mcplane 0.5.0 → 0.6.0

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 0.6.0
+
+New ChatGPT checks
+- `server.widget-domain` (blocks): tools with a UI name resources (`_meta.ui.resourceUri` or `openai/outputTemplate`), and each one must set a widget domain, which OpenAI requires before you can submit a plugin with UI. Preflight now reads those resources; one that needs sign-in is skipped unless you pass `--token`. `openai/widgetDomain` and `ui.domain` both count.
+- `tools.file-viewer-wording` (warning): a tool with a file entrypoint described as a command ("Opens an HTML file…"). The model then calls it with a file path and ChatGPT refuses the read ("MCP app cannot read resource outside its widget scope"), as Stacktree's viewer did on 6 October. Say the user opens the file and name the tool for content the model can read.
+- `tools.sensitive-inputs`: an input called `password` that's really a passcode for something the tool makes gets the advice to call it `passcode`. ChatGPT's approval panel files `password` under "Account passwords".
+
+ChatGPT pack
+- Upload a new version from the plugin's own page (**Upload new version**, or **Upload plugin to make changes**). The Plugins page's upload area creates a second plugin even when the package name matches, which is how Stacktree ended up with two.
+- Published tool changes don't arrive on cue: on 6 October a Rescan left a published plugin's tool table on its reviewed list, and a published plugin's MCP card has no Reconnect. Check the MCPs tab lists new tools before submitting test cases that use them.
+- Don't fix a duplicate by deleting and uploading again: deleting can reserve the plugin's name (openai/codex#39508).
+
+Fewer false alarms
+- `tools.destructive-overwrite` skips verbs whose subject is a sibling tool ("update_site replaces a page in place" in another tool's description) and, like `tools.destructive-option`, expiry on a tool that creates. Stacktree's publish_html, which passed ChatGPT's scan, no longer warns.
+
+README
+- 2026-07-28 cache hints: a `tools/list` that differs by caller should be `cacheScope: "private"`.
+
+## 0.5.1
+
+New ChatGPT checks (warnings)
+- `tools.destructive-option`: a tool marked non-destructive whose input schema offers a destructive option (`burn_after_read`, delete, overwrite, revoke, purge and the like), read from property names, descriptions and enum values one level deep. ChatGPT's scan flagged exactly that, and removing the option from the advertised schema cleared it. An expiry on a tool that creates something isn't flagged.
+- `tools.money-crypto`: tools that move money or handle crypto wallets, signing or stablecoins. ChatGPT's submit step has you attest to neither. Prices, pricing pages and billing links aren't flagged.
+
+Packs and drift
+- ChatGPT: the tool scan's timing and spinner, what "Needs further review" means, unclear tool names, and that a rescan doesn't update a submission in review (cancel, reconnect, resubmit). `drift` says so for a snapshot still in review.
+- Muse: Meta's developer portal at muse.ai/platform, its stages and three requirements, the 5 October intake questions, and per-tool Read/Write annotations drafted from your hints until the portal takes them.
+
 ## 0.5.0
 
 New command

package/README.md

@@ -77,7 +77,7 @@ npx mcplane fleet --root ~/Projects
 | Claude connectors | **Prepares** every field of the directory form | Tool changes are live on deploy; listing edits (tool names included) are reviewed |
 | Claude plugins | **Prepares** and checks the plugin repo | The portal tracks your branch; drift tells you a new version is waiting for review |
 | Cursor | **Prepares** and checks the plugin repo | Pinned to the commit first added; drift flags when you've moved on |
-| Muse | **Prepares** the form | Flags changes |
+| Muse | **Prepares** the form for Meta's developer portal, what its three requirements ask for, and per-tool Read/Write annotations to keep alongside the connector | Flags changes; Meta hasn't published an update process |
 | Vercel Connect | **Checks** your OAuth discovery documents against Vercel's Required, Recommended and Optional tiers, and **prepares** Submit a Service: every field, the OAuth method as Connect will discover it, and the token test each OAuth method needs | Listing edits go back through review (Edit and Resubmit); tools aren't listed, so they can change freely |
 | awesome-remote-mcp-servers | The three-line entry with your Glama connector badge and auth marker, ready for the PR | |
 | Cline, Glama, LobeHub, Smithery, Docker, awesome-mcp-servers | The prefilled issue, `glama.json`, CLI command or entry | |
@@ -89,10 +89,10 @@ npx mcplane fleet --root ~/Projects
 
 Checks come from real rejections, most of them ours:
 
