sbuilder-mcp 0.47.1 → 0.47.2

package/CHANGELOG.md

@@ -6,6 +6,11 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.47.2] - 2026-09-14
+
+### Fixed
+- `sb_page_create` no longer stores an HTML entity verbatim in a page name; a name like `Chính sách giao hàng & đổi trả`, lifted undecoded from a page's own source, is now decoded once before it is sent, on both the create and the home-page-adopt rename path.
+
 ## [0.47.1] - 2026-09-14
 
 ### Fixed

package/CHANGELOG.vi.md

@@ -6,6 +6,11 @@ Mọi thay đổi đáng chú ý của dự án được ghi lại trong file n
 Định dạng dựa trên [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 và dự án tuân theo [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.47.2] - 2026-09-14
+
+### Fixed
+- `sb_page_create` không còn lưu nguyên một HTML entity trong tên trang; một tên như `Chính sách giao hàng & đổi trả`, lấy chưa giải mã từ chính nguồn của một trang, giờ được giải mã một lần trước khi gửi đi, trên cả đường tạo trang lẫn đường đổi tên khi nhận lại trang chủ.
+
 ## [0.47.1] - 2026-09-14
 
 ### Fixed

package/dist/tools/page.js

@@ -311,6 +311,40 @@ async function siteChrome(ctx, siteId) {
         return {};
     }
 }
+/**
+ * Plain text, for a field the platform renders AS text.
+ *
+ * A page name is shown in the pages panel and in the browser tab and is never
+ * parsed as markup, so an HTML entity in one is always a mistake: text lifted
+ * from a page's source and handed on without being decoded. Measured on a real
+ * store, read back through sb_page_list: a page stored as "Chính sách giao hàng
+ * & đổi trả" — which is what the merchant then reads in their own editor,
+ * and what a browser tab then shows.
+ *
+ * ONE PASS, and only over what escaping actually produces. "&" decodes to
+ * "&" and stops there, because a second pass would be inventing an intent
+ * nobody expressed; an unknown entity is left exactly as it arrived. This
+ * un-escapes text that was escaped once. It does not interpret markup.
+ */
+const ENTITIES = {
+    amp: '&',
+    lt: '<',
+    gt: '>',
+    quot: '"',
+    apos: "'",
+    nbsp: ' ',
+};
+export function plainText(s) {
+    return s.replace(/&(#x[0-9a-fA-F]+|#\d+|[a-zA-Z]+);/g, (whole, body) => {
+        if (body.startsWith('#')) {
+            const code = body.startsWith('#x') ? parseInt(body.slice(2), 16) : parseInt(body.slice(1), 10);
+            // A code point that is not one is not a reference — leave the text alone
+            // rather than writing a replacement character into somebody's page name.
+            return Number.isFinite(code) && code > 0 && code <= 0x10ffff ? String.fromCodePoint(code) : whole;
+        }
+        return ENTITIES[body.toLowerCase()] ?? whole;
+    });
+}
 /**
  * The site's own home page, or null when it genuinely has none.
  *
@@ -1004,6 +1038,8 @@ export function registerPageTools(server, ctx) {
     }, async ({ site_id: given, name, type, slug, is_homepage, settings, seed, chrome, locale, headline, dry_run }) => {
         const site_id = siteFor(ctx, given);
         const path = `/api/sites/${encodeURIComponent(site_id)}/pages`;
+        // The platform stores this verbatim and renders it as text — see plainText.
+        name = plainText(name);
         // TYPE IS THE ROUTE for several kinds of page: /checkout and
         // /products/{slug} resolve to the site's PUBLISHED page of that type and
         // fall through to a 404 when there is none. Without this argument the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sbuilder-mcp",
-  "version": "0.47.1",
+  "version": "0.47.2",
   "description": "MCP server that designs and operates a Store Builder site — pages, data, theme and publish — through the platform's own API and live-edit protocol.",
   "mcpName": "io.github.vuluu2k/sbuilder-mcp",
   "type": "module",