@respira/wordpress-mcp-server 6.17.1 → 6.18.0

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAkBH,OAAO,KAAK,EAAE,mBAAmB,EAAe,MAAM,kBAAkB,CAAC;AAyGzE,qBAAa,sBAAsB;IACjC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,WAAW,CAAgC;IACnD,OAAO,CAAC,KAAK,CAA2C;IACxD,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,cAAc,CAAwB;IAC9C,OAAO,CAAC,YAAY,CAA4B;IAChD,8EAA8E;IAC9E,OAAO,CAAC,YAAY,CAA4B;IAChD,8EAA8E;IAC9E,OAAO,CAAC,mBAAmB,CAAS;IAEpC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAsB;IAEhE;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAWzB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;gBA4Bb,WAAW,EAAE,mBAAmB,EAAE,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE;IAwRvE,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,oBAAoB;IAQ5B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,aAAa;IAmBrB,gEAAgE;IAChE,OAAO,CAAC,aAAa;IAUrB;;;;;;OAMG;YACW,UAAU;IA2CxB;;;;;;;;;;;;;;OAcG;YACW,WAAW;IAyIzB;;;;;;;;;OASG;YACW,kBAAkB;IA6FhC,OAAO,CAAC,eAAe;IAmBvB,OAAO,CAAC,aAAa;YA4MP,kBAAkB;YA6BlB,yBAAyB;IASvC;;;OAGG;IACH,OAAO,CAAC,oBAAoB;YAyBd,QAAQ;IA6tEtB;;;;;;OAMG;IACH,yEAAyE;IACzE,OAAO,CAAC,mBAAmB,CAAoD;IAC/E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAU;YAEpC,oBAAoB;YAqDpB,2BAA2B;IAazC;;;;OAIG;YACW,cAAc;IAY5B,OAAO,CAAC,mBAAmB;IAwT3B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAe3C;IAEF;;;;OAIG;IACH,OAAO,CAAC,0BAA0B;YAmCpB,cAAc;YA+Dd,gBAAgB;IA8lB9B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAoRzB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IA6UxB,GAAG;CAgBV"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAmBH,OAAO,KAAK,EAAE,mBAAmB,EAAe,MAAM,kBAAkB,CAAC;AAyGzE,qBAAa,sBAAsB;IACjC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,WAAW,CAAgC;IACnD,OAAO,CAAC,KAAK,CAA2C;IACxD,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,cAAc,CAAwB;IAC9C,OAAO,CAAC,YAAY,CAA4B;IAChD,8EAA8E;IAC9E,OAAO,CAAC,YAAY,CAA4B;IAChD,8EAA8E;IAC9E,OAAO,CAAC,mBAAmB,CAAS;IAEpC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAsB;IAEhE;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAWzB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;gBA4Bb,WAAW,EAAE,mBAAmB,EAAE,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE;IAuTvE,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,oBAAoB;IAQ5B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,aAAa;IAmBrB,gEAAgE;IAChE,OAAO,CAAC,aAAa;IAUrB;;;;;;OAMG;YACW,UAAU;IA2CxB;;;;;;;;;;;;;;OAcG;YACW,WAAW;IAyIzB;;;;;;;;;OASG;YACW,kBAAkB;IA6FhC,OAAO,CAAC,eAAe;IAmBvB,OAAO,CAAC,aAAa;YA4MP,kBAAkB;YA6BlB,yBAAyB;IASvC;;;OAGG;IACH,OAAO,CAAC,oBAAoB;YAyBd,QAAQ;IAmxEtB;;;;;;OAMG;IACH,yEAAyE;IACzE,OAAO,CAAC,mBAAmB,CAAoD;IAC/E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAU;YAEpC,oBAAoB;YAqDpB,2BAA2B;IAazC;;;;OAIG;YACW,cAAc;IAY5B,OAAO,CAAC,mBAAmB;IAwT3B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAe3C;IAEF;;;;OAIG;IACH,OAAO,CAAC,0BAA0B;YAmCpB,cAAc;YA+Dd,gBAAgB;IAqpB9B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAoRzB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IA6UxB,GAAG;CAyCV"}

package/dist/server.js

@@ -6,6 +6,7 @@
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { CallToolRequestSchema, ListToolsRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
+import { execSync } from 'child_process';
 import { readFileSync } from 'fs';
 import { dirname, resolve } from 'path';
 import { fileURLToPath } from 'url';
@@ -402,6 +403,16 @@ Use respira_get_builder_info first to detect which builder is active. Then use t
 - Direct edit mode: when enabled in settings, writes go straight to the original (skip duplicate workflow)
 - respira_validate_security — check content for XSS and security issues before saving
 
+## Theme files (CSS-family only, plugin 7.0.42+)
+
+For agencies that source-control a shared child theme stylesheet (e.g. vds/css/custom.css) across many sites: write the file on disk, not the Customizer Additional CSS post.
