PyPI - adloop - Versions diffs - 0.14.0__tar.gz → 0.16.0__tar.gz - Mend

adloop 0.14.0tar.gz → 0.16.0tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (60) hide show

{adloop-0.14.0 → adloop-0.16.0}/PKG-INFO RENAMED Viewed

@@ -1,13 +1,13 @@
 Metadata-Version: 2.3
 Name: adloop
-Version: 0.14.0
+Version: 0.16.0
 Summary: The AI command center for Google Ads, Reddit Ads, GA4, and tracking code.
 Keywords: mcp,google-ads,reddit-ads,google-analytics,ga4,cursor,marketing
 Author: Daniel Klose
 Author-email: Daniel Klose <info@daniel-klose.com>
 License: MIT
 Requires-Dist: fastmcp>=3.0.0
-Requires-Dist: google-ads>=31.1.0
+Requires-Dist: google-ads>=32.0.0
 Requires-Dist: google-analytics-data>=0.20.0
 Requires-Dist: google-analytics-admin>=0.27.0
 Requires-Dist: google-api-python-client>=2.100.0
@@ -37,7 +37,7 @@ Description-Content-Type: text/markdown
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 [![Python 3.11+](https://img.shields.io/badge/Python-3.11+-3776AB.svg?logo=python&logoColor=white)](https://www.python.org/downloads/)
 [![MCP Compatible](https://img.shields.io/badge/MCP-Compatible-8A2BE2.svg)](https://modelcontextprotocol.io)
-[![Google Ads API](https://img.shields.io/badge/Google%20Ads-API%20v24-4285F4.svg?logo=google-ads&logoColor=white)](https://developers.google.com/google-ads/api/docs/start)
+[![Google Ads API](https://img.shields.io/badge/Google%20Ads-API%20v25-4285F4.svg?logo=google-ads&logoColor=white)](https://developers.google.com/google-ads/api/docs/start)
 [![GA4 Data API](https://img.shields.io/badge/GA4-Data%20API-E37400.svg?logo=google-analytics&logoColor=white)](https://developers.google.com/analytics/devguides/reporting/data/v1)
 [![GitHub stars](https://img.shields.io/github/stars/kLOsk/adloop?style=social)](https://github.com/kLOsk/adloop)
@@ -48,7 +48,7 @@ An MCP server that gives your AI assistant read + write access to Google Ads, Re
 </div>
 > [!TIP]
-> **[AdLoop Cloud](https://getadloop.com) is the hosted version of this project, with a free plan that needs no credit card.** Connect Google in two clicks and use the full toolset from claude.ai, ChatGPT, Claude Code, Cursor, or Gemini. No Google Cloud project, no developer token, no OAuth verification wait. EU-hosted, GDPR-first, DPA included.
+> **[AdLoop Cloud](https://getadloop.com) is the hosted version of this project, with a free plan that needs no credit card.** Connect Google in two clicks and use the full toolset from claude.ai, ChatGPT, Claude Code, Cursor, or Gemini. No Google Cloud project, no API access application, no OAuth verification wait. EU-hosted, GDPR-first, DPA included.
 > 📚 **Documentation: [docs.getadloop.com](https://docs.getadloop.com)** — setup guides per AI client, toolsets, the safety model, and troubleshooting for both editions.
@@ -62,7 +62,7 @@ Both versions run the same tools with the same safety model. The difference is w
 |---|---|---|
 | **Setup** | Connect Google in two clicks | ~5 min: own Google Cloud project + `adloop init` |
 | **Google Cloud project** | Not needed | Required (free) |
-| **Ads developer token** | Not needed | Required (from your MCC) |
+| **Ads API access** | Not needed | Granted to your Cloud project (no developer token, no MCC since Sept 2026) |
 | **Works with** | claude.ai, ChatGPT, Claude Code, Cursor, Gemini | Claude Code, Cursor, Claude Desktop, any local MCP client |
 | **Where your data flows** | EU servers (Germany), GDPR-first, DPA included | 100% your machine — nothing leaves it |
 | **Updates** | Automatic | `pip install -U adloop` |
@@ -299,7 +299,7 @@ AdLoop manages real ad spend, so safety is not optional.
 > **AdLoop uses your own (free) Google Cloud project for OAuth.** The `adloop init` wizard walks you through it — a one-time setup of about 5 minutes, with no shared user caps and no waiting on anyone's verification review. AdLoop does not ship built-in OAuth credentials.
 >
-> **Prefer zero setup?** [**AdLoop Cloud**](https://getadloop.com) is the hosted version: connect Google in two clicks — no Cloud project, no developer token, EU-hosted.
+> **Prefer zero setup?** [**AdLoop Cloud**](https://getadloop.com) is the hosted version: connect Google in two clicks — no Cloud project, no API access application, EU-hosted.
 >
 > *(Upgrading from ≤0.9 with built-in credentials? Those sign-ins were retired in 0.10 — run `adloop init` once to switch to your own project.)*
@@ -329,8 +329,8 @@ uv run adloop init
 The wizard walks you through:
 1. **Google Cloud setup** — creates a project, enables the three APIs, generates an OAuth client (see [Custom Google Cloud Project Setup](#custom-google-cloud-project-setup) below for the exact steps the wizard refers you to)
-2. **Developer token** — from your Google Ads MCC ([API Center](https://ads.google.com/aw/apicenter))
-3. **MCC Account ID** — your Manager Account ID (top bar in the MCC UI)
+2. **Google Ads API access** — applied for on your Cloud project's [Google Ads API Overview page](https://console.cloud.google.com/google/ads-apis/overview); the legacy developer-token prompt can be left empty
+3. **MCC Account ID** — optional, only if you reach several accounts through a Manager Account
 4. **OAuth sign-in** — opens a browser to sign in with Google (or prints a URL for headless servers)
 5. **Auto-discovers your accounts** — finds your GA4 properties and Ads accounts automatically
 6. **Optional services** — pin a GTM container, a Search Console property (both auto-discovered too), and a PageSpeed API key; skip any of them with Enter
@@ -341,26 +341,25 @@ The wizard walks you through:
 ### Requirements
 - Python 3.11+
-- A Google Ads account with an MCC (Manager Account)
-- A Google Ads Developer Token (see below)
+- A Google Ads account (a Manager Account is optional; you only need one to reach several accounts through one login)
+- Google Ads API access on your Google Cloud project (see below)
-### Google Ads Developer Token
+### Google Ads API access
-A developer token is **always required**. Your OAuth client handles Google sign-in; the developer token is a separate key that grants API access to your Google Ads data.
+Since 9 September 2026, Google Ads API access belongs to the **Google Cloud project that owns your OAuth client**. Developer tokens are sunset: the API ignores the header, the wizard's token prompt is optional, and you no longer need a Manager Account to get access.
-1. **Create an MCC** (free) at [ads.google.com/home/tools/manager-accounts](https://ads.google.com/home/tools/manager-accounts/) if you don't have one. Link your regular Google Ads account to it.
-2. In the MCC, go to **Tools & Settings → API Center**
-3. Your **developer token** is shown there. Copy it — the wizard will ask for it.
+Apply on your project's [Google Ads API Overview page](https://console.cloud.google.com/google/ads-apis/overview) in the Cloud Console:
-**Access levels** — your token's access level determines what it can do:
+| Level | How to get it | What it allows |
+|-------|---------------|----------------|
+| **Test** | Automatic when you enable the Google Ads API | Test accounts only, **not production accounts**. `CLOUD_PROJECT_NOT_APPROVED_FOR_PRODUCTION` (or `DEVELOPER_TOKEN_NOT_APPROVED` on older API versions) means you are here. |
+| **Explorer** | "Upgrade access level" → apply; usually granted automatically | 2,880 operations/day on production accounts. Enough to get started. |
+| **Basic** | Apply; reviewed automatically within minutes once the project is brand-verified (OAuth consent screen set to External and published "In production") | 15,000 operations/day. |
+| **Standard** | Apply; manual review, about ten business days | Higher limits; Google's RMF policy applies |
-| Level | How to Get | What It Allows |
-|-------|-----------|----------------|
-| **Test Account** | Default for new tokens | Can only access test accounts — **not production accounts**. If you see `DEVELOPER_TOKEN_NOT_APPROVED`, this is why. |
-| **Explorer** | Automatic after first API call with a production account | 2,880 operations/day on production accounts. Enough to get started. |
-| **Basic** | [Apply through API Center](https://ads.google.com/aw/apicenter) | 15,000 operations/day. Apply if you need more. |
+Projects on a Cloud free trial or with billing disabled are refused Explorer and Basic; use a project with billing set up.
-> **Getting `DEVELOPER_TOKEN_NOT_APPROVED`?** Your token is at "Test Account" level. Go to [API Center](https://ads.google.com/aw/apicenter) in your MCC and check your access level. If it shows "Test Account", you need to apply for Basic access or wait for Explorer access to be granted after your first production API call.
+> **Getting `CLOUD_PROJECT_NOT_APPROVED_FOR_PRODUCTION`?** Your project is at Test level. Open the Overview page above and apply for Explorer access.
 ### Headless Servers
@@ -465,7 +464,7 @@ All configuration lives in `~/.adloop/config.yaml`. See [`config.yaml.example`](
 | `google` | `credentials_path` | *(empty)* | Path to OAuth client JSON or service account key. Empty = `~/.adloop/credentials.json`, else Application Default Credentials. |
 | `google` | `token_path` | `~/.adloop/token.json` | Where to store the OAuth token (auto-created) |
 | `ga4` | `property_id` | — | Your GA4 property ID (auto-discovered by `adloop init`) |
-| `ads` | `developer_token` | — | Your Google Ads API developer token |
+| `ads` | `developer_token` | — | Legacy, optional: API access belongs to your Cloud project since Sept 2026 |
 | `ads` | `customer_id` | — | Default Google Ads customer ID (auto-discovered by `adloop init`) |
 | `ads` | `login_customer_id` | — | Your MCC account ID |
 | `reddit` | `client_id` / `client_secret` | *(empty)* | Your Reddit developer app (Business Manager → Developer Application) |
@@ -551,7 +550,7 @@ What's been shipped and what's next:
 - ~~Claude Code support~~ ✓ — `CLAUDE.md`, `.mcp.json`, `.claude/rules/`, `.claude/commands/`, CLI wizard snippets
 - **Claude Desktop one-click install** — `adloop install claude-desktop` (and/or a `.dxt` extension bundle) that writes the AdLoop MCP entry into `claude_desktop_config.json` automatically, so Claude Desktop + Cowork users don't have to hand-edit JSON
 - ~~PyPI package~~ ✓ — `pip install adloop`
-- ~~[AdLoop Cloud](https://getadloop.com)~~ ✓ — the hosted version: no Google Cloud project, no developer token, connect Google in two clicks (EU-hosted, GDPR-first)
+- ~~[AdLoop Cloud](https://getadloop.com)~~ ✓ — the hosted version: no Google Cloud project, no API access application, connect Google in two clicks (EU-hosted, GDPR-first)
 - ~~Headless server support~~ ✓ — manual URL copy-paste flow for servers without a browser
 - ~~Behavioral eval suites~~ ✓ — 28 prompt-and-expectation tests covering read, write, tracking, and planning workflows
 - ~~Google Tag Manager integration~~ ✓ — read tools for tags, triggers, variables, workspaces, and version history, plus the `audit_event_coverage` three-way join across codebase events, GTM tags, and GA4 actual fires

