@respira/wordpress-mcp-server 7.5.2 → 7.5.4

package/dist/__tests__/delete-media-approval-token.test.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Regression test for ticket 927aa7ed: "delete_media approval flow never
+ * completes: token rejected in a loop".
+ *
+ * Root cause: `WordPressClient.deleteMedia()` only ever forwarded `id` to the
+ * WP REST endpoint (`DELETE /media/{id}`). The MCP tool schema for
+ * `wordpress_delete_media` advertises `approval_token` and `force` params and
+ * the server.ts dispatcher received them from the caller, but the client
+ * method silently dropped both on the floor before the request ever went
+ * out. The WP-side approval gate (Respira_Tool_Governance) never saw a token
+ * on the "confirm" call, so it always treated it as a fresh request and
+ * minted a brand-new token — an infinite loop, indistinguishable from the
+ * outside from a broken approval mechanism, even though the mechanism itself
+ * (proven by delete_page working) was fine.
+ *
+ * Uses the same axios mock-adapter pattern as rest-route-fallback.test.ts.
+ *
+ * @since 7.5.x (ticket 927aa7ed)
+ */
+export {};
+//# sourceMappingURL=delete-media-approval-token.test.d.ts.map

package/dist/__tests__/delete-media-approval-token.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete-media-approval-token.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/delete-media-approval-token.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG"}

package/dist/__tests__/delete-media-approval-token.test.js

@@ -0,0 +1,126 @@
+/**
+ * Regression test for ticket 927aa7ed: "delete_media approval flow never
+ * completes: token rejected in a loop".
+ *
+ * Root cause: `WordPressClient.deleteMedia()` only ever forwarded `id` to the
+ * WP REST endpoint (`DELETE /media/{id}`). The MCP tool schema for
+ * `wordpress_delete_media` advertises `approval_token` and `force` params and
+ * the server.ts dispatcher received them from the caller, but the client
+ * method silently dropped both on the floor before the request ever went
+ * out. The WP-side approval gate (Respira_Tool_Governance) never saw a token
+ * on the "confirm" call, so it always treated it as a fresh request and
+ * minted a brand-new token — an infinite loop, indistinguishable from the
+ * outside from a broken approval mechanism, even though the mechanism itself
+ * (proven by delete_page working) was fine.
+ *
+ * Uses the same axios mock-adapter pattern as rest-route-fallback.test.ts.
+ *
+ * @since 7.5.x (ticket 927aa7ed)
+ */
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import axios from 'axios';
+import { WordPressClient } from '../wordpress-client.js';
+const callLog = [];
+let currentHandler = null;
+const originalAdapter = axios.defaults.adapter;
+function installMockAdapter() {
+    callLog.length = 0;
+    axios.defaults.adapter = ((config) => {
+        callLog.push({
+            method: (config.method || 'get').toLowerCase(),
+            url: config.url,
+            params: config.params,
+        });
+        if (!currentHandler) {
+            return Promise.reject(new Error('no mock handler installed'));
+        }
+        const result = currentHandler(config);
+        return Promise.resolve(result).then((r) => ({
+            status: r.status,
+            statusText: 'OK',
+            headers: {},
+            config,
+            data: r.data,
+            request: {},
+        }));
+    });
+}
+function restoreAdapter() {
+    axios.defaults.adapter = originalAdapter;
+    currentHandler = null;
+}
+function setHandler(h) {
+    currentHandler = h;
+}
+function buildConfig() {
+    return {
+        id: 'test-site',
+        name: 'Test Site',
+        url: 'https://example.com',
+        apiKey: 'respira_test_key',
+    };
+}
+// -----------------------------------------------------------------------------
+// Tests
+// -----------------------------------------------------------------------------
+test('deleteMedia forwards approval_token on the confirm call (927aa7ed regression)', async () => {
+    installMockAdapter();
+    try {
+        setHandler(() => ({ status: 200, data: { success: true } }));
+        const client = new WordPressClient(buildConfig());
+        // First call: no token yet, simulates the initial delete attempt.
+        await client.deleteMedia(42);
+        assert.equal(callLog.length, 1);
+        assert.equal(callLog[0].method, 'delete');
+        assert.equal(callLog[0].url, '/media/42');
+        assert.ok(!callLog[0].params || callLog[0].params.approval_token === undefined, 'first call must not send an approval_token');
+        // Second call: the agent echoes back the exact token it was handed.
+        // Pre-fix this token was silently dropped and the WP side looped forever.
+        await client.deleteMedia(42, undefined, 'approve-tok-abc123');
+        assert.equal(callLog.length, 2);
+        assert.equal(callLog[1].method, 'delete');
+        assert.equal(callLog[1].url, '/media/42');
+        assert.equal(callLog[1].params?.approval_token, 'approve-tok-abc123', 'confirm call must forward the approval_token verbatim');
+    }
+    finally {
+        restoreAdapter();
+    }
+});
+test('deleteMedia forwards force alongside approval_token', async () => {
+    installMockAdapter();
+    try {
+        setHandler(() => ({ status: 200, data: { success: true } }));
+        const client = new WordPressClient(buildConfig());
+        await client.deleteMedia(7, true, 'tok-xyz');
+        assert.equal(callLog.length, 1);
+        assert.equal(callLog[0].params?.force, true);
+        assert.equal(callLog[0].params?.approval_token, 'tok-xyz');
+    }
+    finally {
+        restoreAdapter();
+    }
+});
+test('deletePage approval flow is unaffected (no regression)', async () => {
+    installMockAdapter();
+    try {
+        setHandler(() => ({ status: 200, data: { success: true } }));
+        const client = new WordPressClient(buildConfig());
+        // No force -> no params sent at all (matches pre-existing behavior).
+        await client.deletePage(99);
+        assert.equal(callLog[0].url, '/pages/99');
+        assert.ok(!callLog[0].params || Object.keys(callLog[0].params).length === 0);
+        // force + approval_token -> both forwarded, plus confirm_live_edit which
+        // deletePage has always sent alongside force.
+        await client.deletePage(99, true, 'page-tok-1');
+        const call = callLog[1];
+        assert.equal(call.url, '/pages/99');
+        assert.equal(call.params.force, true);
+        assert.equal(call.params.confirm_live_edit, true);
+        assert.equal(call.params.approval_token, 'page-tok-1');
+    }
+    finally {
+        restoreAdapter();
+    }
+});
+//# sourceMappingURL=delete-media-approval-token.test.js.map

package/dist/__tests__/delete-media-approval-token.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete-media-approval-token.test.js","sourceRoot":"","sources":["../../src/__tests__/delete-media-approval-token.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAUzD,MAAM,OAAO,GAAwD,EAAE,CAAC;AACxE,IAAI,cAAc,GAAuB,IAAI,CAAC;AAE9C,MAAM,eAAe,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;AAE/C,SAAS,kBAAkB;IACzB,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IACnB,KAAK,CAAC,QAAQ,CAAC,OAAO,GAAG,CAAC,CAAC,MAAW,EAAE,EAAE;QACxC,OAAO,CAAC,IAAI,CAAC;YACX,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE;YAC9C,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACtC,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1C,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE,EAAE;YACX,MAAM;YACN,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,EAAE;SACZ,CAAC,CAAC,CAAC;IACN,CAAC,CAAQ,CAAC;AACZ,CAAC;AAED,SAAS,cAAc;IACrB,KAAK,CAAC,QAAQ,CAAC,OAAO,GAAG,eAAe,CAAC;IACzC,cAAc,GAAG,IAAI,CAAC;AACxB,CAAC;AAED,SAAS,UAAU,CAAC,CAAc;IAChC,cAAc,GAAG,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,WAAW;IAClB,OAAO;QACL,EAAE,EAAE,WAAW;QACf,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,qBAAqB;QAC1B,MAAM,EAAE,kBAAkB;KAC3B,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,QAAQ;AACR,gFAAgF;AAEhF,IAAI,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;IAC/F,kBAAkB,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,WAAW,EAAE,CAAC,CAAC;QAElD,kEAAkE;QAClE,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC7B,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC1C,MAAM,CAAC,EAAE,CACP,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,EACpE,4CAA4C,CAC7C,CAAC;QAEF,oEAAoE;QACpE,0EAA0E;QAC1E,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,oBAAoB,CAAC,CAAC;QAC9D,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC1C,MAAM,CAAC,KAAK,CACV,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,cAAc,EACjC,oBAAoB,EACpB,uDAAuD,CACxD,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,cAAc,EAAE,CAAC;IACnB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;IACrE,kBAAkB,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,WAAW,EAAE,CAAC,CAAC;QAElD,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;IAC7D,CAAC;YAAS,CAAC;QACT,cAAc,EAAE,CAAC;IACnB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;IACxE,kBAAkB,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,WAAW,EAAE,CAAC,CAAC;QAElD,qEAAqE;QACrE,MAAM,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC5B,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC1C,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;QAE7E,yEAAyE;QACzE,8CAA8C;QAC9C,MAAM,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;QAClD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;IACzD,CAAC;YAAS,CAAC;QACT,cAAc,EAAE,CAAC;IACnB,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/__tests__/tool-filter-context-cache.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=tool-filter-context-cache.test.d.ts.map

package/dist/__tests__/tool-filter-context-cache.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-filter-context-cache.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/tool-filter-context-cache.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/tool-filter-context-cache.test.js

