hermoso 0.1.495 → 0.1.496

package/mcp/openai-extensions.mjs

@@ -276,6 +276,8 @@ h3{font-size:12px;text-transform:uppercase;letter-spacing:.04em;color:var(--mute
 .quick{display:flex;flex-wrap:wrap;gap:6px;justify-content:center;margin:12px 0 4px}
 .chip{font-size:13px;background:var(--card)}
 .cards{display:grid;grid-template-columns:repeat(auto-fill,minmax(150px,1fr));gap:10px}
+.ccard{display:flex;flex-direction:column;gap:6px;margin:14px 0 4px;border:1px solid var(--line);border-radius:var(--radius);background:var(--card);padding:12px}
+.ccard .row{margin-top:4px}
 .gcard{text-align:left;border:1px solid var(--line);border-radius:var(--radius);background:var(--card);padding:12px;cursor:var(--cur)}
 .gcard b{display:block;margin-bottom:2px}.gcard span{color:var(--muted);font-size:12px}
 .field{margin:12px 0}
@@ -360,7 +362,7 @@ const APP_SCRIPT = String.raw`<script>
   var TOOL_VIEW = { open_hermoso_home: 'home', open_library: 'library', open_ad_brief: 'create', set_up_hermoso: 'setup', show_ad_concepts: 'concepts', show_ad_results: 'results' };
   var CARD_VIEWS = ['concepts', 'results'];
   var PANEL_VIEWS = ['home', 'library', 'jobs', 'calendar', 'ads', 'create', 'setup'];
-  var SECTIONS_FOR = { home: ['brand', 'brands', 'library', 'jobs', 'prefs'], library: ['library', 'jobs', 'brands', 'calendar'], jobs: ['jobs', 'brands'], calendar: ['calendar', 'brands', 'prefs'], ads: ['ads', 'brands'], create: ['brand', 'brands', 'library', 'creators', 'products', 'prefs'], setup: ['brand', 'brands', 'connectors'] };
+  var SECTIONS_FOR = { home: ['brand', 'brands', 'library', 'jobs', 'prefs', 'connectors'], library: ['library', 'jobs', 'brands', 'calendar'], jobs: ['jobs', 'brands'], calendar: ['calendar', 'brands', 'prefs'], ads: ['ads', 'brands'], create: ['brand', 'brands', 'library', 'creators', 'products', 'prefs'], setup: ['brand', 'brands', 'connectors'] };
   var EDITABLE = ['queued', 'scheduled'];
   var state = {
     view: 'home', surface: 'panel', data: null, host: {}, caps: {}, selected: [], focus: null, busy: false, pollTimer: null, pollStarted: 0, routed: false, ready: false,
@@ -659,6 +661,7 @@ const APP_SCRIPT = String.raw`<script>
       + '<button class="chip" data-act="create" data-format="video">Make a video ad</button>'
       + '<button class="chip" data-act="msg" data-text="Help me schedule a post from my Hermoso Library.">Schedule a post</button>'
       + '</div></section>';
+    html += connectCardHtml(d);
     html += '<h3>Get started</h3><div class="cards">'
       + gcard('tab', 'library', 'Library', 'Your images and videos')
       + gcard('tab', 'create', 'Create', 'Pick options, see concepts, then render')
@@ -672,6 +675,14 @@ const APP_SCRIPT = String.raw`<script>
     if (d.notes && d.notes.brand) html += sectionNote('brand');
     return html;
   }
+  // NOTHING CONNECTED YET: posting from here starts with one browser sign-in. Absent while the read is pending or failed,
+  // because an unread list is not an empty one. The links leave through openLink, like every other link in this app.
