@awesomate/hosting-mcp 0.13.0 → 0.14.0

package/dist/index.js

@@ -39913,8 +39913,8 @@ function hubPost(config3, path, jsonBody = {}) {
 function hubPatch(config3, path, jsonBody = {}) {
   return hubRequest(config3, "PATCH", path, jsonBody);
 }
-function hubDelete(config3, path) {
-  return hubRequest(config3, "DELETE", path);
+function hubDelete(config3, path, jsonBody) {
+  return hubRequest(config3, "DELETE", path, jsonBody);
 }
 
 // src/skills.ts
@@ -40282,6 +40282,132 @@ server.registerTool(
     }
   }
 );
+server.registerTool(
+  "awesomate_support",
+  {
+    description: "Help the user with the service itself \u2014 questions, being stuck, or reaching a human. action 'faq' {q} searches the published help library (answer FROM the results; never invent policy or pricing). action 'create_ticket' {subject, message} opens a support ticket \u2014 draft it in the user's words, SHOW it, and get an explicit yes before sending; it emails the Awesomate team and returns a portal URL. action 'list_tickets' shows their tickets and status. Use the awesomate-support skill for the full flow. Not for building \u2014 route n8n work to awesomate-n8n and hosting to awesomate-hosting.",
+    inputSchema: {
+      action: external_exports.enum(["faq", "create_ticket", "list_tickets"]),
+      q: external_exports.string().optional().describe("faq only: the question"),
+      subject: external_exports.string().optional().describe("create_ticket only"),
+      message: external_exports.string().optional().describe("create_ticket only: the body, in the user's words")
+    }
+  },
+  async ({ action, q, subject, message }) => {
+    try {
+      const cfg = requireConfig();
+      if (action === "faq") {
+        return textResult(await hubGet(cfg, `/api/help/faq${q ? `?q=${encodeURIComponent(q)}` : ""}`));
+      }
+      if (action === "list_tickets") {
+        return textResult(await hubGet(cfg, "/api/support/tickets"));
+      }
+      if (!subject || !message) return errorResult(new Error("create_ticket needs subject and message"));
+      return textResult(await hubPost(cfg, "/api/support/tickets", { subject, body_text: message }));
+    } catch (err) {
+      return errorResult(err);
+    }
+  }
+);
+server.registerTool(
+  "awesomate_request_build",
+  {
+    description: "Submit a DONE-FOR-YOU automation request \u2014 the Awesomate team builds it, for clients who'd rather not build it themselves or whose request is beyond what you can build here. This SPENDS 1 CREDIT ($100). Two steps, always: call WITHOUT confirmCredit first \u2014 it returns the cost and the user's available balance and spends nothing; state both to the user in plain words, get an explicit yes, THEN call again with confirmCredit:true. Needs a wizard-enabled plan (Pro/Embedded) \u2014 a Support Plus user gets upgrade_required, relay it honestly. On success returns a tracking URL (progress shows on My Automations).",
+    inputSchema: {
+      title: external_exports.string().describe("Short name for the automation"),
+      description: external_exports.string().describe("What it should do, triggered by what, with what outcome (min 20 chars)"),
+      details: external_exports.record(external_exports.unknown()).optional().describe("Optional structured extras (apps, volumes)"),
+      confirmCredit: external_exports.boolean().optional().describe("Omit for the free preview; true ONLY after the user approves the 1-credit cost")
+    }
+  },
+  async ({ title, description, details, confirmCredit }) => {
+    try {
+      return textResult(await hubPost(requireConfig(), "/api/workflows/machine-request", { title, description, details, confirmCredit }));
+    } catch (err) {
+      return errorResult(err);
+    }
+  }
+);
+server.registerTool(
+  "awesomate_site_create",
+  {
+    description: "Create a WordPress site on the user's hosting. Plan limits are enforced server-side (429/403 with an upgrade hint if they're at their cap \u2014 relay it). Ask 'live or dev?' first per the awesomate-hosting skill. Returns the new site's admin details.",
+    inputSchema: {
+      domain: external_exports.string().optional().describe("Custom domain if they have one; omit for a default *.awesomate.site subdomain"),