+
+- respira_read_theme_file — read a CSS / SCSS / LESS / JSON theme file
+- respira_write_theme_file — replace (or create) a theme file with new contents
+- respira_append_theme_file — append a block to an existing theme file
+
+Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of scope. 1 MiB cap per file. Requires the WP edit_themes capability on the user behind the API key.
+
 ## WooCommerce (when addon installed)
 
 21 tools for product management, categories, tags, orders, stock, and sales reports. All prefixed woocommerce_*.`,
@@ -412,6 +423,29 @@ Use respira_get_builder_info first to detect which builder is active. Then use t
         const allowedSitesEnv = process.env.RESPIRA_SITES;
         if (allowedSitesEnv) {
             this.allowedSites = new Set(allowedSitesEnv.split(',').map((s) => s.trim().toLowerCase()).filter(Boolean));
+            // v6.17.2: log the filter at startup so a "missing site" never silently
+            // confuses the customer again. Previously a stale RESPIRA_SITES env var
+            // (typically baked into Claude Desktop's claude_desktop_config.json by
+            // the connector deeplink at install time) would silently hide every
+            // configured site whose hostname wasn't on the allow-list, and the only
+            // way to discover this was to read the source. Now the dropped sites
+            // are listed in the bootstrap stderr so the customer sees them on
+            // every reconnect.
+            const hidden = siteConfigs
+                .map((s) => {
+                try {
+                    return new URL(s.url).hostname.toLowerCase();
+                }
+                catch {
+                    return null;
+                }
+            })
+                .filter((h) => h !== null && !this.allowedSites.has(h));
+            if (hidden.length > 0) {
+                console.error(`respira-mcp: RESPIRA_SITES filter active (allowed: ${[...this.allowedSites].join(', ')}). ` +
+                    `Hidden site${hidden.length === 1 ? '' : 's'}: ${hidden.join(', ')}. ` +
+                    `To show all, remove or update RESPIRA_SITES in claude_desktop_config.json.`);
+            }
         }
         // Initialize WordPress clients for each site
         siteConfigs.forEach((config) => {
@@ -1816,6 +1850,57 @@ Use respira_get_builder_info first to detect which builder is active. Then use t
                     required: ['content'],
                 },
             },
+            {
+                name: 'wordpress_read_theme_file',
+                description: 'Read the contents of a theme stylesheet on disk (CSS / SCSS / LESS / JSON only). Path is relative to wp-content/themes, e.g. `vds/css/custom.css`. Useful for diffing before a write and for handing the existing stylesheet to an LLM as context. Requires plugin v7.0.42+ and the user behind the API key must have the WP `edit_themes` capability. Returns content, content_md5, byte_size, mtime, theme_role (active_stylesheet | active_template | other), is_writable.',
+                inputSchema: {
+                    type: 'object',
+                    properties: {
+                        relative_path: {
+                            type: 'string',
+                            description: 'Path relative to wp-content/themes/. Example: `vds/css/custom.css`. No leading slash, no `..` segments. Extension must be one of: css, scss, less, json.',
+                        },
+                    },
+                    required: ['relative_path'],
+                },
+                readOnlyHint: true,
+            },
+            {
+                name: 'wordpress_write_theme_file',
+                description: 'Replace (or create) a theme stylesheet on disk with the given content. CSS / SCSS / LESS / JSON only. Creates any missing parent directories under the theme. Path is relative to wp-content/themes, e.g. `vds/css/custom.css`. Use this when the agency source-controls a shared child theme stylesheet and the agent needs to push CSS edits to the same file their human devs commit, not to the Customizer Additional CSS post. Requires plugin v7.0.42+ and the user behind the API key must have the WP `edit_themes` capability. Hard cap: 1 MiB per file. Returns bytes_written, content_md5, theme_role, mtime.',
+                inputSchema: {
+                    type: 'object',
+                    properties: {
+                        relative_path: {
+                            type: 'string',
+                            description: 'Path relative to wp-content/themes/. Example: `vds/css/custom.css`. No leading slash, no `..` segments. Extension must be one of: css, scss, less, json.',
+                        },
+                        content: {
+                            type: 'string',
+                            description: 'Full file contents. Up to 1 MiB. Existing file is fully replaced.',
+                        },
+                    },
+                    required: ['relative_path', 'content'],
+                },
+            },
+            {
+                name: 'wordpress_append_theme_file',
