hostinger-api-mcp 3.30.0 → 3.30.2

package/skills/headless/steps/03-provision/wordpress/SKILL.md

@@ -64,7 +64,7 @@ All operations below go through the Hostinger connector (`execute`).
    (if `<new>/` already exists, stop and ask instead of moving into it),
    update the domain in `brief.md`, and tell the user the new domain.
    Admin credentials are generated by the platform; never ask the user for a password.
-3. Don't wait here. At the join, `node <skill>/wait.mjs setup <domain>` (see *Waiting on Hostinger* in
+3. Don't wait here. At the join, `cd "$HOME" && node <skill>/wait.mjs setup <domain>` (see *Waiting on Hostinger* in
    the top-level `SKILL.md`) returns once the setup is `completed`, usually at once by then. A `failed`
    setup → stop, point at hPanel.
 
@@ -95,7 +95,7 @@ install WordPress straight into its `/cms` directory. This is the onboarding han
      generated database counts against the plan's limit.
 3. The call is **asynchronous** — a success response only means the install job was **queued**. This is
    the *fire*: record `provision.in_progress` and return to prepare work. At the join,
-   `node <skill>/wait.mjs cms <domain> <username>` returns the `/cms` install row (`directory: "cms"`,
+   `cd "$HOME" && node <skill>/wait.mjs cms <domain> <username>` returns the `/cms` install row (`directory: "cms"`,
    valid) once it exists, usually within 1–2 minutes of the install.
 
 ## Step 3 — Verify (all must pass)

package/skills/headless/steps/04-content-model/wordpress/SKILL.md

@@ -78,7 +78,7 @@ else is refused, with the field named.
 ## Step 2 — Run the push
 
 ```bash
-node <skill>/push-content.mjs <domain>
+cd "$HOME" && node <skill>/push-content.mjs <domain>
 ```
 
 It mints the token itself (never printed), removes WordPress's "Hello world!" post and "Sample Page",

package/skills/headless/steps/08-deploy/SKILL.md

@@ -15,13 +15,13 @@ This is an **instance-barrier** step: run it only after `provision.status == "co
 > **Connected to the hosted server (`mcp.hostinger.com`)?** Its `hosting_deploy` deploys Git
 > repositories only and cannot read a local `path`. Run this step through the local
 > `hostinger-api-mcp` server instead (see the connect step:
-> `npx --yes --package=@hostinger/mcp@latest hostinger-api-mcp`).
+> `<command> <launcher>`).
 
 > **With a shell and the Hostinger CLI installed**, the same deploy is one command, with the build
 > settings passed exactly as the table below says. Run it from the project, since it links the current directory:
 > `cd ~/.hostinger/<domain>/src && hostinger up --domain <domain> --type nodejs --app-type <appType> --output-directory <dir> --build-script build --node-version 22 --package-manager npm --yes --format json`.
 > It uploads, builds, waits and returns `data.buildUuid` and `data.buildState`; add `--no-wait` to
-> return at once and wait with `node <skill>/wait.mjs build <domain> <uuid>`. Then continue at
+> return at once and wait with `cd "$HOME" && node <skill>/wait.mjs build <domain> <uuid>`. Then continue at
 > "Verify" below. Recent CLI versions see that the site is headless (`data.headless: true`) and
 > deploy only its Node.js frontend, leaving `/cms` alone; still pass the settings above.
 
@@ -156,7 +156,7 @@ keeps the root from serving 403 (see the rule above).
 Wait for it in one command (see *Waiting on Hostinger* in the top-level `SKILL.md`):
 
 ```bash
-node <skill>/wait.mjs build <domain> <buildUuid>
+cd "$HOME" && node <skill>/wait.mjs build <domain> <buildUuid>
 ```
 
 It waits for `hosting_get-deployment` to report the build `completed`, then for `https://<domain>/` to