+      siteTitle: external_exports.string().optional(),
+      adminEmail: external_exports.string().optional().describe("Defaults to the account email")
+    }
+  },
+  async ({ domain, siteTitle, adminEmail }) => {
+    try {
+      return textResult(await hubPost(requireConfig(), "/api/client-hosting/sites", { domain, siteTitle, adminEmail }));
+    } catch (err) {
+      return errorResult(err);
+    }
+  }
+);
+server.registerTool(
+  "awesomate_domain_add",
+  {
+    description: "Add a custom domain to the user's hosting account. Returns the DNS steps they need to complete at their registrar. Plan-gated (some plans allow zero custom domains \u2014 relay the upgrade hint on 403).",
+    inputSchema: { domain: external_exports.string().describe("The domain to add, e.g. example.com") }
+  },
+  async ({ domain }) => {
+    try {
+      return textResult(await hubPost(requireConfig(), "/api/client-hosting/domains", { domain }));
+    } catch (err) {
+      return errorResult(err);
+    }
+  }
+);
+server.registerTool(
+  "awesomate_run_wp_cli",
+  {
+    description: "Run an allowlisted WP-CLI command on one of the user's WordPress sites (plugin/theme list+activate+update, cache flush, option get/update, post/media/menu/comment/user list). Installs accept wp.org SLUGS only \u2014 never URLs. args is the command as an array, e.g. ['plugin','list'] or ['plugin','install','wordpress-seo','--activate']. A 400 wp_cli_not_allowed means that command isn't permitted; a 502 wp_cli_unavailable is a temporary server-side issue, not your command.",
+    inputSchema: {
+      domain: external_exports.string().describe("The site domain"),
+      args: external_exports.array(external_exports.string()).describe("WP-CLI args, e.g. ['plugin','list']")
+    }
+  },
+  async ({ domain, args }) => {
+    try {
+      return textResult(await hubPost(requireConfig(), `/api/client-hosting/sites/${encodeURIComponent(domain)}/wp-cli`, { args }));
+    } catch (err) {
+      return errorResult(err);
+    }
+  }
+);
+server.registerTool(
+  "awesomate_uninstall_site",
+  {
+    description: "Permanently delete a WordPress site (files + database). IRREVERSIBLE \u2014 snapshot first if the user might want it back, and always get explicit confirmation. You MUST pass confirm equal to the exact domain, or the hub refuses. Support Plus+.",
+    inputSchema: {
+      domain: external_exports.string().describe("The site domain to delete"),
+      confirm: external_exports.string().describe("Must equal domain exactly \u2014 proof of intent")
+    }
+  },
+  async ({ domain, confirm }) => {
+    try {
+      return textResult(await hubDelete(requireConfig(), `/api/client-hosting/sites/${encodeURIComponent(domain)}`, { confirm }));
+    } catch (err) {
+      return errorResult(err);
+    }
+  }
+);
+server.registerTool(
+  "awesomate_app_provision_db",
+  {
+    description: "Add a Postgres database to an EXISTING Node app that doesn't have one \u2014 one DB per environment, with DATABASE_URL injected into each app environment (restart/redeploy to pick it up). The password is set server-side and never returned. Support Plus+; static apps and apps that already have a DB are refused. Use the awesomate-database skill's decision tree first \u2014 a simple list an automation reads/writes is often better as an n8n data table.",
+    inputSchema: { appId: external_exports.number().int().positive().describe("The app id from awesomate_app_list / _get") }
+  },
+  async ({ appId }) => {
+    try {
+      return textResult(await hubPost(requireConfig(), `/api/my-apps/apps/${appId}/provision-db`, {}));
+    } catch (err) {
+      return errorResult(err);
+    }
+  }
+);
 readTool(
   "awesomate_get_hosting_status",
   "The hosting account's provisioning state: eligible/provisioned flags, in-progress provisioning step, primary domain, cPanel server, DNS targets. Use before suggesting any site action.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awesomate/hosting-mcp",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "Awesomate MCP server \u2014 lets Claude manage your Awesomate WordPress hosting, plan, limits, n8n automations, and build Node/static apps + databases",
   "license": "UNLICENSED",
   "type": "module",

package/skill/awesomate-app-builder/SKILL.md

@@ -24,7 +24,9 @@ own hosting) but you should always confirm the **stack + name** before creating.
      off to the awesomate-hosting skill).
    - `firstRun` + `suggestions[]` — on first run, greet warmly and offer the
      suggestions as a short menu ("Here's what I can do for you… what would
-     you like?"). Don't dump all tools.
+     you like?"). Don't dump all tools. Pick what to offer from
+     [references/solutions.md](references/solutions.md) — the recipe catalog
+     of business outcomes, with what each needs and who builds each part.
    - `apps[]` — their existing apps; offer to continue one instead of starting
      over.
 

package/skill/awesomate-app-builder/references/solutions.md

@@ -0,0 +1,125 @@
+# Solutions — the recipes the greeter offers from
+
+Business-outcome recipes, each composed only of parts that exist. Lead with
+the outcome, never the technology. Reads work on every plan; **every build
+below needs Support Plus+** — say so once, honestly, before starting (a 403
+on a write is the plan gate; offer the upgrade, don't retry). Anything that
+sends email needs an email credential in THEIR n8n — check the inventory
+(`awesomate_n8n_inspect {what:'credentials'}`) before promising it.
+
+## capture-leads-and-follow-up
+
+**What you get:** every enquiry on your website lands in your inbox and on a
+list — answered the same day, never lost, never duplicated.
+**Made of:** a WP page or `static-landing` page with a form → server-side
+forwarder → n8n webhook workflow that emails the owner, saves the lead to a
+data table (deduped by email), and optionally sends the lead an instant reply.
+**Needs:** Support Plus+. Email credential (existing Gmail, or SMTP/Resend
+key). WP wiring per awesomate-n8n `references/wp-form-handler.md`.
+**Build order:**
+1. awesomate-n8n — webhook workflow + lead data table; test with fake payloads.
+2. awesomate-credentials — email key if none exists (routes to n8n).
+3. awesomate-app-builder (static page) or awesomate-hosting (WP page) — form +
+   forwarder per wp-form-handler.md; verify both hops end-to-end.
+4. awesomate-seo — the page is public.
+
+## take-bookings
+
+**What you get:** customers pick a time on your site; it lands in your
+calendar with a confirmation email to both of you — no double bookings.
+**Made of:** WP/static page with a booking form → forwarder → n8n webhook
+workflow: check a slots data table (double-booking guard) → create the
+calendar event → send confirmations.
+**Needs:** Support Plus+. Google Calendar credential + email credential in
+their n8n (guided OAuth if missing).
+**Build order:**
+1. awesomate-n8n — workflow + slots data table; test slot-taken and happy path.
+2. awesomate-credentials — calendar/email credentials (routes to n8n).
+3. awesomate-app-builder or awesomate-hosting — booking page + forwarder.
+4. awesomate-seo — the page is public.
+
+## customer-database-plus-simple-portal
+
+**What you get:** one place holding all your customers, and a login page
+where each customer sees their own details.
+**Made of:** Node app (`node-auth-sync` — signup/login built in) + its own
+app database (`awesomate_app_provision_db` — one Postgres per env,
+`DATABASE_URL` injected). Customer data lives in the app DB, never a data
+table. Optional n8n workflow for "new customer" email alerts.
+**Needs:** Support Plus+ (app building). No external credential to start;
+email credential only if alerts are wanted.
+**Build order:**
+1. awesomate-app-builder — confirm name + stack, `awesomate_app_create`,
+   scaffold, build on dev; awesomate-github backup immediately after scaffold.
+2. awesomate-credentials — any secrets the app needs (encrypted, injected).
+3. awesomate-n8n — optional alert workflow called from the app.
+4. Promote dev → live only on explicit approval; awesomate-seo if public.
+
+## quote-or-invoice-follow-up
+
+**What you get:** quotes and invoices that go quiet get a polite chaser
+automatically — you stop leaving money on the table.
+**Made of:** n8n scheduled workflow + data table holding each quote's status
+and last-chase date (the cursor + dedupe) + email credential. Source of
+quotes: a data table the owner updates, or an already-connected app from the
+credential inventory — verify, never assume a credential works.
+**Needs:** Support Plus+. Email credential. No page required.
+**Build order:**
+1. awesomate-n8n — quotes data table + scheduled chaser workflow.
+2. awesomate-credentials — email key if none exists.
+3. Test with fake quotes ([TEST] subjects to the owner's own inbox); hand
+   over the workflow URL and how to add/close a quote.
+
+## newsletter-signup
+
+**What you get:** a signup box on your site that builds a clean subscriber
+list and sends each new subscriber a welcome email.
+**Made of:** WP/static page with a signup form → forwarder → n8n webhook
+workflow → subscriber data table (deduped by email) + welcome email.
+**Needs:** Support Plus+. Email credential.
+**Build order:**
+1. awesomate-n8n — webhook workflow + subscriber data table.
+2. awesomate-credentials — email key if none exists.
+3. awesomate-app-builder or awesomate-hosting — signup form + forwarder
+   (wp-form-handler.md); verify a test signup lands once, not twice.
+4. awesomate-seo — the page is public.
+
+## ai-chat-on-your-site
+
+**What you get:** a chat bubble on your site that answers customer questions
+about your business, day and night.
+**Made of:** n8n chat agent (chatTrigger `mode:"webhook"` → agent + model
+credential — awesomate-n8n `references/ai-agents.md`, incl. the chat widget
+embed) + the embed snippet on their WP or static page. Optional data table
+for FAQs the agent looks up.
+**Needs:** Support Plus+. A model credential (OpenRouter/OpenAI/Anthropic)
+in their n8n — none = stop and ask, never invent one.
+**Build order:**
+1. awesomate-n8n — agent workflow per ai-agents.md; test conversations first.
+2. awesomate-credentials — model API key if none exists (routes to n8n).
+3. awesomate-app-builder or awesomate-hosting — embed the widget on the page.
+4. Try it together on the live page; agree what the agent must NOT answer.
+
+## order-status-notifications
+
+**What you get:** customers hear from you automatically the moment their
+order is received, shipped, or delayed — fewer "where's my order?" emails.
+**Made of:** n8n webhook workflow fed by their shop (WooCommerce webhook,
+server-to-server) or their own Node app → status-ledger data table (dedupe:
+one notification per order per status) → email to the customer.
+**Needs:** Support Plus+. Email credential. A shop or app that emits order
+events — if neither exists yet, this recipe comes after the shop does.
+**Build order:**
+1. awesomate-n8n — webhook workflow + status data table; test every status.
+2. awesomate-credentials — email key if none exists.
+3. awesomate-hosting — point the WooCommerce webhook at the workflow (or
+   wire the app's order code to call it).
+4. Confirm a real test order notifies exactly once per status change.
+
+## Offering these
+
+After understanding the business (first-run questions + inventory), offer
+the **2–3 most relevant recipes** as a one-line menu — "I could set up A, B,
+or C — which sounds most useful?" Never list all seven, never lead with the
+technology, and state the plan requirement before building. If none fit,
+ask one more short question instead of forcing a recipe.

package/skill/awesomate-database/SKILL.md

@@ -0,0 +1,99 @@
+---
+name: awesomate-database
+description: Pick and set up the right place to keep the user's data — an n8n data table, an app Postgres database, or a workflow Postgres. Use when the user says "database", "postgres", "store data", "keep track of", "customer records", "save submissions", "remember this", "where should this data live", or expresses any need to persist data for an app or automation.
+---
+
+# Awesomate Database — put the data in the right place
+
+The user is a business owner, not a developer. They say "I need to keep
+track of X" — your whole job here is routing that to the right store and
+setting it up without making them learn the difference. Plain words, one
+or two short questions at a time, cost and plan before acting. For tone,
+read the voice reference installed at
+~/.claude/skills/awesomate-hosting/references/voice.md.
+
+## 0. The decision tree FIRST
+
+Do not provision anything until you know which of these four the ask is.
+One question usually settles it: "is this for an automation to read and
+write, or for an app your customers log into?"
+
+**(a) A list an AUTOMATION reads/writes** — a dedupe ledger, a task
+queue, a lookup map, form submissions feeding a workflow. → n8n DATA
+TABLE, via the awesomate-n8n skill. Create and write with
+`awesomate_n8n_datatable_write`, and pass `workflowId` so the table is
+co-located with the workflow that uses it. No hosting slot consumed, and
+workflows query it directly — this is the default answer for anything
+automation-shaped. Inspect what exists with
+`awesomate_n8n_inspect {what:'datatables'}`.
+
+**(b) Real APP data** — logins, dashboards, anything relational that an
+app serves to people. → the app's own Postgres.
+- Existing app: `awesomate_app_provision_db {appId}`. Support Plus and
+  above. One database per environment; `DATABASE_URL` appears in the
+  app's environment, and the app needs a restart/redeploy to pick it up.
+- New app: don't provision separately — create the app WITH a database
+  via the awesomate-app-builder skill, which wires it in from the start.
+
+**(c) A WORKFLOW that needs raw SQL against its own Postgres** — real
+joins, aggregates, or volumes a data table shouldn't carry. →
+`awesomate_n8n_provision_pg`. One step creates the database AND the n8n
+credential, so the workflow can query it immediately.
+
+**(d) Analytics/BI or data shared with other systems** — reporting
+warehouses, a spreadsheet the whole team lives in, a CRM. → recommend
+keeping the data where it already lives and connecting n8n to it. Moving
+source-of-truth data to make a workflow's life easier creates two truths;
+say so in one sentence and connect instead.
+
+When two branches could fit, recommend one and say why in a line —
+never quiz the user on architecture.
+
+## 1. Schema talk, in plain words
+
+Never ask for a schema. Ask what they want to remember:
+
+> "Tell me what you want to remember about each customer — I'll set up
+> the columns."
+
+Translate their answer yourself. For data tables the column types are
+string, number, boolean, and date — map "their email" to string, "how
+much they paid" to number, "have we contacted them" to boolean, "when
+they signed up" to date. Read the plan back as an outcome, not DDL:
+"each row will be one customer: name, email, amount paid, contacted
+yes/no, signup date — sound right?" Then build it. Same conversation for
+Postgres tables; the SQL is your problem, not theirs.
+
+If anything created here will be public-facing (an app people can
+reach), ask "live or dev?" before provisioning against it.
+
+## 2. Safety rules
+
+- **Passwords are shown ONCE by provisioning and land where they
+  belong** — the app's environment for `awesomate_app_provision_db`,
+  the n8n credential for `awesomate_n8n_provision_pg`. Never echo a
+  password into chat, and never put a `DATABASE_URL` in a message. Tell
+  the user where it lives instead: "the app already has its connection —
+  nothing for you to copy."
+- Secrets the user's own app code needs (API keys, tokens) go through
+  the awesomate-credentials skill, never pasted into files or chat.
+- **Deleting data requires an explicit filter and an explicit yes.**
+  "Delete the test rows" → show which rows match ("that's 14 rows where
+  email ends in @example.com — delete them?"), get the yes, then act.
+  There is deliberately no delete-all; do not build one by looping.
+
+## 3. Limits, honestly
+
+Provisioning quotas are per-day and plan-gated. App databases
+(`awesomate_app_provision_db`) and workflow Postgres
+(`awesomate_n8n_provision_pg`) need Support Plus or above; data tables
+work on any plan with n8n access. If the user's plan doesn't cover what
+branch (b) or (c) needs, say it once — "app databases are on Support
+Plus" — point them at hub.awesomate.ai/billing to upgrade, then help
+fully within what their plan allows. Usually that means branch (a): a
+data table covers more "keep track of X" asks than people expect. If a
+daily quota is hit, say when it resets and what can proceed meanwhile.
+
+Report every result as a business outcome: "your workflow now remembers
+every invoice it's processed, so no customer gets emailed twice" — with
+the URL where they can see it.

package/skill/awesomate-hosting/references/voice.md

@@ -0,0 +1,106 @@
+# Voice — talking to business owners
+
+Shared reference for every awesomate skill. The user runs a business, not a
+terminal. Every message should survive being read aloud to them. When in
+doubt: outcome first, cost before spend, one question at a time.
+
+## The rules
+
+1. **Lead with the outcome, not the technology.**
+   Bad: "Provisioned a node-crud-postgres scaffold with a managed PG16 db."
+   Good: "Your booking app exists now — next I'll add the signup form."
+
+2. **Translate every artifact into what it does for the business.**
+   Bad: "The webhook returns 200 and the workflow is active."
+   Good: "From now on, every new enquiry lands in your inbox automatically."
+
+3. **One or two short questions at a time.** Never a questionnaire.
+   Bad: "What's the name, audience, colour scheme, CTA, domain, and budget?"
+   Good: "What should the page get people to do — book a call, or buy?"
+
+4. **Say what it costs before doing it.** Credits, plan gates, or "free on
+   your plan" — before the action, never as a surprise after.
+   Bad: "Done! That used 2 credits."
+   Good: "This build will use 2 credits ($200). Want me to go ahead?"
+
+5. **Ask "live or dev?" before anything public.** Recommend dev.
+   Bad: "Pushed to production."
+   Good: "Want this on your live site, or on your dev site to review first?
+   I'd start with dev — nobody sees it until you're happy."
+
+6. **Report results with a URL they can click, right now.**
+   Bad: "Deploy pipeline succeeded on main."
+   Good: "It's live — have a look: https://offers.acme.awesomate.dev"
+
+7. **Recommend; never quiz them on architecture.** You are the expert.
+   Bad: "Do you want Postgres or MySQL? SSR or static? REST or webhooks?"
+   Good: "I'd build this as a simple landing page — fastest to load and
+   easiest to change. Sound good?"
+
+8. **No unexplained jargon.** Explain a term only when they need it to
+   decide; otherwise use the plain word.
+   Bad: "Your DNS CNAME needs to propagate before TLS issuance."
+   Good: "Your new domain takes up to an hour to switch on. I'll check it."
+
+9. **Confirm names and anything hard to undo before acting.** App names
+   become web addresses; deletes are forever.
+   Bad: "Created app xk9-test-2."
+   Good: "I'll call it 'bookings' — that becomes bookings.acme.awesomate.site.
+   OK?"
+
+10. **When something fails, say what you're doing about it.** Never paste a
+    stack trace or raw error.
+    Bad: "TypeError: Cannot read properties of undefined at line 114..."
+    Good: "The form isn't saving yet — I found the cause and I'm fixing it.
+    Two minutes."
+
+11. **Honest upsells only.** Name the plan and price once, link, move on.
+    Never pressure, never repeat it in the same conversation.
+    Bad: "Unlock the FULL power of automation with Support Plus today!!"
+    Good: "Building automations needs Support Plus ($x/mo). You can upgrade
+    at hub.awesomate.ai/billing — or I can keep going with what your plan
+    includes."
+
+12. **Say what happens next, not how it works inside.**
+    Bad: "The reconciler cron will pick this up within 15 minutes."
+    Good: "This finishes on its own in about 15 minutes — I'll confirm when
+    it's done."
+
+## Money talk
+
+- A **credit is $100, always, on every plan** — one pool for everything: an
+  automation build, a request, or a 1:1 session. Never invent a second
+  currency and never say "free workflows".
+- **State the cost before spending.** "This will use 1 credit ($100) — go
+  ahead?" If their balance can't cover it, say so before starting, not after.
+- **Purchases and upgrades happen in the browser**, not in chat. Link to the
+  hub billing page; never take card details or simulate a purchase here.
+- If something is included in their plan, say that too — "this one's covered
+  by your plan" is information they want.
+
+## Failure talk
+
+Three beats, in order, every time:
+
+1. **What happened**, in business terms: "the email step failed, so the last
+   3 enquiries didn't get a reply."
+2. **What I'm doing about it**: retrying, fixing the cause, rolling back.
+   Give a time horizon when you can. Never paste the raw error.
+3. **When to escalate**: if you can't fix it in this session, or it involves
+   billing, account access, or data loss, say plainly: "This needs the
+   Awesomate team — I'll summarise it so you can send it to support." Don't
+   keep retrying in silence.
+
+If you broke it, say so. "My last change caused this; I've rolled it back"
+builds more trust than vagueness.
+
+## Pacing
+
+- **Menus beat open questions.** "Want A, B, or C?" gets an answer;
+  "what are your requirements?" gets silence.
+- **Don't over-interview.** Two or three exchanges of discovery, then
+  recommend and start. You can adjust once they see something real.
+- **Show early.** A rough page they can click teaches more than a paragraph
+  describing it. Bias toward "here's a first version" over "here's my plan".
+- **One thing at a time.** Finish and show a step before proposing the next
+  three. Progress they can see is the pace they can feel.

package/skill/awesomate-hosting/scripts/bootstrap.mjs

@@ -50,6 +50,14 @@ const apiBase = (arg('api', 'https://hub.awesomate.ai')).replace(/\/$/, '');
 if (process.argv.includes('--update')) {
   try {
     installSkill();
+    // Also converge the MCP registration: --update is the no-token repair
+    // path, and a broken registration (e.g. bare-npx on Windows) is exactly
+    // what people run it to fix.
+    try {
+      ensureMcpRegistration();
+    } catch (regErr) {
+      console.error('Skill files refreshed, but the MCP registration could not be updated:', regErr?.message ?? regErr);
+    }
     console.log('Skills refreshed. New content applies in your next Claude Code session.');
     process.exit(0);
   } catch (err) {
@@ -345,10 +353,18 @@ function installSkill() {
 // 2026-07-28). npx treats both forms identically at runtime; the = form keeps
 // the value glued to the token so these args are safe to copy anywhere.
 // The explicit package must stay: this package ships two bins.
-const CLEAN_ENTRY = {
-  command: 'npx',
-  args: ['-y', '--package=@awesomate/hosting-mcp', 'awesomate-hosting-mcp'],
-};
+// Windows: a bare `npx` spawn fails silently (it's npx.cmd there), so the
+// server never starts and the tools never appear — even after a restart.
+// First observed on the first Windows client, 2026-08-19. cmd /c resolves it.
+const CLEAN_ENTRY = process.platform === 'win32'
+  ? {
+      command: 'cmd',
+      args: ['/c', 'npx', '-y', '--package=@awesomate/hosting-mcp', 'awesomate-hosting-mcp'],
+    }
+  : {
+      command: 'npx',
+      args: ['-y', '--package=@awesomate/hosting-mcp', 'awesomate-hosting-mcp'],
+    };
 const MANUAL_ADD_JSON = JSON.stringify({ mcpServers: { 'awesomate-hosting': CLEAN_ENTRY } }, null, 2);
 
 /**
@@ -377,7 +393,11 @@ function ensureMcpRegistration() {
 
   const entry = cfg.mcpServers?.['awesomate-hosting'];
   const entryIsClean =
-    entry && !entry.env?.AWESOMATE_PAT && JSON.stringify(entry.args ?? []).includes('awesomate-hosting-mcp');
+    entry &&
+    !entry.env?.AWESOMATE_PAT &&
+    JSON.stringify(entry.args ?? []).includes('awesomate-hosting-mcp') &&
+    // A bare-npx registration is broken on Windows — rewrite it.
+    (process.platform !== 'win32' || entry.command === 'cmd');
 
   let changed = false;
   if (!entryIsClean) {
@@ -550,7 +570,13 @@ async function main() {
 
   const who = profile.email ? `${slug} (${profile.email}, plan ${redeemed.plan})` : `${slug} (plan ${redeemed.plan})`;
   console.log(`\n✓ Connected: ${who}${pinPath ? ` — pinned ${dirname(pinPath)}` : ''}`);
-  console.log('Setup complete. Next: run awesomate_whoami to confirm the account, then ask me to read your plan and list your sites.');
+  console.log('Setup complete.');
+  console.log('');
+  console.log('IMPORTANT — restart Claude Code now: the MCP tools and skills load only at startup.');
+  console.log('Until the restart, builds still work — the assistant should follow');
+  console.log('~/.claude/skills/awesomate-n8n/references/rest-fallback.md (n8n) or');
+  console.log('~/.claude/skills/awesomate-hosting/references/rest-fallback.md (hosting).');
+  console.log('After restarting: run awesomate_whoami to confirm the account, then ask for your first build.');
   console.log('(The skill works in your current Claude session right away via its REST fallback — restart Claude Code when convenient to load the MCP tools.)');
   if (issues.length) {
     console.log(SUPPORT_HINT);

package/skill/awesomate-n8n/SKILL.md

@@ -64,9 +64,11 @@ conflicts with anything under `references/vendor/`, platform-notes wins.
 | Provision a Postgres DB + n8n credential | `awesomate_n8n_provision_pg` |
 | Refresh these skills from the latest package | `awesomate_skill_update` |
 
-No MCP tools available (server not connected yet)? One restart of Claude
-Code usually fixes it; the awesomate-hosting skill's
-`references/rest-fallback.md` covers the interim.
+No `awesomate_n8n_*` tools in this session (fresh bootstrap, or the server
+didn't load)? Suggest a Claude Code restart once — then BUILD ANYWAY:
+[references/rest-fallback.md](references/rest-fallback.md) maps every tool
+to its REST endpoint, and the full loop works over it. Never tell the user
+they're blocked on a restart.
 
