@diviops/mcp-server 0.2.11 → 0.2.13

package/dist/compatibility.d.ts

@@ -2,7 +2,7 @@
  * Version compatibility between MCP server and WP plugin.
  */
 /** Minimum WP plugin version this server requires. */
-export declare const MIN_PLUGIN_VERSION = "1.0.0-beta.30";
+export declare const MIN_PLUGIN_VERSION = "1.0.0-beta.31";
 /**
  * Compare two semver-like version strings (supports pre-release tags).
  *

package/dist/compatibility.js

@@ -2,7 +2,7 @@
  * Version compatibility between MCP server and WP plugin.
  */
 /** Minimum WP plugin version this server requires. */
-export const MIN_PLUGIN_VERSION = '1.0.0-beta.30';
+export const MIN_PLUGIN_VERSION = '1.0.0-beta.31';
 /**
  * Compare two semver-like version strings (supports pre-release tags).
  *

package/dist/index.js

@@ -14,6 +14,7 @@ import { z } from "zod";
 import { WPClient } from "./wp-client.js";
 import { optimizeSchema } from "./schema-optimizer.js";
 import { createWpCli } from "./wp-cli.js";
+import { findForeignVarRefs, scanAttrsForForeignVarRefs, isolationErrorResult, } from "./validate-attrs.js";
 import { readFileSync, readdirSync } from "fs";
 import { join, dirname } from "path";
 import { fileURLToPath } from "url";
@@ -240,6 +241,9 @@ server.registerTool("diviops_update_page_content", {
             .describe("Full page content in WordPress block markup format (<!-- wp:divi/section -->...<!-- /wp:divi/section -->)"),
     },
 }, async ({ page_id, content }) => {
+    const hits = findForeignVarRefs(content, "content");
+    if (hits.length > 0)
+        return isolationErrorResult("diviops_update_page_content", hits);
     const result = await wp.request(`/page/${page_id}/content`, {
         method: "POST",
         body: { content },
@@ -296,6 +300,9 @@ server.registerTool("diviops_append_section", {
             .describe('Where to insert: "start" or "end" (default)'),
     },
 }, async ({ page_id, content, position }) => {
+    const hits = findForeignVarRefs(content, "content");
+    if (hits.length > 0)
+        return isolationErrorResult("diviops_append_section", hits);
     const result = await wp.request(`/page/${page_id}/append`, {
         method: "POST",
         body: { content, position: position ?? "end" },
@@ -330,6 +337,9 @@ server.registerTool("diviops_replace_section", {
             .describe("Which match to target (1-based, default: 1)"),
     },
 }, async ({ page_id, label, match_text, content, occurrence }) => {
+    const hits = findForeignVarRefs(content, "content");
+    if (hits.length > 0)
+        return isolationErrorResult("diviops_replace_section", hits);
     const body = { content, occurrence };
     if (label)
         body.label = label;
@@ -443,6 +453,9 @@ server.registerTool("diviops_update_module", {
             .describe("Attribute paths (dot notation) and their new values"),
     },
 }, async ({ page_id, label, match_text, auto_index, occurrence, attrs }) => {
+    const hits = scanAttrsForForeignVarRefs(attrs);
+    if (hits.length > 0)
+        return isolationErrorResult("diviops_update_module", hits);
     const body = { attrs };
     if (auto_index)
         body.auto_index = auto_index;
@@ -552,6 +565,11 @@ server.registerTool("diviops_create_page", {
             .describe("Post status"),
     },
 }, async ({ title, content, status }) => {
+    if (content) {
+        const hits = findForeignVarRefs(content, "content");
+        if (hits.length > 0)
+            return isolationErrorResult("diviops_create_page", hits);
+    }
     const result = await wp.request("/page/create", {
         method: "POST",
         body: { title, content: content ?? "", status: status ?? "draft" },
@@ -708,7 +726,7 @@ server.registerTool("diviops_preset_create", {
     };
 });
 server.registerTool("diviops_preset_reassign", {
-    description: 'Reassign a preset UUID across page content. Walks pages and rewrites modules referencing old_uuid in their modulePreset array to reference new_uuid. Optionally strips inline attrs that duplicate the new preset\'s attrs (otherwise inline wins over preset). Defaults to dry-run — set mode="apply" to actually rewrite. Use this to consolidate repeated inline styling into a reusable preset after creating one with diviops_preset_create.',
+    description: 'Reassign a preset UUID across page content. Covers both module-level refs (`attrs.modulePreset[...]`) and attribute-level group-preset refs (`attrs.groupPreset.<slot>.presetId`), plus — for group presets — registry chain refs in other presets\' `attrs.groupPresets.<slot>.presetId`. The `scope` param controls which ref types are walked (default "both", auto-selects based on new_uuid\'s bucket). Cross-bucket swaps (module ↔ group) are rejected. For module-scope swaps, optionally strips inline attrs that duplicate the new preset\'s attrs (otherwise inline wins over preset); slot-scoped inline strip for group scope is not yet implemented and is skipped with an advisory. Defaults to dry-run — set mode="apply" to actually rewrite. Use this to consolidate repeated inline styling into a reusable preset after creating one with diviops_preset_create.',
     inputSchema: {
         old_uuid: z
             .string()
@@ -724,15 +742,26 @@ server.registerTool("diviops_preset_reassign", {
             .enum(["dry-run", "apply"])
             .optional()
             .default("dry-run")
-            .describe('"dry-run" (default) returns the diff without writing. "apply" rewrites page content.'),
+            .describe('"dry-run" (default) returns the diff without writing. "apply" rewrites page content (and registry chains for group-scope swaps).'),
         strip_inline: z
             .boolean()
             .optional()
             .default(true)
-            .describe("If true (default), strip inline attrs that deep-equal the new preset's attrs so the preset actually takes effect. Set false to swap UUIDs only."),
+            .describe("If true (default), strip inline attrs that deep-equal the new preset's attrs so the preset actually takes effect. Applies to module-scope swaps only; group-scope swaps currently skip strip with an advisory in the summary. Set false to swap UUIDs only."),
+        scope: z
+            .enum(["module", "group", "both"])
+            .optional()
+            .default("both")
+            .describe('"module" walks `attrs.modulePreset[...]` only. "group" walks `attrs.groupPreset.<slot>.presetId` plus registry chain refs (`attrs.groupPresets.<slot>.presetId` in other presets). "both" (default) auto-selects based on new_uuid\'s bucket — module/group identity is disjoint, so there is one valid walk per swap. An explicit "module" or "group" rejects if new_uuid is in the wrong bucket.'),
     },
-}, async ({ old_uuid, new_uuid, page_ids, mode, strip_inline }) => {
-    const body = { old_uuid, new_uuid, mode, strip_inline };
+}, async ({ old_uuid, new_uuid, page_ids, mode, strip_inline, scope }) => {
+    const body = {
+        old_uuid,
+        new_uuid,
+        mode,
+        strip_inline,
+        scope,
+    };
     if (page_ids)
         body.page_ids = page_ids;
     const result = await wp.request("/preset-reassign", {

