Owner: Sam Aguiar

Repo: samaguiar1982-cpu/projects, branch main (latest marketing commit: 1dcc06c)

Live URLs:

This supersedes-extends the 2026-06-01 export (Session Export — Marketing Center: live data wiring complete). Read that for the full Wave 1–4 build detail; this page covers final session state and the single outstanding blocker.

⛔ THE ONE BLOCKER — Salesforce OAuth reauth

The SF MCP Worker refresh token is expired (invalid_grant). All 28 SF SOQL refresh queries fail; the dashboard serves the baked 2026-05-22 snapshot for SF-sourced KPIs. CallRail phone KPIs are LIVE. An amber banner on the dashboard tells viewers SF data is stale.

Sam attempted reauth via https://mcp.aguiarinjurylawyers.com/oauth/start and hit OAUTH_APPROVAL_ERROR_GENERIC.

Root cause analysis (verified, not guessed)

Traced the Worker's redirect with curl -I: /oauth/start 302s to login.salesforce.com/services/oauth2/authorize — NOT the org's My Domain. For a My Domain org (samaguiarinjurylawyers2.my.salesforce.com), that mismatch is the classic cause of OAUTH_APPROVAL_ERROR_GENERIC.

Fix path A — use the My Domain authorize URL directly (no code change)

Open this in a browser, signed in as sam@kylawoffice.com (the org's actual admin username — NOT a Gmail address; verified by user query, no samaguiar1982@ or aguiarlawmarketing@ users exist in this org):

<https://samaguiarinjurylawyers2.my.salesforce.com/services/oauth2/authorize?response_type=code&client_id=3MVG9cHH2bfKACZa_5VZ0ykoSgCcyNzz3ko1QZkQeT2GyD_cM2gkF8AbMhpG84L.PW8vOQpcXeTMkTjIw.QdP&redirect_uri=https%3A%2F%2Fmcp.aguiarinjurylawyers.com%2Foauth%2Fcallback&scope=api%20refresh_token%20offline_access>

The Worker's /oauth/callback captures the refresh token automatically.

Fix path B — if A still errors

Check the Connected App in SF Setup → App Manager → SamAguiar_AI_Integration → Manage: