fix(security): no direct HTTP access to plugin PHP files (audit L2, cheap part)

Every file under src/ exits outside WordPress (defined('ABSPATH') ||
exit; after the use block, so a direct request no longer prints a fatal
error with the server path); divi-convert-fixture.php gets the WP_CLI
guard the other integration scripts have. A unit test keeps both true;
PSR1 side-effects warning excluded for the guard.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

src/Integrations/Core/CoreIntegration.php

@@ -8,6 +8,8 @@ use LIT\MCP\Access;
 use LIT\MCP\Guides\GuideRepository;
 use LIT\MCP\Integrations\Integration;
 
+defined('ABSPATH') || exit;
+
 final class CoreIntegration implements Integration
 {
     public function __construct(private string $guidesDirectory)

src/Integrations/Core/EnvironmentProbe.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace LIT\MCP\Integrations\Core;
 
+defined('ABSPATH') || exit;
+
 /**
  * Detects the themes/plugins LIT MCP integrates with.
  */

src/Integrations/Core/GuideAbility.php

@@ -10,6 +10,8 @@ use LIT\MCP\Abilities\Errors;
 use LIT\MCP\Guides\GuideRepository;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 final class GuideAbility implements Ability
 {
     private const DEFAULT_TOPIC = 'overview';

src/Integrations/Core/SiteStatusAbility.php

@@ -9,6 +9,8 @@ use LIT\MCP\Abilities\Annotations;
 use LIT\MCP\Access;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 final class SiteStatusAbility implements Ability
 {
     public function __construct(private EnvironmentProbe $probe, private Access $access)

src/Integrations/Divi/BlockTree/AttrMap.php

@@ -7,6 +7,8 @@ namespace LIT\MCP\Integrations\Divi\BlockTree;
 use InvalidArgumentException;
 use stdClass;
 
+defined('ABSPATH') || exit;
+
 /**
  * Divi 5 attributes addressed by dotted paths ("title.decoration.font.font"). The value at
  * a path is a breakpoint map: {"desktop": {"value": …, "hover": …}, "phone": {"value": …}}.

src/Integrations/Divi/BlockTree/Block.php

@@ -8,6 +8,8 @@ use InvalidArgumentException;
 use LogicException;
 use stdClass;
 
+defined('ABSPATH') || exit;
+
 /**
  * One block of the tree. A parsed block keeps its original opener/closer bytes; they are
  * dropped only when the block itself changes (setAttrs(), a void block getting children),

src/Integrations/Divi/BlockTree/Container.php

@@ -7,6 +7,8 @@ namespace LIT\MCP\Integrations\Divi\BlockTree;
 use InvalidArgumentException;
 use LogicException;
 
+defined('ABSPATH') || exit;
+
 /**
  * Ordered parts of a document or of a block's inner content: blocks and the raw text
  * between them (whitespace, freeform HTML, Divi 4 shortcodes). Keeping every byte of that

src/Integrations/Divi/BlockTree/Document.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace LIT\MCP\Integrations\Divi\BlockTree;
 
+defined('ABSPATH') || exit;
+
 /**
  * The parsed post_content: top-level blocks and the text between them.
  */

src/Integrations/Divi/BlockTree/Json.php

@@ -7,6 +7,8 @@ namespace LIT\MCP\Integrations\Divi\BlockTree;
 use JsonException;
 use stdClass;
 
+defined('ABSPATH') || exit;
+
 /**
  * JSON of block attributes. PHP arrays cannot tell an empty JSON object from an empty list,
  * nor an object with the keys "0", "1", … from a list. decodeObject() therefore keeps such

src/Integrations/Divi/BlockTree/MalformedMarkup.php

@@ -6,6 +6,8 @@ namespace LIT\MCP\Integrations\Divi\BlockTree;
 
 use RuntimeException;
 
+defined('ABSPATH') || exit;
+
 /**
  * post_content is no balanced block markup (closer without opener, unclosed block, PCRE
  * failure). The Divi tools then refuse to read or write the entry – nothing is guessed.

src/Integrations/Divi/BlockTree/NodeIndex.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace LIT\MCP\Integrations\Divi\BlockTree;
 
+defined('ABSPATH') || exit;
+
 /**
  * Path IDs of a Document (spec §5.3): s0, s0.r1, s0.r1.c0.m2. One letter per role –
  * s section, r row / row-inner, c column / column-inner, m module (incl. group and child

src/Integrations/Divi/BlockTree/NodeSummary.php

@@ -6,6 +6,8 @@ namespace LIT\MCP\Integrations\Divi\BlockTree;
 
 use LIT\MCP\Abilities\Text;
 
+defined('ABSPATH') || exit;
+
 /**
  * Short human-readable facts about a node for the outline: admin label, first text,
  * preset IDs, column layout. Pure PHP.

src/Integrations/Divi/BlockTree/Outline.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace LIT\MCP\Integrations\Divi\BlockTree;
 
+defined('ABSPATH') || exit;
+
 /**
  * The page tree as rows and as compact text (lit-divi-outline, spec §5.3/§5.7; also the
  * "outline" of write results). Preset IDs are shown with their names when known.

src/Integrations/Divi/BlockTree/Parser.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace LIT\MCP\Integrations\Divi\BlockTree;
 
