@respira/wordpress-mcp-server 8.3.25 → 8.3.26

package/CHANGELOG.md

@@ -5,6 +5,61 @@ All notable changes to Respira WordPress MCP Server will be documented in this f
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [8.3.26] - 2026-09-17
+
+### Added
+
+- **diagnose_connection says when the host answers /.well-known/ itself.** Some hosts serve
+  everything under `/.well-known/` before WordPress runs, so the OAuth discovery document
+  ChatGPT looks for comes back as the host's own 404 while the plugin is fine. The diagnostic
+  fetches both that address and the plugin's own route, compares them, and when the host is
+  answering first it says so with both status codes, the title of the page that came back, and
+  the one line to ask the host for.
+
+### Fixed
+
+- **Duplicating a post takes the id names agents already use.** `create_post_duplicate` read
+  only `original_id`, so a call with `post_id` or `page_id` sent WordPress the literal word
+  "undefined" in the path and came back a 404. It now accepts all three and refuses a missing
+  id before anything leaves your machine, the same way the page tool already did in 8.3.25.
+- **A missing route stops blaming your plugin version.** When a Respira route 404s on a site
+  whose namespace is live, the message said the installed plugin is older than the tool and
+  sent you to wp-admin. On a site running 8.9.1 with no update offered anywhere that advice
+  was wrong three times across two sessions, while the real cause, an unusable id in the
+  request path, was already printed in the same sentence. The message now names that segment
+  when it is there, and says the plugin is behind only when the plugin's own declared MCP
+  ceiling is below this build.
+- **Update advice matches the install that is answering.** On a Claude Desktop `.mcpb` bundle
+  every response printed `npm i -g @respira/wordpress-mcp-server@latest`. Running it installs
+  a second copy Claude Desktop never loads: the version does not change, and nothing says so.
+  A bundle install is told to update the extension in Claude Desktop, an npx run to restart
+  and clear its cache, a project install to update that project, a source checkout to rebuild,
+  and only a genuine global install gets the global npm command.
+- **A 403 from a web server now carries its evidence.** The answer used to be a ranked list of
+  likely causes, which read as a diagnosis and sent at least one person through Cloudflare
+  rules that were not the cause. It now reports the verb and address, how many bytes the body
+  carried, the headers that name the layer, and that the response has none of the plugin's own
+  headers, which proves WordPress never ran and nothing was written. Uploads already leave as
+  multipart form-data, so when the block is by size the message says to quote that size to the
+  host along with the exact request.
+- **One element can be read on a page too big to extract.** `find_element` now declares the
+  `include` parameter its own answer tells you to pass, so `include: "content"` returns the
+  element body the builder stored instead of a one-line preview. A truncated answer also says
+  how many bytes were cut and which parts are missing.
+- **A plugin whose file contains a slash can be deactivated.** WordPress names a plugin by its
+  file, `WP PROTECTION/SECURITY.php`, and a slash cannot travel inside one URL path segment.
+  The folder now goes in the path and the exact file in the body, so activate, deactivate,
+  update and delete reach the plugin the site actually lists. The body field needs plugin
+  9.0.2; on older plugins the folder alone still resolves.
+
+### Documentation
+
+- **The block libraries are documented as what they are.** Spectra, Kadence Blocks,
+  GenerateBlocks and GreenShift each have their own adapter, detection, block namespace and
+  module list, and read and write through the Gutenberg block path. Their schemas come from
+  the live block registry on your site rather than a Respira-authored pack, which is why
+  `intelligence_package` reads `gutenberg` for all four.
+
 ## [8.3.25] - 2026-09-14
 
 ### Fixed

package/README.md

@@ -377,6 +377,23 @@ respira_add_image({ post_id: 42, image_url: "https://..." })
 | **Thrive Architect** | Basic | Tree utility | Best-effort | — |
 | **Visual Composer** | Basic | Tree utility | Best-effort | — |
 
+### The Gutenberg-native block libraries
+
+Spectra, Kadence Blocks, GenerateBlocks and GreenShift store ordinary WordPress
+blocks in `post_content`. Each has its own adapter in the plugin, with its own
+detection, its own block namespace (`kadence/*`, `uagb/*`, `generateblocks/*`,
+`greenshift-blocks/*`) and its own module list, and reads and writes go through
+the Gutenberg parse and serialize path. Element operations, `build_page` and
+snapshots all work on them.
+
+What they do not have is a Respira-authored schema pack of their own, and they
+do not need one: the Gutenberg intelligence package reads the live
+`WP_Block_Type_Registry` on your site, so it already enumerates their blocks
+and attributes, including any block the library added after this build shipped.
+`respira_get_builder_info` reports this in `intelligence_package`, which reads
+`gutenberg` for all four. `intelligence_available: false` for one of them means
+the site is running a plugin older than 8.2.1.
+
 ---
 
 ## All Tools

package/dist/__tests__/087103bc-the-host-answers-well-known-first.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=087103bc-the-host-answers-well-known-first.test.d.ts.map

package/dist/__tests__/087103bc-the-host-answers-well-known-first.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"087103bc-the-host-answers-well-known-first.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/087103bc-the-host-answers-well-known-first.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/087103bc-the-host-answers-well-known-first.test.js

