hostinger-api-mcp 3.28.5 → 3.29.0

package/skills/headless/wait.mjs

@@ -13,16 +13,7 @@
 // error retrying can't fix (the JSON says which), 2 when it couldn't run (`fallback` names the
 // operation to poll by hand instead).
 
-import { spawn } from 'node:child_process';
-
-// ── platform-safe binary names (npm/npx are .cmd on Windows), as in connect/bootstrap.mjs ──────────
-const isWin = process.platform === 'win32';
-const bin = (name) => (isWin ? `${name}.cmd` : name);
-const MCP = [bin('npx'), '-y', '--package=@hostinger/mcp@latest', 'hostinger-api-mcp'];
-// Node >= 18.20.2 / 20.12.2 refuses to spawn a .cmd/.bat without a shell
-// (CVE-2024-27980), so npx.cmd needs shell:true on Windows. Our args are all
-// fixed literals, so enabling the shell introduces no injection risk.
-const spawnShell = isWin;
+import { connect } from './hostinger-mcp.mjs';
 
 const log = (message) => process.stderr.write(`wait: ${message}\n`);
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
@@ -52,83 +43,6 @@ function duration(text) {
   return Number(m[1]) * { s: 1e3, m: 6e4, h: 36e5 }[m[2]];
 }
 
-// One MCP server for the whole wait, spoken to over newline-delimited JSON-RPC on stdio. Once the
-// server dies every pending and later call rejects, so the wait ends with exit 2 rather than hanging.
-function connect() {
-  const child = spawn(MCP[0], MCP.slice(1), { stdio: ['pipe', 'pipe', 'pipe'], shell: spawnShell });
-  const pending = new Map();
-  let buffer = '';
-  let diag = '';
-  let dead = null;
-  let nextId = 0;
-  const die = (reason) => {
-    dead ??= new Error(`the Hostinger MCP server stopped (${reason}): ${diag.trim().slice(-500)}`);
-    for (const { reject } of pending.values()) reject(dead);
-    pending.clear();
-  };
-  child.on('error', (e) => die(e.message));
-  // 'close' comes after stderr is drained, so the reason is in diag. A write to a dying server fails
-  // with EPIPE before that; 'close' still follows, so the EPIPE itself is ignored.
-  child.on('close', (code) => die(`exit code ${code}`));
-  child.stdin.on('error', () => {});
-  child.stderr.on('data', (chunk) => (diag = (diag + chunk).slice(-2000)));
-  child.stdout.on('data', (chunk) => {
-    buffer += chunk;
-    let i;
-    while ((i = buffer.indexOf('\n')) >= 0) {
-      const line = buffer.slice(0, i);
-      buffer = buffer.slice(i + 1);
-      try {
-        const message = JSON.parse(line);
-        pending.get(message.id)?.resolve(message);
-        pending.delete(message.id);
-      } catch {
-        /* not a JSON-RPC line */
-      }
-    }
-  });
-  // A call can stall on a live server (a stuck upstream request), so each one has its own deadline; past
-  // it, it answers like an error reply. A stalled poll is retried; a stalled start ends the wait.
-  const rpc = (method, params) =>
-    new Promise((resolve, reject) => {
-      if (dead) return reject(dead);
-      const id = (nextId += 1);
-      const timer = setTimeout(() => {
-        pending.delete(id);
-        resolve({ error: { message: `no reply to ${method} in 60 s` } });
-      }, 60_000);
-      const settle = (fn) => (value) => {
-        clearTimeout(timer);
-        fn(value);
-      };
-      pending.set(id, { resolve: settle(resolve), reject: settle(reject) });
-      child.stdin.write(`${JSON.stringify({ jsonrpc: '2.0', id, method, params })}\n`);
-    });
-  const ready = rpc('initialize', { protocolVersion: '2025-06-18', capabilities: {}, clientInfo: { name: 'headless-wait', version: '1' } })
-    .then((reply) => {
-      if (reply.error) throw new Error(`the Hostinger MCP server didn't start: ${reply.error.message}`);
-      child.stdin.write(`${JSON.stringify({ jsonrpc: '2.0', method: 'notifications/initialized' })}\n`);
-    });
-  // The server keeps "HTTP <status>" in its error text. A 409 while the setup runs, a 429 or a 5xx is a
-  // poll that didn't answer; any other 4xx (expired sign-in) or an unknown domain won't fix itself by waiting.
-  const execute = async (operation, params) => {
-    await ready;
-    const reply = await rpc('tools/call', { name: 'execute', arguments: { operation, params } });
-    const text = reply.result?.content?.[0]?.text ?? reply.error?.message ?? 'unknown error';
-    if (reply.error || reply.result?.isError) {
-      const status = Number(text.match(/HTTP (\d{3})/)?.[1]);
-      const terminal = (status >= 400 && status < 500 && ![408, 409, 425, 429].includes(status)) || /No website found/.test(text);
-      return { error: text.slice(0, 300), terminal };
-    }
-    try {
-      return { data: JSON.parse(text) };
-    } catch {
-      return { error: text.slice(0, 300), terminal: false };
-    }
-  };
-  return { execute, close: () => child.kill() };
-}
-
 async function httpStatus(url) {
   try {
     const response = await fetch(url, { redirect: 'follow', signal: AbortSignal.timeout(30_000) });
@@ -156,6 +70,10 @@ async function poll(label, timeoutMs, check) {
   }
 }
 