-- **Server**: `initialize`, `tools/list` and `ping` work. An OAuth server that initializes without a token also lists its tools without one (the half-way state leaves a new ChatGPT connector stuck on "no actions available"). Unknown methods return `-32601` (OpenAI's tool scan probes `server/discover` and gives up on a crash). The URL works with a trailing slash. CORS preflight answers. Automated clients aren't blocked by a bot filter. A TLS 1.2 client connects. DNS doesn't advertise Encrypted ClientHello, which review proxies reset without a trace in your logs.
+- **Server**: `initialize`, `tools/list` and `ping` work. An OAuth server that initializes without a token also lists its tools without one (the half-way state leaves a new ChatGPT connector stuck on "no actions available"). Unknown methods return `-32601` (OpenAI's tool scan probes `server/discover` and gives up on a crash). The URL works with a trailing slash. CORS preflight answers. Automated clients aren't blocked by a bot filter. A TLS 1.2 client connects. DNS doesn't advertise Encrypted ClientHello, which review proxies reset without a trace in your logs. Tools with a UI name resources that set a widget domain, which OpenAI requires before you can submit a plugin with UI.
 - **OAuth**: unauthenticated calls get `401` with `resource_metadata`. Protected-resource and authorization-server metadata resolve, and PKCE S256 is supported. With `--register`, Dynamic Client Registration is tested, including the `cursor://` and other native redirect schemes that locked out every desktop client for us.
 - **Sign-in chain**: plain GETs, the way a reviewer's browser goes: the authorization endpoint, the sign-in page it sends people to, and the identity-provider hosts that page loads. A bot challenge (`cf-mitigated: challenge`) or a 403 anywhere on it is flagged: every MCP check can pass while reviewers never reach your sign-in page. Nothing signs in and no client is registered, so an authorization server that wants a registered client stops the walk at its error page: name your sign-in pages in `server.signIn` (or `--sign-in <url>`) and they're checked too. A pass from your own network proves less than one from a cloud VM or CI.
-- **Tools**: every tool has a title and explicit `readOnlyHint`, `destructiveHint` and `openWorldHint`, and the hints are consistent. Tools declare `outputSchema`. Descriptions don't instruct the model. Writes aren't authorised by a token passed through the chat (Anthropic rejected exactly that). Hints follow OpenAI's current definitions: `openWorldHint` for public or open-ended destinations (read-only web search included; connectivity alone doesn't decide it), `destructiveHint` for messages that can't be unsent and for overwriting, revoking access or deleting. No catch-all request tools, no tool names over 64 characters, no sensitive inputs, no upgrade or pricing copy.
+- **Tools**: every tool has a title and explicit `readOnlyHint`, `destructiveHint` and `openWorldHint`, and the hints are consistent. Tools declare `outputSchema`. Descriptions don't instruct the model. Writes aren't authorised by a token passed through the chat (Anthropic rejected exactly that). Hints follow OpenAI's current definitions: `openWorldHint` for public or open-ended destinations (read-only web search included; connectivity alone doesn't decide it), `destructiveHint` for messages that can't be unsent, for overwriting, revoking access or deleting, and for destructive options in the input schema (ChatGPT's scan flagged a non-destructive publish tool for offering `burn_after_read`). No catch-all request tools, no tool names over 64 characters, no sensitive inputs, no upgrade or pricing copy. Tools that move money or handle crypto wallets are flagged for ChatGPT, whose submit step has you attest to neither. File viewers say the user opens the file: described as a command, the model calls one with a path and ChatGPT refuses the read.
 - **Listing**: the icon is square and at least 512px behind a direct link (PNG, JPEG, WebP or SVG, measured from the bytes), and `/favicon.ico` resolves. The privacy policy covers collection, retention and user controls. Support is a web page. Name, subtitle, one-liner, description and starter prompts fit each store's limits, including the 1,024 characters the ChatGPT package allows for its root description. Every test case uses tools the live server actually has. The ChatGPT domain challenge is served.
 - **Plugin repo**: public, on GitHub, with `.claude-plugin/plugin.json`, and no root `SKILL.md` shadowing the plugin's skills. Grok plugins come from an organisation.
 - **Vercel Connect**: what its [For Service Providers](https://vercel.com/docs/connect/providers) page asks for, read from your discovery documents alone (nothing is registered). Required items block: metadata served as JSON (at the path-suffixed form when the issuer has a path), `token_endpoint`, `grant_types_supported`, and OAuth and OpenID Connect documents that agree. Recommended items warn: DCR or CIMD so Connect can create the client, a `token_endpoint_auth_methods_supported` it can use, PKCE S256, refresh tokens. Optional ones are notes: protected-resource metadata, `revocation_endpoint`, `scopes_supported`. What needs a real token (`expires_in`, refresh rotation, the `https://connect.vercel.com/callback` redirect) is on the list of things to check yourself.
@@ -125,6 +125,8 @@ Readiness for MCP 2026-07-28 (never blocking)
 
 Servers behind sign-in need `--token` for the probes; the authorization checks run from the discovery documents either way.
 
+One thing preflight can't see: 2026-07-28 results carry cache hints, and `tools/list` is one of the results that must. If your list differs by caller, for example tools you hide from ChatGPT connections, mark it `cacheScope: "private"`, or a shared cache can hand one client another's list.
+
 ## ARD manifest
 
 `mcplane pack ard` writes `.mcplane/packs/ard/ard.json`: one entry for your server (`application/mcp-server-card+json`, pointing at your server card when you serve one), with representative queries from your prompts and tests and capabilities from your tool names. It validates against [ARD v0.91](https://agenticresourcediscovery.org/spec/) and against the older schema [Lighthouse 13.5](https://github.com/GoogleChrome/lighthouse/blob/v13.5.0/core/audits/agentic/ard-schema.js) audits. Serve it at `/.well-known/ard.json`, and either at `/.well-known/ai-catalog.json` too or from an `Agentmap:` line in robots.txt, which Lighthouse reads first. ARD is a proposal, so treat it as cheap insurance rather than a requirement.
@@ -197,9 +199,9 @@ Since DevDay (September 2026) ChatGPT takes a plugin ZIP. `mcplane pack chatgpt`
 - **Behind sign-in**: the ZIP doesn't need your tool list, so `pack chatgpt` builds without `--token` and says what it couldn't check. `--tools <file>` takes a saved `tools/list` result instead.
 - The ZIP is reproducible: entries are dated 1980-01-01 and carry Unix modes, so the same files give the same bytes.
 
-What stays with you: upload the ZIP, enter reviewer credentials and make the attestations. Bump `version` for every upload. Tool changes don't need a new ZIP; OpenAI's scans pick them up, and `drift` tracks extension metadata (sidebar, panels, file viewers) as part of each tool.
+What stays with you: upload the ZIP, enter reviewer credentials and make the attestations. Bump `version` for every upload, and upload a new version from the plugin's own page: the Plugins page's upload area makes a second plugin. Tool changes don't need a new ZIP; OpenAI says its scans pick them up after automated checks, though not on cue (check the MCPs tab before you submit test cases that use new tools), and `drift` tracks extension metadata (sidebar, panels, file viewers) as part of each tool.
 
