hermoso 0.1.533 → 0.1.535

package/README.md

@@ -22,29 +22,54 @@ campaigns behind them, all over [MCP](https://modelcontextprotocol.io) tools, a
 - **Posting.** Post and schedule to your own social channels, then read each post's results. The channel list
   is under *What it connects to* below.
 
-## Set up in Claude, ChatGPT or Cursor
+## Set up in ChatGPT, Claude, Grok Bot or a coding agent
+
+**ChatGPT:** one click. **[Add to ChatGPT](https://chatgpt.com/plugins/plugin_asdk_app_6abde87d08048191b2ee7cda76721749)** opens Hermoso in ChatGPT's app
+directory. Press Install plugin and sign in with your Hermoso account, no key needed. Then
+**[open a new ChatGPT chat with your first message typed](https://chatgpt.com/?q=Hermoso%2C%20set%20up%20my%20brand%20from%20my%20website%20and%20make%20my%20first%20ad)**, or paste it yourself:
+`Hermoso, set up my brand from my website and make my first ad`
 
 **Claude (claude.ai, Claude Desktop):** one click. **[Add to Claude](https://claude.ai/customize/connectors?modal=add-custom-connector&connectorName=Hermoso&connectorUrl=https%3A%2F%2Fapp.hermoso.ai%2Fmcp%3Fsrc%3Dreadme)**
 opens Claude's *Add custom connector* dialog with Hermoso already filled in. Press Continue, choose **Sign in now**
 if Claude asks about Authentication, then sign in with your Hermoso account.
 
-By hand: Customize → Connectors → Add → *Add custom connector*, paste the URL below, choose **Sign in now** under
+**Grok Bot:** it cannot open the Hermoso sign-in page, so it signs in with a key. **[Create a key](https://app.hermoso.ai/?tab=api-keys)**,
+then **[add the Hermoso Marketing Bot](https://x.ai/bot/THQqogUKuhn1whWU0hrmb)** and paste the key when it asks.
+
+**Claude Code, Cursor, Codex and other coding agents:** one prompt. Paste this into a new chat and the agent installs
+Hermoso, opens the sign-in and makes your first ad (this is Claude Code's install line; each agent's own is in the app
+under MCP & CLI, and in [Install in one command](#install-in-one-command)):
+
+```text
+Set up Hermoso for me. It is an AI marketing tool (hermoso.ai) that researches ads, makes image and video ads and posts to my social accounts.
+1. Install it by running: claude plugin marketplace add hermoso-ai/hermoso && claude plugin install hermoso@hermoso
+   If the new skills only load after a restart, tell me, and use npx meanwhile.
+2. Sign me in by running: npx -y hermoso auth login
+   It opens my browser and I will approve the connection there. If this machine has no browser, ask me for a Hermoso API key and run npx -y hermoso auth login --token <key> instead.
+3. Once I am signed in, do one small task to show it works: tell me my Hermoso credit balance and which profile is saved.
+4. Then set up my brand from my website and make my first ad.
+```
+
+<details>
+<summary>Set it up by hand</summary>
+
+**Claude by hand:** Customize → Connectors → Add → *Add custom connector*, paste the URL below, choose **Sign in now** under
 Authentication, then Add and Connect. On a Team or Enterprise plan an Owner adds it for the organization first.
 
 ```text
 https://app.hermoso.ai/mcp
 ```
 
+**ChatGPT by hand:** turn on Developer mode once (Settings → Security and login), then Plugins → ＋ → Create app →
+Create MCP App. Paste `https://app.hermoso.ai/mcp` as the Server URL, choose OAuth, leave the advanced OAuth
+settings empty, and press Create.
+
 **Claude Code:**
 
 ```bash
 claude plugin marketplace add hermoso-ai/hermoso && claude plugin install hermoso@hermoso
 ```
 