+// A 409 while the setup runs, a 429 or a 5xx is a poll that didn't answer; any other 4xx (expired
+// sign-in) or an unknown domain won't fix itself by waiting.
+const isTerminal = ({ error, status }) => (status >= 400 && status < 500 && ![408, 409, 425, 429].includes(status)) || /No website found/.test(error);
+
 // List operations answer an array, or an object holding it in `data`; their domain filter is loose.
 const rowsFor = (data, domain) =>
   (Array.isArray(data) ? data : data?.data ?? []).filter((r) => r.domain?.toLowerCase() === domain.toLowerCase());
@@ -173,8 +91,9 @@ const KINDS = {
     fallback: 'hosting_websites_list-setups',
     run: (mcp, { domain }, timeoutMs) =>
       poll('setup', timeoutMs, async () => {
-        const { data, error, terminal } = await mcp.execute('hosting_websites_list-setups', { domain });
-        if (error) return { status: `list-setups: ${error}`, terminal };
+        const reply = await mcp.execute('hosting_websites_list-setups', { domain });
+        const { data, error } = reply;
+        if (error) return { status: `list-setups: ${error}`, terminal: isTerminal(reply) };
         const [row] = rowsFor(data, domain);
         if (row?.status === 'completed') return { done: { ok: true, setup: row } };
         if (row?.status === 'failed') return { done: { ok: false, setup: row } };
@@ -189,8 +108,9 @@ const KINDS = {
     // The list can lag a few seconds behind the install finishing and answer [], so an empty list is a wait.
     run: (mcp, { domain, username }, timeoutMs) =>
       poll('cms', timeoutMs, async () => {
-        const { data, error, terminal } = await mcp.execute('wordpress_installations_list', { username, domain, ownership: 'all' });
-        if (error) return { status: `installations: ${error}`, terminal };
+        const reply = await mcp.execute('wordpress_installations_list', { username, domain, ownership: 'all' });
+        const { data, error } = reply;
+        if (error) return { status: `installations: ${error}`, terminal: isTerminal(reply) };
         const rows = rowsFor(data, domain).filter((r) => r.directory === 'cms');
         const valid = rows.find((r) => r.is_valid ?? r.valid);
         if (valid) return { done: { ok: true, install: valid } };
@@ -205,8 +125,9 @@ const KINDS = {
     run: async (mcp, { domain, buildUuid }, timeoutMs) => {
       const started = Date.now();
       const build = await poll('build', timeoutMs, async () => {
-        const { data, error, terminal } = await mcp.execute('hosting_get-deployment', { domain, buildUuid });
-        if (error) return { status: `get-deployment: ${error}`, terminal };
+        const reply = await mcp.execute('hosting_get-deployment', { domain, buildUuid });
+        const { data, error } = reply;
+        if (error) return { status: `get-deployment: ${error}`, terminal: isTerminal(reply) };
         const state = data?.build?.state;
         if (state === 'failed') {
           const logTail = String(data.logs?.logs ?? '').split('\n').slice(-40).join('\n');
@@ -239,7 +160,7 @@ if (!spec || !domain || rest.length < spec.args.length) fail(`usage: ${usage} [-
 const params = { domain, ...Object.fromEntries(spec.args.map((a, i) => [a, rest[i]])) };
 const timeoutMs = duration(flags.timeout ?? spec.timeout);
 fallback = spec.fallback ?? null;
-const mcp = spec.fallback ? connect() : null;
+const mcp = spec.fallback ? connect('headless-wait') : null;
 const result = await spec.run(mcp, params, timeoutMs).catch((e) => fail(e.message));
 mcp?.close();
 finish(result.ok ? 0 : 1, { wait: kind, domain, ...result });

