@respira/wordpress-mcp-server 8.3.24 → 8.3.26

package/dist/server.js

@@ -3,7 +3,7 @@
  *
  * Provides tools for AI coding assistants to interact with WordPress sites
  */
-import { Server } from '@modelcontextprotocol/server';
+import { Server, ProtocolError, ProtocolErrorCode } from '@modelcontextprotocol/server';
 import { setMcpClientInfo } from './agent-signature.js';
 import { serveStdio } from '@modelcontextprotocol/server/stdio';
 import { execSync } from 'child_process';
@@ -17,9 +17,10 @@ import { RespiraVersionChecker } from './version-checker.js';
 import { getBricksTools, dispatchBricksTool } from './bricks-tools.js';
 import { getElementorTools, dispatchElementorTool } from './elementor-tools.js';
 import { getAcfTools, resolveAcfToolName } from './acf-tools.js';
+import { listSkillPrompts, getSkillPrompt } from './skill-prompts.js';
 import { getUsageEmitter, deriveToolKind } from './usage-emitter.js';
 import { FSE_OPERATION_ITEM_SCHEMA } from './fse-operation-schema.js';
-import { collapseLauncherProcesses, validateApiKeyShape, describeConfigOrigin, configOriginKey } from './config.js';
+import { collapseLauncherProcesses, validateApiKeyShape, describeConfigOrigin, configOriginKey, describeUpdateRoute } from './config.js';
 // Process-local secret keeps target hashes useful for same-session retry
 // detection without making low-entropy WordPress ids reversible centrally.
 const TELEMETRY_HASH_SECRET = randomUUID();
@@ -133,6 +134,19 @@ function saveRespiraMcpState(patch) {
         console.error('[respira-mcp] could not write', STATE_FILE_PATH, '-', err?.message);
     }
 }
+/**
+ * Tools removed in a major release, keyed by the name a caller would still
+ * send. dispatchToolCall answers them with the replacement instead of a bare
+ * "Unknown tool". Not advertised and not dispatched, so the parity gate never
+ * sees them.
+ */
+const RETIRED_TOOLS = {
+    woocommerce_sales_report: {
+        replacement: 'woocommerce_revenue_summary',
+        removedIn: '9.0',
+        note: 'It takes date_start and date_end (ISO, in the store timezone) instead of period, date_min and date_max, and states exactly which order statuses and amounts it counts.',
+    },
+};
 const MCP_SERVER_VERSION = (() => {
     try {
         const currentDir = dirname(fileURLToPath(import.meta.url));
@@ -411,8 +425,8 @@ const TOOLS_WITH_PAGINATION_HINT = {
     // node_id and no pagination, so the old hint sent the agent looking for an
     // argument that does not exist and it silently did nothing. A customer hit
     // the cap on a 158KB Breakdance page and was handed exactly that advice.
-    respira_extract_builder_content: 'This tool has no pagination and always returns the whole page. Use respira_find_builder_targets instead, which takes query, limit and offset and reports total_matches / has_more / next_offset, or respira_find_element to jump straight to one element. respira_get_page_outline gives a row-level summary. If you genuinely need the entire structure in one call, raise the cap with RESPIRA_MAX_TOOL_RESULT_BYTES.',
-    wordpress_extract_builder_content: 'This tool has no pagination and always returns the whole page. Use wordpress_find_builder_targets instead, which takes query, limit and offset and reports total_matches / has_more / next_offset, or wordpress_find_element to jump straight to one element. wordpress_get_page_outline gives a row-level summary. If you genuinely need the entire structure in one call, raise the cap with RESPIRA_MAX_TOOL_RESULT_BYTES.',
+    respira_extract_builder_content: 'This tool has no pagination and always returns the whole page. To read ONE element\'s stored content on a page of any size, call respira_find_element with include: "content". It returns the element body the builder saved, which is what update_element wants back. respira_find_builder_targets takes query, limit and offset and reports total_matches / has_more / next_offset, and respira_get_page_outline gives a row-level summary. Do not rebuild an element from the rendered front end: WordPress adds attributes at output time (target, rel) that the stored value never had. Raising RESPIRA_MAX_TOOL_RESULT_BYTES is a last resort, and it is a client-side setting an agent cannot change mid-task.',
+    wordpress_extract_builder_content: 'This tool has no pagination and always returns the whole page. To read ONE element\'s stored content on a page of any size, call wordpress_find_element with include: "content". It returns the element body the builder saved, which is what update_element wants back. wordpress_find_builder_targets takes query, limit and offset and reports total_matches / has_more / next_offset, and wordpress_get_page_outline gives a row-level summary. Do not rebuild an element from the rendered front end: WordPress adds attributes at output time (target, rel) that the stored value never had. Raising RESPIRA_MAX_TOOL_RESULT_BYTES is a last resort, and it is a client-side setting an agent cannot change mid-task.',
     respira_list_plugins: 'No pagination arg today. The full plugin list is usually small; consider filing a feature request if your site hits the cap here.',
 };
 /**
@@ -566,6 +580,8 @@ export class RespiraWordPressServer {
         }, {
             capabilities: {
                 tools: {},
+                // The bundled skills catalog, one prompt per skill (skill-prompts.ts).
+                prompts: {},
             },
             instructions: `${SOUL_MD_CONTENT}
 
@@ -592,7 +608,7 @@ Follow these on every site. They are what separates a great result from a frustr
 
 ## Tool naming
 
-Always use respira_* tool names (e.g. respira_update_page, respira_find_element). The wordpress_* names are deprecated aliases and will be removed in v6.0.
+Always use respira_* tool names (e.g. respira_update_page, respira_find_element). The older wordpress_* names still answer, so a saved call keeps working, but new calls should use respira_*.
 
 ## Step 1: Understand the site
 
@@ -1826,6 +1842,20 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                 tools: await this.getTools(),
             };
         });
+        // Skills as prompts. Served from the skills folder bundled into the
+        // package, so listing them needs no site and no network: a client can
+        // offer every Respira skill as a slash command before a site is set up.
+        this.server.setRequestHandler('prompts/list', async () => {
+            return { prompts: listSkillPrompts() };
+        });
+        this.server.setRequestHandler('prompts/get', async (request) => {
+            const { name, arguments: promptArgs } = request.params;
+            const prompt = getSkillPrompt(String(name || ''), promptArgs);
+            if (!prompt) {
+                throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Unknown prompt: ${name}. Call prompts/list for the Respira skills this server offers.`);
+            }
+            return prompt;
+        });
         // Handle tool calls
         this.server.setRequestHandler('tools/call', async (request) => {
             const { name, arguments: args } = request.params;
@@ -2128,13 +2158,19 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
         if (!update) {
             return result;
         }
+        // Ticket fb4ec63e: the advice has to describe the install that is
+        // answering. On a .mcpb bundle the npm command completes, installs a copy
+        // Claude Desktop never loads, and leaves the reporter certain they had
+        // updated. describeUpdateRoute reads the same launch-path signal
+        // respira_diagnose_connection already reports.
