@brunobracaioli/aibrain 0.4.0-beta.14 → 0.4.0-beta.15

package/README.md

@@ -63,7 +63,8 @@ Licensed `aisac claude` sessions also load guardrail hooks as the session plugin
 
 Licensed sessions of `aisac claude` and `aisac codex` can also load reviewed MCP
 servers: `github` (read-only, token in `GITHUB_PERSONAL_ACCESS_TOKEN`), `supabase`
-(read-only), `vercel`, `playwright` (pinned, isolated) and `context7`.
+(read-only), `vercel`, `playwright` (pinned, isolated), `context7` and `creatives` (the
+AISAC Creatives Studio, from client `0.4.0-beta.15`).
 - **Default:** every server is off. `aisac mcp` lists them, `aisac mcp enable|disable
   <id>` or `aisac mcp reset` changes the next session, and `aisac mcp info <id>` says
   what a server reaches and how to log in.

package/dist/claude-observation.mjs

@@ -16,7 +16,7 @@ export const MAX_LOG_FILES = 3;
 const LOCK_WAIT_MS = 250;
 const LOCK_STALE_MS = 30_000;
 const ADMISSION_MS = 60 * 60 * 1000;
-export const ADAPTER_VERSION = '0.4.0-beta.14';
+export const ADAPTER_VERSION = '0.4.0-beta.15';
 const MAX_DIAGNOSTIC_COUNT = 10_000_000;
 const MAX_DIAGNOSTIC_BYTES = 128 * 1024 * 1024;
 const CHECKPOINT_BACKENDS = new Set(['native_store', 'private_file']);

package/dist/cli.mjs

@@ -44,7 +44,7 @@ import { anyFormatter } from './guardrails/format.mjs';
 import { readCodexGuardrails } from './guardrails-plugin.mjs';
 import { codexHooksStatus, supportsCodexHooks } from './codex-hooks.mjs';
 
-const VERSION = '0.4.0-beta.14';
+const VERSION = '0.4.0-beta.15';
 // The command is `aisac`; `aibrain` is an alias installed from the same entry.
 const COMMAND = 'aisac';
 const ENDPOINT = 'https://mcp.ai-brain.aisac.cloud/mcp';

package/dist/extensions-catalog.mjs

@@ -185,10 +185,14 @@ export function hookIds() {
  * @property {Readonly<Record<CatalogLocale, string>>} [loginNote] Why and how this login differs.
  * @property {Readonly<Record<CatalogLocale, string>>} description
  * @property {Readonly<Record<CatalogLocale, string>>} reaches What the server can reach (FR7).
- * @property {readonly string[]} [blockedTools] Tools that spend money, removed in both
- *   clients whatever the user's permission mode is (FR7.2). Exact names.
+ * @property {readonly string[]} [blockedTools] Tools removed in both clients whatever the
+ *   user's permission mode is (FR7.2): tools that spend money, or that would take a
+ *   credential as an argument. Exact names.
  * @property {readonly string[]} [blockedToolPrefixes] Name prefixes removed in Claude Code
  *   only, through a glob deny rule; Codex documents exact names only (FR7.2).
+ * @property {Readonly<Record<CatalogLocale, string>>} [blockedNote] Why the tools are
+ *   blocked, when the reason is not spending; `aisac mcp info` prints it in place of the
+ *   spending sentence (FR7.2 amendment of 2026-11-09).
  */
 
 /** Session name of a catalog server, so it never collides with the user's own. */
@@ -196,8 +200,10 @@ export const MCP_SERVER_PREFIX = 'aisac-';
 const PLAYWRIGHT_PACKAGE = '@playwright/mcp@0.0.83';
 