+  function connectCardHtml(d){
+    var c = d.connectCard; if (!c || !c.channels || !c.channels.length) return '';
+    return '<div class="ccard" data-connect-card="1"><b>Post what you make from this chat</b><span class="s">Nothing is connected yet. Sign in once on the platform, then ask here to post or schedule.</span><div class="row">'
+      + c.channels.map(function(x){ return '<button class="btn primary" data-act="open-link" data-url="' + esc(x.url) + '">' + esc(x.name) + '</button>'; }).join('')
+      + '<button class="btn" data-act="setup" data-step="connections">All channels</button></div></div>';
+  }
   function gcard(act, target, title, sub){
     return '<button class="gcard" data-act="' + act + '" ' + (act === 'setup' ? 'data-step' : 'data-view') + '="' + target + '"><b>' + esc(title) + '</b><span>' + esc(sub) + '</span></button>';
   }
@@ -1142,6 +1153,7 @@ const APP_SCRIPT = String.raw`<script>
     if (a === 's-draft') return draftBrand();
     if (a === 's-step') { state.setup.step = el.getAttribute('data-step'); if (state.setup.step === 'connections') load(['connectors']); return render(); }
     if (a === 's-check') return load(['connectors']);
+    if (a === 'open-link') { var ou = el.getAttribute('data-url'); if (ou) openLink(ou); return; }
     if (a === 's-connect') { var pv = el.getAttribute('data-p'); var c = (d.connections || []).filter(function(x){ return x.provider === pv; })[0]; if (c && c.connectUrl) { openLink(c.connectUrl).then(function(){ startWatch(pv); render(); }); } return; }
     // concepts
     if (a === 'c-pick') { state.concepts.open = i; return render(); }
@@ -1287,6 +1299,17 @@ const CHANNELS_OF = { meta: ['facebook', 'instagram'], instagram: ['instagram'],
 const CHANNEL_LABEL = { facebook: 'Facebook', instagram: 'Instagram', threads: 'Threads', tiktok: 'TikTok', youtube: 'YouTube', linkedin: 'LinkedIn', x: 'X', pinterest: 'Pinterest', google_business: 'Google Business Profile', bluesky: 'Bluesky', telegram: 'Telegram' };
 export const ALL_CHANNELS = Object.freeze(Object.keys(CHANNEL_LABEL));
 
+// THE HOME SCREEN'S CARD FOR AN ACCOUNT WITH NOTHING TO POST TO (2026-11-02): the most connected channels on offer, first
+// to last by real connection counts (the server's `popular`), each with its one-click link. A connected posting channel
+// answers null: there is nothing to ask for. `via` names this surface on the admin Funnel tab.
+export const HOME_CONNECT_VIA = 'chatgpt-home';
+export function homeConnectCard(connections = [], popular = []) {
+  const rows = (Array.isArray(connections) ? connections : []).filter((c) => c && CHANNELS_OF[c.provider] && c.provider !== 'google_business');
+  if (!rows.length || rows.some((c) => c.connected)) return null;
+  const rank = (p) => { const i = (Array.isArray(popular) ? popular : []).indexOf(p); return i < 0 ? 999 : i; };
+  return { channels: [...rows].sort((a, b) => rank(a.provider) - rank(b.provider)).slice(0, 3).map((c) => ({ provider: c.provider, name: c.name, url: `${c.connectUrl}&via=${HOME_CONNECT_VIA}` })) };
+}
+
 export function libraryPayload(reads = {}, { view = 'library', origins = [], proxyBase = '', abs = (u) => u } = {}) {
   const appOrigin = (() => { try { return new URL(proxyBase).origin; } catch { return ''; } })();
   const own = (u) => { try { return origins.includes(new URL(u).origin); } catch { return false; } };
@@ -1376,6 +1399,7 @@ export function libraryPayload(reads = {}, { view = 'library', origins = [], pro
       // The channels a post can be scheduled to right now: schedule_post's ids, from the connections that are on.
       // Google Business Profile is left out because schedule_post refuses it at enqueue (held back by Google).
       out.channels = [...new Set(out.connections.filter((c) => c.connected).flatMap((c) => CHANNELS_OF[c.provider] || []))].filter((id) => id !== 'google_business').map((id) => ({ id, label: CHANNEL_LABEL[id] }));
+      if (view === 'home') out.connectCard = homeConnectCard(out.connections, d.popular);
     }
   }
   if (reads.ads) {
@@ -1821,7 +1845,7 @@ export function libraryToolDefs() {
 // proxyBase (our /api/img), abs (absolute asset URLs), call(name, args, extra), which runs an EXISTING tool's handler
 // for this session, and prefs {read, write} for the per-brand defaults this app adds.
