@awesomate/hosting-mcp 0.13.1 → 0.15.0

package/dist/index.js

@@ -39913,8 +39913,8 @@ function hubPost(config3, path, jsonBody = {}) {
 function hubPatch(config3, path, jsonBody = {}) {
   return hubRequest(config3, "PATCH", path, jsonBody);
 }
-function hubDelete(config3, path) {
-  return hubRequest(config3, "DELETE", path);
+function hubDelete(config3, path, jsonBody) {
+  return hubRequest(config3, "DELETE", path, jsonBody);
 }
 
 // src/skills.ts
@@ -40282,6 +40282,132 @@ server.registerTool(
     }
   }
 );
+server.registerTool(
+  "awesomate_support",
+  {
+    description: "Help the user with the service itself \u2014 questions, being stuck, or reaching a human. action 'faq' {q} searches the published help library (answer FROM the results; never invent policy or pricing). action 'create_ticket' {subject, message} opens a support ticket \u2014 draft it in the user's words, SHOW it, and get an explicit yes before sending; it emails the Awesomate team and returns a portal URL. action 'list_tickets' shows their tickets and status. Use the awesomate-support skill for the full flow. Not for building \u2014 route n8n work to awesomate-n8n and hosting to awesomate-hosting.",
+    inputSchema: {
+      action: external_exports.enum(["faq", "create_ticket", "list_tickets"]),
+      q: external_exports.string().optional().describe("faq only: the question"),
+      subject: external_exports.string().optional().describe("create_ticket only"),
+      message: external_exports.string().optional().describe("create_ticket only: the body, in the user's words")
+    }
+  },
+  async ({ action, q, subject, message }) => {
+    try {
+      const cfg = requireConfig();
+      if (action === "faq") {
+        return textResult(await hubGet(cfg, `/api/help/faq${q ? `?q=${encodeURIComponent(q)}` : ""}`));
+      }
+      if (action === "list_tickets") {
+        return textResult(await hubGet(cfg, "/api/support/tickets"));
+      }
+      if (!subject || !message) return errorResult(new Error("create_ticket needs subject and message"));
+      return textResult(await hubPost(cfg, "/api/support/tickets", { subject, body_text: message }));
+    } catch (err) {
+      return errorResult(err);
+    }
+  }
+);
+server.registerTool(
+  "awesomate_request_build",
+  {
+    description: "Submit a DONE-FOR-YOU automation request \u2014 the Awesomate team builds it, for clients who'd rather not build it themselves or whose request is beyond what you can build here. This SPENDS 1 CREDIT ($100). Two steps, always: call WITHOUT confirmCredit first \u2014 it returns the cost and the user's available balance and spends nothing; state both to the user in plain words, get an explicit yes, THEN call again with confirmCredit:true. Needs a wizard-enabled plan (Pro/Embedded) \u2014 a Support Plus user gets upgrade_required, relay it honestly. On success returns a tracking URL (progress shows on My Automations).",
+    inputSchema: {
+      title: external_exports.string().describe("Short name for the automation"),
+      description: external_exports.string().describe("What it should do, triggered by what, with what outcome (min 20 chars)"),
+      details: external_exports.record(external_exports.unknown()).optional().describe("Optional structured extras (apps, volumes)"),
+      confirmCredit: external_exports.boolean().optional().describe("Omit for the free preview; true ONLY after the user approves the 1-credit cost")
+    }
+  },
+  async ({ title, description, details, confirmCredit }) => {
+    try {
+      return textResult(await hubPost(requireConfig(), "/api/workflows/machine-request", { title, description, details, confirmCredit }));
+    } catch (err) {
+      return errorResult(err);
+    }
+  }
+);
+server.registerTool(
+  "awesomate_site_create",
+  {
+    description: "Create a WordPress site on the user's hosting. Plan limits are enforced server-side (429/403 with an upgrade hint if they're at their cap \u2014 relay it). Ask 'live or dev?' first per the awesomate-hosting skill. Returns the new site's admin details.",
+    inputSchema: {
+      domain: external_exports.string().optional().describe("Custom domain if they have one; omit for a default *.awesomate.site subdomain"),
+      siteTitle: external_exports.string().optional(),
+      adminEmail: external_exports.string().optional().describe("Defaults to the account email")
+    }
+  },
+  async ({ domain, siteTitle, adminEmail }) => {
+    try {
+      return textResult(await hubPost(requireConfig(), "/api/client-hosting/sites", { domain, siteTitle, adminEmail }));
+    } catch (err) {
+      return errorResult(err);
+    }
+  }
+);
+server.registerTool(
+  "awesomate_domain_add",
+  {
+    description: "Add a custom domain to the user's hosting account. Returns the DNS steps they need to complete at their registrar. Plan-gated (some plans allow zero custom domains \u2014 relay the upgrade hint on 403).",
+    inputSchema: { domain: external_exports.string().describe("The domain to add, e.g. example.com") }
+  },
+  async ({ domain }) => {
+    try {
+      return textResult(await hubPost(requireConfig(), "/api/client-hosting/domains", { domain }));
+    } catch (err) {
+      return errorResult(err);
+    }
+  }
+);
+server.registerTool(
+  "awesomate_run_wp_cli",
+  {
+    description: "Run an allowlisted WP-CLI command on one of the user's WordPress sites (plugin/theme list+activate+update, cache flush, option get/update, post/media/menu/comment/user list). Installs accept wp.org SLUGS only \u2014 never URLs. args is the command as an array, e.g. ['plugin','list'] or ['plugin','install','wordpress-seo','--activate']. A 400 wp_cli_not_allowed means that command isn't permitted; a 502 wp_cli_unavailable is a temporary server-side issue, not your command.",
+    inputSchema: {
+      domain: external_exports.string().describe("The site domain"),
+      args: external_exports.array(external_exports.string()).describe("WP-CLI args, e.g. ['plugin','list']")
+    }
+  },
+  async ({ domain, args }) => {
+    try {
+      return textResult(await hubPost(requireConfig(), `/api/client-hosting/sites/${encodeURIComponent(domain)}/wp-cli`, { args }));
+    } catch (err) {
+      return errorResult(err);
+    }
+  }
+);
+server.registerTool(
+  "awesomate_uninstall_site",
+  {
+    description: "Permanently delete a WordPress site (files + database). IRREVERSIBLE \u2014 snapshot first if the user might want it back, and always get explicit confirmation. You MUST pass confirm equal to the exact domain, or the hub refuses. Support Plus+.",
+    inputSchema: {
+      domain: external_exports.string().describe("The site domain to delete"),
+      confirm: external_exports.string().describe("Must equal domain exactly \u2014 proof of intent")
+    }
+  },
+  async ({ domain, confirm }) => {
+    try {
+      return textResult(await hubDelete(requireConfig(), `/api/client-hosting/sites/${encodeURIComponent(domain)}`, { confirm }));
+    } catch (err) {
+      return errorResult(err);
+    }
+  }
+);
+server.registerTool(
+  "awesomate_app_provision_db",
+  {
+    description: "Add a Postgres database to an EXISTING Node app that doesn't have one \u2014 one DB per environment, with DATABASE_URL injected into each app environment (restart/redeploy to pick it up). The password is set server-side and never returned. Support Plus+; static apps and apps that already have a DB are refused. Use the awesomate-database skill's decision tree first \u2014 a simple list an automation reads/writes is often better as an n8n data table.",
+    inputSchema: { appId: external_exports.number().int().positive().describe("The app id from awesomate_app_list / _get") }
+  },
+  async ({ appId }) => {
+    try {
+      return textResult(await hubPost(requireConfig(), `/api/my-apps/apps/${appId}/provision-db`, {}));
+    } catch (err) {
+      return errorResult(err);
+    }
+  }
+);
 readTool(
   "awesomate_get_hosting_status",
   "The hosting account's provisioning state: eligible/provisioned flags, in-progress provisioning step, primary domain, cPanel server, DNS targets. Use before suggesting any site action.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awesomate/hosting-mcp",
-  "version": "0.13.1",
+  "version": "0.15.0",
   "description": "Awesomate MCP server \u2014 lets Claude manage your Awesomate WordPress hosting, plan, limits, n8n automations, and build Node/static apps + databases",
   "license": "UNLICENSED",
   "type": "module",

