@leadbay/mcp 0.23.9 → 0.23.11

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog — @leadbay/mcp
 
+## 0.23.11 — 2026-07-02
+
+Windows `.dxt` sign-in now opens the browser reliably (product#3839).
+
+- **`openInBrowser` (Windows)** — the auto-open resolved the moment `cmd.exe` was *created*, before its internal `start` builtin actually handed the URL to the default browser. So a silent no-op (no default-browser protocol association, a locked-down shell / AppLocker, a corrupt `HKCR\http\shell\open`) went undetected: `browserOpenFailedAtBootstrap` stayed false and the user was told "a browser may have opened" when nothing did. On Windows we now wait (bounded — 800ms for `cmd start`, 1200ms otherwise) for the launcher's **exit code**, treat a non-zero exit as failure, and fall through to `rundll32 url.dll,FileProtocolHandler` (no command interpreter — the same ShellExecute path Explorer uses, with an honest exit code) and finally PowerShell `Start-Process`. When every launcher fails, the `AUTH_REQUIRED` envelope honestly says the browser couldn't be opened and shows the clickable sign-in link. The #3801 `&`-quoting `cmd start` candidate is unchanged and still tried first. macOS/Linux keep resolve-on-`spawn` (the #3805 headless-hang fix — those launchers are the hand-off).
+- **`bin.ts` shutdown** — the `browserOpenInFlight` teardown wait rose 1.5s → 3s so the multi-launcher Windows walk can finish dispatching before exit (the sibling bootstrap wait already allows 4s; the surfaced sign-in link is the fallback either way).
+
+## 0.23.10 — 2026-07-01
+
+A freshly-created lens no longer reads as "empty" (product#3833).
+
+- **`leadbay_new_lens`** — creating a lens with criteria queues an asynchronous backend wishlist rebuild, so an immediate `leadbay_pull_leads` can read empty for a few seconds while it computes. The `created` result now carries `computing_wishlist: true` and a "leads stream in — pull in ~30s" message so the agent waits instead of reporting an empty lens. A criteria-less clone inherits the base lens's leads immediately (`computing_wishlist: false`).
+- **`leadbay_pull_leads`** — on an EMPTY page where the backend reports the lens is still computing (`computing_wishlist`/`computing_scores`), `next_steps` now carries a single "Re-pull in ~30s" option (`kind: repull_computing`) instead of `null`, so the agent renders a wait-and-retry widget rather than "no leads." An empty page with nothing computing still returns `null` (a genuinely empty / over-narrow lens — no fabricated leads).
+- Confirmed against `leadbay/backend` (`POST /lenses/:id/filter` → `queueRefreshJob` → `RefreshLens`) and a live probe on `api-us`: a bare clone shows leads instantly; a filtered clone shows `computing_wishlist: true` then settles within ~1–30s.
+
 ## 0.23.9 — 2026-06-27
 
 MCP data plane now targets backend **/1.6** (was /1.5).
@@ -459,7 +474,7 @@ Every tool invocation now fires an `mcp tool called` event to PostHog (same proj
 
 ## 0.6.1 — 2026-05-10
 
-**Distribution**: listed in the official MCP Registry as `io.github.leadbay/leadbay-mcp` (auto-published from CI via GitHub OIDC); installable as a Claude Code plugin via `/plugin marketplace add leadbay/leadclaw` then `/plugin install leadbay@leadbay-leadclaw`; submission packets prepared for the Claude.ai connector directory and Anthropic's curated MCPB extension directory.
+**Distribution**: listed in the official MCP Registry as `io.github.leadbay/leadbay-mcp` (auto-published from CI via GitHub OIDC); installable as a Claude Code plugin via `/plugin marketplace add leadbay/mcp` then `/plugin install leadbay@leadbay-mcp`; submission packets prepared for the Claude.ai connector directory and Anthropic's curated MCPB extension directory.
 
 **Registry verification**: adds `mcpName` to the npm package metadata so the MCP Registry can verify ownership of `io.github.leadbay/leadbay-mcp` against the published `@leadbay/mcp` package.
 
@@ -641,7 +656,7 @@ New `leadbay_import_leads` composite write tool.
 Claude Desktop 2026 compatibility + install UX polish. Also publishes the `refine_prompt` `/user_prompt` wire-key fix that landed on `main` in 0.2.3 but never reached npm.
 
 - **Fix [product#3504](https://github.com/leadbay/product/issues/3504)** — `install --target claude-desktop` no longer silently no-ops on Claude Desktop 2026. The app moved to the DXT (Desktop Extension) system; the legacy `claude_desktop_config.json` is UI-prefs-only there and gets overwritten on every prefs save, so a block written to it disappears a few minutes later. `install` now detects DXT (via `Claude Extensions/`, `extensions-installations.json`, or `dxt:*` keys in `config.json`), prints a loud warning pointing at the `.dxt` bundle, and default-skips the legacy write. Pass `--force-legacy` to override.
-- **New: shipping a `.dxt` bundle** — drag-drop into Claude Desktop 2026 → Settings → Extensions. Uploaded to each [GitHub Release](https://github.com/leadbay/leadclaw/releases). Dialog asks for token + region + write-toggle; no terminal required. Manifest is DXT 0.2 (`dxt_version: "0.2"`, `user_config.leadbay_token.sensitive: true`). Source for the build lives in `packages/dxt/`.
+- **New: shipping a `.dxt` bundle** — drag-drop into Claude Desktop 2026 → Settings → Extensions. Uploaded to each [GitHub Release](https://github.com/leadbay/mcp/releases). Dialog asks for token + region + write-toggle; no terminal required. Manifest is DXT 0.2 (`dxt_version: "0.2"`, `user_config.leadbay_token.sensitive: true`). Source for the build lives in `packages/dxt/`.
 - **Fix**: `login` 401 errors no longer end with a dangling `:` when the backend returns an empty body. Messages now read `login failed (401) at <url> (wrong email or password?)`. 429/5xx get their own hints too. The core helper `formatLoginError` is exported from `@leadbay/core` so the MCP and ClawHub surfaces stay in sync.
 - **README**: new section on `npm install -g` EACCES (sudo / npx / nvm workarounds — common on the official nodejs.org `.pkg`), and a pointer to the `.dxt` install for Claude Desktop 2026.
 - **Also shipping** (previously merged but not yet published to npm) — `leadbay_refine_prompt` / `leadbay_set_user_prompt` now send `{ user_prompt }` instead of `{ prompt }` to `POST /user_prompt` ([product#3508](https://github.com/leadbay/product/issues/3508)). Fixes the JSON deserialization 400 Ludo hit during the 0.2.2 install session.

package/MIGRATION.md

@@ -166,7 +166,7 @@ The legacy `leadbay-mcp install --include-write` flag is accepted but a no-op
 
 ---
 
-# Migration: leadclaw / leadbay-mcp 0.1.x → 0.2.0
+# Migration: leadbay-mcp 0.1.x → 0.2.0
 
 This release is the autoplan-reviewed agent-experience overhaul. The OpenClaw
 plugin and MCP server gain a coherent composite-tool surface so an AI agent
@@ -277,7 +277,7 @@ additionally exposes the granular tools; most users don't need it.
 
 ### OpenClaw plugin
 
-In the plugin config (e.g. `openclaw config set plugins.entries.leadclaw.exposeWrite true`):
+In the plugin config (e.g. `openclaw config set plugins.entries.leadbay-mcp.exposeWrite true`):
 
 ```json
 {

package/README.md

@@ -143,11 +143,11 @@ To rotate the local MCP credential, re-run `npx -y @leadbay/mcp install --oauth`
 ### Install via the Claude Code plugin marketplace
 
 ```text
-/plugin marketplace add leadbay/leadclaw
+/plugin marketplace add leadbay/mcp
 ```
 