 export function registerLibraryApp(server, deps) {
-  const { resourceMeta, origins = [], proxyBase = '', abs = (u) => u, call = async () => null, prefs = null } = deps || {};
+  const { resourceMeta, origins = [], proxyBase = '', abs = (u) => u, call = async () => null, prefs = null, markHomeConnectCard = null } = deps || {};
   const meta = libraryResourceMeta(resourceMeta, origins);
   const description = meta['openai/widgetDescription'];
   server.registerResource('hermoso-library-app', LIBRARY_APP_URI, { description, mimeType: LIBRARY_APP_MIME, _meta: meta },
@@ -1850,7 +1874,11 @@ export function registerLibraryApp(server, deps) {
   const handles = {};
   const reg = (name, fn) => { handles[name] = server.registerTool(name, defs[name], fn); };
 
-  reg(EXT_HOME_TOOL, async (args, extra) => answer(args, extra, ['brand', 'brands', 'library', 'jobs', 'prefs'], 'home'));
+  reg(EXT_HOME_TOOL, async (args, extra) => {
+    const out = await answer(args, extra, ['brand', 'brands', 'library', 'jobs', 'prefs', 'connectors'], 'home');
+    if (out?.structuredContent?.connectCard && typeof markHomeConnectCard === 'function') { try { Promise.resolve(markHomeConnectCard()).catch(() => {}); } catch {} } // counted on the admin Funnel tab; never holds the screen up
+    return out;
+  });
   reg(EXT_ENTRY_TOOL, async (args, extra) => answer(args, extra, ['library', 'jobs', 'brands', 'calendar'], PANEL_VIEWS.includes(args?.view) ? args.view : 'library'));
   reg(EXT_BRIEF_TOOL, async (args, extra) => answer(args, extra, ['brand', 'brands', 'library', 'creators', 'products', 'prefs'], 'create', { surface: 'card', payload: { brief: { format: args?.format === 'video' ? 'video' : args?.format === 'image' ? 'image' : '', product: clip(args?.product, 600) } } }));
   reg(EXT_SETUP_TOOL, async (args, extra) => answer(args, extra, ['brand', 'brands', 'connectors'], 'setup', { surface: 'card', payload: { step: args?.step === 'connections' ? 'connections' : 'brand' } }));

package/mcp/tool-hints.mjs

@@ -109,6 +109,25 @@ export function videoChoiceText(tool, choice, opts = {}) {
 }
 
 
+// ── A FINISHED RENDER, READ FROM THE REPLY (2026-11-02) ─────────────────────────────────────────────────────────────
+// Which replies may carry the "post this" next step (lib/connect-prompt.mjs): the tools that make a file, and only once
+// that file exists. A hosted video answers {stillRendering} and arrives through get_job, so get_job is on the list and a
+// queued, running or failed job is not a finished render. Pure, no imports — the twin rule above.
+export const RENDER_REPLY_TOOLS = Object.freeze(['generate_image', 'generate_video', 'render_ad', 'make_template_ad', 'make_motion_film', 'make_thumbnail', 'make_explainer', 'generate_avatar', 'stitch_video', 'product_sizzle', 'recast_motion', 'finish_video', 'multiply_ad', 'clone_video', 'clone_static', 'remix_static', 'get_job']);
+const _VIDEO_FILE = /\.(mp4|mov|webm|m4v)(\?|#|$)/i, _IMAGE_FILE = /\.(png|jpe?g|webp|gif)(\?|#|$)/i;
+export function finishedRenderKind(tool, r) {
+  if (!RENDER_REPLY_TOOLS.includes(String(tool || '')) || !r || r.isError || !Array.isArray(r.content)) return '';
+  const s = r.structuredContent;
+  if (!s || typeof s !== 'object' || s.stillRendering) return '';
+  if (typeof s.status === 'string' && s.status && s.status !== 'done') return '';
+  const inner = [s, s.raw, s.result, s.result && s.result.data].filter((x) => x && typeof x === 'object');
+  const has = (k) => inner.some((x) => (Array.isArray(x[k]) ? x[k].length > 0 : !!x[k]));
+  const url = String(s.url || '');
+  if (has('video') || _VIDEO_FILE.test(url)) return 'video';
+  if (has('image') || has('images') || has('thumbnails') || has('slides') || _IMAGE_FILE.test(url)) return 'image';
+  return '';
+}
+
 // ── OUT OF CREDITS ON A HOST THAT FORBIDS SELLING CREDITS (2026-09-30, OpenAI's plugin guidelines) ─────────────────
 // "Plugins may: explain that a certain feature is not available with the user's current plan or entitlement; link to
 // an informational page … Plugins may not: link directly to a checkout … or promote upgrades." ChatGPT is not offered

package/mcp/tools.mjs

@@ -32,7 +32,7 @@ function metaAlternativeNote(name) { return metaAlternativeNoteOf(canonicalToolN
 import { toolCostClass, costLabel, costKindOf, creditRangeFrom } from './tool-cost.mjs';
 import { recordToolOutcome, toolHealth, healthLabel, healthPenalty } from './tool-health.mjs';
 // THE NEXT STEP, NAMED. The prose we already write stays; this is the same advice as an addressable field.