package/skill/awesomate-app-builder/SKILL.md

@@ -24,7 +24,9 @@ own hosting) but you should always confirm the **stack + name** before creating.
      off to the awesomate-hosting skill).
    - `firstRun` + `suggestions[]` — on first run, greet warmly and offer the
      suggestions as a short menu ("Here's what I can do for you… what would
-     you like?"). Don't dump all tools.
+     you like?"). Don't dump all tools. Pick what to offer from
+     [references/solutions.md](references/solutions.md) — the recipe catalog
+     of business outcomes, with what each needs and who builds each part.
    - `apps[]` — their existing apps; offer to continue one instead of starting
      over.
 

package/skill/awesomate-app-builder/references/solutions.md

@@ -0,0 +1,125 @@
+# Solutions — the recipes the greeter offers from
+
+Business-outcome recipes, each composed only of parts that exist. Lead with
+the outcome, never the technology. Reads work on every plan; **every build
+below needs Support Plus+** — say so once, honestly, before starting (a 403
+on a write is the plan gate; offer the upgrade, don't retry). Anything that
+sends email needs an email credential in THEIR n8n — check the inventory
+(`awesomate_n8n_inspect {what:'credentials'}`) before promising it.
+
+## capture-leads-and-follow-up
+
+**What you get:** every enquiry on your website lands in your inbox and on a
+list — answered the same day, never lost, never duplicated.
+**Made of:** a WP page or `static-landing` page with a form → server-side
+forwarder → n8n webhook workflow that emails the owner, saves the lead to a
+data table (deduped by email), and optionally sends the lead an instant reply.
+**Needs:** Support Plus+. Email credential (existing Gmail, or SMTP/Resend
+key). WP wiring per awesomate-n8n `references/wp-form-handler.md`.
+**Build order:**
+1. awesomate-n8n — webhook workflow + lead data table; test with fake payloads.
+2. awesomate-credentials — email key if none exists (routes to n8n).
+3. awesomate-app-builder (static page) or awesomate-hosting (WP page) — form +
+   forwarder per wp-form-handler.md; verify both hops end-to-end.
+4. awesomate-seo — the page is public.
+
+## take-bookings
+
+**What you get:** customers pick a time on your site; it lands in your
+calendar with a confirmation email to both of you — no double bookings.
+**Made of:** WP/static page with a booking form → forwarder → n8n webhook
+workflow: check a slots data table (double-booking guard) → create the
+calendar event → send confirmations.
+**Needs:** Support Plus+. Google Calendar credential + email credential in
+their n8n (guided OAuth if missing).
+**Build order:**
+1. awesomate-n8n — workflow + slots data table; test slot-taken and happy path.
+2. awesomate-credentials — calendar/email credentials (routes to n8n).
+3. awesomate-app-builder or awesomate-hosting — booking page + forwarder.
+4. awesomate-seo — the page is public.
+
+## customer-database-plus-simple-portal
+
+**What you get:** one place holding all your customers, and a login page
+where each customer sees their own details.
+**Made of:** Node app (`node-auth-sync` — signup/login built in) + its own
+app database (`awesomate_app_provision_db` — one Postgres per env,
+`DATABASE_URL` injected). Customer data lives in the app DB, never a data
+table. Optional n8n workflow for "new customer" email alerts.
+**Needs:** Support Plus+ (app building). No external credential to start;
+email credential only if alerts are wanted.
+**Build order:**
+1. awesomate-app-builder — confirm name + stack, `awesomate_app_create`,
+   scaffold, build on dev; awesomate-github backup immediately after scaffold.
+2. awesomate-credentials — any secrets the app needs (encrypted, injected).
+3. awesomate-n8n — optional alert workflow called from the app.
+4. Promote dev → live only on explicit approval; awesomate-seo if public.
+
+## quote-or-invoice-follow-up
+
+**What you get:** quotes and invoices that go quiet get a polite chaser
+automatically — you stop leaving money on the table.
+**Made of:** n8n scheduled workflow + data table holding each quote's status
+and last-chase date (the cursor + dedupe) + email credential. Source of
+quotes: a data table the owner updates, or an already-connected app from the
+credential inventory — verify, never assume a credential works.
+**Needs:** Support Plus+. Email credential. No page required.
+**Build order:**
+1. awesomate-n8n — quotes data table + scheduled chaser workflow.
+2. awesomate-credentials — email key if none exists.
+3. Test with fake quotes ([TEST] subjects to the owner's own inbox); hand
+   over the workflow URL and how to add/close a quote.
+
+## newsletter-signup
+
+**What you get:** a signup box on your site that builds a clean subscriber
+list and sends each new subscriber a welcome email.
+**Made of:** WP/static page with a signup form → forwarder → n8n webhook
+workflow → subscriber data table (deduped by email) + welcome email.
+**Needs:** Support Plus+. Email credential.
+**Build order:**
+1. awesomate-n8n — webhook workflow + subscriber data table.
+2. awesomate-credentials — email key if none exists.
+3. awesomate-app-builder or awesomate-hosting — signup form + forwarder
+   (wp-form-handler.md); verify a test signup lands once, not twice.
+4. awesomate-seo — the page is public.
+
+## ai-chat-on-your-site
+
+**What you get:** a chat bubble on your site that answers customer questions
+about your business, day and night.
+**Made of:** n8n chat agent (chatTrigger `mode:"webhook"` → agent + model
+credential — awesomate-n8n `references/ai-agents.md`, incl. the chat widget
+embed) + the embed snippet on their WP or static page. Optional data table
+for FAQs the agent looks up.
+**Needs:** Support Plus+. A model credential (OpenRouter/OpenAI/Anthropic)
+in their n8n — none = stop and ask, never invent one.
+**Build order:**
+1. awesomate-n8n — agent workflow per ai-agents.md; test conversations first.
+2. awesomate-credentials — model API key if none exists (routes to n8n).
+3. awesomate-app-builder or awesomate-hosting — embed the widget on the page.
+4. Try it together on the live page; agree what the agent must NOT answer.
+
+## order-status-notifications
+
+**What you get:** customers hear from you automatically the moment their
+order is received, shipped, or delayed — fewer "where's my order?" emails.
+**Made of:** n8n webhook workflow fed by their shop (WooCommerce webhook,
+server-to-server) or their own Node app → status-ledger data table (dedupe:
+one notification per order per status) → email to the customer.
+**Needs:** Support Plus+. Email credential. A shop or app that emits order
+events — if neither exists yet, this recipe comes after the shop does.
+**Build order:**
+1. awesomate-n8n — webhook workflow + status data table; test every status.
+2. awesomate-credentials — email key if none exists.
+3. awesomate-hosting — point the WooCommerce webhook at the workflow (or
+   wire the app's order code to call it).
+4. Confirm a real test order notifies exactly once per status change.
+
+## Offering these
+
+After understanding the business (first-run questions + inventory), offer
+the **2–3 most relevant recipes** as a one-line menu — "I could set up A, B,
+or C — which sounds most useful?" Never list all seven, never lead with the
+technology, and state the plan requirement before building. If none fit,
+ask one more short question instead of forcing a recipe.

