outrank-cli 0.7.0 → 0.7.1

package/README.md

@@ -119,13 +119,13 @@ Requirements: Node.js 18+ (check with `node --version`), an Outrank API key from
 Run this in the project folder (macOS, Linux, WSL, or the Windows Command Prompt):
 
 ```bash
-claude mcp add outrank --env OUTRANK_API_KEY=outr_live_xxx -- npx -y outrank-cli@0.7.0 mcp
+claude mcp add outrank --env OUTRANK_API_KEY=outr_live_xxx -- npx -y outrank-cli@latest mcp
 ```
 
 If the server does not start on native Windows, use the `cmd /c` form:
 
 ```bash
-claude mcp add outrank --env OUTRANK_API_KEY=outr_live_xxx -- cmd /c npx -y outrank-cli@0.7.0 mcp
+claude mcp add outrank --env OUTRANK_API_KEY=outr_live_xxx -- cmd /c npx -y outrank-cli@latest mcp
 ```
 
 In PowerShell, call `claude.exe` instead of `claude` (`claude.cmd` when Claude Code was installed with npm), so that the `--` separator is kept.
@@ -139,7 +139,7 @@ To share the server with a team, commit a `.mcp.json` that takes the key from ea
   "mcpServers": {
     "outrank": {
       "command": "npx",
-      "args": ["-y", "outrank-cli@0.7.0", "mcp"],
+      "args": ["-y", "outrank-cli@latest", "mcp"],
       "env": { "OUTRANK_API_KEY": "${OUTRANK_API_KEY}" }
     }
   }
@@ -167,14 +167,14 @@ Add the server to `~/.cursor/mcp.json`, the file for all projects (on Windows: `
   "mcpServers": {
     "outrank": {
       "command": "npx",
-      "args": ["-y", "outrank-cli@0.7.0", "mcp"],
+      "args": ["-y", "outrank-cli@latest", "mcp"],
       "env": { "OUTRANK_API_KEY": "outr_live_xxx" }
     }
   }
 }
 ```
 
-If the server does not start on native Windows, use `"command": "cmd"` and `"args": ["/c", "npx", "-y", "outrank-cli@0.7.0", "mcp"]`.
+If the server does not start on native Windows, use `"command": "cmd"` and `"args": ["/c", "npx", "-y", "outrank-cli@latest", "mcp"]`.
 
 For one project or a team, put the server in `.cursor/mcp.json` inside the project and take the key from the environment, so the file can be committed without it:
 
@@ -183,7 +183,7 @@ For one project or a team, put the server in `.cursor/mcp.json` inside the proje
   "mcpServers": {
     "outrank": {
       "command": "npx",
-      "args": ["-y", "outrank-cli@0.7.0", "mcp"],
+      "args": ["-y", "outrank-cli@latest", "mcp"],
       "env": { "OUTRANK_API_KEY": "${env:OUTRANK_API_KEY}" }
     }
   }
@@ -199,10 +199,10 @@ Set `OUTRANK_API_KEY` as shown in the Claude Code section, then quit and reopen
 Any client that can start a local MCP server (the stdio transport) works. Give it these three values; many clients read the same JSON as the Cursor example above.
 
 - Command: `npx`
-- Arguments: `-y outrank-cli@0.7.0 mcp`
+- Arguments: `-y outrank-cli@latest mcp`
 - Environment variable: `OUTRANK_API_KEY` set to your API key
 
-The examples pin the version on purpose: the server holds a live API key, so upgrade it deliberately. If you install the package globally (`npm install -g outrank-cli`), the command is `outrank-cli mcp`, or the `outrank-mcp` binary.
+The examples use the `latest` tag, so the server picks up each new release the next time the client starts it. To stay on one version, replace `latest` with an exact version number from the [npm page](https://www.npmjs.com/package/outrank-cli). If you install the package globally (`npm install -g outrank-cli`), the command is `outrank-cli mcp`, or the `outrank-mcp` binary.
 
 ### Options
 
@@ -241,8 +241,8 @@ For several organizations, store one profile per organization with the CLI and r
 ```bash
 outrank-cli auth login outr_live_xxx --profile acme
 outrank-cli auth login outr_live_yyy --profile globex
-claude mcp add outrank-acme -- npx -y outrank-cli@0.7.0 mcp --profile acme
-claude mcp add outrank-globex -- npx -y outrank-cli@0.7.0 mcp --profile globex
+claude mcp add outrank-acme -- npx -y outrank-cli@latest mcp --profile acme
+claude mcp add outrank-globex -- npx -y outrank-cli@latest mcp --profile globex
 ```
 
 A selected profile ignores `OUTRANK_API_KEY`, so both servers stay on their own organization even when that variable is exported in your shell. In PowerShell, call `claude.exe` in the last two commands, as described under [Claude Code](#claude-code).
@@ -262,10 +262,10 @@ A selected profile ignores `OUTRANK_API_KEY`, so both servers stay on their own
 
 ### Troubleshooting
 
-- **The server does not start.** Run the same command in a terminal: `npx -y outrank-cli@0.7.0 mcp --help` must print usage. Check that Node.js 18 or newer is installed (`node --version`). On native Windows, if the client cannot start `npx` directly, use the `cmd /c npx …` form.