+defined('ABSPATH') || exit;
+
 /**
  * Parses block markup into a Document without WordPress (spec §4.4, §5.2). Uses the
  * block-delimiter pattern of WP_Block_Parser, but records the exact bytes of every

src/Integrations/Divi/BlockTree/Serializer.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace LIT\MCP\Integrations\Divi\BlockTree;
 
+defined('ABSPATH') || exit;
+
 /**
  * Turns a Document back into block markup. Unchanged blocks reuse their original
  * delimiters; changed or new blocks get delimiters generated exactly like WordPress'

src/Integrations/Divi/Compose/AttrWriter.php

@@ -8,6 +8,8 @@ use InvalidArgumentException;
 use LIT\MCP\Integrations\Divi\BlockTree\AttrMap;
 use LIT\MCP\Integrations\Divi\Schema\ModuleCatalog;
 
+defined('ABSPATH') || exit;
+
 /**
  * Applies full-form changes (spec §5.4): attribute path => breakpoint map. Paths are checked
  * against the catalog (invalid_attr_path with suggestions), placeholders resolved, strings

src/Integrations/Divi/Compose/ColumnWidths.php

@@ -8,6 +8,8 @@ use LIT\MCP\Integrations\Divi\BlockTree\AttrMap;
 use LIT\MCP\Integrations\Divi\BlockTree\Block;
 use LIT\MCP\Integrations\Divi\BlockTree\NodeIndex;
 
+defined('ABSPATH') || exit;
+
 /**
  * Column widths of Divi rows (pure, static): the "columns" input of new rows
  * ("1_3,2_3" → flexTypes, ruling S34) and the flexType checks on update (rulings S41, S43,

src/Integrations/Divi/Compose/Composer.php

@@ -11,6 +11,8 @@ use LIT\MCP\Integrations\Divi\Design\DesignSystem;
 use LIT\MCP\Integrations\Divi\Schema\ModuleCatalog;
 use LIT\MCP\Integrations\Divi\Schema\ShortformMap;
 
+defined('ABSPATH') || exit;
+
 /**
  * Builds new Divi blocks from node descriptions (spec §5.4): short form, full form ("attrs")
  * or both; sections with rows ("columns": "1_3,2_3") and modules; parent modules with

src/Integrations/Divi/Compose/ControlChars.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace LIT\MCP\Integrations\Divi\Compose;
 
+defined('ABSPATH') || exit;
+
 /**
  * Removes C0 control characters except tab, LF and CR, and DEL (rulings S32/S32a). Applied to
  * RAW values only, before the marker check and the sanitizer: the WordPress sanitizers keep them

src/Integrations/Divi/Compose/DynamicContentRules.php

@@ -7,6 +7,8 @@ namespace LIT\MCP\Integrations\Divi\Compose;
 use InvalidArgumentException;
 use LIT\MCP\Integrations\Divi\Design\DesignSystem;
 
+defined('ABSPATH') || exit;
+
 /**
  * The allow list of content references ($variable({"type":"content",…})$) that VariableRef
  * delegates to: which names exist and how each of their settings is cleaned. Pure PHP.

src/Integrations/Divi/Compose/HtmlContext.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace LIT\MCP\Integrations\Divi\Compose;
 
+defined('ABSPATH') || exit;
+
 /**
  * An independent second scan of an HTML fragment (ruling S45): a small state machine after the
  * HTML tokenizer rules, written separately from the regex tokenizer HtmlTokens so a mistake in

src/Integrations/Divi/Compose/HtmlTokens.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace LIT\MCP\Integrations\Divi\Compose;
 
+defined('ABSPATH') || exit;
+
 /**
  * Ruling S45 tokenizer of lit/divi-replace-text (spec §5.7, rulings S8/S45): splits a string into
  * tags (quote-aware – a ">" inside a quoted attribute value does not end the tag), comments,

src/Integrations/Divi/Compose/MediaResolver.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace LIT\MCP\Integrations\Divi\Compose;
 
+defined('ABSPATH') || exit;
+
 /**
  * Looks up media library images for short-form fields like image_id (spec §6.3: Divi image
  * modules reference images by attachment ID plus URL). WpMediaResolver is the WordPress side.

src/Integrations/Divi/Compose/Placeholders.php

@@ -7,6 +7,8 @@ namespace LIT\MCP\Integrations\Divi\Compose;
 use InvalidArgumentException;
 use LIT\MCP\Integrations\Divi\Design\DesignSystem;
 
+defined('ABSPATH') || exit;
+
 /**
  * Translates the placeholders of spec §5.4 into Divi's $variable(…)$ syntax:
  * {{color:primary|<Name>|gcid-…}}, {{var:<Name>|gvid-…}}, {{font:heading|body}},

src/Integrations/Divi/Compose/ShortformWriter.php

@@ -8,6 +8,8 @@ use InvalidArgumentException;
 use LIT\MCP\Integrations\Divi\BlockTree\AttrMap;
 use LIT\MCP\Integrations\Divi\Schema\ShortformMap;
 