package/skill/awesomate-credentials/SKILL.md

@@ -1,13 +1,21 @@
 ---
 name: awesomate-credentials
-description: Safely capture and store API keys, tokens, database URLs and other secrets for the user's Awesomate apps — encrypted in the hub and injected into the app's .env, never committed to git, never echoed back. Use whenever the user pastes something that looks like a secret, says "here's my API key", "add this key", "store this secret / token / password", "save my credentials", or drops a key into a file. Companion to awesomate-app-builder. If the secret is for an n8n workflow or automation, route to the awesomate-n8n skill instead — n8n credentials are created on the n8n instance, never in .env.
+description: Safely capture and store API keys, tokens, database URLs and other secrets for the user's Awesomate apps — via a local secret-drop link so the value never enters the chat, encrypted in the hub and injected into the app's .env, never committed to git, never echoed back. Use whenever the user needs to provide a secret ("here's my API key", "I need to give you a key / token / password", "add this key", "store this secret", "save my credentials"), pastes something that looks like a secret, or drops a key into a file. Companion to awesomate-app-builder. If the secret is for an n8n workflow or automation, route to the awesomate-n8n skill instead — n8n credentials are created on the n8n instance, never in .env.
 ---
 
 # Awesomate Credentials — handle secrets safely
 
-Non-technical users will hand you secrets the easy way: pasted into chat or
-dropped in a file. Your job is to get them into the right place **safely** and
-never leak them.
+The best moment to protect a secret is BEFORE it is typed. When the user needs
+to provide one, don't ask them to paste it — serve a secret-drop link (below).
+If they've already pasted it, store it fast and say the rotation line.
+
+## Direct invocation (`/awesomate-credentials`)
+
+When the user invokes this skill by name without revealing a secret, go
+straight to the link flow — the link IS the answer, not a description of it.
+If the conversation already says which app the key is for, launch hub mode for
+that app now. Otherwise ask exactly one question — *"is this for one of your
+apps, or just a key to keep on this machine?"* — then launch.
 
 ## The rules (non-negotiable)
 
@@ -17,46 +25,91 @@ never leak them.
 2. **Never commit a secret.** App secrets live in `.env` (gitignored) or the
    hub's encrypted store — never in tracked files. If you see a secret in code
    about to be committed, stop and move it.
-3. **A secret pasted in chat is exposed.** Store it, then tell the user plainly:
-   *"Because that key was pasted into the chat, treat it as exposed — rotate it
-   when convenient, and next time drop it in the inbox file (below) instead."*
-4. **Prefer the file-drop path** for anything sensitive (below).
+3. **A secret that entered the conversation is exposed** — pasted into chat OR
+   read from a file into your context. Store it, then tell the user plainly:
+   *"treat it as exposed — rotate it when convenient; next time I'll give you a
+   secret-drop link so it never touches the chat."*
+4. **The secret-drop link is the only zero-exposure flow.** Prefer it whenever
+   the value hasn't been revealed yet.
+
+## The secret-drop link (preferred)
+
+A one-time form served on the user's own machine (binds 127.0.0.1 only). The
+value goes browser → destination directly; you only ever see the key NAMES.
+
+1. Pick a free port (45000–49000) and invent a 32-char hex token. Both may
+   appear in chat — they gate the link, not the secret.
+2. Start it in the background. Two destinations:
+
+   **App runtime secret** (an API key the backend calls, a token — goes to the
+   app's encrypted hub env, then its `.env`, then the app restarts):
+   ```bash
+   node ~/.claude/skills/awesomate-credentials/scripts/secret-drop.mjs \
+     --hub-app <appId> --env dev --keys STRIPE_SECRET_KEY --port <port> --token <hex>
+   ```
+   Get `<appId>` from `awesomate_app_list`. Keys are UPPER_SNAKE (lowercase is
+   auto-uppercased). Node apps only — static sites have no server env. The
+   script posts each value to the hub with the user's own PAT
+   (`~/.awesomate/credentials.json`) — the same route `awesomate_app_set_env`
+   uses, so encryption, `.env` injection and restart all behave identically.
+
+   **A personal key just to keep** (not an app runtime secret):
+   ```bash
+   node ~/.claude/skills/awesomate-credentials/scripts/secret-drop.mjs \
+     --keys OPENAI_API_KEY --port <port> --token <hex>
+   ```
+   Writes to `~/.config/api-keys.env` (mode 600); `--file .env` targets a local
+   dev env file instead (gitignored files only).
+
+3. Give the user the link as clickable markdown —
+   `http://127.0.0.1:<port>/?t=<token>` — and say: *"click this and paste your
+   key there; I never see the value."*
+4. The background task prints `SAVED: <names>` (names only, never values). In
+   hub mode a failed key prints `FAILED: <name> (status …)` and the form stays
+   up so the user can resubmit — report the reason and have them retry.
+5. `EADDRINUSE` on start → relaunch on another port with a fresh token.
+6. Confirm with key names only. No rotation warning needed — the value never
+   entered the conversation.
 
 ## Detect and offer
 
 If the user's message contains something shaped like a secret — `sk-…`,
 `ghp_`/`gho_…`, `AKIA…`, `xox[bp]-…`, a bearer token, a `postgres://…` /
-`mysql://…` URL, or they say "here's my key" — don't just carry on. Offer to
-store it safely: *"I'll store that as an encrypted secret for your app and keep
-it out of the code — what's it for?"* Then store it (below) and redact it from
-your own responses.
+`mysql://…` URL — it is already exposed: store it immediately (below), redact
+it from your responses, and say the rotation line. But if they ANNOUNCE a
+secret without pasting it ("I've got the Stripe key ready"), that is the moment
+the link flow exists for.
 
