@yawlabs/caddy-mcp 2.5.6 → 2.5.8

package/README.md

@@ -306,7 +306,7 @@ npm install
 npm run lint       # Biome check
 npm run lint:fix   # Auto-fix
 npm run build      # tsup bundle
-npm test           # Vitest (781 unit tests, +39 POSIX-only unix-socket and launcher tests; +39 live-Caddy integration tests gated by CADDY_MCP_INTEGRATION=1)
+npm test           # Vitest (782 unit tests, +39 POSIX-only unix-socket and launcher tests; +39 live-Caddy integration tests gated by CADDY_MCP_INTEGRATION=1)
 npm run typecheck  # tsc --noEmit
 ```
 

package/dist/index.js

@@ -1633,7 +1633,14 @@ function registerRouteTools(server) {
         "Optional stable @id for the route. When set, repeat calls REPLACE the route in place (idempotent). When omitted, the route is APPENDED \u2014 calling twice with identical args creates a duplicate route. @ids are config-global in Caddy: if this id is already used by a non-route object the call refuses rather than clobbering it."
       )
     },
-    { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+    // destructiveHint is TRUE because the hint covers the whole tool and a host
+    // gates on it before it can see whether the call carries an `id`: with one,
+    // an existing route under that @id is REPLACED wholesale by a PATCH -- its
+    // matchers, its handlers, a subroute holding a whole site's nested routes,
+    // all of it -- which is not the "only additive updates" MCP reserves
+    // destructiveHint:false for. Without an `id` the call only appends. Same
+    // worst-case rule as caddy_config_set and caddy_config_by_id.
+    { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
     async ({ from, to, server: srv, id }) => {
       const match = parseFrom(from.trim());
       if (match.host?.[0]?.trim() === "" || match.host === void 0 && match.path === void 0) {

package/dist/server.js

@@ -1631,7 +1631,14 @@ function registerRouteTools(server) {
         "Optional stable @id for the route. When set, repeat calls REPLACE the route in place (idempotent). When omitted, the route is APPENDED \u2014 calling twice with identical args creates a duplicate route. @ids are config-global in Caddy: if this id is already used by a non-route object the call refuses rather than clobbering it."
       )
     },
-    { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+    // destructiveHint is TRUE because the hint covers the whole tool and a host
+    // gates on it before it can see whether the call carries an `id`: with one,
+    // an existing route under that @id is REPLACED wholesale by a PATCH -- its
+    // matchers, its handlers, a subroute holding a whole site's nested routes,
+    // all of it -- which is not the "only additive updates" MCP reserves
+    // destructiveHint:false for. Without an `id` the call only appends. Same
+    // worst-case rule as caddy_config_set and caddy_config_by_id.
+    { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
     async ({ from, to, server: srv, id }) => {
       const match = parseFrom(from.trim());
       if (match.host?.[0]?.trim() === "" || match.host === void 0 && match.path === void 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/caddy-mcp",
-  "version": "2.5.6",
+  "version": "2.5.8",
   "mcpName": "io.github.YawLabs/caddy-mcp",
   "description": "Caddy MCP server for Claude Code, Cursor, and any MCP client: admin API, config, routes, reverse proxy, TLS, PKI, metrics",
   "license": "MIT",