+defined('ABSPATH') || exit;
+
 /**
  * Writes short-form fields (spec §5.4, ShortformMap) into Divi attributes: checks the value per
  * kind, resolves placeholders (not for code) and sets it at "<path>.desktop.value[.<sub>]";

src/Integrations/Divi/Compose/StoredForms.php

@@ -6,6 +6,8 @@ namespace LIT\MCP\Integrations\Divi\Compose;
 
 use LIT\MCP\Integrations\Divi\BlockTree\Serializer;
 
+defined('ABSPATH') || exit;
+
 /**
  * The forms a search text can take in stored block markup – the database prefilter of
  * lit/divi-replace-text and the check for global modules it does not edit. Only a prefilter:

src/Integrations/Divi/Compose/StructureRules.php

@@ -8,6 +8,8 @@ use LIT\MCP\Integrations\Divi\BlockTree\AttrMap;
 use LIT\MCP\Integrations\Divi\BlockTree\Block;
 use LIT\MCP\Integrations\Divi\Schema\ModuleCatalog;
 
+defined('ABSPATH') || exit;
+
 /**
  * Which node may sit where (spec §5.4 "Struktur"): page → sections; regular section → rows;
  * fullwidth section → fullwidth modules (catalog category "fullwidth-module"); column/group →

src/Integrations/Divi/Compose/TextReplacer.php

@@ -8,6 +8,8 @@ use InvalidArgumentException;
 use LIT\MCP\Integrations\Divi\BlockTree\AttrMap;
 use LIT\MCP\Integrations\Divi\BlockTree\NodeSummary;
 
+defined('ABSPATH') || exit;
+
 /**
  * Replaces visible text in the attributes of one block (lit/divi-replace-text, spec §5.7, D10):
  * only in content (…innerContent) – plain values and the text keys of object values (text,

src/Integrations/Divi/Compose/TreeEditor.php

@@ -9,6 +9,8 @@ use LIT\MCP\Integrations\Divi\BlockTree\Container;
 use LIT\MCP\Integrations\Divi\BlockTree\Document;
 use LIT\MCP\Integrations\Divi\BlockTree\NodeIndex;
 
+defined('ABSPATH') || exit;
+
 /**
  * Structural changes on a parsed page (spec §5.7): where to insert (parent / before / after,
  * optional index), move, remove, duplicate – always checked against StructureRules. Works on

src/Integrations/Divi/Compose/ValueCleaner.php

@@ -7,6 +7,8 @@ namespace LIT\MCP\Integrations\Divi\Compose;
 use InvalidArgumentException;
 use LIT\MCP\Integrations\Divi\Schema\ModuleCatalog;
 
+defined('ABSPATH') || exit;
+
 /**
  * The single choke point through which every client string reaches Divi post_content. Divi
  * saves bypass kses (D7), so this pipeline is the guarantee. Pure PHP.

src/Integrations/Divi/Compose/ValueKind.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace LIT\MCP\Integrations\Divi\Compose;
 
+defined('ABSPATH') || exit;
+
 // The installed PHPCompatibility sniffs predate enums (PHP 8.1) and read their methods as plain functions.
 // phpcs:disable PHPCompatibility.Variables.ForbiddenThisUseContexts.OutsideObjectContext
 // phpcs:disable PHPCompatibility.FunctionDeclarations.NewParamTypeDeclarations.SelfOutsideClassScopeFound

src/Integrations/Divi/Compose/ValueSanitizer.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace LIT\MCP\Integrations\Divi\Compose;
 
+defined('ABSPATH') || exit;
+
 /**
  * Cleans values before they go into Divi attributes (spec §5.6/§10: wp_kses_post for rich
  * text, sanitize_text_field for simple fields, esc_url_raw for URLs). Divi saves bypass kses

src/Integrations/Divi/Compose/VariableRef.php

@@ -10,6 +10,8 @@ use LIT\MCP\Integrations\Divi\BlockTree\Json;
 use LIT\MCP\Integrations\Divi\Design\DesignSystem;
 use stdClass;
 
+defined('ABSPATH') || exit;
+
 /**
  * Divi's $variable({…})$ references (global colors, global variables, theme fonts, dynamic
  * content). Divi saves bypass kses (D7), Divi resolves references anywhere in a string with

src/Integrations/Divi/Compose/Warnings.php

@@ -11,6 +11,8 @@ use LIT\MCP\Integrations\Divi\BlockTree\NodeSummary;
 use LIT\MCP\Integrations\Divi\Design\DesignSystem;
 use LIT\MCP\Integrations\Divi\Schema\ShortformMap;
 
+defined('ABSPATH') || exit;
+
 /**
  * Quality warnings of a Divi write (spec §5.5) – only about the nodes this call created or
  * changed (and their children): fixed colors/fonts where a global one fits, images without

src/Integrations/Divi/Design/DesignSystem.php

@@ -6,6 +6,8 @@ namespace LIT\MCP\Integrations\Divi\Design;
 
 use InvalidArgumentException;
 
+defined('ABSPATH') || exit;
+
 /**
  * The site's Divi design system as read live from Divi (spec §2 principle 2, §5.7): global
  * colors, global variables, theme fonts and sizes, module and group presets. Pure PHP –

src/Integrations/Divi/Design/DesignSystemReader.php

@@ -7,6 +7,8 @@ namespace LIT\MCP\Integrations\Divi\Design;
 use ET\Builder\Packages\GlobalData\GlobalData;
 use ET\Builder\Packages\GlobalData\GlobalPreset;
 
