hermoso 0.1.463 → 0.1.465

package/README.md

@@ -5,7 +5,7 @@ scripts. Research the ads already winning in a market, generate image & video ad
 composited in, copy + CTA included), publish them to your own social channels, and build & manage the ad
 campaigns behind them, all over [MCP](https://modelcontextprotocol.io) tools, a CLI, or installable Claude skills.
 
-**1090 tools.** `tools/list` is always the authoritative set; `hermoso_capabilities` (free) returns the live model
+**1088 tools.** `tools/list` is always the authoritative set; `hermoso_capabilities` (free) returns the live model
 catalog with exact per-render credit costs plus the full capability map.
 
 **No markup on models.** Stop overpaying markups on AI models. Plans: [hermoso.ai/pricing](https://hermoso.ai/pricing).
@@ -242,7 +242,7 @@ block entirely if you signed in above; it is there for CI, where the process can
 
 Then ask your agent: *“Generate an image ad with Hermoso.”*
 
-### What the 1090 tools cover
+### What the 1088 tools cover
 
 **Ad spy / research** — `find_competitors`, `competitor_teardown`, `pull_competitor_ads`, `research_ads`; the
 Meta / Google / LinkedIn ad libraries (`search_meta_ads`, `search_google_ads`, `search_linkedin_ads`); organic

package/mcp/client.mjs

@@ -84,10 +84,23 @@ const scopedBrand = (p) => {
   const b = brandScope.getStore()?.brand;
   return typeof b === 'string' && b.trim() && !/^\/api\/apple-ads\//.test(String(p || '')) ? b.trim() : '';
 };
+// ── AN ACCOUNT NAMED ON ONE TOOL CALL SCOPES EVERY REQUEST THAT CALL MAKES (2026-10-29) ──────────────────────────
+// A brand can hold several accounts of one channel (lib/multi-account.mjs), and the server refuses a write that names
+// none: "2 youtube accounts are connected, name one with account: …". `update_youtube_video` had no `account`
+// argument to name one with, so a customer with two channels could not flip a video public (fb_f6f7b0371d42). Same
+// shape as the brand above: wrap() (tools.mjs) puts the caller's `account` in toolCtx for a tool whose provider is a
+// multi-account channel, and it rides here as `?account=`, which the server's connCtxFor reads on every method.
+// A body `account` the handler already sends is read FIRST by the server and is the same value.
+const scopedAccount = () => { const a = toolCtx.getStore()?.account; return typeof a === 'string' && a.trim() ? a.trim() : ''; };
+const withAccountScope = (p) => {
+  const a = scopedAccount();
+  if (!a || /[?&]account=/.test(String(p))) return p;
+  return `${p}${String(p).includes('?') ? '&' : '?'}account=${encodeURIComponent(a)}`;
+};
 export const withBrandScope = (p) => {
   const b = scopedBrand(p);
-  if (!b || /[?&]brandId=/.test(String(p))) return p;
-  return `${p}${String(p).includes('?') ? '&' : '?'}brandId=${encodeURIComponent(b)}`;
+  if (!b || /[?&]brandId=/.test(String(p))) return withAccountScope(p);
+  return withAccountScope(`${p}${String(p).includes('?') ? '&' : '?'}brandId=${encodeURIComponent(b)}`);
 };
 
 function headers(extra = {}) {

package/mcp/roster-scope.mjs

@@ -52,6 +52,7 @@
 export const NEVER_GATE = new Set([
   'search_meta_ads', 'search_google_ads', 'search_linkedin_ads', 'search_tiktok',
   'search_instagram', 'search_youtube', 'search_reddit', 'search_threads', 'fetch_social_data',
+  'search_meta_places', // place search runs on our data provider and a web search, never on a Meta connection (2026-10-27)
 ]);
 
 // Tool-name → connector provider. ORDERED: the first match wins, so the more specific pattern must come first.
@@ -127,6 +128,28 @@ export const TOOL_PROVIDER_RULES = [
 // in every listing. If Reddit ever approves the app, remove it from this set and the whole surface returns.
 export const UNOFFERED_PROVIDERS = new Set(['reddit', 'snapchat']);
 export function toolUnoffered(name) { const p = toolProvider(name); return !!p && UNOFFERED_PROVIDERS.has(p); }
+
+// ── WHICH TOOLS TAKE `account` (2026-10-29, customer bug fb_f6f7b0371d42) ─────────────────────────────────────────────
+// A brand can connect several accounts of these channels (lib/multi-account.mjs), and the server refuses a write that
+// names none. Only the post_to_* tools declared `account`, so a user with two YouTube channels was told "name one with
+// account: …" by update_youtube_video, which had no such argument. Every surface (both MCP twins' registration seam,
+// the Studio agent's schema and executor) asks THIS function, so the answer cannot differ between them.
+// The set mirrors lib/multi-account.mjs MULTI_ACCOUNT_PROVIDERS, which the npm package cannot import;
+// tools/multi-account-arg-check.mjs fails when the two differ, and DERIVES the tool split below from server.js.
+export const MULTI_ACCOUNT_CHANNELS = Object.freeze(new Set(['tiktok', 'x', 'youtube', 'threads', 'bluesky', 'telegram', 'reddit', 'pinterest', 'instagram']));
+// Filed under a multi-account channel, but routed through a connection that holds ONE grant per brand, so `account`
+// would do nothing there: every other tiktok_* tool rides the TikTok Business account-holder grant or TikTok Ads (not
+// the per-account posting row), and these two Pinterest reads ride the ad-account (pinterest_ads) row.
+const TIKTOK_PER_ACCOUNT_TOOLS = new Set(['post_to_tiktok', 'tiktok_post_status', 'tiktok_creator_info', 'tiktok_account', 'list_tiktok_videos']);
+const SINGLE_GRANT_TOOLS = new Set(['pinterest_targeting_analytics', 'pinterest_audience_insights']);
+export function accountScopedTool(name) {
+  const p = String(toolProvider(name) || '');
+  if (!MULTI_ACCOUNT_CHANNELS.has(p)) return false;
+  return p === 'tiktok' ? TIKTOK_PER_ACCOUNT_TOOLS.has(String(name)) : !SINGLE_GRANT_TOOLS.has(String(name));
+}
+// The channel an account-scoped tool's `account` names, or null.
+export const accountChannelOf = (name) => (accountScopedTool(name) ? String(toolProvider(name)) : null);
+export const ACCOUNT_ARG_TEXT = 'which connected account: its @handle or id from list_connector_accounts; needed only when several are connected';
 export function toolProvider(name) {
   const n = String(name || '');
   if (!n) return null;