@awesomate/hosting-mcp 0.17.0 → 0.19.0

package/dist/index.js

@@ -39675,7 +39675,7 @@ var StdioServerTransport = class {
 };
 
 // src/index.ts
-import { readFileSync as readFileSync2 } from "node:fs";
+import { readFileSync as readFileSync3 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
 import { join as join3, dirname as dirname3 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
@@ -39892,14 +39892,28 @@ async function hubRequest(config3, method, path, jsonBody, opts = {}) {
   }
   if (!res.ok) {
     const serverMsg = body && typeof body === "object" && "error" in body && typeof body.error === "string" ? body.error : `Request failed (${res.status})`;
+    const code = body && typeof body === "object" && "code" in body && typeof body.code === "string" ? body.code : null;
     let hint = "";
     if (res.status === 401) {
       hint = " Your access token is invalid or expired \u2014 ask the user to open the hub Sites page (hub.awesomate.ai/sites), generate a fresh Connect prompt, and re-run the bootstrap.";
+    } else if (res.status === 403 && code === "consent_required") {
+      const settingsUrl = body && typeof body === "object" && "settingsUrl" in body && typeof body.settingsUrl === "string" ? body.settingsUrl : "https://hub.awesomate.ai/settings?tab=privacy";
+      hint = ` This needs a privacy toggle the user must flip themselves \u2014 send them to ${settingsUrl}, wait for them to confirm, then retry. Never suggest a plan upgrade for a consent denial.`;
     } else if (res.status === 403) {
       const missing = body && typeof body === "object" && "missingScopes" in body ? ` (missing: ${JSON.stringify(body.missingScopes)})` : "";
-      hint = ` This plan/token does not allow that action${missing}. Consider suggesting a plan upgrade \u2014 preview it first and get explicit confirmation.`;
+      hint = ` This plan/token does not allow that action${missing}. Relay any upgradeUrl/recommendedPlan in the payload honestly and let the user decide \u2014 never retry.`;
+    } else if (res.status === 402) {
+      hint = " Payment/allowance required \u2014 NOTHING was purchased. State the cost plainly and let the user decide in the hub; this tool never spends money.";
+    } else if (res.status === 404) {
+      hint = " Not found \u2014 usually the resource does not exist for THIS account. Re-check the id/domain before retrying; do not invent one.";
+    } else if (res.status === 409) {
+      hint = " Conflict \u2014 the payload carries the specifics (a limit reached, or a prerequisite missing). Read its code field; do not blind-retry.";
+    } else if (res.status === 422) {
+      hint = " The request was understood and refused \u2014 YOUR arguments were wrong or the remote command failed. The payload says why; fix and retry once.";
+    } else if (res.status === 429) {
+      hint = " Rate/quota limit hit. Wait before retrying; if it is a daily plan quota, relay that honestly instead of looping.";
     } else if (res.status === 503) {
-      hint = " The hub is temporarily unable to verify access tokens \u2014 retry shortly.";
+      hint = " The hub is temporarily unable to serve this \u2014 retry shortly.";
     }
     throw new HubApiError(`${serverMsg}.${hint}`, res.status, body);
   }
@@ -39919,28 +39933,70 @@ function hubDelete(config3, path, jsonBody) {
 }
 
 // src/skills.ts
-import { cpSync, existsSync as existsSync2, readdirSync, writeFileSync } from "node:fs";
+import { cpSync, existsSync as existsSync2, readdirSync, readFileSync as readFileSync2, rmSync, writeFileSync } from "node:fs";
 import { homedir as homedir2 } from "node:os";
 import { join as join2, dirname as dirname2 } from "node:path";
 import { fileURLToPath } from "node:url";
 var PACKAGE_ROOT = join2(dirname2(fileURLToPath(import.meta.url)), "..");
-function installSkills(version2, sourceRoot = join2(PACKAGE_ROOT, "skill")) {
+var DEFAULT_SOURCE_ROOT = join2(PACKAGE_ROOT, "skill");
+function bundledSkillNames(sourceRoot = DEFAULT_SOURCE_ROOT) {
+  try {
+    return readdirSync(sourceRoot, { withFileTypes: true }).filter((e) => e.isDirectory() && existsSync2(join2(sourceRoot, e.name, "SKILL.md"))).map((e) => e.name);
+  } catch {
+    return [];
+  }
+}
+function installedSkillVersion(name) {
+  try {
+    return readFileSync2(join2(homedir2(), ".claude", "skills", name, ".installed-version"), "utf8").trim() || null;
+  } catch {
+    return null;
+  }
+}
+function skillVersions(sourceRoot = DEFAULT_SOURCE_ROOT) {
+  return bundledSkillNames(sourceRoot).map((name) => ({ name, installed: installedSkillVersion(name) }));
+}
+function walkFiles(dir, prefix = "") {
+  const out = [];
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
+    if (entry.isDirectory()) out.push(...walkFiles(join2(dir, entry.name), rel));
+    else out.push(rel);
+  }
+  return out;
+}
+function installSkills(version2, sourceRoot = DEFAULT_SOURCE_ROOT) {
   const destRoot = join2(homedir2(), ".claude", "skills");
   const installed = [];
+  const updates = [];
+  const removedOrphans = [];
   for (const entry of readdirSync(sourceRoot, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
     const src = join2(sourceRoot, entry.name);
     if (!existsSync2(join2(src, "SKILL.md"))) continue;
     const dest = join2(destRoot, entry.name);
+    const from = installedSkillVersion(entry.name);
     cpSync(src, dest, { recursive: true });
+    try {
+      const shipped = new Set(walkFiles(src));
+      for (const rel of walkFiles(dest)) {
+        if (rel === ".installed-version") continue;
+        if (!shipped.has(rel)) {
+          rmSync(join2(dest, rel), { force: true });
+          removedOrphans.push(`${entry.name}/${rel}`);
+        }
+      }
+    } catch {
+    }
     try {
       writeFileSync(join2(dest, ".installed-version"), `${version2}
 `);
     } catch {
     }
     installed.push(entry.name);
+    updates.push({ name: entry.name, from, to: version2 });
   }
-  return { installed, version: version2, skillsDir: destRoot };
+  return { installed, updates, removedOrphans, version: version2, skillsDir: destRoot };
 }
 
 // src/knowledge.ts
@@ -39950,11 +40006,11 @@ function scrubKeyMaterial(text) {
 var KNOWLEDGE_GATE_COPY = {
   displayName: "Knowledge Base",
   requiredPlan: "Pro",
-  description: "Turn your own content \u2014 videos, blog posts, books, socials \u2014 into a knowledge base your AI agents answer from, with a citation for every claim. If it isn't in your content, the bot says so instead of making something up.",
+  description: "Turn your own content (videos, blog posts, books, socials) into a knowledge base your AI agents answer from, with a citation for every claim. If it isn't in your content, the bot says so instead of making something up.",
   bullets: [
     "Answers come only from your published content, cited back to the exact source",
-    `No made-up answers in front of a customer \u2014 no evidence means an honest "I don't know"`,
-    "Feed it videos, podcasts, blog posts and books \u2014 we transcribe and index the lot",
+    `No made-up answers in front of a customer: no evidence means an honest "I don't know"`,
+    "Feed it videos, podcasts, blog posts and books. We transcribe and index the lot",
     "Plugs straight into your n8n chat agents, so the 10pm enquiry gets a real answer",
     "Hosted in Sydney, isolated to your account, and gone the moment you delete it"
   ]
@@ -39965,7 +40021,7 @@ function upsellPayload(apiBase, plan) {
     ...typeof plan === "string" ? { plan } : {},
     feature: KNOWLEDGE_GATE_COPY,
     billingUrl: `${apiBase}/billing`,
-    note: "Knowledge Base needs the Pro plan. Do NOT retry \u2014 relay this honestly, share the billing link, and let the user decide. Preview + explicit confirmation before any upgrade."
+    note: "Knowledge Base needs the Pro plan. Do NOT retry. Relay this honestly, share the billing link, and let the user decide. Preview + explicit confirmation before any upgrade."
   };
 }
 function consentPayload(message) {
@@ -39973,14 +40029,14 @@ function consentPayload(message) {
     consent_required: true,
     message,
     settingsPath: 'Settings \u2192 Privacy \u2192 "Knowledge Platform"',
-    note: "The user must flip the consent themselves in the hub \u2014 do NOT retry until they confirm it is on."
