hostinger-api-mcp 3.28.6 → 3.30.0

package/skills/headless/wait.mjs

@@ -13,17 +13,7 @@
 // error retrying can't fix (the JSON says which), 2 when it couldn't run (`fallback` names the
 // operation to poll by hand instead).
 
-import { spawn } from 'node:child_process';
-import { homedir } from 'node:os';
-
-// ── platform-safe binary names (npm/npx are .cmd on Windows), as in connect/bootstrap.mjs ──────────
-const isWin = process.platform === 'win32';
-const bin = (name) => (isWin ? `${name}.cmd` : name);
-const MCP = [bin('npx'), '-y', '--package=@hostinger/mcp@latest', 'hostinger-api-mcp'];
-// Node >= 18.20.2 / 20.12.2 refuses to spawn a .cmd/.bat without a shell
-// (CVE-2024-27980), so npx.cmd needs shell:true on Windows. Our args are all
-// fixed literals, so enabling the shell introduces no injection risk.
-const spawnShell = isWin;
+import { connect } from './hostinger-mcp.mjs';
 
 const log = (message) => process.stderr.write(`wait: ${message}\n`);
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
@@ -53,83 +43,6 @@ function duration(text) {
   return Number(m[1]) * { s: 1e3, m: 6e4, h: 36e5 }[m[2]];
 }
 
-// One MCP server for the whole wait, spoken to over newline-delimited JSON-RPC on stdio. Once the
-// server dies every pending and later call rejects, so the wait ends with exit 2 rather than hanging.
-function connect() {
-  const child = spawn(MCP[0], MCP.slice(1), { stdio: ['pipe', 'pipe', 'pipe'], shell: spawnShell, cwd: homedir() });
-  const pending = new Map();
-  let buffer = '';
-  let diag = '';
-  let dead = null;
-  let nextId = 0;
-  const die = (reason) => {
-    dead ??= new Error(`the Hostinger MCP server stopped (${reason}): ${diag.trim().slice(-500)}`);
-    for (const { reject } of pending.values()) reject(dead);
-    pending.clear();
-  };
-  child.on('error', (e) => die(e.message));
-  // 'close' comes after stderr is drained, so the reason is in diag. A write to a dying server fails
-  // with EPIPE before that; 'close' still follows, so the EPIPE itself is ignored.
-  child.on('close', (code) => die(`exit code ${code}`));
-  child.stdin.on('error', () => {});
-  child.stderr.on('data', (chunk) => (diag = (diag + chunk).slice(-2000)));
-  child.stdout.on('data', (chunk) => {
-    buffer += chunk;
-    let i;
-    while ((i = buffer.indexOf('\n')) >= 0) {
-      const line = buffer.slice(0, i);
-      buffer = buffer.slice(i + 1);
-      try {
-        const message = JSON.parse(line);
-        pending.get(message.id)?.resolve(message);
-        pending.delete(message.id);
-      } catch {
-        /* not a JSON-RPC line */
-      }
-    }
-  });
-  // A call can stall on a live server (a stuck upstream request), so each one has its own deadline; past
-  // it, it answers like an error reply. A stalled poll is retried; a stalled start ends the wait.
-  const rpc = (method, params) =>
-    new Promise((resolve, reject) => {
-      if (dead) return reject(dead);
-      const id = (nextId += 1);
-      const timer = setTimeout(() => {
-        pending.delete(id);
-        resolve({ error: { message: `no reply to ${method} in 60 s` } });
-      }, 60_000);
-      const settle = (fn) => (value) => {
-        clearTimeout(timer);
-        fn(value);
-      };
-      pending.set(id, { resolve: settle(resolve), reject: settle(reject) });
-      child.stdin.write(`${JSON.stringify({ jsonrpc: '2.0', id, method, params })}\n`);
-    });
-  const ready = rpc('initialize', { protocolVersion: '2025-06-18', capabilities: {}, clientInfo: { name: 'headless-wait', version: '1' } })
-    .then((reply) => {
-      if (reply.error) throw new Error(`the Hostinger MCP server didn't start: ${reply.error.message}`);
-      child.stdin.write(`${JSON.stringify({ jsonrpc: '2.0', method: 'notifications/initialized' })}\n`);
-    });
-  // The server keeps "HTTP <status>" in its error text. A 409 while the setup runs, a 429 or a 5xx is a
-  // poll that didn't answer; any other 4xx (expired sign-in) or an unknown domain won't fix itself by waiting.
-  const execute = async (operation, params) => {
-    await ready;
-    const reply = await rpc('tools/call', { name: 'execute', arguments: { operation, params } });
-    const text = reply.result?.content?.[0]?.text ?? reply.error?.message ?? 'unknown error';
-    if (reply.error || reply.result?.isError) {
-      const status = Number(text.match(/HTTP (\d{3})/)?.[1]);
-      const terminal = (status >= 400 && status < 500 && ![408, 409, 425, 429].includes(status)) || /No website found/.test(text);
-      return { error: text.slice(0, 300), terminal };
-    }
-    try {
-      return { data: JSON.parse(text) };
-    } catch {
-      return { error: text.slice(0, 300), terminal: false };
-    }
-  };
-  return { execute, close: () => child.kill() };
-}
-
 async function httpStatus(url) {
   try {
     const response = await fetch(url, { redirect: 'follow', signal: AbortSignal.timeout(30_000) });
@@ -157,6 +70,10 @@ async function poll(label, timeoutMs, check) {
   }
 }
 
