@respira/wordpress-mcp-server 7.2.10 → 7.2.12

package/dist/server.d.ts

@@ -15,6 +15,9 @@ export declare class RespiraWordPressServer {
     private allowedSites;
     /** Whether the plugin version warning has already been shown this session. */
     private versionWarningShown;
+    /** Epoch ms of the last account site-list refresh (throttle network calls). */
+    private lastSiteRefreshAt;
+    private static readonly SITE_REFRESH_MIN_INTERVAL_MS;
     private static readonly MCP_SERVER_VERSION;
     /**
      * Normalize a tool name: respira_* → wordpress_* for switch dispatch.
@@ -28,6 +31,26 @@ export declare class RespiraWordPressServer {
     private generateDualTools;
     constructor(siteConfigs: WordPressSiteConfig[], enabledTools?: string[]);
     private getSiteSummary;
+    /**
+     * Re-pull the account's CURRENT site list from respira.press and merge in any
+     * sites that aren't in the running server yet.
+     *
+     * Why this exists: the server boots from whatever site list was in its config
+     * at startup. When the user adds a site on the dashboard afterwards, a
+     * long-lived server (Cowork especially) never learns about it and silently
+     * serves the stale list — Emil had 4 sites but Cowork only ever saw 3
+     * (2026-06-30). Rather than make the user re-paste config and restart, this
+     * lets list_sites self-heal: authenticate with a `respira_site_` token the
+     * server already holds, fetch the account's canonical config, and register
+     * any new sites in-memory (and persist to ~/.respira/config.json when that is
+     * the active source).
+     *
+     * Best-effort and throttled: a network/auth failure is swallowed and the
+     * existing list is returned unchanged. Servers with no site token (OAuth-only)
+     * or pinned to RESPIRA_CONFIG_B64 still get the in-session merge; only the
+     * on-disk persistence is skipped when the file is not the active source.
+     */
+    private refreshSitesFromAccount;
     /**
      * N6 fix (v6.19.0): the response envelope `site` field must reflect the
      * client that ACTUALLY serviced the call, not the global default. Pre-fix,

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAoBH,OAAO,KAAK,EAAE,mBAAmB,EAAe,MAAM,kBAAkB,CAAC;AAqTzE,qBAAa,sBAAsB;IACjC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,WAAW,CAAgC;IACnD,OAAO,CAAC,KAAK,CAA2C;IACxD,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,cAAc,CAAwB;IAC9C,OAAO,CAAC,YAAY,CAA4B;IAChD,8EAA8E;IAC9E,OAAO,CAAC,YAAY,CAA4B;IAChD,8EAA8E;IAC9E,OAAO,CAAC,mBAAmB,CAAS;IAEpC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAsB;IAEhE;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAWzB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;gBA4Bb,WAAW,EAAE,mBAAmB,EAAE,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE;IAsVvE,OAAO,CAAC,cAAc;IAItB;;;;;;;;;OASG;IACH,OAAO,CAAC,oBAAoB;IAkB5B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,aAAa;IA4BrB,gEAAgE;IAChE,OAAO,CAAC,aAAa;IAUrB;;;;;;OAMG;YACW,UAAU;IAgDxB;;;;;;;;;;;;;;OAcG;YACW,WAAW;IAiJzB;;;;;;;;;OASG;YACW,kBAAkB;IAyIhC;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,6BAA6B;IA0BrC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,yBAAyB;IA+BjC,OAAO,CAAC,eAAe;IAmBvB,OAAO,CAAC,aAAa;YA2QP,kBAAkB;YA6BlB,yBAAyB;IASvC;;;OAGG;IACH,OAAO,CAAC,oBAAoB;YAyBd,QAAQ;IAuwFtB;;;;;;OAMG;IACH,yEAAyE;IACzE,OAAO,CAAC,mBAAmB,CAAoD;IAC/E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAU;IAElD;;;;;;;;;OASG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAQ7C;IAEF;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAQ3C;IAEF,4EAA4E;IAC5E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,+BAA+B,CAAY;IAEnE,uEAAuE;IACvE,OAAO,CAAC,MAAM,CAAC,SAAS;YAWV,oBAAoB;YAqFpB,2BAA2B;IAazC;;;;OAIG;YACW,cAAc;IAY5B,OAAO,CAAC,mBAAmB;IAwT3B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAe3C;IAEF;;;;OAIG;IACH,OAAO,CAAC,0BAA0B;YAmCpB,cAAc;IAqG5B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,eAAe;YAuCT,gBAAgB;IA22B9B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAwUzB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IA6UxB,GAAG;CAyCV"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAoBH,OAAO,KAAK,EAAE,mBAAmB,EAAe,MAAM,kBAAkB,CAAC;AAsTzE,qBAAa,sBAAsB;IACjC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,WAAW,CAAgC;IACnD,OAAO,CAAC,KAAK,CAA2C;IACxD,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,cAAc,CAAwB;IAC9C,OAAO,CAAC,YAAY,CAA4B;IAChD,8EAA8E;IAC9E,OAAO,CAAC,YAAY,CAA4B;IAChD,8EAA8E;IAC9E,OAAO,CAAC,mBAAmB,CAAS;IACpC,+EAA+E;IAC/E,OAAO,CAAC,iBAAiB,CAAK;IAC9B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,4BAA4B,CAAU;IAE9D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAsB;IAEhE;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAWzB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;gBA4Bb,WAAW,EAAE,mBAAmB,EAAE,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE;IAsVvE,OAAO,CAAC,cAAc;IAItB;;;;;;;;;;;;;;;;;;OAkBG;YACW,uBAAuB;IA0GrC;;;;;;;;;OASG;IACH,OAAO,CAAC,oBAAoB;IAkB5B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,aAAa;IA4BrB,gEAAgE;IAChE,OAAO,CAAC,aAAa;IAUrB;;;;;;OAMG;YACW,UAAU;IAgDxB;;;;;;;;;;;;;;OAcG;YACW,WAAW;IAiJzB;;;;;;;;;OASG;YACW,kBAAkB;IAyIhC;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,6BAA6B;IA0BrC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,yBAAyB;IA+BjC,OAAO,CAAC,eAAe;IAmBvB,OAAO,CAAC,aAAa;YA2QP,kBAAkB;YA6BlB,yBAAyB;IASvC;;;OAGG;IACH,OAAO,CAAC,oBAAoB;YAyBd,QAAQ;IA+wFtB;;;;;;OAMG;IACH,yEAAyE;IACzE,OAAO,CAAC,mBAAmB,CAAoD;IAC/E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAU;IAElD;;;;;;;;;OASG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAQ7C;IAEF;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAQ3C;IAEF,4EAA4E;IAC5E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,+BAA+B,CAAY;IAEnE,uEAAuE;IACvE,OAAO,CAAC,MAAM,CAAC,SAAS;YAWV,oBAAoB;YAqFpB,2BAA2B;IAazC;;;;OAIG;YACW,cAAc;IAY5B,OAAO,CAAC,mBAAmB;IAwT3B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAe3C;IAEF;;;;OAIG;IACH,OAAO,CAAC,0BAA0B;YAmCpB,cAAc;IAqG5B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,eAAe;YAuCT,gBAAgB;IAw3B9B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAwUzB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IA6UxB,GAAG;CAyCV"}

package/dist/server.js

@@ -17,6 +17,7 @@ import { getBricksTools, dispatchBricksTool } from './bricks-tools.js';
 import { getElementorTools, dispatchElementorTool } from './elementor-tools.js';
 import { getAcfTools, ACF_TOOL_NAMES } from './acf-tools.js';
 import { getUsageEmitter, deriveToolKind } from './usage-emitter.js';
+import { loadConfig, saveConfig } from './config.js';
 /**
  * Per-tool argument aliases. AI clients (especially Cowork / Claude desktop)
  * frequently pass a natural-but-wrong key for a value: `pageId` / `page_id`
@@ -315,6 +316,9 @@ export class RespiraWordPressServer {
     allowedSites = null;
     /** Whether the plugin version warning has already been shown this session. */
     versionWarningShown = false;
+    /** Epoch ms of the last account site-list refresh (throttle network calls). */
+    lastSiteRefreshAt = 0;
+    static SITE_REFRESH_MIN_INTERVAL_MS = 60_000;
     static MCP_SERVER_VERSION = MCP_SERVER_VERSION;
     /**
      * Normalize a tool name: respira_* → wordpress_* for switch dispatch.
@@ -693,6 +697,124 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
     getSiteSummary(site) {
         return site.getSiteSummary(site.getSiteId() === this.defaultSiteId);
     }
+    /**
+     * Re-pull the account's CURRENT site list from respira.press and merge in any
+     * sites that aren't in the running server yet.
+     *
+     * Why this exists: the server boots from whatever site list was in its config
+     * at startup. When the user adds a site on the dashboard afterwards, a
+     * long-lived server (Cowork especially) never learns about it and silently
+     * serves the stale list — Emil had 4 sites but Cowork only ever saw 3
+     * (2026-06-30). Rather than make the user re-paste config and restart, this
+     * lets list_sites self-heal: authenticate with a `respira_site_` token the
+     * server already holds, fetch the account's canonical config, and register
+     * any new sites in-memory (and persist to ~/.respira/config.json when that is
+     * the active source).
+     *
+     * Best-effort and throttled: a network/auth failure is swallowed and the
+     * existing list is returned unchanged. Servers with no site token (OAuth-only)
+     * or pinned to RESPIRA_CONFIG_B64 still get the in-session merge; only the
+     * on-disk persistence is skipped when the file is not the active source.
+     */
+    async refreshSitesFromAccount(force = false) {
+        const result = { added: [] };
+        const now = Date.now();
+        if (!force && now - this.lastSiteRefreshAt < RespiraWordPressServer.SITE_REFRESH_MIN_INTERVAL_MS) {
+            return result;
+        }
+        // Pick a live dashboard site token to authenticate the refresh.
+        let authToken = '';
+        for (const client of this.sites.values()) {
+            const key = client.getApiKey();
+            if (typeof key === 'string' && key.startsWith('respira_site_')) {
+                authToken = key;
+                break;
+            }
+        }
+        if (!authToken) {
+            // OAuth-only or token-less server: nothing to authenticate with.
+            return result;
+        }
+        // Stamp before the network call so a hang/failure still respects the
+        // throttle and we don't retry on every single list_sites.
+        this.lastSiteRefreshAt = now;
+        const apiBase = process.env.RESPIRA_API_BASE || 'https://www.respira.press';
+        const url = `${apiBase.replace(/\/+$/, '')}/api/mcp/config/refresh`;
+        let payload = null;
+        try {
+            const response = await fetch(url, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ token: authToken }),
+                signal: AbortSignal.timeout(8000),
+            });
+            if (!response.ok) {
+                return result;
+            }
+            payload = await response.json().catch(() => null);
+        }
+        catch {
+            return result;
+        }
+        const accountSites = payload?.config?.sites;
+        if (!Array.isArray(accountSites)) {
+            return result;
+        }
+        for (const site of accountSites) {
+            if (!site?.id || !site?.url || !site?.apiKey)
+                continue;
+            if (this.sites.has(site.id))
+                continue;
+            const cfg = {
+                id: site.id,
+                name: site.name || site.id,
+                url: site.url,
+                apiKey: site.apiKey,
+                default: false,
+            };
+            const client = new WordPressClient(cfg);
+            this.sites.set(cfg.id, client);
+            if (this.currentSite === null) {
+                this.currentSite = client;
+                this.defaultSiteId = cfg.id;
+            }
+            try {
+                getUsageEmitter().registerSiteToken(cfg.url, cfg.apiKey);
+            }
+            catch {
+                // Best-effort; usage telemetry never blocks.