-**Annotation rules.** OpenAI's [plugin guidelines](https://developers.openai.com/plugins/plugin-guidelines) now ask only for explicit `readOnlyHint`, `destructiveHint` and `openWorldHint` booleans on every tool; its automated review checks them, and you appeal if it flags one you believe is right. Justifications are no longer required, so the pack no longer drafts them: any you wrote in `mcplane.json` become optional appeal notes. Writes count as destructive unless they only add (overwriting, cancelling, revoking access and irreversible sends are all destructive, and an undo button doesn't change that), and preflight warns when a write that overwrites, revokes or deletes says `destructiveHint: false`. `openWorldHint` is about where a tool reaches, not whether it calls an API. A hint change is a note in `drift`, not an action: OpenAI re-checks annotations itself, so `drift --ci` doesn't fail on one.
+**Annotation rules.** OpenAI's [plugin guidelines](https://developers.openai.com/plugins/plugin-guidelines) now ask only for explicit `readOnlyHint`, `destructiveHint` and `openWorldHint` booleans on every tool; its automated review checks them, and you appeal if it flags one you believe is right. Justifications are no longer required, so the pack no longer drafts them: any you wrote in `mcplane.json` become optional appeal notes. Writes count as destructive unless they only add (overwriting, cancelling, revoking access and irreversible sends are all destructive, and an undo button doesn't change that), and preflight warns when a write that overwrites, revokes or deletes says `destructiveHint: false`, or offers an option that does. To keep such an option for other clients, stop advertising it in the schema you serve ChatGPT. `openWorldHint` is about where a tool reaches, not whether it calls an API. A hint change is a note in `drift`, not an action: OpenAI re-checks annotations itself, so `drift --ci` doesn't fail on one.
 
 ## Demo video
 

package/dist/checks/readiness.js

@@ -106,7 +106,7 @@ export function initializeCheck(r, era) {
 export function modernHeaderCheck(r) {
     const title = 'Accepts the Mcp-Method and Mcp-Name headers';
     return r && r.status < 300 && r.body?.result
-        ? check('headers', 'pass', title, { detail: 'a 2026-07-28 tools/list with Mcp-Method works (Mcp-Name only goes on tools/call, resources/read and prompts/get, which mcplane doesn’t call)' })
+        ? check('headers', 'pass', title, { detail: 'a 2026-07-28 tools/list with Mcp-Method works (Mcp-Name only goes on tools/call, resources/read and prompts/get, which this probe doesn’t send)' })
         : check('headers', 'warn', title, { detail: `a 2026-07-28 tools/list with Mcp-Method got ${said(r)}`, fix: 'Mcp-Method is required on every 2026-07-28 POST and must match the body’s method.' });
 }
 /** Legacy servers: the same tools/list with and without the new headers should get the same answer. */

package/dist/checks/server.js

@@ -60,6 +60,38 @@ export async function serverChecks(url, auth, token, extra = []) {
         checks.push(tools.length
             ? { id: 'server.tools', level: 'pass', title: 'tools/list returns tools', detail: tools.map((t) => t.name).join(', ') }
             : { id: 'server.tools', level: 'fail', title: 'tools/list returns tools', detail: `HTTP ${list?.status ?? 'error'}`, fix: 'Stores scan tools/list; with no tools there is nothing to list.' });
+        // Tools with UI name an MCP App resource (_meta.ui.resourceUri, or openai/outputTemplate). OpenAI requires a
+        // dedicated widget domain on each one when you submit a plugin with UI, unique per plugin. Set it as
+        // _meta["openai/widgetDomain"] on the resource: ui.domain also counts, but its format differs by host (Claude
+        // expects its own hash-derived domain there).
+        const uiUris = [...new Set(tools.flatMap((t) => {
+                const meta = (t._meta ?? {});
+                return [meta.ui?.resourceUri, meta['openai/outputTemplate']].filter((u) => typeof u === 'string');
+            }))];
+        if (uiUris.length) {
+            const missing = [];
+            const unread = [];
+            let denied = 0;
+            for (const uri of uiUris) {
+                const read = await client.request('resources/read', { uri }).catch(() => null);
+                if (read?.status === 401 || read?.status === 403) {
+                    denied++;
+                    continue;
+                }
+                const content = read?.body?.result?.contents?.[0];
+                if (!content)
+                    unread.push(uri);
+                else if (!content._meta?.['openai/widgetDomain'] && !content._meta?.ui?.domain)
+                    missing.push(uri);
+            }
+            checks.push(denied === uiUris.length
+                ? { id: 'server.widget-domain', level: 'skip', title: 'UI resources set a widget domain', detail: 'resources/read needs sign-in; run preflight with --token to check', stores: ['chatgpt'] }
+                : missing.length
+                    ? { id: 'server.widget-domain', level: 'fail', title: 'UI resources set a widget domain', detail: missing.join(', '), fix: 'Set _meta["openai/widgetDomain"] (for example "https://yourdomain.com") on each UI resource. OpenAI requires a dedicated, per-plugin widget domain to submit a plugin with UI.', stores: ['chatgpt'] }
+                    : unread.length === uiUris.length
+                        ? { id: 'server.widget-domain', level: 'warn', title: 'UI resources set a widget domain', detail: `resources/read gave nothing for ${unread.join(', ')}`, fix: 'Tools name UI resources that resources/read does not return. ChatGPT reads them the same way to show the UI.', stores: ['chatgpt'] }
+                        : { id: 'server.widget-domain', level: 'pass', title: 'UI resources set a widget domain', detail: uiUris.filter((u) => !unread.includes(u)).join(', '), stores: ['chatgpt'] });
+        }
         const ping = await client.request('ping').catch(() => null);
         checks.push({
             id: 'server.ping',