-import { withHints, videoChoiceText, videoChoiceHints, neutralCreditsText, creditsLowHints, welcomeClaimHint } from './tool-hints.mjs';
+import { withHints, hintsOf, videoChoiceText, videoChoiceHints, neutralCreditsText, creditsLowHints, welcomeClaimHint, finishedRenderKind } from './tool-hints.mjs';
 // THE CHATGPT EXTENSIONS APP (home, Library panel, concept picker, brief, setup, settings, @-mentions), registered only
 // behind HERMOSO_CHATGPT_EXT=1 + `?ext=1` on a widget host — see registerChatGPTExtensions() below and
 // ./openai-extensions.mjs. Same twin-safe specifier rule.
@@ -521,6 +521,28 @@ export const withAccountArg = (name, def) => {
   return { ...def, inputSchema: { ...s, account: ACCOUNT_ARG } };
 };
 
+// A FINISHED RENDER ON AN ACCOUNT WITH NOTHING CONNECTED ENDS BY OFFERING TO POST IT (2026-11-02). The server decides
+// (once, at most twice, never after a connection; lib/connect-prompt.mjs) and words it, so every host and an older CLI
+// say one thing. It rides the reply and never a tool description, which OpenAI scans. A separate text block, so the block
+// a card parses stays exactly as it was. Bounded and best effort: the render already succeeded, so a slow or failed read
+// of this next step says nothing and costs the caller nothing. The REST passthrough (/v1/tools, the one store with no
+// `client`) is an integration parsing a response, not a person in a chat, so it is left out.
+const CONNECT_PROMPT_WAIT_MS = 2000;
+export async function withConnectPrompt(tool, r, post = apiPost) {
+  try {
+    const kind = finishedRenderKind(tool, r);
+    if (!kind) return r;
+    const store = mcpCtx.getStore();
+    if (store && (store.connectPromptQuiet || (store.remote && store.client === undefined))) return r;
+    const sc = r.structuredContent || {};
+    const job = String(sc.jobId || sc.id || '').slice(0, 80);
+    const client = store ? String(store.client || '') : 'hermoso';
+    const d = await Promise.race([Promise.resolve(post('/api/mcp/connect-prompt', { tool, kind, job, client })).catch(() => null), new Promise((res) => { const t = setTimeout(() => res(null), CONNECT_PROMPT_WAIT_MS); if (t && typeof t.unref === 'function') t.unref(); })]);
+    if (!d || d.show !== true || typeof d.text !== 'string' || !d.text) return r;
+    const out = { ...r, content: [...r.content, { type: 'text', text: d.text }], structuredContent: { ...sc, connectPrompt: { channels: Array.isArray(d.channels) ? d.channels : [] } } };
+    return withHints(out, [...hintsOf(r), { do: 'offer to post this; hand the user one of the connect links in this reply', why: 'no publishing channel is connected, and connecting needs a browser sign-in on the platform' }]);
+  } catch { return r; }
+}
 const wrap = (fn) => {
   // A NAMED closure, so registerTools' proxy can stamp the tool name onto the very function it registers and this
   // body can read it back. Reading a name off `fn` instead would be wrong: `fn` is the inner handler and the thing
@@ -560,7 +582,7 @@ const wrap = (fn) => {
           }
         }
       } catch {}
-      return r;
+      return await withConnectPrompt(_tool, r);
     }
     catch (e) {
       try { recordToolOutcome(_tool, { ok: false, ms: Date.now() - _t0 }); } catch {}
@@ -1020,6 +1042,7 @@ const AD_RESULT_HTML = String.raw`<div id="root"></div>
   .dl { border: 1px solid rgba(128,128,128,.45); border-radius: 999px; padding: 2px 10px; font-size: 12px; font-weight: 600;