+    note: "The user must flip the consent themselves in the hub. Do NOT retry until they confirm it is on."
   };
 }
 function notAvailablePayload(apiBase) {
   return {
     available: false,
     reason: "not_available_on_this_hub",
-    note: "Knowledge Base is not enabled on this hub (feature switch off, or the hub predates it). The connection itself is fine \u2014 do not retry. The user can ask Awesomate support when it will be available for their account.",
+    note: "Knowledge Base is not enabled on this hub (feature switch off, or the hub predates it). The connection itself is fine; do not retry. The user can ask Awesomate support when it will be available for their account.",
     hubUrl: apiBase
   };
 }
@@ -39990,7 +40046,7 @@ function packConfirmationPayload(body) {
     purchased: false,
     dimension: body.dimension ?? null,
     pack: body.pack ?? null,
-    note: "This ingest would exceed the included allowance. NOTHING was purchased and the source was NOT added. An Ingestion Pack costs 1 credit ($100) \u2014 state that plainly, get an explicit yes, then send the user to the hub Knowledge \u2192 Usage page to buy it (this tool never spends credits)."
+    note: "This ingest would exceed the included allowance. NOTHING was purchased and the source was NOT added. An Ingestion Pack costs 1 credit ($100). State that plainly, get an explicit yes, then send the user to the hub Knowledge \u2192 Usage page to buy it (this tool never spends credits)."
   };
 }
 function bodyOf(err) {
@@ -40018,14 +40074,14 @@ async function knowledgeStatus(config3) {
     const annotated = {
       ...status,
       usage_glossary: {
-        pages: "month-to-date hub-submitted page quota used (vs usage.included.pages) \u2014 NOT the size of the library",
+        pages: "month-to-date hub-submitted page quota used (vs usage.included.pages): NOT the size of the library",
         sources_total: 'sources currently in the library; kinds in usage.sources_by_kind or awesomate_knowledge_sources {action:"summary"}'
       }
     };
     if (usage.sources_total_source === "hourly_gauge") {
-      annotated.note = "The live source count failed for this call: usage.sources_total / sources_failed are the last hourly gauge \u2014 possibly stale, and 0 for a library the gauge could never count. Retry before quoting them; the tenant itself is active.";
+      annotated.note = "The live source count failed for this call: usage.sources_total / sources_failed are the last hourly gauge: possibly stale, and 0 for a library the gauge could never count. Retry before quoting them; the tenant itself is active.";
     } else if (usage.sources_total_truncated === true) {
-      annotated.note = `usage.sources_total is a floor: the live count stopped at ${String(usage.sources_total)} sources (paged-count cap). The library holds at least that many \u2014 never quote it as the exact total.`;
+      annotated.note = `usage.sources_total is a floor: the live count stopped at ${String(usage.sources_total)} sources (paged-count cap). The library holds at least that many: never quote it as the exact total.`;
     }
     return annotated;
   } catch (err) {
@@ -40038,7 +40094,7 @@ async function knowledgeProvision(config3) {
     if (result.pending) {
       return {
         ...result,
-        note: "Provisioning continues in the background \u2014 poll awesomate_knowledge_status until the tenant is active (a few minutes at most). Re-calling provision is safe (idempotent)."
+        note: "Provisioning continues in the background. Poll awesomate_knowledge_status until the tenant is active (a few minutes at most). Re-calling provision is safe (idempotent)."
       };
     }
     return result;
@@ -40058,7 +40114,7 @@ function describeSourcePage(page) {
     ...page,
     page: { returned: page.sources.length, kinds_on_this_page: kinds, has_more: hasMore },
     ...hasMore ? {
-      note: 'This is ONE page of the most recently ingested sources, not the whole library \u2014 do not summarise the knowledge base from it. Pass cursor=next_cursor to continue (limit up to 200). For the total, use awesomate_knowledge_status \u2192 usage.sources_total (sources_total_truncated:true means "at least that many").'
+      note: 'This is ONE page of the most recently ingested sources, not the whole library: do not summarise the knowledge base from it. Pass cursor=next_cursor to continue (limit up to 200). For the total, use awesomate_knowledge_status \u2192 usage.sources_total (sources_total_truncated:true means "at least that many").'