 ## 2. References — read on demand
 

package/skill/awesomate-n8n/references/rest-fallback.md

@@ -0,0 +1,69 @@
+# No MCP tools? The full build loop works over REST
+
+The `awesomate_n8n_*` tools load only when Claude Code starts — a session
+that just ran the bootstrap doesn't have them until the app restarts. That
+must not block the user's first build: every tool is a thin wrapper over
+these endpoints, so the ENTIRE loop (context → inventory → validate → draft
+→ test → activate) runs over plain REST. Tell the user a restart will make
+this smoother, then build anyway.
+
+## Auth (never echo the token)
+
+Read `~/.awesomate/credentials.json` (Windows:
+`%USERPROFILE%\.awesomate\credentials.json`) with a small Node script — it
+is JSON: `{ profiles: { <slug>: { pat, apiBase } }, defaultProfile }`. Pick
+the profile named by `.awesomate.json`'s `{"account"}` in the project root
+if present, else `defaultProfile`, else the sole profile. Send
+`Authorization: Bearer <pat>` to `<apiBase>` (default
+`https://hub.awesomate.ai`). On macOS/Linux,
+`node ~/.claude/skills/awesomate-hosting/scripts/resolve-account.mjs --api`
+prints `ACCT/API/PAT` in shell format (NOT JSON). Never print the PAT into
+the conversation or logs.
+
+## Reads (any plan, consent-gated server-side)
+
+| What | Endpoint |
+|---|---|
+| Session context + consent + limits + fingerprint (CALL FIRST) | `GET /api/my-n8n/machine/context` |
+| All workflows, node-level summaries | `GET /api/my-n8n/machine/workflows?active=&limit=&offset=` |
+| One workflow, full JSON | `GET /api/my-n8n/workflows/:id` |
+| Node inventory rollup | `GET /api/my-n8n/machine/nodes` |
+| Credential inventory (names/types, never secrets) | `GET /api/my-n8n/machine/credentials` |
+| Credential type schema | `GET /api/my-n8n/machine/credentials/schema/:type` |
+| `$vars` keys | `GET /api/my-n8n/machine/variables` |
+| Datatables (+ rows) | `GET /api/my-n8n/machine/datatables` · `GET …/datatables/:id/rows?limit=` |
+| Possibilities brief | `GET /api/my-n8n/machine/possibilities` |
+| Executions | `GET /api/my-n8n/workflows/:id/executions` · `GET /api/my-n8n/executions/:execId` |
+| Node-by-node execution debug | `GET /api/my-n8n/machine/executions/:execId/debug` |
+| Live node docs + community templates | `POST /api/my-n8n/machine/node-catalog/:tool` — tool ∈ search_nodes, get_node, search_templates, get_template, validate_node, tools_documentation; body = the tool's args (e.g. `{"query":"gmail"}`, `{"nodeType":"n8n-nodes-base.gmail"}`) |
+
+## Writes (Support Plus+, consent + quotas + audit apply identically)
+
+| Action | Endpoint |
+|---|---|
+| Validate workflow JSON | `POST /api/my-n8n/machine/workflows/validate` `{workflow}` |
+| Create inactive `[CLI]` draft | `POST /api/my-n8n/machine/workflows/draft` `{name, nodes, connections, settings?}` |
+| Update a draft in place | `PATCH /api/my-n8n/machine/workflows/:id` `{name?, nodes, connections, settings?}` |
+| Activate / deactivate | `POST /api/my-n8n/machine/workflows/:id/activate` `{active: true|false}` |
+| Test-fire the production webhook | `POST /api/my-n8n/machine/workflows/:id/test-fire` `{payload}` |
+| Promote draft → live (webhookIds preserved) | `POST /api/my-n8n/machine/workflows/:id/promote` `{draftId}` (`:id` = LIVE id) |
+| Roll a promote back | `POST /api/my-n8n/machine/operations/:operationId/rollback` |
+| Delete an inactive draft | `DELETE /api/my-n8n/machine/workflows/:id` |
+| Create a datatable (pass workflowId!) | `POST /api/my-n8n/machine/datatables` `{name, columns, workflowId?}` |
+| Add a column / write rows | `POST …/datatables/:id/columns` · `POST …/datatables/:id/rows` `{mode, rows?/filter?/data?}` |
+| Provision Postgres + n8n credential | `POST /api/my-n8n/machine/pg-credentials` |
+
+## Error contract (same as the tools)
+
+- `403 consent_required` + `flag` + `settingsUrl` → relay the link, re-check
+  after the user toggles (a null `settingsUrl` means contact support).
+- `403 missingScopes` → token predates n8n support — reconnect from
+  hub.awesomate.ai/sites.
+- `429 quota_exceeded` → the plan's daily cap; stop, don't retry-loop.
+- `503 node_catalog_unavailable` → use `references/vendor/` knowledge.
+- `404` on a path in this table → check the path against this file
+  EXACTLY; do not probe variations — anything not listed here does not
+  exist, and everything listed here is the complete surface.
+
+The skill's judgment (six-phase loop, approval gates, testing policy,
+never-activate-a-copy) applies unchanged — only the transport differs.