@@ -0,0 +1,69 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { RespiraWordPressServer } from '../server.js';
+/**
+ * Regression test for the getTools() blocking-network-calls bug
+ * (nathankohut.co.uk, Windows, 2026-07-19): isWooCommerceAddonAvailable(),
+ * isAcfAvailable(), and filterToolsByContext() each independently called
+ * getSiteContext()/getCompactSiteContext() — three uncached, sequential live
+ * HTTP calls to the customer's own site before tools/list could return,
+ * each carrying the wordpress-client retry backoff. A slow/failing site
+ * could push a single tools/list response well past an MCP client's own
+ * handshake patience, killing the process with zero stderr — indistinguishable
+ * from a crash.
+ *
+ * Fix: a single cached, timeout-bounded getContextForToolFiltering() shared
+ * by all three call sites.
+ */
+function makeServer() {
+    const server = new RespiraWordPressServer([
+        { id: 'test-site', name: 'Test Site', url: 'https://example.test', apiKey: 'test-key', default: true },
+    ]);
+    return server;
+}
+test('WooCommerce and ACF availability checks share ONE getSiteContext() call, not two', async () => {
+    const server = makeServer();
+    let callCount = 0;
+    server.currentSite.getSiteContext = async () => {
+        callCount++;
+        return { addons: { woocommerce: { installed: true, licensed: true }, acf: { installed: true } } };
+    };
+    const [woo, acf] = await Promise.all([
+        server.isWooCommerceAddonAvailable(),
+        server.isAcfAvailable(),
+    ]);
+    assert.equal(woo, true);
+    assert.equal(acf, true);
+    assert.equal(callCount, 1, 'expected exactly one underlying getSiteContext() call, got ' + callCount);
+});
+test('a slow getSiteContext() never blocks the caller past the timeout bound', async () => {
+    const server = makeServer();
+    server.currentSite.getSiteContext = () => new Promise((resolve) => setTimeout(() => resolve({ addons: {} }), 10_000)); // deliberately far past any reasonable bound
+    const start = Date.now();
+    const result = await server.getContextForToolFiltering();
+    const elapsed = Date.now() - start;
+    assert.equal(result, null, 'a timed-out fetch should resolve to null (fail-open), not hang or throw');
+    assert.ok(elapsed < 3000, `expected the timeout bound to cap the wait well under 3s, took ${elapsed}ms`);
+});
+test('filterToolsByContext shows all tools when the site context fetch fails', async () => {
+    const server = makeServer();
+    server.currentSite.getSiteContext = async () => {
+        throw new Error('ECONNRESET');
+    };
+    const tools = [{ name: 'wordpress_list_pages' }, { name: 'woocommerce_list_products' }];
+    const filtered = await server.filterToolsByContext(tools);
+    assert.equal(filtered.length, 2, 'a failed context fetch should fail open and show everything, not drop tools');
+});
+test('a successful fetch is cached and reused across repeated tools/list-style calls', async () => {
+    const server = makeServer();
+    let callCount = 0;
+    server.currentSite.getSiteContext = async () => {
+        callCount++;
+        return { addons: { woocommerce: { installed: true, licensed: true } } };
+    };
+    await server.isWooCommerceAddonAvailable();
+    await server.isWooCommerceAddonAvailable();
+    await server.filterToolsByContext([]);
+    assert.equal(callCount, 1, 'a fresh cache hit should never re-fetch within the TTL window');
+});
+//# sourceMappingURL=tool-filter-context-cache.test.js.map