+// A 409 while the setup runs, a 429 or a 5xx is a poll that didn't answer; any other 4xx (expired
+// sign-in) or an unknown domain won't fix itself by waiting.
+const isTerminal = ({ error, status }) => (status >= 400 && status < 500 && ![408, 409, 425, 429].includes(status)) || /No website found/.test(error);
+
 // List operations answer an array, or an object holding it in `data`; their domain filter is loose.
 const rowsFor = (data, domain) =>
   (Array.isArray(data) ? data : data?.data ?? []).filter((r) => r.domain?.toLowerCase() === domain.toLowerCase());
@@ -174,8 +91,9 @@ const KINDS = {
     fallback: 'hosting_websites_list-setups',
     run: (mcp, { domain }, timeoutMs) =>
       poll('setup', timeoutMs, async () => {
-        const { data, error, terminal } = await mcp.execute('hosting_websites_list-setups', { domain });
-        if (error) return { status: `list-setups: ${error}`, terminal };
+        const reply = await mcp.execute('hosting_websites_list-setups', { domain });
+        const { data, error } = reply;
+        if (error) return { status: `list-setups: ${error}`, terminal: isTerminal(reply) };
         const [row] = rowsFor(data, domain);
         if (row?.status === 'completed') return { done: { ok: true, setup: row } };
         if (row?.status === 'failed') return { done: { ok: false, setup: row } };
@@ -190,8 +108,9 @@ const KINDS = {
     // The list can lag a few seconds behind the install finishing and answer [], so an empty list is a wait.
     run: (mcp, { domain, username }, timeoutMs) =>
       poll('cms', timeoutMs, async () => {
-        const { data, error, terminal } = await mcp.execute('wordpress_installations_list', { username, domain, ownership: 'all' });
-        if (error) return { status: `installations: ${error}`, terminal };
+        const reply = await mcp.execute('wordpress_installations_list', { username, domain, ownership: 'all' });
+        const { data, error } = reply;
+        if (error) return { status: `installations: ${error}`, terminal: isTerminal(reply) };
         const rows = rowsFor(data, domain).filter((r) => r.directory === 'cms');
         const valid = rows.find((r) => r.is_valid ?? r.valid);
         if (valid) return { done: { ok: true, install: valid } };
@@ -206,8 +125,9 @@ const KINDS = {
     run: async (mcp, { domain, buildUuid }, timeoutMs) => {
       const started = Date.now();
       const build = await poll('build', timeoutMs, async () => {
-        const { data, error, terminal } = await mcp.execute('hosting_get-deployment', { domain, buildUuid });
-        if (error) return { status: `get-deployment: ${error}`, terminal };
+        const reply = await mcp.execute('hosting_get-deployment', { domain, buildUuid });
+        const { data, error } = reply;
+        if (error) return { status: `get-deployment: ${error}`, terminal: isTerminal(reply) };
         const state = data?.build?.state;
         if (state === 'failed') {
           const logTail = String(data.logs?.logs ?? '').split('\n').slice(-40).join('\n');
@@ -240,7 +160,7 @@ if (!spec || !domain || rest.length < spec.args.length) fail(`usage: ${usage} [-
 const params = { domain, ...Object.fromEntries(spec.args.map((a, i) => [a, rest[i]])) };
 const timeoutMs = duration(flags.timeout ?? spec.timeout);
 fallback = spec.fallback ?? null;
-const mcp = spec.fallback ? connect() : null;
+const mcp = spec.fallback ? connect('headless-wait') : null;
 const result = await spec.run(mcp, params, timeoutMs).catch((e) => fail(e.message));
 mcp?.close();
 finish(result.ok ? 0 : 1, { wait: kind, domain, ...result });