+defined('ABSPATH') || exit;
+
 /**
  * Reads the design system from Divi's own APIs once per request (spec §2 principle 2 – no
  * copy is ever stored). Not final so abilities can be unit-tested with a mock.

src/Integrations/Divi/Design/DiviDesignSystemAbility.php

@@ -9,6 +9,8 @@ use LIT\MCP\Abilities\Annotations;
 use LIT\MCP\Abilities\Errors;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * lit/divi-design-system: global colors, variables, theme fonts/sizes and presets with the
  * placeholder to use for each (spec §5.4, §5.7). Read live from Divi; writing follows in

src/Integrations/Divi/DiviIntegration.php

@@ -27,6 +27,8 @@ use LIT\MCP\Integrations\Integration;
 use LIT\MCP\Integrations\WordPress\Content\ContentComposer;
 use LIT\MCP\Integrations\WordPress\Schema\ContentSchema;
 
+defined('ABSPATH') || exit;
+
 /**
  * Divi 5 pages (spec §5, Etappe 2). Only available when the Divi 5 builder is loaded
  * (spec §2 principle 4); Divi 4 is never edited (spec §3.4). The write abilities share one

src/Integrations/Divi/Pages/DiviChange.php

@@ -8,6 +8,8 @@ use LIT\MCP\Integrations\Divi\BlockTree\Block;
 use LIT\MCP\Integrations\Divi\BlockTree\NodeIndex;
 use LIT\MCP\Integrations\Divi\BlockTree\NodeSummary;
 
+defined('ABSPATH') || exit;
+
 /**
  * What a Divi write did to the tree: summary, changed nodes (for ToolResult::changed – IDs of
  * surviving nodes are resolved after the change), touched nodes (for the quality warnings)

src/Integrations/Divi/Pages/DiviComposition.php

@@ -18,6 +18,8 @@ use LIT\MCP\Integrations\Divi\Compose\Warnings;
 use LIT\MCP\Integrations\Divi\Design\DesignSystemReader;
 use LIT\MCP\Integrations\Divi\Schema\DiviModules;
 
+defined('ABSPATH') || exit;
+
 /**
  * Wires the pure Compose classes with the live catalog, design system, Divi's dynamic content
  * registry and the WordPress sanitizer/media lookup – once per request and entry. Ruling S31:

src/Integrations/Divi/Pages/DiviContentComposer.php

@@ -17,6 +17,8 @@ use LIT\MCP\Integrations\WordPress\Content\ContentComposer;
 use LIT\MCP\Integrations\WordPress\Schema\ContentSchema;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * Divi short form for lit/content-create (spec §6.2): the sections become a Divi 5 layout in
  * exactly one divi/placeholder – inserted by TreeEditor like the first section of an empty page

src/Integrations/Divi/Pages/DiviDeleteAbility.php

@@ -10,6 +10,8 @@ use LIT\MCP\Integrations\Divi\BlockTree\Block;
 use LIT\MCP\Integrations\Divi\BlockTree\NodeSummary;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * lit/divi-delete: removes nodes with everything inside (spec §5.7, destructive). Needs
  * confirm: true after asking the user; without it the answer lists what would be removed –

src/Integrations/Divi/Pages/DiviDuplicateNodeAbility.php

@@ -8,6 +8,8 @@ use LIT\MCP\Abilities\Annotations;
 use LIT\MCP\Integrations\Divi\BlockTree\AttrMap;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * lit/divi-duplicate-node: copies a node with everything inside right behind the original
  * (spec §5.7). The copy's admin label gets " (Kopie)"; read-only nodes (global modules,

src/Integrations/Divi/Pages/DiviErrors.php

@@ -8,6 +8,8 @@ use LIT\MCP\Abilities\Errors;
 use WP_Error;
 use WP_Post;
 
+defined('ABSPATH') || exit;
+
 /** The client errors the Divi tools share. */
 final class DiviErrors
 {

src/Integrations/Divi/Pages/DiviFlags.php

@@ -6,6 +6,8 @@ namespace LIT\MCP\Integrations\Divi\Pages;
 
 use RuntimeException;
 
+defined('ABSPATH') || exit;
+
 /**
  * Marks an entry as a Divi 5 builder layout, like the Visual Builder's own save does
  * (Divi 5.2.1 SyncToServerController.php:382-387: _et_pb_use_divi_5 = "on", legacy

src/Integrations/Divi/Pages/DiviInsertAbility.php

@@ -8,6 +8,8 @@ use LIT\MCP\Abilities\Annotations;
 use LIT\MCP\Abilities\Errors;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * lit/divi-insert: inserts nodes in short and/or full form – modules, rows or whole sections –
  * at parent / before / after (spec §5.7). All or nothing (ruling S39): the whole input is

src/Integrations/Divi/Pages/DiviMoveAbility.php

@@ -8,6 +8,8 @@ use LIT\MCP\Abilities\Annotations;
 use LIT\MCP\Abilities\Errors;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * lit/divi-move: moves a node (with everything inside) to parent / before / after – also into
  * another row or section, as long as the structure rules allow it (spec §5.7). Read-only

src/Integrations/Divi/Pages/DiviNodeGetAbility.php

@@ -16,6 +16,8 @@ use LIT\MCP\Integrations\Divi\Design\DesignSystemReader;
 use LIT\MCP\Integrations\Divi\Schema\ShortformMap;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * lit/divi-node-get: all attributes of one node in the full form (spec §5.4, §5.7) –
  * attribute path => breakpoint map – plus the current short-form values.

