@respira/wordpress-mcp-server 8.2.7 → 8.2.9

package/CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to Respira WordPress MCP Server will be documented in this f
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [8.2.9] - 2026-08-12
+
+### Fixed
+
+- **The security tool descriptions named an advisory that had moved on.** `wordpress_update_core_security` described its `advisory_id` as "currently wordpress-wp2shell-2026" and listed 6.8.6 / 6.9.5 / 7.0.2 as the targets. The plugin catalog has carried the August 2026 core security release and its backports down to 4.7.34 since 8.6.9, and neither field was ever an enum, so nothing was blocked. Only the description was out of date, and that was enough: an agent read it, concluded the tool could not handle the August advisory, and stopped before trying. Both fields now point at `wordpress_run_security_audit` and the catalog rather than naming an advisory, so a future security release cannot make them wrong again. `advisory_ids` on the audit also now says what it actually does, which is get recorded on the receipt without changing which indicators the audit looks for.
+
+## [8.2.8] - 2026-08-11
+
+### Fixed
+
+- **`apply_builder_patch` and `update_element`'s `unset` operation had no valid shape a strict client could use.** The write-path handling for removing a stale attribute alias (e.g. a Divi 5 button's leftover `content` key) was already correct; the served tool schema for `operations`/`updates` never documented `unset` as a real property, so a client validating against the schema had nowhere to put it. Both tool definitions now declare it, matching the plugin's REST route and native ability registry, which already did.
+
 ## [8.2.7] - 2026-08-10
 
 ### Fixed

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAkBH,OAAO,KAAK,EAAE,mBAAmB,EAAe,MAAM,kBAAkB,CAAC;AAsHzE;;;;;;;;;;;;;;;;GAgBG;AACH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,MAAM,CAoBhF;AAiID,qBAAa,sBAAsB;IACjC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,WAAW,CAAgC;IACnD,OAAO,CAAC,KAAK,CAA2C;IACxD,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,cAAc,CAAwB;IAC9C,OAAO,CAAC,YAAY,CAA4B;IAChD,8EAA8E;IAC9E,OAAO,CAAC,YAAY,CAA4B;IAChD,8EAA8E;IAC9E,OAAO,CAAC,mBAAmB,CAAS;IACpC,iFAAiF;IACjF,OAAO,CAAC,iBAAiB,CAAK;IAC9B,iFAAiF;IACjF,OAAO,CAAC,mBAAmB,CAAgC;IAE3D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAsB;IAEhE;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAWzB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;gBA4Bb,WAAW,EAAE,mBAAmB,EAAE,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE;IA6VvE,OAAO,CAAC,cAAc;IAItB;;;;;;;;;OASG;IACH,OAAO,CAAC,oBAAoB;IAkB5B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,aAAa;IA4BrB,gEAAgE;IAChE,OAAO,CAAC,aAAa;IAUrB;;;;;;OAMG;YACW,UAAU;IA2CxB;;;;;;;;;;;;;;OAcG;YACW,WAAW;IAiJzB;;;;;;;;;OASG;YACW,kBAAkB;IA4OhC;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;IAgE7B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;YACW,qBAAqB;YAiBrB,kBAAkB;IA6FhC,yFAAyF;IACzF,OAAO,CAAC,gBAAgB;IASxB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,6BAA6B;IA0BrC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,yBAAyB;IA+BjC,OAAO,CAAC,eAAe;IAmBvB,OAAO,CAAC,aAAa;YAmQP,kBAAkB;YA6BlB,yBAAyB;IASvC;;;OAGG;IACH,OAAO,CAAC,oBAAoB;YAyBd,QAAQ;IA02GtB;;;;;;OAMG;IACH;;;;;;;;;;;;;oDAagD;IAChD,OAAO,CAAC,mBAAmB,CAAoD;IAC/E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAU;IAClD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAAU;IAC1D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAS;IAC1D;;mDAE+C;IAC/C,OAAO,CAAC,0BAA0B,CAAoC;IAEtE;;;;;;;;OAQG;YACW,0BAA0B;YAyC1B,oBAAoB;YA6CpB,2BAA2B;IAQzC;;;;OAIG;YACW,cAAc;IAQ5B,OAAO,CAAC,mBAAmB;IAw9C3B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAe3C;IAEF;;;;OAIG;IACH,OAAO,CAAC,0BAA0B;YAmCpB,cAAc;IA4G5B,oEAAoE;IACpE,OAAO,CAAC,iBAAiB;IAoBzB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,eAAe;YAuCT,gBAAgB;IAk4C9B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAkZzB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IA6UxB,GAAG;CA+CV"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAkBH,OAAO,KAAK,EAAE,mBAAmB,EAAe,MAAM,kBAAkB,CAAC;AAsHzE;;;;;;;;;;;;;;;;GAgBG;AACH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,MAAM,CAoBhF;AAiID,qBAAa,sBAAsB;IACjC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,WAAW,CAAgC;IACnD,OAAO,CAAC,KAAK,CAA2C;IACxD,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,cAAc,CAAwB;IAC9C,OAAO,CAAC,YAAY,CAA4B;IAChD,8EAA8E;IAC9E,OAAO,CAAC,YAAY,CAA4B;IAChD,8EAA8E;IAC9E,OAAO,CAAC,mBAAmB,CAAS;IACpC,iFAAiF;IACjF,OAAO,CAAC,iBAAiB,CAAK;IAC9B,iFAAiF;IACjF,OAAO,CAAC,mBAAmB,CAAgC;IAE3D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAsB;IAEhE;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAWzB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;gBA4Bb,WAAW,EAAE,mBAAmB,EAAE,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE;IA6VvE,OAAO,CAAC,cAAc;IAItB;;;;;;;;;OASG;IACH,OAAO,CAAC,oBAAoB;IAkB5B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,aAAa;IA4BrB,gEAAgE;IAChE,OAAO,CAAC,aAAa;IAUrB;;;;;;OAMG;YACW,UAAU;IA2CxB;;;;;;;;;;;;;;OAcG;YACW,WAAW;IAiJzB;;;;;;;;;OASG;YACW,kBAAkB;IA4OhC;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;IAgE7B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;YACW,qBAAqB;YAiBrB,kBAAkB;IA6FhC,yFAAyF;IACzF,OAAO,CAAC,gBAAgB;IASxB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,6BAA6B;IA0BrC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,yBAAyB;IA+BjC,OAAO,CAAC,eAAe;IAmBvB,OAAO,CAAC,aAAa;YAmQP,kBAAkB;YA6BlB,yBAAyB;IASvC;;;OAGG;IACH,OAAO,CAAC,oBAAoB;YAyBd,QAAQ;IAi3GtB;;;;;;OAMG;IACH;;;;;;;;;;;;;oDAagD;IAChD,OAAO,CAAC,mBAAmB,CAAoD;IAC/E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAU;IAClD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAAU;IAC1D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAS;IAC1D;;mDAE+C;IAC/C,OAAO,CAAC,0BAA0B,CAAoC;IAEtE;;;;;;;;OAQG;YACW,0BAA0B;YAyC1B,oBAAoB;YA6CpB,2BAA2B;IAQzC;;;;OAIG;YACW,cAAc;IAQ5B,OAAO,CAAC,mBAAmB;IAw9C3B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAe3C;IAEF;;;;OAIG;IACH,OAAO,CAAC,0BAA0B;YAmCpB,cAAc;IA4G5B,oEAAoE;IACpE,OAAO,CAAC,iBAAiB;IAoBzB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,eAAe;YAuCT,gBAAgB;IAk4C9B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IA0ZzB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IA6UxB,GAAG;CA+CV"}