package/dist/__tests__/tool-filter-context-cache.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-filter-context-cache.test.js","sourceRoot":"","sources":["../../src/__tests__/tool-filter-context-cache.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAEtD;;;;;;;;;;;;;GAaG;AAEH,SAAS,UAAU;IACjB,MAAM,MAAM,GAAG,IAAI,sBAAsB,CAAC;QACxC,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,sBAAsB,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE;KACvG,CAAQ,CAAC;IACV,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,IAAI,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;IAClG,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,MAAM,CAAC,WAAW,CAAC,cAAc,GAAG,KAAK,IAAI,EAAE;QAC7C,SAAS,EAAE,CAAC;QACZ,OAAO,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACpG,CAAC,CAAC;IAEF,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACnC,MAAM,CAAC,2BAA2B,EAAE;QACpC,MAAM,CAAC,cAAc,EAAE;KACxB,CAAC,CAAC;IAEH,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxB,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,EAAE,6DAA6D,GAAG,SAAS,CAAC,CAAC;AACxG,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;IACxF,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,CAAC,WAAW,CAAC,cAAc,GAAG,GAAG,EAAE,CACvC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,6CAA6C;IAE5H,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,0BAA0B,EAAE,CAAC;IACzD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;IAEnC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,yEAAyE,CAAC,CAAC;IACtG,MAAM,CAAC,EAAE,CAAC,OAAO,GAAG,IAAI,EAAE,kEAAkE,OAAO,IAAI,CAAC,CAAC;AAC3G,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;IACxF,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,CAAC,WAAW,CAAC,cAAc,GAAG,KAAK,IAAI,EAAE;QAC7C,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;IAChC,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,EAAE,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAQ,CAAC;IAC/F,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAE1D,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,6EAA6E,CAAC,CAAC;AAClH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;IAChG,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,MAAM,CAAC,WAAW,CAAC,cAAc,GAAG,KAAK,IAAI,EAAE;QAC7C,SAAS,EAAE,CAAC;QACZ,OAAO,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC1E,CAAC,CAAC;IAEF,MAAM,MAAM,CAAC,2BAA2B,EAAE,CAAC;IAC3C,MAAM,MAAM,CAAC,2BAA2B,EAAE,CAAC;IAC3C,MAAM,MAAM,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAEtC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,EAAE,+DAA+D,CAAC,CAAC;AAC9F,CAAC,CAAC,CAAC"}

package/dist/__tests__/upload-media-path-detection.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=upload-media-path-detection.test.d.ts.map

package/dist/__tests__/upload-media-path-detection.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-media-path-detection.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/upload-media-path-detection.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/upload-media-path-detection.test.js

@@ -0,0 +1,70 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, writeFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { isLocalFilePath, resolveLocalFilePath } from '../wordpress-client.js';
+// Ticket 5a19d816: on Windows, respira_upload_media(file="C:/Users/.../photo.jpg")
+// fell through the local-file detection (which only matched '/', './', '../',
+// '~') into the base64 branch. Buffer.from(nonBase64, 'base64') doesn't throw,
+// it just silently decodes garbage bytes, so the upload "succeeded" with a
+// corrupt ~80-byte file instead of reading the real one from disk.
+test('isLocalFilePath: Windows drive-letter paths are detected as local files, not base64', () => {
+    assert.equal(isLocalFilePath('C:/Users/bob/photo.jpg'), true);
+    assert.equal(isLocalFilePath('C:\\Users\\bob\\photo.jpg'), true);
+    assert.equal(isLocalFilePath('D:\\Media\\file.png'), true);
+    assert.equal(isLocalFilePath('z:/lower/drive/letter.gif'), true);
+});
+test('isLocalFilePath: file:// URIs are detected as local files (Windows and Unix forms)', () => {
+    assert.equal(isLocalFilePath('file:///C:/Users/bob/photo.jpg'), true);
+    assert.equal(isLocalFilePath('file:///home/bob/photo.jpg'), true);
+});
+test('isLocalFilePath: existing POSIX-style detection is unchanged (no regression)', () => {
+    assert.equal(isLocalFilePath('/absolute/unix/path.jpg'), true);
+    assert.equal(isLocalFilePath('./relative/path.jpg'), true);
+    assert.equal(isLocalFilePath('../parent/path.jpg'), true);
+    assert.equal(isLocalFilePath('~/home/path.jpg'), true);
+});
+test('isLocalFilePath: base64 payloads and data:/http(s): URLs are still NOT treated as local files', () => {
+    // A plausible base64 blob with no path-like prefix.
+    assert.equal(isLocalFilePath('aGVsbG8gd29ybGQgdGhpcyBpcyBhIHRlc3Q='), false);
+    assert.equal(isLocalFilePath('data:image/png;base64,iVBORw0KGgo='), false);
+    assert.equal(isLocalFilePath('http://example.com/photo.jpg'), false);
+    assert.equal(isLocalFilePath('https://example.com/photo.jpg'), false);
+});
+test('resolveLocalFilePath: Windows drive-letter paths pass through unchanged (no cwd corruption)', () => {
+    // Regression guard: node:path's resolve() is POSIX on non-Windows hosts and
+    // does not recognize "C:\..." as absolute, so running it through resolve()
+    // would wrongly prefix the string with cwd. The fix must return the drive
+    // path verbatim so fs calls on an actual Windows host see the real path
+    // (and, off-Windows, this test suite sees a clean "File not found: C:\..."
+    // instead of a mangled "<cwd>/C:\...").
+    assert.equal(resolveLocalFilePath('C:\\Users\\bob\\photo.jpg'), 'C:\\Users\\bob\\photo.jpg');
+    assert.equal(resolveLocalFilePath('C:/Users/bob/photo.jpg'), 'C:/Users/bob/photo.jpg');
+});
+test('resolveLocalFilePath: file:///C:/... extracts a Windows-style path', () => {
+    const resolved = resolveLocalFilePath('file:///C:/Users/bob/photo.jpg');
+    assert.equal(resolved, 'C:\\Users\\bob\\photo.jpg');
+});
+test('resolveLocalFilePath: file:///... on Unix round-trips to the real file, byte for byte', () => {
+    const dir = mkdtempSync(join(tmpdir(), 'respira-upload-media-test-'));
+    const filePath = join(dir, 'photo.jpg');
+    writeFileSync(filePath, 'not-actually-a-jpeg-but-that-is-fine');
+    try {
+        const fileUrl = pathToFileURL(filePath).href;
+        assert.equal(isLocalFilePath(fileUrl), true);
+        const resolved = resolveLocalFilePath(fileUrl);
+        assert.equal(resolved, filePath);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
+test('resolveLocalFilePath: existing "~" and relative-path resolution behavior is unchanged', () => {
+    const home = process.env.HOME || '';
+    assert.equal(resolveLocalFilePath('~/photo.jpg'), `${home}/photo.jpg`);
+    // A relative path resolves against cwd, same as plain node:path resolve().
+    assert.equal(resolveLocalFilePath('./photo.jpg'), join(process.cwd(), 'photo.jpg'));
+});
+//# sourceMappingURL=upload-media-path-detection.test.js.map

