@respira/wordpress-mcp-server 7.4.0 → 7.4.1

package/dist/__tests__/site-list-self-heal.test.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Tests for the site-list self-heal (maybeSelfHealSiteList / performSiteRefresh).
+ *
+ * Background: the running MCP server boots from a frozen site list
+ * (RESPIRA_CONFIG_B64 env, which outranks the file, or ~/.respira/config.json,
+ * which Cowork's sandbox can't write). When a user adds a site on the
+ * dashboard, that frozen list never learns about it, so the site is invisible
+ * until the connector is deleted and reinstalled. Mario (3 sites) and Emil
+ * (4 sites, Cowork saw 3) both hit this. The fix re-pulls the account's current
+ * inventory from /api/mcp/config/refresh using a `respira_site_` token the
+ * server already holds and merges missing sites into the live map in-session.
+ *
+ * Private methods are reached through `as any` (compile-time-only constraint),
+ * matching the house convention in default-site-routing-notice.test.ts. `fetch`
+ * is stubbed on globalThis per test and restored after.
+ */
+export {};
+//# sourceMappingURL=site-list-self-heal.test.d.ts.map

package/dist/__tests__/site-list-self-heal.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"site-list-self-heal.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/site-list-self-heal.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG"}

package/dist/__tests__/site-list-self-heal.test.js

@@ -0,0 +1,169 @@
+/**
+ * Tests for the site-list self-heal (maybeSelfHealSiteList / performSiteRefresh).
+ *
+ * Background: the running MCP server boots from a frozen site list
+ * (RESPIRA_CONFIG_B64 env, which outranks the file, or ~/.respira/config.json,
+ * which Cowork's sandbox can't write). When a user adds a site on the
+ * dashboard, that frozen list never learns about it, so the site is invisible
+ * until the connector is deleted and reinstalled. Mario (3 sites) and Emil
+ * (4 sites, Cowork saw 3) both hit this. The fix re-pulls the account's current
+ * inventory from /api/mcp/config/refresh using a `respira_site_` token the
+ * server already holds and merges missing sites into the live map in-session.
+ *
+ * Private methods are reached through `as any` (compile-time-only constraint),
+ * matching the house convention in default-site-routing-notice.test.ts. `fetch`
+ * is stubbed on globalThis per test and restored after.
+ */
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { RespiraWordPressServer } from '../server.js';
+const SITE_A = {
+    id: 'simply1888-com',
+    name: 'Simply 1888',
+    url: 'https://simply1888.com',
+    apiKey: 'respira_site_aaa',
+    default: true,
+};
+function refreshPayload(sites) {
+    return {
+        ok: true,
+        json: async () => ({ success: true, config: { sites }, sites_count: sites.length }),
+    };
+}
+function stubFetch(impl) {
+    const prev = globalThis.fetch;
+    let seen = 0;
+    globalThis.fetch = async (url, init) => {
+        seen += 1;
+        return impl(url, init);
+    };
+    stubFetch.lastCount = () => seen;
+    return () => {
+        globalThis.fetch = prev;
+    };
+}
+test('self-heal adds a site that appeared on the dashboard after startup', async () => {
+    const server = new RespiraWordPressServer([SITE_A]);
+    const restore = stubFetch(async (url, init) => {
+        assert.match(url, /\/api\/mcp\/config\/refresh$/);
+        // it must authenticate with the respira_site_ token the server holds
+        assert.match(String(init.body), /respira_site_aaa/);
+        return refreshPayload([
+            { id: 'simply1888-com', url: 'https://simply1888.com', apiKey: 'respira_site_aaa', name: 'Simply 1888' },
+            { id: 'thebranchespsychology-com', url: 'https://thebranchespsychology.com', apiKey: 'respira_site_bbb', name: 'Branches' },
+        ]);
+    });
+    try {
+        const added = await server.maybeSelfHealSiteList(true);
+        assert.equal(added, 1, 'one new site should be merged');
+        assert.ok(server.sites.has('thebranchespsychology-com'), 'new site now in the live map');
+        assert.ok(server.sites.has('simply1888-com'), 'existing site untouched');
+    }
+    finally {
+        restore();
+    }
+});
+test('dedupes by normalized URL even when the frozen id differs from canonical', async () => {
+    const server = new RespiraWordPressServer([SITE_A]);
+    const restore = stubFetch(async () => 
+    // same site, different id + www + trailing slash: must NOT double-add
+    refreshPayload([
+        { id: 'simply1888-DIFFERENT-id', url: 'https://www.simply1888.com/', apiKey: 'respira_site_aaa', name: 'Simply 1888' },
+    ]));
+    try {
+        const added = await server.maybeSelfHealSiteList(true);
+        assert.equal(added, 0, 'same URL under a different id should not be re-added');
+        assert.equal(server.sites.size, 1);
+    }
+    finally {
+        restore();
+    }
+});
+test('throttles: a second unforced call within the window does not re-fetch', async () => {
+    const server = new RespiraWordPressServer([SITE_A]);
+    let calls = 0;
+    const restore = stubFetch(async () => {
+        calls += 1;
+        return refreshPayload([{ id: 'simply1888-com', url: 'https://simply1888.com', apiKey: 'respira_site_aaa' }]);
+    });
+    try {
+        await server.maybeSelfHealSiteList(true); // primes lastSiteRefreshAt
+        const added = await server.maybeSelfHealSiteList(false); // within 60s window
+        assert.equal(added, 0);
+        assert.equal(calls, 1, 'the throttled call must not hit the network');
+    }
+    finally {
+        restore();
+    }
+});
+test('no respira_site_ token in config → graceful no-op, no fetch', async () => {
+    const oauthOnly = {
+        id: 'oauth-site',
+        name: 'OAuth Site',
+        url: 'https://oauth.example',
+        apiKey: 'rsp_at_perSiteOAuthToken',
+        default: true,
+    };
+    const server = new RespiraWordPressServer([oauthOnly]);
+    let calls = 0;
+    const restore = stubFetch(async () => {
+        calls += 1;
+        return refreshPayload([]);
+    });
+    try {
+        const added = await server.maybeSelfHealSiteList(true);
+        assert.equal(added, 0);
+        assert.equal(calls, 0, 'must not call the backend without an account-wide token');
+    }
+    finally {
+        restore();
+    }
+});
+test('backend failure never throws and adds nothing', async () => {
+    const server = new RespiraWordPressServer([SITE_A]);
+    const restore = stubFetch(async () => ({ ok: false, status: 500, json: async () => ({}) }));
+    try {
+        const added = await server.maybeSelfHealSiteList(true);
+        assert.equal(added, 0, 'non-ok response yields 0 added');
+        assert.equal(server.sites.size, 1, 'existing sites remain');
+    }
+    finally {
+        restore();
+    }
+});
+test('network throw is swallowed (offline / firewall)', async () => {
+    const server = new RespiraWordPressServer([SITE_A]);
+    const restore = stubFetch(async () => {
+        throw new Error('ENOTFOUND');
+    });
+    try {
+        const added = await server.maybeSelfHealSiteList(true);
+        assert.equal(added, 0);
+    }
+    finally {
+        restore();
+    }
+});
+test('disabled via RESPIRA_DISABLE_SITE_REFRESH', async () => {
+    const prev = process.env.RESPIRA_DISABLE_SITE_REFRESH;
+    process.env.RESPIRA_DISABLE_SITE_REFRESH = '1';
+    const server = new RespiraWordPressServer([SITE_A]);
+    let calls = 0;
+    const restore = stubFetch(async () => {
+        calls += 1;
+        return refreshPayload([]);
+    });
+    try {
+        const added = await server.maybeSelfHealSiteList(true);
+        assert.equal(added, 0);
+        assert.equal(calls, 0, 'kill switch must short-circuit before any fetch');
+    }
+    finally {
+        restore();
+        if (prev === undefined)
+            delete process.env.RESPIRA_DISABLE_SITE_REFRESH;
+        else
+            process.env.RESPIRA_DISABLE_SITE_REFRESH = prev;
+    }
+});
+//# sourceMappingURL=site-list-self-heal.test.js.map

package/dist/__tests__/site-list-self-heal.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"site-list-self-heal.test.js","sourceRoot":"","sources":["../../src/__tests__/site-list-self-heal.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAGtD,MAAM,MAAM,GAAwB;IAClC,EAAE,EAAE,gBAAgB;IACpB,IAAI,EAAE,aAAa;IACnB,GAAG,EAAE,wBAAwB;IAC7B,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE,IAAI;CACd,CAAC;AAEF,SAAS,cAAc,CAAC,KAAwE;IAC9F,OAAO;QACL,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;KACpF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,IAA8C;IAC/D,MAAM,IAAI,GAAI,UAAkB,CAAC,KAAK,CAAC;IACvC,IAAI,IAAI,GAAG,CAAC,CAAC;IACZ,UAAkB,CAAC,KAAK,GAAG,KAAK,EAAE,GAAW,EAAE,IAAS,EAAE,EAAE;QAC3D,IAAI,IAAI,CAAC,CAAC;QACV,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC,CAAC;IACD,SAAiB,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC;IAC1C,OAAO,GAAG,EAAE;QACT,UAAkB,CAAC,KAAK,GAAG,IAAI,CAAC;IACnC,CAAC,CAAC;AACJ,CAAC;AAED,IAAI,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;IACpF,MAAM,MAAM,GAAG,IAAI,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC5C,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;QAClD,qEAAqE;QACrE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACpD,OAAO,cAAc,CAAC;YACpB,EAAE,EAAE,EAAE,gBAAgB,EAAE,GAAG,EAAE,wBAAwB,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,aAAa,EAAE;YACxG,EAAE,EAAE,EAAE,2BAA2B,EAAE,GAAG,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,UAAU,EAAE;SAC5H,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAO,MAAc,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAChE,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,+BAA+B,CAAC,CAAC;QACxD,MAAM,CAAC,EAAE,CAAE,MAAc,CAAC,KAAK,CAAC,GAAG,CAAC,2BAA2B,CAAC,EAAE,8BAA8B,CAAC,CAAC;QAClG,MAAM,CAAC,EAAE,CAAE,MAAc,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,yBAAyB,CAAC,CAAC;IACpF,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;IAC1F,MAAM,MAAM,GAAG,IAAI,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,IAAI,EAAE;IACnC,sEAAsE;IACtE,cAAc,CAAC;QACb,EAAE,EAAE,EAAE,yBAAyB,EAAE,GAAG,EAAE,6BAA6B,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,aAAa,EAAE;KACvH,CAAC,CACH,CAAC;IACF,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAO,MAAc,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAChE,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,sDAAsD,CAAC,CAAC;QAC/E,MAAM,CAAC,KAAK,CAAE,MAAc,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9C,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;IACvF,MAAM,MAAM,GAAG,IAAI,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,IAAI,EAAE;QACnC,KAAK,IAAI,CAAC,CAAC;QACX,OAAO,cAAc,CAAC,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,GAAG,EAAE,wBAAwB,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;IAC/G,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAO,MAAc,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,2BAA2B;QAC9E,MAAM,KAAK,GAAG,MAAO,MAAc,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,oBAAoB;QACtF,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACvB,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,6CAA6C,CAAC,CAAC;IACxE,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;IAC7E,MAAM,SAAS,GAAwB;QACrC,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,YAAY;QAClB,GAAG,EAAE,uBAAuB;QAC5B,MAAM,EAAE,0BAA0B;QAClC,OAAO,EAAE,IAAI;KACd,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,sBAAsB,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACvD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,IAAI,EAAE;QACnC,KAAK,IAAI,CAAC,CAAC;QACX,OAAO,cAAc,CAAC,EAAE,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAO,MAAc,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAChE,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACvB,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,yDAAyD,CAAC,CAAC;IACpF,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;IAC/D,MAAM,MAAM,GAAG,IAAI,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5F,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAO,MAAc,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAChE,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,gCAAgC,CAAC,CAAC;QACzD,MAAM,CAAC,KAAK,CAAE,MAAc,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,uBAAuB,CAAC,CAAC;IACvE,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;IACjE,MAAM,MAAM,GAAG,IAAI,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,IAAI,EAAE;QACnC,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAO,MAAc,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAChE,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACzB,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;IAC3D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,4BAA4B,GAAG,GAAG,CAAC;IAC/C,MAAM,MAAM,GAAG,IAAI,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,IAAI,EAAE;QACnC,KAAK,IAAI,CAAC,CAAC;QACX,OAAO,cAAc,CAAC,EAAE,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAO,MAAc,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAChE,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACvB,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,iDAAiD,CAAC,CAAC;IAC5E,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;QACV,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;;YACnE,OAAO,CAAC,GAAG,CAAC,4BAA4B,GAAG,IAAI,CAAC;IACvD,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/server.d.ts

@@ -15,6 +15,10 @@ export declare class RespiraWordPressServer {
     private allowedSites;
     /** Whether the plugin version warning has already been shown this session. */
     private versionWarningShown;
+    /** Epoch ms of the last site-list self-heal against respira.press (throttle). */
+    private lastSiteRefreshAt;
+    /** Dedupe concurrent self-heals so parallel list_sites calls share one fetch. */
+    private siteRefreshInFlight;
     private static readonly MCP_SERVER_VERSION;
     /**
      * Normalize a tool name: respira_* → wordpress_* for switch dispatch.
@@ -89,6 +93,37 @@ export declare class RespiraWordPressServer {
      * a structured error so the AI can explain the failure plainly.
      */
     private redeemInstallToken;
+    /**
+     * Self-heal the in-memory site list from respira.press.
+     *
+     * The running server boots from whatever site list was frozen into its
+     * config at startup (RESPIRA_CONFIG_B64 env, or ~/.respira/config.json).
+     * When the user later adds a site on the dashboard, that frozen list never
+     * learns about it: RESPIRA_CONFIG_B64 outranks the file (see loadConfig), and
+     * Cowork's sandbox can't even write the file, so `redeem` can't persist a new
+     * site there. The only workaround users found was deleting and reinstalling
+     * the connector for every new site (Mario, 3 sites; Emil, 4 sites Cowork saw
+     * as 3). That is the bug this fixes.
+     *
+     * Here we re-pull the account's CURRENT canonical inventory using a
+     * credential the server already holds (any one live `respira_site_` token)
+     * via /api/mcp/config/refresh, and merge any missing sites straight into the
+     * live `this.sites` map. Because the merge is in-memory it takes effect in
+     * the SAME session with no restart, no re-paste, and no file write, so it
+     * works identically under RESPIRA_CONFIG_B64 and inside Cowork's sandbox.
+     *
+     * Best-effort and non-blocking: any failure (offline, OAuth-only config with
+     * no site token, backend error, timeout) resolves to 0 added and never
+     * throws, so list_sites still returns the sites already known. Throttled to
+     * at most once per RESPIRA_SITE_REFRESH_THROTTLE_MS (default 60s) and
+     * deduped so parallel calls share one fetch.
+     *
+     * @returns number of newly added sites.
+     */
+    private maybeSelfHealSiteList;
+    private performSiteRefresh;
+    /** Normalize a site URL for cross-config dedupe: scheme/host only, no www, lowercase. */
+    private normalizeSiteUrl;
     /**
      * When a WRITE tool runs against the default site because the caller
      * omitted site_id and the account has more than one site connected,

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAoBH,OAAO,KAAK,EAAE,mBAAmB,EAAe,MAAM,kBAAkB,CAAC;AAkQzE,qBAAa,sBAAsB;IACjC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,WAAW,CAAgC;IACnD,OAAO,CAAC,KAAK,CAA2C;IACxD,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,cAAc,CAAwB;IAC9C,OAAO,CAAC,YAAY,CAA4B;IAChD,8EAA8E;IAC9E,OAAO,CAAC,YAAY,CAA4B;IAChD,8EAA8E;IAC9E,OAAO,CAAC,mBAAmB,CAAS;IAEpC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAsB;IAEhE;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAWzB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;gBA4Bb,WAAW,EAAE,mBAAmB,EAAE,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE;IAiVvE,OAAO,CAAC,cAAc;IAItB;;;;;;;;;OASG;IACH,OAAO,CAAC,oBAAoB;IAkB5B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,aAAa;IA4BrB,gEAAgE;IAChE,OAAO,CAAC,aAAa;IAUrB;;;;;;OAMG;YACW,UAAU;IA2CxB;;;;;;;;;;;;;;OAcG;YACW,WAAW;IAiJzB;;;;;;;;;OASG;YACW,kBAAkB;IAiHhC;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,6BAA6B;IA0BrC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,yBAAyB;IA+BjC,OAAO,CAAC,eAAe;IAmBvB,OAAO,CAAC,aAAa;YAmQP,kBAAkB;YA6BlB,yBAAyB;IASvC;;;OAGG;IACH,OAAO,CAAC,oBAAoB;YAyBd,QAAQ;IA+vFtB;;;;;;OAMG;IACH,yEAAyE;IACzE,OAAO,CAAC,mBAAmB,CAAoD;IAC/E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAU;YAEpC,oBAAoB;YAqDpB,2BAA2B;IAazC;;;;OAIG;YACW,cAAc;IAY5B,OAAO,CAAC,mBAAmB;IAkpC3B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAe3C;IAEF;;;;OAIG;IACH,OAAO,CAAC,0BAA0B;YAmCpB,cAAc;IAqG5B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,eAAe;YAuCT,gBAAgB;IA8iC9B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAwUzB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IA6UxB,GAAG;CAyCV"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAoBH,OAAO,KAAK,EAAE,mBAAmB,EAAe,MAAM,kBAAkB,CAAC;AAkQzE,qBAAa,sBAAsB;IACjC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,WAAW,CAAgC;IACnD,OAAO,CAAC,KAAK,CAA2C;IACxD,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,cAAc,CAAwB;IAC9C,OAAO,CAAC,YAAY,CAA4B;IAChD,8EAA8E;IAC9E,OAAO,CAAC,YAAY,CAA4B;IAChD,8EAA8E;IAC9E,OAAO,CAAC,mBAAmB,CAAS;IACpC,iFAAiF;IACjF,OAAO,CAAC,iBAAiB,CAAK;IAC9B,iFAAiF;IACjF,OAAO,CAAC,mBAAmB,CAAgC;IAE3D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAsB;IAEhE;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAWzB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;gBA4Bb,WAAW,EAAE,mBAAmB,EAAE,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE;IAiVvE,OAAO,CAAC,cAAc;IAItB;;;;;;;;;OASG;IACH,OAAO,CAAC,oBAAoB;IAkB5B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,aAAa;IA4BrB,gEAAgE;IAChE,OAAO,CAAC,aAAa;IAUrB;;;;;;OAMG;YACW,UAAU;IA2CxB;;;;;;;;;;;;;;OAcG;YACW,WAAW;IAiJzB;;;;;;;;;OASG;YACW,kBAAkB;IAiHhC;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;YACW,qBAAqB;YAiBrB,kBAAkB;IA6FhC,yFAAyF;IACzF,OAAO,CAAC,gBAAgB;IASxB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,6BAA6B;IA0BrC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,yBAAyB;IA+BjC,OAAO,CAAC,eAAe;IAmBvB,OAAO,CAAC,aAAa;YAmQP,kBAAkB;YA6BlB,yBAAyB;IASvC;;;OAGG;IACH,OAAO,CAAC,oBAAoB;YAyBd,QAAQ;IA+vFtB;;;;;;OAMG;IACH,yEAAyE;IACzE,OAAO,CAAC,mBAAmB,CAAoD;IAC/E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAU;YAEpC,oBAAoB;YAqDpB,2BAA2B;IAazC;;;;OAIG;YACW,cAAc;IAY5B,OAAO,CAAC,mBAAmB;IAkpC3B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAe3C;IAEF;;;;OAIG;IACH,OAAO,CAAC,0BAA0B;YAmCpB,cAAc;IAqG5B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,eAAe;YAuCT,gBAAgB;IAyjC9B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAwUzB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IA6UxB,GAAG;CAyCV"}

package/dist/server.js

@@ -263,6 +263,10 @@ export class RespiraWordPressServer {
     allowedSites = null;
     /** Whether the plugin version warning has already been shown this session. */
     versionWarningShown = false;
+    /** Epoch ms of the last site-list self-heal against respira.press (throttle). */
+    lastSiteRefreshAt = 0;
+    /** Dedupe concurrent self-heals so parallel list_sites calls share one fetch. */
+    siteRefreshInFlight = null;
     static MCP_SERVER_VERSION = MCP_SERVER_VERSION;
     /**
      * Normalize a tool name: respira_* → wordpress_* for switch dispatch.
@@ -1044,6 +1048,146 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             message,
         };
     }
+    /**
+     * Self-heal the in-memory site list from respira.press.
+     *
+     * The running server boots from whatever site list was frozen into its
+     * config at startup (RESPIRA_CONFIG_B64 env, or ~/.respira/config.json).
+     * When the user later adds a site on the dashboard, that frozen list never
+     * learns about it: RESPIRA_CONFIG_B64 outranks the file (see loadConfig), and
+     * Cowork's sandbox can't even write the file, so `redeem` can't persist a new
+     * site there. The only workaround users found was deleting and reinstalling
+     * the connector for every new site (Mario, 3 sites; Emil, 4 sites Cowork saw
+     * as 3). That is the bug this fixes.
+     *
+     * Here we re-pull the account's CURRENT canonical inventory using a
+     * credential the server already holds (any one live `respira_site_` token)
+     * via /api/mcp/config/refresh, and merge any missing sites straight into the
+     * live `this.sites` map. Because the merge is in-memory it takes effect in
+     * the SAME session with no restart, no re-paste, and no file write, so it
+     * works identically under RESPIRA_CONFIG_B64 and inside Cowork's sandbox.
+     *
+     * Best-effort and non-blocking: any failure (offline, OAuth-only config with
+     * no site token, backend error, timeout) resolves to 0 added and never
+     * throws, so list_sites still returns the sites already known. Throttled to
+     * at most once per RESPIRA_SITE_REFRESH_THROTTLE_MS (default 60s) and
+     * deduped so parallel calls share one fetch.
+     *
+     * @returns number of newly added sites.
+     */
+    async maybeSelfHealSiteList(force = false) {
+        if (process.env.RESPIRA_DISABLE_SITE_REFRESH === '1') {
+            return 0;
+        }
+        const throttleMs = Number(process.env.RESPIRA_SITE_REFRESH_THROTTLE_MS) || 60_000;
+        if (!force && Date.now() - this.lastSiteRefreshAt < throttleMs) {
+            return 0;
+        }
+        if (this.siteRefreshInFlight) {
+            return this.siteRefreshInFlight;
+        }
+        this.siteRefreshInFlight = this.performSiteRefresh().finally(() => {
+            this.siteRefreshInFlight = null;
+        });
+        return this.siteRefreshInFlight;
+    }
+    async performSiteRefresh() {
+        // Any one live dashboard site token identifies the account. OAuth
+        // per-site tokens (rsp_at_) are not account-wide and are skipped.
+        let token;
+        for (const client of this.sites.values()) {
+            const key = client.getApiKey?.();
+            if (key && key.startsWith('respira_site_')) {
+                token = key;
+                break;
+            }
+        }
+        // Stamp the attempt time even when we bail, so a token-less config doesn't
+        // retry the loop on every single list_sites call.
+        this.lastSiteRefreshAt = Date.now();
+        if (!token) {
+            return 0;
+        }
+        const apiBase = process.env.RESPIRA_API_BASE || 'https://www.respira.press';
+        const url = `${apiBase.replace(/\/+$/, '')}/api/mcp/config/refresh`;
+        const timeoutMs = Number(process.env.RESPIRA_SITE_REFRESH_TIMEOUT_MS) || 8000;
+        let payload;
+        try {
+            const response = await fetch(url, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ token }),
+                signal: AbortSignal.timeout(timeoutMs),
+            });
+            if (!response.ok) {
+                return 0;
+            }
+            payload = await response.json();
+        }
+        catch {
+            // Offline / proxy / firewall / timeout: never block list_sites on this.