package/dist/validate-attrs.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Isolation-rule validator: bans cross-system var(--alias) refs in Divi
+ * module attrs. See SKILL.md rule 8 and references/module-formats.md
+ * §"Design Token References in Attrs".
+ *
+ * CSS spec: var(--undeclared-name) with no fallback falls through to the
+ * property's initial value (0 for padding, browser default for color).
+ * Tool reports success, renderer emits ref as-is, page silently breaks.
+ *
+ * Only var() refs to gcid-* / gvid-* pass — Divi-owned namespaces that
+ * auto-resolve via :root. Any other alias is rejected.
+ */
+export interface ForeignVarRef {
+    alias: string;
+    snippet: string;
+    location?: string;
+}
+export declare function findForeignVarRefs(value: unknown, location?: string): ForeignVarRef[];
+export declare function scanAttrsForForeignVarRefs(attrs: Record<string, unknown>): ForeignVarRef[];
+export declare function formatIsolationError(tool: string, hits: ForeignVarRef[]): string;
+export declare function isolationErrorResult(tool: string, hits: ForeignVarRef[]): {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError: boolean;
+};

package/dist/validate-attrs.js

@@ -0,0 +1,63 @@
+/**
+ * Isolation-rule validator: bans cross-system var(--alias) refs in Divi
+ * module attrs. See SKILL.md rule 8 and references/module-formats.md
+ * §"Design Token References in Attrs".
+ *
+ * CSS spec: var(--undeclared-name) with no fallback falls through to the
+ * property's initial value (0 for padding, browser default for color).
+ * Tool reports success, renderer emits ref as-is, page silently breaks.
+ *
+ * Only var() refs to gcid-* / gvid-* pass — Divi-owned namespaces that
+ * auto-resolve via :root. Any other alias is rejected.
+ */
+const VAR_REF_RE = /var\(\s*--([A-Za-z_][A-Za-z0-9_-]*)/g;
+const ALLOWED_PREFIXES = ["gcid-", "gvid-"];
+export function findForeignVarRefs(value, location) {
+    if (typeof value !== "string" || value.length === 0)
+        return [];
+    const hits = [];
+    VAR_REF_RE.lastIndex = 0;
+    let m;
+    while ((m = VAR_REF_RE.exec(value)) !== null) {
+        const alias = m[1];
+        if (ALLOWED_PREFIXES.some((p) => alias.startsWith(p)))
+            continue;
+        hits.push({ alias, snippet: `var(--${alias})`, location });
+    }
+    return hits;
+}
+export function scanAttrsForForeignVarRefs(attrs) {
+    const hits = [];
+    for (const [path, value] of Object.entries(attrs)) {
+        hits.push(...findForeignVarRefs(value, path));
+    }
+    return hits;
+}
+export function formatIsolationError(tool, hits) {
+    const uniq = new Map();
+    for (const h of hits) {
+        const k = `${h.snippet}::${h.location ?? ""}`;
+        if (!uniq.has(k))
+            uniq.set(k, h);
+    }
+    const lines = [
+        `Isolation-rule violation in ${tool}: module attrs cannot reference non-Divi CSS aliases.`,
+        "",
+        "Offending refs:",
+        ...[...uniq.values()].map((h) => `  - ${h.snippet}${h.location ? `  (at ${h.location})` : ""}`),
+        "",
+        "Allowed: var(--gcid-*) and var(--gvid-*) (Divi-owned, auto-emitted to :root).",
+        'Canonical form: $variable({"type":"content","value":{"name":"gvid-your-token","settings":{}}})$',
+        "",
+        "Fix: register the token inside Divi Variable Manager (readable ID is fine, e.g. gvid-oa-space-3) and reference via $variable({...})$. See SKILL.md rule 8 / references/module-formats.md#design-token-references-in-attrs-canonical-variable-only.",
+    ];
+    return lines.join("\n");
+}
+export function isolationErrorResult(tool, hits) {
+    return {
+        content: [
+            { type: "text", text: formatIsolationError(tool, hits) },
+        ],
+        isError: true,
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diviops/mcp-server",
-  "version": "0.2.11",
+  "version": "0.2.13",
   "description": "MCP server exposing Divi 5 Visual Builder as tools for Claude",
   "type": "module",
   "main": "dist/index.js",