package/dist/__tests__/upload-media-path-detection.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-media-path-detection.test.js","sourceRoot":"","sources":["../../src/__tests__/upload-media-path-detection.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAE/E,mFAAmF;AACnF,8EAA8E;AAC9E,+EAA+E;AAC/E,2EAA2E;AAC3E,mEAAmE;AAEnE,IAAI,CAAC,qFAAqF,EAAE,GAAG,EAAE;IAC/F,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,wBAAwB,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9D,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,2BAA2B,CAAC,EAAE,IAAI,CAAC,CAAC;IACjE,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAC,CAAC;IAC3D,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,2BAA2B,CAAC,EAAE,IAAI,CAAC,CAAC;AACnE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oFAAoF,EAAE,GAAG,EAAE;IAC9F,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,gCAAgC,CAAC,EAAE,IAAI,CAAC,CAAC;IACtE,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,4BAA4B,CAAC,EAAE,IAAI,CAAC,CAAC;AACpE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,8EAA8E,EAAE,GAAG,EAAE;IACxF,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,yBAAyB,CAAC,EAAE,IAAI,CAAC,CAAC;IAC/D,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAC,CAAC;IAC3D,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,oBAAoB,CAAC,EAAE,IAAI,CAAC,CAAC;IAC1D,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC,CAAC;AACzD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,+FAA+F,EAAE,GAAG,EAAE;IACzG,oDAAoD;IACpD,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,sCAAsC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC7E,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,oCAAoC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC3E,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,8BAA8B,CAAC,EAAE,KAAK,CAAC,CAAC;IACrE,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,+BAA+B,CAAC,EAAE,KAAK,CAAC,CAAC;AACxE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,6FAA6F,EAAE,GAAG,EAAE;IACvG,4EAA4E;IAC5E,2EAA2E;IAC3E,0EAA0E;IAC1E,wEAAwE;IACxE,2EAA2E;IAC3E,wCAAwC;IACxC,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,2BAA2B,CAAC,EAAE,2BAA2B,CAAC,CAAC;IAC7F,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,wBAAwB,CAAC,EAAE,wBAAwB,CAAC,CAAC;AACzF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oEAAoE,EAAE,GAAG,EAAE;IAC9E,MAAM,QAAQ,GAAG,oBAAoB,CAAC,gCAAgC,CAAC,CAAC;IACxE,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,2BAA2B,CAAC,CAAC;AACtD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uFAAuF,EAAE,GAAG,EAAE;IACjG,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,4BAA4B,CAAC,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACxC,aAAa,CAAC,QAAQ,EAAE,sCAAsC,CAAC,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACnC,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uFAAuF,EAAE,GAAG,EAAE;IACjG,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IACpC,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,aAAa,CAAC,EAAE,GAAG,IAAI,YAAY,CAAC,CAAC;IACvE,2EAA2E;IAC3E,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;AACtF,CAAC,CAAC,CAAC"}