+        const route = describeUpdateRoute();
         // Lead with what this build is missing, not with the fact that a number
         // changed. A customer on 7.1.2 received the old generic sentence on every
         // call for weeks while fighting a bug that a newer build had already fixed,
         // and neither she nor her AI had any reason to connect the two.
         const message = update.missingFixes.length > 0
-            ? `This MCP build (${update.currentVersion}) is behind ${update.latestVersion} and is missing behaviour you may be working around right now: ${update.missingFixes.join(' ')} Update with: npm i -g @respira/wordpress-mcp-server@latest`
-            : `A newer MCP version is available (${update.currentVersion} -> ${update.latestVersion}). Please update your local MCP package.`;
+            ? `This MCP build (${update.currentVersion}) is behind ${update.latestVersion} and is missing behaviour you may be working around right now: ${update.missingFixes.join(' ')} ${route.how_to_update}`
+            : `A newer MCP version is available (${update.currentVersion} -> ${update.latestVersion}). ${route.how_to_update}`;
         const noticePayload = {
             package: update.packageName,
             current_version: update.currentVersion,
@@ -2142,8 +2178,12 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             checked_at: update.checkedAt,
             ...(update.missingFixes.length > 0 ? { missing_fixes: update.missingFixes } : {}),
             message,
-            upgrade_command: 'npm i -g @respira/wordpress-mcp-server@latest',
-            rerun_setup_command: 'npx @respira/wordpress-mcp-server --setup',
+            install_kind: route.install_kind,
+            transport_mode: route.transport_mode,
+            binary_path: route.binary_path,
+            how_to_update: route.how_to_update,
+            ...(route.upgrade_command ? { upgrade_command: route.upgrade_command } : {}),
+            ...(route.rerun_setup_command ? { rerun_setup_command: route.rerun_setup_command } : {}),
         };
         if (result && typeof result === 'object' && !Array.isArray(result)) {
             return {
@@ -2161,7 +2201,8 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
         if (!update) {
             return errorMessage;
         }
-        return `${errorMessage}\n\nUpdate available: ${update.currentVersion} -> ${update.latestVersion}. Run: npm i -g @respira/wordpress-mcp-server@latest`;
+        const route = describeUpdateRoute();
+        return `${errorMessage}\n\nUpdate available: ${update.currentVersion} -> ${update.latestVersion}. ${route.how_to_update}`;
     }
     /**
      * Append the plugin version compatibility warning to the first successful tool
@@ -2566,12 +2607,20 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                             type: 'number',
                             description: 'ID of the original page to duplicate',
                         },
+                        page_id: {
+                            type: 'number',
+                            description: 'Alias for original_id, matching the builder page tools',
+                        },
+                        post_id: {
+                            type: 'number',
+                            description: 'Alias for original_id, matching tools that operate on any post type',
+                        },
                         suffix: {
                             type: 'string',
                             description: 'Optional suffix for the duplicated page title',
                         },
                     },
-                    required: ['original_id'],
+                    required: [],
                 },
                 annotations: {
                     title: "Duplicate Page",
@@ -2649,7 +2698,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             },
             {
                 name: 'wordpress_delete_page',
-                description: 'Delete a page. IMPORTANT: By default, this only works on Respira-created duplicates. To delete an original: pass `force=true` AND `confirm_live_edit=true`. The "Allow Direct Editing" setting in Respira must also be enabled (disabled by default for safety).\n\nApproval flow (added v6.14.2): the first call returns `code: respira_approval_required` with `data.approval_request.approval_token`. Pass that token back via the `approval_token` param on the next call to complete the delete. Pre-v6.14.2 the schema did not expose `approval_token` so agents could see the token in the response but had no way to pass it back — leaving every agent-driven cleanup of its own duplicates stuck.',
+                description: 'Delete a page. IMPORTANT: By default, this only works on Respira-created duplicates. To delete an original: pass `force=true` AND `confirm_live_edit=true`. The "Allow Direct Editing" setting in Respira must also be enabled (disabled by default for safety).\n\nApproval flow: the first call returns `code: respira_approval_required` with `data.approval_request.approval_token`. Pass that token back via the `approval_token` param on the next call to complete the delete.',
                 inputSchema: {
                     type: 'object',
                     properties: {
@@ -2663,7 +2712,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                         },
                         confirm_live_edit: {
                             type: 'boolean',
-                            description: 'N37 fix (v6.19.0): operator confirmation that a force-delete on an original is intended. The server has always required this alongside force=true; pre-v6.19.0 it was undocumented and the surfaced approval response leaked it as a "surreptitious" field. Now in the schema.',
+                            description: 'Operator confirmation that a force-delete on an original is intended. Required alongside force=true, and honoured only when "Allow Direct Editing" is enabled in Respira settings.',
                         },
                         approval_token: {
                             type: 'string',
@@ -2751,12 +2800,20 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                             type: 'number',
                             description: 'Original post ID',
                         },
+                        post_id: {
+                            type: 'number',
+                            description: 'Alias for original_id, matching tools that operate on any post type',
+                        },
+                        page_id: {
+                            type: 'number',
+                            description: 'Alias for original_id, matching the builder page tools',
+                        },
                         suffix: {
                             type: 'string',
                             description: 'Optional suffix',
                         },
                     },
-                    required: ['original_id'],
+                    required: [],
                 },
                 annotations: {
                     title: "Duplicate Post",
@@ -3081,7 +3138,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             },
             {
                 name: 'wordpress_delete_post',
-                description: 'Delete a post. IMPORTANT: By default, this only works on Respira-created duplicates. To delete an original: pass `force=true` AND `confirm_live_edit=true`. The "Allow Direct Editing" setting in Respira must also be enabled (disabled by default for safety).\n\nApproval flow: destructive — the FIRST call returns `code: respira_approval_required` with `data.approval_request.approval_token`, and deletes nothing. Pass that exact token back via the `approval_token` param on the next call to complete the delete. Deleting a Respira-created duplicate still takes both calls; the approval gate runs before the duplicate check.\n\nFixed in 8.3.7 (ticket 429299b5): this tool used to discard the response body, so the approval token, the refusal reason and the success flag were all invisible and every call looked like an empty response. It now always returns the site\'s answer.',
+                description: 'Delete a post. IMPORTANT: By default, this only works on Respira-created duplicates. To delete an original: pass `force=true` AND `confirm_live_edit=true`. The "Allow Direct Editing" setting in Respira must also be enabled (disabled by default for safety).\n\nApproval flow: destructive — the FIRST call returns `code: respira_approval_required` with `data.approval_request.approval_token`, and deletes nothing. Pass that exact token back via the `approval_token` param on the next call to complete the delete. Deleting a Respira-created duplicate still takes both calls; the approval gate runs before the duplicate check.\n\nThe response is always the site\'s answer: the approval token, the refusal reason, or the success flag.',
                 inputSchema: {
                     type: 'object',
                     properties: {
@@ -3324,7 +3381,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                         },
                         mode: {
                             type: 'string',
-                            description: 'replace (default): OVERWRITES all existing page content. append: adds new content after existing elements, preserving the current layout. As of plugin v7.0.16, replace against a page with existing content requires confirm_replace=true.',
+                            description: 'replace (default): OVERWRITES all existing page content. append: adds new content after existing elements, preserving the current layout. Replacing a page that already has content requires confirm_replace=true.',
                             enum: ['replace', 'append'],
                         },
                         confirm_replace: {
@@ -3660,6 +3717,57 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                     openWorldHint: false,
                 },
             },
+            {
+                // The client report. Before 9.0 it existed only as the ability
+                // respira/generate-activity-report, which invoke_ability cannot reach
+                // (the inhale gate refuses it), so every skill that asked for it
+                // failed at step 1.