src/Integrations/Divi/Pages/DiviOutlineAbility.php

@@ -13,6 +13,8 @@ use LIT\MCP\Integrations\Divi\BlockTree\Outline;
 use LIT\MCP\Integrations\Divi\Design\DesignSystemReader;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * lit/divi-outline: the page tree with path IDs, types, admin labels, text excerpts and
  * preset names plus tree_rev (spec §5.3, §5.7). Every Divi write needs this tree_rev.

src/Integrations/Divi/Pages/DiviPage.php

@@ -9,6 +9,8 @@ use LIT\MCP\Integrations\Divi\BlockTree\Document;
 use LIT\MCP\Integrations\Divi\BlockTree\NodeIndex;
 use WP_Post;
 
+defined('ABSPATH') || exit;
+
 /**
  * An entry loaded for the Divi tools: the post, its parsed tree, the path index and the
  * tree_rev (hash of post_content – the optimistic lock of the Divi tools, ruling P16; the

src/Integrations/Divi/Pages/DiviPageLoader.php

@@ -13,6 +13,8 @@ use LIT\MCP\Integrations\WordPress\Schema\ContentSchema;
 use LIT\MCP\Log;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * Loads an entry for the Divi tools: rights and status via PostGuard (spec §4.5), then the
  * block tree. Divi 4 shortcode content and unbalanced markup are refused with a hint –

src/Integrations/Divi/Pages/DiviReplaceTextAbility.php

@@ -19,6 +19,8 @@ use LIT\MCP\Log;
 use Throwable;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * lit/divi-replace-text: replaces visible text across the Divi pages of one content type
  * (spec §5.7, D10). dry_run (default true) only lists the hits with their tree_rev; the real run

src/Integrations/Divi/Pages/DiviSaver.php

@@ -15,6 +15,8 @@ use Throwable;
 use WP_Error;
 use WP_Post;
 
+defined('ABSPATH') || exit;
+
 /**
  * Save pipeline of spec §5.6, steps 3–5: restore point and wp_update_post() with wp_slash() (the
  * status stays), Divi 5 flags (DiviFlags), Divi's static CSS cache. A failure after saving is

src/Integrations/Divi/Pages/DiviSchema.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace LIT\MCP\Integrations\Divi\Pages;
 
+defined('ABSPATH') || exit;
+
 /** Input schema properties the Divi write tools share. */
 final class DiviSchema
 {

src/Integrations/Divi/Pages/DiviTextSearch.php

@@ -13,6 +13,8 @@ use LIT\MCP\Integrations\Divi\Compose\ValueCleaner;
 use LIT\MCP\Integrations\WordPress\PostGuard;
 use LIT\MCP\Integrations\WordPress\PostStatuses;
 
+defined('ABSPATH') || exit;
+
 /**
  * The search part of lit/divi-replace-text (D10): the SQL prefilter for candidate pages and
  * the hits of one page, computed without changing it. The replacement is cleaned per place by

src/Integrations/Divi/Pages/DiviUpdateAbility.php

@@ -10,6 +10,8 @@ use LIT\MCP\Integrations\Divi\BlockTree\Block;
 use LIT\MCP\Integrations\Divi\Compose\ColumnWidths;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * lit/divi-update: sets or removes values of existing nodes – short-form fields ("set"), full
  * form ("attrs", null removes a path or breakpoint), preset and admin label (spec §5.7). Several

src/Integrations/Divi/Pages/DiviWriteAbility.php

@@ -8,6 +8,8 @@ use LIT\MCP\Abilities\Ability;
 use LIT\MCP\Abilities\ToolResult;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * The frame of the Divi write tools (spec §5.6): permission and execute both load the page
  * through DiviWriter::page() (rights, Divi layout, tree_rev lock – execute never trusts state

src/Integrations/Divi/Pages/DiviWriter.php

@@ -16,6 +16,8 @@ use LIT\MCP\Integrations\Divi\Design\DesignSystemReader;
 use LIT\MCP\Integrations\WordPress\PostSaveFollowUp;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * The shared frame of every Divi write (spec §5.6): load with rights and the tree_rev lock
  * (ruling P16; a mismatch is rev_mismatch and nothing is written), let the ability change the

src/Integrations/Divi/Pages/DynamicContentMap.php

@@ -10,6 +10,8 @@ use LIT\MCP\Integrations\Divi\Compose\DynamicContentRules;
 use LIT\MCP\Log;
 use Throwable;
 