{adloop-0.14.0 → adloop-0.16.0}/README.md RENAMED Viewed

@@ -10,7 +10,7 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 [![Python 3.11+](https://img.shields.io/badge/Python-3.11+-3776AB.svg?logo=python&logoColor=white)](https://www.python.org/downloads/)
 [![MCP Compatible](https://img.shields.io/badge/MCP-Compatible-8A2BE2.svg)](https://modelcontextprotocol.io)
-[![Google Ads API](https://img.shields.io/badge/Google%20Ads-API%20v24-4285F4.svg?logo=google-ads&logoColor=white)](https://developers.google.com/google-ads/api/docs/start)
+[![Google Ads API](https://img.shields.io/badge/Google%20Ads-API%20v25-4285F4.svg?logo=google-ads&logoColor=white)](https://developers.google.com/google-ads/api/docs/start)
 [![GA4 Data API](https://img.shields.io/badge/GA4-Data%20API-E37400.svg?logo=google-analytics&logoColor=white)](https://developers.google.com/analytics/devguides/reporting/data/v1)
 [![GitHub stars](https://img.shields.io/github/stars/kLOsk/adloop?style=social)](https://github.com/kLOsk/adloop)
@@ -21,7 +21,7 @@ An MCP server that gives your AI assistant read + write access to Google Ads, Re
 </div>
 > [!TIP]
-> **[AdLoop Cloud](https://getadloop.com) is the hosted version of this project, with a free plan that needs no credit card.** Connect Google in two clicks and use the full toolset from claude.ai, ChatGPT, Claude Code, Cursor, or Gemini. No Google Cloud project, no developer token, no OAuth verification wait. EU-hosted, GDPR-first, DPA included.
+> **[AdLoop Cloud](https://getadloop.com) is the hosted version of this project, with a free plan that needs no credit card.** Connect Google in two clicks and use the full toolset from claude.ai, ChatGPT, Claude Code, Cursor, or Gemini. No Google Cloud project, no API access application, no OAuth verification wait. EU-hosted, GDPR-first, DPA included.
 > 📚 **Documentation: [docs.getadloop.com](https://docs.getadloop.com)** — setup guides per AI client, toolsets, the safety model, and troubleshooting for both editions.
@@ -35,7 +35,7 @@ Both versions run the same tools with the same safety model. The difference is w
 |---|---|---|
 | **Setup** | Connect Google in two clicks | ~5 min: own Google Cloud project + `adloop init` |
 | **Google Cloud project** | Not needed | Required (free) |
-| **Ads developer token** | Not needed | Required (from your MCC) |
+| **Ads API access** | Not needed | Granted to your Cloud project (no developer token, no MCC since Sept 2026) |
 | **Works with** | claude.ai, ChatGPT, Claude Code, Cursor, Gemini | Claude Code, Cursor, Claude Desktop, any local MCP client |
 | **Where your data flows** | EU servers (Germany), GDPR-first, DPA included | 100% your machine — nothing leaves it |
 | **Updates** | Automatic | `pip install -U adloop` |
@@ -272,7 +272,7 @@ AdLoop manages real ad spend, so safety is not optional.
 > **AdLoop uses your own (free) Google Cloud project for OAuth.** The `adloop init` wizard walks you through it — a one-time setup of about 5 minutes, with no shared user caps and no waiting on anyone's verification review. AdLoop does not ship built-in OAuth credentials.
 >
-> **Prefer zero setup?** [**AdLoop Cloud**](https://getadloop.com) is the hosted version: connect Google in two clicks — no Cloud project, no developer token, EU-hosted.
+> **Prefer zero setup?** [**AdLoop Cloud**](https://getadloop.com) is the hosted version: connect Google in two clicks — no Cloud project, no API access application, EU-hosted.
 >
 > *(Upgrading from ≤0.9 with built-in credentials? Those sign-ins were retired in 0.10 — run `adloop init` once to switch to your own project.)*
@@ -302,8 +302,8 @@ uv run adloop init
 The wizard walks you through:
 1. **Google Cloud setup** — creates a project, enables the three APIs, generates an OAuth client (see [Custom Google Cloud Project Setup](#custom-google-cloud-project-setup) below for the exact steps the wizard refers you to)
-2. **Developer token** — from your Google Ads MCC ([API Center](https://ads.google.com/aw/apicenter))
-3. **MCC Account ID** — your Manager Account ID (top bar in the MCC UI)
+2. **Google Ads API access** — applied for on your Cloud project's [Google Ads API Overview page](https://console.cloud.google.com/google/ads-apis/overview); the legacy developer-token prompt can be left empty
+3. **MCC Account ID** — optional, only if you reach several accounts through a Manager Account
 4. **OAuth sign-in** — opens a browser to sign in with Google (or prints a URL for headless servers)
 5. **Auto-discovers your accounts** — finds your GA4 properties and Ads accounts automatically
 6. **Optional services** — pin a GTM container, a Search Console property (both auto-discovered too), and a PageSpeed API key; skip any of them with Enter
@@ -314,26 +314,25 @@ The wizard walks you through:
 ### Requirements
 - Python 3.11+
-- A Google Ads account with an MCC (Manager Account)
-- A Google Ads Developer Token (see below)
+- A Google Ads account (a Manager Account is optional; you only need one to reach several accounts through one login)
+- Google Ads API access on your Google Cloud project (see below)
-### Google Ads Developer Token
+### Google Ads API access
-A developer token is **always required**. Your OAuth client handles Google sign-in; the developer token is a separate key that grants API access to your Google Ads data.
+Since 9 September 2026, Google Ads API access belongs to the **Google Cloud project that owns your OAuth client**. Developer tokens are sunset: the API ignores the header, the wizard's token prompt is optional, and you no longer need a Manager Account to get access.
-1. **Create an MCC** (free) at [ads.google.com/home/tools/manager-accounts](https://ads.google.com/home/tools/manager-accounts/) if you don't have one. Link your regular Google Ads account to it.
-2. In the MCC, go to **Tools & Settings → API Center**
-3. Your **developer token** is shown there. Copy it — the wizard will ask for it.
+Apply on your project's [Google Ads API Overview page](https://console.cloud.google.com/google/ads-apis/overview) in the Cloud Console:
-**Access levels** — your token's access level determines what it can do:
+| Level | How to get it | What it allows |
+|-------|---------------|----------------|
+| **Test** | Automatic when you enable the Google Ads API | Test accounts only, **not production accounts**. `CLOUD_PROJECT_NOT_APPROVED_FOR_PRODUCTION` (or `DEVELOPER_TOKEN_NOT_APPROVED` on older API versions) means you are here. |
+| **Explorer** | "Upgrade access level" → apply; usually granted automatically | 2,880 operations/day on production accounts. Enough to get started. |
+| **Basic** | Apply; reviewed automatically within minutes once the project is brand-verified (OAuth consent screen set to External and published "In production") | 15,000 operations/day. |
+| **Standard** | Apply; manual review, about ten business days | Higher limits; Google's RMF policy applies |
-| Level | How to Get | What It Allows |
-|-------|-----------|----------------|
-| **Test Account** | Default for new tokens | Can only access test accounts — **not production accounts**. If you see `DEVELOPER_TOKEN_NOT_APPROVED`, this is why. |
-| **Explorer** | Automatic after first API call with a production account | 2,880 operations/day on production accounts. Enough to get started. |
-| **Basic** | [Apply through API Center](https://ads.google.com/aw/apicenter) | 15,000 operations/day. Apply if you need more. |
+Projects on a Cloud free trial or with billing disabled are refused Explorer and Basic; use a project with billing set up.
-> **Getting `DEVELOPER_TOKEN_NOT_APPROVED`?** Your token is at "Test Account" level. Go to [API Center](https://ads.google.com/aw/apicenter) in your MCC and check your access level. If it shows "Test Account", you need to apply for Basic access or wait for Explorer access to be granted after your first production API call.
+> **Getting `CLOUD_PROJECT_NOT_APPROVED_FOR_PRODUCTION`?** Your project is at Test level. Open the Overview page above and apply for Explorer access.
 ### Headless Servers
@@ -438,7 +437,7 @@ All configuration lives in `~/.adloop/config.yaml`. See [`config.yaml.example`](
 | `google` | `credentials_path` | *(empty)* | Path to OAuth client JSON or service account key. Empty = `~/.adloop/credentials.json`, else Application Default Credentials. |
 | `google` | `token_path` | `~/.adloop/token.json` | Where to store the OAuth token (auto-created) |
 | `ga4` | `property_id` | — | Your GA4 property ID (auto-discovered by `adloop init`) |
-| `ads` | `developer_token` | — | Your Google Ads API developer token |
+| `ads` | `developer_token` | — | Legacy, optional: API access belongs to your Cloud project since Sept 2026 |
 | `ads` | `customer_id` | — | Default Google Ads customer ID (auto-discovered by `adloop init`) |
 | `ads` | `login_customer_id` | — | Your MCC account ID |
 | `reddit` | `client_id` / `client_secret` | *(empty)* | Your Reddit developer app (Business Manager → Developer Application) |
@@ -524,7 +523,7 @@ What's been shipped and what's next:
 - ~~Claude Code support~~ ✓ — `CLAUDE.md`, `.mcp.json`, `.claude/rules/`, `.claude/commands/`, CLI wizard snippets
 - **Claude Desktop one-click install** — `adloop install claude-desktop` (and/or a `.dxt` extension bundle) that writes the AdLoop MCP entry into `claude_desktop_config.json` automatically, so Claude Desktop + Cowork users don't have to hand-edit JSON
 - ~~PyPI package~~ ✓ — `pip install adloop`
-- ~~[AdLoop Cloud](https://getadloop.com)~~ ✓ — the hosted version: no Google Cloud project, no developer token, connect Google in two clicks (EU-hosted, GDPR-first)
+- ~~[AdLoop Cloud](https://getadloop.com)~~ ✓ — the hosted version: no Google Cloud project, no API access application, connect Google in two clicks (EU-hosted, GDPR-first)
 - ~~Headless server support~~ ✓ — manual URL copy-paste flow for servers without a browser
 - ~~Behavioral eval suites~~ ✓ — 28 prompt-and-expectation tests covering read, write, tracking, and planning workflows
 - ~~Google Tag Manager integration~~ ✓ — read tools for tags, triggers, variables, workspaces, and version history, plus the `audit_event_coverage` three-way join across codebase events, GTM tags, and GA4 actual fires