+                name: 'wordpress_generate_activity_report',
+                description: 'Generate the client report for a period from this site\'s Respira activity log: what changed, through which tools and builders, concrete before and after examples, notable moments, and time saved against per-tool manual baselines. Returns structured data for you to write up in the chosen framing, such as an agency client report or a personal recap. Reads the log and changes nothing. Defaults to the last 30 days. Needs an administrator key.',
+                inputSchema: {
+                    type: 'object',
+                    properties: {
+                        window_days: { type: 'integer', minimum: 1, maximum: 365, description: 'Days back from now. Default 30. Ignored when start_date and end_date are given.' },
+                        start_date: { type: 'string', description: 'ISO 8601 start date. Use with end_date.' },
+                        end_date: { type: 'string', description: 'ISO 8601 end date. Use with start_date.' },
+                        content_types: {
+                            type: 'array',
+                            items: { type: 'string', enum: ['pages', 'posts', 'products', 'variables', 'snapshots', 'migrations', 'audits', 'skills'] },
+                            description: 'Limit the report to these content types. Default all.',
+                        },
+                        scope: {
+                            type: 'object',
+                            properties: {
+                                page_ids: { type: 'array', items: { type: 'integer' } },
+                                post_ids: { type: 'array', items: { type: 'integer' } },
+                                product_ids: { type: 'array', items: { type: 'integer' } },
+                                builder: { type: 'string' },
+                            },
+                            description: 'Focus on specific page, post or product IDs, or on one page builder by slug.',
+                        },
+                        framing: {
+                            type: 'string',
+                            enum: ['personal_recap', 'agency_client_report', 'agency_case_study', 'team_report', 'testimonial_draft', 'build_in_public'],
+                            description: 'Who the write-up is for. Default personal_recap; use agency_client_report for a client.',
+                        },
+                        output_mode: { type: 'string', enum: ['structured', 'client_report', 'ops_report'], description: 'structured returns the data; client_report and ops_report add ready-made sections.' },
+                        report_tone: { type: 'string', enum: ['client_update', 'retainer_proof', 'internal_ops'], description: 'Tone for the ready-made sections.' },
+                        client_name: { type: 'string', description: 'Who an agency report is addressed to.' },
+                        include_examples: { type: 'boolean', description: 'Up to 10 edits with 200-character before and after excerpts. Default true.' },
+                        include_time_estimates: { type: 'boolean', description: 'Estimate time saved from per-tool baselines. Default true.' },
+                        anonymize: { type: 'boolean', description: 'Redact page titles, URLs and excerpts, for a report that will be published. Default false.' },
+                        currency: { type: 'string', description: 'ISO 4217 code for the cost estimate. Default EUR.' },
+                        hourly_rate: { type: 'number', description: 'When set, time savings include a cost estimate at this hourly rate.' },
+                    },
+                },
+                annotations: {
+                    title: "Generate Activity Report",
+                    readOnlyHint: true,
+                    destructiveHint: false,
+                    idempotentHint: true,
+                    openWorldHint: false,
+                },
+            },
             {
                 name: 'wordpress_get_site_template',
                 description: 'Read one FSE template or template part as normalized blocks. Returns its source, render route, supported targeted operations, and expected_fingerprint for safe updates.',
@@ -4640,7 +4748,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             },
             {
                 name: 'wordpress_diagnose_connection',
-                description: 'Run a connection-fingerprint diagnostic for the active site. Combines the plugin\'s server-side report (route registration, php/wp/plugin versions, edge plugin presence) with outside-in probes from the MCP server (REST root reachability, content-type sanity check on Respira routes, edge-layer headers). Use when a tool returns "html instead of json", an opaque 5xx, or when a connection that worked yesterday silently breaks. ALSO use it when the user suspects the wrong site, a stale connection, or a setup step that "did nothing": the response carries transport_mode (which install is answering: mcpb_bundle, npx_cache, global_npm_install, project_local_install, source_checkout), transport.duplicate_entries (whether a second Respira server is running, which usually means the client config lists Respira twice), and client_config (which config source won and how many sites came out of it). Returns a structured object including detected edge layers (Cloudflare, Wordfence, Sucuri) and concrete remediation recommendations.',
+                description: 'Run a connection-fingerprint diagnostic for the active site. Combines the plugin\'s server-side report (route registration, php/wp/plugin versions, edge plugin presence) with outside-in probes from the MCP server (REST root reachability, content-type sanity check on Respira routes, edge-layer headers). Use when a tool returns "html instead of json", an opaque 5xx, or when a connection that worked yesterday silently breaks. ALSO use it when the user suspects the wrong site, a stale connection, or a setup step that "did nothing": the response carries transport_mode (which install is answering: mcpb_bundle, npx_cache, global_npm_install, project_local_install, source_checkout), transport.duplicate_entries (whether a second Respira server is running, which usually means the client config lists Respira twice), and client_config (which config source won and how many sites came out of it). Returns a structured object including detected edge layers (Cloudflare, Wordfence, Sucuri) and concrete remediation recommendations. It also reports well_known_discovery: whether the host answers /.well-known/oauth-protected-resource itself instead of letting WordPress answer it, which is what breaks a ChatGPT connection on a site whose plugin is working, since ChatGPT checks only that address.',
                 inputSchema: {
                     type: 'object',
                     properties: {
@@ -4650,7 +4758,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                         },
                         probe_timeout_ms: {
                             type: 'number',
-                            description: 'Optional per-probe timeout in milliseconds. Default 30000 (was 15000 pre-v6.17). Clamped to [5000, 60000]. Bump this when probing sites behind slow edge layers (some Cloudflare custom rules add 8+ seconds before forwarding to origin).',
+                            description: 'Optional per-probe timeout in milliseconds. Default 30000. Clamped to [5000, 60000]. Bump this when probing sites behind slow edge layers (some Cloudflare custom rules add 8+ seconds before forwarding to origin).',
                             minimum: 5000,
                             maximum: 60000,
                         },
@@ -4786,31 +4894,35 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                 },
             },
             {
+                // Until 9.0 this returned a heuristic estimate from static page
+                // analysis. AER's "what a visitor notices first" shortcut and three
+                // skills call it by name expecting field data, so it now runs the real
+                // PageSpeed Insights audit instead of being removed.
                 name: 'wordpress_get_core_web_vitals',
-                description: 'Get Core Web Vitals metrics (LCP, FID, CLS) for a page.\n\n**Deprecated path** (v6.19.0+, Phase E Tier 1): the current implementation returns a HEURISTIC estimate from static page analysis, NOT real Lighthouse / CrUX data. The response includes `data_source: "respira_heuristic_v1"` and a `_deprecation` field. For real measurements use `respira_run_pagespeed_audit` (Phase E Tier 2).',
+                description: 'Core Web Vitals for a page, measured by Google PageSpeed Insights: LCP, CLS and INP from real Chrome users over the last 28 days when Google publishes field data for the URL, plus Lighthouse lab metrics. Runs the same audit as respira_run_pagespeed_audit with one strategy, so the page must be publicly reachable; drafts and local sites return an error that says so. Cached for 1 hour per URL and strategy.',
                 inputSchema: {
                     type: 'object',
                     properties: {
-                        page_id: {
-                            type: 'number',
-                            description: 'Page ID to analyze',
-                        },
+                        page_id: { type: 'number', description: 'Page ID to measure. Resolved to its public permalink.' },
+                        url: { type: 'string', description: 'Explicit public URL to measure instead of a page ID.' },
+                        strategy: { type: 'string', enum: ['mobile', 'desktop'], default: 'mobile', description: 'Device profile. Default mobile.' },
                     },
-                    required: ['page_id'],
+                    anyOf: [
+                        { required: ['page_id'] },
+                        { required: ['url'] },
+                    ],
                 },
                 annotations: {
                     title: "Core Web Vitals",
                     readOnlyHint: true,
                     destructiveHint: false,
                     idempotentHint: true,
-                    openWorldHint: false,
+                    openWorldHint: true,
                 },
             },
             {
-                // Phase E Tier 2 (v6.19.0): real PageSpeed Insights v5 audit. The
-                // honest replacement for `get_core_web_vitals` heuristic. Returns
-                // Lighthouse lab data + CrUX field data (when available) + the
-                // opportunity list ranked by metric savings.
+                // Real PageSpeed Insights v5 audit: Lighthouse lab data, CrUX field
+                // data when available, and opportunities ranked by metric savings.
                 name: 'wordpress_run_pagespeed_audit',
                 description: 'Run a real PageSpeed Insights v5 audit against a public URL. Returns Lighthouse lab data (scores for performance/accessibility/best-practices/seo, lab metrics FCP/LCP/TBT/CLS/SI/TTI, opportunities ranked by savings_ms, diagnostics) plus CrUX field data (real-user p75 metrics over the trailing ~28 days, when Google has enough traffic to publish them for the URL). Cached for 1 hour per (url, strategy). Pass `fresh=true` to bypass the cache. `strategy="both"` runs mobile + desktop in series. Set the `respira_pagespeed_api_key` WordPress option to lift the 1 req/sec free-tier rate limit to 200 req/min.',
                 inputSchema: {
@@ -4836,9 +4948,8 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                 },
             },
             {
-                // Phase E Tier 2 (v6.19.0): standard-analyzer-envelope wrapper around
-                // PSI. Feeds the Health tab composite via Respira_Site_Health's new
-                // `pagespeed` slot. Use for periodic site-wide health passes; use
+                // Standard-analyzer-envelope wrapper around PSI. Feeds the Health tab
+                // composite via Respira_Site_Health's `pagespeed` slot. Use for periodic site-wide health passes; use
                 // `respira_run_pagespeed_audit` for the raw lab+field data.
                 name: 'wordpress_analyze_pagespeed',
                 description: 'Analyzer-envelope wrapper around the PSI audit. Returns the standard `{success, score, grade, issues, recommendations, metrics, data_source, measured_at}` shape that the Reports → Health tab consumes. Score = Lighthouse performance score (0-100). Grade A≥90, B≥75, C≥60, D≥40, F<40. Issues derived from Lighthouse opportunities, ranked by savings_ms. CrUX p75 field-data surfaces as an info-priority recommendation when available.',
@@ -5016,7 +5127,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             // Safety & Security center
             {
                 name: 'wordpress_run_security_audit',
-                description: 'Run a bounded, read-only WordPress security evidence pass. Returns authoritative WordPress/WooCommerce versions, official core checksum mismatches, administrators, standard and must-use plugins, WordPress cron hooks, known advisory indicators, scan coverage and explicit host-level limitations. Set deep_scan=true to inspect uploads and must-use plugin paths for executable files. This tool never deletes or rewrites anything.',
+                description: 'Run a bounded WordPress security audit. Returns authoritative WordPress/WooCommerce versions, official core checksum mismatches, administrators and account hygiene, standard and must-use plugins, themes, WordPress cron hooks, advisory indicators, scan coverage and explicit host-level limitations. The audit reads and never changes the site, deep_scan included. One flag writes: probe_uploads_execution, off by default, puts one inert PHP file in uploads, requests it to learn whether PHP runs there, then deletes it. The result includes known_vulnerabilities: installed core, plugins and themes matched against the Respira vulnerability database for a licensed site, with status ok or unavailable. An unavailable status never means the site is clean. known_vulnerabilities=false skips that match. On plugins older than 9.0, deep_scan also runs the uploads probe.',
                 inputSchema: {
                     type: 'object',
                     properties: {
@@ -5028,7 +5139,17 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                         deep_scan: {
                             type: 'boolean',
                             default: false,
-                            description: 'Inspect uploads and must-use plugin paths with strict file, time, symlink and result limits.',
+                            description: 'Inspect uploads and must-use plugin paths for executable files, with strict file, time, symlink and result limits. Reads only on plugin 9.0 and newer.',
+                        },
+                        probe_uploads_execution: {
+                            type: 'boolean',
+                            default: false,
+                            description: 'Writes one inert PHP file into uploads, requests it to test whether PHP executes there, then deletes it. Off by default. File-change monitors such as Wordfence may report the file. Needs plugin 9.0 or newer; older plugins ignore it.',
