@omnisocials/mcp-server 1.35.0 → 1.46.0

package/README.md

@@ -9,7 +9,7 @@ MCP (Model Context Protocol) server for the [OmniSocials](https://omnisocials.co
 
 ## Remote MCP URL (no install)
 
-For clients that support remote MCP over HTTP (claude.ai, ChatGPT, Notion, OpenClaw):
+For clients that support remote MCP over HTTP (claude.ai, ChatGPT, Notion, Muse, OpenClaw):
 
 ```
 https://mcp.omnisocials.com?API_KEY=omsk_live_your_key_here
@@ -112,10 +112,12 @@ OmniSocials accepts the following channel IDs in `create_post`, `create_and_publ
 | `threads` | Threads | Posts, chained threads via `threads.thread_parts`, location tagging via `threads.location_id` (rolling out) |
 | `bluesky` | Bluesky | Posts, chained threads via `bluesky.thread_parts` |
 | `mastodon` | Mastodon | Posts, chained threads via `mastodon.thread_parts` |
+| `telegram` | Telegram | A channel or group the OmniSocials bot posts to: text, photos, videos, GIFs, albums of up to 10, native polls and link buttons via `telegram` |
+| `discord` | Discord | One Discord channel, posted through its webhook: text, up to 10 images, GIFs and videos, native polls, link buttons and forum post titles via `discord` |
 
 ## Available Tools
 
-### Posts (13 tools)
+### Posts (15 tools)
 
 | Tool | Description |
 |------|-------------|
@@ -130,7 +132,9 @@ OmniSocials accepts the following channel IDs in `create_post`, `create_and_publ
 | `list_approval_workflows` | List the workspace's approval workflows (steps + approvers); pass an id as `approval_workflow_id` on `create_post` to hold the post for review |
 | `approve_post` | Approve the current step of a post's approval workflow (the connected user must be a listed approver for that step) |
 | `reject_post` | Reject a post's approval workflow, stopping it immediately |
+| `get_post_approval` | Read the approval review of a post: steps, approvers and their decisions, the rejection reason and the comment thread |
 | `search_locations` | Find an Instagram or Threads location to tag (Instagram place IDs for `location_id`, Threads location ids for `threads.location_id`; Threads also searches by latitude/longitude) |
+| `list_pinterest_products` | List the product Pins of the connected Pinterest account (catalog or own Pins), or check one Pin, to tag products with `pinterest.product_tags` |
 | `search_instagram_audio` | Search Instagram's licensed music catalog for a track to attach to a Reel |
 
 ### Media & folders (6 tools)
@@ -178,12 +182,12 @@ Apply a set when creating a post: `create_post` / `create_and_publish_post` acce
 | `list_workspaces` | List all workspaces available in this session |
 | `switch_workspace` | Switch the active workspace **by name** (id or list number also accepted) |
 
-### Webhooks (5 tools)
+### Webhooks (6 tools)
 
 | Tool | Description |
 |------|-------------|
 | `list_webhooks` | List all webhooks |
-| `create_webhook` | Create a webhook for event notifications |
+| `create_webhook` | Create a webhook for event notifications (`post.scheduled`, `post.published`, `post.failed`, `post.approved`, `post.rejected`) |
 | `get_webhook` | Get webhook details |
 | `update_webhook` | Update a webhook |
 | `delete_webhook` | Delete a webhook |
@@ -194,21 +198,34 @@ Apply a set when creating a post: `create_post` / `create_and_publish_post` acce
 | Tool | Description |
 |------|-------------|
 | `list_inbox_conversations` | List conversations: Instagram/Facebook DMs, comments, mentions, LinkedIn company-page comments/mentions, TikTok video comments, YouTube video comments, X DMs (opt-in), and Threads replies on your posts plus mentions; filter by platform, type, unread, or `unanswered` |
-| `get_next_unanswered` | The next item that still needs an answer (longest-waiting first) with the whole thread and the post it is on; filter by platform or type, `include_read`, `exclude` |
+| `get_next_unanswered` | The next item that still needs an answer (DMs that can still be answered first, then expired Instagram/Facebook DMs, then comments and mentions oldest first) with the whole thread, the post it is on and its `reply_window`; filter by platform or type, `include_read`, `exclude` |
 | `get_inbox_conversation` | Get a conversation's full message history with the post it belongs to; every message shows its `#id` |
 | `mark_inbox_read` | Mark all incoming messages in a conversation as read (also the durable skip for `get_next_unanswered`) |
-| `reply_to_inbox` | Reply to a DM, comment, or mention (existing conversations only); `include_next` returns the next unanswered item in the same call |
+| `reply_to_inbox` | Reply to a DM, comment, or mention (existing conversations only); `message_id` picks the comment being answered; `include_next` returns the next unanswered item in the same call |
 | `hide_inbox_comment` | Hide or unhide a comment on one of your posts (Facebook, Instagram, TikTok, YouTube, Threads) |
 | `delete_inbox_comment` | Permanently delete a comment on one of your posts, with the replies under it (Facebook, Instagram, TikTok) |
 | `hide_inbox_reply` | Older name for `hide_inbox_comment`, kept for compatibility |
 
 Requires an API key with the opt-in `inbox:read` / `inbox:write` scopes — enable "Social Inbox access" when you create the key.
 
+### Automations (6 tools)
+
+| Tool | Description |
+|------|-------------|
+| `list_automations` | List the comment-to-DM automations of the workspace (Instagram and Facebook Page), optionally by `status`, `post_id` or `platform` |
+| `get_automation` | Get one automation: trigger, keywords, DM text, public reply, limits and stats |
+| `create_automation` | Create a comment-to-DM automation: a keyword in a comment (or a DM) gets a DM back, once per person, with an optional public reply |
+| `update_automation` | Pause, resume or change the keywords, DM text, public reply, limits or post of an automation |
+| `delete_automation` | Delete an automation |
+| `get_automation_activity` | One row per comment or message the automation acted on: the DM sent, a skip with its reason, or the platform's error |
+
+Requires an API key with the opt-in `automations:read` / `automations:write` scopes (Settings > API, "Automations" on the key).