-**ChatGPT:** turn on Developer mode once (Settings → Security and login), then Plugins → ＋ → Create app →
-Create MCP App. Paste `https://app.hermoso.ai/mcp` as the Server URL, choose OAuth, leave the advanced OAuth
-settings empty, and press Create.
-
 **Cursor:**
 
 ```bash
@@ -57,6 +82,8 @@ Or add the MCP server to Cursor's `mcp.json` after `npx -y hermoso auth login`:
 { "mcpServers": { "hermoso": { "command": "npx", "args": ["-y", "hermoso", "mcp"] } } }
 ```
 
+</details>
+
 Codex, Gemini CLI, Grok and the rest are in [Install in one command](#install-in-one-command).
 
 ## Examples
@@ -71,7 +98,7 @@ Ask in your own words. The agent picks the tools:
 - "Compare last week's Google Ads and Meta Ads results and tell me what to pause."
 - "Schedule this video to TikTok, Instagram Reels and YouTube Shorts for Tuesday at 9am."
 
-**1231 tools.** `tools/list` is always the authoritative set; `hermoso_capabilities` (free) returns the live model
+**1233 tools.** `tools/list` is always the authoritative set; `hermoso_capabilities` (free) returns the live model
 catalog with exact per-render credit costs plus the full capability map.
 
 **No markup on models** on Starter, Pro and Studio. Stop overpaying markups on AI models. Plans: [hermoso.ai/pricing](https://hermoso.ai/pricing).
@@ -311,7 +338,7 @@ block entirely if you signed in above; it is there for CI, where the process can
 
 Then ask your agent: *“Generate an image ad with Hermoso.”*
 
-### What the 1231 tools cover
+### What the 1233 tools cover
 
 **Ad spy / research** — `find_competitors`, `competitor_teardown`, `pull_competitor_ads`, `research_ads`; the
 Meta / Google / LinkedIn ad libraries (`search_meta_ads`, `search_google_ads`, `search_linkedin_ads`); organic