+                        },
+                        known_vulnerabilities: {
+                            type: 'boolean',
+                            default: true,
+                            description: 'Match installed core, plugins and themes against the Respira vulnerability database. On by default; false skips that round trip. Needs plugin 9.0 or newer.',
                         },
                     },
                 },
@@ -5042,17 +5163,17 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             },
             {
                 name: 'wordpress_update_core_security',
-                description: 'Update WordPress core to an exact, catalog-approved security release on the current release branch. Requires a recent recoverable backup, then explicit two-step approval. The first call returns respira_approval_required and an approval_token; repeat the same arguments with that token. The result verifies the running version, REST/frontend boot and official checksums. WordPress core has no automatic rollback, and the receipt says so.',
+                description: 'Update WordPress core to the security release WordPress.org offers on the site\'s current release branch. Requires a recent recoverable backup, then explicit two-step approval. The first call returns respira_approval_required and an approval_token; repeat the same arguments with that token. The result verifies the running version, REST/frontend boot and official checksums. WordPress core has no automatic rollback, and the receipt says so. Plugins older than 9.0 accept only the releases in their own catalog.',
                 inputSchema: {
                     type: 'object',
                     properties: {
                         advisory_id: {
                             type: 'string',
-                            description: 'Reviewed security advisory ID. Do not guess it: run respira_run_security_audit first and use the advisory it reports. The approved list lives in the plugin catalog and grows with each WordPress security release, so any advisory named here would go stale.',
+                            description: 'Security advisory ID from respira_run_security_audit, recorded on the receipt. Do not guess it: run the audit first and use the advisory it reports.',
                         },
                         target_version: {
                             type: 'string',
-                            description: 'Exact approved patch version for that advisory on this site\'s own release branch, as reported by respira_run_security_audit. The plugin rejects anything outside its catalog, and it will not move a site across branches.',
+                            description: 'The exact version WordPress.org offers as the update on this site\'s own release branch, as reported by respira_run_security_audit. The plugin refuses any other version and never moves a site across branches.',
                         },
                         backup_confirmed: {
                             type: 'boolean',
@@ -5073,6 +5194,60 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                     openWorldHint: true,
                 },
             },
+            {
+                name: 'wordpress_update_theme',
+                description: 'Update a theme to the latest version offered to this site, then check that the site still answers (REST API, front page, fatal-error marker). Requires plugin management to be enabled in Respira settings. Approval-gated: the first call returns `respira_approval_required` with an `approval_token`; call again with the same `stylesheet` plus that token. If the result carries `stop_batch: true`, stop updating and check the site. There is no automatic rollback.',
+                inputSchema: {
+                    type: 'object',
+                    properties: {
+                        stylesheet: {
+                            type: 'string',
+                            description: 'Theme directory name (its stylesheet), as respira_run_security_audit lists it under checks.themes.',
+                        },
+                        approval_token: {
+                            type: 'string',
+                            description: 'Second-step approval token returned by the first call. Echo it back unchanged with the same stylesheet.',
+                        },
+                    },
+                    required: ['stylesheet'],
+                },
+                annotations: {
+                    title: "Update Theme",
+                    readOnlyHint: false,
+                    destructiveHint: true,
+                    idempotentHint: true,
+                    openWorldHint: true,
+                },
+            },
+            {
+                name: 'wordpress_revoke_application_password',
+                description: 'Revoke one WordPress application password, by user id and uuid as respira_run_security_audit reports them under checks.account_hygiene. Anything that signs in with it stops working and it cannot be restored. Approval-gated: the first call returns `respira_approval_required` with an `approval_token`; call again with the same arguments plus that token. The password this request itself signed in with is refused.',
+                inputSchema: {
+                    type: 'object',
+                    properties: {
+                        user_id: {
+                            type: 'integer',
+                            description: 'The user the application password belongs to.',
+                        },
+                        uuid: {
+                            type: 'string',
+                            description: 'The application password uuid from the security audit. Never the password itself.',
+                        },
+                        approval_token: {
+                            type: 'string',
+                            description: 'Second-step approval token returned by the first call. Echo it back unchanged with the same user_id and uuid.',
+                        },
+                    },
+                    required: ['user_id', 'uuid'],
+                },
+                annotations: {
+                    title: "Revoke Application Password",
+                    readOnlyHint: false,
+                    destructiveHint: true,
+                    idempotentHint: true,
+                    openWorldHint: false,
+                },
+            },
             // Accessibility tools
             {
                 name: 'wordpress_list_accessibility_scans',
@@ -5155,10 +5330,12 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                     openWorldHint: false,
                 },
             },
-            // Plugin Management tools (EXPERIMENTAL)
+            // Plugin Management tools. The EXPERIMENTAL label came off in 9.0: every
+            // mutation is approval-gated, and activation has probed the site and
+            // rolled itself back on failure since plugin 8.5.5.