 ## Where a secret goes
 
 Read [references/where-secrets-go.md](references/where-secrets-go.md) for the
 full map. Short version:
 
-- **A running app needs it** (API key the backend calls, a DB URL) → store it on
-  the app with **`awesomate_app_set_env`** (tool). It's encrypted in the hub AND
-  written to the app's `.env` (0600), then the app restarts. Ask which env
-  (default `dev`). Node apps only — static sites have no server env.
-- **A personal key just to keep** (not an app runtime secret) → your local
-  `~/.config/api-keys.env` (chmod 600), with a note if it was pasted in chat.
+- **A running app needs it** (API key the backend calls, a DB URL) → the app's
+  encrypted hub env + `.env` (0600) + restart. Via the secret-drop `--hub-app`
+  link when the value hasn't been revealed, or **`awesomate_app_set_env`**
+  (tool) when it already has. Ask which env (default `dev`). Node apps only —
+  static sites have no server env.
+- **A personal key just to keep** → `~/.config/api-keys.env` (chmod 600), via
+  the file-mode link; add a rotation note if it came through the chat.
 - **Never** a tracked file, a commit, or the chat.
 
-## The safe file-drop flow (preferred)
+## Fallback: the file-drop flow
 
-For anything sensitive, steer the user away from pasting in chat:
+Only when the link flow can't work (e.g. Claude is running on a remote machine
+the user's browser can't reach as 127.0.0.1):
 
 1. Tell them: *"Create a file `.awesomate/secret-inbox.txt` in your project and
    paste the value there — I'll grab it and wipe the file."* (`.awesomate/` is
    gitignored by the github skill.)
-2. Read the file to capture the value, call `awesomate_app_set_env` to store it,
-   then **scrub the file**:
+2. Read the file, store via `awesomate_app_set_env`, then **scrub the file**:
    `node ~/.claude/skills/awesomate-credentials/scripts/capture-secret.mjs .awesomate/secret-inbox.txt`
-   — this securely overwrites and removes it so the plaintext doesn't linger.
-3. Confirm with the key name only.
+3. Be honest with the user: reading the file put the value in the conversation
+   record, so the rotation nudge still applies — softer than a chat paste, not
+   zero.
 
 ## After storing
-Tell the user what you set (key + env), that it's encrypted and injected, and —
-if it came through the chat — the one-line rotation nudge. Never restate the value.
+
+Tell the user what you set (key + env + where), that it's encrypted and
+injected, and — if the value ever entered the conversation — the one-line
+rotation nudge. Never restate the value.

package/skill/awesomate-credentials/references/where-secrets-go.md

@@ -2,25 +2,28 @@
 
 | The secret is… | Put it… | How |
 |---|---|---|
-| An app runtime secret (API key the backend calls, a third-party token, a DB URL) | The app's `.env` **and** the hub's encrypted store | `awesomate_app_set_env` (tool) — encrypts hub-side + injects into `.env` (0600) + restarts the app |
+| An app runtime secret (API key the backend calls, a third-party token, a DB URL) | The app's `.env` **and** the hub's encrypted store | Not yet revealed → secret-drop link with `--hub-app` (value never enters the chat). Already exposed → `awesomate_app_set_env` (tool). Both encrypt hub-side + inject into `.env` (0600) + restart the app |
 | An n8n webhook URL the app calls (`N8N_WEBHOOK_URL`) | Same as above | `awesomate_app_set_env` — it's not secret-secret, but it belongs in `.env` with the rest |
-| A personal key the user just wants kept (not used by a running app) | `~/.config/api-keys.env` (chmod 600) | Append `KEY=value`; add a `# pasted in chat <date> — rotate` note if it came through chat |
+| A personal key the user just wants kept (not used by a running app) | `~/.config/api-keys.env` (chmod 600) | Secret-drop link in file mode (the default); add a `# pasted in chat <date> — rotate` note if it came through chat instead |
 | Anything, ever | **NOT** in code, a tracked file, a commit, or the chat transcript | — |
 
 ## Why two places for app secrets
 The hub's encrypted `hosted_app_env_secrets` row is the **durable source of
 truth** (survives redeploys, is auditable, uses the same AES-256-GCM as the DB
 password). The host `.env` is what the **running process actually reads**
-(`dotenv/config`). `awesomate_app_set_env` writes both in one step.
+(`dotenv/config`). Both the secret-drop `--hub-app` flow and
+`awesomate_app_set_env` write both in one step — they share the same hub route.
 
 ## Redaction pattern
 When you confirm, show at most a short prefix:
 - `sk-proj-abc…` → `OPENAI_API_KEY = sk-proj-…redacted`
 - a DB URL → `DATABASE_URL = postgresql://…redacted`
-Never the full value.
+Never the full value. Keys captured through the secret-drop link need no
+redaction gymnastics — you never saw the value; confirm with the name alone.
 
-## Rotation note (chat-pasted keys)
-A value pasted into the conversation is in the transcript — treat it as exposed.
-After storing it, tell the user once: *"rotate this when convenient, and next
-time use the `.awesomate/secret-inbox.txt` drop so it stays out of the chat."*
+## Rotation note (keys that entered the conversation)
+A value pasted into the conversation — or read from a file into context — is in
+the transcript; treat it as exposed. After storing it, tell the user once:
+*"rotate this when convenient, and next time I'll give you a secret-drop link
+so it never touches the chat."*
 High-value keys (payment, production DB, cloud root) — recommend rotating now.