package/skills/headless/wp-mcp.mjs

@@ -0,0 +1,125 @@
+// The site's own WP MCP (the Hostinger AI Assistant plugin): streamable HTTP, session-based, with the
+// installation token on every request. Used by push-content.mjs.
+
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+// A reply is plain JSON or an event stream whose data lines hold it.
+function parseReply(text, id) {
+  if (text.trimStart().startsWith('{')) return JSON.parse(text);
+  for (const line of text.split('\n')) {
+    if (!line.startsWith('data:')) continue;
+    try {
+      const message = JSON.parse(line.slice(5));
+      if (message.id === id) return message;
+    } catch {
+      /* not a JSON data line */
+    }
+  }
+  throw new Error(`no JSON-RPC reply in: ${text.slice(0, 200)}`);
+}
+
+// A tool result holds { ability, result } (structuredContent, or JSON text). A WordPress error comes back
+// as a normal result carrying { code, message, data: { status } }; a term_exists error still names the id.
+function unwrap(result) {
+  let body = result?.structuredContent;
+  const text = result?.content?.[0]?.text;
+  if (body === undefined) {
+    try {
+      body = JSON.parse(text);
+    } catch {
+      body = text;
+    }
+  }
+  const value = body?.result ?? body;
+  if (result?.isError || typeof value !== 'object' || value === null) return { error: String(text ?? value).slice(0, 300) };
+  if (value.success === false || (value.code && value.data?.status >= 400)) {
+    return { error: `${value.code ?? 'error'}: ${value.message ?? ''}`.slice(0, 300), id: value.data?.term_id ?? value.data?.resource_id };
+  }
+  return { data: value, id: value.id ?? value.data?.id };
+}
+
+export const listOf = (data) => (Array.isArray(data) ? data : data?.data ?? []);
+
+// Opens the session and resolves the abilities. `mint` returns { token, url }; it is called again only
+// when the token expires. Returns { has(ability), run(ability, params) → { data, id } | { error, id? } }.
+export async function openSite(mint) {
+  let { token, url } = await mint();
+  let session = null;
+  let nextId = 0;
+  const send = async (method, params, { notify = false } = {}) => {
+    const message = notify ? { jsonrpc: '2.0', method, params } : { jsonrpc: '2.0', id: (nextId += 1), method, params };
+    const response = await fetch(url, {
+      method: 'POST',
+      headers: {
+        'content-type': 'application/json',
+        accept: 'application/json, text/event-stream',
+        'X-Hostinger-JWT-Token': token,
+        ...(session ? { 'Mcp-Session-Id': session } : {}),
+      },
+      body: JSON.stringify(message),
+      signal: AbortSignal.timeout(120_000),
+    });
+    session = response.headers.get('mcp-session-id') ?? session;
+    const text = await response.text();
+    // The initialized notification can answer 404 with no body; that's harmless.
+    if (notify) return null;
+    if (!response.ok) throw Object.assign(new Error(`HTTP ${response.status}: ${text.slice(0, 200)}`), { status: response.status });