package/src/core/oauth.js

@@ -85,11 +85,21 @@ function parseIssuer(raw) {
   return u.origin;
 }
 
+// Keeps the absolute PATH entries outside any node_modules folder. npx run in a project puts its
+// node_modules/.bin (and each parent's) first on PATH, and a relative entry resolves against the project,
+// so either would let the project supply xdg-open.
+export function safePath(value, delimiter = path.delimiter) {
+  return value
+    .split(delimiter)
+    .filter((p) => path.isAbsolute(p) && !p.split(/[\\/]/).includes("node_modules"))
+    .join(delimiter);
+}
+
 // No shell: the URL is a single argv entry, never parsed by sh or cmd.
-// Windows resolves a bare program name from the working directory before PATH,
-// so rundll32 is launched by absolute path to never pick up a planted copy.
+// rundll32 and macOS open are launched by absolute path, so neither a PATH entry nor (on Windows,
+// which looks a bare name up in the working directory first) a planted copy can stand in for them.
 export function browserCommand(platform, url, systemRoot = process.env.SystemRoot) {
-  if (platform === "darwin") return ["open", [url]];
+  if (platform === "darwin") return ["/usr/bin/open", [url]];
   if (platform === "win32") {
     return [
       path.win32.join(systemRoot || "C:\\Windows", "System32", "rundll32.exe"),
@@ -435,7 +445,7 @@ export class OAuthProvider {
       "[OAuth] If the browser does not open, copy the URL above into one manually.\n\n",
     );
     const [cmd, args] = browserCommand(process.platform, url);
-    execFile(cmd, args, (err) => {
+    execFile(cmd, args, { cwd: os.homedir(), env: { ...process.env, PATH: safePath(process.env.PATH ?? "") } }, (err) => {
       if (err) {
         process.stderr.write(
           `[OAuth] Could not auto-launch browser: ${err.message}\n`,

package/src/core/oauth.ts

@@ -88,11 +88,21 @@ function parseIssuer(raw: string): string {
   return u.origin;
 }
 
+// Keeps the absolute PATH entries outside any node_modules folder. npx run in a project puts its
+// node_modules/.bin (and each parent's) first on PATH, and a relative entry resolves against the project,
+// so either would let the project supply xdg-open.
+export function safePath(value: string, delimiter: string = path.delimiter): string {
+  return value
+    .split(delimiter)
+    .filter((p) => path.isAbsolute(p) && !p.split(/[\\/]/).includes('node_modules'))
+    .join(delimiter);
+}
+
 // No shell: the URL is a single argv entry, never parsed by sh or cmd.
-// Windows resolves a bare program name from the working directory before PATH,
-// so rundll32 is launched by absolute path to never pick up a planted copy.
+// rundll32 and macOS open are launched by absolute path, so neither a PATH entry nor (on Windows,
+// which looks a bare name up in the working directory first) a planted copy can stand in for them.
 export function browserCommand(platform: string, url: string, systemRoot = process.env.SystemRoot): [string, string[]] {
-  if (platform === 'darwin') return ['open', [url]];
+  if (platform === 'darwin') return ['/usr/bin/open', [url]];
   if (platform === 'win32') {
     return [
       path.win32.join(systemRoot || 'C:\\Windows', 'System32', 'rundll32.exe'),
@@ -396,7 +406,7 @@ export class OAuthProvider {
     process.stderr.write(`\n[OAuth] Opening browser for sign-in:\n  ${url}\n`);
     process.stderr.write('[OAuth] If the browser does not open, copy the URL above into one manually.\n\n');
     const [cmd, args] = browserCommand(process.platform, url);
-    execFile(cmd, args, (err) => {
+    execFile(cmd, args, { cwd: os.homedir(), env: { ...process.env, PATH: safePath(process.env.PATH ?? '') } }, (err) => {
       if (err) {
         process.stderr.write(`[OAuth] Could not auto-launch browser: ${err.message}\n`);
       }

package/src/core/runtime.js

@@ -4109,6 +4109,12 @@ class MCPServer {
 }
 
 export async function startServer({ name, version, tools, instructions, skills }) {
+  // The headless skill's launcher starts this server from the home folder (npx run in the project would
+  // put the project's node_modules/.bin first on PATH) and names the project here, so relative paths in
+  // tool arguments still resolve against it. Everything that runs from PATH is resolved by now.
+  if (process.env.MCP_PROJECT_DIR) {
+    try { process.chdir(process.env.MCP_PROJECT_DIR); } catch { /* stay in the home folder */ }
+  }
   const argv = minimist(process.argv.slice(2), {
     string: ['host'],
     boolean: ['stdio', 'http', 'help', 'version', 'login', 'logout'],

package/src/core/runtime.ts

@@ -4170,6 +4170,12 @@ class MCPServer {
 }
 
 export async function startServer({ name, version, tools, instructions, skills }: { name: string; version: string; tools: OpenApiTool[]; instructions?: string; skills?: Skill[] }): Promise<void> {
+  // The headless skill's launcher starts this server from the home folder (npx run in the project would
+  // put the project's node_modules/.bin first on PATH) and names the project here, so relative paths in
+  // tool arguments still resolve against it. Everything that runs from PATH is resolved by now.
+  if (process.env.MCP_PROJECT_DIR) {
+    try { process.chdir(process.env.MCP_PROJECT_DIR); } catch { /* stay in the home folder */ }
+  }
   const argv = minimist(process.argv.slice(2), {
     string: ['host'],
     boolean: ['stdio', 'http', 'help', 'version', 'login', 'logout'],