{adloop-0.14.0 → adloop-0.16.0}/pyproject.toml RENAMED Viewed

@@ -1,6 +1,6 @@
 [project]
 name = "adloop"
-version = "0.14.0"
+version = "0.16.0"
 description = "The AI command center for Google Ads, Reddit Ads, GA4, and tracking code."
 readme = "README.md"
 requires-python = ">=3.11"
@@ -15,7 +15,7 @@ keywords = [
 ]
 dependencies = [
     "fastmcp>=3.0.0",
-    "google-ads>=31.1.0",
+    "google-ads>=32.0.0",
     "google-analytics-data>=0.20.0",
     "google-analytics-admin>=0.27.0",
     "google-api-python-client>=2.100.0",

{adloop-0.14.0 → adloop-0.16.0}/pyproject.toml.orig RENAMED Viewed

@@ -1,6 +1,6 @@
 [project]
 name = "adloop"
-version = "0.14.0"
+version = "0.16.0"
 description = "The AI command center for Google Ads, Reddit Ads, GA4, and tracking code."
 readme = "README.md"
 authors = [
@@ -11,7 +11,7 @@ license = { text = "MIT" }
 keywords = ["mcp", "google-ads", "reddit-ads", "google-analytics", "ga4", "cursor", "marketing"]
 dependencies = [
     "fastmcp>=3.0.0",
-    "google-ads>=31.1.0",
+    "google-ads>=32.0.0",
     "google-analytics-data>=0.20.0",
     "google-analytics-admin>=0.27.0",
     "google-api-python-client>=2.100.0",

{adloop-0.14.0 → adloop-0.16.0}/src/adloop/ads/client.py RENAMED Viewed

@@ -16,7 +16,7 @@ if TYPE_CHECKING:
 # Pin the API version so library upgrades don't silently break field names,
 # enum values, or mutate operation structures. Bump this deliberately when
 # migrating to a new API version — never let it float to the library default.
-GOOGLE_ADS_API_VERSION = "v24"
+GOOGLE_ADS_API_VERSION = "v25"
 def get_ads_client(config: AdLoopConfig) -> GoogleAdsClient:
@@ -28,11 +28,16 @@ def get_ads_client(config: AdLoopConfig) -> GoogleAdsClient:
     credentials = get_ads_credentials(config)
     client_config = {
-        "developer_token": config.ads.developer_token,
         "use_proto_plus": True,
         "version": GOOGLE_ADS_API_VERSION,
     }
+    # Access levels live on the Google Cloud project that owns the OAuth
+    # client since 2026-09-09; the developer token header is optional and
+    # ignored by the API. Send it only when someone still has one configured.
+    if config.ads.developer_token:
+        client_config["developer_token"] = config.ads.developer_token
     if config.ads.login_customer_id:
         client_config["login_customer_id"] = config.ads.login_customer_id.replace("-", "")

{adloop-0.14.0 → adloop-0.16.0}/src/adloop/ads/conversion_actions.py RENAMED Viewed

@@ -430,6 +430,7 @@ def draft_remove_conversion_action(
         entity_id=str(conversion_action_id),
         customer_id=customer_id,
         changes={"conversion_action_id": str(conversion_action_id)},
+        requires_double_confirm=True,
     )
     store_plan(plan)
     preview = plan.to_preview()

{adloop-0.14.0 → adloop-0.16.0}/src/adloop/ads/enums.py RENAMED Viewed

@@ -22,9 +22,8 @@ def _enum_introspection_client():
     """Memoized no-auth GoogleAdsClient used purely for enum introspection.
     The client constructor doesn't make any network calls and doesn't
-    validate credentials beyond requiring SOMETHING in the developer-token
-    field — perfect for reading the bundled enum protos. We cache it so
-    every enum_names() call after the first is essentially free.
+    validate credentials — perfect for reading the bundled enum protos. We
+    cache it so every enum_names() call after the first is essentially free.
     """
     from google.ads.googleads.client import GoogleAdsClient
@@ -32,7 +31,6 @@ def _enum_introspection_client():
     return GoogleAdsClient(
         credentials=None,
-        developer_token="adloop-enum-introspection-not-used",
         use_proto_plus=True,
         version=GOOGLE_ADS_API_VERSION,
     )

{adloop-0.14.0 → adloop-0.16.0}/src/adloop/ads/forecast.py RENAMED Viewed

@@ -226,7 +226,7 @@ def _build_keyword_ideas_rest_body(
 ) -> dict:
     """Build the JSON body for the REST generateKeywordIdeas endpoint.
-    Schema follows google-ads REST v24 (camelCase). Exactly one of
+    Schema follows the pinned google-ads REST version (camelCase; unchanged v24 → v25). Exactly one of
     ``keywordSeed`` / ``urlSeed`` / ``keywordAndUrlSeed`` is set based on
     which inputs were provided.
     """
@@ -272,10 +272,9 @@ def _post_keyword_ideas_rest_page(
     credentials = get_ads_credentials(config)
     session = AuthorizedSession(credentials)
-    headers = {
-        "developer-token": config.ads.developer_token,
-        "Content-Type": "application/json",
-    }
+    headers = {"Content-Type": "application/json"}
+    if config.ads.developer_token:
+        headers["developer-token"] = config.ads.developer_token
     if config.ads.login_customer_id:
         headers["login-customer-id"] = config.ads.login_customer_id.replace("-", "")

{adloop-0.14.0 → adloop-0.16.0}/src/adloop/ads/gaql.py RENAMED Viewed

@@ -63,15 +63,24 @@ def run_gaql(
 # ---------------------------------------------------------------------------
 _GAQL_ERROR_HINTS = {
+    "CLOUD_PROJECT_NOT_APPROVED_FOR_PRODUCTION": (
+        "The Google Cloud project that owns your OAuth client only has Test "
+        "access, which cannot reach production Google Ads accounts. Apply for "
+        "Explorer or Basic access on the project's Google Ads API Overview "
+        "page: https://console.cloud.google.com/google/ads-apis/overview"
+    ),
+    # Pre-2026-09 wording: access levels moved from developer tokens to the
+    # Cloud project, but older API versions still answer with these names.
     "DEVELOPER_TOKEN_NOT_APPROVED": (
-        "Your Google Ads developer token is only approved for test accounts. "
-        "Apply for Basic or Standard access in the Google Ads API Center, "
-        "or use a test account."
+        "Your project's Google Ads API access is at Test level, which cannot "
+        "reach production accounts. Apply for Explorer or Basic access on the "
+        "Google Cloud project's Google Ads API Overview page: "
+        "https://console.cloud.google.com/google/ads-apis/overview"
     ),
     "DEVELOPER_TOKEN_INVALID": (
-        "Your Google Ads developer token is invalid. Update "
-        "`ads.developer_token` in `~/.adloop/config.yaml` using the token "
-        "from your manager account API Center."
+        "The configured `ads.developer_token` is invalid. Since September 2026 "
+        "no token is needed at all: remove it from `~/.adloop/config.yaml`; "
+        "access is granted to the Google Cloud project that owns your OAuth client."
     ),
     "EXPECTED_REFERENCED_FIELD_IN_SELECT_CLAUSE": (
         "Fields used in ORDER BY or HAVING must also appear in the SELECT clause. "