 ```text
-/plugin install leadbay@leadbay-leadclaw
+/plugin install leadbay@leadbay-mcp
 ```
 
 Claude Code prompts for Leadbay auth/config through the plugin's `userConfig`. This is equivalent to the npm/CLI install above.
@@ -157,13 +157,13 @@ The plugin install gives you **two surfaces in one shot**:
 1. **The MCP server** — registered via the plugin's `mcpServers.leadbay` block (boots `@leadbay/mcp` over stdio). This exposes the `leadbay_*` tools to the agent.
 2. **Six auto-discovered Claude Code skills** under `skills/` — `leadbay_daily_check_in`, `leadbay_research_a_domain`, `leadbay_import_file`, `leadbay_log_outreach`, `leadbay_qualify_top_n`, `leadbay_refine_audience`. These auto-trigger on natural-language matches against each skill's description ("get me leadbay leads today", "research acme.com", etc.) and dispatch to the MCP tools above by name. Each `SKILL.md` is generated by `@leadbay/promptforge` from the same `.md.tmpl` source as the MCP prompt, so the two surfaces never drift.
 
-You can verify the skills installed by running `/skill list` after install. To uninstall everything, `/plugin uninstall leadbay@leadbay-leadclaw` removes the MCP server registration **and** the skills together.
+You can verify the skills installed by running `/skill list` after install. To uninstall everything, `/plugin uninstall leadbay@leadbay-mcp` removes the MCP server registration **and** the skills together.
 
 ### Claude Desktop
 
 The guided installer writes the local `mcpServers.leadbay` entry in `claude_desktop_config.json` with `npx -y @leadbay/mcp@latest`, like the Linux flow. Restart Claude Desktop after install.
 
-The `.dxt` / `.mcpb` bundle from [Releases](https://github.com/leadbay/leadclaw/releases/latest) remains available as an alternative install path.
+The `.dxt` / `.mcpb` bundle from [Releases](https://github.com/leadbay/mcp/releases/latest) remains available as an alternative install path.
 
 ### `npm install -g` says "EACCES" / "permission denied"
 
@@ -551,7 +551,7 @@ The user's literal text replaces `verification.ref` in the outreach record, and
 
 ## 7. Upgrade & rotation
 
-**Upgrade**: the guided installer pins `@leadbay/mcp@latest`, so each MCP session already picks up the newest published version — just restart the client. (If you hand-pinned a specific version in your config, change it to `@latest` or the version you want, then restart.) **0.3.0 enables composite write tools by default** — see [MIGRATION.md](./MIGRATION.md). See also the [changelog](https://github.com/leadbay/leadclaw/releases).
+**Upgrade**: the guided installer pins `@leadbay/mcp@latest`, so each MCP session already picks up the newest published version — just restart the client. (If you hand-pinned a specific version in your config, change it to `@latest` or the version you want, then restart.) **0.3.0 enables composite write tools by default** — see [MIGRATION.md](./MIGRATION.md). See also the [changelog](https://github.com/leadbay/mcp/releases).
 
 **Rotate local credential**: re-run `npx -y @leadbay/mcp@latest install --oauth` (or `login --oauth`) — the new credential replaces the old one in your MCP client config.
 

package/dist/bin.js

@@ -7411,8 +7411,9 @@ On \`preview\` (default \u2014 NOTHING created yet): show the lens that WILL be
 created (name + resolved sectors/sizes as chips) and ASK the user to confirm
 via ask_user_input_v0 ("Create this lens?" / "Change something"). Only on
 "yes" re-call with confirm:true. On \`created\`: confirm "Created **<name>**."
-On \`ambiguous_sectors\` / \`ambiguous_locations\`: surface the candidates to
-pick from.
+(if \`computing_wishlist:true\`, add that leads stream in \u2014 pull in ~30s, don't
+report "empty"). On \`ambiguous_sectors\` / \`ambiguous_locations\`: surface the
+candidates to pick from.
 
 ---
 
@@ -7426,6 +7427,8 @@ Create a brand-new lens (saved audience) and apply its sector/size criteria. Clo
 
 **Does not switch the active lens.** The new lens is created but the user stays on their current one. Offer \`leadbay_my_lenses(switchToLensId=<new id>)\` as a next step if they want to start pulling from it.
 
+**Leads compute asynchronously.** When the lens has criteria, applying the filter kicks off a backend wishlist rebuild \u2014 the \`created\` result carries \`computing_wishlist:true\`. An immediate \`leadbay_pull_leads\` may read empty for a few seconds while it computes; that lens is *warming up*, not empty. Wait ~30s before the first pull (or offer the user a re-pull). A criteria-less clone inherits the base lens's leads right away (\`computing_wishlist:false\`).
+
 WHEN TO USE: when the user wants a NEW lens. Canonical phrasings: "create a lens called X", "make a new audience for Y", "set up a lens for <sector>".
 
 WHEN NOT TO USE: to EDIT an existing lens \u2014 use \`leadbay_adjust_audience\` (pass \`lensName\` to target one by name). Not for listing/switching (\`leadbay_my_lenses\`) or topping up (\`leadbay_extend_lens\`).
@@ -7479,17 +7482,23 @@ User picks \u2192 call the matching \`Calls\` tool. Constraints: 2\u20134 mutual
 Pick the rows that fit. On \`created\`, the switch + pull rows are the natural
 follow-ups. On \`ambiguous_sectors\`, the only move is to pick a sector and re-call.
 
-| Observation                       | Suggest                                  | Calls                                                  |
-|-----------------------------------|------------------------------------------|--------------------------------------------------------|
-| \`preview\` (not yet created)       | "Yes, create this lens"                  | \`leadbay_new_lens(...same args..., confirm=true)\`      |
-| \`preview\` (not yet created)       | "Change the sectors/size first"          | (re-ask the user, then \`leadbay_new_lens\` with new args) |
-| Lens created                      | "Switch to it and pull leads"            | \`leadbay_my_lenses(switchToLensId=<new id>)\` then \`leadbay_pull_leads()\` |
-| Lens created                      | "Refine the audience further"            | \`leadbay_adjust_audience(lensName=<new name>, ...)\`    |
-| Lens created                      | "Leave it; keep my current lens active"  | (no call)                                              |
-| \`ambiguous_sectors\`               | "Pick the right sector and create"       | \`leadbay_new_lens(name=..., sectors=[<chosen id>])\`    |
-
-If nothing fits, default to "switch to the new lens and pull leads" \u2014 never
-invent a tool that doesn't exist.
+**\`created\` with \`computing_wishlist: true\`** \u2014 the new lens's leads are being
+(re)computed asynchronously. Do NOT fire an immediate \`leadbay_pull_leads\` and
+report "empty" \u2014 the lens is warming up, not empty. Tell the user the lens was
+created and its leads are streaming in, and offer to pull in ~30s.
+
+| Observation                             | Suggest                                  | Calls                                                  |
+|-----------------------------------------|------------------------------------------|--------------------------------------------------------|
+| \`preview\` (not yet created)             | "Yes, create this lens"                  | \`leadbay_new_lens(...same args..., confirm=true)\`      |
+| \`preview\` (not yet created)             | "Change the sectors/size first"          | (re-ask the user, then \`leadbay_new_lens\` with new args) |
+| Lens created, \`computing_wishlist=true\` | "Give it ~30s, then pull leads (the wishlist is still computing)" | \`leadbay_my_lenses(switchToLensId=<new id>)\` then \`leadbay_pull_leads()\` after ~30s |
+| Lens created (no criteria)              | "Switch to it and pull leads"            | \`leadbay_my_lenses(switchToLensId=<new id>)\` then \`leadbay_pull_leads()\` |
+| Lens created                            | "Refine the audience further"            | \`leadbay_adjust_audience(lensName=<new name>, ...)\`    |
+| Lens created                            | "Leave it; keep my current lens active"  | (no call)                                              |
+| \`ambiguous_sectors\`                     | "Pick the right sector and create"       | \`leadbay_new_lens(name=..., sectors=[<chosen id>])\`    |
+
+If nothing fits, default to "switch to the new lens and pull leads in ~30s
+(the wishlist may still be computing)" \u2014 never invent a tool that doesn't exist.
 `;