+
 ## Environment Variables
 
 | Variable | Required | Description |
 |----------|----------|-------------|
-| `OMNISOCIALS_API_KEY` | Yes | Your API key (`omsk_live_*` or `omsk_test_*`). Comma-separated for multiple workspaces. |
+| `OMNISOCIALS_API_KEY` | Yes | Your API key (`omsk_live_*`; there are no test keys). Comma-separated for multiple workspaces. |
 | `OMNISOCIALS_BASE_URL` | No | Custom API base URL (defaults to production) |
 
 ## Alternative: Agent Skills
@@ -227,6 +244,87 @@ Full API docs: [docs.omnisocials.com](https://docs.omnisocials.com)
 
 ## Changelog
 
+### 1.46.0 (2026-10-23)
+
+- **Added: comment-to-DM on a Facebook Page.** The automation tools now run on the connected Facebook Page as well as on Instagram. `create_automation` takes `platform` (`instagram`, the default, or `facebook`) and `facebook_post_id` (a Page post published outside OmniSocials, `{page-id}_{post-id}` or the post id alone; it implies `facebook`). On Facebook the DM lands in Messenger, `triggers` takes `comment` and `dm` (a keyword in a Messenger message to the Page), and `story_reply` is refused (Facebook has no story replies). Meta's rules are the same on both: one private reply per comment within 7 days, a follow-up only after the person answers. `list_automations` takes a `platform` filter and shows a Platform column; `get_automation` and `create_automation` print the platform. `update_automation` takes `facebook_post_id` to move a Facebook automation to another Page post; the platform itself cannot change (`platform_immutable`). `get_automation_activity` shows a Facebook person by name, without an @. Same on the companion server (`mcp.omnisocials.com`).
+- **Added: `platforms` on `comment_dm_automation`.** `create_post`, `create_and_publish_post` and `update_post` take `comment_dm_automation.platforms`: `["instagram"]`, `["facebook"]` or both, one automation per channel with the same keywords, DM, public reply and limits. Each listed channel must be a channel of the post. Without it, the post gets one automation: Instagram when the post goes there, else Facebook. On `update_post` a channel no longer listed loses its automation, and `null` removes them all. The post shows every automation id with its channel; `get_post` shows them for a post that goes to Instagram or Facebook.
+- **Added: Discord.** `discord` is a new channel ID: one Discord channel the user connected in OmniSocials (with Continue with Discord, or by pasting a webhook URL). The post is sent through the channel's webhook, so it shows the webhook's name and picture. `create_post`, `create_and_publish_post` and `update_post` take a `discord` object: `silent` (no notification), `link_preview` (`false` hides the link previews), `allow_mentions` (off by default: @everyone, @here and role mentions in the text ping nobody until it is `true`), `spoiler`, `thread_name` (the post title in a forum or media channel, where Discord requires one; max 100 chars), up to 5 `buttons` (`{ text, url }`, labels up to 80 chars, not with a poll) and a native `poll` (`{ options: 2-10 of up to 55 chars, duration_hours: 1-768 (default 24), multiple }`; the post text is the question, max 300 chars; no media). Text up to 2,000 characters; up to 10 images, GIFs and videos per message, which may mix; a video or GIF over Discord's 20 MB file limit is sent as a link in the message (listed in `result.video_links`); no Stories; a Reel is sent as one video message. On `update_post` every key merges into the stored options and `null` removes it. `get_post` prints the options and, once sent, the link to the message. `list_accounts` and `get_account` show the server, the channel name and type (`platform_details.channel_name` and `channel_type`: read by the OmniSocials bot, which Continue with Discord adds with no permissions, or given by the person when connecting), the webhook name, the channel id, how it was connected and the channel link; with the bot in the server, `get_account_analytics` shows the member count as followers. Discord gives webhooks no view counts: `get_post_analytics` shows the reactions (total and per emoji) and the poll votes. Same on the companion server (`mcp.omnisocials.com`), whose version is 1.46.0 too.
+
+### 1.45.0 (not published; included in 1.46.0)
+
+- **Added: a link to the post on every post tool.** `publish_post`, `retry_post`, `approve_post` and `reject_post` now end with the "Open in OmniSocials" row that `create_post`, `create_and_publish_post`, `get_post` and `update_post` already had, and `publish_post` says that `get_post` lists the live links once each platform has posted. Every app link carries `?ref=mcp`, so OmniSocials can count the visits from an agent's answer (the app ignores the parameter).
+- **Added on the companion server (`mcp.omnisocials.com`): the post card.** In apps that show MCP Apps (Claude, ChatGPT, Cursor, VS Code), the results of `get_post`, `create_post`, `create_and_publish_post`, `update_post`, `publish_post`, `retry_post`, `approve_post` and `reject_post` appear as a card: the post the way each platform will show it, a channel list with each channel's state (the planned time, Posting, Posted with its live link, or Failed with the reason), and a link into OmniSocials. While a post publishes, the card follows it until every channel is done. Other clients (terminal agents, automations) get the same text answer as before. The card is built as an MCP App resource, `ui://omnisocials/post-card.html`; a new tool, `get_post_status`, is only for the card (hidden from the model in apps that support MCP Apps).
+
+### 1.44.0 (2026-10-17, not published; included in 1.46.0)
+
+- **Added: Telegram.** `telegram` is a new channel ID: a Telegram channel or group the user connected in OmniSocials, where the OmniSocials bot is an admin that can post. `create_post`, `create_and_publish_post` and `update_post` take a `telegram` object: `silent`, `link_preview`, `pin`, `protect_content`, `spoiler`, `caption_above_media`, up to 3 `buttons` (`{ text, url }`, one per row, not on an album or a poll), a native `poll` (`{ options: 2-12 of up to 100 chars, open_period: 5-2628000 seconds, multiple }`; the post text is the question, max 300 chars; no media) and `first_comment` (a reply under the post). Text up to 4,096 characters; with media, text over 1,024 characters is sent as a reply under the media. Albums hold up to 10 photos and videos; a GIF goes on its own; files up to 50 MB; no Stories; a Reel is sent as a video message. On `update_post` every key merges into the stored options and `null` removes it. `get_post` prints the options and, once sent, the message count, the pin and the link. `list_accounts` and `get_account` show the chat type, the subscribers and the link. Telegram gives bots no view counts: `get_post_analytics` shows the reactions (total and per emoji) and the poll votes. Same on the companion server (`mcp.omnisocials.com`).
+- **Changed: the three version strings match again.** `package.json`, the stdio server and the companion server all say 1.44.0 (the stdio server said 1.42.0 and the companion server 1.41.0 after the last releases).