     } : {}
   };
 }
@@ -40104,7 +40160,7 @@ async function knowledgeSources(config3, args) {
     if (!args.url && !args.sitemap) {
       return {
         error: "invalid_request",
-        note: "add needs url or sitemap. For a local FILE, send the user to the hub: Knowledge \u2192 Sources \u2192 Upload \u2014 files stream there; this tool cannot carry file bytes in v1."
+        note: "add needs url or sitemap. For a local FILE, send the user to the hub: Knowledge \u2192 Sources \u2192 Upload. Files stream there; this tool cannot carry file bytes in v1."
       };
     }
     const body = args.url ? { url: args.url } : { sitemap: args.sitemap, ...args.since ? { since: args.since } : {} };
@@ -40139,7 +40195,7 @@ function renderAnswer(meta, streamedAnswer, streamError = null) {
       detail: streamError ?? (streamedAnswer || null),
       configured_fallback: fallback,
       ...session,
-      note: "The knowledge platform failed to answer \u2014 a service problem, NOT a content gap. Do not tell the user their content lacks this. Say the service hit a problem, retry once, and if it persists raise it via awesomate_support. configured_fallback is only what an end customer would have seen meanwhile."
+      note: "The knowledge platform failed to answer: a service problem, NOT a content gap. Do not tell the user their content lacks this. Say the service hit a problem, retry once, and if it persists raise it via awesomate_support. configured_fallback is only what an end customer would have seen meanwhile."
     };
   }
   if (status !== "ok") {
@@ -40149,7 +40205,7 @@ function renderAnswer(meta, streamedAnswer, streamError = null) {
       not_in_verified_content: true,
       configured_fallback: fallback,
       ...session,
-      note: "The knowledge base has no verified answer for this \u2014 relay that honestly (use the configured fallback wording if present). Never fill the gap from memory."
+      note: "The knowledge base has no verified answer for this. Relay that honestly (use the configured fallback wording if present). Never fill the gap from memory."
     };
   }
   const rawSources = Array.isArray(meta.sources) ? meta.sources : [];
@@ -40166,7 +40222,7 @@ function renderAnswer(meta, streamedAnswer, streamError = null) {
     sources,
     ...typeof meta.score === "number" ? { score: meta.score } : {},
     ...session,
-    note: "Present the answer with its numbered sources \u2014 the citations are the product."
+    note: "Present the answer with its numbered sources; the citations are the product."
   };
 }
 async function knowledgeAsk(config3, args) {
@@ -40174,7 +40230,7 @@ async function knowledgeAsk(config3, args) {
     const raw = await hubPost(
       config3,
       "/api/knowledge/chat",
-      { question: args.question, ...args.session ? { session: args.session } : {} },
+      { question: args.question, ...args.session ? { session: args.session } : {}, ...args.filters ? { filters: askFilters(args.filters) } : {} },
       { accept: "application/json" }
     );
     if (raw && typeof raw === "object") {
@@ -40210,10 +40266,10 @@ function entityLayerUnavailablePayload() {
   return {
     available: false,
     reason: "entity_layer_not_available",
-    note: "People, places and connections are not switched on for this knowledge base yet (the platform has not deployed the entity layer for this tenant). Nothing to fix on the user's side \u2014 do not retry; the counts appear once the first resolution runs."
+    note: "People, places and connections are not switched on for this knowledge base yet (the platform has not deployed the entity layer for this tenant). Nothing to fix on the user's side: do not retry; the counts appear once the first resolution runs."
   };
 }
-var PHOTOS_NOTE = "Text only: names, mention counts and the sources behind them. Photos of unnamed people are only viewable on the hub Knowledge \u2192 People page \u2014 never guess who someone is from a handle.";
+var PHOTOS_NOTE = "Text only: names, mention counts and the sources behind them. Photos of unnamed people are only viewable on the hub Knowledge \u2192 People page: never guess who someone is from a handle.";
 function invalid(note) {
   return { error: "invalid_request", note };
 }
@@ -40224,7 +40280,7 @@ function mapPeopleError(err, apiBase) {
       return {
         error: "not_found",
         message: typeof body.message === "string" ? body.message : "No such person or entity on this knowledge base",
-        note: "Use the exact person_id / entity_id from a fresh list \u2014 ids are opaque and per-tenant."