     leadbay_open_billing_portal = `Generate a one-shot Stripe customer-portal URL. Wraps \`GET /1.6/stripe/portal\` \u2192 \`{url}\`. Returns a fresh Stripe-hosted URL the user can open to manage their existing Leadbay subscription: change plan tier, swap payment method, view invoices. The agent does NOT make subscription changes itself \u2014 it surfaces the URL and lets the user act.
 
@@ -7951,7 +7960,8 @@ Examples that should NOT invoke this tool (sound similar, route elsewhere):
 
 ## RENDER (quick)
 
-3-col markdown table sorted by \`score\` desc \u2014 DO NOT print the numeric
+3-col markdown table in the order the tool returns them (the Discover-tab
+order \u2014 do NOT re-sort by score) \u2014 DO NOT print the numeric
 score. Col 1 = inline-code 10-segment bar (\`\u25B0\` firmographic, \`\u2756\` AI
 booster cap at the right end of the filled run, \`\u25B1\` empty;
 filled=round(score/10), ai=round(avg_boost/3.3)) + \`<br>\` + linked
@@ -7978,7 +7988,7 @@ The active lens can change between calls (5-min cache + backend \`last_requested
 
 ## RENDERING \u2014 markdown table, three columns, score-bar driven
 
-Present the response as a markdown table sorted by \`score\` descending, with exactly three columns. Do not summarize in prose. Do not show the numeric score anywhere.
+Present the response as a markdown table **in the exact order the tool returned the leads** \u2014 this is the Discover-tab order (the backend orders by new-today first, then status, then score). Do **not** re-sort the rows (in particular, do NOT re-order by \`score\`); render them top-to-bottom as received so the list matches what the user sees in the Leadbay UI. Exactly three columns. Do not summarize in prose. Do not show the numeric score anywhere.
 
 ## Score-bar (10-segment, inline-code wrapped)
 
@@ -8084,6 +8094,7 @@ Pick 2\u20133 items below based on what was actually observed in the response. T
 | Top row has phone but no email                             | "Show [Contact]'s call details + a 60-second opener"         | leadbay_prepare_outreach(leadId)                       |
 | Top row has contacts but no phone/email                    | "Order contact enrichment to surface email/phone first"      | leadbay_enrich_titles(...) or leadbay_prepare_outreach(leadId, enrich:true) |
 | \`computing_scores == true\` or \`computing_wishlist == true\` | "Scores are still being computed \u2014 re-pull in ~30s"          | leadbay_pull_leads (retry with same lensId)            |
+| Batch is EMPTY and \`computing_wishlist\`/\`computing_scores == true\` (e.g. a just-created lens) | render the \`next_steps\` widget \u2014 it carries "Re-pull in ~30s" (first) + "Refine audience". Do NOT report "no leads": the lens is warming up, not empty | leadbay_pull_leads (retry with same lensId after ~30s) |
 | User wants a narrower / wider audience                     | "Adjust the lens filters (sector / size)"                    | leadbay_adjust_audience(...)                           |
 | Phase 4 research was run (\`research_lead_by_id\` called) AND top contacts lack direct email/phone | "Enrich contacts on [Lead1], [Lead2] to get direct emails and phone numbers" | leadbay_enrich_contacts(leadId, contactId) \u2014 ONE call per contact (the tool takes a single leadId + contactId, never a list) |
 If nothing in the menu applies cleanly, suggest only "pull next page" and "research a specific lead in depth" \u2014 never invent a tool that doesn't exist.
@@ -9396,12 +9407,12 @@ var init_login = __esm({
       execute: async (client, params, ctx) => {
         const cleanPassword = params.password.replace(/\\(.)/g, "$1");
         const startWith = client.region === "fr" ? "fr" : "us";
-        ctx?.logger?.info?.(`LeadClaw login: email=${params.email} startRegion=${startWith}`);
+        ctx?.logger?.info?.(`Leadbay login: email=${params.email} startRegion=${startWith}`);
         try {
           const result = await resolveRegion(params.email, cleanPassword, startWith);
           if (client.baseUrl !== result.baseUrl) {
             client.setBaseUrl(result.baseUrl, result.region);
-            ctx?.logger?.info?.(`LeadClaw login: switched to region=${result.region} (account is in the ${result.region.toUpperCase()} backend)`);
+            ctx?.logger?.info?.(`Leadbay login: switched to region=${result.region} (account is in the ${result.region.toUpperCase()} backend)`);
           }
           client.setToken(result.token);
           client.prefetchOrgData().catch(() => {
@@ -9413,7 +9424,7 @@ var init_login = __esm({
             verified: result.verified
           };
         } catch (err) {
-          ctx?.logger?.error?.(`LeadClaw login: failed: ${err?.message}`);
+          ctx?.logger?.error?.(`Leadbay login: failed: ${err?.message}`);
           return {
             error: true,
             code: "LOGIN_FAILED",
@@ -11413,7 +11424,7 @@ async function pollRecordsToTerminal(client, importId, budgetMs, expectedRowCoun
       }
     }
     if (!exhaustedPagination) {
-      throw client.makeError("IMPORT_PAGINATION_RUNAWAY", `Records pagination exceeded ${maxPagesPerPoll} pages`, `importId=${importId}. Please file a bug at https://github.com/leadbay/leadclaw/issues.`, `GET /imports/${importId}/records`);
+      throw client.makeError("IMPORT_PAGINATION_RUNAWAY", `Records pagination exceeded ${maxPagesPerPoll} pages`, `importId=${importId}. Please file a bug at https://github.com/leadbay/mcp/issues.`, `GET /imports/${importId}/records`);
     }
     const snapshot = { total, transient };
     const settled = transient === 0;
@@ -14474,9 +14485,27 @@ function summarise(responses) {
   return { answered, total, avg_qualification_boost: avg, best_response_excerpt: excerpt };
 }
 function buildPullLeadsNextSteps(args) {
-  const { leadCount, hasMore, nextPage } = args;
-  if (leadCount <= 0)
+  const { leadCount, hasMore, nextPage, computingWishlist, computingScores } = args;
+  if (leadCount <= 0) {
+    if (computingWishlist || computingScores) {
+      return {
+        question: "This lens is still warming up. What next?",
+        options: [
+          {
+            label: "Re-pull in ~30s",
+            description: "Leads are still being computed for this lens \u2014 wait ~30s, then pull again to see them.",
+            kind: "repull_computing"
+          },
+          {
+            label: "Refine audience",
+            description: "Adjust the lens audience / filters (sector, size, prompt) \u2014 useful if it's coming back sparse.",
+            kind: "refine_audience"
+          }
+        ]
+      };
+    }
     return null;
+  }
   const options = [];
   options.push({
     label: "Triage board",
@@ -14574,7 +14603,7 @@ var init_pull_leads = __esm({
           },
           next_steps: {
             type: ["object", "null"],
-            description: "Ready-made NEXT STEPS for the host's choice widget. Each option has a SHORT `label` (\u22645 words, fits AskUserQuestion's label cap on Claude cowork/Claude Code) and a full `description`. For AskUserQuestion (cowork/Claude Code) pass each option as {label, description}. For ask_user_input_v0 (Claude chat/ChatGPT, string-only options) use the `description` as the option string. Use these VERBATIM, in order \u2014 do NOT re-derive, reword, or render as prose when a widget tool exists. options[0] is the artifact offer (build the lead triage board) whenever the batch is non-empty. null only when the batch is empty.",
+            description: "Ready-made NEXT STEPS for the host's choice widget. Each option has a SHORT `label` (\u22645 words, fits AskUserQuestion's label cap on Claude cowork/Claude Code) and a full `description`. For AskUserQuestion (cowork/Claude Code) pass each option as {label, description}. For ask_user_input_v0 (Claude chat/ChatGPT, string-only options) use the `description` as the option string. Use these VERBATIM, in order \u2014 do NOT re-derive, reword, or render as prose when a widget tool exists. options[0] is the artifact offer (build the lead triage board) whenever the batch is non-empty. When the batch is empty but the lens is still computing (computing_wishlist/computing_scores true), this carries a 'Re-pull in ~30s' option (kind:repull_computing) plus 'Refine audience' \u2014 render the widget so the user waits rather than seeing 'no leads.' null only when the batch is empty AND nothing is computing (a genuinely empty / over-narrow lens).",
             properties: {
               question: { type: "string" },
               options: {
@@ -14665,7 +14694,13 @@ var init_pull_leads = __esm({
         const hasMore = currentPage < totalPages - 1;
         const nextPage = hasMore ? currentPage + 1 : null;