package/dist/checks/tools.js

@@ -19,16 +19,58 @@ const BEARER_INPUT = /^(token|edit_token|update_token|secret|access_key|api_key|
 /** OpenAI's destructive effects ("deletion, overwriting, cancellation, access revocation") in the words a tool uses about itself. */
 const DESTRUCTIVE = /\b(overwrit\w*|replac\w*|revo[kc]\w*|delet\w*|cancel\w*|archiv\w*|expir\w*|passwords?|gat(?:e|es|ed|ing))\b/gi;
 const NEGATED = /\b(never|not|no|without|nothing|refuses?|cannot|can['’]t|doesn['’]t|don['’]t|won['’]t)\b(\s+\w+){0,2}\s*$/i;
-/** The destructive words in a tool's name, title and description, skipping negated ones ("never overwrites"). */
-function destructiveWords(text) {
+/**
+ * Destructive options in an input schema. No "-ed" forms: they describe a state (include_deleted, "the deleted
+ * page's id"), not what the option does. Passcodes and gates stay out: a passcode on a page the call creates
+ * revokes nothing.
+ */
+const DESTRUCTIVE_OPTION = /\b(burn[\s_-]+after[\s_-]+read\w*|self[\s_-]?destruct(?:s|ing)?|delet(?:e|es|ing|ion)|destroy(?:s|ing)?|overwrit(?:e|es|ing)|replac(?:e|es|ing|ement)|revok(?:e|es|ing)|revocation|purg(?:e|es|ing)|wip(?:e|es|ing)|eras(?:e|es|ing|ure)|expir(?:e|es|ing|y|ation))\b/gi;
+/** Tools that make something new: a creating verb anywhere in the name (api_create_key), or first when it's also a noun (update_post isn't one). */
+const CREATES = /\b(create|add|new|publish|upload|mint|generate|insert)\b|^(post|share|invite|issue|schedule|make)\b/i;
+/** Crypto: wallets, chains, signing schemes and stablecoins. */
+const CRYPTO = /\b(crypto(?:currenc(?:y|ies))?|wallets?|on[\s-]?chain|blockchains?|web3|eip[\s-]?(?:191|712)|personal[\s_-]?sign|eth[\s_-]sign|sign[\s_-]?typed[\s_-]?data|usdc|usdt|stablecoins?|bitcoin|ethereum|solana|x402|nfts?|seed phrases?)\b/gi;
+/**
+ * Moving money, as a verb with what it moves. Like UPSELL, phrases only: prices, pricing pages and billing
+ * links aren't money movement, and neither is a purchase history or a hotel's check-out date.
+ */
+const MONEY = /\b(transfer(?:s|ring)? (?:the |your )?(?:funds|money|payments?)|send(?:s|ing)? (?:a |the |your )?(?:money|funds|payments?)|(?:make|makes|making|complete|completes|process|processes|processing|submit|submits|execute|executes) (?:a |the )?(?:payments?|purchases?)|pay(?:s|ing)? (?:an? |the |your )?(?:invoices?|bills?)|charg(?:e|es|ing) (?:a |the |their |your )?(?:cards?|customers?)|refund(?:s|ing)? (?:an? |the |their |your )?(?:customers?|orders?|payments?|charges?)|issu(?:e|es|ing) (?:a )?refunds?|(?:withdraw|deposit)(?:s|ing)? (?:funds|money)|(?:purchas(?:e|es|ing)|buy(?:s|ing)?) (?:an?|the|this|it)|checkouts?(?![\s_-]*(?:date|time|day)))\b/gi;
+/**
+ * The words a pattern finds in text, skipping negated ones ("never overwrites") and ones whose subject is another
+ * tool: "(update_site replaces a page in place)" describes update_site, not the tool being checked.
+ */
+function mentions(text, re, others = []) {
     const found = new Set();
-    for (const m of text.matchAll(DESTRUCTIVE)) {
-        if (NEGATED.test(text.slice(Math.max(0, m.index - 40), m.index)))
+    const subject = others.length ? new RegExp(`\\b(${others.map((n) => n.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('|')})\\b(\\s+\\w+){0,2}\\s*$`, 'i') : null;
+    for (const m of text.matchAll(re)) {
+        const before = text.slice(Math.max(0, m.index - 40), m.index);
+        if (NEGATED.test(before) || subject?.test(before))
             continue;
-        found.add(m[1].toLowerCase());
+        found.add(m[0].toLowerCase().replace(/\s+/g, ' '));
     }
     return [...found];
 }
+/** The destructive words in a tool's name, title and description, given the names of its sibling tools. */
+const destructiveWords = (text, others = []) => mentions(text, DESTRUCTIVE, others);
+/** A name as words: set_password and setPassword both read "set password". */
+const words = (name) => name.replace(/[_-]+/g, ' ').replace(/([a-z])([A-Z])/g, '$1 $2');
+/** A tool's input properties and the ones a level down (an object's properties, an array's items), by path. */
+function inputProps(t) {
+    return Object.entries(t.inputSchema?.properties ?? {}).flatMap(([k, v]) => {
+        const p = (v ?? {});
+        const kids = (p.properties ?? p.items?.properties ?? {});
+        return [[k, p], ...Object.entries(kids).map(([c, cv]) => [`${k}.${c}`, (cv ?? {})])];
+    });
+}
+/**
+ * The destructive words in what a property says about itself: its name, string enum values ("overwrite") and
+ * description. "Replace" counts in names and values only: descriptions use it loosely ("until a refresh replaces them").
+ */
+function optionWords(path, p) {