package/mcp/brand-look.mjs

@@ -0,0 +1,120 @@
+// ── THE BRAND'S FONTS AND COLOURS, EDITABLE EVERYWHERE (2026-11-13) ─────────────────────────────────────────────
+//
+// A paying customer wrote in: his profile still held the fonts and palette the site scrape guessed at onboarding,
+// and nothing let him change them. The Profile showed only the free-text "Visual style", and update_brand had no
+// fonts or palette field. These are the two parsers every door now goes through: the MCP twins (so the CLI and
+// /v1/tools), the Studio agent's update_brand, the web Profile (its own inline copy, pinned to these fixtures by
+// tools/brand-look-check.mjs) and the admin brand-field route.
+//
+// It lives in mcp/ rather than lib/ for the reason roster-scope.mjs does: the npm package ships `cli/mcp/**` and
+// nothing else, so `./brand-look.mjs` is the one path that resolves from BOTH tools.mjs twins. cli/mcp/brand-look.mjs
+// is its byte twin (tools/mcp-parity.mjs sweeps every shared file).
+//
+// THE STORED SHAPES DO NOT CHANGE. `fonts` stays what the onboarding draft writes: an ORDERED array of family names,
+// headline face first, body face second (templates/font-map.mjs reads it positionally). `palette` stays an array of
+// hex strings. Both doors are accepted for fonts: the array as stored, or {headline, body}, which is merged onto the
+// fonts already saved so changing one role leaves the other alone.
+//
+// NOTHING THE USER WROTE IS SILENTLY CHANGED. A value is trimmed and otherwise kept exactly as typed (case included);
+// anything we cannot use is REFUSED with a sentence that names it, and nothing is saved. A short hex (#abc) or one
+// without its # is refused rather than expanded, because every renderer reads the six-digit form only.
+
+export const PALETTE_MAX = 8;
+export const FONTS_MAX = 4;
+export const FONT_NAME_MAX = 60;
+export const HEX_RE = /^#[0-9a-fA-F]{6}$/;
+
+const s = (v) => (typeof v === 'string' ? v : v == null ? '' : String(v));
+const show = (v) => JSON.stringify(s(v).slice(0, 40));
+
+/** One colour → '' when usable, else the sentence saying why not. Pure. */
+export function hexRefusal(v) {
+  if (typeof v !== 'string') return `Each colour must be written as text like "#3D4C41".`;
+  const t = v.trim();
+  if (!t) return 'A colour is empty. Remove it or write it like "#3D4C41".';
+  if (HEX_RE.test(t)) return '';
+  if (/^[0-9a-fA-F]{6}$/.test(t)) return `${show(t)} needs a # in front: "#${t}".`;
+  if (/^#?[0-9a-fA-F]{3}$/.test(t)) return `${show(t)} is a short colour code. Write all six digits, like "#AABBCC".`;
+  return `${show(t)} is not a colour code. Write it as # and six digits or letters A–F, like "#3D4C41".`;
+}
+
+/**
+ * The palette a caller asked for → { value } (the array to store) or { error }. An empty array clears it. Pure.
+ */
+export function parseBrandPalette(input) {
+  if (input == null) return { error: 'palette must be a list of colour codes, like ["#3D4C41", "#EEE4DA"].' };
+  const list = typeof input === 'string' ? input.split(/[\s,]+/).filter(Boolean) : input;
+  if (!Array.isArray(list)) return { error: 'palette must be a list of colour codes, like ["#3D4C41", "#EEE4DA"].' };
+  if (list.length > PALETTE_MAX) return { error: `A palette holds up to ${PALETTE_MAX} colours; this one has ${list.length}.` };
+  const out = [], seen = new Set();
+  for (const c of list) {
+    const why = hexRefusal(c);
+    if (why) return { error: why };
+    const t = c.trim();
+    if (seen.has(t.toLowerCase())) return { error: `${t} is in the palette twice.` };
+    seen.add(t.toLowerCase()); out.push(t);
+  }
+  return { value: out };
+}
+
+/** One font name → '' when usable, else the sentence saying why not. Any family name is accepted. Pure. */
+export function fontNameRefusal(v) {
+  if (typeof v !== 'string') return 'Each font must be a family name written as text, like "Josefin Sans".';