             {
                 name: 'wordpress_list_plugins',
-                description: 'EXPERIMENTAL: List all installed plugins with their status, version, and update availability. Requires plugin management to be enabled in Respira settings.',
+                description: 'List all installed plugins with their status, version, and update availability. Requires plugin management to be enabled in Respira settings.',
                 inputSchema: {
                     type: 'object',
                     properties: {},
@@ -5173,7 +5350,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             },
             {
                 name: 'wordpress_install_plugin',
-                description: 'EXPERIMENTAL: Install a plugin from WordPress.org or a ZIP URL. Requires plugin management to be enabled in Respira settings. Approval-gated: first call returns `respira_approval_required` with an `approval_token`; call again with that token to complete the install. Use with caution.',
+                description: 'Install a plugin from WordPress.org or a ZIP URL. Requires plugin management to be enabled in Respira settings. Approval-gated: first call returns `respira_approval_required` with an `approval_token`; call again with that token to complete the install. Install only what the site owner asked for.',
                 inputSchema: {
                     type: 'object',
                     properties: {
@@ -5203,13 +5380,13 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             },
             {
                 name: 'wordpress_activate_plugin',
-                description: 'EXPERIMENTAL: Safely activate a plugin. Respira checks declared PHP, WordPress, dependency and companion-plugin compatibility, activates in a fresh loopback request, probes REST and frontend boot, and automatically deactivates the plugin if the site fails. Approval-gated. Use force_without_probe only after explicit operator approval on a host that blocks loopback requests.',
+                description: 'Safely activate a plugin. Respira checks declared PHP, WordPress, dependency and companion-plugin compatibility, activates in a fresh loopback request, probes REST and frontend boot, and automatically deactivates the plugin if the site fails. Approval-gated. Use force_without_probe only after explicit operator approval on a host that blocks loopback requests.',
                 inputSchema: {
                     type: 'object',
                     properties: {
                         slug: {
                             type: 'string',
-                            description: 'Plugin slug',
+                            description: 'Plugin folder name, or the exact plugin file wordpress_list_plugins reports. Both work, including names with spaces and capitals ("WP PROTECTION" or "WP PROTECTION/SECURITY.php"). Do not sanitize the name yourself: pass it exactly as WordPress spells it.',
                         },
                         approval_token: {
                             type: 'string',
@@ -5232,13 +5409,13 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             },
             {
                 name: 'wordpress_deactivate_plugin',
-                description: 'EXPERIMENTAL: Deactivate a plugin. Requires plugin management to be enabled in Respira settings. Approval-gated: first call returns `respira_approval_required` with an `approval_token`; call again with the same `slug` plus that token to complete deactivation.',
+                description: 'Deactivate a plugin. Requires plugin management to be enabled in Respira settings. Approval-gated: first call returns `respira_approval_required` with an `approval_token`; call again with the same `slug` plus that token to complete deactivation.',
                 inputSchema: {
                     type: 'object',
                     properties: {
                         slug: {
                             type: 'string',
-                            description: 'Plugin slug',
+                            description: 'Plugin folder name, or the exact plugin file wordpress_list_plugins reports. Both work, including names with spaces and capitals ("WP PROTECTION" or "WP PROTECTION/SECURITY.php"). Do not sanitize the name yourself: pass it exactly as WordPress spells it.',
                         },
                         approval_token: {
                             type: 'string',
@@ -5257,13 +5434,13 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             },
             {
                 name: 'wordpress_update_plugin',
-                description: 'EXPERIMENTAL: Update a plugin to the latest version. Requires plugin management to be enabled in Respira settings. Approval-gated: first call returns `respira_approval_required` with an `approval_token`; call again with the same `slug` plus that token to complete the update. Make sure you have backups before updating.',
+                description: 'Update a plugin to the latest version. Requires plugin management to be enabled in Respira settings. Approval-gated: first call returns `respira_approval_required` with an `approval_token`; call again with the same `slug` plus that token to complete the update. Make sure a recent backup exists before updating, and load the front page afterwards to confirm the site still renders.',
                 inputSchema: {
                     type: 'object',
                     properties: {
                         slug: {
                             type: 'string',
-                            description: 'Plugin slug',
+                            description: 'Plugin folder name, or the exact plugin file wordpress_list_plugins reports. Both work, including names with spaces and capitals ("WP PROTECTION" or "WP PROTECTION/SECURITY.php"). Do not sanitize the name yourself: pass it exactly as WordPress spells it.',
                         },
                         approval_token: {
                             type: 'string',
@@ -5282,13 +5459,13 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             },
             {
                 name: 'wordpress_delete_plugin',
-                description: 'EXPERIMENTAL: Permanently delete a plugin. Requires plugin management to be enabled in Respira settings. The plugin must be deactivated first. Approval-gated: first call returns `respira_approval_required` with an `approval_token`; call again with the same `slug` plus that token to confirm deletion.',
+                description: 'Permanently delete a plugin. Requires plugin management to be enabled in Respira settings. The plugin must be deactivated first. Approval-gated: first call returns `respira_approval_required` with an `approval_token`; call again with the same `slug` plus that token to confirm deletion.',
                 inputSchema: {
                     type: 'object',
                     properties: {
                         slug: {
                             type: 'string',
-                            description: 'Plugin slug',
+                            description: 'Plugin folder name, or the exact plugin file wordpress_list_plugins reports. Both work, including names with spaces and capitals ("WP PROTECTION" or "WP PROTECTION/SECURITY.php"). Do not sanitize the name yourself: pass it exactly as WordPress spells it.',
                         },
                         approval_token: {
                             type: 'string',
@@ -5357,7 +5534,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             },
             {
                 name: 'wordpress_create_user',
-                description: 'Create a new user.\n\nApproval flow (N9 fix, v6.19.0): destructive — the first call returns `code: respira_approval_required` with `data.approval_request.approval_token`. Pass that token back via the `approval_token` param on the next call to complete the create. Pre-v6.19.0 the schema did not expose `approval_token` so agents could see the token in the response but had no way to complete the flow.',
+                description: 'Create a new user.\n\nApproval flow: the first call returns `code: respira_approval_required` with `data.approval_request.approval_token`. Pass that token back via the `approval_token` param on the next call to complete the create.',
                 inputSchema: {
                     type: 'object',
                     properties: {
@@ -5394,7 +5571,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             },
             {
                 name: 'wordpress_update_user',
-                description: 'Update user information.\n\nApproval flow (N9 fix, v6.19.0): destructive — first call returns `respira_approval_required` with `approval_token`; pass it back to complete the update.',
+                description: 'Update user information.\n\nApproval flow: the first call returns `respira_approval_required` with `approval_token`; pass it back to complete the update.',
                 inputSchema: {
                     type: 'object',
                     properties: {
@@ -5435,7 +5612,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             },
             {
                 name: 'wordpress_delete_user',
-                description: 'Delete a user.\n\nApproval flow (N9 fix, v6.19.0): destructive — first call returns `respira_approval_required` with `approval_token`; pass it back to complete the delete.',
+                description: 'Delete a user.\n\nApproval flow: the first call returns `respira_approval_required` with `approval_token`; pass it back to complete the delete.',
                 inputSchema: {
                     type: 'object',
                     properties: {
@@ -6531,7 +6708,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             },
             {
                 name: 'wordpress_delete_custom_post',
-                description: 'Delete a custom post.\n\nSafety flow (N9 fix, v6.19.0): destructive. By default this only works on Respira-created duplicates. To delete an original: pass `force=true` AND `confirm_live_edit=true` (the latter requires "Allow Direct Editing" enabled in Respira settings). Approval gate may also fire — if response is `respira_approval_required`, pass the returned `approval_token` back to complete the delete. Pre-v6.19.0 the schema lacked `force`, `confirm_live_edit`, and `approval_token` so agents could not complete the flow at all.',