+    const values = Array.isArray(p.enum) ? p.enum.filter((e) => typeof e === 'string').join(' ') : '';
+    const named = mentions(`${words(path.split('.').pop())} ${values}`, DESTRUCTIVE_OPTION);
+    const described = mentions(typeof p.description === 'string' ? p.description : '', DESTRUCTIVE_OPTION).filter((w) => !w.startsWith('replac'));
+    return [...new Set([...named, ...described])];
+}
 export function toolChecks(tools) {
     if (!tools.length)
         return [];
@@ -111,11 +153,15 @@ export function toolChecks(tools) {
     }
     // The same definition covers overwriting, revoking access and deleting; an undo doesn't change that.
     // Conservative: explicit write tools whose own words say so, negated mentions ("never overwrites") excluded.
+    // Expiry follows the destructive-option rule below: on a tool that creates, it bounds what the call adds.
+    // Stacktree's publish_html ("plan-aware expiry", "update_site replaces a page in place") passed ChatGPT's scan.
     const destroys = tools.flatMap((t) => {
         if (t.annotations?.readOnlyHint !== false || t.annotations?.destructiveHint !== false)
             return [];
-        const words = destructiveWords(`${t.name.replace(/[_-]+/g, ' ').replace(/([a-z])([A-Z])/g, '$1 $2')} ${t.title ?? ''} ${t.description ?? ''}`);
-        return words.length ? [`${t.name} (${words.join(', ')})`] : [];
+        const creates = CREATES.test(words(t.name));
+        const others = tools.filter((o) => o !== t).map((o) => o.name);
+        const found = destructiveWords(`${words(t.name)} ${t.title ?? ''} ${t.description ?? ''}`, others).filter((w) => !(creates && w.startsWith('expir')));
+        return found.length ? [`${t.name} (${found.join(', ')})`] : [];
     });
     if (destroys.length) {
         checks.push({
@@ -127,6 +173,51 @@ export function toolChecks(tools) {
             stores: ['chatgpt'],
         });
     }
+    // ChatGPT's scan reads the input schema too: it flagged Stacktree's publish_html, marked non-destructive, for
+    // offering burn_after_read, and a rescan cleared it once the option was gone from the advertised schema (Oct 2026).
+    // Conservative: property names, descriptions and enum values, one level deep. Expiry is the trade-off: it only
+    // counts on tools that change something that exists. On a tool that creates (a publish's lifetime, a share
+    // link's expires_in) it bounds what the call itself adds, and publish_html kept expires_in_hours through
+    // that rescan. An expiry on an update tool still counts: it can take a live page down.
+    const options = tools.flatMap((t) => {
+        if (t.annotations?.readOnlyHint !== false || t.annotations?.destructiveHint !== false)
+            return [];
+        const creates = CREATES.test(words(t.name));
+        return inputProps(t).flatMap(([path, p]) => {
+            const found = optionWords(path, p).filter((w) => !(creates && w.startsWith('expir')));
+            return found.length ? [`${t.name}.${path} (${found.join(', ')})`] : [];
+        });
+    });
+    if (options.length) {
+        checks.push({
+            id: 'tools.destructive-option',
+            level: 'warn',
+            title: 'destructiveHint covers the options a tool’s schema offers',
+            detail: `${options.join('; ')}: destructiveHint is false, but the schema offers an option that deletes, overwrites, revokes or expires`,
+            fix: 'Set destructiveHint to true, or stop advertising the option in the schema you serve ChatGPT; your server can keep honouring it for older clients that still send it. ChatGPT’s scan flagged a publish tool marked non-destructive whose schema offered burn_after_read, and removing the option from the advertised schema cleared the flag on rescan.',
+            stores: ['chatgpt'],
+        });
+    }
+    // Before submitting, ChatGPT has the developer attest that the app involves no money or crypto.
+    // Moving money is a write, so read-only tools are judged by what they're about (name, title, property names) and a
+    // passing mention in their description doesn't count ("inflation, GDP, crypto and more").
+    const money = tools.flatMap((t) => {
+        const about = `${words(t.name)} ${t.title ?? ''} ${t.annotations?.title ?? ''} ${inputProps(t).map(([path]) => words(path.split('.').pop())).join(' ')}`;
+        const readOnly = t.annotations?.readOnlyHint === true;
+        const text = readOnly ? about : `${about} ${t.description ?? ''}`;
+        const found = [...mentions(text, CRYPTO), ...(readOnly ? [] : mentions(text, MONEY))];
+        return found.length ? [`${t.name} (${found.join(', ')})`] : [];
+    });