+    const reply = parseReply(text, message.id);
+    if (reply.error) throw new Error(`${method}: ${reply.error.message}`);
+    return reply.result;
+  };
+  const open = async () => {
+    session = null;
+    await send('initialize', { protocolVersion: '2025-06-18', capabilities: {}, clientInfo: { name: 'headless-push-content', version: '1' } });
+    await send('notifications/initialized', undefined, { notify: true }).catch(() => {});
+  };
+  // A 429, a 5xx or a dropped connection is retried, but a create only on a 429: it may have gone
+  // through, and the next run's lookup finds it. An expired token is re-minted once; a lost session is
+  // reopened.
+  const call = async (method, params, { retry = true } = {}) => {
+    let reminted = false;
+    for (let attempt = 0; ; attempt += 1) {
+      try {
+        return await send(method, params);
+      } catch (e) {
+        if ((e.status === 401 || e.status === 403) && !reminted) {
+          reminted = true;
+          ({ token } = await mint());
+          await open();
+          continue;
+        }
+        const sessionLost = e.status === 404 || /Mcp-Session-Id/i.test(e.message);
+        const transient = e.status === 429 || e.status >= 500 || e.status === undefined;
+        if (attempt >= 3 || !(sessionLost || (transient && (retry || e.status === 429)))) throw e;
+        if (sessionLost) await open();
+        else await sleep(2_000 * 2 ** attempt);
+      }
+    }
+  };
+  await open();
+
+  // Every ability as its own tool, or three meta-tools (discover → get-info → execute). Names carry a
+  // `hostinger-ai/` prefix (`hostinger-ai-` as a tool name); match on the rest.
+  const { tools = [] } = await call('tools/list', {});
+  const meta = (suffix) => tools.find((t) => t.name.endsWith(suffix))?.name;
+  const execute = meta('execute-ability');
+  let names = tools.map((t) => t.name);
+  if (execute) {
+    const listed = unwrap(await call('tools/call', { name: meta('discover-abilities'), arguments: {} }));
+    if (listed.error) throw new Error(`discover-abilities: ${listed.error}`);
+    names = (listed.data.abilities ?? []).map((a) => a.name);
+  }
+  const byShort = new Map(names.map((n) => [n.replace(/^hostinger[-_]ai[/_-]+/, ''), n]));
+  const run = async (ability, params) => {
+    const name = byShort.get(ability);
+    if (!name) return { error: `the site's MCP has no ${ability} ability` };
+    const retry = !/-(create|upload-from-url)$/.test(ability);
+    try {
+      const request = execute ? { name: execute, arguments: { name, parameters: params } } : { name, arguments: params };
+      return unwrap(await call('tools/call', request, { retry }));
+    } catch (e) {
+      return { error: e.message.slice(0, 300) };
+    }
+  };
+  return { has: (ability) => byShort.has(ability), run };
+}

package/skills/maintain-wordpress/SKILL.md

@@ -65,7 +65,7 @@ When a site breaks: stop the run, deactivate the plugin updated last with `wordp
 