package/dist/server.d.ts

@@ -170,9 +170,38 @@ export declare class RespiraWordPressServer {
      * Widget shortcuts are filtered to only the detected builder's element types.
      * Core tools (site context, pages, posts, media, menus, etc.) always remain.
      */
-    /** Cached site context for tool filtering (refreshed on site switch). */
+    /** Cached site context, shared by tool filtering and the WooCommerce/ACF
+     * availability checks below — all three used to independently call
+     * getSiteContext() (getCompactSiteContext() itself just wraps it), meaning
+     * every getTools() invocation made up to three uncached, sequential live
+     * HTTP calls to the customer's own WordPress site before it could return
+     * the tool catalog. Each call carries the wordpress-client retry backoff
+     * (200/600/1800ms across 3 attempts), so a slow or failing site could push
+     * a single tools/list response past 7s — long enough for an MCP client's
+     * own handshake patience to give up and tear down the process, which
+     * looks identical to a crash with zero stderr output (nathankohut.co.uk,
+     * Windows, 2026-07-19). getContextForToolFiltering() below is the only
+     * caller of currentSite.getSiteContext() in this class; everything that
+     * used to call it directly or via getCompactSiteContext() now shares this
+     * one cached, timeout-bounded fetch instead. */
     private cachedFilterContext;
     private static readonly FILTER_CACHE_TTL;
+    private static readonly FILTER_CACHE_FAILURE_TTL;
+    private static readonly FILTER_CONTEXT_TIMEOUT_MS;
+    /** Dedupes concurrent callers (e.g. isWooCommerceAddonAvailable() and
+     * isAcfAvailable() both missing a cold cache at once) onto one in-flight
+     * fetch instead of each starting their own. */
+    private filterContextFetchInFlight;
+    /**
+     * Fetch (or reuse a cached / in-flight) site context for tool-catalog
+     * decisions. Bounded to FILTER_CONTEXT_TIMEOUT_MS regardless of how long
+     * the underlying client's own retry backoff would otherwise take, so a
+     * slow or unreachable site can never block tools/list indefinitely.
+     * Resolves to null (and caches the miss briefly) on timeout or any fetch
+     * error — callers treat null as "show everything / skip context-dependent
+     * gating" rather than failing the whole tool list.
+     */
+    private getContextForToolFiltering;
     private filterToolsByContext;
     private isWooCommerceAddonAvailable;
     /**

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAqBH,OAAO,KAAK,EAAE,mBAAmB,EAAe,MAAM,kBAAkB,CAAC;AAsQzE,qBAAa,sBAAsB;IACjC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,WAAW,CAAgC;IACnD,OAAO,CAAC,KAAK,CAA2C;IACxD,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,cAAc,CAAwB;IAC9C,OAAO,CAAC,YAAY,CAA4B;IAChD,8EAA8E;IAC9E,OAAO,CAAC,YAAY,CAA4B;IAChD,8EAA8E;IAC9E,OAAO,CAAC,mBAAmB,CAAS;IACpC,iFAAiF;IACjF,OAAO,CAAC,iBAAiB,CAAK;IAC9B,iFAAiF;IACjF,OAAO,CAAC,mBAAmB,CAAgC;IAE3D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAsB;IAEhE;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAWzB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;gBA4Bb,WAAW,EAAE,mBAAmB,EAAE,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE;IAiVvE,OAAO,CAAC,cAAc;IAItB;;;;;;;;;OASG;IACH,OAAO,CAAC,oBAAoB;IAkB5B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,aAAa;IA4BrB,gEAAgE;IAChE,OAAO,CAAC,aAAa;IAUrB;;;;;;OAMG;YACW,UAAU;IA2CxB;;;;;;;;;;;;;;OAcG;YACW,WAAW;IAiJzB;;;;;;;;;OASG;YACW,kBAAkB;IAiHhC;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;YACW,qBAAqB;YAiBrB,kBAAkB;IA6FhC,yFAAyF;IACzF,OAAO,CAAC,gBAAgB;IASxB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,6BAA6B;IA0BrC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,yBAAyB;IA+BjC,OAAO,CAAC,eAAe;IAmBvB,OAAO,CAAC,aAAa;YAmQP,kBAAkB;YA6BlB,yBAAyB;IASvC;;;OAGG;IACH,OAAO,CAAC,oBAAoB;YAyBd,QAAQ;IA+vFtB;;;;;;OAMG;IACH,yEAAyE;IACzE,OAAO,CAAC,mBAAmB,CAAoD;IAC/E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAU;YAEpC,oBAAoB;YAqDpB,2BAA2B;IAazC;;;;OAIG;YACW,cAAc;IAY5B,OAAO,CAAC,mBAAmB;IA2uC3B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAe3C;IAEF;;;;OAIG;IACH,OAAO,CAAC,0BAA0B;YAmCpB,cAAc;IA4G5B,oEAAoE;IACpE,OAAO,CAAC,iBAAiB;IAoBzB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,eAAe;YAuCT,gBAAgB;IAimC9B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAwUzB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IA6UxB,GAAG;CAyCV"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAqBH,OAAO,KAAK,EAAE,mBAAmB,EAAe,MAAM,kBAAkB,CAAC;AAsQzE,qBAAa,sBAAsB;IACjC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,WAAW,CAAgC;IACnD,OAAO,CAAC,KAAK,CAA2C;IACxD,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,cAAc,CAAwB;IAC9C,OAAO,CAAC,YAAY,CAA4B;IAChD,8EAA8E;IAC9E,OAAO,CAAC,YAAY,CAA4B;IAChD,8EAA8E;IAC9E,OAAO,CAAC,mBAAmB,CAAS;IACpC,iFAAiF;IACjF,OAAO,CAAC,iBAAiB,CAAK;IAC9B,iFAAiF;IACjF,OAAO,CAAC,mBAAmB,CAAgC;IAE3D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAsB;IAEhE;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAWzB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;gBA4Bb,WAAW,EAAE,mBAAmB,EAAE,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE;IAiVvE,OAAO,CAAC,cAAc;IAItB;;;;;;;;;OASG;IACH,OAAO,CAAC,oBAAoB;IAkB5B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,aAAa;IA4BrB,gEAAgE;IAChE,OAAO,CAAC,aAAa;IAUrB;;;;;;OAMG;YACW,UAAU;IA2CxB;;;;;;;;;;;;;;OAcG;YACW,WAAW;IAiJzB;;;;;;;;;OASG;YACW,kBAAkB;IAiHhC;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;YACW,qBAAqB;YAiBrB,kBAAkB;IA6FhC,yFAAyF;IACzF,OAAO,CAAC,gBAAgB;IASxB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,6BAA6B;IA0BrC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,yBAAyB;IA+BjC,OAAO,CAAC,eAAe;IAmBvB,OAAO,CAAC,aAAa;YAmQP,kBAAkB;YA6BlB,yBAAyB;IASvC;;;OAGG;IACH,OAAO,CAAC,oBAAoB;YAyBd,QAAQ;IA+vFtB;;;;;;OAMG;IACH;;;;;;;;;;;;;oDAagD;IAChD,OAAO,CAAC,mBAAmB,CAAoD;IAC/E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAU;IAClD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAAU;IAC1D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAS;IAC1D;;mDAE+C;IAC/C,OAAO,CAAC,0BAA0B,CAAoC;IAEtE;;;;;;;;OAQG;YACW,0BAA0B;YAyC1B,oBAAoB;YA6CpB,2BAA2B;IAQzC;;;;OAIG;YACW,cAAc;IAQ5B,OAAO,CAAC,mBAAmB;IA2uC3B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAe3C;IAEF;;;;OAIG;IACH,OAAO,CAAC,0BAA0B;YAmCpB,cAAc;IA4G5B,oEAAoE;IACpE,OAAO,CAAC,iBAAiB;IAoBzB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,eAAe;YAuCT,gBAAgB;IAimC9B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAwUzB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IA6UxB,GAAG;CAyCV"}