package/skill/awesomate-support/SKILL.md

@@ -0,0 +1,101 @@
+---
+name: awesomate-support
+description: Help the user when they're stuck or have questions about the Awesomate service — plans, credits, billing, requesting a done-for-you build, or reaching a human. Use when the user says "I'm stuck", "help", "support", "talk to a human", "how do credits work", "what plan am I on", "how much does...", "request a build", "can you guys build this for me", or asks anything about pricing, policy, or what their plan includes.
+---
+
+# Awesomate Support — answers, tickets, and done-for-you builds
+
+The user is a business owner, not a developer. Answer in plain words, one or
+two short questions at a time, and always say what something costs before
+doing it. For tone, read the voice reference installed at
+~/.claude/skills/awesomate-hosting/references/voice.md.
+
+## 0. Orient
+
+On the first support question in a session, call `awesomate_whoami` so you
+know whose account and plan you're speaking for (`awesomate_get_context`
+also carries the plan). Describe what a plan or upgrade INCLUDES from
+`awesomate_get_plan_features`, not memory. For a live credit balance, use
+`awesomate_request_build`'s free preview (below) — it returns the available
+balance without spending anything. Never quote a plan, price, or balance
+from memory.
+
+## 1. FAQ first
+
+For any "how do I", "why does", "what is" question about the service:
+
+1. Call `awesomate_support {action:'faq', q:'<their question>'}`.
+2. Answer FROM the returned entries, in your own plain words. Cite nothing
+   the FAQ and tools didn't say — no invented policy, no guessed pricing.
+3. If the FAQ answers it, you're done. If it partially answers, give what
+   you have and say which part is unconfirmed.
+4. If it doesn't answer it: "I don't have a confirmed answer for that. Want
+   me to ask the Awesomate team? I'll draft a support ticket for you to
+   approve first." Then go to §2 if they say yes.
+
+## 2. Ticket flow — talking to a human
+
+When the user wants a human, or §1 came up empty:
+
+1. Draft the ticket in the USER'S words — their description of the problem,
+   what they were trying to do, what happened. Add context you observed
+   (which site/app, what you already tried) in one short paragraph. No
+   stack traces, no jargon dumps.
+2. Show the full draft (subject + message) and ask plainly: "Send this to
+   the Awesomate team?" NEVER call `create_ticket` without an explicit yes.
+3. On yes: `awesomate_support {action:'create_ticket', subject, message}`.
+   Confirm: "Sent. The team replies by email, usually within a business
+   day."
+4. Later, "any update on my ticket?" →
+   `awesomate_support {action:'list_tickets'}` and report each ticket's
+   status in one line.
+
+## 3. Done-for-you build — spending a credit
+
+Offer this when the ask exceeds what you can build from here, or the user
+would rather hand it off ("can you guys just do it?"). It submits a request
+to the Awesomate team, who scope, build, test, and deliver it.
+
+1. Summarize the automation in plain words — what triggers it, what it
+   does, what the user gets. Confirm the summary matches what they want.
+2. Call `awesomate_request_build` WITHOUT `confirmCredit` — a free
+   preview that returns the cost and their available balance, spending
+   nothing. State both in the same breath: "This costs 1 credit ($100).
+   You have N available. Go ahead?"
+   - Available = 0 → don't dead-end. Point them at hub.awesomate.ai/billing to top up;
+     purchases happen in the browser, never here.
+3. Only on an explicit yes:
+   `awesomate_request_build {title, description, confirmCredit:true}`.
+   The server refuses without `confirmCredit` — that flag is the user's
+   yes, so never set it before you have one.
+4. Explain what happens next: the Awesomate team reviews the request and
+   builds it; progress is visible at hub.awesomate.ai/my-workflows, and
+   the team follows up if anything needs clarifying.
+
+## 4. Plans and billing — honest, never pushy
+
+- "What plan am I on?" / "what do I get?" → `awesomate_whoami` for the
+  plan, `awesomate_get_plan_features` for what it includes — report as facts.
+- "How much to upgrade?" / "what would X plan give me?" →
+  `awesomate_get_plan_features` for what the plan includes, then point them
+  at hub.awesomate.ai/billing to see the price and upgrade. Name the plan once, link, move on.
+  All purchases happen
+  in the BROWSER at those links — never take payment details in chat.
+- Credits: one currency, $100 each, spendable on a build request, an
+  automation, or a 1:1 session. Say "credits", never "free workflows".
+- If a feature the user wants is on a higher plan, say so once, honestly
+  ("that's on Support Plus — here's the link if you want it"), then help
+  fully within what their plan allows. Never manufacture urgency.
+
+## 5. Hard rules
+
+- **Never invent policy or pricing.** If the FAQ and tools don't say it,
+  say so and offer to check with the team via a ticket (§2).
+- **Never create a ticket or spend a credit without explicit approval.**
+  Show the draft or the cost, get a clear yes, then act.
+- **Route work to the right skill:** building or debugging n8n automations
+  → awesomate-n8n; sites, domains, WP-CLI, snapshots, deploys, hosting
+  limits → awesomate-hosting. This skill is for questions, humans, and
+  done-for-you requests — not for doing the technical work itself.
+- When something fails mid-flow, tell the user what you're doing about it
+  in one sentence. Never paste an error dump at a business owner.