package/dist/server.js

@@ -3185,7 +3185,14 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                                     },
                                     updates: {
                                         type: 'object',
-                                        description: 'Patch to merge into the matched element. Same shape as wordpress_update_module.updates: { content?: string, attributes?: object, ...flat_settings_keys? }. Flat keys (admin_label, background_color, font_size, ...) route through the adapter\'s deep-set helper.',
+                                        description: 'Patch to merge into the matched element. Same shape as wordpress_update_module.updates: { content?: string, attributes?: object, unset?: string[], ...flat_settings_keys? }. Flat keys (admin_label, background_color, font_size, ...) route through the adapter\'s deep-set helper. `unset` is a STRUCTURED array of attribute key names to remove (e.g. ["content"] drops a stale content alias attribute so the module\'s real content attribute takes precedence) — never a single string, and never merged in as literal data.',
+                                        properties: {
+                                            unset: {
+                                                type: 'array',
+                                                items: { type: 'string' },
+                                                description: 'Attribute key names to remove from the matched element (e.g. a stale content alias). A single string is also accepted and treated as a one-element list.',
+                                            },
+                                        },
                                     },
                                 },
                             },
@@ -3573,7 +3580,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                         advisory_ids: {
                             type: 'array',
                             items: { type: 'string' },
-                            description: 'Optional reviewed advisory IDs to record as the audit scope, for example wordpress-wp2shell-2026.',
+                            description: 'Optional reviewed advisory IDs, recorded on the receipt as the scope you audited. Recorded only: this does not currently change which indicators the audit looks for.',
                         },
                         deep_scan: {
                             type: 'boolean',
@@ -3592,11 +3599,11 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                     properties: {
                         advisory_id: {
                             type: 'string',
-                            description: 'Reviewed security advisory ID, currently wordpress-wp2shell-2026.',
+                            description: 'Reviewed security advisory ID. Do not guess it: run respira_run_security_audit first and use the advisory it reports. The approved list lives in the plugin catalog and grows with each WordPress security release, so any advisory named here would go stale.',
                         },
                         target_version: {
                             type: 'string',
-                            description: 'Exact approved patch version on the current branch: 6.8.6, 6.9.5 or 7.0.2 for wp2shell.',
+                            description: 'Exact approved patch version for that advisory on this site\'s own release branch, as reported by respira_run_security_audit. The plugin rejects anything outside its catalog, and it will not move a site across branches.',
                         },
                         backup_confirmed: {
                             type: 'boolean',
@@ -8200,7 +8207,14 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                         identifier_value: { type: 'string', description: 'Value to match' },
                         updates: {
                             type: 'object',
-                            description: 'Key-value pairs of settings to update on the matched element. Do NOT put `edit_target` or `confirm_live_edit` in this object; pass them as top-level params (otherwise they get persisted as element settings).',
+                            description: 'Key-value pairs of settings to update on the matched element. Do NOT put `edit_target` or `confirm_live_edit` in this object; pass them as top-level params (otherwise they get persisted as element settings). `unset` is a STRUCTURED array of attribute key names to remove (e.g. ["content"] drops a stale content alias attribute so a different one takes precedence) — never a single string, and never treated as a value to write.',
+                            properties: {
+                                unset: {
+                                    type: 'array',
+                                    items: { type: 'string' },
+                                    description: 'Attribute key names to remove from the matched element. A single string is also accepted and treated as a one-element list.',
+                                },
+                            },
                         },
                         edit_target: {
                             type: 'string',