         const leadCount = res.items.length;
-        const nextSteps = buildPullLeadsNextSteps({ leadCount, hasMore, nextPage });
+        const nextSteps = buildPullLeadsNextSteps({
+          leadCount,
+          hasMore,
+          nextPage,
+          computingWishlist: res.computing_wishlist,
+          computingScores: res.computing_scores
+        });
         return withAgentMemoryMeta(client, {
           lens: { id: lensId },
           leads: res.items.map((lead) => ({
@@ -21818,6 +21853,10 @@ var init_new_lens = __esm({
             items: { type: "object" }
           },
           filter_applied: { type: "object", description: "On 'created': the FilterPayload POSTed to the new lens." },
+          computing_wishlist: {
+            type: "boolean",
+            description: "On 'created': true when the lens has criteria and its wishlist is (re)computing asynchronously \u2014 an immediate leadbay_pull_leads may read empty; wait ~30s. False for a criteria-less clone (it inherits the base lens's leads immediately)."
+          },
           message: { type: "string" },
           _meta: { type: "object" }
         },
@@ -21924,7 +21963,13 @@ var init_new_lens = __esm({
           status: "created",
           lens: { id: created.id, name: created.name },
           filter_applied: merged,
-          message: `Created "${created.name}".`,
+          // Applying the filter queued a backend wishlist refresh (#3833). The lens
+          // leads are (re)computed asynchronously, so an immediate pull_leads can
+          // read empty for a few seconds. Signal that here (flag-independent — the
+          // backend's own computing_wishlist can lag right after create) so the
+          // agent waits ~30s instead of reporting an empty lens.
+          computing_wishlist: hasCriteria,
+          message: hasCriteria ? `Created "${created.name}". Leads stream in asynchronously \u2014 call leadbay_pull_leads in ~30s to see them (an immediate pull may show an empty lens while the wishlist computes).` : `Created "${created.name}".`,
           _meta: { region: client.region }
         };
       }
@@ -23223,7 +23268,7 @@ Call \`leadbay_pull_leads\` on the resolved lens. **Capture \`response.lens.id\`
 
 ## RENDERING \u2014 markdown table, three columns, score-bar driven
 
-Present the response as a markdown table sorted by \`score\` descending, with exactly three columns. Do not summarize in prose. Do not show the numeric score anywhere.
+Present the response as a markdown table **in the exact order the tool returned the leads** \u2014 this is the Discover-tab order (the backend orders by new-today first, then status, then score). Do **not** re-sort the rows (in particular, do NOT re-order by \`score\`); render them top-to-bottom as received so the list matches what the user sees in the Leadbay UI. Exactly three columns. Do not summarize in prose. Do not show the numeric score anywhere.
 
 ## Score-bar (10-segment, inline-code wrapped)
 
@@ -23422,7 +23467,7 @@ If the prompt's body and the tool's RENDERING appear to conflict, the tool's REN
 
 ## RENDERING \u2014 markdown table, three columns, score-bar driven
 
-Present the response as a markdown table sorted by \`score\` descending, with exactly three columns. Do not summarize in prose. Do not show the numeric score anywhere.
+Present the response as a markdown table **in the exact order the tool returned the leads** \u2014 this is the Discover-tab order (the backend orders by new-today first, then status, then score). Do **not** re-sort the rows (in particular, do NOT re-order by \`score\`); render them top-to-bottom as received so the list matches what the user sees in the Leadbay UI. Exactly three columns. Do not summarize in prose. Do not show the numeric score anywhere.
 
 ## Score-bar (10-segment, inline-code wrapped)
 
@@ -23552,6 +23597,7 @@ Pick 2\u20133 items below based on what was actually observed in the response. T
 | Top row has phone but no email                             | "Show [Contact]'s call details + a 60-second opener"         | leadbay_prepare_outreach(leadId)                       |
 | Top row has contacts but no phone/email                    | "Order contact enrichment to surface email/phone first"      | leadbay_enrich_titles(...) or leadbay_prepare_outreach(leadId, enrich:true) |
 | \`computing_scores == true\` or \`computing_wishlist == true\` | "Scores are still being computed \u2014 re-pull in ~30s"          | leadbay_pull_leads (retry with same lensId)            |
+| Batch is EMPTY and \`computing_wishlist\`/\`computing_scores == true\` (e.g. a just-created lens) | render the \`next_steps\` widget \u2014 it carries "Re-pull in ~30s" (first) + "Refine audience". Do NOT report "no leads": the lens is warming up, not empty | leadbay_pull_leads (retry with same lensId after ~30s) |
 | User wants a narrower / wider audience                     | "Adjust the lens filters (sector / size)"                    | leadbay_adjust_audience(...)                           |
 | Phase 4 research was run (\`research_lead_by_id\` called) AND top contacts lack direct email/phone | "Enrich contacts on [Lead1], [Lead2] to get direct emails and phone numbers" | leadbay_enrich_contacts(leadId, contactId) \u2014 ONE call per contact (the tool takes a single leadId + contactId, never a list) |
 If nothing in the menu applies cleanly, suggest only "pull next page" and "research a specific lead in depth" \u2014 never invent a tool that doesn't exist.
@@ -24066,7 +24112,7 @@ When \`bulk_qualify_leads\` returns, surface results in two parts.
 
 ## RENDERING \u2014 markdown table, three columns, score-bar driven
 
-Present the response as a markdown table sorted by \`score\` descending, with exactly three columns. Do not summarize in prose. Do not show the numeric score anywhere.
+Present the response as a markdown table **in the exact order the tool returned the leads** \u2014 this is the Discover-tab order (the backend orders by new-today first, then status, then score). Do **not** re-sort the rows (in particular, do NOT re-order by \`score\`); render them top-to-bottom as received so the list matches what the user sees in the Leadbay UI. Exactly three columns. Do not summarize in prose. Do not show the numeric score anywhere.
 
 ## Score-bar (10-segment, inline-code wrapped)
 
@@ -25174,7 +25220,7 @@ function getCachedUpdateInfo() {
 function getInFlightCheck() {
   return inFlightCheck;
 }
-var RELEASES_LATEST_URL = "https://api.github.com/repos/leadbay/leadclaw/releases/latest";
+var RELEASES_LATEST_URL = "https://api.github.com/repos/leadbay/mcp/releases/latest";
 var CHECK_THROTTLE_MS = 24 * 60 * 60 * 1e3;
 var FETCH_TIMEOUT_MS = 5e3;
 var USER_AGENT = "leadbay-mcp-update-check";
@@ -25754,7 +25800,7 @@ function buildServer(client, opts = {}) {
   }
   const exposedNames = new Set(toolByName.keys());
   const server = new Server(
-    { name: "leadbay", version: opts.version ?? "0.0.0-dev" },
+    { name: "leadbay-mcp", version: opts.version ?? "0.0.0-dev" },
     {
       capabilities: {
         tools: {},
@@ -27536,6 +27582,17 @@ function browserOpenCandidates(url) {
     { cmd: "xdg-open", args: [url] }
   ];
 }
+function windowsFallbackCandidates(url) {
+  const sysRoot = process.env.SystemRoot || process.env.windir || "C:\\Windows";
+  const psLiteral = `'${url.replace(/'/g, "''")}'`;
+  return [
+    { cmd: `${sysRoot}\\System32\\rundll32.exe`, args: ["url.dll,FileProtocolHandler", url] },
+    {
+      cmd: `${sysRoot}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`,
+      args: ["-NoProfile", "-NonInteractive", "-Command", "Start-Process", psLiteral]
+    }
+  ];
+}
 function browserLaunchEnv(debug) {
   const env = { ...process.env };
   if (process.platform !== "linux") return env;
@@ -27600,7 +27657,7 @@ function browserLaunchEnv(debug) {
   return env;
 }
 async function openInBrowser(url, debug) {
-  const candidates = browserOpenCandidates(url);
+  const candidates = process.platform === "win32" ? [...browserOpenCandidates(url), ...windowsFallbackCandidates(url)] : browserOpenCandidates(url);
   const launchEnv = browserLaunchEnv(debug);
   debug?.(
     `openInBrowser: platform=${process.platform} DISPLAY=${launchEnv.DISPLAY ?? "<unset>"} WAYLAND=${launchEnv.WAYLAND_DISPLAY ?? "<unset>"} DBUS=${launchEnv.DBUS_SESSION_BUS_ADDRESS ? "set" : "<unset>"} candidates=[${candidates.map((c) => c.cmd).join(", ")}]`
@@ -27609,14 +27666,43 @@ async function openInBrowser(url, debug) {
   for (const { cmd, args } of candidates) {
     try {
