hermoso 0.1.90 → 0.1.112

package/README.md

@@ -5,7 +5,7 @@ scripts. Research the ads already winning in a market, generate finished image &
 composited in, copy + CTA included), publish them to your own social channels, and build & manage the ad
 campaigns behind them — all over [MCP](https://modelcontextprotocol.io) tools, a CLI, or installable Claude skills.
 
-**427 tools.** `tools/list` is always the authoritative set; `hermoso_capabilities` (free) returns the live model
+**519 tools.** `tools/list` is always the authoritative set; `hermoso_capabilities` (free) returns the live model
 catalog with exact per-render credit costs plus the full capability map.
 
 **It is not all-or-nothing.** Research, creation, publishing/scheduling and ads management are four *independent*
@@ -53,7 +53,7 @@ Cursor / Codex — add to `mcp.json` (Codex uses the TOML equivalent):
 
 Then ask your agent: *“Generate an image ad with Hermoso.”*
 
-### What the 427 tools cover
+### What the 519 tools cover
 
 **Ad spy / research** — `find_competitors`, `competitor_teardown`, `pull_competitor_ads`, `research_ads`; the
 Meta / Google / LinkedIn ad libraries (`search_meta_ads`, `search_google_ads`, `search_linkedin_ads`); organic

package/mcp/hermoso-mcp.mjs

@@ -2,8 +2,8 @@
 // Hermoso MCP server (stdio transport) — lets Claude Code / Cursor / Codex (and any stdio MCP client) drive Hermoso:
 // research competitors, plan ads, and generate images/videos/avatars, all against the running Hermoso server.
 //
-//   Local (today):   node mcp/hermoso-mcp.mjs            # talks to https://app.hermoso.ai (HERMOSO_API_BASE to override, e.g. http://localhost:3000 when self-running)
-//   Auth (today):    none — the local server resolves the dev account. Set HERMOSO_TOKEN once real auth lands.
+//   Local (today):   node mcp/hermoso-mcp.mjs            # talks to http://localhost:3000 (HEIST_API_BASE to override)
+//   Auth (today):    none — the local server resolves the dev account. Set HEIST_TOKEN once real auth lands.
 //
 // stdout is the JSON-RPC channel — NEVER print to it. All logging goes to stderr (console.error).
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
@@ -17,11 +17,15 @@ const server = new McpServer({ name: 'hermoso-mcp', version: '1.0.0' }, {
   instructions: MCP_INSTRUCTIONS,
 });
 
-// Optional roster scoping, same groups as the hosted connector's ?tools= (see registerTools). A client that
-// loads every tool definition eagerly spends ~154k tokens on the full roster; HERMOSO_TOOLS=channels,ads narrows it.
+// Roster scoping, same groups as the hosted connector's ?tools= (see registerTools). The DEFAULT is every group
+// except `ads` — 238 of the 436 tools and ~66% of the schema weight — which takes an eagerly-loading client from
+// ~235k tokens to ~83k. Nothing is lost: `enable_tools` switches a group on mid-session with no reconnect.
+// HERMOSO_TOOLS=all restores the full roster; HERMOSO_TOOLS=create,channels narrows it further.
 // An unknown group EXITS rather than silently serving all of them — a scoped connection you did not get is
 // worse than one you were told you could not have.
-const _scope = parseToolScope(process.env.HERMOSO_TOOLS);
+// Both env names are read: HERMOSO_TOOLS is the current prefix, HEIST_TOOLS the pre-rebrand one that is live in
+// people's configs today. Renaming a variable someone already set is how a working setup goes quiet.
+const _scope = parseToolScope(process.env.HERMOSO_TOOLS || process.env.HEIST_TOOLS);
 if (_scope.error) { console.error(`[hermoso-mcp] ${_scope.error}`); process.exit(1); }
 registerTools(server, { only: _scope.groups });
 

package/mcp/http.mjs

@@ -5,11 +5,11 @@
 //
 // It is written so the cloud step is a CONFIG FLIP, not a rewrite — but it is intentionally OFF and will REFUSE
 // to mount until BOTH are true:
-//   (1) HERMOSO_MCP_REMOTE=1, and
+//   (1) HEIST_MCP_REMOTE=1, and
 //   (2) a real token verifier is wired (verifyBearer) — i.e. Firebase Auth (or equivalent) is configured.
 // Why it must stay off locally: a public money-spending endpoint cannot exist without authenticated identity
 // (the no-anon-spend rule), there is no hosted origin yet, and per the rollout plan cloud is provisioned
-// COLLABORATIVELY, never solo. Until then, use the local stdio server (mcp/hermoso-mcp.mjs) + the CLI + skills.
+// COLLABORATIVELY, never solo. Until then, use the local stdio server (mcp/heist-mcp.mjs) + the CLI + skills.
 //
 // When the cloud step happens, the remaining work is small and explicit (see ENABLE CHECKLIST at the bottom).
 // ───────────────────────────────────────────────────────────────────────────────────────────────────────
@@ -22,19 +22,19 @@ import { mcpCtx } from './client.mjs';
 // Mount the remote connector onto the Express app. No-op unless explicitly enabled + auth-backed.
 // `verifyBearer(token) -> {userId, accountId, email} | null` MUST be supplied by the caller (the real auth seam).
 export function mountRemoteMcp(app, { verifyBearer, publicBaseUrl } = {}) {
-  if (process.env.HERMOSO_MCP_REMOTE !== '1') return false;             // gate 1: off by default
+  if (process.env.HEIST_MCP_REMOTE !== '1') return false;             // gate 1: off by default
   if (typeof verifyBearer !== 'function') {                           // gate 2: refuse without real auth
     console.error('[mcp-remote] REFUSING to mount: no token verifier wired. A remote, money-spending MCP must authenticate every caller (no-anon-spend). Wire Firebase Auth → verifyBearer first.');
     return false;
   }
-  const BASE = (publicBaseUrl || process.env.HERMOSO_PUBLIC_URL || '').replace(/\/+$/, '');
+  const BASE = (publicBaseUrl || process.env.HEIST_PUBLIC_URL || '').replace(/\/+$/, '');
 