         text-decoration: none; color: inherit; opacity: .8; }
   .dl:hover { opacity: 1; background: rgba(128,128,128,.14); }
+  .next { display: flex; align-items: center; flex-wrap: wrap; gap: 6px; padding: 0 12px 10px; font-size: 12.5px; }
   .spacer { flex: 1; }
   .wordmark { font-size: 11px; font-weight: 700; letter-spacing: .08em; text-transform: uppercase; opacity: .4; }
   .empty { padding: 18px 16px; font-size: 13px; opacity: .75; }
@@ -1041,6 +1064,28 @@ const AD_RESULT_HTML = String.raw`<div id="root"></div>
   // free, read-only get_job over the host bridge (get_job carries openai/widgetAccessible for exactly this) until
   // the media exists, then renders it. The model's own get_job loop still works and is unaffected — whichever
   // arrives first wins, because both paths land in the same view().
+  // THE "POST THIS" LINKS (2026-11-02). On ChatGPT a hosted video finishes through THIS card's get_job poll, so that answer
+  // never reaches the model; without a row here the next step could be said to nobody. Read from structuredContent, or
+  // from the prompt's text block on a host that hands callTool the content array alone. Only our own app's connect links.
+  var postLinks = [];
+  function postLinksFrom(r) {
+    if (!r || typeof r !== 'object') return [];
+    var okUrl = function (u) { return /^https:\/\/([a-z0-9-]+\.)*hermoso\.ai\/\?connect=[a-z_]{1,40}(&[A-Za-z0-9_=-]+)*$/.test(String(u || '')); };
+    var q = [r, r.structuredContent, r.toolOutput, r.result], out = [];
+    for (var i = 0; i < q.length; i++) {
+      var ch = q[i] && q[i].connectPrompt && q[i].connectPrompt.channels;
+      if (Array.isArray(ch)) { for (var j = 0; j < ch.length; j++) if (ch[j] && ch[j].label && okUrl(ch[j].url)) out.push({ label: String(ch[j].label), url: String(ch[j].url) }); }
+      if (out.length) return out;
+    }
+    var blocks = Array.isArray(r.content) ? r.content : (r.result && Array.isArray(r.result.content) ? r.result.content : []);
+    for (var b = 0; b < blocks.length && b < 8; b++) {
+      var t = blocks[b] && blocks[b].text;
+      if (typeof t !== 'string' || t.indexOf('?connect=') < 0) continue;
+      var lines = t.split('\n');
+      for (var n = 0; n < lines.length; n++) { var m = /^- (.+): (https:\/\/\S+)$/.exec(lines[n]); if (m && okUrl(m[2])) out.push({ label: m[1], url: m[2] }); }
+    }
+    return out;
+  }
   var live = null;                 // the payload OUR poll resolved — it is newer than a frozen toolOutput, so it wins
   var polls = 0, timer = null, pollErr = '', missed = 0, timeouts = 0, busy = 0, backoff = 0, gone = false, lastJob = null;
   // MAX_MISSES IS A TIME BUDGET, NOT A COUNT, AND 3 WAS SHORTER THAN A RENDER (2026-08-24). With the backoff
@@ -1262,6 +1307,7 @@ const AD_RESULT_HTML = String.raw`<div id="root"></div>
     var guard = setTimeout(function () { if (settled) return; settled = true; timeouts++; backoff++; pollErr = 'timeout'; render(); }, POLL_TIMEOUT_MS); // a bridge that did not answer in 8s must not be hit again in 5
     api.callTool('get_job', { id: v.jobId }).then(once(function (r) {
       var d = jobFrom(r);
+      var pl = postLinksFrom(r); if (pl.length) postLinks = pl;
       if (d && typeof d === 'object' && d.status === 'not_found') { gone = true; return; }   // FINAL — one answer settles it; burning three misses on it would only delay the truth
       // A POLL ANSWER MUST BE A get_job RESULT, AND get_job ALWAYS CARRIES A status FIELD (2026-08-24).