+defined('ABSPATH') || exit;
+
 /**
  * DynamicContentRules' dynamic content allow map (ruling S22) from Divi's live registry
  * DynamicContentOptions::get_options($postId, 'edit') – the options the Visual Builder offers

src/Integrations/Divi/Pages/WpMediaResolver.php

@@ -6,6 +6,8 @@ namespace LIT\MCP\Integrations\Divi\Pages;
 
 use LIT\MCP\Integrations\Divi\Compose\MediaResolver;
 
+defined('ABSPATH') || exit;
+
 /**
  * Media library images for short-form fields (image_id, portrait_id, image_ids): only images
  * the current user may read. URL and alt text are cleaned by ShortformWriter like client input.

src/Integrations/Divi/Pages/WpValueSanitizer.php

@@ -6,6 +6,8 @@ namespace LIT\MCP\Integrations\Divi\Pages;
 
 use LIT\MCP\Integrations\Divi\Compose\ValueSanitizer;
 
+defined('ABSPATH') || exit;
+
 /**
  * WordPress sanitizing of Divi values (spec §5.6/§10). Because DiviSaver bypasses kses for the
  * page as a whole (kses would re-serialize every untouched block, D7), every value this plugin

src/Integrations/Divi/Schema/AttrPathIndex.php

@@ -6,6 +6,8 @@ namespace LIT\MCP\Integrations\Divi\Schema;
 
 use LIT\MCP\Integrations\Divi\BlockTree\AttrMap;
 
+defined('ABSPATH') || exit;
+
 /**
  * Known attribute paths of one module, derived from Divi's module metadata (settings of
  * every attribute group, attrName references) and its default attributes (spec §5.4:

src/Integrations/Divi/Schema/DiviCatalogAbility.php

@@ -10,6 +10,8 @@ use LIT\MCP\Abilities\Errors;
 use LIT\MCP\Abilities\JsonMap;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * lit/divi-catalog: the modules of this Divi installation with their short-form fields;
  * with "module" the details of one module incl. all known attribute paths (spec §5.7).

src/Integrations/Divi/Schema/DiviModules.php

@@ -6,6 +6,8 @@ namespace LIT\MCP\Integrations\Divi\Schema;
 
 use ET\Builder\Packages\ModuleLibrary\ModuleRegistration;
 
+defined('ABSPATH') || exit;
+
 /**
  * Reads Divi's module metadata once per request (Divi 5 only). Not final so abilities can be
  * unit-tested with a mock.

src/Integrations/Divi/Schema/ModuleCatalog.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace LIT\MCP\Integrations\Divi\Schema;
 
+defined('ABSPATH') || exit;
+
 /**
  * The modules this Divi installation knows (spec §5.7 lit-divi-catalog), built from
  * ModuleRegistration::get_all_core_modules_metadata() – always live, never a copy.

src/Integrations/Divi/Schema/ShortformMap.php

@@ -6,6 +6,8 @@ namespace LIT\MCP\Integrations\Divi\Schema;
 
 use LIT\MCP\Integrations\Divi\BlockTree\AttrMap;
 
+defined('ABSPATH') || exit;
+
 /**
  * Curated short form (spec §5.4) for the ~20 everyday modules: field => where Divi 5 keeps
  * the value. Paths come from Divi's conversion outlines (…/module-library/src/components/

src/Integrations/Integration.php

@@ -6,6 +6,8 @@ namespace LIT\MCP\Integrations;
 
 use LIT\MCP\Abilities\Ability;
 
+defined('ABSPATH') || exit;
+
 /**
  * A group of abilities that is only registered when its theme/plugin is active.
  */

src/Integrations/IntegrationRegistry.php

@@ -6,6 +6,8 @@ namespace LIT\MCP\Integrations;
 
 use LIT\MCP\Abilities\Ability;
 
+defined('ABSPATH') || exit;
+
 final class IntegrationRegistry
 {
     /** @var list<Integration> */

src/Integrations/Media/AdminIncludes.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace LIT\MCP\Integrations\Media;
 
+defined('ABSPATH') || exit;
+
 /**
  * Media helpers (download_url, wp_tempnam, media_handle_sideload, …) live in
  * wp-admin/includes and are not loaded on REST requests.

src/Integrations/Media/ContentMediaReferences.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace LIT\MCP\Integrations\Media;
 
+defined('ABSPATH') || exit;
+
 /**
  * The pure part of MediaUsageFinder: whether a piece of stored content (post content or a
  * block widget) references an attachment – by ID (wp-image-<id>, [gallery ids], Divi 4

src/Integrations/Media/MediaDeleteAbility.php

@@ -13,6 +13,8 @@ use LIT\MCP\ChangeLog\ChangeLog;
 use WP_Error;
 use WP_Post;
 
+defined('ABSPATH') || exit;
+
 /**
  * lit/media-delete: deletes one attachment after confirmation. WordPress has no media trash by
  * default (MEDIA_TRASH false): wp_delete_attachment($id, false) then deletes the attachment and

src/Integrations/Media/MediaDownloadAbility.php

@@ -10,6 +10,8 @@ use LIT\MCP\Abilities\Errors;
 use LIT\MCP\Limits;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * Delivers a media file (original or a named image size) as an MCP embedded resource
  * (spec §4.3). Direct tool: like ImageContent (lit-media-preview), an embedded resource

src/Integrations/Media/MediaFiles.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace LIT\MCP\Integrations\Media;
 