+
+### 1.43.0 (2026-10-12, not published; included in 1.46.0)
+
+- **Polls on X, Threads and Mastodon.** `create_post`, `create_and_publish_post` and `update_post` take `poll` under `x`, `threads` and `mastodon` (the post text is the question): X `{ options: 2-4 of up to 25 chars, duration_minutes: 5-10080 }`, Threads `{ options: 2-4 of 1-25 chars }` (closed by Threads after 24 hours), Mastodon `{ options, expires_in, multiple, hide_totals }` within the instance's limits. The API refuses a channel with a poll and media; on a thread the poll goes on the first part. `null` on `update_post` removes it. `get_post` prints the poll per channel.
+
+### 1.42.0 (not published; included in 1.46.0)
+
+- **Added: comment-to-DM automations.** Six new tools manage the Instagram comment-to-DM automations of the workspace: `list_automations`, `get_automation`, `create_automation`, `update_automation` (pause, resume, new keywords, new DM text, new limits, another post), `delete_automation` and `get_automation_activity` (one row per comment or message the automation acted on: the DM sent, a skip with its reason, or Instagram's error). An automation DMs a person once when they comment a keyword on a post, and can post a public reply under the comment; `triggers` also takes `dm` (a keyword in a DM to the account) and `story_reply` (a keyword in a reply to a story). `scope` is one post (`post_id` = an OmniSocials post, scheduled or live; `instagram_media_id` = a post published outside OmniSocials, read from Instagram to check it belongs to the account), `next_post` (the next Instagram post the workspace publishes) or `any` (every post). Backed by the new `/automations` endpoints, which need the opt-in API key scopes `automations:read` and `automations:write` (Settings > API, "Automations" on the key); the tools say so on a 403. Same on the companion server (`mcp.omnisocials.com`), where the OAuth session needs the `create_schedule_post` permission for the writes.
+- **Added: `comment_dm_automation` on `create_post`, `create_and_publish_post` and `update_post`.** A comment-to-DM automation bound to the new post (Instagram must be a channel): `{ trigger: { keywords, match }, actions: { dm: { text }, public_reply: { enabled, variations } }, limits: { max_sends, stop_at } }`. The automation starts listening once the post is live on Instagram. On `update_post` the object replaces the post's automation and `null` removes it. The created automation comes back as `comment_dm_automation` on the post, and `get_post` shows it for a post that goes to Instagram. Same on the companion server.
+
+### 1.41.0 (not published; included in 1.46.0)
+
+- **Added: image fit per channel (`media_fit`).** A feed image whose ratio is outside what a channel shows uncropped is handled per channel at create time. Instagram shows feed images between 4:5 and 1.91:1: a 9:16 (story-style) or very wide image posted to the Instagram feed is now cropped to 4:5 / 1.91:1 around the subject by default, because Instagram cut it to that window anyway (a blind centre crop) and Meta cannot boost a feed post outside it. Pinterest keeps a Pin taller than 2:3 and reports it. `create_post`, `create_and_publish_post` and `update_post` take `media_fit: { instagram: "auto" | "crop" | "keep", pinterest: ... }`; every decision comes back as a `warnings` entry with code `image_fit` (`action` cropped / kept / crop_failed, the crop's url, and how to undo it). The crop is a separate file for that channel only; `default` and the other channels keep the original; stories, reels and videos are never cropped. On `update_post`, `media_fit` alone re-decides the stored images (`keep` gives the original back). Same on the companion server (`mcp.omnisocials.com`).
+- **Changed: `check_media_compatibility` reports image fit.** For an image whose size is known (a library file of the workspace) the answer lists, per connected channel with a rule, whether its feed shows the image uncropped and what a post does by default, so an assistant can ask "crop to 4:5 or keep the original?" before it posts. Media items (`list_media`, `get_media`, uploads) now carry `width` and `height`.
+
+### 1.40.0 (not published; included in 1.46.0)
+
+- **Changed: the MCP SDK dependency moves to 1.32.1.** GHSA-6qxp-vccf-f47h (CVE-2026-104850) is in the SDK's OAuth client, which let an MCP server name the authorization server that received the client's credentials. This package is a server and talks to OmniSocials with an API key, so it was not affected; the move clears the advisory for everyone who installs it.
+
+### 1.39.1 (2026-10-06, not published; included in 1.46.0)
+
+- **Changed: `list_pinterest_products` names an account without a catalog.** Pinterest answers HTTP 409 ("Can't access this feature without an existing catalog") when the connection has catalog access but the account has no catalog yet. The API now returns `no_catalog: true` with empty `products` and `product_groups` instead of a `platform_error`, and the tool says where the user adds products (https://www.pinterest.com/business/catalogs/). Seen live on 2026-10-06, the first day of the feature.
+
+### 1.39.0 (2026-10-05)
+
+- **Added: tag products on a Pinterest Pin.** `pinterest.product_tags` on `create_post`, `create_and_publish_post` and `update_post` takes up to 24 product Pins of the connected Pinterest account (Pin IDs or Pin links), so people can shop the items in the image. Pinterest accepts a product only when its Pin is public, belongs to the same account and links to a website that account claimed; products of other merchants cannot be tagged. The tags are added right after the Pin is published. A product that Pinterest refuses never fails the post: the other products are still tagged, and `get_post` shows the outcome (`product_tags_result`, with Pinterest's reason for each product that was not tagged).
+- **Added: `list_pinterest_products`.** New tool that lists the product Pins of the connected Pinterest account, with the `pin_id` to use in `pinterest.product_tags`. `source` `catalog` reads the Pinterest catalog (price and stock included) and needs catalog access, which the user gives one time in the OmniSocials composer (Pinterest options, Add products, Connect catalog). `source` `pins` reads the account's own Pins and works on every connection. `check_pin` checks one Pin ID or Pin link instead of listing.
+
+### 1.38.0 (2026-10-02)
+
+- **Added: read the approval review of a post.** New tool `get_post_approval` returns the review of a post that went through an approval workflow: every step with its approvers and their decisions, the rejection (who, when and the reason) and the comment thread, oldest first. Until now the tools only gave the status, so an assistant saw `rejected` and not who rejected the post or why. Use it on a rejected post to learn what to change before sending it again, or on a post that waits for approval to see who it waits for and what the reviewers wrote. Read-only. A post without an approval workflow returns status `none`. Backed by `GET /posts/{id}/approval` (scope `posts:read`). Same on the companion server (`mcp.omnisocials.com`).
