@respira/wordpress-mcp-server 7.4.0 → 7.5.0

package/dist/server.js

@@ -263,6 +263,10 @@ export class RespiraWordPressServer {
     allowedSites = null;
     /** Whether the plugin version warning has already been shown this session. */
     versionWarningShown = false;
+    /** Epoch ms of the last site-list self-heal against respira.press (throttle). */
+    lastSiteRefreshAt = 0;
+    /** Dedupe concurrent self-heals so parallel list_sites calls share one fetch. */
+    siteRefreshInFlight = null;
     static MCP_SERVER_VERSION = MCP_SERVER_VERSION;
     /**
      * Normalize a tool name: respira_* → wordpress_* for switch dispatch.
@@ -1044,6 +1048,146 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             message,
         };
     }
+    /**
+     * Self-heal the in-memory site list from respira.press.
+     *
+     * The running server boots from whatever site list was frozen into its
+     * config at startup (RESPIRA_CONFIG_B64 env, or ~/.respira/config.json).
+     * When the user later adds a site on the dashboard, that frozen list never
+     * learns about it: RESPIRA_CONFIG_B64 outranks the file (see loadConfig), and
+     * Cowork's sandbox can't even write the file, so `redeem` can't persist a new
+     * site there. The only workaround users found was deleting and reinstalling
+     * the connector for every new site (Mario, 3 sites; Emil, 4 sites Cowork saw
+     * as 3). That is the bug this fixes.
+     *
+     * Here we re-pull the account's CURRENT canonical inventory using a
+     * credential the server already holds (any one live `respira_site_` token)
+     * via /api/mcp/config/refresh, and merge any missing sites straight into the
+     * live `this.sites` map. Because the merge is in-memory it takes effect in
+     * the SAME session with no restart, no re-paste, and no file write, so it
+     * works identically under RESPIRA_CONFIG_B64 and inside Cowork's sandbox.
+     *
+     * Best-effort and non-blocking: any failure (offline, OAuth-only config with
+     * no site token, backend error, timeout) resolves to 0 added and never
+     * throws, so list_sites still returns the sites already known. Throttled to
+     * at most once per RESPIRA_SITE_REFRESH_THROTTLE_MS (default 60s) and
+     * deduped so parallel calls share one fetch.
+     *
+     * @returns number of newly added sites.
+     */
+    async maybeSelfHealSiteList(force = false) {
+        if (process.env.RESPIRA_DISABLE_SITE_REFRESH === '1') {
+            return 0;
+        }
+        const throttleMs = Number(process.env.RESPIRA_SITE_REFRESH_THROTTLE_MS) || 60_000;
+        if (!force && Date.now() - this.lastSiteRefreshAt < throttleMs) {
+            return 0;
+        }
+        if (this.siteRefreshInFlight) {
+            return this.siteRefreshInFlight;
+        }
+        this.siteRefreshInFlight = this.performSiteRefresh().finally(() => {
+            this.siteRefreshInFlight = null;
+        });
+        return this.siteRefreshInFlight;
+    }
+    async performSiteRefresh() {
+        // Any one live dashboard site token identifies the account. OAuth
+        // per-site tokens (rsp_at_) are not account-wide and are skipped.
+        let token;
+        for (const client of this.sites.values()) {
+            const key = client.getApiKey?.();
+            if (key && key.startsWith('respira_site_')) {
+                token = key;
+                break;
+            }
+        }
+        // Stamp the attempt time even when we bail, so a token-less config doesn't
+        // retry the loop on every single list_sites call.
+        this.lastSiteRefreshAt = Date.now();
+        if (!token) {
+            return 0;
+        }
+        const apiBase = process.env.RESPIRA_API_BASE || 'https://www.respira.press';
+        const url = `${apiBase.replace(/\/+$/, '')}/api/mcp/config/refresh`;
+        const timeoutMs = Number(process.env.RESPIRA_SITE_REFRESH_TIMEOUT_MS) || 8000;
+        let payload;
+        try {
+            const response = await fetch(url, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ token }),
+                signal: AbortSignal.timeout(timeoutMs),
+            });
+            if (!response.ok) {
+                return 0;
+            }
+            payload = await response.json();
+        }
+        catch {
+            // Offline / proxy / firewall / timeout: never block list_sites on this.
+            return 0;
+        }
+        const sites = payload?.config?.sites;
+        if (!Array.isArray(sites)) {
+            return 0;
+        }
+        const knownUrls = new Set();
+        for (const client of this.sites.values()) {
+            knownUrls.add(this.normalizeSiteUrl(client.getSiteUrl()));
+        }
+        let added = 0;
+        for (const s of sites) {
+            if (!s || typeof s !== 'object' || !s.id || !s.url || !s.apiKey) {
+                continue;
+            }
+            // Dedupe by id AND by normalized URL (a stale frozen config may hold the
+            // same site under a different id than the canonical inventory returns).