+defined('ABSPATH') || exit;
+
 /**
  * Shared file-path safety check for lit-media-preview and lit-media-download
  * (controller ruling: never read a file outside the uploads directory, even

src/Integrations/Media/MediaGetAbility.php

@@ -8,6 +8,8 @@ use LIT\MCP\Abilities\Ability;
 use LIT\MCP\Abilities\Annotations;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 final class MediaGetAbility implements Ability
 {
     public function __construct(private MediaPresenter $presenter, private MediaUsageFinder $finder)

src/Integrations/Media/MediaGuard.php

@@ -9,6 +9,8 @@ use LIT\MCP\Integrations\WordPress\PostGuard;
 use WP_Error;
 use WP_Post;
 
+defined('ABSPATH') || exit;
+
 /**
  * Loads an attachment for abilities and checks the capability on that attachment
  * (spec §4.5). Every error is ready to be returned from permission()/execute().

src/Integrations/Media/MediaImporter.php

@@ -13,6 +13,8 @@ use Throwable;
 use WP_Error;
 use WpOrg\Requests\Exception as RequestsException;
 
+defined('ABSPATH') || exit;
+
 /**
  * Imports files into the media library (spec §6.3, §10).
  *

src/Integrations/Media/MediaIntegration.php

@@ -9,6 +9,8 @@ use LIT\MCP\Integrations\Integration;
 use LIT\MCP\Integrations\WordPress\Schema\ContentSchema;
 use LIT\MCP\Limits;
 
+defined('ABSPATH') || exit;
+
 /**
  * Media library tools (spec §6.3). Always available. $log and $limits serve the write
  * tools (upload, update, delete).

src/Integrations/Media/MediaMetaWriter.php

@@ -8,6 +8,8 @@ use LIT\MCP\Integrations\WordPress\PostRow;
 use RuntimeException;
 use WP_Post;
 
+defined('ABSPATH') || exit;
+
 /**
  * Writes the editable metadata of an attachment (alt text, title, caption, description) and
  * restores it from a snapshot taken before (lit/media-update rolls a batch back with it).

src/Integrations/Media/MediaPresenter.php

@@ -7,6 +7,8 @@ namespace LIT\MCP\Integrations\Media;
 use LIT\MCP\Abilities\JsonMap;
 use WP_Post;
 
+defined('ABSPATH') || exit;
+
 /**
  * Output format of an attachment. Not final so abilities can be tested with a mock.
  */

src/Integrations/Media/MediaPreviewAbility.php

@@ -9,6 +9,8 @@ use LIT\MCP\Abilities\Annotations;
 use LIT\MCP\Abilities\Errors;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * Renders a downscaled preview of an image attachment as an MCP ImageContent block
  * (spec §4.3). Direct tool only: the mcp-adapter only turns `{type: 'image', …}` into

src/Integrations/Media/MediaSearchAbility.php

@@ -12,6 +12,8 @@ use LIT\MCP\Integrations\WordPress\PostGuard;
 use WP_Error;
 use WP_Post;
 
+defined('ABSPATH') || exit;
+
 /**
  * Media library search (spec §6.3). Direct tool. `unused` only ever checks a small,
  * bounded number of candidates per call via MediaUsageFinder::isUsed() (each call does one

src/Integrations/Media/MediaUpdateAbility.php

@@ -17,6 +17,8 @@ use Throwable;
 use WP_Error;
 use WP_Post;
 
+defined('ABSPATH') || exit;
+
 /**
  * lit/media-update: metadata of up to 50 attachments in one call, all or nothing.
  * Every item is validated first (attachment, edit_post, lengths, optional `modified` lock);

src/Integrations/Media/MediaUploadAbility.php

@@ -9,6 +9,8 @@ use LIT\MCP\Abilities\Annotations;
 use LIT\MCP\Limits;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * Uploads a Base64-encoded file into the media library (spec §6.3), up to the configured
  * upload limit (at most Limits::INLINE_MAX_MB, the request carries the whole file).

src/Integrations/Media/MediaUploadFromUrlAbility.php

@@ -8,6 +8,8 @@ use LIT\MCP\Abilities\Ability;
 use LIT\MCP\Abilities\Annotations;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * Imports a publicly reachable file into the media library (spec §6.3). Direct tool.
  * Download, checks and cleanup: MediaImporter; permission and result: MediaUploads.

src/Integrations/Media/MediaUploads.php

@@ -14,6 +14,8 @@ use LIT\MCP\Integrations\WordPress\Schema\ContentSchema;
 use WP_Error;
 use WP_Post;
 
+defined('ABSPATH') || exit;
+
 /**
  * What both upload abilities share (lit/media-upload-from-url, lit/media-upload): the
  * permission check, running the import and building the result for the new attachment.

src/Integrations/Media/MediaUsageFinder.php

@@ -8,6 +8,8 @@ use Closure;
 use LIT\MCP\Integrations\WordPress\PostStatuses;
 use LIT\MCP\Log;
 
+defined('ABSPATH') || exit;
+
 /**
  * Finds where an attachment is used (spec §6.3). Deliberately errs on the side of "used":
  * a false positive only asks for force: true, a false negative would break a page.