       // Measured: 29 consecutive polls, every one readable, not one of them ever done, against a job that had
@@ -1351,7 +1397,9 @@ const AD_RESULT_HTML = String.raw`<div id="root"></div>
       return;
     }
     if (!body) { root.innerHTML = ''; stop(); collapse(); return; }
-    root.innerHTML = '<div class="card">' + body + footer + '</div>';
+    var _ol = postLinksFrom({ structuredContent: (window.openai && window.openai.toolOutput) || null }); if (_ol.length) postLinks = _ol;
+    var nextRow = (!v.pending && !v.error && postLinks.length) ? '<div class="next"><span>Post this:</span>' + postLinks.map(function (l) { return '<a class="dl" href="' + esc(l.url) + '" target="_blank" rel="noopener">' + esc(l.label) + '</a>'; }).join('') + '</div>' : '';
+    root.innerHTML = '<div class="card">' + body + footer + nextRow + '</div>';
     if (v.pending) { schedule(); } else { stop(); }
   }
   render();
@@ -3546,11 +3594,14 @@ function registerChatGPTExtensions(rawServer, ctx, opts) {
     // unchanged (awaitRenderJob reads waitMs only after submitJob).
     call: (name, args, extra, o) => {
       const s = ctx.srcOf[name]; if (!s || typeof s.handler !== 'function') return null;
-      const run = () => s.handler(args || {}, extra);
+      // connectPromptQuiet: the app reads through the tool handlers, and that answer goes to a screen rather than the
+      // model, so it must not spend a showing of the "post this" next step (withConnectPrompt).
+      const run = () => { const cur = mcpCtx.getStore(); return cur ? mcpCtx.run({ ...cur, connectPromptQuiet: true }, () => s.handler(args || {}, extra)) : s.handler(args || {}, extra); };
       const store = o && o.noWait ? mcpCtx.getStore() : null;
       return store ? mcpCtx.run({ ...store, waitMs: 0 }, run) : run();
     },
     prefs: { read: () => readStore(EXT_PREFS_KEY), write: (v) => writeStore(EXT_PREFS_KEY, v) },
+    markHomeConnectCard: () => apiPost('/api/mcp/connect-prompt/home', {}),
   });
   installEntrypointIcons(rawServer);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hermoso",
-  "version": "0.1.495",
+  "version": "0.1.496",
   "mcpName": "io.github.hermoso-ai/hermoso",
   "description": "AI marketing agent and AI ad generator, run from your own AI agent. 1109 tools. No markup on models on Starter and up. Publishing, scheduling, ad campaign management, comments, DMs and analytics cost no credits on any plan; Free includes 30 posts a month and every paid plan posts without a limit. AD PLATFORMS: Meta, Google Ads, TikTok Ads, LinkedIn Ads, Reddit Ads, X Ads, Pinterest Ads, Snapchat Ads, Microsoft Advertising, Apple Search Ads, ChatGPT Ads and AppLovin Ads, plus product feeds in Google Merchant Center. PUBLISHING AND SCHEDULING: Facebook, Instagram, Threads, TikTok, YouTube, X, LinkedIn, Pinterest, Bluesky, Telegram and Google Business Profile. INSTAGRAM DM AUTOMATIONS: a keyword comment, a DM, a story reply or an ig.me link gets an automatic private reply from the brand. AD RESEARCH: the Meta, Google and LinkedIn ad libraries plus organic TikTok, Instagram, YouTube, Threads and Reddit. ANALYTICS: Google Analytics 4, Google Search Console and every connected platform's own post and campaign insights. Also brand onboarding, 50+ image and video generation models, ad scoring, competitor teardowns, Google Drive and OneDrive, a CLI and installable Claude skills.",
   "type": "module",