+    if (money.length) {
+        checks.push({
+            id: 'tools.money-crypto',
+            level: 'warn',
+            title: 'Tools don’t move money or handle crypto',
+            detail: `${money.join('; ')}: the tool seems to move money or handle crypto`,
+            fix: 'ChatGPT’s final submit step has you tick an attestation that the app involves no money or crypto. Remove the tool, or hide it from ChatGPT connections only: leave it out of their tools/list and refuse calls to it. Stacktree serves a per-client tool profile, and a client counts as ChatGPT when every OAuth redirect URI it registered is on chatgpt.com or openai.com, or its client name is "ChatGPT". "Every", not "any": some clients register a claude.ai callback beside a chatgpt.com one.',
+            stores: ['chatgpt'],
+        });
+    }
     const long = tools.filter((t) => t.name.length > 64);
     if (long.length)
         checks.push({ id: 'tools.name-length', level: 'fail', title: 'Tool names are 64 characters or fewer', detail: long.map((t) => t.name).join(', '), fix: 'Anthropic’s review criteria cap tool names at 64 characters.', stores: ['claude-connectors', 'claude-plugins'] });
@@ -143,7 +234,10 @@ export function toolChecks(tools) {
         .filter((k) => /(ssn|social_security|passport|national_id|tax_id|credit_card|card_number|cvv|iban|password|mfa|otp|2fa|diagnos|medical|health_record|biometric|fingerprint)/i.test(k))
         .map((k) => `${t.name}.${k}`));
     if (sensitive.length) {
-        checks.push({ id: 'tools.sensitive-inputs', level: 'fail', title: 'Tools don’t ask for sensitive data', detail: sensitive.join(', '), fix: 'OpenAI flags inputs that request PHI, card data, SSNs, credentials, MFA codes, government IDs or biometrics unless strictly necessary. Remove them or justify them in the submission.', stores: ['chatgpt'] });
+        const passcode = sensitive.some((s) => /\.password$/i.test(s))
+            ? ' If a password input is really a passcode for a page or file the tool makes, name it passcode: ChatGPT’s approval panel files an argument called password under "Account passwords", which reads as a credential request. Accepting both names on the server keeps older clients working.'
+            : '';
+        checks.push({ id: 'tools.sensitive-inputs', level: 'fail', title: 'Tools don’t ask for sensitive data', detail: sensitive.join(', '), fix: `OpenAI flags inputs that request PHI, card data, SSNs, credentials, MFA codes, government IDs or biometrics unless strictly necessary. Remove them or justify them in the submission.${passcode}`, stores: ['chatgpt'] });
     }
     const upsell = tools.filter((t) => UPSELL.test(`${t.title ?? ''} ${t.annotations?.title ?? ''} ${t.description ?? ''}`));
     checks.push(upsell.length
@@ -153,5 +247,22 @@ export function toolChecks(tools) {
     const ext = tools.flatMap((t) => ((t._meta?.['openai/ui']?.entrypoints) ?? []).map((e) => `${t.name}: ${e.type}${e.extensions?.length ? ` (${e.extensions.join(', ')})` : ''}`));
     if (ext.length)
         checks.push({ id: 'tools.extensions', level: 'pass', title: 'ChatGPT extensions declared', detail: ext.join('; '), stores: ['chatgpt'] });
+    // A file viewer opens when the user opens a file, and ChatGPT passes it an opaque resource URI. Described as a command
+    // ("Opens an HTML file in…"), the model calls it itself with a file path, and ChatGPT refuses the read ("MCP app cannot
+    // read resource outside its widget scope"). Seen with Stacktree's open_html_file in ChatGPT desktop, 6 Oct 2026.
+    const fileViewers = tools.filter((t) => ((t._meta?.['openai/ui']?.entrypoints) ?? []).some((e) => e.type === 'file'));
+    if (fileViewers.length) {
+        const invites = fileViewers.filter((t) => !/(user opens|when (the |a )?user opens|path does not work|not a (file )?path|opaque)/i.test(t.description ?? ''));
+        checks.push(invites.length
+            ? {
+                id: 'tools.file-viewer-wording',
+                level: 'warn',
+                title: 'File viewers say the user opens the file',
+                detail: invites.map((t) => t.name).join(', '),
+                fix: 'Say that ChatGPT calls this when the user opens a file, that a file path does not work here, and which tool the model should use instead for a file it can read (Stacktree points at publish_html). Otherwise the model calls the viewer with a path and the user sees ChatGPT refuse the read.',
+                stores: ['chatgpt'],
+            }
+            : { id: 'tools.file-viewer-wording', level: 'pass', title: 'File viewers say the user opens the file', stores: ['chatgpt'] });
+    }
     return checks;
 }