+- **Added: webhook events `post.approved` and `post.rejected`.** `create_webhook` and `update_webhook` take them next to `post.scheduled`, `post.published` and `post.failed`. `post.approved` fires when the last step of a post's approval workflow is approved (the post moves to `scheduled`, or `posting` when its publish time already passed). `post.rejected` fires when an approver rejects the post (it will not publish). Both carry one more object, `data.approval`: `{ status, decided_by, reason }` (`reason` is `null` on an approval and when the approver gave none), and their `targets` array is empty. Same on the companion server.
+- **Changed: more approval emails.** A rejection, a reviewer comment, a reviewer edit and the final approval now email the person who requested the approval, and the requester's reply in the review thread emails the reviewers. A post that still waits for approval gets automatic emails near its publish time: the reviewers 24 hours before, and the reviewers plus the requester when the time passes (the post did not publish; a late approval publishes it at once). No tool input or output changed for this.
+- **Changed: X link-post credits count only `http://` and `https://` links.** A post that names a website without a scheme (`brand.com`, `www.brand.com`) no longer uses credits and no longer returns the `x_url_post_credits` warning, because X does not bill it as a link post. A post with a full link still uses 20 credits. The descriptions of `create_post` and `create_and_publish_post` say which links count. Same on the companion server.
+
+### 1.37.1 (2026-09-30)
+
+- **Changed: Facebook Reels longer than 90 seconds are accepted.** The API no longer refuses a Facebook Reel over 90 seconds at submit: a Reel now follows the 240 minute ceiling of a Facebook feed video. Meta removed the Reel length limit in June 2025 (every Facebook video is a reel now), while its Reels Publishing API guide still lists 3 to 90 seconds. A 3 minute Reel published through the API on 2026-09-30, and Reels of 91 to 117 seconds published before the cap existed. The `create_post` and `create_and_publish_post` descriptions no longer tell the assistant to keep a Facebook Reel under 90 seconds. If Facebook refuses a length at publish time, the Facebook target fails with "Facebook did not accept the length of this video..." and the video can go out as a regular Facebook post (`type: "post"`). Same on the companion server.
+- **Changed: `video_cover` on YouTube Shorts is described as channel-dependent.** YouTube shows the cover on Shorts only on channels where it has enabled custom Shorts thumbnails (rolling out since July 2026, Partner Program channels first); on other channels it stores the cover as the default thumbnail but shows a frame from the video (checked on 15 published Shorts from 5 channels: 3 channels show it, 1 does not). The `video_cover` and `youtube` descriptions now say so, so the assistant says it depends on the channel instead of promising it. The image is now sent at up to 1080 x 1920, YouTube's Shorts thumbnail size. Same on the companion server.
+- **Companion server: `video_cover` added.** The hosted server now accepts `video_cover` on `create_post`, `create_and_publish_post` and `update_post` (`null` removes it), takes `facebook.thumbnail_type` / `thumb_offset` / `cover_url`, and lists the cover under Platform Options in `get_post`. This package has had them since 1.35.0.
+
+### 1.37.0 (2026-09-28)
+
+- **Added: the original PDF is kept, and LinkedIn receives it.** `upload_media` (url, base64 and the `upload_url` snippet) still splits a PDF into one image slide per page (max 20) and now also keeps the original file. When a LinkedIn post's `media_ids` are exactly that PDF's slides, in order and unchanged, LinkedIn receives the original file as the document: text stays sharp, in-document links work, viewers download the real file, and every page is included even past the 20-slide cap. The upload result names the kept file (`pdf.id`, `pdf.name`, `pdf.url`, `pdf.size_bytes`), the tool output says so, and every slide returned by `list_media` / `get_media` carries `pdf: { id, name, url, page, total_pages, rendered_pages }`. Same on the companion server (`mcp.omnisocials.com`).
+- **Added: `pdf_mode` on `upload_media`.** `"slides"` (default) keeps one image media item per page, one Media ID each. `"document"` keeps the PDF as ONE media item (`type: "document"`, its page images in `pdf.pages`); pass its single Media ID in `media_ids` and the post gets every page, in order. The tool output explains which shape came back, and `list_media` shows document items as "Document (PDF, N pages)". Same on the companion server (`mcp.omnisocials.com`), where the `upload_url` snippet takes it as a form field (`-F pdf_mode=document`).
+- **Added: `document_source` on the `linkedin` / `linkedin_page` options** of `create_post`, `create_and_publish_post` and `update_post`. `"original_pdf"` (default) sends the kept original when the images are its unchanged pages; `"slides"` rebuilds the document from the slide images instead (a flattened copy). On `update_post`: `"slides"` sets it, `"original_pdf"`/`null` reverts, omitted keeps the current value. `get_post` prints "document source: rebuilt from the slide images" when a channel opted out. Ignored when the images are not a PDF's pages, when `carousel_as_images` is true, and for 0-1 images, videos and polls. Same on the companion server.
+
+### 1.36.0 (2026-09-24)
+
+- **Added: `reply_to_inbox` takes `message_id`.** Every comment on a post shares one inbox conversation, and the reply endpoint always answered the newest incoming comment on that post, so a reply drafted for one person could land under a different person's comment. Pass `message_id` (the "Message to answer" `#id` from `get_next_unanswered`, or a `#id` from `get_inbox_conversation`) and the reply goes under exactly that comment. Without it the old behaviour is kept for compatibility (newest comment). Ignored for DMs. A `404 not_found` means the id is not an incoming message of that conversation. The tool description and the `get_next_unanswered` output tell the assistant to always pass it for comments. Same on the companion server (`mcp.omnisocials.com`).
+- **Changed: `get_next_unanswered` serves DMs first and no longer drops expired ones.** A customer's Facebook DM ("How do I buy and where please") was never served: DMs older than 24 hours were filtered out and the queue was oldest-first across everything, so a fresh DM sat behind a three-week comment backlog until Meta's reply window closed. The order is now: Instagram/Facebook DMs inside Meta's 24-hour window (the one closing soonest first) and X DMs, then Instagram/Facebook DMs whose window has closed, then comments and mentions oldest first (`order: "newest"` reverses within each group). Each item carries `reply_window: { open, closes_at }` (only Instagram/Facebook DMs have a window; everything else is `open: true, closes_at: null`). When `open` is false the tool prints a warning that OmniSocials cannot reply and that the user must answer from the Instagram or Facebook app (mirrored into the inbox) or skip with `mark_inbox_read`. `list_inbox_conversations` with `unanswered: true` now includes those expired DM conversations too. Same on the companion server.