@@ -0,0 +1,73 @@
+/**
+ * Ticket 087103bc: the host answers /.well-known/ itself, before WordPress.
+ *
+ * Measured on an nginx SiteGround site: /.well-known/oauth-protected-resource
+ * returned the host's own 404 page, titled "404 - Not found", with nothing
+ * WordPress in it, while /wp-json/respira/v1/oauth-protected-resource returned
+ * 200 JSON. ChatGPT only looks at the /.well-known/ address, so the connection
+ * failed while the plugin was fine, and nothing inside WordPress could see it.
+ */
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { wellKnownOwnership } from '../wordpress-client.js';
+const hostFourOhFour = {
+    label: 'well_known_oauth_protected_resource',
+    url: 'https://www.example.com/.well-known/oauth-protected-resource',
+    status: 404,
+    looks_like_html: true,
+    title_text: '404 - Not found',
+    body_snippet: '<html><head><title>404 - Not found</title></head><body>404 - Not found</body></html>',
+    headers: { server: 'nginx', link: null },
+};
+const pluginRoute = {
+    label: 'respira_oauth_protected_resource',
+    url: 'https://www.example.com/wp-json/respira/v1/oauth-protected-resource',
+    status: 200,
+    looks_like_html: false,
+    title_text: null,
+    body_snippet: '{"resource":"https://www.example.com/wp-json/respira/v1/mcp","authorization_servers":["https://www.respira.press"]}',
+    headers: {},
+};
+test('a host 404 on /.well-known/ next to a working plugin route is reported as the host answering first', () => {
+    const result = wellKnownOwnership(hostFourOhFour, pluginRoute);
+    assert.equal(result.verdict, 'host_answers_first');
+    assert.equal(result.evidence.well_known_status, 404);
+    assert.equal(result.evidence.rest_mirror_status, 200);
+    assert.equal(result.evidence.well_known_looks_like_wordpress, false);
+    const said = String(result.recommendation);
+    assert.match(said, /returned 404/);
+    assert.match(said, /404 - Not found/);
+    assert.match(said, /no WordPress marker/);
+    assert.match(said, /returned 200 as WordPress/);
+    assert.match(said, /except \/\.well-known\/acme-challenge\//);
+});
+test('WordPress serving the metadata itself needs no advice', () => {
+    const served = { ...hostFourOhFour, status: 200, title_text: null, body_snippet: pluginRoute.body_snippet };
+    const result = wellKnownOwnership(served, pluginRoute);
+    assert.equal(result.verdict, 'wordpress_serves_it');
+    assert.equal(result.recommendation, null);
+    assert.equal(result.evidence.well_known_looks_like_wordpress, true);
+});
+test("a theme's own 404 at that address is WordPress, not the host", () => {
+    const themeFourOhFour = {
+        ...hostFourOhFour,
+        title_text: 'Page not found - Example',
+        body_snippet: '<html><head><link rel="https://api.w.org/" href="https://www.example.com/wp-json/"></head></html>',
+    };
+    const result = wellKnownOwnership(themeFourOhFour, pluginRoute);
+    assert.equal(result.verdict, 'wordpress_serves_it');
+    assert.equal(result.recommendation, null);
+});
+test('a site where neither address answers is not blamed on the host', () => {
+    const result = wellKnownOwnership(hostFourOhFour, { ...pluginRoute, status: 503 });
+    assert.equal(result.verdict, 'both_unreachable');
+    assert.equal(result.recommendation, null);
+    assert.match(String(result.evidence.note), /the plugin route did not answer either/);
+});
+test('a probe that never came back says so instead of guessing', () => {
+    const dropped = { label: 'well_known_oauth_protected_resource', url: 'x', error: 'ETIMEDOUT' };
+    const result = wellKnownOwnership(dropped, pluginRoute);
+    assert.equal(result.verdict, 'unknown');
+    assert.equal(result.recommendation, null);
+});
+//# sourceMappingURL=087103bc-the-host-answers-well-known-first.test.js.map

package/dist/__tests__/087103bc-the-host-answers-well-known-first.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"087103bc-the-host-answers-well-known-first.test.js","sourceRoot":"","sources":["../../src/__tests__/087103bc-the-host-answers-well-known-first.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE5D,MAAM,cAAc,GAAG;IACrB,KAAK,EAAE,qCAAqC;IAC5C,GAAG,EAAE,8DAA8D;IACnE,MAAM,EAAE,GAAG;IACX,eAAe,EAAE,IAAI;IACrB,UAAU,EAAE,iBAAiB;IAC7B,YAAY,EAAE,sFAAsF;IACpG,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE;CACzC,CAAC;AAEF,MAAM,WAAW,GAAG;IAClB,KAAK,EAAE,kCAAkC;IACzC,GAAG,EAAE,qEAAqE;IAC1E,MAAM,EAAE,GAAG;IACX,eAAe,EAAE,KAAK;IACtB,UAAU,EAAE,IAAI;IAChB,YAAY,EAAE,qHAAqH;IACnI,OAAO,EAAE,EAAE;CACZ,CAAC;AAEF,IAAI,CAAC,oGAAoG,EAAE,GAAG,EAAE;IAC9G,MAAM,MAAM,GAAG,kBAAkB,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAE/D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IACrD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;IAErE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC3C,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACnC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IACtC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;IAC1C,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC;IAChD,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,yCAAyC,CAAC,CAAC;AAChE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uDAAuD,EAAE,GAAG,EAAE;IACjE,MAAM,MAAM,GAAG,EAAE,GAAG,cAAc,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,CAAC,YAAY,EAAE,CAAC;IAC5G,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAEvD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;IACpD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IAC1C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,+BAA+B,EAAE,IAAI,CAAC,CAAC;AACtE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,8DAA8D,EAAE,GAAG,EAAE;IACxE,MAAM,eAAe,GAAG;QACtB,GAAG,cAAc;QACjB,UAAU,EAAE,0BAA0B;QACtC,YAAY,EAAE,mGAAmG;KAClH,CAAC;IACF,MAAM,MAAM,GAAG,kBAAkB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IAEhE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;IACpD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;AAC5C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gEAAgE,EAAE,GAAG,EAAE;IAC1E,MAAM,MAAM,GAAG,kBAAkB,CAAC,cAAc,EAAE,EAAE,GAAG,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACnF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;IACjD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IAC1C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,wCAAwC,CAAC,CAAC;AACvF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0DAA0D,EAAE,GAAG,EAAE;IACpE,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,qCAAqC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAC/F,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACxD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACxC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;AAC5C,CAAC,CAAC,CAAC"}