       await new Promise((resolve, reject) => {
-        const spawnOpts = { stdio: "ignore", detached: true, env: launchEnv };
-        if (process.platform === "win32") spawnOpts.windowsVerbatimArguments = true;
+        const isWin = process.platform === "win32";
+        const spawnOpts = { stdio: "ignore", detached: !isWin, env: launchEnv };
+        if (isWin) spawnOpts.windowsVerbatimArguments = true;
         const child = spawn3(cmd, args, spawnOpts);
         child.on("error", reject);
-        child.on("spawn", () => {
-          debug?.(`spawn OK: ${cmd} (pid=${child.pid})`);
+        if (!isWin) {
+          child.on("spawn", () => {
+            debug?.(`spawn OK: ${cmd} (pid=${child.pid})`);
+            child.unref();
+            resolve();
+          });
+          return;
+        }
+        const isCmd = /cmd(\.exe)?$/i.test(cmd);
+        const budgetMs = isCmd ? 800 : 1200;
+        let settled = false;
+        const finish = (fn) => {
+          if (settled) return;
+          settled = true;
+          fn();
+        };
+        const timer = setTimeout(() => {
+          debug?.(`exit-wait timeout (${budgetMs}ms): ${cmd} \u2014 assuming launched`);
           child.unref();
-          resolve();
+          finish(resolve);
+        }, budgetMs);
+        timer.unref?.();
+        child.on("spawn", () => debug?.(`spawn OK: ${cmd} (pid=${child.pid}) \u2014 awaiting exit`));
+        child.on("exit", (code) => {
+          clearTimeout(timer);
+          if (code === 0 || code === null) {
+            debug?.(`exit ${code}: ${cmd} \u2014 launched OK`);
+            finish(resolve);
+          } else {
+            debug?.(`exit ${code}: ${cmd} \u2014 treating as failed, next candidate`);
+            finish(() => reject(new Error(`${cmd} exited ${code}`)));
+          }
         });
       });
       return;
@@ -27721,7 +27807,7 @@ var OAUTH_BASE_URLS = {
     fr: "https://staging.api.leadbay.app"
   }
 };
-var VERSION = "0.23.9";
+var VERSION = "0.23.11";
 var HELP = `
 leadbay-mcp ${VERSION} \u2014 Leadbay Model Context Protocol server
 
@@ -27788,7 +27874,7 @@ EXAMPLE Claude Desktop config (~/Library/Application Support/Claude/claude_deskt
   }
 
 DOCS
-  https://github.com/leadbay/leadclaw#readme
+  https://github.com/leadbay/mcp#readme
 `.trim();
 function makeStderrLogger(level) {
   const rank = { debug: 0, info: 1, error: 2 };
@@ -28998,11 +29084,11 @@ async function main() {
       }
     }
     if (browserOpenInFlight) {
-      bootstrapDebug(`shutdown(code=${code}) browser-open still in flight \u2014 waiting up to 1.5s`);
+      bootstrapDebug(`shutdown(code=${code}) browser-open still in flight \u2014 waiting up to 3s`);
       try {
         await Promise.race([
           browserOpenInFlight,
-          new Promise((r) => setTimeout(r, 1500))
+          new Promise((r) => setTimeout(r, 3e3))
         ]);
       } catch {
       }

package/dist/http-server.js

@@ -88,7 +88,7 @@ Call \`leadbay_pull_leads\` on the resolved lens. **Capture \`response.lens.id\`
 
 ## RENDERING \u2014 markdown table, three columns, score-bar driven
 
-Present the response as a markdown table sorted by \`score\` descending, with exactly three columns. Do not summarize in prose. Do not show the numeric score anywhere.
+Present the response as a markdown table **in the exact order the tool returned the leads** \u2014 this is the Discover-tab order (the backend orders by new-today first, then status, then score). Do **not** re-sort the rows (in particular, do NOT re-order by \`score\`); render them top-to-bottom as received so the list matches what the user sees in the Leadbay UI. Exactly three columns. Do not summarize in prose. Do not show the numeric score anywhere.
 
 ## Score-bar (10-segment, inline-code wrapped)
 
@@ -287,7 +287,7 @@ If the prompt's body and the tool's RENDERING appear to conflict, the tool's REN
 
 ## RENDERING \u2014 markdown table, three columns, score-bar driven
 
-Present the response as a markdown table sorted by \`score\` descending, with exactly three columns. Do not summarize in prose. Do not show the numeric score anywhere.
+Present the response as a markdown table **in the exact order the tool returned the leads** \u2014 this is the Discover-tab order (the backend orders by new-today first, then status, then score). Do **not** re-sort the rows (in particular, do NOT re-order by \`score\`); render them top-to-bottom as received so the list matches what the user sees in the Leadbay UI. Exactly three columns. Do not summarize in prose. Do not show the numeric score anywhere.
 
 ## Score-bar (10-segment, inline-code wrapped)
 
@@ -417,6 +417,7 @@ Pick 2\u20133 items below based on what was actually observed in the response. T
 | Top row has phone but no email                             | "Show [Contact]'s call details + a 60-second opener"         | leadbay_prepare_outreach(leadId)                       |
 | Top row has contacts but no phone/email                    | "Order contact enrichment to surface email/phone first"      | leadbay_enrich_titles(...) or leadbay_prepare_outreach(leadId, enrich:true) |
 | \`computing_scores == true\` or \`computing_wishlist == true\` | "Scores are still being computed \u2014 re-pull in ~30s"          | leadbay_pull_leads (retry with same lensId)            |
+| Batch is EMPTY and \`computing_wishlist\`/\`computing_scores == true\` (e.g. a just-created lens) | render the \`next_steps\` widget \u2014 it carries "Re-pull in ~30s" (first) + "Refine audience". Do NOT report "no leads": the lens is warming up, not empty | leadbay_pull_leads (retry with same lensId after ~30s) |
 | User wants a narrower / wider audience                     | "Adjust the lens filters (sector / size)"                    | leadbay_adjust_audience(...)                           |
 | Phase 4 research was run (\`research_lead_by_id\` called) AND top contacts lack direct email/phone | "Enrich contacts on [Lead1], [Lead2] to get direct emails and phone numbers" | leadbay_enrich_contacts(leadId, contactId) \u2014 ONE call per contact (the tool takes a single leadId + contactId, never a list) |
 If nothing in the menu applies cleanly, suggest only "pull next page" and "research a specific lead in depth" \u2014 never invent a tool that doesn't exist.
@@ -931,7 +932,7 @@ When \`bulk_qualify_leads\` returns, surface results in two parts.
 
 ## RENDERING \u2014 markdown table, three columns, score-bar driven
 
-Present the response as a markdown table sorted by \`score\` descending, with exactly three columns. Do not summarize in prose. Do not show the numeric score anywhere.
+Present the response as a markdown table **in the exact order the tool returned the leads** \u2014 this is the Discover-tab order (the backend orders by new-today first, then status, then score). Do **not** re-sort the rows (in particular, do NOT re-order by \`score\`); render them top-to-bottom as received so the list matches what the user sees in the Leadbay UI. Exactly three columns. Do not summarize in prose. Do not show the numeric score anywhere.
 
 ## Score-bar (10-segment, inline-code wrapped)
 
@@ -8540,8 +8541,9 @@ On \`preview\` (default \u2014 NOTHING created yet): show the lens that WILL be
 created (name + resolved sectors/sizes as chips) and ASK the user to confirm
 via ask_user_input_v0 ("Create this lens?" / "Change something"). Only on
 "yes" re-call with confirm:true. On \`created\`: confirm "Created **<name>**."
-On \`ambiguous_sectors\` / \`ambiguous_locations\`: surface the candidates to
-pick from.
+(if \`computing_wishlist:true\`, add that leads stream in \u2014 pull in ~30s, don't
+report "empty"). On \`ambiguous_sectors\` / \`ambiguous_locations\`: surface the
+candidates to pick from.
 
 ---
 
@@ -8555,6 +8557,8 @@ Create a brand-new lens (saved audience) and apply its sector/size criteria. Clo
 
 **Does not switch the active lens.** The new lens is created but the user stays on their current one. Offer \`leadbay_my_lenses(switchToLensId=<new id>)\` as a next step if they want to start pulling from it.
 
+**Leads compute asynchronously.** When the lens has criteria, applying the filter kicks off a backend wishlist rebuild \u2014 the \`created\` result carries \`computing_wishlist:true\`. An immediate \`leadbay_pull_leads\` may read empty for a few seconds while it computes; that lens is *warming up*, not empty. Wait ~30s before the first pull (or offer the user a re-pull). A criteria-less clone inherits the base lens's leads right away (\`computing_wishlist:false\`).
+