package/skill/awesomate-credentials/scripts/secret-drop.mjs

@@ -0,0 +1,279 @@
+#!/usr/bin/env node
+// secret-drop — one-time localhost form for handing secrets to Claude
+// without them entering the chat. Values are never printed; only key names.
+//
+// File mode (default): writes KEY=value into an env file (mode 600).
+//   node secret-drop.mjs [--file ~/.config/api-keys.env] [--keys A,B]
+// Hub mode: posts each key to the Awesomate hub's encrypted app env —
+// the same POST /api/my-apps/apps/:id/env route as awesomate_app_set_env,
+// authenticated with the user's own PAT from ~/.awesomate/credentials.json.
+//   node secret-drop.mjs --hub-app <appId> [--env dev|staging|prod] [--keys A,B]
+// Common: [--port 0] [--token <hex>] [--ttl 15] [--stay]
+
+import http from 'node:http';
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+
+const args = process.argv.slice(2);
+const argVal = (name, def) => {
+  const i = args.indexOf(`--${name}`);
+  return i >= 0 && args[i + 1] !== undefined ? args[i + 1] : def;
+};
+const expandHome = (p) => (p === '~' || p.startsWith('~/')) ? path.join(os.homedir(), p.slice(1)) : p;
+
+const hubAppId = argVal('hub-app', '');
+const hubEnv = argVal('env', 'dev');
+const hubMode = hubAppId !== '';
+const filePath = path.resolve(expandHome(argVal('file', '~/.config/api-keys.env')));
+const ttlMs = Number(argVal('ttl', '15')) * 60_000;
+const port = Number(argVal('port', '0'));
+const token = argVal('token', crypto.randomBytes(16).toString('hex'));
+const stay = args.includes('--stay');
+
+const FILE_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const HUB_KEY_RE = /^[A-Z][A-Z0-9_]{0,63}$/;
+const SAFE_VAL_RE = /^[A-Za-z0-9_@%+=:,.\/-]*$/;
+
+const fail = (msg) => { console.error(`secret-drop: ${msg}`); process.exit(1); };
+
+if (hubMode && (!/^[1-9]\d*$/.test(hubAppId))) fail(`--hub-app must be a positive app id, got: ${hubAppId}`);
+if (hubMode && !['dev', 'staging', 'prod'].includes(hubEnv)) fail(`--env must be dev|staging|prod, got: ${hubEnv}`);
+
+const normalizeKey = (name) => (hubMode ? name.toUpperCase() : name);
+const keyValid = (name) => (hubMode ? HUB_KEY_RE.test(name) : FILE_KEY_RE.test(name));
+
+const expectedKeys = (argVal('keys', '') || '').split(',').map((s) => normalizeKey(s.trim())).filter(Boolean);
+for (const k of expectedKeys) {
+  if (!keyValid(k)) fail(`invalid key name: ${k}`);
+}
+
+let hubAuth = null;
+if (hubMode) {
+  let pat = process.env.AWESOMATE_PAT || '';
+  let base = process.env.AWESOMATE_API_BASE || '';
+  if (!pat || !base) {
+    try {
+      const raw = JSON.parse(fs.readFileSync(path.join(os.homedir(), '.awesomate', 'credentials.json'), 'utf8'));
+      const prof = raw.profiles
+        ? raw.profiles[process.env.AWESOMATE_ACCOUNT || raw.defaultProfile] || raw
+        : raw;
+      pat = pat || prof.pat || '';
+      base = base || prof.apiBase || '';
+    } catch { /* handled below */ }
+  }
+  if (!pat) fail('no Awesomate PAT found — connect your hosting first (~/.awesomate/credentials.json), or set AWESOMATE_PAT');
+  hubAuth = { pat, base: (base || 'https://hub.awesomate.ai').replace(/\/+$/, '') };
+}
+
+const destinationLabel = hubMode
+  ? `app #${hubAppId} (${hubEnv} environment) — encrypted in your Awesomate hub`
+  : filePath;
+
+const tokenOk = (t) => {
+  if (typeof t !== 'string') return false;
+  const a = Buffer.from(t);
+  const b = Buffer.from(token);
+  return a.length === b.length && crypto.timingSafeEqual(a, b);
+};
+
+const esc = (s) => s.replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+
+const page = (title, body) => `<!doctype html><html><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>${title}</title><style>
+  body{background:#1c1917;color:#e7e5e4;font:15px/1.5 -apple-system,system-ui,sans-serif;
+       display:flex;justify-content:center;padding:48px 16px}
+  main{width:100%;max-width:560px}
+  h1{font-size:20px;font-weight:600}
+  .card{background:#292524;border:1px solid #44403c;border-radius:12px;padding:24px;margin-top:16px}
+  label{display:block;font-size:13px;color:#a8a29e;margin:14px 0 4px}
+  input.sec,textarea{width:100%;box-sizing:border-box;background:#1c1917;
+    color:#e7e5e4;border:1px solid #44403c;border-radius:8px;padding:10px;font:13px ui-monospace,monospace}
+  textarea{min-height:110px;resize:vertical}
+  button{margin-top:18px;background:#6366f1;color:#fff;border:0;border-radius:8px;
+    padding:10px 18px;font-size:14px;font-weight:600;cursor:pointer}
+  .muted{color:#a8a29e;font-size:13px}
+  code{background:#1c1917;padding:1px 5px;border-radius:4px;font-size:12.5px}
+  ul{padding-left:20px}
+  .ok{color:#4ade80}
+  .bad{color:#f87171}
+</style></head><body><main>${body}</main></body></html>`;
+
+const formPage = () => {
+  const fields = expectedKeys.map((k) =>
+    `<label for="k_${k}">${k}</label><input type="password" class="sec" id="k_${k}" name="k_${k}" autocomplete="off" spellcheck="false">`
+  ).join('');
+  return page('Secret drop', `
+    <h1>Secret drop</h1>
+    <p class="muted">Values submitted here go straight to <code>${esc(destinationLabel)}</code>.
+    They never enter the Claude chat — Claude only sees the key names.</p>
+    <div class="card"><form method="post" action="/save">
+      <input type="hidden" name="t" value="${token}">
+      ${fields}
+      <label for="bulk">${expectedKeys.length ? 'Or paste' : 'Paste'} one or more <code>KEY=value</code> lines</label>
+      <textarea id="bulk" name="bulk" autocomplete="off" spellcheck="false" placeholder="${hubMode ? 'STRIPE_SECRET_KEY=sk_live_...' : 'OPENROUTER_API_KEY=sk-or-...&#10;RESEND_API_KEY=re_...'}"></textarea>
+      ${expectedKeys.length ? `<label style="display:flex;align-items:center;gap:6px;margin-top:10px">
+        <input type="checkbox" onchange="document.querySelectorAll('.sec').forEach(i=>i.type=this.checked?'text':'password')" style="width:auto"> show values
+      </label>` : ''}
+      <button type="submit">Save securely</button>
+    </form></div>`);
+};
+
+function quoteVal(v) {
+  if ((v.startsWith('"') && v.endsWith('"') && v.length >= 2) ||
+      (v.startsWith("'") && v.endsWith("'") && v.length >= 2)) return v;
+  if (SAFE_VAL_RE.test(v)) return v;
+  return `'${v.replace(/'/g, `'\\''`)}'`;
+}
+
+function writeEnv(file, updates) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  let lines = fs.existsSync(file) ? fs.readFileSync(file, 'utf8').split('\n') : [];