+- **Changed: `reply_to_inbox` checks the 24-hour window before sending.** A `422 outside_messaging_window` on an Instagram/Facebook DM is now raised before the platform call (it was only mapped from Meta's error afterwards). Nothing is sent, the message names when the window closed, and the tool description tells the assistant not to retry. Same on the companion server.
+- **Changed: `hide_inbox_comment` explains a 502 `hide_not_applied`.** After an Instagram hide or unhide the API reads the comment back and reports Instagram's own `hidden` state. When Instagram accepted the call but the comment is still in the old state, the API answers 502 `hide_not_applied` and the inbox row is left unchanged (a hide had been reported as done while the comment stayed public). This happens with comments Instagram shows under "Comments from Facebook" on a reel that is also shared to Facebook: they live on Facebook and Instagram's hide does not reach them. The tool description tells the assistant to have the user hide it in the Instagram or Facebook app and not retry. Same on the companion server.
+- **Changed: Facebook `reach` is absent, never 0, in `get_post_analytics` and `get_bulk_post_analytics`.** Meta retired Facebook post reach on 2026-06-15 and the replacement metric it documents (`post_total_media_view_unique`) returns 0 for every Page post while views and clicks keep counting, so the API had stored and returned a false 0 for every Facebook post. The key is now left out, and a row collected before 2026-09-27 that still carries `reach: 0` is dropped by the API. The tool description tells the assistant to treat a missing `reach` as "not reported" and to sum reach only over the platforms that carry it (Instagram, LinkedIn, TikTok with the Business API). Same on the companion server (`mcp.omnisocials.com`).
+
+### 1.35.1 (2026-09-22)
+
+- **Changed: `reply_to_inbox` explains a 422 `reply_not_allowed`.** The API answers 422 instead of 502 when the platform refuses replies to an item for good (Facebook `#1705`: comment on a share or boosted copy of the post, or the commenter restricts replies; YouTube: the thread's `canReply` is false). The item is dropped from `get_next_unanswered` automatically; relay it, do not retry.
+- **Changed: `hide_inbox_comment` explains a 422 `cannot_hide`.** Facebook does not let the Page hide some comments (the commenter blocked the Page, their account is deactivated or restricted, or the comment sits on a shared copy of the post); the API now reads the comment back and answers 422 when Facebook's `can_hide` is false, instead of a 502 on every attempt. Retrying never changes it; use `mark_inbox_read` if the item should stop coming up.
+
+### 1.35.0 (2026-09-17)
+
+- **Added: video covers.** `create_post`, `create_and_publish_post` and `update_post` accept `video_cover` for a post whose media is one video: `type: "frame"` with `thumb_offset` (milliseconds into the video) or `type: "custom"` with `cover_url` (JPEG/PNG), plus per-platform `overrides` keyed by platform id (instagram, facebook, linkedin, linkedin_page, tiktok, pinterest, youtube). On `update_post`, `video_cover: null` removes the stored cover. `get_post` shows the cover in use.
+- **Changed: analytics say "not reported" instead of 0.** Metrics a platform never reports at post level (reach on X, saves on Facebook, link clicks on Instagram feed posts, and so on) render as N/A with the reason, and `reach` is null when the platform did not report it, so a zero is never invented.
+- **Changed: `reply_to_inbox` explains a 409 `duplicate_reply`.** The API now refuses the same reply (same text and attachment) sent twice to one comment, or to one DM conversation, within 10 minutes; the tool description tells the assistant that nothing was sent again and to continue with `get_next_unanswered` rather than resend. Guards against a re-invoked tool call after a slow response (a customer's Instagram comment got the identical reply twice, 21 seconds apart).
+
 ### 1.34.1 (2026-09-14)
 
 - **Changed: Threads threads and the Threads inbox are no longer "rolling out".** Meta approved the reply, read-replies and mentions permissions, so `threads.thread_parts` and the Threads inbox work for every Threads connection; accounts connected before 2026-09-14 need a one-time reconnect under Settings -> Organisation -> Workspaces (`400`/`401` errors name the reconnect). Threads location tagging stays rolling out (not approved yet). Same on the companion server.
@@ -320,7 +418,7 @@ Full API docs: [docs.omnisocials.com](https://docs.omnisocials.com)
 ### 1.16.0
 
 - **Hashtag sets:** save reusable, named groups of hashtags per workspace and apply one to a new post in a single call. Four new tools: `list_hashtag_sets`, `create_hashtag_set`, `update_hashtag_set`, `delete_hashtag_set`.
-- `create_post` / `create_and_publish_post` accept `hashtag_set`, `hashtag_placement` (`caption_append` default, or `first_comment`), and `hashtag_platforms`. The set expands server-side once at create time — editing a set later never changes existing posts; duplicate tags are skipped; Instagram's 30-hashtag cap fails fast with `hashtag_limit_exceeded`.
+- `create_post` / `create_and_publish_post` accept `hashtag_set`, `hashtag_placement` (`caption_append` default, or `first_comment`), and `hashtag_platforms`. The set expands server-side once at create time — editing a set later never changes existing posts; duplicate tags are skipped; Instagram's 5-hashtag cap fails fast with `hashtag_limit_exceeded`.
 - Same tools on the companion server (`mcp.omnisocials.com`).