 WHEN TO USE: when the user wants a NEW lens. Canonical phrasings: "create a lens called X", "make a new audience for Y", "set up a lens for <sector>".
 
 WHEN NOT TO USE: to EDIT an existing lens \u2014 use \`leadbay_adjust_audience\` (pass \`lensName\` to target one by name). Not for listing/switching (\`leadbay_my_lenses\`) or topping up (\`leadbay_extend_lens\`).
@@ -8608,17 +8612,23 @@ User picks \u2192 call the matching \`Calls\` tool. Constraints: 2\u20134 mutual
 Pick the rows that fit. On \`created\`, the switch + pull rows are the natural
 follow-ups. On \`ambiguous_sectors\`, the only move is to pick a sector and re-call.
 
-| Observation                       | Suggest                                  | Calls                                                  |
-|-----------------------------------|------------------------------------------|--------------------------------------------------------|
-| \`preview\` (not yet created)       | "Yes, create this lens"                  | \`leadbay_new_lens(...same args..., confirm=true)\`      |
-| \`preview\` (not yet created)       | "Change the sectors/size first"          | (re-ask the user, then \`leadbay_new_lens\` with new args) |
-| Lens created                      | "Switch to it and pull leads"            | \`leadbay_my_lenses(switchToLensId=<new id>)\` then \`leadbay_pull_leads()\` |
-| Lens created                      | "Refine the audience further"            | \`leadbay_adjust_audience(lensName=<new name>, ...)\`    |
-| Lens created                      | "Leave it; keep my current lens active"  | (no call)                                              |
-| \`ambiguous_sectors\`               | "Pick the right sector and create"       | \`leadbay_new_lens(name=..., sectors=[<chosen id>])\`    |
-
-If nothing fits, default to "switch to the new lens and pull leads" \u2014 never
-invent a tool that doesn't exist.
+**\`created\` with \`computing_wishlist: true\`** \u2014 the new lens's leads are being
+(re)computed asynchronously. Do NOT fire an immediate \`leadbay_pull_leads\` and
+report "empty" \u2014 the lens is warming up, not empty. Tell the user the lens was
+created and its leads are streaming in, and offer to pull in ~30s.
+
+| Observation                             | Suggest                                  | Calls                                                  |
+|-----------------------------------------|------------------------------------------|--------------------------------------------------------|
+| \`preview\` (not yet created)             | "Yes, create this lens"                  | \`leadbay_new_lens(...same args..., confirm=true)\`      |
+| \`preview\` (not yet created)             | "Change the sectors/size first"          | (re-ask the user, then \`leadbay_new_lens\` with new args) |
+| Lens created, \`computing_wishlist=true\` | "Give it ~30s, then pull leads (the wishlist is still computing)" | \`leadbay_my_lenses(switchToLensId=<new id>)\` then \`leadbay_pull_leads()\` after ~30s |
+| Lens created (no criteria)              | "Switch to it and pull leads"            | \`leadbay_my_lenses(switchToLensId=<new id>)\` then \`leadbay_pull_leads()\` |
+| Lens created                            | "Refine the audience further"            | \`leadbay_adjust_audience(lensName=<new name>, ...)\`    |
+| Lens created                            | "Leave it; keep my current lens active"  | (no call)                                              |
+| \`ambiguous_sectors\`                     | "Pick the right sector and create"       | \`leadbay_new_lens(name=..., sectors=[<chosen id>])\`    |
+
+If nothing fits, default to "switch to the new lens and pull leads in ~30s
+(the wishlist may still be computing)" \u2014 never invent a tool that doesn't exist.
 `;
 var leadbay_open_billing_portal = `Generate a one-shot Stripe customer-portal URL. Wraps \`GET /1.6/stripe/portal\` \u2192 \`{url}\`. Returns a fresh Stripe-hosted URL the user can open to manage their existing Leadbay subscription: change plan tier, swap payment method, view invoices. The agent does NOT make subscription changes itself \u2014 it surfaces the URL and lets the user act.
 
@@ -9080,7 +9090,8 @@ Examples that should NOT invoke this tool (sound similar, route elsewhere):
 
 ## RENDER (quick)
 
-3-col markdown table sorted by \`score\` desc \u2014 DO NOT print the numeric
+3-col markdown table in the order the tool returns them (the Discover-tab
+order \u2014 do NOT re-sort by score) \u2014 DO NOT print the numeric
 score. Col 1 = inline-code 10-segment bar (\`\u25B0\` firmographic, \`\u2756\` AI
 booster cap at the right end of the filled run, \`\u25B1\` empty;
 filled=round(score/10), ai=round(avg_boost/3.3)) + \`<br>\` + linked
@@ -9107,7 +9118,7 @@ The active lens can change between calls (5-min cache + backend \`last_requested
 
 ## RENDERING \u2014 markdown table, three columns, score-bar driven
 
-Present the response as a markdown table sorted by \`score\` descending, with exactly three columns. Do not summarize in prose. Do not show the numeric score anywhere.
+Present the response as a markdown table **in the exact order the tool returned the leads** \u2014 this is the Discover-tab order (the backend orders by new-today first, then status, then score). Do **not** re-sort the rows (in particular, do NOT re-order by \`score\`); render them top-to-bottom as received so the list matches what the user sees in the Leadbay UI. Exactly three columns. Do not summarize in prose. Do not show the numeric score anywhere.
 
 ## Score-bar (10-segment, inline-code wrapped)
 
@@ -9213,6 +9224,7 @@ Pick 2\u20133 items below based on what was actually observed in the response. T
 | Top row has phone but no email                             | "Show [Contact]'s call details + a 60-second opener"         | leadbay_prepare_outreach(leadId)                       |
 | Top row has contacts but no phone/email                    | "Order contact enrichment to surface email/phone first"      | leadbay_enrich_titles(...) or leadbay_prepare_outreach(leadId, enrich:true) |
 | \`computing_scores == true\` or \`computing_wishlist == true\` | "Scores are still being computed \u2014 re-pull in ~30s"          | leadbay_pull_leads (retry with same lensId)            |
+| Batch is EMPTY and \`computing_wishlist\`/\`computing_scores == true\` (e.g. a just-created lens) | render the \`next_steps\` widget \u2014 it carries "Re-pull in ~30s" (first) + "Refine audience". Do NOT report "no leads": the lens is warming up, not empty | leadbay_pull_leads (retry with same lensId after ~30s) |
 | User wants a narrower / wider audience                     | "Adjust the lens filters (sector / size)"                    | leadbay_adjust_audience(...)                           |
 | Phase 4 research was run (\`research_lead_by_id\` called) AND top contacts lack direct email/phone | "Enrich contacts on [Lead1], [Lead2] to get direct emails and phone numbers" | leadbay_enrich_contacts(leadId, contactId) \u2014 ONE call per contact (the tool takes a single leadId + contactId, never a list) |
 If nothing in the menu applies cleanly, suggest only "pull next page" and "research a specific lead in depth" \u2014 never invent a tool that doesn't exist.
@@ -10517,12 +10529,12 @@ var login = {
   execute: async (client, params, ctx) => {
     const cleanPassword = params.password.replace(/\\(.)/g, "$1");
     const startWith = client.region === "fr" ? "fr" : "us";
-    ctx?.logger?.info?.(`LeadClaw login: email=${params.email} startRegion=${startWith}`);
+    ctx?.logger?.info?.(`Leadbay login: email=${params.email} startRegion=${startWith}`);
     try {
       const result = await resolveRegion(params.email, cleanPassword, startWith);
       if (client.baseUrl !== result.baseUrl) {
         client.setBaseUrl(result.baseUrl, result.region);
-        ctx?.logger?.info?.(`LeadClaw login: switched to region=${result.region} (account is in the ${result.region.toUpperCase()} backend)`);
+        ctx?.logger?.info?.(`Leadbay login: switched to region=${result.region} (account is in the ${result.region.toUpperCase()} backend)`);
       }
       client.setToken(result.token);
       client.prefetchOrgData().catch(() => {
@@ -10534,7 +10546,7 @@ var login = {
         verified: result.verified
       };
     } catch (err) {
-      ctx?.logger?.error?.(`LeadClaw login: failed: ${err?.message}`);
+      ctx?.logger?.error?.(`Leadbay login: failed: ${err?.message}`);
       return {
         error: true,
         code: "LOGIN_FAILED",