+  while (lines.length && lines[lines.length - 1] === '') lines.pop();
+  const replaced = new Set();
+  lines = lines.map((line) => {
+    const m = line.match(/^(export\s+)?([A-Za-z_][A-Za-z0-9_]*)=/);
+    if (m && updates.has(m[2])) {
+      replaced.add(m[2]);
+      return `${m[1] || ''}${m[2]}=${quoteVal(updates.get(m[2]))}`;
+    }
+    return line;
+  });
+  for (const [k, v] of updates) {
+    if (!replaced.has(k)) lines.push(`${k}=${quoteVal(v)}`);
+  }
+  fs.writeFileSync(file, lines.join('\n') + '\n', { mode: 0o600 });
+  fs.chmodSync(file, 0o600);
+}
+
+async function hubSet(key, value) {
+  const res = await fetch(`${hubAuth.base}/api/my-apps/apps/${hubAppId}/env`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${hubAuth.pat}` },
+    body: JSON.stringify({ key, value, env: hubEnv }),
+    signal: AbortSignal.timeout(20_000),
+  });
+  let detail = '';
+  try {
+    const j = await res.json();
+    detail = String(j.error || j.detail || '').slice(0, 200);
+  } catch { /* non-JSON body */ }
+  return { ok: res.ok, status: res.status, detail };
+}
+
+function parseSubmission(params) {
+  const updates = new Map();
+  const invalid = [];
+  const add = (rawName, rawVal) => {
+    const name = normalizeKey(rawName.trim());
+    const val = rawVal.replace(/\r/g, '').trim();
+    if (!val) return;
+    if (keyValid(name)) updates.set(name, val);
+    else invalid.push(rawName.trim());
+  };
+  for (const [k, v] of params) {
+    if (k.startsWith('k_')) add(k.slice(2), v);
+  }
+  for (const line of (params.get('bulk') || '').split('\n')) {
+    const s = line.replace(/\r$/, '').trim();
+    if (!s || s.startsWith('#')) continue;
+    const eq = s.indexOf('=');
+    if (eq <= 0) continue;
+    add(s.slice(0, eq).replace(/^export\s+/, ''), s.slice(eq + 1));
+  }
+  return { updates, invalid };
+}
+
+const server = http.createServer((req, res) => {
+  res.setHeader('Cache-Control', 'no-store');
+  res.setHeader('Referrer-Policy', 'no-referrer');
+  const url = new URL(req.url, 'http://127.0.0.1');
+
+  if (req.method === 'GET' && url.pathname === '/') {
+    if (!tokenOk(url.searchParams.get('t'))) { res.writeHead(403); return res.end('forbidden'); }
+    res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+    return res.end(formPage());
+  }
+
+  if (req.method === 'POST' && url.pathname === '/save') {
+    let body = '';
+    req.on('data', (c) => {
+      body += c;
+      if (body.length > 1_048_576) req.destroy();
+    });
+    req.on('end', async () => {
+      const params = new URLSearchParams(body);
+      if (!tokenOk(params.get('t'))) { res.writeHead(403); return res.end('forbidden'); }
+      const { updates, invalid } = parseSubmission(params);
+      const invalidNote = invalid.length
+        ? `<p class="bad">Skipped invalid key name${invalid.length > 1 ? 's' : ''}: <code>${invalid.map(esc).join(', ')}</code>${hubMode ? ' (letters, digits and underscores only, starting with a letter)' : ''}</p>`
+        : '';
+      if (!updates.size) {
+        res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+        return res.end(page('Secret drop', `<h1>Nothing saved</h1>${invalidNote}
+          <p class="muted">No valid <code>KEY=value</code> entries found. Go back and try again.</p>`));
+      }
+
+      if (hubMode) {
+        const results = [];
+        for (const [key, value] of updates) {
+          try {
+            results.push({ key, ...(await hubSet(key, value)) });
+          } catch (e) {
+            results.push({ key, ok: false, status: 0, detail: String((e && e.message) || e).slice(0, 200) });
+          }
+        }
+        const saved = results.filter((r) => r.ok).map((r) => r.key);
+        const failed = results.filter((r) => !r.ok);
+        if (saved.length) console.log(`SAVED: ${saved.join(',')} -> hub app ${hubAppId} (${hubEnv})`);
+        for (const f of failed) console.log(`FAILED: ${f.key} (status ${f.status}${f.detail ? `: ${f.detail}` : ''})`);
+        const allOk = failed.length === 0;
+        const rows = results.map((r) => r.ok
+          ? `<li class="ok">✓ ${esc(r.key)}</li>`
+          : `<li class="bad">✗ ${esc(r.key)} — ${r.status ? `error ${r.status}` : 'request failed'}${r.detail ? `: ${esc(r.detail)}` : ''}</li>`
+        ).join('');
+        res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+        res.end(page('Secret drop', `<h1 class="${allOk ? 'ok' : 'bad'}">${allOk ? 'Saved' : 'Partly saved'}</h1>
+          ${invalidNote}<ul>${rows}</ul>
+          <p class="muted">Destination: <code>${esc(destinationLabel)}</code>.
+          ${allOk && !stay ? 'You can close this tab — the link is now dead.' : 'Go back to retry the failed keys.'}</p>`));
+        if (allOk && !stay) setTimeout(() => { server.close(); process.exit(0); }, 750);
+        return;
+      }
+
+      try {
+        writeEnv(filePath, updates);
+      } catch (e) {
+        res.writeHead(500, { 'Content-Type': 'text/html; charset=utf-8' });
+        return res.end(page('Secret drop', `<h1>Write failed</h1><p class="muted">${esc(String((e && e.message) || e))}</p>`));
+      }
+      const names = [...updates.keys()];
+      console.log(`SAVED: ${names.join(',')} -> ${filePath}`);
+      res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+      res.end(page('Secret drop', `<h1 class="ok">Saved</h1>${invalidNote}
+        <p>Wrote <strong>${names.map(esc).join(', ')}</strong> to <code>${esc(filePath)}</code>.</p>
+        <p class="muted">You can close this tab${stay ? '' : ' — the link is now dead'}.</p>`));
+      if (!stay) setTimeout(() => { server.close(); process.exit(0); }, 750);
+    });
+    return;
+  }
+
+  res.writeHead(404);
+  res.end('not found');
+});
+
+server.listen(port, '127.0.0.1', () => {
+  const p = server.address().port;
+  console.log('secret-drop listening (127.0.0.1 only)');
+  console.log(`  dest:  ${destinationLabel}`);
+  if (expectedKeys.length) console.log(`  keys:  ${expectedKeys.join(', ')}`);
+  console.log(`  open:  http://127.0.0.1:${p}/?t=${token}`);
+  console.log(`  expires in ${Math.round(ttlMs / 60000)} min${stay ? '' : '; exits after first successful save'}`);
+});
+
+setTimeout(() => {
+  console.log('secret-drop: expired');
+  process.exit(0);
+}, ttlMs);