   // RFC 9728 protected-resource metadata — tells Claude.ai where to get a token. (Authorization-server metadata
   // is served by the auth provider itself, e.g. Firebase/your IdP.) Scopes match the AS metadata + minted token
   // (mcp/oauth.mjs): hermoso.research / hermoso.generate.
   app.get('/.well-known/oauth-protected-resource', (req, res) => res.json({
     resource: `${BASE}/mcp`,
-    authorization_servers: [process.env.HERMOSO_OAUTH_ISSUER].filter(Boolean),
+    authorization_servers: [process.env.HEIST_OAUTH_ISSUER].filter(Boolean),
     scopes_supported: ['hermoso.research', 'hermoso.generate'],
     bearer_methods_supported: ['header'],
   }));
@@ -109,8 +109,13 @@ export function mountRemoteMcp(app, { verifyBearer, publicBaseUrl } = {}) {
   };
   // `?tools=research,create` narrows the roster this connection advertises (see registerTools). Read here rather
   // than inside registerTools so BOTH the anonymous discovery handshake and a real session honour the same query,
-  // and so an unknown group is refused at the door with the valid list instead of silently serving all 301.
-  // The scope is fixed at initialize and stored on the session: tools/list must not change under a live client.
+  // and so an unknown group is refused at the door with the valid list instead of silently serving every group.
+  // ABSENT, the DEFAULT is every group except `ads` (2026-08-16) — 238 tools and ~66% of the schema weight, which
+  // takes an eagerly-loading client from ~235k tokens to ~83k. `?tools=all` restores the full roster.
+  // The scope fixed here is the STARTING roster, not a cage: `enable_tools` widens it mid-session and the SDK
+  // notifies the client. That is deliberate — the old comment's "tools/list must not change under a live client"
+  // was the right instinct for a scope the SERVER changes silently, and the wrong one for a change the CLIENT
+  // asked for and is told about.
   function scopeFor(req, res) {
     const { groups, error } = parseToolScope(req.query?.tools ?? req.headers['x-hermoso-tools']);
     if (error) { res.status(400).json({ jsonrpc: '2.0', error: { code: -32602, message: error }, id: null }); return false; }
@@ -179,7 +184,7 @@ export function mountRemoteMcp(app, { verifyBearer, publicBaseUrl } = {}) {
     }
     // The caller's bearer rides into every /api call the tools make — spend bills THEIR account. `remote: true`
     // says what this store IS: a per-request tenant scope on a shared, multi-tenant process. client.mjs treats the
-    // presence of this store as the signal to STOP falling back to the process's own HERMOSO_PROFILE / HERMOSO_OWNER,
+    // presence of this store as the signal to STOP falling back to the process's own HEIST_PROFILE / HEIST_OWNER,
     // which belong to whoever runs the box, not to whoever is calling.
     //
     // NOTE WHAT IS DELIBERATELY *NOT* HERE: a profile or an owner read off the request. There is nowhere honest to
@@ -190,14 +195,14 @@ export function mountRemoteMcp(app, { verifyBearer, publicBaseUrl } = {}) {
     await mcpCtx.run({ token, remote: true }, () => entry.transport.handleRequest(req, res, req.body));
   });
 
-  console.error(`[mcp-remote] mounted at ${BASE || '(set HERMOSO_PUBLIC_URL)'}/mcp`);
+  console.error(`[mcp-remote] mounted at ${BASE || '(set HEIST_PUBLIC_URL)'}/mcp`);
   return true;
 }
 
 // ── ENABLE CHECKLIST (cloud step, collaborative) ──────────────────────────────────────────────────────────
-//  1. Provision a hosted origin (Cloud Run) + Firebase Auth; set HERMOSO_PUBLIC_URL + HERMOSO_OAUTH_ISSUER.
+//  1. Provision a hosted origin (Cloud Run) + Firebase Auth; set HEIST_PUBLIC_URL + HEIST_OAUTH_ISSUER.
 //  2. Implement verifyBearer(token) via the Firebase auth adapter (adapters/auth/firebase.js) and pass it here.
 //  3. Thread the authenticated user into mcp/client.mjs's outbound /api calls (AsyncLocalStorage) so reserve()/
 //     gateSpend bill the right account — the server-side enforcement is already authoritative once req.user is real.
-//  4. Set HERMOSO_MCP_REMOTE=1. Then in server.js: `import { mountRemoteMcp } from './mcp/http.mjs'; mountRemoteMcp(app, { verifyBearer, publicBaseUrl })`.
-//  5. The published connector URL becomes `${HERMOSO_PUBLIC_URL}/mcp` — paste into Claude.ai → Settings → Connectors.
+//  4. Set HEIST_MCP_REMOTE=1. Then in server.js: `import { mountRemoteMcp } from './mcp/http.mjs'; mountRemoteMcp(app, { verifyBearer, publicBaseUrl })`.
+//  5. The published connector URL becomes `${HEIST_PUBLIC_URL}/mcp` — paste into Claude.ai → Settings → Connectors.