fix: close etappe-0 whole-branch review findings

- Autoloader: add automattic/jetpack-autoloader and load
  vendor/autoload_packages.php; require wordpress/mcp-adapter directly (^0.5).
- ServerRegistrar: make the adapter create_server() call and the
  OAuthServerRegistrar class_exists() check injectable so createServer()'s
  unhook-before-create ordering and the "mcp-oauth absent" branch are unit
  tested; add a smoke-test check that booting REST triggers no
  _doing_it_wrong().
- mcp-smoke.sh: assert mcp-adapter's default server route 404s, and that the
  subscriber role-gate denial actually carries our/the adapter's denial text
  (not just any isError/error).
- Guard tests/Integration/mint-token.php and tec-probe.php with
  `defined('WP_CLI') && WP_CLI || exit;`; add .gitattributes export-ignore
  for tests/docs-superpowers/.superpowers/phpunit/phpcs config.
- Security: add Server/RequestContext, tracking via
  rest_request_before_callbacks whether the current REST dispatch is our
  OAuth-protected /mcp/mcp-oauth-server route; AbilityRegistrar's
  permission_callback now denies (after the role gate) when abilities are
  invoked outside that route. Wired in Plugin::boot().
- Minors: single Plugin::VERSION constant used by ServerRegistrar;
  IntegrationRegistry caches its computed abilities list; tec-probe.php
  checks wp_insert_post's result and cleans up its probe post in a
  try/finally.

composer test: 47/47 green. composer lint: clean. Full mcp-smoke.sh run ends
ALL CHECKS PASSED (plus the expected /.well-known WARN).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
This commit is contained in:
2026-09-25 19:23:09 +02:00
co-authored by Claude Opus 5.5
parent 2c03286ba0
commit 0e3332ad3e
17 changed files with 430 additions and 38 deletions
Generated
+65 -1
View File
@@ -4,8 +4,72 @@
"Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
"This file is @generated automatically"
],
"content-hash": "538b1dbb81faf068bc0ff5f6a99efde9",
"content-hash": "f61708b5ca7588f7b1c5b47774383472",
"packages": [
{
"name": "automattic/jetpack-autoloader",
"version": "v3.1.3",
"source": {
"type": "git",
"url": "https://github.com/Automattic/jetpack-autoloader.git",
"reference": "e7e49a4e2f16cb2dfd3e58c478499a60d7d51839"
},
"dist": {
"type": "zip",
"url": "https://api.github.com/repos/Automattic/jetpack-autoloader/zipball/e7e49a4e2f16cb2dfd3e58c478499a60d7d51839",
"reference": "e7e49a4e2f16cb2dfd3e58c478499a60d7d51839",
"shasum": ""
},
"require": {
"composer-plugin-api": "^1.1 || ^2.0",
"php": ">=7.0"
},
"require-dev": {
"automattic/jetpack-changelogger": "^4.2.8",
"composer/composer": "^1.1 || ^2.0",
"yoast/phpunit-polyfills": "^1.1.1"
},
"type": "composer-plugin",
"extra": {
"class": "Automattic\\Jetpack\\Autoloader\\CustomAutoloaderPlugin",
"autotagger": true,
"mirror-repo": "Automattic/jetpack-autoloader",
"branch-alias": {
"dev-trunk": "3.1.x-dev"
},
"changelogger": {
"link-template": "https://github.com/Automattic/jetpack-autoloader/compare/v${old}...v${new}"
},
"version-constants": {
"::VERSION": "src/AutoloadGenerator.php"
}
},
"autoload": {
"psr-4": {
"Automattic\\Jetpack\\Autoloader\\": "src"
},
"classmap": [
"src/AutoloadGenerator.php"
]
},
"notification-url": "https://packagist.org/downloads/",
"license": [
"GPL-2.0-or-later"
],
"description": "Creates a custom autoloader for a plugin or theme.",
"keywords": [
"autoload",
"autoloader",
"composer",
"jetpack",
"plugin",
"wordpress"
],
"support": {
"source": "https://github.com/Automattic/jetpack-autoloader/tree/v3.1.3"
},
"time": "2024-11-04T09:23:56+00:00"
},
{
"name": "wordpress/mcp-adapter",
"version": "v0.5.0",