ScriptSeen agent plugins 1.1.3

ScriptSeen 1.1.3 adds a ChatGPT script workspace. A connected creator can make a script from a brief, review and edit it in the MCP Apps panels, save it to their account, and ask ChatGPT to revise saved scripts through MCP tools.

Saved-library reads and writes have separate OAuth permissions. Edits require an explicit save and a current revision. The hosted API and plugin downloads are live at scriptseen.com. The OpenAI directory submission remains the earlier 1.1.0 review version; directory approval is separate.

Download the Codex or Claude package below, connect to https://api.scriptseen.com/mcp, and approve the permissions you need. Existing connections must reconnect to grant the new library scopes.

ScriptSeen agent plugins 1.1.0

Agent integration release — 2026-09-22

Implemented OAuth authorization-code/S256 PKCE account linking for the narrow
MCP tools. Explicit consent, exact callback/resource binding, secure flow cookies,
one-use codes, hashed credentials, refresh rotation/replay family revocation,
rate limits, owner revocation, account-deletion cleanup and Firestore TTL are
covered by protocol tests. Personal tokens remain available.

Added a responsive consent screen and connected-app management; corrected
OAuth-first setup instructions, phone checkbox layout, contrast and skip-link
styling. Updated privacy disclosures and Vietnamese, Chinese and Spanish copy.

Prepared Codex and Claude packages version 1.1.0, a Claude/Grok-compatible public
repository export, marketplace instructions, listing copy, reviewer test cases
and Grok Bot template instructions. Added the publisher operations skill and
updated the consumer scriptseen-create skill. Both are installed in the local
Codex skills directory and validated.

Validation

• Python ScriptSeen suite: 457 tests passed before the final extra OAuth cases;
  final OAuth/store run: 15 tests passed, including concurrent exchange/replay,
  Firestore parity, account isolation, expiry and request limits.
• Dashboard: 13 passed.
• Web: 321 passed; production build passed.
• iOS: 235 executed, 2 StoreKit skips, no failures; no archive/upload needed.
• Plugin manifests and both skills validated.
• Rendered browser QA at 1440, 390 and 320 pixels: no overflow or JavaScript
  errors; permission narrowing, Allow, Deny, revocation and expired-flow recovery.
  Authentication/model providers were test doubles for these local checks.

Boundaries

This release does not prove that a live Codex, Claude, Muse or Grok account has
completed sign-in. No marketplace approval or listing is claimed. OpenAI and
Claude publishing portals currently require the owner's login. OAuth does not
provide OIDC/UserInfo or enterprise email-domain restriction support. See
STATUS.md for publication evidence and outstanding marketplace-specific steps.

Production evidence

Implementation merged to canonical at de6d07054430 before deployment.
Cloud Build f042af6a-add8-4c49-bc6e-f5fc863bb970 succeeded. API revision
scriptseen-api-00102-xbs serves image api:de6d070. The reviewed Terraform
apply completed: one OAuth TTL field added, API and shared-image trends job
updated, no resources destroyed. Firebase Hosting released the matching site.
Public Codex/Claude ZIPs were fetched and confirmed as 1.1.0, three files each;
the production integration page links the dedicated public repository.

Live non-generating protocol smoke passed OAuth/resource discovery, 401 MCP
challenge, public dynamic registration, exact callback/PKCE authorization,
secure flow cookie, trusted-origin credentialed CORS, human-login enforcement
for consent and untrusted-origin rejection. No grant or generation was created.
No ERROR logs were found for the new API revision in the checked 20-minute
window. Local UI checks use test identities; a real vendor login remains untested.

The dedicated public repository was published at initial commit
70516e8c502ad1a5d812e7c108cc800d09ca550a. It contains only the export allowlist;
no private source, customer data, deployment state or credentials. Publisher
portals require account access; native Grok Bot inspection was blocked by the
locked Mac. Muse's submission anchor currently links back to its own page.

Distribution and submission

Grok Build submission: xai-org/plugin-marketplace#863,
branch commit 73e3bbe, pinning the public plugin commit above. The upstream
catalog validator, generated index and index check passed. Remote source commits
were fetched and HEAD-verified into a cache; upstream generator code was unchanged.
Only the ScriptSeen catalog entry and generated index record changed. Approval
and marketplace listing are pending xAI's review.

The final website copy update (bf50327) distinguishes personal tokens from
OAuth apps in empty states and table labels. Its 321 web tests and production
build passed; Hosting release succeeded after retrying a temporary network
failure. This does not change the API image. Updated export includes OAuth
operations and this release note so relative documentation links resolve.

MCP Registry latest remains 1.0.0. The new 1.1.0 manifest is ready, but publisher
authentication is not available in the local publisher configuration. Direct
OAuth and the existing personal-token fallback are independent of that listing.

Local Codex skills installed and validated:

• ~/.codex/skills/scriptseen-create/SKILL.md: consumer workflow.
• ~/.codex/skills/scriptseen-agent-publishing/SKILL.md: publishing operations.
  The versioned integration and deployment skills were also updated.