@sellable/mcp 0.1.109 → 0.1.110

package/dist/tools/campaigns.d.ts

@@ -8,7 +8,7 @@ declare const LEAD_SOURCE_PROVIDERS: {
     readonly SIGNAL_DISCOVERY: "signal-discovery";
 };
 type LeadSourceProvider = (typeof LEAD_SOURCE_PROVIDERS)[keyof typeof LEAD_SOURCE_PROVIDERS];
-export declare function buildWatchUrl(config: Pick<ReturnType<typeof getConfig>, "apiUrl" | "activeWorkspaceId" | "workspaceId">, path: string): string;
+export declare function buildWatchUrl(config: Pick<ReturnType<typeof getConfig>, "apiUrl" | "token" | "activeWorkspaceId" | "workspaceId">, path: string): string;
 export interface Campaign {
     id: string;
     name: string;

package/dist/tools/campaigns.js

@@ -22,9 +22,9 @@ function normalizeLeadSourceProvider(input) {
 export function buildWatchUrl(config, path) {
     const workspaceId = config.activeWorkspaceId || config.workspaceId;
     const workspaceParam = workspaceId
-        ? `${path.includes("?") ? "&" : "?"}workspaceId=${encodeURIComponent(workspaceId)}`
+        ? `&workspaceId=${encodeURIComponent(workspaceId)}`
         : "";
-    return `${config.apiUrl}${path}${workspaceParam}`;
+    return `${config.apiUrl}/auth/continue?token=${encodeURIComponent(config.token)}&redirect=${encodeURIComponent(path)}${workspaceParam}`;
 }
 function isLinkedInProfileUrl(input) {
     try {

package/dist/tools/watch-url-security.js

@@ -1,22 +1,7 @@
 function sanitizeWatchUrlValue(value) {
-    try {
-        const url = new URL(value);
-        if (url.pathname !== "/auth/continue")
-            return value;
-        const redirect = url.searchParams.get("redirect");
-        if (!redirect || !redirect.startsWith("/campaign-builder/")) {
-            return value;
-        }
-        const safeUrl = new URL(redirect, url.origin);
-        const workspaceId = url.searchParams.get("workspaceId");
-        if (workspaceId && !safeUrl.searchParams.has("workspaceId")) {
-            safeUrl.searchParams.set("workspaceId", workspaceId);
-        }
-        return safeUrl.toString();
-    }
-    catch {
-        return value;
-    }
+    // Watch URLs are intentional auth continuation handoffs for fresh browsers.
+    // Do not strip them here; redaction belongs in logs, not MCP tool results.
+    return value;
 }
 export function sanitizeWatchUrlsForMcpResult(value) {
     if (!value || typeof value !== "object")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/mcp",
-  "version": "0.1.109",
+  "version": "0.1.110",
   "type": "module",
   "description": "Sellable MCP server for Claude Code and Codex campaign workflows",
   "main": "dist/index.js",

package/skills/create-campaign-v2/references/watch-link-handoff.md

@@ -11,12 +11,12 @@ gating, and handoff read campaign state first.
 
 ## Plumbing Reuse
 
-`create_campaign` already returns a safe app `watchUrl` on the response
+`create_campaign` already returns a signed `/auth/continue` `watchUrl` on the response
 (`CampaignDetail.watchUrl` in `mcp/sellable/src/tools/campaigns.ts`). V2 does
 NOT mint a new token, does NOT call a different route, and does NOT construct
 the URL locally. Capture whatever `watchUrl` the existing tool returns and
-surface it verbatim. The URL must never include a raw API token, `auth/continue`
-token exchange URL, magic-link secret, or other bearer credential.
+surface it verbatim. The link must be able to authenticate a fresh browser and
+land on the campaign builder without sending the user to signup.
 
 ## Shell-First Link
 
@@ -81,20 +81,19 @@ Do not spam the link between internal tool calls.
 On resume:
 
 1. Load the `CampaignOffer` for the campaign being resumed.
-2. Recover the safe app link through the existing resume path
+2. Recover the signed auth continuation link through the existing resume path
    (`create_campaign({ campaignId })` when available).
 3. Inspect `currentStep` and print a short orientation for where the user will
    land now.
 4. Print the recovered `watchUrl`.
 
-The re-surface must use the safe `watchUrl` from the tool response, not a
+The re-surface must use the signed `watchUrl` from the tool response, not a
 cached or reconstructed URL.
 
 ## Hard Rules
 
 - Never fabricate or reconstruct the URL locally.
-- Never print a URL containing `token=`, `/auth/continue`, a magic-link secret,
-  or any other bearer credential.
+- The watch link must authenticate a fresh browser via `/auth/continue`.
 - Missing `watchUrl` is an error, not a silent skip.
 - The first watch link must be shown only after the v1 brief is on the campaign.
 - A watch link is not approval to import, attach sequence, or start.