package/dist/__tests__/685d8023-a-403-from-the-web-server-shows-its-evidence.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=685d8023-a-403-from-the-web-server-shows-its-evidence.test.d.ts.map

package/dist/__tests__/685d8023-a-403-from-the-web-server-shows-its-evidence.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"685d8023-a-403-from-the-web-server-shows-its-evidence.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/685d8023-a-403-from-the-web-server-shows-its-evidence.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/685d8023-a-403-from-the-web-server-shows-its-evidence.test.js

@@ -0,0 +1,106 @@
+/**
+ * Ticket 685d8023: uploads over roughly 500 bytes were refused with a 403 on
+ * one site while a 250-byte upload succeeded. The connector answered with a
+ * ranked list of likely causes, which read as a diagnosis and was not one.
+ *
+ * The upload path already sends multipart/form-data, not a base64 JSON body,
+ * so there is no plainer request shape left to try from this side. What the
+ * answer can do is carry the proof: the verb, the path, the size of the body,
+ * the headers that name the layer, and the absence of the header the plugin
+ * stamps on every REST response it serves.
+ */
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import FormData from 'form-data';
+import axios from 'axios';
+import { nonWordPressBlockEvidence, nonWordPressBlockAsk, WordPressClient, } from '../wordpress-client.js';
+const blocked403 = {
+    config: {
+        method: 'post',
+        url: '/media/upload',
+        baseURL: 'https://www.example.com/wp-json/respira/v1',
+        headers: {
+            'Content-Type': 'multipart/form-data; boundary=--------x',
+            'Content-Length': '36412',
+        },
+    },
+    response: {
+        status: 403,
+        headers: { server: 'nginx', 'cf-ray': '8d2f1a2b3c4d5e6f-OTP' },
+        data: '<html><head><title>403 Forbidden</title></head></html>',
+    },
+};
+test('a web-server 403 reports the request and the headers, not a ranked guess', () => {
+    const evidence = nonWordPressBlockEvidence(blocked403);
+    assert.match(evidence, /POST \/media\/upload/);
+    assert.match(evidence, /36,412 byte body/);
+    assert.match(evidence, /multipart\/form-data/);
+    assert.match(evidence, /no X-Respira-Plugin-Version header/);
+    assert.match(evidence, /nothing was written/);
+    assert.match(evidence, /server: nginx/);
+    assert.match(evidence, /cf-ray: 8d2f1a2b3c4d5e6f-OTP/);
+});
+test('the answer says what to ask the host, with the request in it', () => {
+    const ask = nonWordPressBlockAsk(blocked403);
+    assert.match(ask, /POST to https:\/\/www\.example\.com\/wp-json\/respira\/v1\/media\/upload/);
+    assert.match(ask, /ModSecurity audit log/);
+    assert.match(ask, /rule id/);
+});
+test('a layer that names itself in no header is described as exactly that', () => {
+    const evidence = nonWordPressBlockEvidence({
+        config: { method: 'get', url: '/pages' },
+        response: { status: 403, headers: {}, data: '<html></html>' },
+    });
+    assert.match(evidence, /did not identify itself/);
+    assert.match(evidence, /no body/);
+});
+test('when WordPress did answer, the evidence says so instead', () => {
+    const evidence = nonWordPressBlockEvidence({
+        config: { method: 'post', url: '/media/upload' },
+        response: { status: 403, headers: { 'x-respira-plugin-version': '9.0.1' }, data: '' },
+    });
+    assert.match(evidence, /X-Respira-Plugin-Version: 9\.0\.1/);
+    assert.match(evidence, /WordPress did answer/);
+});
+test('the upload leaves as multipart form-data, not as a base64 JSON body', async () => {
+    const saved = axios.defaults.adapter;
+    const seen = [];
+    try {
+        axios.defaults.adapter = ((config) => {
+            const contentType = String(config.headers?.['Content-Type'] || config.headers?.['content-type'] || '');
+            const body = config.data;
+            seen.push({
+                url: config.url || '',
+                contentType,
+                isMultipart: Buffer.isBuffer(body) && body.toString('utf8', 0, 200).includes('Content-Disposition: form-data'),
+            });
+            return Promise.resolve({
+                status: 200,
+                statusText: 'OK',
+                headers: { 'content-type': 'application/json' },
+                config,
+                data: { media: { id: 1 } },
+                request: {},
+            });
+        });
+        const client = new WordPressClient({
+            id: 'upload-shape-test',
+            name: 'Upload Shape Test',
+            url: 'https://example.com',
+            apiKey: 'test-key',
+        });
+        // A 3 KB payload, above the size that failed on the reporting site.
+        const payload = Buffer.alloc(3072, 7).toString('base64');
+        await client.uploadMedia(payload, 'featured.webp', 'image/webp');
+        assert.equal(seen.length, 1);
+        assert.equal(seen[0].url, '/media/upload');
+        assert.match(seen[0].contentType, /^multipart\/form-data/);
+        assert.equal(seen[0].isMultipart, true);
+        // FormData is what builds it, so this pins the dependency the shape rests on.
+        assert.equal(typeof new FormData().getBuffer, 'function');
+    }
+    finally {
+        axios.defaults.adapter = saved;
+    }
+});
+//# sourceMappingURL=685d8023-a-403-from-the-web-server-shows-its-evidence.test.js.map