 - Page cache: `wordpress_litespeed-cache_show-lite-speed-status`; purge after design or content changes.
 - Object cache: `wordpress_object-cache_show-memcached-status`, then `wordpress_object-cache_toggle-memcached` with `enabled: true` — the usual quick speed-up.
-- PHP version: `hosting_php_get` is large (around 25 KB), so read it only when the user asks about PHP. PHP 8.x is markedly faster than 7.x; confirm plugin compatibility before `hosting_php_update-version`.
+- PHP version: `hosting_php_get` is large (around 25 KB), so read it only when the user asks about PHP. PHP 8.x is markedly faster than 7.x; confirm plugin compatibility before switching with `hosting_php_update` (`version`). The switch resets extensions and options to their defaults, so pass the custom ones from `hosting_php_get` in the same call.
 - wp-admin: `wordpress_login_create-links` returns temporary one-click login links. Give them to the user only; never store or reuse them.
 - Hostinger's own plugins update with `wordpress_plugins_update-hostinger` (`slug`).
 

package/skills/troubleshoot-website/SKILL.md

@@ -68,7 +68,7 @@ Batch `hosting_get-deployment` (the latest build with its log, failure analysis
 
 ### PHP
 
-`hosting_php_get` returns every extension and option (around 25 KB), so call it only for PHP problems. `hosting_php_update-version` switches versions. `hosting_php_update-options` silently caps values at the plan maximum (`max` in `hosting_php_get`), so read the applied value back. Agency: `agency-hosting_php_list-options-for-website`, then `agency-hosting_php_replace-website-options` — a full replace, so send every custom option that should stay.
+`hosting_php_get` returns every extension and option (around 25 KB), so call it only for PHP problems. `hosting_php_update` changes the version, extensions and options in one call. Switching the version resets the extensions and options to their defaults, so pass the ones to keep in the same call. Option values are silently capped at the plan maximum (`max` in `hosting_php_get`), so read the applied value back. Agency: `agency-hosting_php_list-options-for-website`, then `agency-hosting_php_replace-website-options` — a full replace, so send every custom option that should stay.
 
 ### Agency Plan sites
 

package/src/core/runtime.js

@@ -304,6 +304,8 @@ class MCPServer {
         return await this.handleHostingWebsitesUpdateSettings(params);
       case 'hosting_cache_clear':
         return await this.handleHostingCacheClear(params);
+      case 'hosting_php_update':
+        return await this.handleHostingPhpUpdate(params);
       case 'hosting_websites_list-domains':
         return await this.handleHostingWebsitesListDomains(params);
       case 'hosting_websites_add-domain':
@@ -1605,6 +1607,100 @@ class MCPServer {
     return { domain, cleared: scope, directory, response };
   }
 
