@diviops/mcp-server 0.2.11 → 0.2.12

package/dist/index.js

@@ -14,6 +14,7 @@ import { z } from "zod";
 import { WPClient } from "./wp-client.js";
 import { optimizeSchema } from "./schema-optimizer.js";
 import { createWpCli } from "./wp-cli.js";
+import { findForeignVarRefs, scanAttrsForForeignVarRefs, isolationErrorResult, } from "./validate-attrs.js";
 import { readFileSync, readdirSync } from "fs";
 import { join, dirname } from "path";
 import { fileURLToPath } from "url";
@@ -240,6 +241,9 @@ server.registerTool("diviops_update_page_content", {
             .describe("Full page content in WordPress block markup format (<!-- wp:divi/section -->...<!-- /wp:divi/section -->)"),
     },
 }, async ({ page_id, content }) => {
+    const hits = findForeignVarRefs(content, "content");
+    if (hits.length > 0)
+        return isolationErrorResult("diviops_update_page_content", hits);
     const result = await wp.request(`/page/${page_id}/content`, {
         method: "POST",
         body: { content },
@@ -296,6 +300,9 @@ server.registerTool("diviops_append_section", {
             .describe('Where to insert: "start" or "end" (default)'),
     },
 }, async ({ page_id, content, position }) => {
+    const hits = findForeignVarRefs(content, "content");
+    if (hits.length > 0)
+        return isolationErrorResult("diviops_append_section", hits);
     const result = await wp.request(`/page/${page_id}/append`, {
         method: "POST",
         body: { content, position: position ?? "end" },
@@ -330,6 +337,9 @@ server.registerTool("diviops_replace_section", {
             .describe("Which match to target (1-based, default: 1)"),
     },
 }, async ({ page_id, label, match_text, content, occurrence }) => {
+    const hits = findForeignVarRefs(content, "content");
+    if (hits.length > 0)
+        return isolationErrorResult("diviops_replace_section", hits);
     const body = { content, occurrence };
     if (label)
         body.label = label;
@@ -443,6 +453,9 @@ server.registerTool("diviops_update_module", {
             .describe("Attribute paths (dot notation) and their new values"),
     },
 }, async ({ page_id, label, match_text, auto_index, occurrence, attrs }) => {
+    const hits = scanAttrsForForeignVarRefs(attrs);
+    if (hits.length > 0)
+        return isolationErrorResult("diviops_update_module", hits);
     const body = { attrs };
     if (auto_index)
         body.auto_index = auto_index;
@@ -552,6 +565,11 @@ server.registerTool("diviops_create_page", {
             .describe("Post status"),
     },
 }, async ({ title, content, status }) => {
+    if (content) {
+        const hits = findForeignVarRefs(content, "content");
+        if (hits.length > 0)
+            return isolationErrorResult("diviops_create_page", hits);
+    }
     const result = await wp.request("/page/create", {
         method: "POST",
         body: { title, content: content ?? "", status: status ?? "draft" },

package/dist/validate-attrs.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Isolation-rule validator: bans cross-system var(--alias) refs in Divi
+ * module attrs. See SKILL.md rule 8 and references/module-formats.md
+ * §"Design Token References in Attrs".
+ *
+ * CSS spec: var(--undeclared-name) with no fallback falls through to the
+ * property's initial value (0 for padding, browser default for color).
+ * Tool reports success, renderer emits ref as-is, page silently breaks.
+ *
+ * Only var() refs to gcid-* / gvid-* pass — Divi-owned namespaces that
+ * auto-resolve via :root. Any other alias is rejected.
+ */
+export interface ForeignVarRef {
+    alias: string;
+    snippet: string;
+    location?: string;
+}
+export declare function findForeignVarRefs(value: unknown, location?: string): ForeignVarRef[];
+export declare function scanAttrsForForeignVarRefs(attrs: Record<string, unknown>): ForeignVarRef[];
+export declare function formatIsolationError(tool: string, hits: ForeignVarRef[]): string;
+export declare function isolationErrorResult(tool: string, hits: ForeignVarRef[]): {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError: boolean;
+};

package/dist/validate-attrs.js

@@ -0,0 +1,63 @@
+/**
+ * Isolation-rule validator: bans cross-system var(--alias) refs in Divi
+ * module attrs. See SKILL.md rule 8 and references/module-formats.md
+ * §"Design Token References in Attrs".
+ *
+ * CSS spec: var(--undeclared-name) with no fallback falls through to the
+ * property's initial value (0 for padding, browser default for color).
+ * Tool reports success, renderer emits ref as-is, page silently breaks.
+ *
+ * Only var() refs to gcid-* / gvid-* pass — Divi-owned namespaces that
+ * auto-resolve via :root. Any other alias is rejected.
+ */
+const VAR_REF_RE = /var\(\s*--([A-Za-z_][A-Za-z0-9_-]*)/g;
+const ALLOWED_PREFIXES = ["gcid-", "gvid-"];
+export function findForeignVarRefs(value, location) {
+    if (typeof value !== "string" || value.length === 0)
+        return [];
+    const hits = [];
+    VAR_REF_RE.lastIndex = 0;
+    let m;
+    while ((m = VAR_REF_RE.exec(value)) !== null) {
+        const alias = m[1];
+        if (ALLOWED_PREFIXES.some((p) => alias.startsWith(p)))
+            continue;
+        hits.push({ alias, snippet: `var(--${alias})`, location });
+    }
+    return hits;
+}
+export function scanAttrsForForeignVarRefs(attrs) {
+    const hits = [];
+    for (const [path, value] of Object.entries(attrs)) {
+        hits.push(...findForeignVarRefs(value, path));
+    }
+    return hits;
+}
+export function formatIsolationError(tool, hits) {
+    const uniq = new Map();
+    for (const h of hits) {
+        const k = `${h.snippet}::${h.location ?? ""}`;
+        if (!uniq.has(k))
+            uniq.set(k, h);
+    }
+    const lines = [
+        `Isolation-rule violation in ${tool}: module attrs cannot reference non-Divi CSS aliases.`,
+        "",
+        "Offending refs:",
+        ...[...uniq.values()].map((h) => `  - ${h.snippet}${h.location ? `  (at ${h.location})` : ""}`),
+        "",
+        "Allowed: var(--gcid-*) and var(--gvid-*) (Divi-owned, auto-emitted to :root).",
+        'Canonical form: $variable({"type":"content","value":{"name":"gvid-your-token","settings":{}}})$',
+        "",
+        "Fix: register the token inside Divi Variable Manager (readable ID is fine, e.g. gvid-oa-space-3) and reference via $variable({...})$. See SKILL.md rule 8 / references/module-formats.md#design-token-references-in-attrs-canonical-variable-only.",
+    ];
+    return lines.join("\n");
+}
+export function isolationErrorResult(tool, hits) {
+    return {
+        content: [
+            { type: "text", text: formatIsolationError(tool, hits) },
+        ],
+        isError: true,
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diviops/mcp-server",
-  "version": "0.2.11",
+  "version": "0.2.12",
   "description": "MCP server exposing Divi 5 Visual Builder as tools for Claude",
   "type": "module",
   "main": "dist/index.js",