@@ -12421,7 +12433,7 @@ async function pollRecordsToTerminal(client, importId, budgetMs, expectedRowCoun
       }
     }
     if (!exhaustedPagination) {
-      throw client.makeError("IMPORT_PAGINATION_RUNAWAY", `Records pagination exceeded ${maxPagesPerPoll} pages`, `importId=${importId}. Please file a bug at https://github.com/leadbay/leadclaw/issues.`, `GET /imports/${importId}/records`);
+      throw client.makeError("IMPORT_PAGINATION_RUNAWAY", `Records pagination exceeded ${maxPagesPerPoll} pages`, `importId=${importId}. Please file a bug at https://github.com/leadbay/mcp/issues.`, `GET /imports/${importId}/records`);
     }
     const snapshot = { total, transient };
     const settled = transient === 0;
@@ -15151,9 +15163,27 @@ function summarise(responses) {
   return { answered, total, avg_qualification_boost: avg, best_response_excerpt: excerpt };
 }
 function buildPullLeadsNextSteps(args) {
-  const { leadCount, hasMore, nextPage } = args;
-  if (leadCount <= 0)
+  const { leadCount, hasMore, nextPage, computingWishlist, computingScores } = args;
+  if (leadCount <= 0) {
+    if (computingWishlist || computingScores) {
+      return {
+        question: "This lens is still warming up. What next?",
+        options: [
+          {
+            label: "Re-pull in ~30s",
+            description: "Leads are still being computed for this lens \u2014 wait ~30s, then pull again to see them.",
+            kind: "repull_computing"
+          },
+          {
+            label: "Refine audience",
+            description: "Adjust the lens audience / filters (sector, size, prompt) \u2014 useful if it's coming back sparse.",
+            kind: "refine_audience"
+          }
+        ]
+      };
+    }
     return null;
+  }
   const options = [];
   options.push({
     label: "Triage board",
@@ -15245,7 +15275,7 @@ var pullLeads = {
       },
       next_steps: {
         type: ["object", "null"],
-        description: "Ready-made NEXT STEPS for the host's choice widget. Each option has a SHORT `label` (\u22645 words, fits AskUserQuestion's label cap on Claude cowork/Claude Code) and a full `description`. For AskUserQuestion (cowork/Claude Code) pass each option as {label, description}. For ask_user_input_v0 (Claude chat/ChatGPT, string-only options) use the `description` as the option string. Use these VERBATIM, in order \u2014 do NOT re-derive, reword, or render as prose when a widget tool exists. options[0] is the artifact offer (build the lead triage board) whenever the batch is non-empty. null only when the batch is empty.",
+        description: "Ready-made NEXT STEPS for the host's choice widget. Each option has a SHORT `label` (\u22645 words, fits AskUserQuestion's label cap on Claude cowork/Claude Code) and a full `description`. For AskUserQuestion (cowork/Claude Code) pass each option as {label, description}. For ask_user_input_v0 (Claude chat/ChatGPT, string-only options) use the `description` as the option string. Use these VERBATIM, in order \u2014 do NOT re-derive, reword, or render as prose when a widget tool exists. options[0] is the artifact offer (build the lead triage board) whenever the batch is non-empty. When the batch is empty but the lens is still computing (computing_wishlist/computing_scores true), this carries a 'Re-pull in ~30s' option (kind:repull_computing) plus 'Refine audience' \u2014 render the widget so the user waits rather than seeing 'no leads.' null only when the batch is empty AND nothing is computing (a genuinely empty / over-narrow lens).",
         properties: {
           question: { type: "string" },
           options: {
@@ -15336,7 +15366,13 @@ var pullLeads = {
     const hasMore = currentPage < totalPages - 1;
     const nextPage = hasMore ? currentPage + 1 : null;
     const leadCount = res.items.length;
-    const nextSteps = buildPullLeadsNextSteps({ leadCount, hasMore, nextPage });
+    const nextSteps = buildPullLeadsNextSteps({
+      leadCount,
+      hasMore,
+      nextPage,
+      computingWishlist: res.computing_wishlist,
+      computingScores: res.computing_scores
+    });
     return withAgentMemoryMeta(client, {
       lens: { id: lensId },
       leads: res.items.map((lead) => ({
@@ -21610,6 +21646,10 @@ var newLens = {
         items: { type: "object" }
       },
       filter_applied: { type: "object", description: "On 'created': the FilterPayload POSTed to the new lens." },
+      computing_wishlist: {
+        type: "boolean",
+        description: "On 'created': true when the lens has criteria and its wishlist is (re)computing asynchronously \u2014 an immediate leadbay_pull_leads may read empty; wait ~30s. False for a criteria-less clone (it inherits the base lens's leads immediately)."
+      },
       message: { type: "string" },
       _meta: { type: "object" }
     },
@@ -21716,7 +21756,13 @@ var newLens = {
       status: "created",
       lens: { id: created.id, name: created.name },
       filter_applied: merged,
-      message: `Created "${created.name}".`,
+      // Applying the filter queued a backend wishlist refresh (#3833). The lens
+      // leads are (re)computed asynchronously, so an immediate pull_leads can
+      // read empty for a few seconds. Signal that here (flag-independent — the
+      // backend's own computing_wishlist can lag right after create) so the
+      // agent waits ~30s instead of reporting an empty lens.
+      computing_wishlist: hasCriteria,
+      message: hasCriteria ? `Created "${created.name}". Leads stream in asynchronously \u2014 call leadbay_pull_leads in ~30s to see them (an immediate pull may show an empty lens while the wishlist computes).` : `Created "${created.name}".`,
       _meta: { region: client.region }
     };
   }
@@ -22771,7 +22817,7 @@ function getCachedUpdateInfo() {
 function getInFlightCheck() {
   return inFlightCheck;
 }
-var RELEASES_LATEST_URL = "https://api.github.com/repos/leadbay/leadclaw/releases/latest";
+var RELEASES_LATEST_URL = "https://api.github.com/repos/leadbay/mcp/releases/latest";
 var CHECK_THROTTLE_MS = 24 * 60 * 60 * 1e3;
 var FETCH_TIMEOUT_MS = 5e3;
 var USER_AGENT = "leadbay-mcp-update-check";
@@ -23329,7 +23375,7 @@ function buildServer(client, opts = {}) {
   }
   const exposedNames = new Set(toolByName.keys());
   const server = new Server(
-    { name: "leadbay", version: opts.version ?? "0.0.0-dev" },
+    { name: "leadbay-mcp", version: opts.version ?? "0.0.0-dev" },
     {
       capabilities: {
         tools: {},
@@ -24016,7 +24062,7 @@ function parseWriteEnv(env = process.env) {
 }
 
 // src/http-server.ts
-var VERSION = true ? "0.23.9" : "0.0.0-dev";
+var VERSION = true ? "0.23.11" : "0.0.0-dev";
 var PORT = Number(process.env.PORT ?? 8080);
 var HOST = process.env.HOST ?? "0.0.0.0";
 var sseSessions = /* @__PURE__ */ new Map();
@@ -24058,6 +24104,24 @@ function applyCors(c) {
   c.header("Access-Control-Allow-Origin", "*");
   c.header("Access-Control-Expose-Headers", "WWW-Authenticate");
 }
+var DEFAULT_ALLOWED_ORIGINS = [
+  "https://claude.ai",
+  "https://claude.com",
+  "https://chatgpt.com"
+];
+function allowedOrigins() {
+  const extra = (process.env.LEADBAY_MCP_ALLOWED_ORIGINS ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+  return /* @__PURE__ */ new Set([...DEFAULT_ALLOWED_ORIGINS, ...extra]);
+}
+function rejectForeignOrigin(c) {
+  const origin = c.req.header("origin");
+  if (!origin) return null;
+  const allowed = allowedOrigins();
+  allowed.add(requestOrigin(c));
+  if (allowed.has(origin)) return null;
+  applyCors(c);
+  return c.json({ error: "forbidden origin" }, 403);
+}
 function servePrm(c, resourcePath) {
   applyCors(c);
   c.header("Cache-Control", "public, max-age=3600");
@@ -24096,6 +24160,8 @@ app.use("/mcp", MCP_BODY_LIMIT);
 app.use("/fr/mcp", MCP_BODY_LIMIT);
 app.use("/messages", MCP_BODY_LIMIT);
 async function handleStreamable(c, resourcePath) {
+  const foreign = rejectForeignOrigin(c);
+  if (foreign) return foreign;
   const token = extractBearer(c.req.header("authorization"));
   const resolved = await resolveClientFromToken(token);
   if (resolved.authState === "missing" || resolved.authState === "expired") {
@@ -24141,6 +24207,8 @@ async function handleStreamable(c, resourcePath) {
 app.all("/mcp", (c) => handleStreamable(c, "/mcp"));
 app.all("/fr/mcp", (c) => handleStreamable(c, "/fr/mcp"));
 async function handleSse(c, resourcePath) {
+  const foreign = rejectForeignOrigin(c);
+  if (foreign) return foreign;
   const token = extractBearer(c.req.header("authorization"));
   const resolved = await resolveClientFromToken(token);
