fix(security): content-create divi follows the Divi group switches (audit M2)

The divi input of lit/content-create is refused with unsupported when
lit/divi-insert is disabled or the Divi group is disabled or read-only
(ExposurePolicy::allows as a cross-group gate, asked at execute time).
content-create without divi keeps working. Adds a registrar test that
read-only write tools are never registered, so execute-ability can't
reach them either.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
This commit is contained in:
2026-09-26 19:16:35 +02:00
co-authored by Claude Opus 5.5
parent 7d0837be6c
commit 5f596b8a17
10 changed files with 169 additions and 6 deletions
@@ -21,6 +21,12 @@ interface ContentComposer
/** Whether composing is possible on this site right now (e.g. Divi 5 active). */
public function available(): bool;
/**
* Whether the site owner lets LIT MCP write such content (Tools tab: for Divi, lit/divi-insert
* is not disabled and the Divi group is neither disabled nor "nur lesen" – security M2).
*/
public function writable(): bool;
/**
* Validates the description for a new entry of $postType. Nothing is written.
*