hermoso 0.1.259 → 0.1.260

package/mcp/http.mjs

@@ -243,12 +243,12 @@ const inflightNameOf = (body) => { const msgs = Array.isArray(body) ? body : [bo
   // `?tools=research,create` narrows the roster this connection advertises (see registerTools). Read here rather
   // than inside registerTools so BOTH the anonymous discovery handshake and a real session honour the same query,
   // and so an unknown group is refused at the door with the valid list instead of silently serving every group.
-  // ABSENT, an authenticated session resolves to `defaultToolGroups` in tools.mjs, which is the FULL roster unless
-  // this process sets MCP_CORE_FIRST=1 — and production does not set it (measured 2026-09-20 off the Cloud Run
-  // service env). This comment used to say an authenticated session "resolves to the CORE-FIRST default" in one
-  // sentence and "the default is the full roster" in the next; the second one is the true one. When core-first IS
-  // on, the list is the core tools plus a few that make the connection drivable, with everything else held out of
-  // the LIST on size and reachable through find_tools + call_tool. `?tools=all` restores the full roster for one
+  // ABSENT, an authenticated session resolves to `defaultToolGroups` in tools.mjs: the FULL roster unless this
+  // process sets MCP_CORE_FIRST=1. PRODUCTION SETS IT (since 2026-09-20, read off the Cloud Run service env; for the
+  // three weeks before, this comment claimed core-first was the default while the variable was absent). With it on,
+  // the list is the core tools, the few that make the connection drivable and the headline verb of each area
+  // (CORE_FIRST_HEADLINE), with everything else held out of the LIST on size and reachable through find_tools +
+  // call_tool. `?tools=all` restores the full roster for one
   // connection. The anonymous discovery path above is
   // deliberately NOT core-first — see the comment on its registerTools call.
   // The scope fixed here is the STARTING roster, not a cage: `enable_tools` widens it mid-session and the SDK

package/mcp/tools.mjs

@@ -1936,7 +1936,27 @@ export const coreFirstRoster = (env = process.env) => CORE_FIRST_ENV.some((k) =>
 // every existing caller and every per-group count the site and the docs derive. tools/core-first-roster-check.mjs
 // asserts each name is registered and that NONE of them is connector-gated (one that were would be listed and
 // then answer 401, which is the thing the connector gate exists to prevent).
-export const CORE_FIRST_EXTRA = Object.freeze(['get_brand', 'get_job', 'list_jobs', 'list_connectors', 'list_scheduled']);
+// THE SHORT LIST HAS TO LOOK LIKE THE PRODUCT (2026-09-20, Dave: "we dont want to degrade quality or make it look like
+// there's less capability"). The first core-first list was the `core` group plus the five above, and read live off
+// production it was: enable_tools, find_tools, call_tool, hermoso_capabilities, hermoso_credits, buy_credits,
+// report_bug, request_feature, billing_status, upgrade_plan, set_auto_reload, list_brands, use_brand, create_brand,
+// delete_brand … — a billing utility. Not one listed tool made an ad, researched a competitor or published a post, so
+// a person scanning the connector in Claude, ChatGPT or Cursor saw no marketing product, and a client that does not
+// reliably search (`find_tools` is an instruction, and weaker hosts skip instructions) had no way to discover one.
+// So the HEADLINE VERBS of each area ride in the list: research, create, the variant tools, publish, measure. Every
+// name here is un-gated (listed with nothing connected and never answering 401), and everything else is still one
+// find_tools + call_tool away. The weight this costs is measured in tools/roster-weight-check.mjs.
+export const CORE_FIRST_HEADLINE = Object.freeze([
+  // research
+  'find_competitors', 'pull_competitor_ads', 'competitor_teardown', 'research_ads', 'mine_angles',
+  // create
+  'draft_brand', 'plan_ad', 'render_ad', 'generate_image', 'generate_video', 'clone_video', 'clone_static', 'make_template_ad',
+  // variants of a finished ad
+  'edit_image', 'headline_variants', 'hook_variants', 'multiply_ad',
+  // publish, files, measure
+  'schedule_post', 'list_library', 'upload_file', 'post_performance', 'analyze_campaigns',
+]);
+export const CORE_FIRST_EXTRA = Object.freeze(['get_brand', 'get_job', 'list_jobs', 'list_connectors', 'list_scheduled', ...CORE_FIRST_HEADLINE]);
 export function defaultToolGroups(env = process.env) { return coreFirstRoster(env) ? ['core'] : [...DEFAULT_TOOL_GROUPS]; }
 
 // Parse a `tools=` scope. Returns {groups} or {error} — an unknown name is REFUSED BY NAME rather than dropped,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hermoso",
-  "version": "0.1.259",
+  "version": "0.1.260",
   "mcpName": "io.github.hermoso-ai/hermoso",
   "description": "Marketing on autopilot, run from your own AI agent. 847 tools. Publishing, scheduling, ad campaign management, comments, DMs and analytics cost no credits on every plan; credits are only for generating creative and for Ad Spy research. AD PLATFORMS: Meta, Google Ads, TikTok Ads, LinkedIn Ads, Reddit Ads, X Ads, Pinterest Ads, Snapchat Ads, Microsoft Advertising, Apple Search Ads and ChatGPT Ads, plus product feeds in Google Merchant Center. PUBLISHING AND SCHEDULING: Facebook, Instagram, Threads, TikTok, YouTube, X, LinkedIn, Pinterest, Bluesky and Telegram. AD RESEARCH: the Meta, Google and LinkedIn ad libraries plus organic TikTok, Instagram, YouTube, Threads and Reddit. ANALYTICS: Google Analytics 4, Google Search Console and every connected platform's own post and campaign insights. Also brand onboarding, 50+ image and video generation models, ad scoring, competitor teardowns, Google Drive and OneDrive, a CLI and installable Claude skills.",
   "type": "module",