fix(security): no direct HTTP access to plugin PHP files (audit L2, cheap part)

Every file under src/ exits outside WordPress (defined('ABSPATH') ||
exit; after the use block, so a direct request no longer prints a fatal
error with the server path); divi-convert-fixture.php gets the WP_CLI
guard the other integration scripts have. A unit test keeps both true;
PSR1 side-effects warning excluded for the guard.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

src/Integrations/Divi/Pages/DiviChange.php

@@ -8,6 +8,8 @@ use LIT\MCP\Integrations\Divi\BlockTree\Block;
 use LIT\MCP\Integrations\Divi\BlockTree\NodeIndex;
 use LIT\MCP\Integrations\Divi\BlockTree\NodeSummary;
 
+defined('ABSPATH') || exit;
+
 /**
  * What a Divi write did to the tree: summary, changed nodes (for ToolResult::changed – IDs of
  * surviving nodes are resolved after the change), touched nodes (for the quality warnings)

src/Integrations/Divi/Pages/DiviComposition.php

@@ -18,6 +18,8 @@ use LIT\MCP\Integrations\Divi\Compose\Warnings;
 use LIT\MCP\Integrations\Divi\Design\DesignSystemReader;
 use LIT\MCP\Integrations\Divi\Schema\DiviModules;
 
+defined('ABSPATH') || exit;
+
 /**
  * Wires the pure Compose classes with the live catalog, design system, Divi's dynamic content
  * registry and the WordPress sanitizer/media lookup – once per request and entry. Ruling S31:

src/Integrations/Divi/Pages/DiviContentComposer.php

@@ -17,6 +17,8 @@ use LIT\MCP\Integrations\WordPress\Content\ContentComposer;
 use LIT\MCP\Integrations\WordPress\Schema\ContentSchema;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * Divi short form for lit/content-create (spec §6.2): the sections become a Divi 5 layout in
  * exactly one divi/placeholder – inserted by TreeEditor like the first section of an empty page

src/Integrations/Divi/Pages/DiviDeleteAbility.php

@@ -10,6 +10,8 @@ use LIT\MCP\Integrations\Divi\BlockTree\Block;
 use LIT\MCP\Integrations\Divi\BlockTree\NodeSummary;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * lit/divi-delete: removes nodes with everything inside (spec §5.7, destructive). Needs
  * confirm: true after asking the user; without it the answer lists what would be removed –

src/Integrations/Divi/Pages/DiviDuplicateNodeAbility.php

@@ -8,6 +8,8 @@ use LIT\MCP\Abilities\Annotations;
 use LIT\MCP\Integrations\Divi\BlockTree\AttrMap;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * lit/divi-duplicate-node: copies a node with everything inside right behind the original
  * (spec §5.7). The copy's admin label gets " (Kopie)"; read-only nodes (global modules,

src/Integrations/Divi/Pages/DiviErrors.php

@@ -8,6 +8,8 @@ use LIT\MCP\Abilities\Errors;
 use WP_Error;
 use WP_Post;
 
+defined('ABSPATH') || exit;
+
 /** The client errors the Divi tools share. */
 final class DiviErrors
 {

src/Integrations/Divi/Pages/DiviFlags.php

@@ -6,6 +6,8 @@ namespace LIT\MCP\Integrations\Divi\Pages;
 
 use RuntimeException;
 
+defined('ABSPATH') || exit;
+
 /**
  * Marks an entry as a Divi 5 builder layout, like the Visual Builder's own save does
  * (Divi 5.2.1 SyncToServerController.php:382-387: _et_pb_use_divi_5 = "on", legacy

src/Integrations/Divi/Pages/DiviInsertAbility.php

@@ -8,6 +8,8 @@ use LIT\MCP\Abilities\Annotations;
 use LIT\MCP\Abilities\Errors;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * lit/divi-insert: inserts nodes in short and/or full form – modules, rows or whole sections –
  * at parent / before / after (spec §5.7). All or nothing (ruling S39): the whole input is

src/Integrations/Divi/Pages/DiviMoveAbility.php

@@ -8,6 +8,8 @@ use LIT\MCP\Abilities\Annotations;
 use LIT\MCP\Abilities\Errors;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * lit/divi-move: moves a node (with everything inside) to parent / before / after – also into
  * another row or section, as long as the structure rules allow it (spec §5.7). Read-only

src/Integrations/Divi/Pages/DiviNodeGetAbility.php

@@ -16,6 +16,8 @@ use LIT\MCP\Integrations\Divi\Design\DesignSystemReader;
 use LIT\MCP\Integrations\Divi\Schema\ShortformMap;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * lit/divi-node-get: all attributes of one node in the full form (spec §5.4, §5.7) –
  * attribute path => breakpoint map – plus the current short-form values.

src/Integrations/Divi/Pages/DiviOutlineAbility.php

@@ -13,6 +13,8 @@ use LIT\MCP\Integrations\Divi\BlockTree\Outline;
 use LIT\MCP\Integrations\Divi\Design\DesignSystemReader;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * lit/divi-outline: the page tree with path IDs, types, admin labels, text excerpts and
  * preset names plus tree_rev (spec §5.3, §5.7). Every Divi write needs this tree_rev.