+  const t = v.trim();
+  if (!t) return 'A font name is empty.';
+  if (t.length > FONT_NAME_MAX) return `${show(t)}… is longer than ${FONT_NAME_MAX} characters; write just the family name.`;
+  // Characters that would end a CSS family name or a prompt line. Letters in any alphabet, digits, spaces, hyphens,
+  // dots, ampersands and apostrophe-free punctuation stay; nothing is stripped, the name is refused instead.
+  if (/[\u0000-\u001f"'`<>{};\\]/.test(t)) return `${show(t)} contains a character a font name cannot have (quotes, < > { } ; or \\).`;
+  return '';
+}
+
+/**
+ * The fonts a caller asked for → { value } (the ordered array to store) or { error }.
+ * `input` is an array (headline first, body second, as stored) or { headline, body } merged onto `existing`;
+ * an empty string in the object form removes that role. An empty array clears the fonts. Pure.
+ */
+export function parseBrandFonts(input, existing = []) {
+  const cur = (Array.isArray(existing) ? existing : []).filter((x) => typeof x === 'string' && x.trim());
+  if (Array.isArray(input)) {
+    if (input.length > FONTS_MAX) return { error: `Up to ${FONTS_MAX} fonts; the first is used for headlines and the second for body text.` };
+    const out = [];
+    for (const f of input) { const why = fontNameRefusal(f); if (why) return { error: why }; const t = f.trim(); if (out.some((o) => o.toLowerCase() === t.toLowerCase())) return { error: `${t} is listed twice.` }; out.push(t); }
+    return { value: out };
+  }
+  if (input && typeof input === 'object') {
+    const keys = Object.keys(input).filter((k) => input[k] !== undefined);
+    const bad = keys.filter((k) => k !== 'headline' && k !== 'body');
+    if (bad.length) return { error: `fonts takes headline and body (or a list); ${bad.map((k) => JSON.stringify(k)).join(', ')} is not one of them.` };
+    if (!keys.length) return { error: 'fonts needs a headline or a body font (or a list).' };
+    let head = cur[0] || '', body = cur[1] || '';
+    const rest = cur.slice(2);
+    for (const role of ['headline', 'body']) {
+      if (input[role] === undefined) continue;
+      const v = input[role] == null ? '' : input[role];
+      if (typeof v === 'string' && !v.trim()) { if (role === 'headline') head = ''; else body = ''; continue; }
+      const why = fontNameRefusal(v); if (why) return { error: why };
+      if (role === 'headline') head = v.trim(); else body = v.trim();
+    }
+    // A body font with no headline font keeps its place as the one face; the order is what renderers read.
+    const out = [head, body, ...rest].filter(Boolean);
+    const dedup = []; for (const f of out) if (!dedup.some((d) => d.toLowerCase() === f.toLowerCase())) dedup.push(f);
+    return { value: dedup };
+  }
+  if (typeof input === 'string') return { error: 'fonts takes a list (headline first, then body) or {headline, body}, not a single string.' };
+  return { error: 'fonts takes a list (headline first, then body) or {headline, body}.' };
+}
+
+/** The roles an ordered font list carries: the first is the headline face, the second the body face. Pure. */
+export function brandFontRoles(fonts) {
+  const f = (Array.isArray(fonts) ? fonts : []).filter((x) => typeof x === 'string' && x.trim()).map((x) => x.trim());
+  return { headline: f[0] || '', body: f[1] || f[0] || '', extra: f.slice(2) };
+}
+
+/** "Benne (headlines), Josefin Sans (body)" — how a reply, get_brand and the planner name the fonts. Pure. */
+export function describeBrandFonts(fonts) {
+  const f = (Array.isArray(fonts) ? fonts : []).filter((x) => typeof x === 'string' && x.trim()).map((x) => x.trim());
+  if (!f.length) return '';
+  if (f.length === 1) return `${f[0]} (headlines and body)`;
+  return [`${f[0]} (headlines)`, `${f[1]} (body)`, ...f.slice(2)].join(', ');
+}