 
 ### 1.15.0

package/build/client.d.ts

@@ -1,4 +1,4 @@
-import type { Account, AnalyticsOverview, AccountAnalyticsEntry, ApiPost, ApiResponse, ApiVideoCover, AudioSearchResult, BestTimesResult, HashtagSet, LocationSearchResult, MediaCheckResult, MediaCompatibility, MediaFolder, MediaItem, PdfUploadResult, PostAnalytics, PublishPostResult, RecentPlatformPost, RetryPostResult, ApprovePostResult, RejectPostResult, InboxConversation, InboxDeleteResult, InboxMessage, InboxNextUnanswered, Webhook } from "./types.js";
+import type { Account, AnalyticsOverview, AccountAnalyticsEntry, ApiPost, ApiResponse, ApiVideoCover, AudioSearchResult, Automation, AutomationEvent, AutomationEventsResult, AutomationInput, BestTimesResult, CommentDmAutomationInput, HashtagSet, LocationSearchResult, PinterestProductCheck, PinterestProductsResult, MediaCheckResult, MediaCompatibility, MediaFolder, MediaItem, PdfUploadResult, PostAnalytics, PublishPostResult, RecentPlatformPost, RetryPostResult, ApprovePostResult, RejectPostResult, PostApproval, InboxConversation, InboxDeleteResult, InboxMessage, InboxNextUnanswered, Webhook } from "./types.js";
 export declare function fetchImageAsBase64(url: string): Promise<{
     data: string;
     mimeType: string;
@@ -44,10 +44,27 @@ export interface XThreadPartInput {
      * Entries may be `{ url, alt }` to attach alt text (photos/GIFs only). */
     media_urls?: MediaUrlEntry[];
 }
+/**
+ * A poll on an X, Threads or Mastodon post (the post text is the question).
+ * X: 2 to 4 options of up to 25 characters, duration_minutes 5 to 10080
+ * (default 1440). Threads: 2 to 4 options of 1 to 25 characters, closed by
+ * Threads after 24 hours. Mastodon: options and expires_in (seconds) within
+ * the instance's limits, plus multiple and hide_totals. No media together
+ * with a poll; on a thread the poll goes on the first part. On update,
+ * `null` removes the poll.
+ */
+export interface ChannelPollInput {
+    options: string[];
+    duration_minutes?: number;
+    expires_in?: number;
+    multiple?: boolean;
+    hide_totals?: boolean;
+}
 export interface XPostOptions {
     reply_settings?: "" | "following" | "mentionedUsers";
     paid_partnership?: boolean;
     made_with_ai?: boolean;
+    poll?: ChannelPollInput | null;
     /** Provide 2–25 parts to publish as a thread. Omit for a single tweet. */
     thread_parts?: XThreadPartInput[];
 }
@@ -93,6 +110,7 @@ export interface MastodonThreadPartInput {
     media_urls?: MediaUrlEntry[];
 }
 export interface MastodonPostOptions {
+    poll?: ChannelPollInput | null;
     /** Provide 2–25 parts to publish as a thread. Omit for a single status. */
     thread_parts?: MastodonThreadPartInput[];
 }
@@ -101,8 +119,96 @@ export interface MastodonPostOptions {
  * single status); `undefined` leaves the existing thread untouched.
  */
 export interface MastodonPostOptionsUpdate {
+    poll?: ChannelPollInput | null;
     thread_parts?: MastodonThreadPartInput[] | null;
 }
+export interface TelegramButtonInput {
+    /** Button label, 1 to 64 characters. */
+    text: string;
+    /** https://, http:// or tg:// link. */
+    url: string;
+}
+export interface TelegramPollInput {
+    /** 2 to 12 answer options of up to 100 characters, all different. */
+    options: string[];
+    /** Seconds the poll stays open (5 to 2628000). Omit to keep it open. */
+    open_period?: number;
+    /** Allow several answers per person. */
+    multiple?: boolean;
+}
+export interface TelegramPostOptions {
+    silent?: boolean | null;
+    link_preview?: boolean | null;
+    pin?: boolean | null;
+    protect_content?: boolean | null;
+    spoiler?: boolean | null;
+    caption_above_media?: boolean | null;
+    /** Up to 3 link buttons, one per row. Not on an album or a poll. */
+    buttons?: TelegramButtonInput[] | null;
+    /** A native poll; the post text is the question (max 300 characters). */
+    poll?: TelegramPollInput | null;
+    /** A reply under the post, sent right after it is published. */
+    first_comment?: string;
+}
+/** What GET /posts/{id} returns under `telegram` once the post went out. */
+export interface TelegramPostResult {
+    chat_id: string | null;
+    message_ids: string[];
+    pinned: boolean;
+    pin_error?: string;
+    text_message_id?: string;
+    link_public: string | null;
+    link_private: string | null;
+    sent_at: string | null;
+}
+export interface DiscordButtonInput {
+    /** Button label, 1 to 80 characters. */
+    text: string;
+    /** https:// or http:// link. */
+    url: string;
+}
+export interface DiscordPollInput {
+    /** 2 to 10 answer options of up to 55 characters, all different. */
+    options: string[];
+    /** Hours the poll stays open (1 to 768). Default 24. */
+    duration_hours?: number;
+    /** Allow several answers per person. */
+    multiple?: boolean;
+}
+export interface DiscordPostOptions {
+    /** Send without a push or desktop notification (@silent). */
+    silent?: boolean | null;
+    /** false hides the previews of the links in the text. */
+    link_preview?: boolean | null;
+    /** true lets @everyone, @here, role and user mentions ping. Off by default. */
+    allow_mentions?: boolean | null;
+    /** Blur every image and video until someone clicks it. */
+    spoiler?: boolean | null;
+    /** Post title in a forum or media channel (required there), max 100 characters. */
+    thread_name?: string | null;
+    /** Up to 5 link buttons in one row. Not with a poll. */
+    buttons?: DiscordButtonInput[] | null;
+    /** A native poll; the post text is the question (max 300 characters). */
+    poll?: DiscordPollInput | null;
+}
+/** What GET /posts/{id} returns under `discord` once the message went out. */
+export interface DiscordPostResult {
+    webhook_id: string | null;
+    guild_id: string | null;
+    channel_id: string | null;
+    /** The forum post the message opened, in a forum or media channel. */
+    thread_id: string | null;
+    message_id: string | null;
+    /** discord.com/channels/<server>/<channel or thread>/<message>. */
+    url: string | null;
+    sent_at: string | null;
+    /** Media sent as a link in the text (videos and GIFs over 20 MB). */
+    video_links: string[];
+    /** A second message with the media links, when they did not fit in the text. */
+    link_message_id: string | null;
+    /** Codes such as "media_sent_as_links" or "links_sent_as_follow_up". */
+    warnings: string[];
+}
 export interface ThreadsThreadPartInput {
     /** Part text, 1 to 500 characters. */
     text: string;
@@ -114,6 +220,7 @@ export interface ThreadsThreadPartInput {
     media_urls?: MediaUrlEntry[];
 }
 export interface ThreadsPostOptions {
+    poll?: ChannelPollInput | null;
     /** Provide 2 to 25 parts to publish as a thread. Omit for a single post.