+- **The server does not start.** Run the same command in a terminal: `npx -y outrank-cli@latest mcp --help` must print usage. Check that Node.js 18 or newer is installed (`node --version`). On native Windows, if the client cannot start `npx` directly, use the `cmd /c npx …` form.
 - **The command works in a terminal, but the client cannot find `npx` or `node` (macOS, Linux).** A client started from the Dock or a desktop menu does not always get the `PATH` of your shell, so a Node.js installed with nvm, fnm or volta can be invisible to it. Run `which npx` in a terminal, use that full path as the command, and add its folder to `PATH` in the `env` block of the server entry, for example `"PATH": "/home/you/.nvm/versions/node/v22.0.0/bin:/usr/bin:/bin"`. The full path alone is not enough: `npx` starts `node` through `PATH`.
 - **PowerShell reports `unknown option '-y'` on `claude mcp add`.** PowerShell drops the `--` separator when `claude` is a script or a function instead of the program itself (an npm-installed Claude Code, or a wrapper in your profile). Call `claude.exe mcp add …` (`claude.cmd` when Claude Code was installed with npm) or run the command from the Command Prompt.
-- **The first start is slow, or the server fails to connect.** `npx` downloads the package the first time and contacts the npm registry on every start, so an empty cache or a slow registry can push startup past the client's limit. In Claude Code, run `/mcp reconnect all` to try again; `MCP_TIMEOUT` (milliseconds) raises the startup limit. To take the registry out of the startup path, install the package globally (`npm install -g outrank-cli@0.7.0`) and use `outrank-cli mcp` as the command.
+- **The first start is slow, or the server fails to connect.** `npx` downloads the package the first time and contacts the npm registry on every start, so an empty cache or a slow registry can push startup past the client's limit. In Claude Code, run `/mcp reconnect all` to try again; `MCP_TIMEOUT` (milliseconds) raises the startup limit. To take the registry out of the startup path, install the package globally (`npm install -g outrank-cli@latest`) and use `outrank-cli mcp` as the command.
 - **Every call returns `CLI_AUTH_REQUIRED`.** The server has no key. Add `OUTRANK_API_KEY` to the server entry, or select a stored profile with `--profile`.
 - **Only a few tools are listed.** Read the server instructions in the client: they name the toolsets that are off and why. See [Toolsets](#toolsets).
 - **A long call times out.** `improvements_analyze`, `improvements_candidates_brief`, `improvements_tasks_execute`, `improvements_executions_push`, `articles_generate`, `articles_precreate`, `articles_retry_publish` and `keywords_generate` can run for minutes. When the call does not finish, the result is `CLI_OPERATION_MAY_STILL_BE_RUNNING` and names the tool to poll: the work continues on the server, so poll instead of repeating the call. The server sends progress notifications while such a call runs, but clients do not have to extend their own limit because of them. Claude Code does not cut a tool call off by default: `MCP_TOOL_TIMEOUT` (milliseconds) is about 28 hours when unset, and a `timeout` field on the server's `.mcp.json` entry sets a hard limit for that server which progress notifications do not extend. Cursor (measured on 3.22) stops a call after 120 seconds without a progress notification and keeps waiting while they arrive, so long calls get through there. Other clients may stop after a fixed time whatever the server does; the poll tools are the way through.
@@ -730,7 +730,7 @@ Buyer side:
 - Shopify uses a direct app access token. Start with `outrank-cli products integrations validate shopify --json '{"access_token":"shpat_xxx"}'`; the response returns `shop_name` and the available blogs you can use in the create payload, so the human does not need to provide the store name separately.
 - Webflow uses a direct API token plus pre-save discovery. Start with `outrank-cli products integrations validate webflow --json-file webflow-sites.json`, then use `webflow sites`, `webflow collections`, `webflow fields`, and `webflow items` to build the exact create or update payload for the chosen CMS collection.
 - Wix is a direct credential flow using `site_id`, `api_key`, and `publish_status`. Validate first, then create or update directly; there is no OAuth or prepare step.
-- Next.js Blog is a one-step create flow. Run `outrank-cli products integrations create <product-id> --json '{"provider":"nextjs-blog"}'` and store the returned `data.secrets.api_key` immediately because it is not readable later.
+- Next.js Blog is a one-step create flow. Run `outrank-cli products integrations create <product-id> --json '{"provider":"nextjs-blog"}'` and store the returned `data.secrets.api_key` immediately because it is not readable later. One key serves both the articles and the marketplace integration of a product: when the product already hosts marketplace placements through Next.js Blog, create reuses that key and returns no `secrets`.
 - Validate unsaved webhook, Ghost, Framer, Shopify, Webflow, Wix, or WordPress Plugin credentials with `outrank-cli products integrations validate <provider> --json-file integration.json`.
 - Create a webhook, Ghost, Framer, Shopify, Webflow, Wix, WordPress Plugin, or Next.js Blog integration with `outrank-cli products integrations create <product-id> --json-file integration-create.json`.
