@diviops/mcp-server 0.2.18 → 0.2.19

package/README.md

@@ -9,7 +9,8 @@ Claude Code <-> MCP Server (stdio) <-> WordPress REST API <-> Divi MCP Plugin
 ## Requirements
 
 - **Node.js** >= 18.0.0
-- **WordPress** >= 5.6 (Application Passwords support)
+- **PHP** >= 7.4
+- **WordPress** >= 6.5
 - **Divi 5** theme active
 - **DiviOps Agent** WordPress plugin installed and active
 
@@ -175,6 +176,8 @@ Read-only commands plus non-destructive writes needed for core MCP functionality
 | Cache | `cache flush`, `transient delete`, `rewrite flush` |
 | Export | `export` (WXR data export to file) |
 | Info | `cron event list`, `plugin list`, `theme list`, `menu list`, `site url` |
+| Core (read-only) | `core version`, `core check-update`, `core is-installed`, `core verify-checksums`, `core language list` |
+| DB (introspection) | `db columns`, `db size`, `db tables`, `db check`, `db search` |
 
 ### Extended commands (opt-in)
 

package/dist/wp-client.js

@@ -5,6 +5,48 @@
  * Generate one at: WP Admin → Users → Your Profile → Application Passwords.
  */
 import { MIN_PLUGIN_VERSION, compareVersions, } from './compatibility.js';
+/**
+ * Normalize over-escaped variable-token quote sequences inside `$variable(...)$`
+ * token regions only.
+ *
+ * Divi block-attrs JSON uses `\"` (2-byte) for inner quotes inside Divi variable
+ * tokens. Two over-escaped forms can leak in via callers that round-trip
+ * pre-existing broken bytes:
+ *   - `\u0022` (11 bytes literal) — the mass-corruption form (backslash
+ *     itself unicode-escaped, observed in the wild on Divi 5.3.x sites)
+ *   - `\\u0022`     (7 bytes literal) — produced when a caller passes the
+ *     6-byte `"` form through an extra JSON-encoding layer
+ *
+ * Both decode to the same value after Divi's resolver, but cause render asymmetry
+ * across attr paths (`background.color`, `spacing.margin`, `border.color`,
+ * `layout.columnGap` silently fail to resolve). We normalize defensively so any
+ * write — clean or pre-broken — settles on canonical bytes.
+ *
+ * Scope is intentionally narrow: rewrites only happen inside `$variable(...)$`
+ * regions (Divi's actual resolver boundary). Bytes outside those regions —
+ * arbitrary user text, code samples, string-variable values that happen to
+ * contain `\u0022` — are left untouched.
+ */
+function normalizeQuoteEscapes(s) {
+    return s.replace(/\$variable\([^$]*?\)\$/g, (token) => token.replace(/(?:\\u005cu0022|\\\\u0022)/g, '\\"'));
+}
+function normalizeBody(value) {
+    if (typeof value === 'string')
+        return normalizeQuoteEscapes(value);
+    if (Array.isArray(value))
+        return value.map(normalizeBody);
+    // Restrict recursion to plain objects so Date / RegExp / class instances
+    // with custom `toJSON` keep their canonical serialization.
+    if (value &&
+        typeof value === 'object' &&
+        Object.getPrototypeOf(value) === Object.prototype) {
+        const out = {};
+        for (const [k, v] of Object.entries(value))
+            out[k] = normalizeBody(v);
+        return out;
+    }
+    return value;
+}
 export class WPClient {
     baseUrl;
     authHeader;
@@ -34,7 +76,7 @@ export class WPClient {
             },
         };
         if (body && method !== 'GET') {
-            fetchOptions.body = JSON.stringify(body);
+            fetchOptions.body = JSON.stringify(normalizeBody(body));
         }
         const response = await fetch(url, fetchOptions);
         if (!response.ok) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diviops/mcp-server",
-  "version": "0.2.18",
+  "version": "0.2.19",
   "description": "MCP server exposing Divi 5 Visual Builder as tools for Claude",
   "type": "module",
   "main": "dist/index.js",