+  // Application order, and how each step maps to its operation.
+  hosting_phpUpdate_steps = [
+    { setting: 'version', run: (target, value) => this.callOperation('hosting_php_update-version', { ...target, version: value }) },
+    { setting: 'resetExtensions', run: (target) => this.callOperation('hosting_php_reset-extensions', target) },
+    { setting: 'extensions', run: (target, value) => this.callOperation('hosting_php_update-extensions', { ...target, ...this.hosting_phpUpdate_extensionLists(value) }) },
+    { setting: 'options', run: (target, value) => this.callOperation('hosting_php_update-options', { ...target, options: value }) },
+  ];
+
+  // The enable and disable lists to send: only the non-empty ones.
+  hosting_phpUpdate_extensionLists(extensions) {
+    const lists = {};
+    for (const key of ['enable', 'disable']) {
+      if (Array.isArray(extensions[key]) && extensions[key].length > 0) {
+        lists[key] = extensions[key];
+      }
+    }
+    return lists;
+  }
+
+  hosting_phpUpdate_validate(params) {
+    // Models send null for fields they leave unset.
+    const given = (name) => params[name] !== undefined && params[name] !== null;
+
+    if (given('version') && (typeof params.version !== 'string' || params.version.trim() === '')) {
+      throw new Error('version must be a non-empty string when provided');
+    }
+    if (given('resetExtensions') && typeof params.resetExtensions !== 'boolean') {
+      throw new Error('resetExtensions must be a boolean when provided');
+    }
+    if (given('extensions')) {
+      const extensions = params.extensions;
+      const list = (value) => value === undefined || value === null || (Array.isArray(value) && value.every((name) => typeof name === 'string' && name !== ''));
+      const valid = typeof extensions === 'object' && !Array.isArray(extensions)
+        && list(extensions.enable) && list(extensions.disable)
+        && Object.keys(this.hosting_phpUpdate_extensionLists(extensions)).length > 0;
+      if (!valid) {
+        throw new Error('extensions must be an object with a non-empty enable or disable list of extension names');
+      }
+    }
+    if (given('options')) {
+      const options = params.options;
+      const valid = typeof options === 'object' && !Array.isArray(options) && Object.keys(options).length > 0
+        && Object.values(options).every(value => typeof value === 'string' || (typeof value === 'number' && Number.isInteger(value)));
+      if (!valid) {
+        throw new Error('options must be a non-empty object of option names to string or integer values');
+      }
+    }
+  }
+
+  async handleHostingPhpUpdate(params) {
+    const { domain: requestedDomain } = params;
+    this.hosting_phpUpdate_validate(params);
+
+    // resetExtensions: false asks for nothing, like null.
+    const requested = this.hosting_phpUpdate_steps.filter(step => step.setting === 'resetExtensions'
+      ? params.resetExtensions === true
+      : params[step.setting] !== undefined && params[step.setting] !== null);
+    if (requested.length === 0) {
+      throw new Error('Pass at least one of version, resetExtensions, extensions, options');
+    }
+    if (!requestedDomain || typeof requestedDomain !== 'string') {
+      throw new Error('domain is required and must be a string');
+    }
+
+    const { username, domain } = await this.findWebsite(requestedDomain);
+    const target = { username, domain };
+
+    const applied = {};
+    let failed = null;
+    const skipped = [];
+    for (const step of requested) {
+      const value = params[step.setting];
+      if (failed) {
+        skipped.push(step.setting);
+        continue;
+      }
+      try {
+        await step.run(target, value);
+        // What was sent: for extensions, only the non-empty lists.
+        applied[step.setting] = step.setting === 'extensions' ? this.hosting_phpUpdate_extensionLists(value) : value;
+      } catch (error) {
+        failed = { setting: step.setting, error: this.formatToolError(error) };
+      }
+    }
+
+    const result = { domain, applied, failed, skipped };
+    // A failed step is a tool error carrying the same JSON, so execute reports it and a
+    // multi-execute batch stops at this step.
+    if (failed) {
+      throw new Error(JSON.stringify(result));
+    }
+    return result;
+  }
+
   // A 404 means the domain is not a website on the account, which fails the whole call; any other
   // failure only fails its own list.
   async hosting_websitesListDomains_section(request, pick) {

package/src/core/runtime.ts

@@ -336,6 +336,8 @@ class MCPServer {
         return await this.handleHostingWebsitesUpdateSettings(params);
       case 'hosting_cache_clear':
         return await this.handleHostingCacheClear(params);
+      case 'hosting_php_update':
+        return await this.handleHostingPhpUpdate(params);
       case 'hosting_websites_list-domains':
         return await this.handleHostingWebsitesListDomains(params);
       case 'hosting_websites_add-domain':
@@ -1643,6 +1645,100 @@ class MCPServer {
     return { domain, cleared: scope, directory, response };
   }
 