package/mcp/client.mjs

@@ -179,7 +179,7 @@ async function unwrap(res, { read = false } = {}) {
     // ledger with the tool name off x-hermoso-tool. wrap() reports ONLY the errors that lack this marker — a local
     // throw, a schema rejection, a socket reset — which is what stops the twins double-counting every 4xx.
     // `connectUrl` rides a not-connected 401 with the brand already in it, so a hint never rebuilds the link.
-    throw Object.assign(new Error(msg), { status: res.status, _viaApi: true, ...(res.status === 429 ? { retryAfter: Number(body?.retryAfter) || Number(res.headers?.get?.('retry-after')) || 60 } : {}), ...(typeof body?.code === 'string' ? { apiCode: body.code } : {}), ...(body?.connector ? { connector: body.connector } : {}), ...(typeof body?.connectUrl === 'string' ? { connectUrl: body.connectUrl } : {}), ...(body?.meta?.videoChoice && typeof body.meta.videoChoice === 'object' ? { videoChoice: body.meta.videoChoice } : {}), ...(body?.metaAuthHold === true ? { metaAuthHold: true } : {}), ...(body?.meta?.welcomeClaim && typeof body.meta.welcomeClaim === 'object' && body.meta.welcomeClaim.url ? { welcomeClaim: { credits: Number(body.meta.welcomeClaim.credits) || 0, url: String(body.meta.welcomeClaim.url) } } : {}), ...(body?.remedy && typeof body.remedy === 'object' && typeof body.remedy.code === 'string' ? { remedy: body.remedy } : {}), ...(body?.buy && typeof body.buy === 'object' && body.buy.pack ? { buy: body.buy } : {}) }); // `buy` (2026-11-12): the two priced doors a balance refusal carries (server buyDoorsFor): a pack and a plan, each with its price and a checkout link // `remedy` (2026-10-25): the server's structured next step (a publish outcome, Meta's security hold), handed on whole to wrap()'s _meta and /v1 // `videoChoice` rides a 402 for a video the caller expects and cannot afford (server videoChoiceFor) — wrap() spells its options out instead of a bare top-up line
+    throw Object.assign(new Error(msg), { status: res.status, _viaApi: true, ...(res.status === 429 ? { retryAfter: Number(body?.retryAfter) || Number(res.headers?.get?.('retry-after')) || 60 } : {}), ...(typeof body?.code === 'string' ? { apiCode: body.code } : {}), ...(body?.connector ? { connector: body.connector } : {}), ...(typeof body?.connectUrl === 'string' ? { connectUrl: body.connectUrl } : {}), ...(body?.meta?.videoChoice && typeof body.meta.videoChoice === 'object' ? { videoChoice: body.meta.videoChoice } : {}), ...(body?.metaAuthHold === true ? { metaAuthHold: true } : {}), ...(body?.meta?.rewardsSettled && typeof body.meta.rewardsSettled === 'object' ? { rewardsSettled: { credits: Number(body.meta.rewardsSettled.credits) || 0 } } : {}), ...(body?.meta?.welcomeClaim && typeof body.meta.welcomeClaim === 'object' && body.meta.welcomeClaim.url ? { welcomeClaim: { credits: Number(body.meta.welcomeClaim.credits) || 0, url: String(body.meta.welcomeClaim.url) } } : {}), ...(body?.remedy && typeof body.remedy === 'object' && typeof body.remedy.code === 'string' ? { remedy: body.remedy } : {}), ...(body?.buy && typeof body.buy === 'object' && body.buy.pack ? { buy: body.buy } : {}) }); // `buy` (2026-11-12): the two priced doors a balance refusal carries (server buyDoorsFor): a pack and a plan, each with its price and a checkout link // `remedy` (2026-10-25): the server's structured next step (a publish outcome, Meta's security hold), handed on whole to wrap()'s _meta and /v1 // `videoChoice` rides a 402 for a video the caller expects and cannot afford (server videoChoiceFor) — wrap() spells its options out instead of a bare top-up line
   }
   // WHAT THIS CALL WAS CHARGED (2026-10-19). A paid route answers {data, creditsUsed}, and the unwrap below drops the
   // sibling, so a synchronous paid tool's reply could never say what it cost. It is added to the running tool call's