package/dist/__tests__/685d8023-a-403-from-the-web-server-shows-its-evidence.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"685d8023-a-403-from-the-web-server-shows-its-evidence.test.js","sourceRoot":"","sources":["../../src/__tests__/685d8023-a-403-from-the-web-server-shows-its-evidence.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,QAAQ,MAAM,WAAW,CAAC;AACjC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAEhC,MAAM,UAAU,GAAG;IACjB,MAAM,EAAE;QACN,MAAM,EAAE,MAAM;QACd,GAAG,EAAE,eAAe;QACpB,OAAO,EAAE,4CAA4C;QACrD,OAAO,EAAE;YACP,cAAc,EAAE,yCAAyC;YACzD,gBAAgB,EAAE,OAAO;SAC1B;KACF;IACD,QAAQ,EAAE;QACR,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,sBAAsB,EAAE;QAC9D,IAAI,EAAE,wDAAwD;KAC/D;CACF,CAAC;AAEF,IAAI,CAAC,0EAA0E,EAAE,GAAG,EAAE;IACpF,MAAM,QAAQ,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;IAEvD,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC;IAC/C,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IAC3C,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC;IAC/C,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,oCAAoC,CAAC,CAAC;IAC7D,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;IAC9C,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IACxC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,8BAA8B,CAAC,CAAC;AACzD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,8DAA8D,EAAE,GAAG,EAAE;IACxE,MAAM,GAAG,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,0EAA0E,CAAC,CAAC;IAC9F,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IAC3C,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;AAC/B,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qEAAqE,EAAE,GAAG,EAAE;IAC/E,MAAM,QAAQ,GAAG,yBAAyB,CAAC;QACzC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE;QACxC,QAAQ,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE;KAC9D,CAAC,CAAC;IACH,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CAAC;IAClD,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AACpC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yDAAyD,EAAE,GAAG,EAAE;IACnE,MAAM,QAAQ,GAAG,yBAAyB,CAAC;QACzC,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,EAAE;QAChD,QAAQ,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,0BAA0B,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;KACtF,CAAC,CAAC;IACH,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,mCAAmC,CAAC,CAAC;IAC5D,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC;AACjD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;IACrF,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;IACrC,MAAM,IAAI,GAAsE,EAAE,CAAC;IAEnF,IAAI,CAAC;QACH,KAAK,CAAC,QAAQ,CAAC,OAAO,GAAG,CAAC,CAAC,MAAW,EAAE,EAAE;YACxC,MAAM,WAAW,GAAG,MAAM,CACxB,MAAM,CAAC,OAAO,EAAE,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,CAC3E,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC;gBACR,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,EAAE;gBACrB,WAAW;gBACX,WAAW,EACT,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,gCAAgC,CAAC;aACpG,CAAC,CAAC;YACH,OAAO,OAAO,CAAC,OAAO,CAAC;gBACrB,MAAM,EAAE,GAAG;gBACX,UAAU,EAAE,IAAI;gBAChB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,MAAM;gBACN,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE;gBAC1B,OAAO,EAAE,EAAE;aACZ,CAAC,CAAC;QACL,CAAC,CAAQ,CAAC;QAEV,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,EAAE,EAAE,mBAAmB;YACvB,IAAI,EAAE,mBAAmB;YACzB,GAAG,EAAE,qBAAqB;YAC1B,MAAM,EAAE,UAAU;SACZ,CAAC,CAAC;QAEV,oEAAoE;QACpE,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACzD,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC;QAEjE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC;QAC3D,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACxC,8EAA8E;QAC9E,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,QAAQ,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAC5D,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,QAAQ,CAAC,OAAO,GAAG,KAAK,CAAC;IACjC,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/__tests__/81c478df-rest-no-route-blames-the-plugin.test.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Second half of ticket 81c478df.
+ *
+ * The id-alias fix stopped `create_page_duplicate` from sending
+ * /pages/undefined/duplicate. This covers what the operator was TOLD while it
+ * did: every rest_no_route under a registered namespace was reported as "the
+ * installed plugin is older than this tool. Update Respira in wp-admin under
+ * Plugins." The reporting site ran 8.9.1 with no update available anywhere,
+ * so the advice sent them to wp-admin three times across two sessions for an
+ * update that did not exist.
+ *
+ * Two facts were available and unused: the unusable path segment sitting in
+ * the message already, and the plugin's own declared max_mcp_version.
+ */
+export {};
+//# sourceMappingURL=81c478df-rest-no-route-blames-the-plugin.test.d.ts.map

package/dist/__tests__/81c478df-rest-no-route-blames-the-plugin.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"81c478df-rest-no-route-blames-the-plugin.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/81c478df-rest-no-route-blames-the-plugin.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG"}