+  // Application order, and how each step maps to its operation.
+  private hosting_phpUpdate_steps: Array<{ setting: string; run: (target: { username: string; domain: string }, value: any) => Promise<any> }> = [
+    { setting: 'version', run: (target, value) => this.callOperation('hosting_php_update-version', { ...target, version: value }) },
+    { setting: 'resetExtensions', run: (target) => this.callOperation('hosting_php_reset-extensions', target) },
+    { setting: 'extensions', run: (target, value) => this.callOperation('hosting_php_update-extensions', { ...target, ...this.hosting_phpUpdate_extensionLists(value) }) },
+    { setting: 'options', run: (target, value) => this.callOperation('hosting_php_update-options', { ...target, options: value }) },
+  ];
+
+  // The enable and disable lists to send: only the non-empty ones.
+  private hosting_phpUpdate_extensionLists(extensions: Record<string, any>): Record<string, string[]> {
+    const lists: Record<string, string[]> = {};
+    for (const key of ['enable', 'disable']) {
+      if (Array.isArray(extensions[key]) && extensions[key].length > 0) {
+        lists[key] = extensions[key];
+      }
+    }
+    return lists;
+  }
+
+  private hosting_phpUpdate_validate(params: Record<string, any>): void {
+    // Models send null for fields they leave unset.
+    const given = (name: string) => params[name] !== undefined && params[name] !== null;
+
+    if (given('version') && (typeof params.version !== 'string' || params.version.trim() === '')) {
+      throw new Error('version must be a non-empty string when provided');
+    }
+    if (given('resetExtensions') && typeof params.resetExtensions !== 'boolean') {
+      throw new Error('resetExtensions must be a boolean when provided');
+    }
+    if (given('extensions')) {
+      const extensions = params.extensions;
+      const list = (value: any) => value === undefined || value === null || (Array.isArray(value) && value.every((name: any) => typeof name === 'string' && name !== ''));
+      const valid = typeof extensions === 'object' && !Array.isArray(extensions)
+        && list(extensions.enable) && list(extensions.disable)
+        && Object.keys(this.hosting_phpUpdate_extensionLists(extensions)).length > 0;
+      if (!valid) {
+        throw new Error('extensions must be an object with a non-empty enable or disable list of extension names');
+      }
+    }
+    if (given('options')) {
+      const options = params.options;
+      const valid = typeof options === 'object' && !Array.isArray(options) && Object.keys(options).length > 0
+        && Object.values(options).every(value => typeof value === 'string' || (typeof value === 'number' && Number.isInteger(value)));
+      if (!valid) {
+        throw new Error('options must be a non-empty object of option names to string or integer values');
+      }
+    }
+  }
+
+  private async handleHostingPhpUpdate(params: Record<string, any>): Promise<any> {
+    const { domain: requestedDomain } = params;
+    this.hosting_phpUpdate_validate(params);
+
+    // resetExtensions: false asks for nothing, like null.
+    const requested = this.hosting_phpUpdate_steps.filter(step => step.setting === 'resetExtensions'
+      ? params.resetExtensions === true
+      : params[step.setting] !== undefined && params[step.setting] !== null);
+    if (requested.length === 0) {
+      throw new Error('Pass at least one of version, resetExtensions, extensions, options');
+    }
+    if (!requestedDomain || typeof requestedDomain !== 'string') {
+      throw new Error('domain is required and must be a string');
+    }
+
+    const { username, domain } = await this.findWebsite(requestedDomain);
+    const target = { username, domain };
+
+    const applied: Record<string, any> = {};
+    let failed: { setting: string; error: string } | null = null;
+    const skipped: string[] = [];
+    for (const step of requested) {
+      const value = params[step.setting];
+      if (failed) {
+        skipped.push(step.setting);
+        continue;
+      }
+      try {
+        await step.run(target, value);
+        // What was sent: for extensions, only the non-empty lists.
+        applied[step.setting] = step.setting === 'extensions' ? this.hosting_phpUpdate_extensionLists(value) : value;
+      } catch (error) {
+        failed = { setting: step.setting, error: this.formatToolError(error) };
+      }
+    }
+
+    const result = { domain, applied, failed, skipped };
+    // A failed step is a tool error carrying the same JSON, so execute reports it and a
+    // multi-execute batch stops at this step.
+    if (failed) {
+      throw new Error(JSON.stringify(result));
+    }
+    return result;
+  }
+
   // A 404 means the domain is not a website on the account, which fails the whole call; any other
   // failure only fails its own list.
   private async hosting_websitesListDomains_section(request: Promise<any>, pick: (item: any) => any): Promise<any> {