src/Integrations/Divi/Pages/DiviPage.php

@@ -9,6 +9,8 @@ use LIT\MCP\Integrations\Divi\BlockTree\Document;
 use LIT\MCP\Integrations\Divi\BlockTree\NodeIndex;
 use WP_Post;
 
+defined('ABSPATH') || exit;
+
 /**
  * An entry loaded for the Divi tools: the post, its parsed tree, the path index and the
  * tree_rev (hash of post_content – the optimistic lock of the Divi tools, ruling P16; the

src/Integrations/Divi/Pages/DiviPageLoader.php

@@ -13,6 +13,8 @@ use LIT\MCP\Integrations\WordPress\Schema\ContentSchema;
 use LIT\MCP\Log;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * Loads an entry for the Divi tools: rights and status via PostGuard (spec §4.5), then the
  * block tree. Divi 4 shortcode content and unbalanced markup are refused with a hint –

src/Integrations/Divi/Pages/DiviReplaceTextAbility.php

@@ -19,6 +19,8 @@ use LIT\MCP\Log;
 use Throwable;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * lit/divi-replace-text: replaces visible text across the Divi pages of one content type
  * (spec §5.7, D10). dry_run (default true) only lists the hits with their tree_rev; the real run

src/Integrations/Divi/Pages/DiviSaver.php

@@ -15,6 +15,8 @@ use Throwable;
 use WP_Error;
 use WP_Post;
 
+defined('ABSPATH') || exit;
+
 /**
  * Save pipeline of spec §5.6, steps 3–5: restore point and wp_update_post() with wp_slash() (the
  * status stays), Divi 5 flags (DiviFlags), Divi's static CSS cache. A failure after saving is

src/Integrations/Divi/Pages/DiviSchema.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace LIT\MCP\Integrations\Divi\Pages;
 
+defined('ABSPATH') || exit;
+
 /** Input schema properties the Divi write tools share. */
 final class DiviSchema
 {

src/Integrations/Divi/Pages/DiviTextSearch.php

@@ -13,6 +13,8 @@ use LIT\MCP\Integrations\Divi\Compose\ValueCleaner;
 use LIT\MCP\Integrations\WordPress\PostGuard;
 use LIT\MCP\Integrations\WordPress\PostStatuses;
 
+defined('ABSPATH') || exit;
+
 /**
  * The search part of lit/divi-replace-text (D10): the SQL prefilter for candidate pages and
  * the hits of one page, computed without changing it. The replacement is cleaned per place by

src/Integrations/Divi/Pages/DiviUpdateAbility.php

@@ -10,6 +10,8 @@ use LIT\MCP\Integrations\Divi\BlockTree\Block;
 use LIT\MCP\Integrations\Divi\Compose\ColumnWidths;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * lit/divi-update: sets or removes values of existing nodes – short-form fields ("set"), full
  * form ("attrs", null removes a path or breakpoint), preset and admin label (spec §5.7). Several

src/Integrations/Divi/Pages/DiviWriteAbility.php

@@ -8,6 +8,8 @@ use LIT\MCP\Abilities\Ability;
 use LIT\MCP\Abilities\ToolResult;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * The frame of the Divi write tools (spec §5.6): permission and execute both load the page
  * through DiviWriter::page() (rights, Divi layout, tree_rev lock – execute never trusts state

src/Integrations/Divi/Pages/DiviWriter.php

@@ -16,6 +16,8 @@ use LIT\MCP\Integrations\Divi\Design\DesignSystemReader;
 use LIT\MCP\Integrations\WordPress\PostSaveFollowUp;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * The shared frame of every Divi write (spec §5.6): load with rights and the tree_rev lock
  * (ruling P16; a mismatch is rev_mismatch and nothing is written), let the ability change the

src/Integrations/Divi/Pages/DynamicContentMap.php

@@ -10,6 +10,8 @@ use LIT\MCP\Integrations\Divi\Compose\DynamicContentRules;
 use LIT\MCP\Log;
 use Throwable;
 
+defined('ABSPATH') || exit;
+
 /**
  * DynamicContentRules' dynamic content allow map (ruling S22) from Divi's live registry
  * DynamicContentOptions::get_options($postId, 'edit') – the options the Visual Builder offers

src/Integrations/Divi/Pages/WpMediaResolver.php

@@ -6,6 +6,8 @@ namespace LIT\MCP\Integrations\Divi\Pages;
 
 use LIT\MCP\Integrations\Divi\Compose\MediaResolver;
 
+defined('ABSPATH') || exit;
+
 /**
  * Media library images for short-form fields (image_id, portrait_id, image_ids): only images
  * the current user may read. URL and alt text are cleaned by ShortformWriter like client input.

src/Integrations/Divi/Pages/WpValueSanitizer.php

@@ -6,6 +6,8 @@ namespace LIT\MCP\Integrations\Divi\Pages;
 
 use LIT\MCP\Integrations\Divi\Compose\ValueSanitizer;
 
+defined('ABSPATH') || exit;
+
 /**
  * WordPress sanitizing of Divi values (spec §5.6/§10). Because DiviSaver bypasses kses for the
  * page as a whole (kses would re-serialize every untouched block, D7), every value this plugin