 /**
- * MCP catalog v1 (spec FR7; the owner chose the list on 2026-11-03). The review of
- * each entry (source, transport, login, tools, reach) is recorded in the spec.
+ * MCP catalog v1 (spec FR7; the owner chose the five vendor servers on 2026-11-03)
+ * plus `creatives`, the AISAC Creatives Studio (owner, 2026-11-09; spec
+ * aisac-engineering-reels FR8, wave E7c). The review of each entry (source,
+ * transport, login, tools, reach) is recorded in the extensions spec (FR7.1).
  * @type {readonly McpEntry[]}
  */
 export const MCP_CATALOG = Object.freeze([
@@ -315,6 +321,45 @@ export const MCP_CATALOG = Object.freeze([
         'Só documentação pública de bibliotecas. O que o agente pergunta (nomes de bibliotecas e dúvidas) vai para a Upstash, então não coloque segredos nem código privado nessas perguntas. Funciona sem login, com limites de uso menores.',
     },
   },
+  {
+    id: 'creatives',
+    defaultOn: false,
+    clients: ['claude', 'codex'],
+    publisher: 'AISAC',
+    source: 'https://studio.aisac.agency/',
+    // The URL is the OAuth resource the Studio itself publishes in its
+    // protected-resource metadata (read 2026-11-09, reels spec M3). The Studio
+    // web app lives at studio.aisac.agency, but that domain is the browser origin
+    // only: the MCP issuer, audience and resource stay on this host, so a token
+    // obtained for this URL is the one the server accepts.
+    transport: { type: 'http', url: 'https://mcp-creatives.vercel.app/mcp' },
+    login: 'host-oauth',
+    // The key-management tools take or delete a provider key by name. A key typed
+    // into a tool call would stay in the session transcript, so keys are managed
+    // only on the Studio keys page (reels spec D2, FR8). The generate tools spend
+    // on the keys the user registered there: not blocked (FR7.2 amendment).
+    blockedTools: ['creatives_register_key', 'creatives_revoke_key'],
+    blockedNote: {
+      en: 'Provider keys are managed only on the Studio keys page (https://studio.aisac.agency/?studio=keys): a key typed into a tool call would stay in the session transcript.',
+      'pt-BR':
+        'As chaves dos provedores são gerenciadas só na página de chaves do Studio (https://studio.aisac.agency/?studio=keys): uma chave digitada numa chamada de ferramenta ficaria no transcript da sessão.',
+    },
+    loginNote: {
+      en: 'The Studio login needs an account with access (it comes with the AISAC Engineering purchase). Register your provider keys on the Studio keys page before the first generation; the server never takes a key as an argument.',
+      'pt-BR':
+        'O login do Studio exige uma conta com acesso (vem com a compra do AISAC Engineering). Registre as chaves dos seus provedores na página de chaves do Studio antes da primeira geração; o servidor nunca recebe uma chave como argumento.',
+    },
+    description: {
+      en: 'The AISAC Creatives Studio: images, narration and video generated with your own provider keys, plus voices, influencer profiles and reel productions.',
+      'pt-BR':
+        'O AISAC Creatives Studio: imagens, narração e vídeo gerados com as suas próprias chaves de provedor, mais vozes, perfis de influencer e produções de reels.',
+    },
+    reaches: {
+      en: 'Your Studio account only: the generations, assets, voice presets, influencer profiles, Motion projects and productions you own, and the fingerprints of the provider keys you registered (never the keys). Image, audio and video generation and the Motion stages spend on your own provider keys, within the limits the Studio enforces; a Studio production spends only after an approval in the Studio web app or in the Mothership. Registering and revoking keys is blocked by AISAC.',
+      'pt-BR':
+        'Só a sua conta do Studio: as gerações, assets, presets de voz, perfis de influencer, projetos Motion e produções que são seus, e as impressões digitais das chaves de provedor que você registrou (nunca as chaves). Geração de imagem, áudio e vídeo e as etapas do Motion gastam das suas próprias chaves de provedor, dentro dos limites que o Studio impõe; uma produção do Studio só gasta depois de uma aprovação no app web do Studio ou no Mothership. Registrar e revogar chaves é bloqueado pela AISAC.',
+    },
+  },
 ]);
 
 /** @param {string} id @returns {McpEntry | undefined} */

package/dist/extensions-cli.mjs

@@ -273,11 +273,13 @@ export function serverInfo(entry, locale, item) {
             note: 'Hosted by the vendor: its tools can change without a client release, so keep the confirmation of each call on.',
           },
     reaches: entry.reaches[locale],
-    // Tools that spend money, removed whatever the permission mode is (FR7.2).
+    // Tools removed whatever the permission mode is (FR7.2): they spend money, or
+    // the entry's blockedNote says why.
     blockedTools: [...(entry.blockedTools ?? [])],
     ...(entry.blockedToolPrefixes === undefined
       ? {}
       : { blockedToolPrefixes: [...entry.blockedToolPrefixes] }),
+    ...(entry.blockedNote === undefined ? {} : { blockedNote: entry.blockedNote[locale] }),
     login,
     ...(variable === undefined ? {} : { tokenVariable: variable }),
     ...(entry.loginNote === undefined ? {} : { loginNote: entry.loginNote[locale] }),
@@ -304,8 +306,12 @@ function printInfo(info) {
       prefixes.length === 0
         ? ''
         : ` In Claude Code, also any tool whose name starts with ${prefixes.join(', ')}.`;
+    const reason =
+      info.blockedNote === undefined
+        ? `Blocked by AISAC, because they spend money: ${info.blockedTools.join(', ')}.${claudeOnly}`
+        : `Blocked by AISAC: ${info.blockedTools.join(', ')}.${claudeOnly} ${info.blockedNote}`;
     console.log(
-      `Blocked by AISAC, because they spend money: ${info.blockedTools.join(', ')}.${claudeOnly} They stay blocked even if you allow every tool or skip permission prompts.`,
+      `${reason} They stay blocked even if you allow every tool or skip permission prompts.`,
     );
   }
   if (info.loginNote !== undefined) console.log(`Login: ${info.loginNote}`);

package/dist/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@brunobracaioli/aibrain",
-  "version": "0.4.0-beta.14",
+  "version": "0.4.0-beta.15",
   "type": "module"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brunobracaioli/aibrain",
-  "version": "0.4.0-beta.14",
+  "version": "0.4.0-beta.15",
   "private": false,
   "description": "AISAC client for Claude Code and Codex: AI Brain memory, context management and AISAC Engineering",
   "license": "UNLICENSED",