package/dist/__tests__/81c478df-rest-no-route-blames-the-plugin.test.js

@@ -0,0 +1,105 @@
+/**
+ * Second half of ticket 81c478df.
+ *
+ * The id-alias fix stopped `create_page_duplicate` from sending
+ * /pages/undefined/duplicate. This covers what the operator was TOLD while it
+ * did: every rest_no_route under a registered namespace was reported as "the
+ * installed plugin is older than this tool. Update Respira in wp-admin under
+ * Plugins." The reporting site ran 8.9.1 with no update available anywhere,
+ * so the advice sent them to wp-admin three times across two sessions for an
+ * update that did not exist.
+ *
+ * Two facts were available and unused: the unusable path segment sitting in
+ * the message already, and the plugin's own declared max_mcp_version.
+ */
+import { test, after } from 'node:test';
+import assert from 'node:assert/strict';
+import http from 'node:http';
+import { WordPressClient } from '../wordpress-client.js';
+const servers = [];
+after(() => { for (const s of servers)
+    s.close(); });
+/**
+ * A site with the Respira namespace live and the compatibility endpoint
+ * answering, where every other route is missing.
+ */
+async function startSite(compatibility) {
+    const server = http.createServer((req, res) => {
+        const url = req.url || '';
+        if (url.startsWith('/wp-json/respira/v2/server/compatibility') && compatibility) {
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify(compatibility));
+            return;
+        }
+        // The namespace index: proof the plugin is active and REST routing works.
+        if (url === '/wp-json/respira/v2' || url === '/wp-json/respira/v2/') {
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ namespace: 'respira/v2', routes: {} }));
+            return;
+        }
+        res.writeHead(404, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            code: 'rest_no_route',
+            message: 'No route was found matching the URL and request method.',
+            data: { status: 404 },
+        }));
+    });
+    servers.push(server);
+    await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+    const { port } = server.address();
+    const client = new WordPressClient({
+        id: 's',
+        name: 's',
+        url: `http://127.0.0.1:${port}`,
+        apiKey: `respira_site_${'x'.repeat(24)}`,
+    });
+    // Skip version negotiation: the route under test is a v2 route.
+    client.negotiatedApiVersion = 'v2';
+    return client;
+}
+async function messageFor(client, id) {
+    try {
+        await client.duplicatePage(id);
+    }
+    catch (err) {
+        return String(err?.message ?? err);
+    }
+    throw new Error('the duplicate call was expected to fail');
+}
+test('an "undefined" id in the path is named, not blamed on the plugin version', async () => {
+    const client = await startSite({ plugin_version: '8.9.1', min_mcp_version: '8.0.0' });
+    const message = await messageFor(client, undefined);
+    assert.match(message, /\[attempted: POST .*\/pages\/undefined\/duplicate\]/);
+    assert.match(message, /carried "undefined" where the route expects an id/);
+    assert.doesNotMatch(message, /older than this tool/, 'a malformed request path says nothing about the plugin version');
+    assert.doesNotMatch(message, /Update Respira in wp-admin/);
+});
+test('a plugin that does not declare itself behind is not called out of date', async () => {
+    // 8.9.1 with no max_mcp_version: the plugin publishes no ceiling, so there
+    // is no evidence it predates this tool.
+    const client = await startSite({ plugin_version: '8.9.1', min_mcp_version: '8.0.0' });
+    const message = await messageFor(client, 200);
+    assert.match(message, /\[attempted: POST .*\/pages\/200\/duplicate\]/);
+    assert.match(message, /The Respira namespace IS registered/);
+    assert.match(message, /v8\.9\.1/, 'name the version actually installed');
+    assert.match(message, /does not report itself as older than this tool/);
+    assert.doesNotMatch(message, /Update Respira in wp-admin/);
+});
+test('a plugin whose declared ceiling is below this build is told to update', async () => {
+    const client = await startSite({
+        plugin_version: '6.2.0',
+        min_mcp_version: '6.0.0',
+        max_mcp_version: '6.2.0',
+    });
+    const message = await messageFor(client, 200);
+    assert.match(message, /supports Respira MCP up to v6\.2\.0/);
+    assert.match(message, /Update Respira in wp-admin under Plugins/);
+});
+test('an unreadable compatibility endpoint still does not invent a verdict', async () => {
+    const client = await startSite(null);
+    const message = await messageFor(client, 200);
+    assert.match(message, /installed version unknown/);
+    assert.doesNotMatch(message, /Update Respira in wp-admin/);
+    assert.match(message, /respira_diagnose_connection/);
+});
+//# sourceMappingURL=81c478df-rest-no-route-blames-the-plugin.test.js.map

