fix(security): no direct HTTP access to plugin PHP files (audit L2, cheap part)

Every file under src/ exits outside WordPress (defined('ABSPATH') ||
exit; after the use block, so a direct request no longer prints a fatal
error with the server path); divi-convert-fixture.php gets the WP_CLI
guard the other integration scripts have. A unit test keeps both true;
PSR1 side-effects warning excluded for the guard.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

src/Integrations/Divi/Compose/AttrWriter.php

@@ -8,6 +8,8 @@ use InvalidArgumentException;
 use LIT\MCP\Integrations\Divi\BlockTree\AttrMap;
 use LIT\MCP\Integrations\Divi\Schema\ModuleCatalog;
 
+defined('ABSPATH') || exit;
+
 /**
  * Applies full-form changes (spec §5.4): attribute path => breakpoint map. Paths are checked
  * against the catalog (invalid_attr_path with suggestions), placeholders resolved, strings

src/Integrations/Divi/Compose/ColumnWidths.php

@@ -8,6 +8,8 @@ use LIT\MCP\Integrations\Divi\BlockTree\AttrMap;
 use LIT\MCP\Integrations\Divi\BlockTree\Block;
 use LIT\MCP\Integrations\Divi\BlockTree\NodeIndex;
 
+defined('ABSPATH') || exit;
+
 /**
  * Column widths of Divi rows (pure, static): the "columns" input of new rows
  * ("1_3,2_3" → flexTypes, ruling S34) and the flexType checks on update (rulings S41, S43,

src/Integrations/Divi/Compose/Composer.php

@@ -11,6 +11,8 @@ use LIT\MCP\Integrations\Divi\Design\DesignSystem;
 use LIT\MCP\Integrations\Divi\Schema\ModuleCatalog;
 use LIT\MCP\Integrations\Divi\Schema\ShortformMap;
 
+defined('ABSPATH') || exit;
+
 /**
  * Builds new Divi blocks from node descriptions (spec §5.4): short form, full form ("attrs")
  * or both; sections with rows ("columns": "1_3,2_3") and modules; parent modules with

src/Integrations/Divi/Compose/ControlChars.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace LIT\MCP\Integrations\Divi\Compose;
 
+defined('ABSPATH') || exit;
+
 /**
  * Removes C0 control characters except tab, LF and CR, and DEL (rulings S32/S32a). Applied to
  * RAW values only, before the marker check and the sanitizer: the WordPress sanitizers keep them

src/Integrations/Divi/Compose/DynamicContentRules.php

@@ -7,6 +7,8 @@ namespace LIT\MCP\Integrations\Divi\Compose;
 use InvalidArgumentException;
 use LIT\MCP\Integrations\Divi\Design\DesignSystem;
 
+defined('ABSPATH') || exit;
+
 /**
  * The allow list of content references ($variable({"type":"content",…})$) that VariableRef
  * delegates to: which names exist and how each of their settings is cleaned. Pure PHP.

src/Integrations/Divi/Compose/HtmlContext.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace LIT\MCP\Integrations\Divi\Compose;
 
+defined('ABSPATH') || exit;
+
 /**
  * An independent second scan of an HTML fragment (ruling S45): a small state machine after the
  * HTML tokenizer rules, written separately from the regex tokenizer HtmlTokens so a mistake in

src/Integrations/Divi/Compose/HtmlTokens.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace LIT\MCP\Integrations\Divi\Compose;
 
+defined('ABSPATH') || exit;
+
 /**
  * Ruling S45 tokenizer of lit/divi-replace-text (spec §5.7, rulings S8/S45): splits a string into
  * tags (quote-aware – a ">" inside a quoted attribute value does not end the tag), comments,

src/Integrations/Divi/Compose/MediaResolver.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace LIT\MCP\Integrations\Divi\Compose;
 
+defined('ABSPATH') || exit;
+
 /**
  * Looks up media library images for short-form fields like image_id (spec §6.3: Divi image
  * modules reference images by attachment ID plus URL). WpMediaResolver is the WordPress side.

src/Integrations/Divi/Compose/Placeholders.php

@@ -7,6 +7,8 @@ namespace LIT\MCP\Integrations\Divi\Compose;
 use InvalidArgumentException;
 use LIT\MCP\Integrations\Divi\Design\DesignSystem;
 
+defined('ABSPATH') || exit;
+
 /**
  * Translates the placeholders of spec §5.4 into Divi's $variable(…)$ syntax:
  * {{color:primary|<Name>|gcid-…}}, {{var:<Name>|gvid-…}}, {{font:heading|body}},

src/Integrations/Divi/Compose/ShortformWriter.php

@@ -8,6 +8,8 @@ use InvalidArgumentException;
 use LIT\MCP\Integrations\Divi\BlockTree\AttrMap;
 use LIT\MCP\Integrations\Divi\Schema\ShortformMap;
 
