fix(security): content-create divi follows the Divi group switches (audit M2)
The divi input of lit/content-create is refused with unsupported when lit/divi-insert is disabled or the Divi group is disabled or read-only (ExposurePolicy::allows as a cross-group gate, asked at execute time). content-create without divi keeps working. Adds a registrar test that read-only write tools are never registered, so execute-ability can't reach them either. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
This commit is contained in:
@@ -21,6 +21,12 @@ interface ContentComposer
|
||||
/** Whether composing is possible on this site right now (e.g. Divi 5 active). */
|
||||
public function available(): bool;
|
||||
|
||||
/**
|
||||
* Whether the site owner lets LIT MCP write such content (Tools tab: for Divi, lit/divi-insert
|
||||
* is not disabled and the Divi group is neither disabled nor "nur lesen" – security M2).
|
||||
*/
|
||||
public function writable(): bool;
|
||||
|
||||
/**
|
||||
* Validates the description for a new entry of $postType. Nothing is written.
|
||||
*
|
||||
|
||||
Reference in New Issue
Block a user