package/mcp/http.mjs

@@ -177,7 +177,36 @@ const inflightNameOf = (body) => { const msgs = Array.isArray(body) ? body : [bo
   const rpcCancelledIdKeys = (body) => (Array.isArray(body) ? body : [body]).filter((m) => m && m.method === 'notifications/cancelled' && m.params && m.params.requestId !== undefined && m.params.requestId !== null).map((m) => rpcIdKey(m.params.requestId));
   const GET_STREAM_MAX = Math.max(1, Number(process.env.MCP_GET_STREAM_MAX || 64));
   let openGetStreams = 0;
-  const streamStats = () => ({ open: openGetStreams, max: GET_STREAM_MAX, lifeMs: GET_STREAM_MS });
+  // ── A STOPPING OR RETIRED INSTANCE HANDS ITS STREAMS BACK, IT DOES NOT LET THEM BREAK (2026-11-13) ──────────────────
+  // On SIGTERM, and when this revision has lost the traffic (server.js, lib/pump-handover.mjs retiredVerdict), every open
+  // GET stream is ended CLEANLY with an SSE `retry:` field first, the spec's own reconnection hint, so the client reopens
+  // it at once and the reopen lands on the serving revision (a stream cut by process exit reads as a network error, and
+  // some clients back off). While draining, a new GET stream is answered 503 + Retry-After (it is optional, the spec lets a
+  // server refuse it) and POSTs are untouched: a tool call in flight is never cut by this, and a session id this instance
+  // holds keeps working until its own idle expiry. A session the client reopens elsewhere gets the 404 → re-initialize
+  // path below, which is how every deploy already ends a session. undrain() reverses it (a rollback brings the traffic back).
+  const openGetResponses = new Set();
+  let draining = '';
+  const RECONNECT_HINT_MS = 1000;
+  function drain(why = 'draining') {
+    if (!draining) console.error(`[mcp-remote] draining (${why}): ending ${openGetResponses.size} notification stream(s) with a reconnect hint`);
+    draining = String(why || 'draining');
+    let ended = 0;
+    for (const res of [...openGetResponses]) {
+      try {
+        if (!res.writableEnded && !res.destroyed) {
+          // An open 200 on a GET here IS the SDK's SSE stream (its headers go through writeHead, so getHeader cannot see them;
+          // any refusal it answers is JSON and already ended). Events are written whole, so a field between them is valid SSE.
+          if (res.headersSent && res.statusCode === 200) res.write(`retry: ${RECONNECT_HINT_MS}\n\n`);
+          res.end(); ended++;
+        }
+      } catch {}
+      openGetResponses.delete(res);
+    }
+    return { ended, sessions: sessions.size };
+  }
+  function undrain() { if (draining) console.error(`[mcp-remote] no longer draining (was: ${draining})`); draining = ''; }
+  const streamStats = () => ({ open: openGetStreams, max: GET_STREAM_MAX, lifeMs: GET_STREAM_MS, draining: draining || null });
   // THE 401 IS THE ONLY THING A STUCK AGENT EVER READS, so it carries the way out (2026-09-04). It used to be the
   // three words `Authentication required`, and that is exactly how far a real user got: a Cursor-based client
   // (Grok Bot) registered fine, listed all 160 tools, and then every call 401'd while its own consent card never
@@ -488,13 +517,18 @@ const inflightNameOf = (body) => { const msgs = Array.isArray(body) ? body : [bo
 
     // The stream cap, BEFORE any session work: a burst of reconnects must be refused at the door, not after allocating.
     if (req.method === 'GET') {
+      if (draining) {
+        res.set('Retry-After', '1');
+        return res.status(503).json({ error: 'This instance is handing over to a new one: reopen the stream (it reconnects to the new instance). Tool calls (POST) are unaffected.' });
+      }
       if (openGetStreams >= GET_STREAM_MAX) {
         res.set('Retry-After', '30');
         return res.status(503).json({ error: `This instance already holds ${openGetStreams} open notification streams — retry the stream in 30s. Tool calls (POST) are unaffected.` });
       }
       openGetStreams++;
       const t = setTimeout(() => { try { res.end(); } catch {} }, GET_STREAM_MS); if (t && typeof t.unref === 'function') t.unref();
-      res.once('close', () => { openGetStreams = Math.max(0, openGetStreams - 1); clearTimeout(t); });
+      openGetResponses.add(res);
+      res.once('close', () => { openGetStreams = Math.max(0, openGetStreams - 1); clearTimeout(t); openGetResponses.delete(res); });
     }
 
     const sid = req.headers['mcp-session-id'];
@@ -686,6 +720,7 @@ const inflightNameOf = (body) => { const msgs = Array.isArray(body) ? body : [bo
 
   console.error(`[mcp-remote] mounted at ${BASE || '(set HERMOSO_PUBLIC_URL)'}/mcp`);
   app.locals.mcpStreamStats = streamStats; // for the check and the admin read; the return value stays `true` as every caller asserts
+  app.locals.mcpDrain = drain; app.locals.mcpUndrain = undrain; // server.js: on SIGTERM and while this revision is retired
   return true;
 }
 

