@se-studio/skills 1.9.6 → 1.9.8

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @se-studio/skills
 
+## 1.9.8
+
+### Patch Changes
+
+- Document role-gated publish, and allow browser CORS on the OAuth token and register routes.
+
+## 1.9.7
+
+### Patch Changes
+
+- Advertise OAuth scopes and Client ID Metadata Documents, and add typed MCP tools so ChatGPT and other remote clients can read and save drafts without a shell.
+
 ## 1.9.6
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@se-studio/skills",
-  "version": "1.9.6",
+  "version": "1.9.8",
   "description": "SE Studio agent skills for marketing site development with Contentful CMS",
   "repository": {
     "type": "git",

package/skills/contentful-cms-core/SKILL.md

@@ -25,12 +25,7 @@ Use this skill when you need to read or edit content in Contentful using **hoste
 
 ## Safety Rules
 
-**This tool CANNOT and WILL NOT:**
-- Publish any entry
-- Unpublish any entry
-- Archive or delete published entries
-
-All `save` operations create **draft** versions. A human must review and publish in Contentful.
+`save` writes **drafts**. Publish, unpublish, and archive use `publish plan`, then `publish apply` after an explicit yes, and only when the signed-in Contentful role allows it. AI Editor cannot. Do not publish as part of save.
 
 **Assets:** Upload **is** supported (`asset upload`). Default workflow: **search and reuse** existing assets first (`index sync` → `asset search`). Search by concept (`asset search --concept` / `--concept-all`) finds a subject and a tone, including files no page uses yet. Concepts are not blog tags. When uploading:
 - **Raster/video:** `cms_edit_request_staged_upload` → curl → `cms_edit_media` prepare → wait → catalog → import with real alt. Video, and an image master over 4MB, is a presigned direct PUT (100MB, `intake: direct`) then prepare with that URL. Smaller images still use `stagedUploadIds`. Never `asset upload --staged/--url/--base64` for jpeg/png/webp/gif/mp4. The stored asset is the processed file.
@@ -204,7 +199,7 @@ Shows a diff of all modified fields across all changed entries.
 cms-edit save
 ```
 
-Writes all changes to Contentful as **drafts**. The changes are visible in Contentful's web app but NOT live until a human publishes them.
+Writes all changes to Contentful as **drafts**. They stay drafts until `publish plan` then `publish apply`, after an explicit yes, and only if the Contentful role allows it.
 
 After saving, the session is cleared automatically if all changes were saved.
 

package/skills/contentful-cms-setup/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: contentful-cms-setup
-description: "Guide a user through connecting hosted cms-edit MCP for Claude or Grok (OAuth)."
+description: "Guide a user through connecting hosted cms-edit MCP for Claude, ChatGPT, Grok, Cursor, or Gemini (OAuth)."
 ---
 
 # Skill: cms-edit Setup
 
-Use this skill when the user wants to connect Claude or Grok to their Contentful site via **hosted cms-edit MCP**.
+Use this skill when the user wants to connect Claude, ChatGPT, Grok, Cursor, VS Code, or Gemini CLI to their Contentful site via **hosted cms-edit MCP**.
 
 Local stdio MCP and the setup wizard are **not supported**. Editors connect through the site's `/cms-edit` onboarding flow.
 
@@ -68,6 +68,27 @@ Full guide: `packages/contentful-cms/docs/mcp/hosted-guide.md` (Grok Build secti
 
 ---
 
+## Hosted setup (ChatGPT and other remote MCP clients)
+
+The MCP URL is the same URL as Claude (`https://<host>/api/mcp`). The client must speak remote Streamable HTTP and OAuth. There is no local stdio server and no OpenAPI Action.
+
+### ChatGPT
+
+1. Settings → **Apps & Connectors** → create a custom MCP server
+2. Paste the MCP URL and choose **OAuth**
+3. Sign in with **Contentful**
+4. Ask it to call `search` or `cms_edit_version`
+
+Draft writes (`set_field`, `save_draft`) need a Business, Enterprise, or Edu workspace. Pro can be read-only. ChatGPT freezes the tool list at connect time: after a cms-edit upgrade, remove the connector and add it again.
+
+Clients that cannot run a shell use `append_text` for bodies over 8192 bytes, then `cms_edit` with `--staged`. `save_draft` does not publish.
+
+### Cursor, VS Code, Gemini CLI
+
+Add the MCP URL as a remote HTTP server and complete OAuth. Cursor: `~/.cursor/mcp.json` `url`. VS Code: `.vscode/mcp.json` `servers` with `type: http`. Gemini CLI: `mcpServers.<name>.url`.
+
+---
+
 ## Developers (CLI + skills, not local MCP)
 
 For engineering work in a site repo (Cursor, Grok, terminal):