for all-px inputs (safe default — emits px, root-agnostic). Pass "rem" to emit rem (accepts the 1rem=16px assumption unless root_font_size_px is also passed); required when inputs include rem unless root_font_size_px is passed. Pass "px" to force px output regardless of input unit.'),
+        root_font_size_px: z
+            .number()
+            .positive()
+            .optional()
+            .describe("Site's root font-size in px (positive number), used for correct rem↔px conversion in the generated clamp() formula. Defaults to 16 (standard browser default) when omitted. Pass explicitly for sites that customize `html { font-size }` (e.g. 10 for `html { font-size: 62.5% }`, 20 for `html { font-size: 20px }`). Also counts as an opt-in signal for rem emission — passing it alone (without output_unit) implies rem output. Only applies when min/max/targets is used."),
     },
-}, async ({ type, id, label, value, min, max, targets }) => {
+}, async ({ type, id, label, value, min, max, targets, output_unit, root_font_size_px, }) => {
     const body = { type, label };
     if (value !== undefined)
         body.value = value;
@@ -1329,6 +1356,10 @@ server.registerTool("diviops_create_variable", {
         body.max = max;
     if (targets !== undefined)
         body.targets = targets;
+    if (output_unit !== undefined)
+        body.output_unit = output_unit;
+    if (root_font_size_px !== undefined)
+        body.root_font_size_px = root_font_size_px;
     const result = await wp.request("/variable/create", {
         method: "POST",
         body,

package/dist/validate-attrs.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Isolation-rule validator: bans cross-system var(--alias) refs in Divi
+ * module attrs. See SKILL.md rule 8 and references/module-formats.md
+ * §"Design Token References in Attrs".
+ *
+ * CSS spec: var(--undeclared-name) with no fallback falls through to the
+ * property's initial value (0 for padding, browser default for color).
+ * Tool reports success, renderer emits ref as-is, page silently breaks.
+ *
+ * Only var() refs to gcid-* / gvid-* pass — Divi-owned namespaces that
+ * auto-resolve via :root. Any other alias is rejected.
+ */
+export interface ForeignVarRef {
+    alias: string;
+    snippet: string;
+    location?: string;
+}
+export declare function findForeignVarRefs(value: unknown, location?: string): ForeignVarRef[];
+export declare function scanAttrsForForeignVarRefs(attrs: Record<string, unknown>): ForeignVarRef[];
+export declare function formatIsolationError(tool: string, hits: ForeignVarRef[]): string;
+export declare function isolationErrorResult(tool: string, hits: ForeignVarRef[]): {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError: boolean;
+};

package/dist/validate-attrs.js

@@ -0,0 +1,63 @@
+/**
+ * Isolation-rule validator: bans cross-system var(--alias) refs in Divi
+ * module attrs. See SKILL.md rule 8 and references/module-formats.md
+ * §"Design Token References in Attrs".
+ *
+ * CSS spec: var(--undeclared-name) with no fallback falls through to the
+ * property's initial value (0 for padding, browser default for color).
+ * Tool reports success, renderer emits ref as-is, page silently breaks.
+ *
+ * Only var() refs to gcid-* / gvid-* pass — Divi-owned namespaces that
+ * auto-resolve via :root. Any other alias is rejected.
+ */
+const VAR_REF_RE = /var\(\s*--([A-Za-z_][A-Za-z0-9_-]*)/g;
+const ALLOWED_PREFIXES = ["gcid-", "gvid-"];
+export function findForeignVarRefs(value, location) {
+    if (typeof value !== "string" || value.length === 0)
+        return [];
+    const hits = [];
+    VAR_REF_RE.lastIndex = 0;
+    let m;
+    while ((m = VAR_REF_RE.exec(value)) !== null) {
+        const alias = m[1];
+        if (ALLOWED_PREFIXES.some((p) => alias.startsWith(p)))
+            continue;
+        hits.push({ alias, snippet: `var(--${alias})`, location });
+    }
+    return hits;
+}
+export function scanAttrsForForeignVarRefs(attrs) {
+    const hits = [];
+    for (const [path, value] of Object.entries(attrs)) {
+        hits.push(...findForeignVarRefs(value, path));
+    }
+    return hits;
+}
+export function formatIsolationError(tool, hits) {
+    const uniq = new Map();
+    for (const h of hits) {
+        const k = `${h.snippet}::${h.location ?? ""}`;
+        if (!uniq.has(k))
+            uniq.set(k, h);
+    }
+    const lines = [
+        `Isolation-rule violation in ${tool}: module attrs cannot reference non-Divi CSS aliases.`,
+        "",
+        "Offending refs:",
+        ...[...uniq.values()].map((h) => `  - ${h.snippet}${h.location ? `  (at ${h.location})` : ""}`),
+        "",
+        "Allowed: var(--gcid-*) and var(--gvid-*) (Divi-owned, auto-emitted to :root).",
+        'Canonical form: $variable({"type":"content","value":{"name":"gvid-your-token","settings":{}}})$',
+        "",
+        "Fix: register the token inside Divi Variable Manager (readable ID is fine, e.g. gvid-oa-space-3) and reference via $variable({...})$. See SKILL.md rule 8 / references/module-formats.md#design-token-references-in-attrs-canonical-variable-only.",
+    ];
+    return lines.join("\n");
+}
+export function isolationErrorResult(tool, hits) {
+    return {
+        content: [
+            { type: "text", text: formatIsolationError(tool, hits) },
+        ],
+        isError: true,
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diviops/mcp-server",
-  "version": "0.2.10",
+  "version": "0.2.12",
   "description": "MCP server exposing Divi 5 Visual Builder as tools for Claude",
   "type": "module",
   "main": "dist/index.js",