+                description: 'Delete a custom post.\n\nSafety flow: by default this only works on Respira-created duplicates. To delete an original: pass `force=true` AND `confirm_live_edit=true` (the latter requires "Allow Direct Editing" enabled in Respira settings). The approval gate may also fire: if the response is `respira_approval_required`, pass the returned `approval_token` back to complete the delete.',
                 inputSchema: {
                     type: 'object',
                     properties: {
@@ -6610,7 +6787,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             },
             {
                 name: 'wordpress_update_option',
-                description: 'Update an option value.',
+                description: 'Update an option value. Send the value in the same type get_option returns. A string stays a string, even when it contains JSON, because many plugins store JSON as text and decode it themselves. Send an object or array only for options that already hold one, such as theme_mods. Writing an object or array over an option that holds text is refused unless allow_type_change is true.',
                 inputSchema: {
                     type: 'object',
                     properties: {
@@ -6619,7 +6796,15 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                             description: 'Option name',
                         },
                         value: {
-                            description: 'Option value (string, number, boolean, object, or array). For complex options like theme_mods, pass as object — not JSON string.',
+                            description: 'Option value, in the type get_option returns for this option. Text stays text (JSON-encode it if needed). Objects or arrays only for options that already hold them, such as theme_mods.',
+                        },
+                        allow_type_change: {
+                            type: 'boolean',
+                            description: 'Set true only to really replace an option that holds text with an object or array. Without it that write is refused, because a plugin that decodes its own text option can crash on every page load.',
+                        },
+                        allow_object_overwrite: {
+                            type: 'boolean',
+                            description: 'Set true only to replace an option that stores a PHP object, and only when the new value keeps the same shape. Without it that write is refused.',
                         },
                     },
                     required: ['option', 'value'],
@@ -6771,7 +6956,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             },
             {
                 name: 'wordpress_delete_media',
-                description: 'Delete a media file. Approval-gated since v7.1.0-beta.1 — the first call returns `code: respira_approval_required` with an `approval_token`; pass that token in the second call to confirm. Same flow as `delete_page` / `delete_user` / `delete_plugin`.',
+                description: 'Delete a media file. Approval-gated: the first call returns `code: respira_approval_required` with an `approval_token`; pass that token in the second call to confirm. Same flow as `delete_page` / `delete_user` / `delete_plugin`.',
                 inputSchema: {
                     type: 'object',
                     properties: {
@@ -6891,7 +7076,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             },
             {
                 name: 'wordpress_delete_menu',
-                description: 'Delete a navigation menu.\n\nApproval flow (N9 fix, v6.19.0): destructive — first call returns `respira_approval_required` with `approval_token`; pass it back to complete the delete.',
+                description: 'Delete a navigation menu.\n\nApproval flow: the first call returns `respira_approval_required` with `approval_token`; pass it back to complete the delete.',
                 inputSchema: {
                     type: 'object',
                     properties: {
@@ -7156,9 +7341,10 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
         }
         // Generate respira_* aliases for all wordpress_* tools.
         const allTools = this.generateDualTools(tools);
-        // Context-aware tool filtering: expose only relevant tools based on
-        // detected builder and active plugins. Reduces tool list from ~170 to
-        // ~30-60, saving significant tokens in AI agent context windows.
+        // Context-aware tool filtering: builder-specific tools appear only on the
+        // builder they serve, and WooCommerce tools only where WooCommerce runs.
+        // When the site context cannot be read, everything is shown (fail-open).
+        // The README's "Tools on one site" table has the measured counts.
         return this.filterToolsByContext(allTools);
     }
     /**
@@ -7719,25 +7905,6 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                     openWorldHint: false,
                 },
             },
-            {
-                name: 'woocommerce_sales_report',
-                description: 'Deprecated compatibility alias for woocommerce_revenue_summary. Retained for two minor releases.',
-                inputSchema: {
-                    type: 'object',
-                    properties: {
-                        period: { type: 'string', description: 'week, month, year, custom' },
-                        date_min: { type: 'string', description: 'Start date for custom period' },
-                        date_max: { type: 'string', description: 'End date for custom period' },
-                    },
-                },
-                annotations: {
-                    title: "Sales Report",
-                    readOnlyHint: true,
-                    destructiveHint: false,
-                    idempotentHint: true,
-                    openWorldHint: false,
-                },
-            },
             {
                 name: 'woocommerce_revenue_summary',
                 description: 'Bounded HPOS-compatible revenue summary with currency, store timezone, exact date boundaries, included statuses, pagination coverage, and explicit gross/discount/refund/tax/shipping/net definitions.',
@@ -9675,12 +9842,33 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
         const preview = serialized.slice(0, Math.min(2000, cap / 2));
         const paginationHint = TOOLS_WITH_PAGINATION_HINT[toolName] ||
             'Try re-calling this tool with pagination args (per_page, page, search filter) to limit the result size.';
+        // Ticket 467cb71d: "_truncated: true" and two byte counts did not say
+        // what was lost. On a 235 KB Divi page the preview stopped inside the
+        // first section, far above the element being worked on, and nothing in
+        // the envelope said so. Name the share that is missing and which
+        // top-level keys did not survive the preview at all.
+        const cutBytes = serialized.length - preview.length;
+        const cutPercent = Math.max(1, Math.round((cutBytes / serialized.length) * 100));
+        const topKeys = result && typeof result === 'object' && !Array.isArray(result) ? Object.keys(result) : [];
+        const keysInPreview = topKeys.filter((key) => preview.includes(`${JSON.stringify(key)}:`));
+        const keysCut = topKeys.filter((key) => !keysInPreview.includes(key));
         const envelope = {
             _truncated: true,
             _original_size_bytes: serialized.length,
             _cap_bytes: cap,
             _tool_name: toolName,
             _preview_json: preview,
+            _returned_bytes: preview.length,
+            _cut_bytes: cutBytes,
+            _cut: `This response carries the first ${preview.length} bytes of ${serialized.length}. ` +
+                `${cutBytes} bytes, about ${cutPercent}% of the answer, are not here, ` +
+                'and the preview stops mid-structure wherever that byte count fell.' +
+                (keysCut.length
+                    ? ` Nothing was returned for: ${keysCut.join(', ')}.`
+                    : '') +
+                (keysInPreview.length
+                    ? ` Partly present: ${keysInPreview.join(', ')}.`
+                    : ''),
             _hint: paginationHint,
             _why: 'Response exceeded the MCP server response-size cap. ' +
                 'Most MCP hosts (Claude Desktop, Cursor) silently kill the subprocess ' +
@@ -9784,11 +9972,16 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                 return await client.listPages(args);
             case 'wordpress_read_page':
                 return await client.getPage(args.id, args.include);
-            case 'wordpress_create_page_duplicate':
+            case 'wordpress_create_page_duplicate': {
+                const originalId = args.original_id ?? args.page_id ?? args.post_id;
+                if (originalId === undefined || originalId === null) {
+                    throw new Error('create_page_duplicate needs original_id, page_id, or post_id.');
+                }
                 return {
-                    ...(await client.duplicatePage(args.original_id, args.suffix, args.include)),
+                    ...(await client.duplicatePage(originalId, args.suffix, args.include)),
                     respira_approvals_url: client.getApprovalsUrl(),
                 };
+            }
             case 'wordpress_update_page': {
                 const approvalsUrl = client.getApprovalsUrl();
                 const page = await client.updatePage(args.id, args);
@@ -9817,11 +10010,19 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                 return await client.listPosts(args);
             case 'wordpress_read_post':
                 return await client.getPost(args.id, args.include);
-            case 'wordpress_create_post_duplicate':
+            case 'wordpress_create_post_duplicate': {
+                // Same shape as the page tool above (ticket 81c478df): a missing id
+                // used to reach WordPress as the literal string "undefined" in the
+                // path, and came back as a 404 that read like a plugin problem.