package/mcp/openai-extensions.mjs

@@ -1278,7 +1278,7 @@ export const neutralNote = (t) => {
 // sweeps and drift watches queued for later (measured on a fresh local account: one `agentidle` "nudge", queued for
 // tomorrow, would have shown as "1 render in progress"). Mirrors server.js JOB_TYPES_HIDDEN_FROM_V1, and the check
 // fails if that list gains a type this one lacks. A job queued for LATER is not in progress either.
-export const PANEL_HIDDEN_JOB_TYPES = Object.freeze(['shopifykeepalive', 'shopredact', 'fallate', 'storysweep', 'ttpublicurl', 'whatsappcoexsync', 'purge', 'agentidle', 'welcomewait', 'agentsetupmail', 'uploadretention', 'miniappretention', 'connectordrift', 'falwatch', 'faceassetsweep', 'searchvis', 'mcpcanary', 'welcomeads', 'lifecycleedu', 'connhealth', 'chargednothing', 'badoutcome', 'reviewask', 'emailfeedback', 'weeklyposts']);
+export const PANEL_HIDDEN_JOB_TYPES = Object.freeze(['shopifykeepalive', 'shopredact', 'fallate', 'storysweep', 'ttpublicurl', 'whatsappcoexsync', 'purge', 'agentidle', 'welcomewait', 'agentsetupmail', 'uploadretention', 'miniappretention', 'connectordrift', 'falwatch', 'faceassetsweep', 'searchvis', 'mcpcanary', 'welcomeads', 'lifecycleedu', 'connhealth', 'chargednothing', 'badoutcome', 'reviewask', 'emailfeedback', 'weeklyposts', 'winback']);
 const ageText = (h) => (h == null || !Number.isFinite(+h) ? '' : +h < 1 ? 'just now' : +h < 48 ? `${Math.round(+h)}h ago` : `${Math.round(+h / 24)}d ago`);
 const VIDEO_RE = /\.(mp4|webm|mov|m4v)([?#]|$)/i;
 const clip = (s, n) => { const t = String(s ?? '').replace(/\s+/g, ' ').trim(); return t.length > n ? t.slice(0, n - 1) + '…' : t; };

package/mcp/roster-scope.mjs

@@ -230,7 +230,7 @@ export const metaAlternativeNote = (name) => INSTAGRAM_LOGIN_TOOLS.has(String(na
 // The Shopify tools (list_shopify_products, publish_to_shopify_product, the marketing-activity tools) work only for an
 // account created by installing Hermoso from the Shopify App Store: the store is derived server-side from the verified
 // account and there is no "connect Shopify" tile. So they cannot ride TOOL_PROVIDER_RULES — every provider there must
-// be a CONNECTOR_INFO key (property 3), and "connect it under Settings ▸ Connectors" would be a dead end. Instead the
+// be a CONNECTOR_INFO key (property 3), and "connect it under Connectors" would be a dead end. Instead the
 // same /api/connectors/providers read answers `shopifyStore`: true (this account has a live store), false (it does not,
 // or Shopify is off on this deployment), or absent when the server could not tell. ONLY a definite false holds them
 // back — an unreadable answer keeps them, like every other read of this set (property 1). Held, they are answered by

package/mcp/tool-hints.mjs

@@ -1,6 +1,6 @@
 // ── HINTS: THE NEXT STEP, NAMED (2026-09-17) ───────────────────────────────────────────────────────────────────
 //
-// This product already tells an agent what to do next, constantly and well — "connect it under Settings ▸
+// This product already tells an agent what to do next, constantly and well — "connect it under
 // Connectors, then call again", "run buy_credits to top up", "call find_tools then call_tool", "reconnect with
 // ?tools=all". Every one of those is a SENTENCE inside a wall of other sentences, so reading it is a parsing job
 // an agent may or may not do. Monid rides a `Hints` block on its responses — server-suggested next command,