+            if (this.sites.has(s.id) || knownUrls.has(this.normalizeSiteUrl(s.url))) {
+                continue;
+            }
+            try {
+                const client = new WordPressClient({
+                    id: s.id,
+                    url: s.url,
+                    apiKey: s.apiKey,
+                    name: s.name || s.id,
+                    default: false,
+                });
+                this.sites.set(s.id, client);
+                knownUrls.add(this.normalizeSiteUrl(s.url));
+                if (!this.currentSite) {
+                    this.currentSite = client;
+                    this.defaultSiteId = s.id;
+                }
+                try {
+                    getUsageEmitter().registerSiteToken(s.url, s.apiKey);
+                }
+                catch {
+                    // usage telemetry never blocks
+                }
+                added += 1;
+            }
+            catch {
+                // A single malformed site entry never aborts the merge.
+            }
+        }
+        if (added > 0) {
+            console.error(`respira-mcp: self-heal added ${added} site${added === 1 ? '' : 's'} from respira.press ` +
+                `(now ${this.sites.size} connected).`);
+        }
+        return added;
+    }
+    /** Normalize a site URL for cross-config dedupe: scheme/host only, no www, lowercase. */
+    normalizeSiteUrl(raw) {
+        try {
+            const u = new URL(raw);
+            return u.host.replace(/^www\./i, '').toLowerCase() + u.pathname.replace(/\/+$/, '');
+        }
+        catch {
+            return String(raw || '').trim().toLowerCase().replace(/\/+$/, '');
+        }
+    }
     /**
      * When a WRITE tool runs against the default site because the caller
      * omitted site_id and the account has more than one site connected,
@@ -5346,6 +5490,94 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                 },
                 readOnlyHint: true,
             },
+            // --- Product configurator, STAGGS (addon v3.2) ---
+            {
+                name: 'woocommerce_configurator_status',
+                description: 'Which product configurator is active (STAGGS) plus how many products and attribute groups use it. Start here before any configurator work.',
+                inputSchema: { type: 'object', properties: {} },
+                readOnlyHint: true,
+            },
+            {
+                name: 'woocommerce_get_product_configurator',
+                description: "Read a product's STAGGS configurator state: the enabled flag and all sgg_ meta (steps, attributes, themes).",
+                inputSchema: {
+                    type: 'object',
+                    properties: { id: { type: 'number', description: 'Product ID' } },
+                    required: ['id'],
+                },
+                readOnlyHint: true,
+            },
+            {
+                name: 'woocommerce_set_product_configurator',
+                description: 'Enable or disable the STAGGS configurator on a product. Supports dry_run. Snapshots the product before and after.',
+                inputSchema: {
+                    type: 'object',
+                    properties: {
+                        id: { type: 'number', description: 'Product ID' },
+                        enabled: { type: 'boolean' },
+                        dry_run: { type: 'boolean', description: 'Preview without writing (default false)' },
+                    },
+                    required: ['id', 'enabled'],
+                },
+            },
+            {
+                name: 'woocommerce_list_configurator_attributes',
+                description: 'List STAGGS attribute groups (the reusable option sets a configurator is built from): id, title, type.',
+                inputSchema: { type: 'object', properties: {} },
+                readOnlyHint: true,
+            },
+            {
+                name: 'woocommerce_get_configurator_attribute_items',
+                description: "Read a STAGGS attribute's option items. The workflow is read, edit the returned array, then write it back with set_configurator_attribute_items, so STAGGS' internal sub-field names never have to be guessed.",
+                inputSchema: {
+                    type: 'object',
+                    properties: { id: { type: 'number', description: 'STAGGS attribute (sgg_attribute) post ID' } },
+                    required: ['id'],
+                },
+                readOnlyHint: true,
+            },
+            {
+                name: 'woocommerce_set_configurator_attribute_items',
+                description: "Replace a STAGGS attribute's option items, written through the STAGGS/Carbon Fields helpers so storage stays consistent. Supports dry_run. Snapshots the attribute.",
+                inputSchema: {
+                    type: 'object',
+                    properties: {
+                        id: { type: 'number', description: 'STAGGS attribute (sgg_attribute) post ID' },
+                        items: { type: 'array', items: { type: 'object' }, description: 'The full items array (read first, edit, write back)' },
+                        dry_run: { type: 'boolean', description: 'Preview without writing (default false)' },
+                    },
+                    required: ['id', 'items'],
+                },
+            },
+            {
+                name: 'woocommerce_get_plugin_state',
+                description: 'Read allow-listed options and post meta for a known third-party plugin (currently: staggs). Keys outside the allow-list are ignored on read.',
+                inputSchema: {
+                    type: 'object',
+                    properties: {
+                        plugin: { type: 'string', description: 'Plugin slug with a registered allow-list (staggs)' },
+                        option_keys: { type: 'array', items: { type: 'string' }, description: 'Option names to read (must match the allow-list prefixes)' },
+                        post_id: { type: 'number', description: 'Optional post whose allow-listed meta to read' },
+                    },
+                    required: ['plugin'],
+                },
+                readOnlyHint: true,
+            },
+            {
+                name: 'woocommerce_set_plugin_state',
+                description: 'Write allow-listed options and post meta for a known third-party plugin (currently: staggs). Any key outside the allow-list refuses the whole request. Supports dry_run. Snapshots the post.',
+                inputSchema: {
+                    type: 'object',
+                    properties: {
+                        plugin: { type: 'string', description: 'Plugin slug with a registered allow-list (staggs)' },
+                        options: { type: 'object', description: 'Option name to value map' },
+                        meta: { type: 'object', description: 'Meta key to value map (requires post_id)' },
+                        post_id: { type: 'number' },
+                        dry_run: { type: 'boolean', description: 'Preview without writing (default false)' },
+                    },
+                    required: ['plugin'],
+                },
+            },
             // --- Readiness autofix (addon v3.1) ---
             {
                 name: 'woocommerce_readiness_fixlist',
@@ -5705,6 +5937,10 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                     ? await client.getSiteContext()
                     : await client.getCompactSiteContext();
             case 'wordpress_list_sites': {
+                // Self-heal first so a site added on the dashboard after this server
+                // started shows up here without a reinstall or re-paste (throttled,
+                // best-effort, never throws).
+                await this.maybeSelfHealSiteList();
                 const allSites = Array.from(this.sites.values());
                 const visibleSites = allSites.filter((site) => this.isSiteAllowed(site));
                 // v6.17.2: surface hidden sites so the AI can explain
@@ -5883,9 +6119,16 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                     respira_approvals_url: client.getApprovalsUrl(),
                 };
             case 'wordpress_switch_site': {
-                const newSite = this.sites.get(args.site_id);
+                let newSite = this.sites.get(args.site_id);
+                if (!newSite) {
+                    // The target may be a site added on the dashboard after this server
+                    // started. Self-heal once, then retry before giving up.
+                    await this.maybeSelfHealSiteList();
+                    newSite = this.sites.get(args.site_id);
+                }
                 if (!newSite) {
-                    throw new Error(`Site with ID "${args.site_id}" not found in configuration`);
+                    const available = Array.from(this.sites.keys()).join(', ') || '(none configured)';
+                    throw new Error(`Site with ID "${args.site_id}" not found in configuration. Available: ${available}`);
                 }
                 if (!this.isSiteAllowed(newSite)) {
                     throw new Error(`Site "${args.site_id}" is not in this MCP configuration group.`);
@@ -6350,6 +6593,30 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                 return await client.woocommerceCreateCartLink(args);
             case 'woocommerce_agent_orders_report':
                 return await client.woocommerceAgentOrdersReport(args);
+            case 'woocommerce_configurator_status':
+                return await client.woocommerceConfiguratorStatus();
+            case 'woocommerce_get_product_configurator':
+                return await client.woocommerceGetProductConfigurator(args.id);
+            case 'woocommerce_set_product_configurator': {
+                const { id, ...payload } = args;
+                return await client.woocommerceSetProductConfigurator(id, payload);
+            }
+            case 'woocommerce_list_configurator_attributes':
+                return await client.woocommerceListConfiguratorAttributes();
+            case 'woocommerce_get_configurator_attribute_items':
+                return await client.woocommerceGetConfiguratorAttributeItems(args.id);
+            case 'woocommerce_set_configurator_attribute_items': {
+                const { id, ...payload } = args;
+                return await client.woocommerceSetConfiguratorAttributeItems(id, payload);
+            }
+            case 'woocommerce_get_plugin_state': {
+                const { plugin, ...params } = args;
+                return await client.woocommerceGetPluginState(plugin, params);
+            }
+            case 'woocommerce_set_plugin_state': {
+                const { plugin, ...payload } = args;
+                return await client.woocommerceSetPluginState(plugin, payload);
+            }
             case 'woocommerce_readiness_fixlist':
                 return await client.woocommerceReadinessFixlist(args);
             case 'woocommerce_set_image_alt': {