+                const originalId = args.original_id ?? args.post_id ?? args.page_id;
+                if (originalId === undefined || originalId === null) {
+                    throw new Error('create_post_duplicate needs original_id, post_id, or page_id.');
+                }
                 return {
-                    ...(await client.duplicatePost(args.original_id, args.suffix, args.include)),
+                    ...(await client.duplicatePost(originalId, args.suffix, args.include)),
                     respira_approvals_url: client.getApprovalsUrl(),
                 };
+            }
             case 'respira_duplicate_with_translations':
                 return await client.duplicateWithTranslations({
                     post_id: args.post_id,
@@ -10092,7 +10293,11 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             case 'wordpress_analyze_performance':
                 return await client.analyzePerformance(args.page_id);
             case 'wordpress_get_core_web_vitals':
-                return await client.getCoreWebVitals(args.page_id);
+                return await client.getCoreWebVitals({
+                    page_id: args.page_id,
+                    url: args.url,
+                    strategy: args.strategy,
+                });
             case 'wordpress_run_pagespeed_audit':
                 return await client.runPageSpeedAudit({
                     page_id: args.page_id,
@@ -10124,7 +10329,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             case 'wordpress_check_structured_data':
                 return await client.checkStructuredData(args.page_id);
             case 'wordpress_run_security_audit':
-                return await client.runSecurityAudit(args.advisory_ids || [], args.deep_scan === true);
+                return await client.runSecurityAudit(args.advisory_ids || [], args.deep_scan === true, args.probe_uploads_execution === true, args.known_vulnerabilities !== false);
             case 'wordpress_update_core_security':
                 return await client.updateCoreSecurity({
                     advisoryId: args.advisory_id,
@@ -10132,6 +10337,10 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                     backupConfirmed: args.backup_confirmed === true,
                     approvalToken: args.approval_token,
                 });
+            case 'wordpress_update_theme':
+                return await client.updateTheme(args.stylesheet, args.approval_token);
+            case 'wordpress_revoke_application_password':
+                return await client.revokeApplicationPassword(Number(args.user_id), String(args.uuid), args.approval_token);
             // Accessibility
             case 'wordpress_list_accessibility_scans':
                 return await client.listAccessibilityScans({
@@ -10145,7 +10354,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                 return await client.scanPageAccessibility(args.page_id, args.standard, args.url);
             case 'wordpress_apply_accessibility_fixes':
                 return await client.applyAccessibilityFixes(args.scan_id, args.rule_ids);
-            // Plugin Management (EXPERIMENTAL)
+            // Plugin Management
             case 'wordpress_list_plugins':
                 return await client.listPlugins();
             case 'wordpress_install_plugin':
@@ -10274,7 +10483,10 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             case 'wordpress_get_option':
                 return await client.getOption(args.option);
             case 'wordpress_update_option':
-                return await client.updateOption(args.option, args.value);
+                return await client.updateOption(args.option, args.value, {
+                    allow_type_change: args.allow_type_change,
+                    allow_object_overwrite: args.allow_object_overwrite,
+                });
             case 'wordpress_delete_option':
                 return await client.deleteOption(args.option, args.approval_token);
             case 'wordpress_purge_cache':
@@ -10341,6 +10553,10 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                 return await client.callRestV1('GET', '/activity', args);
             case 'wordpress_get_activity':
                 return await client.callRestV1('GET', `/activity/${args.id}`);
+            case 'wordpress_generate_activity_report': {
+                const { site_id: _siteId, ...reportInput } = args || {};
+                return await client.generateActivityReport(reportInput);
+            }
             case 'wordpress_get_site_template':
                 return await client.callRestV2('GET', '/fse/template', args);
             case 'wordpress_create_site_template':
@@ -10478,8 +10694,6 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                 const { id, ...payload } = args;
                 return await client.woocommerceUpdateStock(id, payload);
             }
-            case 'woocommerce_sales_report':
-                return await client.woocommerceSalesReport(args);
             case 'woocommerce_revenue_summary':
                 return await client.callRestV1('GET', '/woocommerce/reports/revenue-summary', args);
             case 'woocommerce_sales_timeseries':
@@ -10891,6 +11105,19 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                 }
                 // Return isError result instead of throwing — unknown tool is an execution
                 // error, not a protocol error. This lets LLMs self-correct gracefully.
+                // A tool removed in a major release answers with its replacement, so a
+                // saved workflow or an older skill learns the new name in one turn
+                // instead of guessing from "Unknown tool".
+                const retired = RETIRED_TOOLS[name];
+                if (retired) {
+                    return {
+                        __respira_is_error: true,
+                        error: `Retired tool: ${name}`,
+                        code: 'respira_tool_retired',
+                        replacement: retired.replacement,
+                        hint: `${name} was removed in ${retired.removedIn}. Call ${retired.replacement} instead. ${retired.note}`,
+                    };
+                }
                 return {
                     __respira_is_error: true,
                     error: `Unknown tool: ${name}`,
@@ -10922,6 +11149,18 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                             type: 'string',
                             description: 'Optional text to narrow the result set to elements whose own text or attribute values contain it. Works for every identifier_type. It separates siblings; it cannot separate an element from an ancestor that contains it, so use identifier_type "path" when you need certainty.',
                         },
+                        // Ticket 467cb71d: the plugin has honoured `include` since 7.1.0
+                        // and the compact answer told agents to pass it, but it was missing
+                        // from this schema, so hosts dropped it before the call left. On a
+                        // 235 KB Divi page that left no way at all to read one element:
+                        // extract_builder_content was over the response cap and this was
+                        // the documented alternative. The element could be written and
+                        // never read, so the value had to be reconstructed from the
+                        // rendered front end, which added attributes nobody asked for.
+                        include: {
+                            type: 'string',
+                            description: 'CSV of optional response sections. Pass "content" (or "full") for the element\'s stored body: settings, attributes and children, exactly as the builder saved them. Without it the answer is a compact summary with a one-line preview, which cannot be edited from. This is the way to read one element on a page too large for extract_builder_content.',
+                        },
                     },
                     required: ['post_id', 'identifier_type', 'identifier_value'],
                 },
@@ -10969,7 +11208,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                         editTarget: {
                             type: 'string',
                             enum: ['live', 'duplicate'],
-                            description: 'Deprecated camelCase alias of edit_target. Prefer edit_target. Kept for back-compat with pre-v6.19.5 callers.',
+                            description: 'Deprecated camelCase alias of edit_target. Prefer edit_target. Kept so older callers keep working.',
                         },
                         confirm_live_edit: {
                             type: 'boolean',