      * When set, the Threads caption is taken from part 1. */
     thread_parts?: ThreadsThreadPartInput[];
@@ -128,6 +235,7 @@ export interface ThreadsPostOptions {
  * single post); `undefined` leaves the existing thread untouched.
  */
 export interface ThreadsPostOptionsUpdate {
+    poll?: ChannelPollInput | null;
     thread_parts?: ThreadsThreadPartInput[] | null;
     /** New Threads location id, or null to remove the tag. Omit to leave the
      * existing tag untouched. */
@@ -152,6 +260,10 @@ export interface CreatePostInput {
     content: string | Record<string, string>;
     channels?: string[];
     scheduled_at?: string;
+    /** With scheduled_at: keep the time but store the post as a draft (planned draft). */
+    draft?: boolean;
+    /** Image fit per channel: { instagram: "auto" | "crop" | "keep" }. */
+    media_fit?: Record<string, "auto" | "crop" | "keep">;
     media_ids?: MediaIdEntry[] | Record<string, MediaIdEntry[]>;
     media_urls?: MediaUrlEntry[] | Record<string, MediaUrlEntry[]>;
     type?: string;
@@ -183,11 +295,15 @@ export interface CreatePostInput {
     mastodon?: MastodonPostOptions;
     threads?: ThreadsPostOptions;
     google_business?: Record<string, unknown>;
+    telegram?: TelegramPostOptions | null;
+    discord?: DiscordPostOptions | null;
     hashtag_set?: string;
     hashtag_placement?: "caption_append" | "first_comment";
     hashtag_platforms?: string[];
     /** Route the post through a saved approval workflow (GET /approval-workflows). */
     approval_workflow_id?: string;
+    /** Comment-to-DM automations bound to this post (Instagram or Facebook must be a channel). `null` removes them on update. */
+    comment_dm_automation?: CommentDmAutomationInput | null;
 }
 export interface ApprovalWorkflowApprover {
     id: string;
@@ -234,6 +350,8 @@ export declare class OmniSocialsClient {
     updatePost(id: string, data: {
         content?: string | Record<string, string>;
         scheduled_at?: string;
+        /** false = schedule a planned draft at its stored time; true = unschedule, keep the time. */
+        draft?: boolean;
         channels?: string[];
         media_ids?: MediaIdEntry[] | Record<string, MediaIdEntry[]>;
         media_urls?: MediaUrlEntry[] | Record<string, MediaUrlEntry[]>;
@@ -258,23 +376,34 @@ export declare class OmniSocialsClient {
         linkedin?: Record<string, unknown>;
         linkedin_page?: Record<string, unknown>;
         linkedin_poll?: LinkedInPollInput | null;
+        comment_dm_automation?: CommentDmAutomationInput | null;
         tiktok?: Record<string, unknown>;
         x?: XPostOptionsUpdate;
         bluesky?: BlueskyPostOptionsUpdate;
         mastodon?: MastodonPostOptionsUpdate;
         threads?: ThreadsPostOptionsUpdate;
         google_business?: Record<string, unknown>;
+        telegram?: TelegramPostOptions | null;
+        discord?: DiscordPostOptions | null;
     }): Promise<ApiResponse<ApiPost>>;
     deletePost(id: string): Promise<ApiResponse<unknown>>;
     publishPost(id: string): Promise<ApiResponse<PublishPostResult>>;
     retryPost(id: string): Promise<ApiResponse<RetryPostResult>>;
     approvePost(id: string): Promise<ApiResponse<ApprovePostResult>>;
     rejectPost(id: string, comment?: string): Promise<ApiResponse<RejectPostResult>>;
+    getPostApproval(id: string): Promise<ApiResponse<PostApproval>>;
     searchLocations(query?: string, platform?: "instagram" | "threads", coords?: {
         latitude?: number;
         longitude?: number;
     }): Promise<LocationSearchResult>;
     validateLocation(id: string): Promise<ApiResponse<unknown>>;
+    listPinterestProducts(params?: {
+        source?: "catalog" | "pins";
+        product_group_id?: string;
+        bookmark?: string;
+        page_size?: string;
+    }): Promise<PinterestProductsResult>;
+    validatePinterestProduct(id: string): Promise<PinterestProductCheck>;
     searchInstagramAudio(query?: string, type?: "music" | "original_sound"): Promise<AudioSearchResult>;
     listMedia(params?: {
         limit?: string;
@@ -287,6 +416,7 @@ export declare class OmniSocialsClient {
         filename?: string;
         name?: string;
         folder?: string;
+        pdf_mode?: "slides" | "document";
     }): Promise<ApiResponse<MediaItem> & Partial<PdfUploadResult> & {
         compatibility?: MediaCompatibility;
         message?: string;
@@ -297,6 +427,7 @@ export declare class OmniSocialsClient {
         filename?: string;
         name?: string;
         folder?: string;
+        pdf_mode?: "slides" | "document";
     }): Promise<ApiResponse<MediaItem> & Partial<PdfUploadResult> & {
         compatibility?: MediaCompatibility;
         message?: string;
@@ -333,6 +464,20 @@ export declare class OmniSocialsClient {
         hashtags?: string[];
     }): Promise<ApiResponse<HashtagSet>>;
     deleteHashtagSet(id: string): Promise<ApiResponse<unknown>>;
+    listAutomations(params?: {
+        status?: string;
+        post_id?: string;
+        platform?: string;
+    }): Promise<ApiResponse<Automation[]>>;
+    getAutomation(id: string): Promise<ApiResponse<Automation>>;
+    createAutomation(data: AutomationInput): Promise<ApiResponse<Automation>>;
+    updateAutomation(id: string, data: AutomationInput): Promise<ApiResponse<Automation>>;
+    deleteAutomation(id: string): Promise<ApiResponse<unknown>>;
+    listAutomationEvents(id: string, params?: {
+        outcome?: string;
+        limit?: number;
+        offset?: number;
+    }): Promise<ApiResponse<AutomationEvent[]> & Partial<Omit<AutomationEventsResult, "data">>>;
     listAccounts(): Promise<ApiResponse<Account[]> & {
         workspace_id?: number | string | null;
         workspace_name?: string | null;
@@ -394,6 +539,7 @@ export declare class OmniSocialsClient {
     markInboxRead(conversationId: string): Promise<ApiResponse<unknown>>;
     replyToInboxConversation(conversationId: string, data: {
         text: string;
+        message_id?: string;
         attachment_url?: string;
         attachment_type?: string;
         include_next?: boolean;

package/build/client.js

@@ -198,6 +198,13 @@ export function metricRows(m) {
     }
     return rows;
 }
+// Query params as strings, without the undefined ones (request() takes
+// Record<string, string>).