package/dist/server.js

@@ -4380,26 +4380,80 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
      * Widget shortcuts are filtered to only the detected builder's element types.
      * Core tools (site context, pages, posts, media, menus, etc.) always remain.
      */
-    /** Cached site context for tool filtering (refreshed on site switch). */
+    /** Cached site context, shared by tool filtering and the WooCommerce/ACF
+     * availability checks below — all three used to independently call
+     * getSiteContext() (getCompactSiteContext() itself just wraps it), meaning
+     * every getTools() invocation made up to three uncached, sequential live
+     * HTTP calls to the customer's own WordPress site before it could return
+     * the tool catalog. Each call carries the wordpress-client retry backoff
+     * (200/600/1800ms across 3 attempts), so a slow or failing site could push
+     * a single tools/list response past 7s — long enough for an MCP client's
+     * own handshake patience to give up and tear down the process, which
+     * looks identical to a crash with zero stderr output (nathankohut.co.uk,
+     * Windows, 2026-07-19). getContextForToolFiltering() below is the only
+     * caller of currentSite.getSiteContext() in this class; everything that
+     * used to call it directly or via getCompactSiteContext() now shares this
+     * one cached, timeout-bounded fetch instead. */
     cachedFilterContext = null;
-    static FILTER_CACHE_TTL = 60_000; // 1 minute
-    async filterToolsByContext(tools) {
+    static FILTER_CACHE_TTL = 60_000; // successful fetch: 1 minute
+    static FILTER_CACHE_FAILURE_TTL = 15_000; // failed fetch: retry sooner
+    static FILTER_CONTEXT_TIMEOUT_MS = 2_000;
+    /** Dedupes concurrent callers (e.g. isWooCommerceAddonAvailable() and
+     * isAcfAvailable() both missing a cold cache at once) onto one in-flight
+     * fetch instead of each starting their own. */
+    filterContextFetchInFlight = null;
+    /**
+     * Fetch (or reuse a cached / in-flight) site context for tool-catalog
+     * decisions. Bounded to FILTER_CONTEXT_TIMEOUT_MS regardless of how long
+     * the underlying client's own retry backoff would otherwise take, so a
+     * slow or unreachable site can never block tools/list indefinitely.
+     * Resolves to null (and caches the miss briefly) on timeout or any fetch
+     * error — callers treat null as "show everything / skip context-dependent
+     * gating" rather than failing the whole tool list.
+     */
+    async getContextForToolFiltering() {
         if (!this.currentSite) {
-            return tools; // No site connected — show everything.
+            return null;
         }
-        let context;
         const now = Date.now();
-        if (this.cachedFilterContext && (now - this.cachedFilterContext.timestamp) < RespiraWordPressServer.FILTER_CACHE_TTL) {
-            context = this.cachedFilterContext.context;
+        if (this.cachedFilterContext) {
+            const ttl = this.cachedFilterContext.context
+                ? RespiraWordPressServer.FILTER_CACHE_TTL
+                : RespiraWordPressServer.FILTER_CACHE_FAILURE_TTL;
+            if (now - this.cachedFilterContext.timestamp < ttl) {
+                return this.cachedFilterContext.context;
+            }
         }
-        else {
+        if (this.filterContextFetchInFlight) {
+            return this.filterContextFetchInFlight;
+        }
+        const fetchPromise = (async () => {
+            let context = null;
             try {
-                context = await this.currentSite.getCompactSiteContext();
-                this.cachedFilterContext = { context, timestamp: now };
+                const timeout = new Promise((_, reject) => setTimeout(() => reject(new Error('site context fetch timed out')), RespiraWordPressServer.FILTER_CONTEXT_TIMEOUT_MS));
+                context = await Promise.race([this.currentSite.getSiteContext(), timeout]);
             }
             catch {
-                return tools; // Can't fetch context — show everything.
+                context = null;
             }
+            this.cachedFilterContext = { context, timestamp: now };
+            return context;
+        })();
+        this.filterContextFetchInFlight = fetchPromise;
+        try {
+            return await fetchPromise;
+        }
+        finally {
+            this.filterContextFetchInFlight = null;
+        }
+    }
+    async filterToolsByContext(tools) {
+        if (!this.currentSite) {
+            return tools; // No site connected — show everything.
+        }
+        const context = await this.getContextForToolFiltering();
+        if (!context) {
+            return tools; // Can't fetch context — show everything.
         }
         const detectedBuilder = (context?.page_builder?.name || '').toLowerCase();
         const hasWooCommerce = Boolean(context?.woocommerce?.active || context?.addons?.woocommerce?.installed);
@@ -4430,16 +4484,11 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
         });
     }
     async isWooCommerceAddonAvailable() {
-        if (!this.currentSite) {
-            return false;
-        }
-        try {
-            const context = await this.currentSite.getSiteContext();
-            return Boolean(context.addons?.woocommerce?.installed && context.addons?.woocommerce?.licensed);
-        }
-        catch {
+        const context = await this.getContextForToolFiltering();
+        if (!context) {
             return false;
         }
+        return Boolean(context.addons?.woocommerce?.installed && context.addons?.woocommerce?.licensed);
     }
     /**
      * Detect whether ACF is active on the currently selected site.
@@ -4447,16 +4496,11 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
      * (a Pro tool on a non-Pro site returns PRO_FEATURE_REQUIRED).
      */
     async isAcfAvailable() {
-        if (!this.currentSite) {
-            return false;
-        }
-        try {
-            const context = await this.currentSite.getSiteContext();
-            return Boolean(context.addons?.acf?.installed);
-        }
-        catch {
+        const context = await this.getContextForToolFiltering();
+        if (!context) {
             return false;
         }
+        return Boolean(context.addons?.acf?.installed);
     }
     getWooCommerceTools() {
         return [
@@ -6401,7 +6445,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             case 'wordpress_update_media_batch':
                 return await client.updateMediaBatch(args.items);
             case 'wordpress_delete_media':
-                return await client.deleteMedia(args.id);
+                return await client.deleteMedia(args.id, args.force, args.approval_token);
             // Menu Management
             case 'wordpress_list_menus':
                 return await client.listMenus();