 - Inspect one integration with `outrank-cli products integrations get <product-id> <integration-id>`.

package/SKILL.md

@@ -383,7 +383,7 @@ Recommended flow:
 8. For Shopify, start with `outrank-cli products integrations validate shopify --json '{"access_token":"shpat_xxx"}'`. The response returns `shop_name` and the available blogs, which the agent should use to build the create payload instead of guessing them or asking the human for the store name first.
 9. For Webflow, start with `outrank-cli products integrations validate webflow --json-file webflow-sites.json`, then use `webflow sites`, `webflow collections`, `webflow fields`, and `webflow items` to build the exact create or update payload for the chosen CMS collection.
 10. For Framer, use only the newer Server API flow. Start with `outrank-cli products integrations validate framer --json-file framer-validate.json`, then use `framer collections` and `framer fields` when the human wants to publish into an existing editable collection. Do not use or mention the older plugin-based setup.
-11. For Next.js Blog, do not ask the human for credentials first. Run `outrank-cli products integrations create <productId> --json '{"provider":"nextjs-blog"}'` and treat the returned `data.secrets.api_key` as a one-time secret that must be saved immediately.
+11. For Next.js Blog, do not ask the human for credentials first. Run `outrank-cli products integrations create <productId> --json '{"provider":"nextjs-blog"}'` and treat the returned `data.secrets.api_key` as a one-time secret that must be saved immediately. If the response has no `secrets`, the product already hosts marketplace placements through Next.js Blog and that integration's key was reused: the site needs no change.
 12. For Wix, use a direct credential flow with `site_id`, `api_key`, and `publish_status`. Validate first, then create or update directly; there is no OAuth or prepare step.
 13. Validate webhook, Ghost, Shopify, Webflow, Wix, Framer, or WordPress Plugin credentials before saving with `outrank-cli products integrations validate <provider> --json-file integration.json`.
 14. Create a webhook, Ghost, Shopify, Webflow, Wix, Framer, WordPress Plugin, or Next.js Blog integration with `outrank-cli products integrations create <productId> --json-file integration-create.json`.
@@ -403,7 +403,7 @@ Important behavior:
 - `webflow` should use validation plus discovery before create. The agent should not guess `site_id`, `collection_id`, or Webflow field mappings.
 - `framer` should use the newer Server API flow only. The agent should not mention the older Framer plugin flow. Validate the project URL and Server API key first, then use `framer collections` and `framer fields` only when the human chooses an existing editable collection. There is no separate plugin-config step in the agent surface.
 - `wix` uses direct validate/create/update/test with a site UUID plus API key. The agent should validate `site_id` and `api_key` before create or after credentials change.
-- `nextjs-blog` create returns a one-time API key. The agent must surface and preserve it immediately because later reads only show that a hash exists, not the plain secret.
+- `nextjs-blog` create returns a one-time API key. The agent must surface and preserve it immediately because later reads only show that a hash exists, not the plain secret. One key serves both the articles and the marketplace integration of a product: when an active Next.js Blog marketplace integration exists, create reuses its key and returns no `secrets`; creating again issues a new key and invalidates the old one.
 - deleting the current active integration clears the product integration fields automatically
 - `validate` tests unsaved credentials without persisting a row, while `test` re-checks a saved integration row
 - the current CLI surface still does not expose create, update, or test for some providers, and only WordPress.com and Notion currently expose an OAuth connect flow; if the human asks for unsupported operations, say they are not shipped in this CLI yet instead of inventing commands

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "outrank-cli",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Agent-first CLI and MCP server for the Outrank agent API",
   "type": "module",
   "files": [

package/src/adapters/mcp/prompts.js

@@ -143,7 +143,9 @@ const providerHints = Object.freeze({
   ghost:
     'products_integrations_validate with url and api_key (the Ghost Admin API key, id:secret), then create with ' +
     'publish_status (draft | published).',
-  'nextjs-blog': 'products_integrations_create directly; data.secrets.api_key is shown once and must be saved.',
+  'nextjs-blog':
+    'products_integrations_create directly; data.secrets.api_key is shown once and must be saved. No secrets means ' +
+    'the key of the existing Next.js Blog marketplace integration was reused: the site needs no change.',
 });
 
 const setupPublishingIntegrationText = (productId, provider) =>

package/src/adapters/mcp/toolNotes.js

@@ -262,7 +262,8 @@ export const TOOL_NOTES = Object.freeze({
   'products.integrations.create': {
     note:
       'A product keeps one publishing integration. Validate the credentials first. nextjs-blog returns a one-time ' +
-      'secrets.api_key: show it to the user at once. Use connect for notion and wordpress-com.',
+      'secrets.api_key: show it to the user at once (no secrets when it reuses the key of the marketplace ' +
+      'integration). Use connect for notion and wordpress-com.',
     body:
       'provider (required) plus: webhook { name, endpoint, access_token }; ghost { name, url, api_key, ' +
       'publish_status (draft | published) }; shopify { name, access_token, blog_id, author_name, publish_status ' +