adloop-0.16.0/src/adloop/ads/validate_only.py ADDED Viewed

@@ -0,0 +1,115 @@
+"""Run a Google Ads plan in validate-only mode for ``confirm_and_apply`` dry runs.
+The dry run used to echo the plan back without asking Google anything, so a
+change the API would reject only failed at the real apply. Wrapping the Ads
+client here sends every mutate the plan would send with ``validate_only=True``
+instead: Google checks the full request (field values, policy, references to
+existing entities) and executes nothing.
+Validate-only responses carry no results, so each validated call answers the
+apply code with placeholder resource names. A later call that references one
+(a plan whose second step uses what the first would have created) cannot be
+validated meaningfully; it is skipped and counted instead of sent.
+"""
+from __future__ import annotations
+from types import SimpleNamespace
+PLACEHOLDER = "adloop-validate-only"
+_RESPONSE_FIELD_FOR_SERVICE = "campaign_result"
+class ValidateOnlyFailure(Exception):
+    """Google rejected part of a validate-only request (partial failure)."""
+class ValidateOnlyClient:
+    """A GoogleAdsClient stand-in whose services only ever validate.
+    Everything except ``get_service`` passes through (enums, ``get_type``),
+    and every service method except ``mutate*`` passes through too, so the
+    reads some apply paths do before mutating still run normally.
+    """
+    def __init__(self, client: object) -> None:
+        self._client = client
+        self.validated_calls = 0
+        self.skipped_calls = 0
+    def __getattr__(self, name: str) -> object:
+        return getattr(self._client, name)
+    def get_service(self, name: str, *args: object, **kwargs: object) -> object:
+        return _ValidateOnlyService(self, name, self._client.get_service(name, *args, **kwargs))
+class _ValidateOnlyService:
+    def __init__(self, owner: ValidateOnlyClient, name: str, service: object) -> None:
+        self._owner = owner
+        self._name = name
+        self._service = service
+    def __getattr__(self, attr: str) -> object:
+        target = getattr(self._service, attr)
+        if not attr.startswith("mutate"):
+            return target
+        def validate(request: object = None, **kwargs: object) -> object:
+            if request is None:
+                request = self._build_request(attr, kwargs)
+            request.validate_only = True
+            operations = list(_operations_of(request))
+            if PLACEHOLDER in str(request):
+                self._owner.skipped_calls += 1
+            else:
+                response = target(request=request)
+                self._owner.validated_calls += 1
+                failure = getattr(response, "partial_failure_error", None)
+                if failure is not None and getattr(failure, "code", 0):
+                    raise ValidateOnlyFailure(getattr(failure, "message", "") or str(failure))
+            return _placeholder_response(request.customer_id, len(operations), attr == "mutate")
+        return validate
+    def _build_request(self, method: str, kwargs: dict) -> object:
+        request = self._owner._client.get_type(_request_type(self._name, method))
+        for key, value in kwargs.items():
+            if key in ("operations", "mutate_operations"):
+                getattr(request, key).extend(value)
+            else:
+                setattr(request, key, value)
+        return request
+def _request_type(service_name: str, method: str) -> str:
+    """``mutate_ad_group_criteria`` -> ``MutateAdGroupCriteriaRequest``."""
+    if method == "mutate":
+        return "Mutate" + service_name.removesuffix("Service") + "Request"
+    words = method.removeprefix("mutate_").split("_")
+    return "Mutate" + "".join(word.capitalize() for word in words) + "Request"
+def _operations_of(request: object) -> object:
+    if hasattr(request, "mutate_operations"):
+        return request.mutate_operations
+    return getattr(request, "operations", [])
+def _placeholder_response(customer_id: str, count: int, googleads_mutate: bool) -> object:
+    names = [f"customers/{customer_id}/{PLACEHOLDER}/{i}" for i in range(count)]
+    if googleads_mutate:
+        return SimpleNamespace(
+            mutate_operation_responses=[
+                SimpleNamespace(**{_RESPONSE_FIELD_FOR_SERVICE: SimpleNamespace(resource_name=n)})
+                for n in names
+            ],
+            partial_failure_error=None,
+        )
+    return SimpleNamespace(
+        results=[SimpleNamespace(resource_name=n) for n in names],
+        partial_failure_error=None,
+    )