+defined('ABSPATH') || exit;
+
 /**
  * Writes short-form fields (spec §5.4, ShortformMap) into Divi attributes: checks the value per
  * kind, resolves placeholders (not for code) and sets it at "<path>.desktop.value[.<sub>]";

src/Integrations/Divi/Compose/StoredForms.php

@@ -6,6 +6,8 @@ namespace LIT\MCP\Integrations\Divi\Compose;
 
 use LIT\MCP\Integrations\Divi\BlockTree\Serializer;
 
+defined('ABSPATH') || exit;
+
 /**
  * The forms a search text can take in stored block markup – the database prefilter of
  * lit/divi-replace-text and the check for global modules it does not edit. Only a prefilter:

src/Integrations/Divi/Compose/StructureRules.php

@@ -8,6 +8,8 @@ use LIT\MCP\Integrations\Divi\BlockTree\AttrMap;
 use LIT\MCP\Integrations\Divi\BlockTree\Block;
 use LIT\MCP\Integrations\Divi\Schema\ModuleCatalog;
 
+defined('ABSPATH') || exit;
+
 /**
  * Which node may sit where (spec §5.4 "Struktur"): page → sections; regular section → rows;
  * fullwidth section → fullwidth modules (catalog category "fullwidth-module"); column/group →

src/Integrations/Divi/Compose/TextReplacer.php

@@ -8,6 +8,8 @@ use InvalidArgumentException;
 use LIT\MCP\Integrations\Divi\BlockTree\AttrMap;
 use LIT\MCP\Integrations\Divi\BlockTree\NodeSummary;
 
+defined('ABSPATH') || exit;
+
 /**
  * Replaces visible text in the attributes of one block (lit/divi-replace-text, spec §5.7, D10):
  * only in content (…innerContent) – plain values and the text keys of object values (text,

src/Integrations/Divi/Compose/TreeEditor.php

@@ -9,6 +9,8 @@ use LIT\MCP\Integrations\Divi\BlockTree\Container;
 use LIT\MCP\Integrations\Divi\BlockTree\Document;
 use LIT\MCP\Integrations\Divi\BlockTree\NodeIndex;
 
+defined('ABSPATH') || exit;
+
 /**
  * Structural changes on a parsed page (spec §5.7): where to insert (parent / before / after,
  * optional index), move, remove, duplicate – always checked against StructureRules. Works on

src/Integrations/Divi/Compose/ValueCleaner.php

@@ -7,6 +7,8 @@ namespace LIT\MCP\Integrations\Divi\Compose;
 use InvalidArgumentException;
 use LIT\MCP\Integrations\Divi\Schema\ModuleCatalog;
 
+defined('ABSPATH') || exit;
+
 /**
  * The single choke point through which every client string reaches Divi post_content. Divi
  * saves bypass kses (D7), so this pipeline is the guarantee. Pure PHP.

src/Integrations/Divi/Compose/ValueKind.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace LIT\MCP\Integrations\Divi\Compose;
 
+defined('ABSPATH') || exit;
+
 // The installed PHPCompatibility sniffs predate enums (PHP 8.1) and read their methods as plain functions.
 // phpcs:disable PHPCompatibility.Variables.ForbiddenThisUseContexts.OutsideObjectContext
 // phpcs:disable PHPCompatibility.FunctionDeclarations.NewParamTypeDeclarations.SelfOutsideClassScopeFound

src/Integrations/Divi/Compose/ValueSanitizer.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace LIT\MCP\Integrations\Divi\Compose;
 
+defined('ABSPATH') || exit;
+
 /**
  * Cleans values before they go into Divi attributes (spec §5.6/§10: wp_kses_post for rich
  * text, sanitize_text_field for simple fields, esc_url_raw for URLs). Divi saves bypass kses

src/Integrations/Divi/Compose/VariableRef.php

@@ -10,6 +10,8 @@ use LIT\MCP\Integrations\Divi\BlockTree\Json;
 use LIT\MCP\Integrations\Divi\Design\DesignSystem;
 use stdClass;
 
+defined('ABSPATH') || exit;
+
 /**
  * Divi's $variable({…})$ references (global colors, global variables, theme fonts, dynamic
  * content). Divi saves bypass kses (D7), Divi resolves references anywhere in a string with

src/Integrations/Divi/Compose/Warnings.php

@@ -11,6 +11,8 @@ use LIT\MCP\Integrations\Divi\BlockTree\NodeSummary;
 use LIT\MCP\Integrations\Divi\Design\DesignSystem;
 use LIT\MCP\Integrations\Divi\Schema\ShortformMap;
 
+defined('ABSPATH') || exit;
+
 /**
  * Quality warnings of a Divi write (spec §5.5) – only about the nodes this call created or
  * changed (and their children): fixed colors/fonts where a global one fits, images without