+const queryString = (params) => params
+    ? Object.fromEntries(Object.entries(params)
+        .filter(([, v]) => v !== undefined && v !== null)
+        .map(([k, v]) => [k, String(v)]))
+    : undefined;
 export class OmniSocialsClient {
     baseUrl;
     apiKey;
@@ -285,6 +292,12 @@ export class OmniSocialsClient {
             ...(comment ? { comment } : {}),
         });
     }
+    // Reads the review of the post's approval workflow: every step with its
+    // approvers and their decisions, the rejection with its reason, and the
+    // comment thread. A post without a workflow answers 200 with status "none".
+    async getPostApproval(id) {
+        return this.request("GET", `/posts/${id}/approval`);
+    }
     // Locations (Instagram or Threads place tagging). NOT the standard
     // envelope; see LocationSearchResult: Instagram's degraded-path `error` is
     // a plain string next to `data`; Threads answers with `locations` and a
@@ -303,6 +316,24 @@ export class OmniSocialsClient {
     async validateLocation(id) {
         return this.request("GET", "/locations/validate", undefined, { id });
     }
+    // Pinterest product Pins (for `pinterest.product_tags`). NOT the standard
+    // envelope; see PinterestProductsResult: `products` on success, a
+    // { code, message } `error` object when the list could not be read.
+    async listPinterestProducts(params) {
+        const query = {};
+        if (params?.source)
+            query.source = params.source;
+        if (params?.product_group_id)
+            query.product_group_id = params.product_group_id;
+        if (params?.bookmark)
+            query.bookmark = params.bookmark;
+        if (params?.page_size)
+            query.page_size = params.page_size;
+        return this.request("GET", "/pinterest/products", undefined, query);
+    }
+    async validatePinterestProduct(id) {
+        return this.request("GET", "/pinterest/products/validate", undefined, { id });
+    }
     // Audio (Instagram Reel music). Same nonstandard string-`error` envelope.
     async searchInstagramAudio(query, type) {
         const params = {};
@@ -367,6 +398,26 @@ export class OmniSocialsClient {
     async deleteHashtagSet(id) {
         return this.request("DELETE", `/hashtag-sets/${id}`);
     }
+    // Comment-to-DM automations (opt-in scopes automations:read / automations:write)
+    async listAutomations(params) {
+        return this.request("GET", "/automations", undefined, queryString(params));
+    }
+    async getAutomation(id) {
+        return this.request("GET", `/automations/${id}`);
+    }
+    async createAutomation(data) {
+        return this.request("POST", "/automations", data);
+    }
+    async updateAutomation(id, data) {
+        return this.request("PATCH", `/automations/${id}`, data);
+    }
+    async deleteAutomation(id) {
+        return this.request("DELETE", `/automations/${id}`);
+    }
+    // The events response is not the plain list envelope: { data, counts, pagination }.
+    async listAutomationEvents(id, params) {
+        return this.request("GET", `/automations/${id}/events`, undefined, queryString(params));
+    }
     // Accounts. Alongside `data`, the list response carries the workspace's
     // identity top-level (backend/routes/api/v1/accounts.js) — the workspaces
     // tool reads it to label multi-workspace setups.

package/build/index.js

@@ -9,6 +9,7 @@ import { registerAccountTools } from "./tools/accounts.js";
 import { registerAnalyticsTools } from "./tools/analytics.js";
 import { registerWebhookTools } from "./tools/webhooks.js";
 import { registerHashtagSetTools } from "./tools/hashtag-sets.js";
+import { registerAutomationTools } from "./tools/automations.js";
 import { registerInboxTools } from "./tools/inbox.js";
 import { registerWorkspaceTools } from "./tools/workspaces.js";
 const apiKeyEnv = process.env.OMNISOCIALS_API_KEY;
@@ -29,7 +30,7 @@ const sessionState = { activeIndex: 0 };
 const getActiveClient = () => workspaceClients[sessionState.activeIndex].client;
 const server = new McpServer({
     name: "OmniSocials",
-    version: "1.35.0",
+    version: "1.46.0",
 });
 // Register all tools - pass getter function so tools always use the active workspace's client
 registerPostTools(server, getActiveClient);
@@ -38,6 +39,7 @@ registerAccountTools(server, getActiveClient);
 registerAnalyticsTools(server, getActiveClient);
 registerWebhookTools(server, getActiveClient);
 registerHashtagSetTools(server, getActiveClient);
+registerAutomationTools(server, getActiveClient);
 registerInboxTools(server, getActiveClient);
 registerWorkspaceTools(server, workspaceClients, sessionState);
 // Register prompts

package/build/metrics.d.ts

@@ -20,9 +20,11 @@ export declare function getImpressions(platform: string, metrics: Metrics): numb
 export declare function getReach(platform: string, metrics: Metrics): number | null;
 /** Post-level metrics a platform can never report: platform -> metric key -> reason. */
 export declare const UNSUPPORTED_POST_METRICS: Record<string, Record<string, string>>;
-/** Reason `metricKey` is unavailable on `platform`, or null when it is available. */
-export declare function unsupportedMetricReason(platform: string, metricKey: string): string | null;
-/** True when the platform can never report `metricKey`; a finite stored value overrides the map. */
+/** Metrics unavailable for some post types only: platform -> content_type -> metric key -> reason. Empty since Facebook reach moved to the platform-wide map. */
+export declare const UNSUPPORTED_POST_METRICS_BY_CONTENT_TYPE: Record<string, Record<string, Record<string, string>>>;
+/** Reason `metricKey` is unavailable on `platform` (refined by `contentType`), or null when it is available. */
+export declare function unsupportedMetricReason(platform: string, metricKey: string, contentType?: string): string | null;
+/** True when the platform can never report `metricKey` for this post; a finite stored value overrides the map. */
 export declare function isMetricUnsupported(platform: string, metricKey: string, metrics?: Metrics): boolean;
 /**
  * Engagement rate as a percentage (0-100), suppressed below the impression