{adloop-0.14.0 → adloop-0.16.0}/src/adloop/ads/write.py RENAMED Viewed

@@ -669,8 +669,13 @@ def update_responsive_search_ad(
     if errors:
         return {"error": "Validation failed", "details": errors}
+    url_warnings_found: list[str] = []
     if has_url_change:
-        url_check = _validate_urls([final_url])
+        # _validate_urls returns (errors, warnings) — the same contract the
+        # create path and the sitelink path already unpack. Treating the tuple
+        # as a dict made every URL-only update fail with
+        # "'tuple' object has no attribute 'get'" before a plan existed.
+        url_check, url_warnings = _validate_urls([final_url])
         if url_check.get(final_url):
             return {
                 "error": "URL validation failed",
@@ -679,6 +684,10 @@ def update_responsive_search_ad(
                     f"{url_check[final_url]}. Ads MUST point to working URLs."
                 ],
             }
+        if url_warnings.get(final_url):
+            url_warnings_found.append(
+                f"final_url '{final_url}': {url_warnings[final_url]}"
+            )
     changes: dict = {"ad_id": str(ad_id)}
     if has_url_change:
@@ -703,8 +712,10 @@ def update_responsive_search_ad(
     preview = plan.to_preview()
     # Only warn when the creative text is actually being replaced — URL/path
     # edits do not trigger the learning reset or policy re-review.
+    if url_warnings_found:
+        preview.setdefault("warnings", []).extend(url_warnings_found)
     if has_headlines_change or has_descriptions_change:
-        preview["warnings"] = [_RSA_TEXT_UPDATE_WARNING]
+        preview.setdefault("warnings", []).append(_RSA_TEXT_UPDATE_WARNING)
     return preview
@@ -1232,7 +1243,11 @@ def update_ad_group(
     max_cpc: float = 0,
 ) -> dict:
     """Draft an ad group update for name and manual CPC bid."""
-    from adloop.safety.guards import SafetyViolation, check_blocked_operation
+    from adloop.safety.guards import (
+        SafetyViolation,
+        check_bid_increase,
+        check_blocked_operation,
+    )
     from adloop.safety.preview import ChangePlan, store_plan
     try:
@@ -1276,6 +1291,12 @@ def update_ad_group(
                     f"target governs spend under automated bidding. "
                     f"No change made."
                 )
+        else:
+            current_bid = _current_ad_group_cpc_bid(config, customer_id, ad_group_id)
+            try:
+                check_bid_increase(current_bid or 0, max_cpc, config.safety)
+            except SafetyViolation as e:
+                errors.append(str(e))
     has_any_change = bool(ad_group_name.strip() or max_cpc)
     if not has_any_change:
@@ -1384,6 +1405,9 @@ def remove_entity(
         entity_id=entity_id,
         customer_id=customer_id,
         changes={"action": "REMOVE"},
+        # Removal is irreversible; the preview asks for a second explicit
+        # confirmation, as Reddit removals already did.
+        requires_double_confirm=True,
     )
     store_plan(plan)
     return plan.to_preview()
@@ -1574,6 +1598,7 @@ def update_campaign(
     """
     from adloop.safety.guards import (
         SafetyViolation,
+        check_bid_increase,
         check_blocked_operation,
         check_budget_cap,
     )
@@ -1628,6 +1653,14 @@ def update_campaign(
             errors.append("campaign_id was not found")
         elif strategy_for_cap != "TARGET_SPEND":
             errors.append("max_cpc requires TARGET_SPEND bidding_strategy")
+        else:
+            # Only a ceiling that already exists has a baseline; a campaign
+            # switching to Maximize Clicks has none to compare against.
+            current_ceiling = _current_campaign_cpc_ceiling(config, customer_id, campaign_id)
+            try:
+                check_bid_increase(current_ceiling or 0, max_cpc, config.safety)
+            except SafetyViolation as e:
+                errors.append(str(e))
     has_any_change = any([
         bs,
@@ -1957,14 +1990,23 @@ def _extract_error_message(exc: Exception) -> str:
         if isinstance(exc, GoogleAdsException) and exc.failure:
             parts = []
             for error in exc.failure.errors:
-                error_code = error.error_code
-                code_field = error_code.WhichOneof("error_code")
-                code_value = getattr(error_code, code_field) if code_field else "UNKNOWN"
-                line = f"[{code_field}={code_value.name if hasattr(code_value, 'name') else code_value}]"
-                if error.message:
-                    line += f" {error.message}"
-                if error.trigger and error.trigger.string_value:
-                    line += f" (trigger: {error.trigger.string_value})"
+                # The client returns proto-plus messages, on which WhichOneof
+                # does not exist; read the underlying protobuf instead.
+                pb = type(error).pb(error) if hasattr(type(error), "pb") else error
+                code_field = pb.error_code.WhichOneof("error_code")
+                code_name = "UNKNOWN"
+                if code_field:
+                    number = getattr(pb.error_code, code_field)
+                    enum = pb.error_code.DESCRIPTOR.fields_by_name[code_field].enum_type
+                    value = enum.values_by_number.get(number)
+                    code_name = value.name if value else str(number)
+                line = f"[{code_field}={code_name}]"
+                if pb.message:
+                    line += f" {pb.message}"
+                if pb.HasField("trigger"):
+                    kind = pb.trigger.WhichOneof("value")
+                    if kind:
+                        line += f" (trigger: {getattr(pb.trigger, kind)})"
                 parts.append(line)
             if parts:
                 msg = "; ".join(parts)
@@ -2008,39 +2050,49 @@ def confirm_and_apply(
     if dry_run:
         preflight_checks: dict | None = None
-        if is_reddit:
-            # Reddit has no validate-only mode; the dry run re-reads the
-            # target and re-runs the safety caps against live values. A
-            # failed preflight leaves dry_run_result unset so two-phase
-            # apply keeps refusing the real write.
-            from adloop.reddit.write import preflight
+        validation: dict | None = None
+        # Either way a failed check leaves dry_run_result unset, so two-phase
+        # apply keeps refusing the real write.
+        try:
+            if is_reddit:
+                # Reddit has no validate-only mode; the dry run re-reads the
+                # target and re-runs the safety caps against live values.
+                from adloop.reddit.write import preflight
-            try:
                 preflight_checks = preflight(config, plan)
-            except Exception as e:
-                error_message = _extract_error_message(e)
-                log_mutation(