   if (resolved.authState === "missing" || resolved.authState === "expired") {
@@ -24162,6 +24230,8 @@ async function handleSse(c, resourcePath) {
 app.get("/sse", (c) => handleSse(c, "/sse"));
 app.get("/fr/sse", (c) => handleSse(c, "/fr/sse"));
 app.post("/messages", async (c) => {
+  const foreign = rejectForeignOrigin(c);
+  if (foreign) return foreign;
   const sessionId = c.req.query("sessionId");
   if (!sessionId) {
     return c.json({ error: "missing sessionId" }, 400);

package/dist/installer-electron.js

@@ -867,6 +867,17 @@ function browserOpenCandidates(url) {
     { cmd: "xdg-open", args: [url] }
   ];
 }
+function windowsFallbackCandidates(url) {
+  const sysRoot = process.env.SystemRoot || process.env.windir || "C:\\Windows";
+  const psLiteral = `'${url.replace(/'/g, "''")}'`;
+  return [
+    { cmd: `${sysRoot}\\System32\\rundll32.exe`, args: ["url.dll,FileProtocolHandler", url] },
+    {
+      cmd: `${sysRoot}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`,
+      args: ["-NoProfile", "-NonInteractive", "-Command", "Start-Process", psLiteral]
+    }
+  ];
+}
 function browserLaunchEnv(debug) {
   const env = { ...process.env };
   if (process.platform !== "linux") return env;
@@ -931,7 +942,7 @@ function browserLaunchEnv(debug) {
   return env;
 }
 async function openInBrowser(url, debug) {
-  const candidates = browserOpenCandidates(url);
+  const candidates = process.platform === "win32" ? [...browserOpenCandidates(url), ...windowsFallbackCandidates(url)] : browserOpenCandidates(url);
   const launchEnv = browserLaunchEnv(debug);
   debug?.(
     `openInBrowser: platform=${process.platform} DISPLAY=${launchEnv.DISPLAY ?? "<unset>"} WAYLAND=${launchEnv.WAYLAND_DISPLAY ?? "<unset>"} DBUS=${launchEnv.DBUS_SESSION_BUS_ADDRESS ? "set" : "<unset>"} candidates=[${candidates.map((c) => c.cmd).join(", ")}]`
@@ -940,14 +951,43 @@ async function openInBrowser(url, debug) {
   for (const { cmd, args } of candidates) {
     try {
       await new Promise((resolve, reject) => {
-        const spawnOpts = { stdio: "ignore", detached: true, env: launchEnv };
-        if (process.platform === "win32") spawnOpts.windowsVerbatimArguments = true;
+        const isWin = process.platform === "win32";
+        const spawnOpts = { stdio: "ignore", detached: !isWin, env: launchEnv };
+        if (isWin) spawnOpts.windowsVerbatimArguments = true;
         const child = spawn3(cmd, args, spawnOpts);
         child.on("error", reject);
-        child.on("spawn", () => {
-          debug?.(`spawn OK: ${cmd} (pid=${child.pid})`);
+        if (!isWin) {
+          child.on("spawn", () => {
+            debug?.(`spawn OK: ${cmd} (pid=${child.pid})`);
+            child.unref();
+            resolve();
+          });
+          return;
+        }
+        const isCmd = /cmd(\.exe)?$/i.test(cmd);
+        const budgetMs = isCmd ? 800 : 1200;
+        let settled = false;
+        const finish = (fn) => {
+          if (settled) return;
+          settled = true;
+          fn();
+        };
+        const timer = setTimeout(() => {
+          debug?.(`exit-wait timeout (${budgetMs}ms): ${cmd} \u2014 assuming launched`);
           child.unref();
-          resolve();
+          finish(resolve);
+        }, budgetMs);
+        timer.unref?.();
+        child.on("spawn", () => debug?.(`spawn OK: ${cmd} (pid=${child.pid}) \u2014 awaiting exit`));
+        child.on("exit", (code) => {
+          clearTimeout(timer);
+          if (code === 0 || code === null) {
+            debug?.(`exit ${code}: ${cmd} \u2014 launched OK`);
+            finish(resolve);
+          } else {
+            debug?.(`exit ${code}: ${cmd} \u2014 treating as failed, next candidate`);
+            finish(() => reject(new Error(`${cmd} exited ${code}`)));
+          }
         });
       });
       return;
@@ -1764,7 +1804,7 @@ var init_installer_gui = __esm({
     init_install_dxt();
     init_install_shared();
     init_oauth();
-    VERSION = true ? "0.23.9" : "0.0.0-dev";
+    VERSION = true ? "0.23.11" : "0.0.0-dev";
     MESSAGES = {
       en: {
         installer: {

package/dist/installer-gui.js

@@ -853,6 +853,17 @@ function browserOpenCandidates(url) {
     { cmd: "xdg-open", args: [url] }
   ];
 }
+function windowsFallbackCandidates(url) {
+  const sysRoot = process.env.SystemRoot || process.env.windir || "C:\\Windows";
+  const psLiteral = `'${url.replace(/'/g, "''")}'`;
+  return [
+    { cmd: `${sysRoot}\\System32\\rundll32.exe`, args: ["url.dll,FileProtocolHandler", url] },
+    {
+      cmd: `${sysRoot}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`,
+      args: ["-NoProfile", "-NonInteractive", "-Command", "Start-Process", psLiteral]
+    }
+  ];
+}
 function browserLaunchEnv(debug) {
   const env = { ...process.env };
   if (process.platform !== "linux") return env;
@@ -917,7 +928,7 @@ function browserLaunchEnv(debug) {
   return env;
 }
 async function openInBrowser(url, debug) {
-  const candidates = browserOpenCandidates(url);
+  const candidates = process.platform === "win32" ? [...browserOpenCandidates(url), ...windowsFallbackCandidates(url)] : browserOpenCandidates(url);
   const launchEnv = browserLaunchEnv(debug);
   debug?.(
     `openInBrowser: platform=${process.platform} DISPLAY=${launchEnv.DISPLAY ?? "<unset>"} WAYLAND=${launchEnv.WAYLAND_DISPLAY ?? "<unset>"} DBUS=${launchEnv.DBUS_SESSION_BUS_ADDRESS ? "set" : "<unset>"} candidates=[${candidates.map((c) => c.cmd).join(", ")}]`
@@ -926,14 +937,43 @@ async function openInBrowser(url, debug) {
   for (const { cmd, args } of candidates) {
     try {
       await new Promise((resolve, reject) => {
-        const spawnOpts = { stdio: "ignore", detached: true, env: launchEnv };
-        if (process.platform === "win32") spawnOpts.windowsVerbatimArguments = true;
+        const isWin = process.platform === "win32";
+        const spawnOpts = { stdio: "ignore", detached: !isWin, env: launchEnv };
+        if (isWin) spawnOpts.windowsVerbatimArguments = true;
         const child = spawn3(cmd, args, spawnOpts);
         child.on("error", reject);
-        child.on("spawn", () => {
-          debug?.(`spawn OK: ${cmd} (pid=${child.pid})`);
+        if (!isWin) {
+          child.on("spawn", () => {
+            debug?.(`spawn OK: ${cmd} (pid=${child.pid})`);
+            child.unref();
+            resolve();
+          });
+          return;
+        }
+        const isCmd = /cmd(\.exe)?$/i.test(cmd);
+        const budgetMs = isCmd ? 800 : 1200;
+        let settled = false;
+        const finish = (fn) => {
+          if (settled) return;
+          settled = true;
+          fn();
+        };
+        const timer = setTimeout(() => {
+          debug?.(`exit-wait timeout (${budgetMs}ms): ${cmd} \u2014 assuming launched`);
           child.unref();
-          resolve();
+          finish(resolve);
+        }, budgetMs);
+        timer.unref?.();
+        child.on("spawn", () => debug?.(`spawn OK: ${cmd} (pid=${child.pid}) \u2014 awaiting exit`));
+        child.on("exit", (code) => {
+          clearTimeout(timer);
+          if (code === 0 || code === null) {
+            debug?.(`exit ${code}: ${cmd} \u2014 launched OK`);
+            finish(resolve);
+          } else {
+            debug?.(`exit ${code}: ${cmd} \u2014 treating as failed, next candidate`);
+            finish(() => reject(new Error(`${cmd} exited ${code}`)));
+          }
         });
       });
       return;
@@ -1027,7 +1067,7 @@ async function oauthLogin(opts) {
 }
 
 // installer/installer-gui.ts
-var VERSION = true ? "0.23.9" : "0.0.0-dev";
+var VERSION = true ? "0.23.11" : "0.0.0-dev";
 var MESSAGES = {
   en: {
     installer: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leadbay/mcp",
-  "version": "0.23.9",
+  "version": "0.23.11",
   "mcpName": "io.github.leadbay/leadbay-mcp",
   "description": "Model Context Protocol (MCP) server for Leadbay — AI lead discovery, qualification, and enrichment for Claude Desktop, Cursor, and Claude Code.",
   "type": "module",
@@ -61,13 +61,13 @@
   ],
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/leadbay/leadclaw.git",
+    "url": "git+https://github.com/leadbay/mcp.git",
     "directory": "packages/mcp"
   },
   "bugs": {
-    "url": "https://github.com/leadbay/leadclaw/issues"
+    "url": "https://github.com/leadbay/mcp/issues"
   },
-  "homepage": "https://github.com/leadbay/leadclaw/tree/main/packages/mcp#readme",
+  "homepage": "https://github.com/leadbay/mcp/tree/main/packages/mcp#readme",
   "author": "Leadbay",
   "license": "MIT"
 }