@apex-inc/mcp-server 0.28.0 → 0.28.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@apex-inc/mcp-server",
-  "version": "0.28.0",
+  "version": "0.28.1",
   "description": "MCP server for Apex \u2014 currently in private beta.",
   "type": "module",
   "main": "dist/index.js",

package/skills/apex-adoption/SKILL.md

@@ -89,10 +89,26 @@ Do not `add_journey_step` send on a compose-built path. Point the existing Send
 
 ## Stills
 
-Two pictures: **Not yet** (empty screen) and **Done** (finished). Shop or agent attaches. No Apex default stills.
+Two pictures: **Not yet** (empty screen) and **Done** (finished). Shop or agent attaches. No Apex default stills. Apex cannot sign into their product.
 
-- `attach_adoption_milestone_still` — `image_base64` or a public image URL
-- `recapture_adoption_milestone_stills` — public https pages on a **named workspace host**. Not localhost. A login wall writes nothing.
+**Public page** (anyone can open it):
+
+- Capture on the card, or `recapture_adoption_milestone_stills` on a **named workspace host**. Not localhost. A login wall writes nothing.
+- Or the CLI without a login file.
+
+**Signed-in product** (almost every SaaS moment) — Playwright on THEIR machine:
+
+1. Save a login file they already have from their tests, or:
+   `npx playwright codegen --save-storage .apex/auth.json https://app.theirproduct.com`
+2. Sit both screens:
+   ```
+   npx @apex-inc/mcp-server screenshot --milestone <id> --state not_yet --url https://app.theirproduct.com/reports --storage-state .apex/auth.json
+   npx @apex-inc/mcp-server screenshot --milestone <id> --state done --url https://app.theirproduct.com/reports --storage-state .apex/auth.json
+   ```
+3. Do not send the login file to Apex. Only the picture uploads.
+4. If they already have a PNG, `attach_adoption_milestone_still`.
+
+Do not use hosted recapture for a login wall.
 
 ## Hand-built Adaptive Journey
 
@@ -120,6 +136,9 @@ Only when they are not using compose:
 ### "Save not-yet as a Segment"
 Pass `save_not_yet_segment: true` (and/or `save_done_segment`) on compose. Names: `Not yet: {name}` / `Done: {name}`. Completing drops them from not-yet. The Adaptive Journey watch list stays private if they do not check this.
 
+### "Put pictures on a Milestone"
+Public page → `recapture_adoption_milestone_stills`. Signed-in page → CLI with `--storage-state` (recipe under Stills). Already have a PNG → `attach_adoption_milestone_still`.
+
 ## Guardrails
 
 - Milestones start OFF.

package/skills/apex-experimentation/SKILL.md

@@ -69,7 +69,7 @@ Interactive flows: MCP prompts `new-experiment` and `experiment-review` orchestr
 
 ## Screenshots, exposure & the wiring gate
 
-- **Screenshots are first-class.** SDK / Cursor experiments author the variant in local code. Apex does **not** auto-capture a public URL on create — that page does not have the unpublished variant, and a guessed host (a sibling workspace's brand domain) shows the wrong site on both arms. Capture both arms on localhost with `?_apex_preview=control|variant_a&_apex_exp=<id>`, then `attach_experiment_asset({ experimentId, variantKey, imageBase64 })`. After deploy, `recapture_experiment_screenshots` refreshes the live host. Snippet/DOM experiments created in the dashboard still auto-capture a public URL whose variant already lives there.
+- **Screenshots are first-class.** SDK / Cursor experiments author the variant in local code. Apex does **not** auto-capture a public URL on create — that page does not have the unpublished variant, and a guessed host (a sibling workspace's brand domain) shows the wrong site on both arms. Capture both arms on localhost with `?_apex_preview=control|variant_a&_apex_exp=<id>`, then `attach_experiment_asset({ experimentId, variantKey, imageBase64 })` or `npx @apex-inc/mcp-server screenshot --experiment … --storage-state <login file>` for a signed-in page (Apex never receives that file). After deploy, `recapture_experiment_screenshots` refreshes the live host. Snippet/DOM experiments created in the dashboard still auto-capture a public URL whose variant already lives there.
 - **Target URL is this workspace.** `target_url` must be a host named on the **active** workspace (`list_workspace_environments` + the workspace site). If the merchant already named a workspace, switch to it — do not ask which workspace again. If they have multiple hosts on that workspace, ask which URL. Never guess `apex.inc` or any other workspace's domain.
 - **Mobile/Capacitor experiments capture on-device.** When the experiment runs on an authed in-app screen (servers can't reach it), tell the dev to call `Apex.captureVariantScreenshot({ experimentId, variantKey })` on the variant's screen, keyed to the resolved variant in a `useEffect`, in a debug build (`Apex.initialize({ ..., debug: true })`). It no-ops in production and lands the shot on the dashboard card + gallery like web/agent captures.
 - **Exposure auto-fires.** When a variant resolves via `useApexVariant` (web) or `Apex.getVariant()` (mobile), the SDK fires the canonical `experiment_exposure` event — the denominator for results. You don't fire it manually.