-                    config.safety.log_file,
-                    operation=plan.operation,
-                    customer_id=plan.customer_id,
-                    entity_type=plan.entity_type,
-                    entity_id=plan.entity_id,
-                    changes=plan.changes,
-                    dry_run=True,
-                    result="dry_run_failed",
-                    error=error_message,
-                )
-                return {
-                    "status": "DRY_RUN_FAILED",
-                    "plan_id": plan.plan_id,
-                    "operation": plan.operation,
-                    "error": error_message,
-                    "message": (
-                        "The dry run re-checked the target against Reddit and "
-                        "found a problem; nothing was sent. Fix the cause and "
-                        "draft again."
-                    ),
-                }
+            elif plan.operation != "create_key_event":
+                # Google Ads checks the exact mutates with validate_only=True
+                # and executes nothing.
+                validation = _validate_with_google(config, plan)
+        except Exception as e:
+            error_message = _extract_error_message(e)
+            log_mutation(
+                config.safety.log_file,
+                operation=plan.operation,
+                customer_id=plan.customer_id,
+                entity_type=plan.entity_type,
+                entity_id=plan.entity_id,
+                changes=plan.changes,
+                dry_run=True,
+                result="dry_run_failed",
+                error=error_message,
+            )
+            checked_against = (
+                "re-checked the target against Reddit"
+                if is_reddit
+                else "sent the change to Google Ads in validate-only mode"
+            )
+            return {
+                "status": "DRY_RUN_FAILED",
+                "plan_id": plan.plan_id,
+                "operation": plan.operation,
+                "error": error_message,
+                "message": (
+                    f"The dry run {checked_against} and found a problem; "
+                    "nothing was changed. The real apply would fail the same "
+                    "way. Fix the cause and draft again."
+                ),
+            }
         log_mutation(
             config.safety.log_file,
             operation=plan.operation,
@@ -2074,6 +2126,18 @@ def confirm_and_apply(
                 "Reddit Ads has no validate-only mode: the dry run re-read the "
                 "target and re-checked the safety caps; nothing was sent."
             )
+        if validation is not None:
+            response["checks"] = validation
+            response["note"] = (
+                "Google Ads validated this exact change (validate_only) and "
+                "executed nothing."
+            )
+            if validation["skipped_calls"]:
+                response["note"] += (
+                    f" {validation['skipped_calls']} later step(s) build on "
+                    "objects an earlier step would create, so Google could "
+                    "only validate the step(s) before them."
+                )
         if forced_by_config:
             # The caller passed dry_run=false but safety.require_dry_run
             # forced it back on. Tell them exactly why and how to unlock
@@ -2257,6 +2321,38 @@ def _existing_negative_geo_exclusions(
     return ids
+def _current_ad_group_cpc_bid(
+    config: AdLoopConfig, customer_id: str, ad_group_id: str
+) -> float | None:
+    """The ad group's current manual CPC bid in account currency, or None."""
+    from adloop.ads.gaql import execute_query
+    rows = execute_query(config, customer_id, f"""
+        SELECT ad_group.cpc_bid_micros
+        FROM ad_group
+        WHERE ad_group.id = {ad_group_id}
+        LIMIT 1
+    """)
+    micros = rows[0].get("ad_group.cpc_bid_micros") if rows else None
+    return int(micros) / 1_000_000 if micros else None
+def _current_campaign_cpc_ceiling(
+    config: AdLoopConfig, customer_id: str, campaign_id: str
+) -> float | None:
+    """The campaign's current Maximize Clicks CPC ceiling, or None if unset."""
+    from adloop.ads.gaql import execute_query
+    rows = execute_query(config, customer_id, f"""
+        SELECT campaign.target_spend.cpc_bid_ceiling_micros
+        FROM campaign
+        WHERE campaign.id = {campaign_id}
+        LIMIT 1
+    """)
+    micros = rows[0].get("campaign.target_spend.cpc_bid_ceiling_micros") if rows else None
+    return int(micros) / 1_000_000 if micros else None
 def _ad_group_campaign_bidding_strategy(
     config: AdLoopConfig, customer_id: str, ad_group_id: str
 ) -> str | None:
@@ -2851,8 +2947,20 @@ def _extract_resource_name(resp: object) -> str:
     return ""
-def _execute_plan(config: AdLoopConfig, plan: object) -> dict:
-    """Dispatch to the right API call based on plan.operation."""
+def _validate_with_google(config: AdLoopConfig, plan: object) -> dict:
+    """Send a Google Ads plan with validate_only=True; raises if Google rejects it."""
+    return _execute_plan(config, plan, validate_only=True)
+def _execute_plan(
+    config: AdLoopConfig, plan: object, *, validate_only: bool = False
+) -> dict:
+    """Dispatch to the right API call based on plan.operation.
+    With ``validate_only`` the plan's Google Ads mutates are sent with
+    ``validate_only=True`` (nothing executes) and the return value reports
+    how many calls Google validated; any rejection raises.
+    """
     from adloop.ads.client import get_ads_client, normalize_customer_id
     # Reddit plans have their own executors and never touch Google: the
@@ -2873,6 +2981,25 @@ def _execute_plan(config: AdLoopConfig, plan: object) -> dict:
     client = get_ads_client(config)
     cid = normalize_customer_id(plan.customer_id)
+    if validate_only:
+        from adloop.ads.validate_only import ValidateOnlyClient
+        validator = ValidateOnlyClient(client)
+        result = _dispatch_ads_plan(validator, cid, plan)
+        # Multi-step applies catch their own errors and report them in the
+        # result instead of raising; in a dry run that is still a failure.
+        if isinstance(result, dict) and result.get("error"):
+            raise ValueError(result["error"])
+        return {
+            "validated_calls": validator.validated_calls,
+            "skipped_calls": validator.skipped_calls,
+        }
+    return _dispatch_ads_plan(client, cid, plan)
+def _dispatch_ads_plan(client: object, cid: str, plan: object) -> dict:
+    """Run a Google Ads plan against ``client`` (real or validate-only)."""
     # Conversion-action CRUD lives in its own module; import lazily so the
     # dispatch table (and this module) don't take the dependency at import time.
     from adloop.ads.conversion_actions import (