+            return 0;
+        }
+        const sites = payload?.config?.sites;
+        if (!Array.isArray(sites)) {
+            return 0;
+        }
+        const knownUrls = new Set();
+        for (const client of this.sites.values()) {
+            knownUrls.add(this.normalizeSiteUrl(client.getSiteUrl()));
+        }
+        let added = 0;
+        for (const s of sites) {
+            if (!s || typeof s !== 'object' || !s.id || !s.url || !s.apiKey) {
+                continue;
+            }
+            // Dedupe by id AND by normalized URL (a stale frozen config may hold the
+            // same site under a different id than the canonical inventory returns).
+            if (this.sites.has(s.id) || knownUrls.has(this.normalizeSiteUrl(s.url))) {
+                continue;
+            }
+            try {
+                const client = new WordPressClient({
+                    id: s.id,
+                    url: s.url,
+                    apiKey: s.apiKey,
+                    name: s.name || s.id,
+                    default: false,
+                });
+                this.sites.set(s.id, client);
+                knownUrls.add(this.normalizeSiteUrl(s.url));
+                if (!this.currentSite) {
+                    this.currentSite = client;
+                    this.defaultSiteId = s.id;
+                }
+                try {
+                    getUsageEmitter().registerSiteToken(s.url, s.apiKey);
+                }
+                catch {
+                    // usage telemetry never blocks
+                }
+                added += 1;
+            }
+            catch {
+                // A single malformed site entry never aborts the merge.
+            }
+        }
+        if (added > 0) {
+            console.error(`respira-mcp: self-heal added ${added} site${added === 1 ? '' : 's'} from respira.press ` +
+                `(now ${this.sites.size} connected).`);
+        }
+        return added;
+    }
+    /** Normalize a site URL for cross-config dedupe: scheme/host only, no www, lowercase. */
+    normalizeSiteUrl(raw) {
+        try {
+            const u = new URL(raw);
+            return u.host.replace(/^www\./i, '').toLowerCase() + u.pathname.replace(/\/+$/, '');
+        }
+        catch {
+            return String(raw || '').trim().toLowerCase().replace(/\/+$/, '');
+        }
+    }
     /**
      * When a WRITE tool runs against the default site because the caller
      * omitted site_id and the account has more than one site connected,
@@ -5705,6 +5849,10 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                     ? await client.getSiteContext()
                     : await client.getCompactSiteContext();
             case 'wordpress_list_sites': {
+                // Self-heal first so a site added on the dashboard after this server
+                // started shows up here without a reinstall or re-paste (throttled,
+                // best-effort, never throws).
+                await this.maybeSelfHealSiteList();
                 const allSites = Array.from(this.sites.values());
                 const visibleSites = allSites.filter((site) => this.isSiteAllowed(site));
                 // v6.17.2: surface hidden sites so the AI can explain
@@ -5883,9 +6031,16 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                     respira_approvals_url: client.getApprovalsUrl(),
                 };
             case 'wordpress_switch_site': {
-                const newSite = this.sites.get(args.site_id);
+                let newSite = this.sites.get(args.site_id);
+                if (!newSite) {
+                    // The target may be a site added on the dashboard after this server
+                    // started. Self-heal once, then retry before giving up.
+                    await this.maybeSelfHealSiteList();
+                    newSite = this.sites.get(args.site_id);
+                }
                 if (!newSite) {
-                    throw new Error(`Site with ID "${args.site_id}" not found in configuration`);
+                    const available = Array.from(this.sites.keys()).join(', ') || '(none configured)';
+                    throw new Error(`Site with ID "${args.site_id}" not found in configuration. Available: ${available}`);
                 }
                 if (!this.isSiteAllowed(newSite)) {
                     throw new Error(`Site "${args.site_id}" is not in this MCP configuration group.`);