+            }
+            result.added.push(cfg.name);
+        }
+        // Persist new sites to disk so a restart keeps them — only when the file is
+        // the active config source. A RESPIRA_CONFIG_B64- or RESPIRA_CONFIG_FILE-
+        // pinned server still has the correct in-memory list this session; writing
+        // the default file would not be read on its next boot and could orphan a
+        // stray file, so skip it there.
+        const fileIsActiveSource = !process.env.RESPIRA_CONFIG_B64?.trim() && !process.env.RESPIRA_CONFIG_FILE?.trim();
+        if (result.added.length > 0 && fileIsActiveSource) {
+            try {
+                const onDisk = loadConfig();
+                const known = new Set(onDisk.sites.map((s) => s.id));
+                for (const site of accountSites) {
+                    if (site?.id && site?.url && site?.apiKey && !known.has(site.id)) {
+                        onDisk.sites.push({
+                            id: site.id,
+                            name: site.name || site.id,
+                            url: site.url,
+                            apiKey: site.apiKey,
+                            default: false,
+                        });
+                    }
+                }
+                saveConfig(onDisk);
+            }
+            catch {
+                // Best-effort; the in-memory merge above is what unblocks this session.
+            }
+        }
+        return result;
+    }
     /**
      * N6 fix (v6.19.0): the response envelope `site` field must reflect the
      * client that ACTUALLY serviced the call, not the global default. Pre-fix,
@@ -2141,7 +2263,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             },
             {
                 name: 'wordpress_inject_builder_content',
-                description: 'REPLACE (or append to) the entire page builder layout. WARNING: By default this REPLACES all existing content (use mode:"append" to add content without destroying existing elements). For editing a single module, use wordpress_update_module instead. Use exactly: gutenberg, divi, elementor, bricks, beaver, oxygen, breakdance, brizy, thrive, visual-composer, wpbakery. For Divi, divi_version is required ("4" or "5"). Replacing a page that already has content with mode="replace" requires confirm_replace=true, else returns 409 respira_replace_confirmation_required. Alternatives: mode="append" to add to existing content, or edit_target="live" to overwrite the live page directly. The gate prevents silent data loss.\n\nCanonical Divi 5 nested shape: `content: [{ type: "section", children: [{ type: "row", children: [{ type: "column", children: [{ type: "heading", settings: {...} }] }] }] }]` (rows/cols/columns/modules/elements/innerBlocks also accepted as `children` aliases). Each Divi module needs its render-critical attr in `settings` (e.g. heading→title, text→content, button→button_text); the plugin names any missing one via `respira_divi_required_attrs_missing`.',
+                description: 'REPLACE (or append to) the entire page builder layout. WARNING: By default this REPLACES all existing content (use mode:"append" to add content without destroying existing elements). For editing a single module, use wordpress_update_module instead. Use exactly: gutenberg, divi, elementor, bricks, beaver, oxygen, breakdance, brizy, thrive, visual-composer, wpbakery. For Divi, divi_version is required ("4" or "5"). Replacing a page that already has content with mode="replace" requires confirm_replace=true, else returns 409 respira_replace_confirmation_required. Alternatives: mode="append" to add to existing content, or edit_target="live" to overwrite the live page directly. The gate prevents silent data loss.\n\nCanonical Divi 5 nested shape: `content: [{ type: "section", children: [{ type: "row", children: [{ type: "column", children: [{ type: "heading", settings: {...} }] }] }] }]` (rows/cols/columns/modules/elements/innerBlocks also accepted as `children` aliases). Each Divi module needs its render-critical attr in `settings` (e.g. heading→title, text→content, button→button_text); the plugin names any missing one via `respira_divi_required_attrs_missing`.\n\nLARGE SECTIONS (payload cap): if a fully styled section is too big to send in one call (some AI clients cap tool-call payload size), build it in pieces with `target_path`. First create the section frame (the section + rows + empty columns) in one small call, then append each module into its column with separate small calls: `target_path: "sections[0].rows[0].columns[1]"`, `position: -1` (append to end). Get exact bracket paths from `extract_builder_content`. Do NOT split one section across multiple top-level `mode:"append"` calls — append adds each call as a NEW section, so you would get several sections instead of one. `target_path` insert is supported on Divi 5 today; on other builders it returns `respira_target_path_unsupported` (use the lean-skeleton + `update_module` approach there).',