{adloop-0.14.0 → adloop-0.16.0}/src/adloop/cli.py RENAMED Viewed

@@ -33,9 +33,13 @@ _GOOGLE_CLOUD_INSTRUCTIONS = """\
 │     → https://console.cloud.google.com/apis/credentials         │
 │     Download the JSON file.                                     │
 │                                                                 │
-│  5. Get your Google Ads Developer Token from your MCC account   │
-│     → https://ads.google.com/aw/apicenter                      │
-│     (You need a Manager Account / MCC)                          │
+│  5. Apply for Google Ads API access ON THE PROJECT              │
+│     → https://console.cloud.google.com/google/ads-apis/overview │
+│     New projects start at Test level (test accounts only).      │
+│     "Upgrade access level": Explorer is granted automatically   │
+│     (2,880 ops/day); Basic (15,000/day) needs the consent       │
+│     screen published ("In production") first.                   │
+│     No manager account (MCC) and no developer token needed.     │
 └─────────────────────────────────────────────────────────────────┘
 """
@@ -77,9 +81,11 @@ def _validate_customer_id(raw: str) -> str | None:
     return None
-def _prompt_customer_id(label: str, default: str = "") -> str:
+def _prompt_customer_id(label: str, default: str = "", required: bool = True) -> str:
     while True:
-        value = _prompt(label, default=default)
+        value = _prompt(label, default=default, required=required)
+        if not value and not required:
+            return ""
         formatted = _format_customer_id(value)
         err = _validate_customer_id(formatted)
         if err:
@@ -183,9 +189,10 @@ def _generate_config_yaml(
         f'  property_id: "{property_id}"',
         "",
         "ads:",
+        "  # Legacy; API access comes from the Google Cloud project since 2026-09.",
         f'  developer_token: "{developer_token}"',
         f'  customer_id: "{customer_id}"',
-        "  # MCC / Manager Account ID (required if using a manager account)",
+        "  # MCC / Manager Account ID (only if using a manager account)",
         f'  login_customer_id: "{login_customer_id}"',
         "",
         "gsc:",
@@ -604,23 +611,29 @@ def run_init_wizard() -> None:
     )
     step_num = 4
-    _step_header(step_num, "Google Ads Developer Token")
-    _print("  Find your developer token in your MCC account:")
-    _print("  → https://ads.google.com/aw/apicenter")
+    _step_header(step_num, "Google Ads API access")
+    _print("  Since September 2026 API access belongs to your Google Cloud")
+    _print("  project, not to a developer token. Apply on the project's page:")
+    _print("  → https://console.cloud.google.com/google/ads-apis/overview")
+    _print("  Leave the token empty unless you still run an old setup.")
     _print()
     developer_token = _prompt(
-        "Developer Token",
+        "Developer token (legacy, optional)",
         default=_existing("ads", "developer_token"),
+        required=False,
     )
-    # MCC Account ID (needed before auto-discovery for Ads API calls)
+    # Manager account: optional since access no longer comes from an MCC.
+    # Still needed to reach several accounts through one login.
     step_num += 1
-    _step_header(step_num, "MCC / Manager Account")
-    _print("  Your MCC (Manager) account ID is in the top bar of your MCC.")
+    _step_header(step_num, "Manager Account (MCC), optional")
+    _print("  Only if you manage several accounts through a manager account:")
+    _print("  its ID is in the top bar of the MCC. Leave empty otherwise.")
     _print()
     login_customer_id = _prompt_customer_id(
         "MCC Account ID (XXX-XXX-XXXX)",
         default=_existing("ads", "login_customer_id"),
+        required=False,
     )
     # OAuth + auto-discovery