src/Integrations/Media/PublicAddress.php

@@ -6,6 +6,8 @@ namespace LIT\MCP\Integrations\Media;
 
 use Closure;
 
+defined('ABSPATH') || exit;
+
 /**
  * The plugin's own check that a URL import only reaches public addresses (security audit M3), in
  * addition to wp_http_validate_url(): older WordPress versions (the plugin supports 6.9) block

src/Integrations/Pods/PodsFieldSource.php

@@ -9,6 +9,8 @@ use LIT\MCP\Integrations\WordPress\Schema\FieldSource;
 use RuntimeException;
 use Throwable;
 
+defined('ABSPATH') || exit;
+
 /**
  * Pods field adapter (spec §6.1/§6.2): definitions from pods_api()->load_pod(),
  * values read and written through the Pods API so relationships and caches stay

src/Integrations/WordPress/Content/ContentComposer.php

@@ -7,6 +7,8 @@ namespace LIT\MCP\Integrations\WordPress\Content;
 use Throwable;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * Builds the content of a new entry for lit/content-create from a structured description
  * (spec §6.2: "optional Divi-Inhalt in Kurzform"). Implemented by the Divi integration, so the

src/Integrations/WordPress/Content/ContentCreateAbility.php

@@ -17,6 +17,8 @@ use Throwable;
 use WP_Error;
 use WP_Post;
 
+defined('ABSPATH') || exit;
+
 /**
  * lit/content-create: new entry, always a draft. All or nothing (spec §8.2): input is
  * validated before the insert; if fields, terms or the featured image cannot be written

src/Integrations/WordPress/Content/ContentGetAbility.php

@@ -10,6 +10,8 @@ use LIT\MCP\Integrations\WordPress\PostGuard;
 use LIT\MCP\Integrations\WordPress\Schema\ContentSchema;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 final class ContentGetAbility implements Ability
 {
     public function __construct(private ContentSchema $schema, private PostPresenter $presenter)

src/Integrations/WordPress/Content/ContentQueryAbility.php

@@ -14,6 +14,8 @@ use LIT\MCP\Integrations\WordPress\Schema\FieldDefinition;
 use WP_Error;
 use WP_Post;
 
+defined('ABSPATH') || exit;
+
 final class ContentQueryAbility implements Ability
 {
     private const STATUSES = ['publish', 'draft', 'pending', 'private', 'future'];

src/Integrations/WordPress/Content/ContentTypesAbility.php

@@ -10,6 +10,8 @@ use LIT\MCP\Abilities\Errors;
 use LIT\MCP\Integrations\WordPress\Schema\ContentSchema;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 final class ContentTypesAbility implements Ability
 {
     public function __construct(private ContentSchema $schema)

src/Integrations/WordPress/Content/ContentUpdateAbility.php

@@ -22,6 +22,8 @@ use Throwable;
 use WP_Error;
 use WP_Post;
 
+defined('ABSPATH') || exit;
+
 /**
  * lit/content-update: changes an entry without touching its status. rev (from
  * lit/content-get) is required so parallel edits are never overwritten (spec §2

src/Integrations/WordPress/Content/NewDraft.php

@@ -12,6 +12,8 @@ use RuntimeException;
 use Throwable;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * The transaction of lit/content-create: inserting the draft and every way back out of it.
  * The three exits side by side:

src/Integrations/WordPress/Content/PostPresenter.php

@@ -11,6 +11,8 @@ use LIT\MCP\Integrations\WordPress\Schema\ContentSchema;
 use LIT\MCP\Integrations\WordPress\Schema\FieldDefinition;
 use WP_Post;
 
+defined('ABSPATH') || exit;
+
 /**
  * Output format of an entry for the content tools. Not final so abilities can be
  * unit-tested with a mock.

src/Integrations/WordPress/Content/PostWriter.php

@@ -14,6 +14,8 @@ use Throwable;
 use WP_Error;
 use WP_Post;
 
+defined('ABSPATH') || exit;
+
 /**
  * Shared validation and write logic of lit/content-create and lit/content-update.
  * prepare() validates everything before the first write (all or nothing, spec §8.2);

src/Integrations/WordPress/Menus/MenuAssignLocationAbility.php

@@ -12,6 +12,8 @@ use LIT\MCP\Abilities\ToolResult;
 use LIT\MCP\ChangeLog\ChangeLog;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * lit/menu-assign-location: assigns a menu to a theme location (menu_id 0 removes
  * the assignment – the menu then disappears from the site, so removing an existing

src/Integrations/WordPress/Menus/MenuCreateAbility.php

@@ -13,6 +13,8 @@ use LIT\MCP\Abilities\ToolResult;
 use LIT\MCP\ChangeLog\ChangeLog;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * lit/menu-create: creates an empty menu and optionally assigns it to a theme
  * location. Menu items are added afterwards via lit/menu-set-items (Task 14).

src/Integrations/WordPress/Menus/MenuGetAbility.php

@@ -10,6 +10,8 @@ use LIT\MCP\Abilities\Errors;
 use LIT\MCP\Abilities\Rev;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * lit/menu-get: a menu as a tree (P4 ruling: same node shape lit/menu-set-items,
  * Task 14, accepts as input, so the result can be edited and sent back as-is).