package/dist/core.js

@@ -26,7 +26,7 @@ function reminders(m, stores) {
         r.push('ChatGPT needs a demo video recorded in developer mode that shows the tools your test cases use. Re-record it whenever tools change ("mcplane demo" records it on a Mac with ChatGPT desktop).');
         r.push('After "Submit for Review" the ChatGPT portal shows nothing for about 20 seconds. Confirm the status on the plugins list, not the button.');
         r.push('OpenAI no longer asks for hint justifications: its automated review checks each tool’s hints. If it flags one you believe is right, appeal with an explanation.');
-        r.push('ChatGPT allows one version in review at a time. To change a submission, Cancel Review and resubmit the same draft.');
+        r.push('ChatGPT allows one version in review at a time, and a rescan doesn’t update the tools it was submitted with. To change a submission, Cancel Review (back to Draft), reconnect if tools changed so ChatGPT rediscovers them, and resubmit.');
     }
     if (stores.includes('claude-connectors') || stores.includes('claude-plugins')) {
         if (stores.includes('claude-connectors'))

package/dist/drift.js

@@ -162,16 +162,19 @@ export async function drift(m, stores, opts = {}, dir = process.cwd()) {
         const since = `since ${snap.state === 'live' ? 'the live version' : 'your submission'}${snap.version ? ` (v${snap.version})` : ''} on ${snap.takenOn}`;
         if (store === 'chatgpt') {
             // OpenAI rescans published servers: removals apply at once, new and changed tools after automated checks.
-            // Listing text is part of the version and needs a new one.
+            // A version in review keeps the tool snapshot it was submitted with. Listing text is part of the version and needs a new one.
             const hintChanges = d.changed.filter((c) => c.fields.some((f) => f.includes('Hint')));
+            const inReview = snap.state === 'submitted';
             if (toolChange)
                 items.push({
                     store,
                     level: 'info',
                     what: `Tools changed ${since}: ${summary}`,
-                    todo: `No resubmission needed for tools: OpenAI rescans your server, drops removed tools at once and switches new or changed ones over after they pass automated checks (the old definition stays live until then).${d.added.length || d.removed.length ? ' Update the test cases and demo video in your next version.' : ''}`,
+                    todo: inReview
+                        ? 'A rescan doesn’t update a submission already in review: it keeps the tools it was submitted with. For review to see these changes, cancel the review (back to Draft), reconnect so ChatGPT rediscovers the tools, then resubmit. The scan takes about 4 to 6 minutes; reload the page to see the result.'
+                        : `No resubmission needed for tools: OpenAI rescans your server, drops removed tools at once and switches new or changed ones over after they pass automated checks (the old definition stays live until then).${d.added.length || d.removed.length ? ' Update the test cases and demo video in your next version.' : ''}`,
                 });
-            if (hintChanges.length)
+            if (hintChanges.length && !inReview)
                 items.push({ store, level: 'info', what: `Hints changed: ${hintChanges.map((c) => c.tool).join(', ')}`, todo: 'Nothing to resubmit: OpenAI re-checks changed annotations automatically and no longer asks for justifications. If its review flags a value you believe is right, appeal with an explanation.' });
             if (listingChange.length)
                 items.push({ store, level: 'action', what: `Listing text changed (${listingChange.join(', ')})`, todo: 'Listing changes need a new version, review and publication: "mcplane pack chatgpt", import it into a new version, submit.' });
@@ -198,7 +201,7 @@ export async function drift(m, stores, opts = {}, dir = process.cwd()) {
                 items.push({ store, level: 'info', what: `Grok serves ${pinned.slice(0, 7)}; your repo is at ${head.slice(0, 7)}`, todo: 'xAI bumps pins daily. If it’s still behind tomorrow, "mcplane publish grok" opens a pin-bump pull request.' });
         }
         if (store === 'muse' && (toolChange || listingChange.length)) {
-            items.push({ store, level: 'info', what: `Changed ${since}: ${[summary, listingChange.length && `listing ${listingChange.join(', ')}`].filter(Boolean).join('; ')}`, todo: 'Meta hasn’t published an update process yet. Update the listing in muse.ai/platform if it shows old details.' });
+            items.push({ store, level: 'info', what: `Changed ${since}: ${[summary, listingChange.length && `listing ${listingChange.join(', ')}`].filter(Boolean).join('; ')}`, todo: 'Meta hasn’t published an update process yet. Open the submission in muse.ai/platform, which shows its stage (Submitted, then In review) and three requirements, and update anything that shows old details. If tools changed, update the Read, Write and Sensitive annotations you keep alongside the connector too.' });
         }
         if (store === 'mcp-registry' && (toolChange || listingChange.length)) {
             items.push({ store, level: 'action', what: `Changed ${since}`, todo: 'Bump the version and run "mcplane publish mcp-registry".' });

package/dist/packs.d.ts

@@ -60,6 +60,11 @@ export declare function claudeEvalPack(m: Manifest, opts?: PackOptions): Promise
 /** Every pack by name: a store with a form, or one of the extras. */
 export declare const PACKS: readonly ["chatgpt", "claude-connectors", "vercel-connect", "cursor", "muse", "directories", "ard", "claude-eval"];
 export declare function packFor(m: Manifest, name: string, opts?: PackOptions): Promise<Pack>;
+/**
+ * Muse: the values for Meta's developer portal (muse.ai/platform, live since 2 Oct 2026), what each
+ * submission's three requirements ask for, and per-tool annotations to keep until the portal takes them.
+ */
+export declare function musePack(m: Manifest, opts?: PackOptions): Promise<Pack>;
 export declare function simplePack(m: Manifest, store: StoreId): Promise<Pack>;
 /** The long tail: directories that only take a web form. One sheet with every value to paste. */
 export declare function directoriesPack(m: Manifest): Pack;

package/dist/packs.js

@@ -289,12 +289,16 @@ export async function chatgptPack(m, opts = {}) {
     const steps = `# ChatGPT submission: ${m.title} ${m.version ?? ''}
 
 ## 1. Upload the package
-platform.openai.com/plugins → **Upload new or existing plugin** → choose your verified developer identity → upload \`${zipName}\`.
+- **First version:** platform.openai.com/plugins → **Upload new or existing plugin** → choose your verified developer identity → upload \`${zipName}\`.
+- **A new version of a plugin you already have:** open that plugin's page and use **Upload new version** (or **Upload plugin to make changes**). Uploading from the Plugins page instead creates a second plugin, even when the package name matches.
 It fills the listing, icons, test cases, demo video, release notes and translations${skills.names.length ? `, and adds ${skills.names.length === 1 ? 'the skill' : `${skills.names.length} skills:`} ${skills.names.join(', ')}` : ''}. To change any of them later, edit mcplane.json, bump "version" and run \`mcplane pack chatgpt\` again.${skills.names.length ? '\nSkills are scanned too, which can take up to 2 hours. If one is flagged, take it out of chatgpt.skills and upload again; skills can come back in a later version.' : ''}
 
 ## 2. Resolve findings
 Open **Metadata & Skills** and **MCPs**, wait for the checks, fix anything listed (Copy issues is handy), and upload again if the package changes.
 Domain verification: serve the token it gives you as plain text at ${new URL(m.server.url).origin}/.well-known/openai-apps-challenge, and keep it there.
+- The tool scan takes about 4 to 6 minutes, and the page's spinner never finishes: reload to see the result.
+- "Needs further review" sends a tool to human review. It isn't an error, and the automated judge reshuffles which tools land there between scans.
+- Name tools by what they do. The scan flags names it can't understand: Stacktree's set_agentation, named after a product, was flagged "unclear name".
 