                 inputSchema: {
                     type: 'object',
                     properties: {
@@ -2176,6 +2298,14 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                             description: 'Divi generation hint ("4" for shortcode format, "5" for block format). Required for all Divi inject calls.',
                             enum: ['4', '5'],
                         },
+                        target_path: {
+                            type: 'string',
+                            description: 'Insert the content as children of the container at this bracket path (from extract_builder_content), e.g. "sections[0].rows[1].columns[0]", instead of at page top level. Use this to build a large section in small calls when the whole tree exceeds the AI client payload cap: create the section frame first, then append each module by target_path. Omit for normal whole-page inject. Supported on Divi 5 today; other builders return respira_target_path_unsupported.',
+                        },
+                        position: {
+                            type: 'number',
+                            description: 'Where to insert within the target_path container: -1 (default) appends to the end, 0 inserts first, N inserts at index N. Only used when target_path is set.',
+                        },
                     },
                     required: ['builder', 'page_id', 'content'],
                 },
@@ -5041,6 +5171,10 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                     ? await client.getSiteContext()
                     : await client.getCompactSiteContext();
             case 'wordpress_list_sites': {
+                // Self-heal a stale list: re-pull the account's current sites so a site
+                // added on the dashboard after this server booted shows up without a
+                // re-paste or restart. Best-effort and throttled; never blocks the list.
+                const refresh = await this.refreshSitesFromAccount().catch(() => ({ added: [] }));
                 const allSites = Array.from(this.sites.values());
                 const visibleSites = allSites.filter((site) => this.isSiteAllowed(site));
                 // v6.17.2: surface hidden sites so the AI can explain
@@ -5053,6 +5187,13 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                 return {
                     sites: visibleSites.map((site) => this.getSiteSummary(site)),
                     active_site: this.getActiveSiteSummary(),
+                    ...(refresh.added.length > 0
+                        ? {
+                            refreshed_note: `Picked up ${refresh.added.length} newly added site${refresh.added.length === 1 ? '' : 's'} from your respira.press account: ${refresh.added.join(', ')}.${process.env.RESPIRA_CONFIG_B64?.trim()
+                                ? ' This server is pinned to the RESPIRA_CONFIG_B64 env var, so update that env to keep these sites after a restart.'
+                                : ''}`,
+                        }
+                        : {}),
                     ...(hiddenSites.length > 0
                         ? {
                             hidden_by_filter: hiddenSites,
@@ -5194,7 +5335,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                 return await client.getBuilderInlineSchemas(args.builder, args.types);
             case 'wordpress_inject_builder_content':
                 return hoistDroppedStylingWarnings({
-                    ...(await client.injectBuilderContent(args.builder, args.page_id, args.content, args.divi_version, args.edit_target, args.mode, args.confirm_replace)),
+                    ...(await client.injectBuilderContent(args.builder, args.page_id, args.content, args.divi_version, args.edit_target, args.mode, args.confirm_replace, args.target_path, args.position)),
                     respira_approvals_url: client.getApprovalsUrl(),
                 });
             case 'wordpress_make_responsive':