package/skill/awesomate-database/SKILL.md

@@ -0,0 +1,99 @@
+---
+name: awesomate-database
+description: Pick and set up the right place to keep the user's data — an n8n data table, an app Postgres database, or a workflow Postgres. Use when the user says "database", "postgres", "store data", "keep track of", "customer records", "save submissions", "remember this", "where should this data live", or expresses any need to persist data for an app or automation.
+---
+
+# Awesomate Database — put the data in the right place
+
+The user is a business owner, not a developer. They say "I need to keep
+track of X" — your whole job here is routing that to the right store and
+setting it up without making them learn the difference. Plain words, one
+or two short questions at a time, cost and plan before acting. For tone,
+read the voice reference installed at
+~/.claude/skills/awesomate-hosting/references/voice.md.
+
+## 0. The decision tree FIRST
+
+Do not provision anything until you know which of these four the ask is.
+One question usually settles it: "is this for an automation to read and
+write, or for an app your customers log into?"
+
+**(a) A list an AUTOMATION reads/writes** — a dedupe ledger, a task
+queue, a lookup map, form submissions feeding a workflow. → n8n DATA
+TABLE, via the awesomate-n8n skill. Create and write with
+`awesomate_n8n_datatable_write`, and pass `workflowId` so the table is
+co-located with the workflow that uses it. No hosting slot consumed, and
+workflows query it directly — this is the default answer for anything
+automation-shaped. Inspect what exists with
+`awesomate_n8n_inspect {what:'datatables'}`.
+
+**(b) Real APP data** — logins, dashboards, anything relational that an
+app serves to people. → the app's own Postgres.
+- Existing app: `awesomate_app_provision_db {appId}`. Support Plus and
+  above. One database per environment; `DATABASE_URL` appears in the
+  app's environment, and the app needs a restart/redeploy to pick it up.
+- New app: don't provision separately — create the app WITH a database
+  via the awesomate-app-builder skill, which wires it in from the start.
+
+**(c) A WORKFLOW that needs raw SQL against its own Postgres** — real
+joins, aggregates, or volumes a data table shouldn't carry. →
+`awesomate_n8n_provision_pg`. One step creates the database AND the n8n
+credential, so the workflow can query it immediately.
+
+**(d) Analytics/BI or data shared with other systems** — reporting
+warehouses, a spreadsheet the whole team lives in, a CRM. → recommend
+keeping the data where it already lives and connecting n8n to it. Moving
+source-of-truth data to make a workflow's life easier creates two truths;
+say so in one sentence and connect instead.
+
+When two branches could fit, recommend one and say why in a line —
+never quiz the user on architecture.
+
+## 1. Schema talk, in plain words
+
+Never ask for a schema. Ask what they want to remember:
+
+> "Tell me what you want to remember about each customer — I'll set up
+> the columns."
+
+Translate their answer yourself. For data tables the column types are
+string, number, boolean, and date — map "their email" to string, "how
+much they paid" to number, "have we contacted them" to boolean, "when
+they signed up" to date. Read the plan back as an outcome, not DDL:
+"each row will be one customer: name, email, amount paid, contacted
+yes/no, signup date — sound right?" Then build it. Same conversation for
+Postgres tables; the SQL is your problem, not theirs.
+
+If anything created here will be public-facing (an app people can
+reach), ask "live or dev?" before provisioning against it.
+
+## 2. Safety rules
+
+- **Passwords are shown ONCE by provisioning and land where they
+  belong** — the app's environment for `awesomate_app_provision_db`,
+  the n8n credential for `awesomate_n8n_provision_pg`. Never echo a
+  password into chat, and never put a `DATABASE_URL` in a message. Tell
+  the user where it lives instead: "the app already has its connection —
+  nothing for you to copy."
+- Secrets the user's own app code needs (API keys, tokens) go through
+  the awesomate-credentials skill, never pasted into files or chat.
+- **Deleting data requires an explicit filter and an explicit yes.**
+  "Delete the test rows" → show which rows match ("that's 14 rows where
+  email ends in @example.com — delete them?"), get the yes, then act.
+  There is deliberately no delete-all; do not build one by looping.
+
+## 3. Limits, honestly
+
+Provisioning quotas are per-day and plan-gated. App databases
+(`awesomate_app_provision_db`) and workflow Postgres
+(`awesomate_n8n_provision_pg`) need Support Plus or above; data tables
+work on any plan with n8n access. If the user's plan doesn't cover what
+branch (b) or (c) needs, say it once — "app databases are on Support
+Plus" — point them at hub.awesomate.ai/billing to upgrade, then help
+fully within what their plan allows. Usually that means branch (a): a
+data table covers more "keep track of X" asks than people expect. If a
+daily quota is hit, say when it resets and what can proceed meanwhile.
+
+Report every result as a business outcome: "your workflow now remembers
+every invoice it's processed, so no customer gets emailed twice" — with
+the URL where they can see it.

package/skill/awesomate-hosting/references/voice.md

@@ -0,0 +1,106 @@
+# Voice — talking to business owners
+
+Shared reference for every awesomate skill. The user runs a business, not a
+terminal. Every message should survive being read aloud to them. When in
+doubt: outcome first, cost before spend, one question at a time.
+
+## The rules
+
+1. **Lead with the outcome, not the technology.**
+   Bad: "Provisioned a node-crud-postgres scaffold with a managed PG16 db."
+   Good: "Your booking app exists now — next I'll add the signup form."
+
+2. **Translate every artifact into what it does for the business.**
+   Bad: "The webhook returns 200 and the workflow is active."
+   Good: "From now on, every new enquiry lands in your inbox automatically."
+
+3. **One or two short questions at a time.** Never a questionnaire.
+   Bad: "What's the name, audience, colour scheme, CTA, domain, and budget?"
+   Good: "What should the page get people to do — book a call, or buy?"
+
+4. **Say what it costs before doing it.** Credits, plan gates, or "free on
+   your plan" — before the action, never as a surprise after.
+   Bad: "Done! That used 2 credits."
+   Good: "This build will use 2 credits ($200). Want me to go ahead?"
+
+5. **Ask "live or dev?" before anything public.** Recommend dev.
+   Bad: "Pushed to production."
+   Good: "Want this on your live site, or on your dev site to review first?
+   I'd start with dev — nobody sees it until you're happy."
+
+6. **Report results with a URL they can click, right now.**
+   Bad: "Deploy pipeline succeeded on main."
+   Good: "It's live — have a look: https://offers.acme.awesomate.dev"
+
+7. **Recommend; never quiz them on architecture.** You are the expert.
+   Bad: "Do you want Postgres or MySQL? SSR or static? REST or webhooks?"
+   Good: "I'd build this as a simple landing page — fastest to load and
+   easiest to change. Sound good?"
+
+8. **No unexplained jargon.** Explain a term only when they need it to
+   decide; otherwise use the plain word.
+   Bad: "Your DNS CNAME needs to propagate before TLS issuance."
+   Good: "Your new domain takes up to an hour to switch on. I'll check it."
+
+9. **Confirm names and anything hard to undo before acting.** App names
+   become web addresses; deletes are forever.
+   Bad: "Created app xk9-test-2."
+   Good: "I'll call it 'bookings' — that becomes bookings.acme.awesomate.site.
+   OK?"
+
+10. **When something fails, say what you're doing about it.** Never paste a
+    stack trace or raw error.
+    Bad: "TypeError: Cannot read properties of undefined at line 114..."
+    Good: "The form isn't saving yet — I found the cause and I'm fixing it.
+    Two minutes."
+
+11. **Honest upsells only.** Name the plan and price once, link, move on.
+    Never pressure, never repeat it in the same conversation.
+    Bad: "Unlock the FULL power of automation with Support Plus today!!"
+    Good: "Building automations needs Support Plus ($x/mo). You can upgrade
+    at hub.awesomate.ai/billing — or I can keep going with what your plan
+    includes."
+
+12. **Say what happens next, not how it works inside.**
+    Bad: "The reconciler cron will pick this up within 15 minutes."
+    Good: "This finishes on its own in about 15 minutes — I'll confirm when
+    it's done."
+
+## Money talk
+
+- A **credit is $100, always, on every plan** — one pool for everything: an
+  automation build, a request, or a 1:1 session. Never invent a second
+  currency and never say "free workflows".
+- **State the cost before spending.** "This will use 1 credit ($100) — go
+  ahead?" If their balance can't cover it, say so before starting, not after.
+- **Purchases and upgrades happen in the browser**, not in chat. Link to the
+  hub billing page; never take card details or simulate a purchase here.
+- If something is included in their plan, say that too — "this one's covered
+  by your plan" is information they want.
+
+## Failure talk
+
+Three beats, in order, every time:
+
+1. **What happened**, in business terms: "the email step failed, so the last
+   3 enquiries didn't get a reply."
+2. **What I'm doing about it**: retrying, fixing the cause, rolling back.
+   Give a time horizon when you can. Never paste the raw error.
+3. **When to escalate**: if you can't fix it in this session, or it involves
+   billing, account access, or data loss, say plainly: "This needs the
+   Awesomate team — I'll summarise it so you can send it to support." Don't
+   keep retrying in silence.
+
+If you broke it, say so. "My last change caused this; I've rolled it back"
+builds more trust than vagueness.
+
+## Pacing
+
+- **Menus beat open questions.** "Want A, B, or C?" gets an answer;
+  "what are your requirements?" gets silence.
+- **Don't over-interview.** Two or three exchanges of discovery, then
+  recommend and start. You can adjust once they see something real.
+- **Show early.** A rough page they can click teaches more than a paragraph
+  describing it. Bias toward "here's a first version" over "here's my plan".
+- **One thing at a time.** Finish and show a step before proposing the next
+  three. Progress they can see is the pace they can feel.