+                description: 'Append content to a theme stylesheet on disk. CSS / SCSS / LESS / JSON only. Adds a leading newline if the existing file did not end in one so two appended blocks do not fuse on the seam. If the file does not exist yet, behaves identically to write (creates it + any missing parent directories). Path is relative to wp-content/themes, e.g. `vds/css/custom.css`. Useful for adding per-page CSS to a shared theme stylesheet without rewriting the whole file. Requires plugin v7.0.42+ and the user behind the API key must have the WP `edit_themes` capability. Hard cap: post-append file size cannot exceed 1 MiB. Returns appended_bytes, total_bytes, content_md5, theme_role, mtime.',
+                inputSchema: {
+                    type: 'object',
+                    properties: {
+                        relative_path: {
+                            type: 'string',
+                            description: 'Path relative to wp-content/themes/. Example: `vds/css/custom.css`. No leading slash, no `..` segments. Extension must be one of: css, scss, less, json.',
+                        },
+                        content: {
+                            type: 'string',
+                            description: 'Block to append. Up to 1 MiB. Final file size after append cannot exceed 1 MiB.',
+                        },
+                    },
+                    required: ['relative_path', 'content'],
+                },
+            },
             {
                 name: 'wordpress_switch_site',
                 description: 'Switch to a different WordPress site in the active Respira multi-site configuration.',
@@ -3844,9 +3929,22 @@ Use respira_get_builder_info first to detect which builder is active. Then use t
             case 'wordpress_list_sites': {
                 const allSites = Array.from(this.sites.values());
                 const visibleSites = allSites.filter((site) => this.isSiteAllowed(site));
+                // v6.17.2: surface hidden sites so the AI can explain
+                // ("baymcp.com is configured but hidden by RESPIRA_SITES") instead
+                // of pretending they don't exist. The filter itself stays in place
+                // for security/scoping; this just makes it visible.
+                const hiddenSites = allSites
+                    .filter((site) => !this.isSiteAllowed(site))
+                    .map((site) => this.getSiteSummary(site));
                 return {
                     sites: visibleSites.map((site) => this.getSiteSummary(site)),
                     active_site: this.getActiveSiteSummary(),
+                    ...(hiddenSites.length > 0
+                        ? {
+                            hidden_by_filter: hiddenSites,
+                            filter_note: `${hiddenSites.length} site${hiddenSites.length === 1 ? '' : 's'} hidden by RESPIRA_SITES env var (allow-list: ${this.allowedSites ? [...this.allowedSites].join(', ') : 'none'}). To show, remove or update RESPIRA_SITES in claude_desktop_config.json.`,
+                        }
+                        : {}),
                 };
             }
             case 'wordpress_get_active_site':
@@ -3947,6 +4045,18 @@ Use respira_get_builder_info first to detect which builder is active. Then use t
                 };
             case 'wordpress_validate_security':
                 return await client.validateSecurity(args.content);
+            case 'wordpress_read_theme_file':
+                return await client.readThemeFile(args.relative_path);
+            case 'wordpress_write_theme_file':
+                return {
+                    ...(await client.writeThemeFile(args.relative_path, args.content)),
+                    respira_approvals_url: client.getApprovalsUrl(),
+                };
+            case 'wordpress_append_theme_file':
+                return {
+                    ...(await client.appendThemeFile(args.relative_path, args.content)),
+                    respira_approvals_url: client.getApprovalsUrl(),
+                };
             case 'wordpress_switch_site': {
                 const newSite = this.sites.get(args.site_id);
                 if (!newSite) {
@@ -3963,8 +4073,35 @@ Use respira_get_builder_info first to detect which builder is active. Then use t
                     site: this.getSiteSummary(newSite),
                 };
             }
-            case 'wordpress_diagnose_connection':
-                return await client.diagnoseConnection({ post_id: args.post_id, probe_timeout_ms: args.probe_timeout_ms });
+            case 'wordpress_diagnose_connection': {
+                const siteDiag = await client.diagnoseConnection({ post_id: args.post_id, probe_timeout_ms: args.probe_timeout_ms });
+                // v6.17.2: append process-level runtime info so version drift,
+                // orphan processes, and a stale RESPIRA_SITES filter become
+                // visible from a single tool call rather than requiring shell
+                // access. Origin: cekt-ro 2026-05-20 bug report (5 orphan
+                // processes flapping the tool catalog because npm exec ignored
+                // the @latest pin and bound to a homebrew v6.14.2 install).
+                const binaryPath = process.argv[1] || '<unknown>';
+                return {
+                    ...siteDiag,
+                    runtime: {
+                        version: MCP_SERVER_VERSION,
+                        pid: process.pid,
+                        binary_path: binaryPath,
+                        is_global_install: /\/opt\/homebrew\/|\/usr\/local\//.test(binaryPath),
+                        sibling_pids: findSiblingProcesses(),
+                        uptime_seconds: Math.round(process.uptime()),
+                        node_version: process.version,
+                    },
+                    filter: {
+                        RESPIRA_SITES_active: this.allowedSites !== null,
+                        allowed_hostnames: this.allowedSites ? [...this.allowedSites] : null,
+                        hidden_site_count: this.allowedSites
+                            ? Array.from(this.sites.values()).filter((s) => !this.isSiteAllowed(s)).length
+                            : 0,
+                    },
+                };
+            }
             // v6.17: docs full-text search. See searchDocs() below.
             case 'wordpress_search_docs':
                 return await this.searchDocs(String(args?.query || ''), Number(args?.limit ?? 5));
@@ -4869,7 +5006,61 @@ Use respira_get_builder_info first to detect which builder is active. Then use t
         })
             .filter((s) => !!s);
         const sitesLabel = siteNames.length ? siteNames.join(', ') : 'no sites configured';
-        console.error(`respira-mcp v${MCP_SERVER_VERSION} ready · ${siteNames.length} site${siteNames.length === 1 ? '' : 's'}: ${sitesLabel}`);
+        console.error(`respira-mcp v${MCP_SERVER_VERSION} ready · pid ${process.pid} · ${siteNames.length} site${siteNames.length === 1 ? '' : 's'}: ${sitesLabel}`);
+        // v6.17.2: detect orphan sibling processes from prior reconnect cycles
+        // and warn loudly. The Claude Code / Conductor MCP supervisor sometimes
+        // spawns a new server without reaping the previous one, leaving 5+
+        // parallel pairs alive that flap the tool catalog because each one
+        // ships a different feature set (see cekt-ro bug report 2026-05-20).
+        // We can't kill the siblings ourselves (they belong to the supervisor),
+        // but listing them makes the failure mode obvious instead of invisible.
+        warnAboutSiblingProcesses(findSiblingProcesses());
+        // v6.17.2: print the running binary path so a global homebrew /
+        // /usr/local install accidentally shadowing the `@latest` pin in
+        // claude_desktop_config.json becomes visible. npm exec strips the
+        // @version part of the spec when it resolves the binary, so a
+        // globally-installed older version will silently win over the
+        // registry's latest. Same cekt-ro bug report, bug 2.
+        const binaryPath = process.argv[1] || '<unknown>';
+        const isGlobal = /\/opt\/homebrew\/|\/usr\/local\//.test(binaryPath);
+        if (isGlobal) {
+            console.error(`respira-mcp: running from global install at ${binaryPath}. ` +
+                `If your claude_desktop_config.json pins @latest, npm exec is ignoring the pin and serving this older binary. ` +
+                `To unblock: 'npm uninstall -g @respira/wordpress-mcp-server' (or 'brew uninstall wordpress-mcp-server'), then reconnect.`);
+        }
+    }
+}
+/**
+ * v6.17.2: detect orphan wordpress-mcp-server processes from prior
+ * supervisor reconnect cycles. Pure function — does not log. Used by
+ * the boot warning and by respira_diagnose_connection so diagnose
+ * doesn't re-emit a stderr warning on every call.
+ */
+function findSiblingProcesses() {
+    try {
+        // ps -eo lists every process; awk filters to ones that contain
+        // 'wordpress-mcp-server' in their command and aren't our own PID.
+        const psOutput = execSync(`ps -eo pid,command 2>/dev/null | awk -v me=${process.pid} '$0 ~ /wordpress-mcp-server/ && $0 !~ /awk/ && $1 != me { print $1 }'`, { encoding: 'utf8', timeout: 2000, stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+        return psOutput
+            ? psOutput.split('\n').map((s) => parseInt(s.trim(), 10)).filter((n) => !Number.isNaN(n))
+            : [];
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * v6.17.2: emit a one-shot stderr warning at boot if any sibling
+ * wordpress-mcp-server processes are running. We can't kill them
+ * (they belong to the Claude Code / Conductor supervisor), but
+ * listing them makes the flapping-tool-catalog failure mode obvious.
+ * See cekt-ro bug report 2026-05-20.
+ */
+function warnAboutSiblingProcesses(pids) {
+    if (pids.length > 0) {
+        console.error(`respira-mcp: ${pids.length} other wordpress-mcp-server process${pids.length === 1 ? '' : 'es'} running (pid${pids.length === 1 ? '' : 's'}: ${pids.join(', ')}). ` +
+            `These are likely orphans from prior reconnects and may flap the tool catalog (different versions answering different calls). ` +
+            `To clean: pkill -f wordpress-mcp-server, then reconnect.`);
     }
 }
 //# sourceMappingURL=server.js.map