package/dist/__tests__/81c478df-rest-no-route-blames-the-plugin.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"81c478df-rest-no-route-blames-the-plugin.test.js","sourceRoot":"","sources":["../../src/__tests__/81c478df-rest-no-route-blames-the-plugin.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,MAAM,OAAO,GAAkB,EAAE,CAAC;AAClC,KAAK,CAAC,GAAG,EAAE,GAAG,KAAK,MAAM,CAAC,IAAI,OAAO;IAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAErD;;;GAGG;AACH,KAAK,UAAU,SAAS,CAAC,aAA6C;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5C,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;QAE1B,IAAI,GAAG,CAAC,UAAU,CAAC,0CAA0C,CAAC,IAAI,aAAa,EAAE,CAAC;YAChF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QAED,0EAA0E;QAC1E,IAAI,GAAG,KAAK,qBAAqB,IAAI,GAAG,KAAK,sBAAsB,EAAE,CAAC;YACpE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;YACjE,OAAO;QACT,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;YACrB,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,yDAAyD;YAClE,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE;SACtB,CAAC,CAAC,CAAC;IACN,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;IAEjD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,EAAE,EAAE,GAAG;QACP,IAAI,EAAE,GAAG;QACT,GAAG,EAAE,oBAAoB,IAAI,EAAE;QAC/B,MAAM,EAAE,gBAAgB,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;KACzC,CAAC,CAAC;IACH,gEAAgE;IAC/D,MAAc,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAC5C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,MAAuB,EAAE,EAAW;IAC5D,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,aAAa,CAAC,EAAY,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI,GAAG,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;AAC7D,CAAC;AAED,IAAI,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;IAC1F,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC;IAEtF,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAEpD,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,qDAAqD,CAAC,CAAC;IAC7E,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,mDAAmD,CAAC,CAAC;IAC3E,MAAM,CAAC,YAAY,CACjB,OAAO,EACP,sBAAsB,EACtB,gEAAgE,CACjE,CAAC;IACF,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,4BAA4B,CAAC,CAAC;AAC7D,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;IACxF,2EAA2E;IAC3E,wCAAwC;IACxC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC;IAEtF,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAE9C,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,+CAA+C,CAAC,CAAC;IACvE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,qCAAqC,CAAC,CAAC;IAC7D,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,qCAAqC,CAAC,CAAC;IACzE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,gDAAgD,CAAC,CAAC;IACxE,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,4BAA4B,CAAC,CAAC;AAC7D,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;IACvF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC;QAC7B,cAAc,EAAE,OAAO;QACvB,eAAe,EAAE,OAAO;QACxB,eAAe,EAAE,OAAO;KACzB,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAE9C,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,qCAAqC,CAAC,CAAC;IAC7D,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,0CAA0C,CAAC,CAAC;AACpE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;IACtF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IAErC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAE9C,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC;IACnD,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,4BAA4B,CAAC,CAAC;IAC3D,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,CAAC;AACvD,CAAC,CAAC,CAAC"}

package/dist/__tests__/dfc0e156-plugin-file-with-a-slash.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=dfc0e156-plugin-file-with-a-slash.test.d.ts.map

package/dist/__tests__/dfc0e156-plugin-file-with-a-slash.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dfc0e156-plugin-file-with-a-slash.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/dfc0e156-plugin-file-with-a-slash.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/dfc0e156-plugin-file-with-a-slash.test.js

@@ -0,0 +1,69 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import axios from 'axios';
+import { WordPressClient, pluginRouteTarget } from '../wordpress-client.js';
+test('a plugin file keeps its folder in the path and its file in the body', () => {
+    assert.deepEqual(pluginRouteTarget('WP PROTECTION/SECURITY.php'), {
+        segment: 'WP PROTECTION',
+        body: { plugin_file: 'WP PROTECTION/SECURITY.php' },
+    });
+    // A folder name, and a single-file plugin at the plugins root, carry no
+    // slash and are sent exactly as before.
+    assert.deepEqual(pluginRouteTarget('WP PROTECTION'), { segment: 'WP PROTECTION', body: {} });
+    assert.deepEqual(pluginRouteTarget('hello.php'), { segment: 'hello.php', body: {} });
+    assert.deepEqual(pluginRouteTarget('  /akismet/akismet.php '), {
+        segment: 'akismet',
+        body: { plugin_file: 'akismet/akismet.php' },
+    });
+});
+test('deactivating a plugin whose folder has a space sends one path segment and the exact file', async () => {
+    const saved = axios.defaults.adapter;
+    const seen = [];
+    try {
+        axios.defaults.adapter = ((config) => {
+            seen.push({
+                method: config.method || '',
+                url: config.url || '',
+                data: typeof config.data === 'string' ? JSON.parse(config.data) : config.data,
+            });
+            return Promise.resolve({
+                status: 200,
+                statusText: 'OK',
+                headers: { 'content-type': 'application/json' },
+                config,
+                data: { success: true, message: 'Plugin deactivated successfully' },
+                request: {},
+            });
+        });
+        const client = new WordPressClient({
+            id: 'plugin-slash-test',
+            name: 'Plugin Slash Test',
+            url: 'https://example.com',
+            apiKey: 'test-key',
+        });
+        await client.deactivatePlugin('WP PROTECTION/SECURITY.php');
+        await client.activatePlugin('WP PROTECTION/SECURITY.php');
+        await client.updatePlugin('WP PROTECTION/SECURITY.php', 'token-123');
+        await client.deletePlugin('WP PROTECTION/SECURITY.php');
+        // No %2F anywhere: that is what both attempts in the report sent, and it
+        // never reached the route.
+        assert.equal(seen.some((r) => r.url.toUpperCase().includes('%2F')), false);
+        assert.deepEqual(seen.map((r) => [r.method, r.url]), [
+            ['post', '/plugins/WP%20PROTECTION/deactivate'],
+            ['post', '/plugins/WP%20PROTECTION/activate'],
+            ['post', '/plugins/WP%20PROTECTION/update'],
+            ['delete', '/plugins/WP%20PROTECTION'],
+        ]);
+        assert.deepEqual(seen[0].data, { plugin_file: 'WP PROTECTION/SECURITY.php' });
+        assert.deepEqual(seen[1].data, { plugin_file: 'WP PROTECTION/SECURITY.php' });
+        assert.deepEqual(seen[2].data, {
+            plugin_file: 'WP PROTECTION/SECURITY.php',
+            approval_token: 'token-123',
+        });
+        assert.deepEqual(seen[3].data, { plugin_file: 'WP PROTECTION/SECURITY.php' });
+    }
+    finally {
+        axios.defaults.adapter = saved;
+    }
+});
+//# sourceMappingURL=dfc0e156-plugin-file-with-a-slash.test.js.map