{adloop-0.14.0 → adloop-0.16.0}/src/adloop/rules/adloop.md RENAMED Viewed

@@ -244,6 +244,9 @@ Same draft → preview → `confirm_and_apply` gate; the plan carries `platform:
 - `update_campaign` replaces POSITIVE geo/language targets entirely (not append). Pass the full desired list. NEGATIVE geo exclusions (criteria with `negative=TRUE`) are **preserved** across a positive-geo replacement — they survive the swap. The preview surfaces preserved negative geo IDs in `preserved_negative_geo_target_ids` so the change is auditable. To ADD negative geo exclusions (e.g. exclude a city inside a targeted state), use `add_negative_locations` — do not try to express exclusions through `geo_target_ids`. To remove a negative geo exclusion explicitly, use `remove_entity` with `entity_type="campaign_criterion"`.
 - `remove_entity` is IRREVERSIBLE — always prefer `pause_entity` unless the user explicitly wants permanent removal. Removal triggers double confirmation in the safety layer.
 - `remove_entity` supports `entity_type` values: "campaign", "ad_group", "ad", "keyword", "negative_keyword", "shared_criterion", "ad_group_criterion", "campaign_criterion", "campaign_asset", "asset", "customer_asset". Use "negative_keyword" to remove campaign-level negative keywords. Use "shared_criterion" to remove a keyword from a shared negative keyword list — the `entity_id` format is "sharedSetId~criterionId" (use the `resource_id` field from `get_negative_keyword_list_keywords`). Use "ad_group_criterion" or "campaign_criterion" to remove demographic targeting (age/gender/parental/income) — pass the `remove_id` returned by `get_demographic_targeting`. Use "campaign_asset" to remove sitelinks and other asset links from a campaign. Use "asset" to remove a standalone asset. Use "customer_asset" to remove a customer-level asset link.
+- A Google Ads `dry_run=true` sends the exact change to Google with `validate_only` — Google checks it and executes nothing. `DRY_RUN_FAILED` carries Google's error and means the real apply would fail the same way; fix the cause and draft again. Steps that build on an object an earlier step would create (e.g. keywords for a new negative list) are counted in `checks.skipped_calls` instead of validated.
+- `max_bid_increase_pct` (default 100) applies to Google Ads bid raises too: `update_ad_group` max_cpc on MANUAL_CPC and `update_campaign` max_cpc on an existing Maximize Clicks ceiling. A first-time ceiling has no baseline and is not capped.
+- New Google Ads ad groups are created enabled; they cannot serve until one of their ads (created PAUSED) is enabled.
 - `require_dry_run: true` in config overrides `dry_run=false` — the user must change the config to allow real mutations.
 - `two_phase_apply: true` in config (always on for AdLoop Cloud) refuses `dry_run=false` with status `DRY_RUN_REQUIRED` until that plan_id has completed one `dry_run=true` pass. Run the dry run, show the user, then apply — do not retry `dry_run=false` in a loop.
 - All operations (including dry runs) are logged to `~/.adloop/audit.log`.

{adloop-0.14.0 → adloop-0.16.0}/src/adloop/server.py RENAMED Viewed

@@ -110,8 +110,13 @@ def _build_orchestration_instructions() -> str:
         "`dry_run=false` after the user explicitly approves the preview. "
         "`require_dry_run` in config can override this.\n"
         "- Respect the config's `max_daily_budget` cap.\n"
-        "- New campaigns, ad groups, RSAs and Reddit ads are created PAUSED. "
+        "- New Google Ads campaigns and RSAs, and every new Reddit campaign, "
+        "ad group and ad, are created PAUSED. A new Google Ads ad group is "
+        "enabled but cannot serve until one of its (paused) ads is enabled. "
         "The user must enable them after review.\n"
+        "- A Google Ads dry run sends the exact change to Google with "
+        "validate_only (nothing executes); DRY_RUN_FAILED means the real "
+        "apply would fail the same way.\n"
         "- One change at a time — don't batch unrelated writes.\n\n"
         "PRE-WRITE CHECKS (before any `draft_*`):\n"
         "- BROAD match keywords require Smart Bidding (MAXIMIZE_CONVERSIONS, "
@@ -251,26 +256,36 @@ def _structured_error(fn_name: str, exc: Exception) -> dict:
     err = str(exc)
     err_lower = err.lower()
-    if "developer_token_not_approved" in err_lower or "only approved for use with test accounts" in err_lower:
+    # Access levels belong to the Google Cloud project that owns the OAuth
+    # client (developer tokens were sunset on 2026-09-09). v25+ names the
+    # project; older API versions still answer with the token wording.
+    if (
+        "cloud_project_not_approved_for_production" in err_lower
+        or "developer_token_not_approved" in err_lower
+        or "only approved for use with test accounts" in err_lower
+    ):
         return {
             "error": (
-                "Google Ads authorization failed — developer token is not "
-                "approved for production accounts."
+                "Google Ads authorization failed — your Google Cloud project's "
+                "API access level (Test) cannot reach production accounts."
             ),
             "hint": (
-                "This developer token can only access Google Ads test accounts. "
-                "Apply for Basic or Standard access in the Google Ads API Center, "
-                "or switch AdLoop to a test account."
+                "Open the project's Google Ads API Overview page "
+                "(https://console.cloud.google.com/google/ads-apis/overview) and "
+                "apply for Explorer access (usually granted automatically) or "
+                "Basic access (needs the OAuth consent screen brand-verified: "
+                "External and In production). Or switch AdLoop to a test account."
             ),
-            "auth_error": "DEVELOPER_TOKEN_NOT_APPROVED",
+            "auth_error": "CLOUD_PROJECT_NOT_APPROVED_FOR_PRODUCTION",
         }
     if "developer_token_invalid" in err_lower or "developer token is not valid" in err_lower:
         return {
-            "error": "Google Ads authentication failed — developer token is invalid.",
+            "error": "Google Ads authentication failed — the configured developer token is invalid.",
             "hint": (
-                "Update `ads.developer_token` in `~/.adloop/config.yaml` with "
-                "the token from your Google Ads manager account API Center. "
+                "Since September 2026 no developer token is needed: remove "
+                "`ads.developer_token` from `~/.adloop/config.yaml`. API access "
+                "belongs to the Google Cloud project that owns your OAuth client. "
                 "OAuth is working if GA4 tools succeed."
             ),
             "auth_error": "DEVELOPER_TOKEN_INVALID",
@@ -2263,9 +2278,15 @@ def confirm_and_apply(
     DRY_RUN_REQUIRED until this plan_id has completed one dry_run=true
     pass. Run the dry run, show it to the user, then apply for real.
+    Google Ads plans: the dry run sends the exact mutates to Google with
+    validate_only=True, so Google checks the change and executes nothing
+    (`checks` counts the validated calls). Steps that build on an object an
+    earlier step would create cannot be validated and are counted as skipped.
     Reddit plans: Reddit has no validate-only mode, so the dry run re-reads
-    the target entity and re-checks the safety caps (returned as `checks`);
-    a DRY_RUN_FAILED result means the real apply would also fail.
+    the target entity and re-checks the safety caps (returned as `checks`).
+    Either way, a DRY_RUN_FAILED result means the real apply would also fail.
     The plan_id comes from a prior draft_* or pause/enable tool call.
     """