 ## 3. What only you can enter
 - **Review details:** reviewer credentials${m.server.auth === 'oauth' ? ` (${m.reviewerAccess ?? 'an email-and-password account with no 2FA, SMS or email confirmation, seeded for every test case'})` : ' (none needed: no sign-in)'}. Credentials never go in the ZIP.
@@ -305,7 +309,9 @@ Hints need no justification: OpenAI's automated review checks readOnlyHint, dest
 ## Traps
 - One review can be active per plugin. To replace a package in review, cancel the review first.
 - "Submit for review" can show nothing for a while; confirm the status on the Plugins page.
-- Tool changes don't need a new package: OpenAI's scans pick them up. Listing changes do.
+- Tool changes don't need a new package: OpenAI says its scans pick them up once you're published, after automated checks. Listing changes do. Neither happens on cue: on 6 Oct 2026 a Rescan on a published plugin left its tools table at the reviewed list ("last checked yesterday") and the scanner never connected, and a published plugin's MCP card has no Reconnect. If a new version's test cases use tools added since the last review, wait until the MCPs tab lists them before you submit.
+- Don't fix a duplicate plugin by deleting it and uploading again: deleting can reserve the plugin's name for an unknown time (openai/codex#39508).
+- A rescan doesn't update a submission already in review: it keeps the tools it was submitted with. To change them, cancel the review (back to Draft), reconnect so ChatGPT rediscovers the tools, then resubmit.
 - The package takes icons up to 5 MiB, but developer mode's own icon upload (when you add the server by hand to record the demo) takes 10 KB at most.
 
 When it's in: \`mcplane submitted chatgpt --version ${m.version ?? '1.0.0'} --app-id <asdk_app_… from the URL>\`
@@ -637,8 +643,48 @@ export async function packFor(m, name, opts = {}) {
         return claudePack(m, opts);
     if (name === 'vercel-connect')
         return vercelConnectPack(m);
+    if (name === 'muse')
+        return musePack(m, opts);
     return simplePack(m, name);
 }
+/**
+ * Muse: the values for Meta's developer portal (muse.ai/platform, live since 2 Oct 2026), what each
+ * submission's three requirements ask for, and per-tool annotations to keep until the portal takes them.
+ */
+export async function musePack(m, opts = {}) {
+    m = forStore(m, 'muse');
+    const listed = await toolsFor(m, opts);
+    const oauth = m.server.auth === 'oauth';
+    const todo = listed.tools ? [] : [withoutTools(listed.why, 'the per-tool annotations')];
+    const annotations = listed.tools
+        ? listed.tools.map((t) => `- ${t.name}: ${t.annotations?.readOnlyHint === true ? 'Read' : 'Write'}`).join('\n') || 'No tools listed.'
+        : 'Unknown without the tool list (pass --token or --tools).';
+    const md = `# Muse connectors: ${m.title}
+
+Submit at muse.ai/platform, Meta's developer portal (launched 2 October 2026), choosing "Existing MCP". Meta's Jake Levine mentioned about 3,000 connector submissions when he announced it on X, so expect a queue.
+
+- MCP server URL: ${m.server.url}
+- Auth: ${oauth ? 'OAuth (PKCE)' : 'None'}
+- Name: ${m.title}
+- Description: ${m.oneLiner ?? m.description ?? 'MISSING'}
+- Privacy: ${m.links?.privacy ?? 'MISSING'}
+
+## After you submit
+Each submission shows its stage, Submitted then In review, and three requirements:
+- **Business verification:** a code sent by email. Each "Verify email" click sends a new code and invalidates the last one, so click once and don't leave the code box until the email arrives.
+- **Questionnaire:** your company details and where data is stored.
+- **Integration credentials:** ${oauth ? 'a test API key or similar, so Meta can reach the tools behind your sign-in.' : 'none required: for an authless MCP, the portal says so.'}
+
+On 5 October Meta emailed developers asking them to "complete the additional intake questions", so check the portal for anything still open.
+
+## Tool annotations
+Meta's docs ask for a Read, Write or Sensitive annotation on each tool. The portal's field for them is marked as coming soon, so document them alongside the connector for now. Drafted from your readOnlyHint values; Sensitive is your call against Meta's docs:
+${annotations}
+
+Meta hasn't published an update process yet. When it's in: \`mcplane submitted muse\`.
+`;
+    return { files: [{ path: 'muse.md', content: md }], problems: [], todo };
+}
 export async function simplePack(m, store) {
     m = forStore(m, store);
     const problems = [];
@@ -649,7 +695,7 @@ export async function simplePack(m, store) {
         md = `# Cursor Marketplace: ${m.title}\n\nSubmit at cursor.com/marketplace/publish.\n\n- Repository: ${m.repository ?? 'MISSING'} (public, with a Cursor plugin manifest)\n- Name: ${m.title}\n- Description: ${m.oneLiner ?? m.description ?? 'MISSING'}\n- Website: ${m.links?.website ?? ''}\n\nEvery plugin is reviewed by hand. When it's in: \`mcplane submitted cursor\`. Review Times closes the report itself when your plugin appears in the marketplace.\n`;
     }
     else if (store === 'muse') {
-        md = `# Muse connectors: ${m.title}\n\nSubmit at muse.ai/platform, choosing "Existing MCP".\n\n- MCP server URL: ${m.server.url}\n- Auth: ${m.server.auth === 'oauth' ? 'OAuth (PKCE)' : 'None'}\n- Name: ${m.title}\n- Description: ${m.oneLiner ?? m.description ?? 'MISSING'}\n- Privacy: ${m.links?.privacy ?? 'MISSING'}\n\nMeta onboards in waves and gives no status yet. When it's in: \`mcplane submitted muse\`.\n`;
+        return musePack(m);
     }
     else {
         throw new Error(`No pack for ${store} yet. Packs: ${PACKS.join(', ')}.`);

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.5.0";
+export declare const VERSION = "0.6.0";

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = '0.5.0';
+export const VERSION = '0.6.0';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcplane",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "fastlane for MCP servers: preflight against every store's rejection causes, publish where you can, prepare the rest, track every review.",
   "type": "module",
   "bin": {