package/skills/headless/wp-mcp.mjs

@@ -0,0 +1,125 @@
+// The site's own WP MCP (the Hostinger AI Assistant plugin): streamable HTTP, session-based, with the
+// installation token on every request. Used by push-content.mjs.
+
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+// A reply is plain JSON or an event stream whose data lines hold it.
+function parseReply(text, id) {
+  if (text.trimStart().startsWith('{')) return JSON.parse(text);
+  for (const line of text.split('\n')) {
+    if (!line.startsWith('data:')) continue;
+    try {
+      const message = JSON.parse(line.slice(5));
+      if (message.id === id) return message;
+    } catch {
+      /* not a JSON data line */
+    }
+  }
+  throw new Error(`no JSON-RPC reply in: ${text.slice(0, 200)}`);
+}
+
+// A tool result holds { ability, result } (structuredContent, or JSON text). A WordPress error comes back
+// as a normal result carrying { code, message, data: { status } }; a term_exists error still names the id.
+function unwrap(result) {
+  let body = result?.structuredContent;
+  const text = result?.content?.[0]?.text;
+  if (body === undefined) {
+    try {
+      body = JSON.parse(text);
+    } catch {
+      body = text;
+    }
+  }
+  const value = body?.result ?? body;
+  if (result?.isError || typeof value !== 'object' || value === null) return { error: String(text ?? value).slice(0, 300) };
+  if (value.success === false || (value.code && value.data?.status >= 400)) {
+    return { error: `${value.code ?? 'error'}: ${value.message ?? ''}`.slice(0, 300), id: value.data?.term_id ?? value.data?.resource_id };
+  }
+  return { data: value, id: value.id ?? value.data?.id };
+}
+
+export const listOf = (data) => (Array.isArray(data) ? data : data?.data ?? []);
+
+// Opens the session and resolves the abilities. `mint` returns { token, url }; it is called again only
+// when the token expires. Returns { has(ability), run(ability, params) → { data, id } | { error, id? } }.
+export async function openSite(mint) {
+  let { token, url } = await mint();
+  let session = null;
+  let nextId = 0;
+  const send = async (method, params, { notify = false } = {}) => {
+    const message = notify ? { jsonrpc: '2.0', method, params } : { jsonrpc: '2.0', id: (nextId += 1), method, params };
+    const response = await fetch(url, {
+      method: 'POST',
+      headers: {
+        'content-type': 'application/json',
+        accept: 'application/json, text/event-stream',
+        'X-Hostinger-JWT-Token': token,
+        ...(session ? { 'Mcp-Session-Id': session } : {}),
+      },
+      body: JSON.stringify(message),
+      signal: AbortSignal.timeout(120_000),
+    });
+    session = response.headers.get('mcp-session-id') ?? session;
+    const text = await response.text();
+    // The initialized notification can answer 404 with no body; that's harmless.
+    if (notify) return null;
+    if (!response.ok) throw Object.assign(new Error(`HTTP ${response.status}: ${text.slice(0, 200)}`), { status: response.status });
+    const reply = parseReply(text, message.id);
+    if (reply.error) throw new Error(`${method}: ${reply.error.message}`);
+    return reply.result;
+  };
+  const open = async () => {
+    session = null;
+    await send('initialize', { protocolVersion: '2025-06-18', capabilities: {}, clientInfo: { name: 'headless-push-content', version: '1' } });
+    await send('notifications/initialized', undefined, { notify: true }).catch(() => {});
+  };
+  // A 429, a 5xx or a dropped connection is retried, but a create only on a 429: it may have gone
+  // through, and the next run's lookup finds it. An expired token is re-minted once; a lost session is
+  // reopened.
+  const call = async (method, params, { retry = true } = {}) => {
+    let reminted = false;
+    for (let attempt = 0; ; attempt += 1) {
+      try {
+        return await send(method, params);
+      } catch (e) {
+        if ((e.status === 401 || e.status === 403) && !reminted) {
+          reminted = true;
+          ({ token } = await mint());
+          await open();
+          continue;
+        }
+        const sessionLost = e.status === 404 || /Mcp-Session-Id/i.test(e.message);
+        const transient = e.status === 429 || e.status >= 500 || e.status === undefined;
+        if (attempt >= 3 || !(sessionLost || (transient && (retry || e.status === 429)))) throw e;
+        if (sessionLost) await open();
+        else await sleep(2_000 * 2 ** attempt);
+      }
+    }
+  };
+  await open();
+
+  // Every ability as its own tool, or three meta-tools (discover → get-info → execute). Names carry a
+  // `hostinger-ai/` prefix (`hostinger-ai-` as a tool name); match on the rest.
+  const { tools = [] } = await call('tools/list', {});
+  const meta = (suffix) => tools.find((t) => t.name.endsWith(suffix))?.name;
+  const execute = meta('execute-ability');
+  let names = tools.map((t) => t.name);
+  if (execute) {
+    const listed = unwrap(await call('tools/call', { name: meta('discover-abilities'), arguments: {} }));
+    if (listed.error) throw new Error(`discover-abilities: ${listed.error}`);
+    names = (listed.data.abilities ?? []).map((a) => a.name);
+  }
+  const byShort = new Map(names.map((n) => [n.replace(/^hostinger[-_]ai[/_-]+/, ''), n]));
+  const run = async (ability, params) => {
+    const name = byShort.get(ability);
+    if (!name) return { error: `the site's MCP has no ${ability} ability` };
+    const retry = !/-(create|upload-from-url)$/.test(ability);
+    try {
+      const request = execute ? { name: execute, arguments: { name, parameters: params } } : { name, arguments: params };
+      return unwrap(await call('tools/call', request, { retry }));
+    } catch (e) {
+      return { error: e.message.slice(0, 300) };
+    }
+  };
+  return { has: (ability) => byShort.has(ability), run };
+}