package/dist/__tests__/dfc0e156-plugin-file-with-a-slash.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dfc0e156-plugin-file-with-a-slash.test.js","sourceRoot":"","sources":["../../src/__tests__/dfc0e156-plugin-file-with-a-slash.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE5E,IAAI,CAAC,qEAAqE,EAAE,GAAG,EAAE;IAC/E,MAAM,CAAC,SAAS,CAAC,iBAAiB,CAAC,4BAA4B,CAAC,EAAE;QAChE,OAAO,EAAE,eAAe;QACxB,IAAI,EAAE,EAAE,WAAW,EAAE,4BAA4B,EAAE;KACpD,CAAC,CAAC;IACH,wEAAwE;IACxE,wCAAwC;IACxC,MAAM,CAAC,SAAS,CAAC,iBAAiB,CAAC,eAAe,CAAC,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7F,MAAM,CAAC,SAAS,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACrF,MAAM,CAAC,SAAS,CAAC,iBAAiB,CAAC,yBAAyB,CAAC,EAAE;QAC7D,OAAO,EAAE,SAAS;QAClB,IAAI,EAAE,EAAE,WAAW,EAAE,qBAAqB,EAAE;KAC7C,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0FAA0F,EAAE,KAAK,IAAI,EAAE;IAC1G,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;IACrC,MAAM,IAAI,GAAsD,EAAE,CAAC;IAEnE,IAAI,CAAC;QACH,KAAK,CAAC,QAAQ,CAAC,OAAO,GAAG,CAAC,CAAC,MAAW,EAAE,EAAE;YACxC,IAAI,CAAC,IAAI,CAAC;gBACR,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;gBAC3B,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,EAAE;gBACrB,IAAI,EAAE,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI;aAC9E,CAAC,CAAC;YACH,OAAO,OAAO,CAAC,OAAO,CAAC;gBACrB,MAAM,EAAE,GAAG;gBACX,UAAU,EAAE,IAAI;gBAChB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,MAAM;gBACN,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,iCAAiC,EAAE;gBACnE,OAAO,EAAE,EAAE;aACZ,CAAC,CAAC;QACL,CAAC,CAAQ,CAAC;QAEV,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,EAAE,EAAE,mBAAmB;YACvB,IAAI,EAAE,mBAAmB;YACzB,GAAG,EAAE,qBAAqB;YAC1B,MAAM,EAAE,UAAU;SACZ,CAAC,CAAC;QAEV,MAAM,MAAM,CAAC,gBAAgB,CAAC,4BAA4B,CAAC,CAAC;QAC5D,MAAM,MAAM,CAAC,cAAc,CAAC,4BAA4B,CAAC,CAAC;QAC1D,MAAM,MAAM,CAAC,YAAY,CAAC,4BAA4B,EAAE,WAAW,CAAC,CAAC;QACrE,MAAM,MAAM,CAAC,YAAY,CAAC,4BAA4B,CAAC,CAAC;QAExD,yEAAyE;QACzE,2BAA2B;QAC3B,MAAM,CAAC,KAAK,CACV,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EACrD,KAAK,CACN,CAAC;QAEF,MAAM,CAAC,SAAS,CACd,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAClC;YACE,CAAC,MAAM,EAAE,qCAAqC,CAAC;YAC/C,CAAC,MAAM,EAAE,mCAAmC,CAAC;YAC7C,CAAC,MAAM,EAAE,iCAAiC,CAAC;YAC3C,CAAC,QAAQ,EAAE,0BAA0B,CAAC;SACvC,CACF,CAAC;QAEF,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,4BAA4B,EAAE,CAAC,CAAC;QAC9E,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,4BAA4B,EAAE,CAAC,CAAC;QAC9E,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;YAC7B,WAAW,EAAE,4BAA4B;YACzC,cAAc,EAAE,WAAW;SAC5B,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,4BAA4B,EAAE,CAAC,CAAC;IAChF,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,QAAQ,CAAC,OAAO,GAAG,KAAK,CAAC;IACjC,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/__tests__/fb4ec63e-update-advice-matches-the-install.test.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Regression test for ticket fb4ec63e: the update block printed
+ * `npm i -g @respira/wordpress-mcp-server@latest` on every install shape.
+ *
+ * On a Claude Desktop .mcpb bundle that command succeeds, installs a second
+ * copy the client never loads, and leaves the version unchanged with no error
+ * to say so. The reporter kept a private note reading "do not run the command
+ * Respira prints".
+ *
+ * describeTransportMode already classified the install correctly in the same
+ * session. describeUpdateRoute reads the same signal, so the advice and the
+ * diagnostic can no longer disagree.
+ */
+export {};
+//# sourceMappingURL=fb4ec63e-update-advice-matches-the-install.test.d.ts.map

package/dist/__tests__/fb4ec63e-update-advice-matches-the-install.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fb4ec63e-update-advice-matches-the-install.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/fb4ec63e-update-advice-matches-the-install.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG"}

package/dist/__tests__/fb4ec63e-update-advice-matches-the-install.test.js

@@ -0,0 +1,61 @@
+/**
+ * Regression test for ticket fb4ec63e: the update block printed
+ * `npm i -g @respira/wordpress-mcp-server@latest` on every install shape.
+ *
+ * On a Claude Desktop .mcpb bundle that command succeeds, installs a second
+ * copy the client never loads, and leaves the version unchanged with no error
+ * to say so. The reporter kept a private note reading "do not run the command
+ * Respira prints".
+ *
+ * describeTransportMode already classified the install correctly in the same
+ * session. describeUpdateRoute reads the same signal, so the advice and the
+ * diagnostic can no longer disagree.
+ */
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { describeUpdateRoute, describeTransportMode } from '../config.js';
+const BUNDLE_PATH = '/Users/someone/Library/Application Support/Claude/Claude Extensions/local.mcpb.mihai-dragomirescu.respira-wordpress/server/index.js';
+test('a .mcpb bundle is never told to run npm', () => {
+    const route = describeUpdateRoute({
+        binaryPath: BUNDLE_PATH,
+        env: { RESPIRA_CONNECTION_SOURCE: 'claude_desktop_mcpb' },
+    });
+    assert.equal(route.transport_mode, 'mcpb_bundle');
+    assert.equal(route.upgrade_command, undefined, 'no shell command updates a bundle install');
+    assert.doesNotMatch(route.how_to_update, /npm i -g/);
+    assert.doesNotMatch(String(route.rerun_setup_command), /npx /);
+    assert.match(route.how_to_update, /Claude Desktop/);
+    assert.match(route.how_to_update, /Extensions/);
+});
+test('only a genuine global install gets the global npm command', () => {
+    const route = describeUpdateRoute({
+        binaryPath: '/opt/homebrew/lib/node_modules/@respira/wordpress-mcp-server/dist/index.js',
+        env: {},
+    });
+    assert.equal(route.transport_mode, 'global_npm_install');
+    assert.equal(route.upgrade_command, 'npm i -g @respira/wordpress-mcp-server@latest');
+});
+test('every other install shape names its own update route', () => {
+    const cases = [
+        ['/Users/someone/.npm/_npx/9f2/node_modules/.bin/wordpress-mcp-server', 'npx_cache'],
+        ['/srv/app/node_modules/@respira/wordpress-mcp-server/dist/index.js', 'project_local_install'],
+        ['/Users/someone/code/respira/mcp-server/dist/index.js', 'source_checkout'],
+        ['/opt/weird/launcher.js', 'unknown'],
+    ];
+    for (const [binaryPath, expectedMode] of cases) {
+        const route = describeUpdateRoute({ binaryPath, env: {} });
+        assert.equal(route.transport_mode, expectedMode, binaryPath);
+        assert.notEqual(route.upgrade_command, 'npm i -g @respira/wordpress-mcp-server@latest', `${expectedMode} must not be sent to a global install it does not use`);
+        assert.ok(route.how_to_update.length > 0, `${expectedMode} must say how to update`);
+    }
+});
+test('the update advice and respira_diagnose_connection read the same signal', () => {
+    const env = { RESPIRA_CONNECTION_SOURCE: 'claude_desktop_mcpb' };
+    const transport = describeTransportMode({ binaryPath: BUNDLE_PATH, env, processScanWorked: false });
+    const route = describeUpdateRoute({ binaryPath: BUNDLE_PATH, env });
+    assert.equal(route.transport_mode, transport.transport_mode);
+    assert.equal(route.install_kind, transport.label);
+    assert.equal(route.binary_path, transport.binary_path);
+    assert.equal(transport.is_global_install, false);
+});
+//# sourceMappingURL=fb4ec63e-update-advice-matches-the-install.test.js.map

package/dist/__tests__/fb4ec63e-update-advice-matches-the-install.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fb4ec63e-update-advice-matches-the-install.test.js","sourceRoot":"","sources":["../../src/__tests__/fb4ec63e-update-advice-matches-the-install.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAE1E,MAAM,WAAW,GACf,qIAAqI,CAAC;AAExI,IAAI,CAAC,yCAAyC,EAAE,GAAG,EAAE;IACnD,MAAM,KAAK,GAAG,mBAAmB,CAAC;QAChC,UAAU,EAAE,WAAW;QACvB,GAAG,EAAE,EAAE,yBAAyB,EAAE,qBAAqB,EAAE;KAC1D,CAAC,CAAC;IAEH,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;IAClD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,eAAe,EAAE,SAAS,EAAE,2CAA2C,CAAC,CAAC;IAC5F,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACrD,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC,CAAC;IAC/D,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IACpD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;AAClD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2DAA2D,EAAE,GAAG,EAAE;IACrE,MAAM,KAAK,GAAG,mBAAmB,CAAC;QAChC,UAAU,EAAE,4EAA4E;QACxF,GAAG,EAAE,EAAE;KACR,CAAC,CAAC;IAEH,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,EAAE,oBAAoB,CAAC,CAAC;IACzD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,eAAe,EAAE,+CAA+C,CAAC,CAAC;AACvF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sDAAsD,EAAE,GAAG,EAAE;IAChE,MAAM,KAAK,GAA4B;QACrC,CAAC,qEAAqE,EAAE,WAAW,CAAC;QACpF,CAAC,mEAAmE,EAAE,uBAAuB,CAAC;QAC9F,CAAC,sDAAsD,EAAE,iBAAiB,CAAC;QAC3E,CAAC,wBAAwB,EAAE,SAAS,CAAC;KACtC,CAAC;IAEF,KAAK,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,IAAI,KAAK,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,mBAAmB,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3D,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;QAC7D,MAAM,CAAC,QAAQ,CACb,KAAK,CAAC,eAAe,EACrB,+CAA+C,EAC/C,GAAG,YAAY,uDAAuD,CACvE,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,YAAY,yBAAyB,CAAC,CAAC;IACtF,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wEAAwE,EAAE,GAAG,EAAE;IAClF,MAAM,GAAG,GAAG,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,CAAC;IACjE,MAAM,SAAS,GAAG,qBAAqB,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC;IACpG,MAAM,KAAK,GAAG,mBAAmB,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;IAEpE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC;IAC7D,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;AACnD,CAAC,CAAC,CAAC"}