@leadbay/mcp 0.33.4 → 0.34.1

package/CHANGELOG.md

@@ -1,5 +1,93 @@
 # Changelog — @leadbay/mcp
 
+## 0.34.1 — 2026-09-07
+
+`leadbay_set_lead_status` threw `TypeError: (params.lead_ids ?? []).filter is
+not a function` five times in 29 s on the hosted route (product#4079, Sentry
+MCP-3T): a scheduled agent passed `lead_ids` as something other than an array.
+The same class hit `leadbay_new_lens` on 2026-08-04 (`texts.filter is not a
+function`, `locations` as a string, MCP-3B). Both times the agent retried the
+identical call four or five times, because a raw TypeError names no argument.
+
+The CallTool handler in `server.ts` never checked `inputSchema` before
+`tool.execute`; its own comment said enforcement was ours, and it only enforced
+`_triggered_by`. 32 tools declare a top-level `array` or `object` parameter and
+none of them defended against a string: four threw, two silently corrupted
+(`adjust_audience` spread `"tech"` into `["t","e","c","h"]`), the rest forwarded
+the string to the backend.
+
+One guard now runs before `execute`, after the `LAST_PROMPT_REQUIRED` check
+(`findShapeMismatch`): for each top-level schema property whose `type` is
+`array` or `object`, a present non-null argument of the wrong JSON shape returns
+`BAD_INPUT` naming the field, the expected shape and the received type
+(`lead_ids must be a JSON array (got string)`), through the same envelope branch
+a tool's own `BAD_INPUT` takes. So PostHog sees `ok:false error_code:BAD_INPUT`
+and Sentry groups the event with the tool's existing `BAD_INPUT` issue
+(`source:business`) instead of a `source:unexpected` stack fingerprint.
+
+Deliberately not done: no coercion of a bare string into a one-element array (a
+JSON-stringified array would become one bogus id and fail per lead inside
+`failed[]`); no scalar checks (hosts send `"20"` for a number and tools coerce);
+no `required`, `items`, nested or `additionalProperties` validation; no runtime
+dependency. `null` counts as absent. One visible change on an existing tool:
+`leadbay_report_outreach` with `verification` given as a string answered
+`VERIFICATION_REQUIRED`; it now answers `BAD_INPUT … must be a JSON object (got
+string)`. Tools executed directly outside the MCP server (OpenClaw consumes
+`@leadbay/core` without `buildServer`) keep the raw throw.
+
+Test: `packages/mcp/test/unit/input-shape-guard.test.ts` drives `tools/call`
+through `buildServer` with the incident shapes.
+
+## 0.34.0 — 2026-09-02
+
+The OpenAI app directory rejects an app that sells digital goods — "plugins may
+conduct commerce only for physical goods. Selling digital products or services
+— including subscriptions, digital content, tokens, or credits — is not
+allowed" — and separately forbids promoting the purchase: a plugin "must not
+display subscription plans, initiate new subscriptions, or promote upgrades" or
+"link directly to a checkout". Signing in to an existing paid account and using
+what it entitles you to IS allowed. Anthropic's Software Directory Policy has
+no equivalent clause; its nearest rule bars software that "executes financial
+transactions on behalf of users", which our Stripe-URL handoff does not do.
+
+`POST /chatgpt/mcp` is the URL submitted to OpenAI. Same Hono app, same auth,
+same handler, built with `includeCommerce: false`. Four things go away
+together — the tools, and every text that would promote buying them, since
+removing only the tools left the agent still pushing a top-up it could no
+longer produce:
+
+- `leadbay_create_topup_link` and `leadbay_open_billing_portal` are not
+  registered (filtered after the catalogue arrays merge — both appear in
+  `compositeReadTools` and `granularReadTools`).
+- Tool descriptions lose their `{{commerce}}` blocks
+  (`NO_COMMERCE_TOOL_DESCRIPTIONS`, emitted by promptforge).
+- The `QUOTA_TOPUP` instruction paragraph is not pushed. `quota-topup.md` was
+  split verbatim: the selling paragraph is gated, and the neutral one that says
+  when to re-render the quota gauge became `quota-refresh.md`, pushed on both.
+- `LeadbayClient.commerce` drops the two selling sentences from the
+  QUOTA_EXCEEDED hint ("OR top up AI credits…", "…or direct them to
+  app.leadbay.ai → Billing"). One client per session on hosted, so the flag
+  cannot leak across tenants.
+
+Nothing is reworded for ChatGPT. `{{commerce}}` only ever DELETES — there is no
+second, softened wording anywhere to drift out of sync, and the Claude surface
+keeps selling exactly as hard as before. Enforced two ways:
+`commerce-gate.test.ts` asserts the gated description and instruction strings
+are pure character-level *subsequences* of the Claude ones (any reworded
+character fails), and the generated descriptions were diffed against `main` to
+confirm the default rendering did not move by a byte.
+
+A path rather than an `initialize` clientInfo sniff, and rather than a query
+parameter: the OAuth protected-resource identifier IS the path
+(`/.well-known/oauth-protected-resource/chatgpt/mcp` → `resource:
+https://mcp.leadbay.app/chatgpt/mcp`). A `?commerce=off` flag would leave both
+URLs advertising the same resource, so a client reconnecting to the audience it
+registered would get the selling tools back. RFC 8707 also says a resource URI
+should carry no query component.
+
+`RESOURCE_PATHS` gains the path so OAuth discovery resolves for it, and the
+installer's ChatGPT Desktop entry now hands out `HOSTED_MCP_URL_CHATGPT`.
+
 ## 0.33.4 — 2026-09-02
 
 `leadbay_enrich_contacts` moves from `granularWriteTools` to