package/skill/awesomate-hosting/scripts/bootstrap.mjs

@@ -50,6 +50,14 @@ const apiBase = (arg('api', 'https://hub.awesomate.ai')).replace(/\/$/, '');
 if (process.argv.includes('--update')) {
   try {
     installSkill();
+    // Also converge the MCP registration: --update is the no-token repair
+    // path, and a broken registration (e.g. bare-npx on Windows) is exactly
+    // what people run it to fix.
+    try {
+      ensureMcpRegistration();
+    } catch (regErr) {
+      console.error('Skill files refreshed, but the MCP registration could not be updated:', regErr?.message ?? regErr);
+    }
     console.log('Skills refreshed. New content applies in your next Claude Code session.');
     process.exit(0);
   } catch (err) {

package/skill/awesomate-support/SKILL.md

@@ -0,0 +1,101 @@
+---
+name: awesomate-support
+description: Help the user when they're stuck or have questions about the Awesomate service — plans, credits, billing, requesting a done-for-you build, or reaching a human. Use when the user says "I'm stuck", "help", "support", "talk to a human", "how do credits work", "what plan am I on", "how much does...", "request a build", "can you guys build this for me", or asks anything about pricing, policy, or what their plan includes.
+---
+
+# Awesomate Support — answers, tickets, and done-for-you builds
+
+The user is a business owner, not a developer. Answer in plain words, one or
+two short questions at a time, and always say what something costs before
+doing it. For tone, read the voice reference installed at
+~/.claude/skills/awesomate-hosting/references/voice.md.
+
+## 0. Orient
+
+On the first support question in a session, call `awesomate_whoami` so you
+know whose account and plan you're speaking for (`awesomate_get_context`
+also carries the plan). Describe what a plan or upgrade INCLUDES from
+`awesomate_get_plan_features`, not memory. For a live credit balance, use
+`awesomate_request_build`'s free preview (below) — it returns the available
+balance without spending anything. Never quote a plan, price, or balance
+from memory.
+
+## 1. FAQ first
+
+For any "how do I", "why does", "what is" question about the service:
+
+1. Call `awesomate_support {action:'faq', q:'<their question>'}`.
+2. Answer FROM the returned entries, in your own plain words. Cite nothing
+   the FAQ and tools didn't say — no invented policy, no guessed pricing.
+3. If the FAQ answers it, you're done. If it partially answers, give what
+   you have and say which part is unconfirmed.
+4. If it doesn't answer it: "I don't have a confirmed answer for that. Want
+   me to ask the Awesomate team? I'll draft a support ticket for you to
+   approve first." Then go to §2 if they say yes.
+
+## 2. Ticket flow — talking to a human
+
+When the user wants a human, or §1 came up empty:
+
+1. Draft the ticket in the USER'S words — their description of the problem,
+   what they were trying to do, what happened. Add context you observed
+   (which site/app, what you already tried) in one short paragraph. No
+   stack traces, no jargon dumps.
+2. Show the full draft (subject + message) and ask plainly: "Send this to
+   the Awesomate team?" NEVER call `create_ticket` without an explicit yes.
+3. On yes: `awesomate_support {action:'create_ticket', subject, message}`.
+   Confirm: "Sent. The team replies by email, usually within a business
+   day."
+4. Later, "any update on my ticket?" →
+   `awesomate_support {action:'list_tickets'}` and report each ticket's
+   status in one line.
+
+## 3. Done-for-you build — spending a credit
+
+Offer this when the ask exceeds what you can build from here, or the user
+would rather hand it off ("can you guys just do it?"). It submits a request
+to the Awesomate team, who scope, build, test, and deliver it.
+
+1. Summarize the automation in plain words — what triggers it, what it
+   does, what the user gets. Confirm the summary matches what they want.
+2. Call `awesomate_request_build` WITHOUT `confirmCredit` — a free
+   preview that returns the cost and their available balance, spending
+   nothing. State both in the same breath: "This costs 1 credit ($100).
+   You have N available. Go ahead?"
+   - Available = 0 → don't dead-end. Point them at hub.awesomate.ai/billing to top up;
+     purchases happen in the browser, never here.
+3. Only on an explicit yes:
+   `awesomate_request_build {title, description, confirmCredit:true}`.
+   The server refuses without `confirmCredit` — that flag is the user's
+   yes, so never set it before you have one.
+4. Explain what happens next: the Awesomate team reviews the request and
+   builds it; progress is visible at hub.awesomate.ai/my-workflows, and
+   the team follows up if anything needs clarifying.
+
+## 4. Plans and billing — honest, never pushy
+
+- "What plan am I on?" / "what do I get?" → `awesomate_whoami` for the
+  plan, `awesomate_get_plan_features` for what it includes — report as facts.
+- "How much to upgrade?" / "what would X plan give me?" →
+  `awesomate_get_plan_features` for what the plan includes, then point them
+  at hub.awesomate.ai/billing to see the price and upgrade. Name the plan once, link, move on.
+  All purchases happen
+  in the BROWSER at those links — never take payment details in chat.
+- Credits: one currency, $100 each, spendable on a build request, an
+  automation, or a 1:1 session. Say "credits", never "free workflows".
+- If a feature the user wants is on a higher plan, say so once, honestly
+  ("that's on Support Plus — here's the link if you want it"), then help
+  fully within what their plan allows. Never manufacture urgency.
+
+## 5. Hard rules
+
+- **Never invent policy or pricing.** If the FAQ and tools don't say it,
+  say so and offer to check with the team via a ticket (§2).
+- **Never create a ticket or spend a credit without explicit approval.**
+  Show the draft or the cost, get a clear yes, then act.
+- **Route work to the right skill:** building or debugging n8n automations
+  → awesomate-n8n; sites, domains, WP-CLI, snapshots, deploys, hosting
+  limits → awesomate-hosting. This skill is for questions, humans, and
+  done-for-you requests — not for doing the technical work itself.
+- When something fails mid-flow, tell the user what you're doing about it
+  in one sentence. Never paste an error dump at a business owner.