+        note: "Use the exact person_id / entity_id from a fresh list: ids are opaque and per-tenant."
       };
     }
   }
@@ -40256,13 +40312,13 @@ async function knowledgePeople(config3, args) {
         const page = await hubGet(config3, `/api/knowledge/entities/aliases?${q.toString()}`);
         return {
           ...page,
-          note: "Each suggestion is a text name the content uses that probably refers to a known entity. Show the user the alias, the suggested match and the confidence, then use decide with the (kind, alias_norm) pair \u2014 only after they explicitly say accept, reject, or create."
+          note: "Each suggestion is a text name the content uses that probably refers to a known entity. Show the user the alias, the suggested match and the confidence, then use decide with the (kind, alias_norm) pair: only after they explicitly say accept, reject, or create."
         };
       }
       const result = await hubPost(config3, "/api/knowledge/entities/resolve", {});
       return {
         ...result,
-        note: result.status === "queued" ? "Resolution queued. It re-scans the content for people/places/topics and counts toward the ingestion allowance; the user's names and decisions are never undone. Check back with list for the refreshed counts." : "A resolution is already queued or running \u2014 nothing new was started. Check back with list for the refreshed counts."
+        note: result.status === "queued" ? "Resolution queued. It re-scans the content for people/places/topics and counts toward the ingestion allowance; the user's names and decisions are never undone. Check back with list for the refreshed counts." : "A resolution is already queued or running: nothing new was started. Check back with list for the refreshed counts."
       };
     }
     if (args.action === "get") {
@@ -40278,7 +40334,7 @@ async function knowledgePeople(config3, args) {
       let body;
       if (args.action === "rename") {
         const name = args.displayName?.trim();
-        if (!name) return invalid("rename needs displayName (1\u201380 chars) \u2014 the name the USER gave, never a guess");
+        if (!name) return invalid("rename needs displayName (1\u201380 chars): the name the USER gave, never a guess");
         body = { display_name: name };
       } else {
         body = { status: args.action === "hide" ? "hidden" : "unknown" };
@@ -40292,7 +40348,7 @@ async function knowledgePeople(config3, args) {
         changed: Object.keys(body),
         requested: body,
         ...result,
-        note: args.action === "rename" ? "The name is attached to every source this person appears in and the agent uses it from the next reindex. Read the new display_name back to the user to confirm." : args.action === "hide" ? "Hidden \u2014 this person no longer appears in answers. Reversible with unhide." : "Unhidden \u2014 back in answers from the next resolution."
+        note: args.action === "rename" ? "The name is attached to every source this person appears in and the agent uses it from the next reindex. Read the new display_name back to the user to confirm." : args.action === "hide" ? "Hidden: this person no longer appears in answers. Reversible with unhide." : "Unhidden: back in answers from the next resolution."
       };
     }
     if (args.action === "merge") {
@@ -40325,7 +40381,7 @@ async function knowledgePeople(config3, args) {
       return {
         requested: body,
         ...result,
-        note: args.decision === "reject" ? "Rejected \u2014 the alias stays a plain text mention and will not be suggested again." : "Accepted \u2014 mentions re-link on the next resolution. Read entity_id back to the user."
+        note: args.decision === "reject" ? "Rejected: the alias stays a plain text mention and will not be suggested again." : "Accepted: mentions re-link on the next resolution. Read entity_id back to the user."
       };
     }
     return invalid(`unknown action ${String(args.action)}`);
@@ -40357,6 +40413,101 @@ async function knowledgeAgent(config3, args) {
     return mapKnowledgeError(err, config3.apiBase);
   }
 }
+function askFilters(f) {
+  const out = {};
+  for (const name of ["kind", "topic", "person", "place", "category", "author"]) {
+    if (f[name] !== void 0) out[name] = f[name];
+  }
+  const docs = f.doc ?? f.doc_ids;
+  if (docs !== void 0) out.doc_ids = docs;
+  if (f.year !== void 0) {
+    const years = Array.isArray(f.year) ? f.year : [f.year];
+    out.year = years.map((y) => Number(y)).filter((y) => Number.isInteger(y));
+  }
+  return out;
+}
+var SENTINEL_PRE = "\uE000";
+var SENTINEL_POST = "\uE001";
+function plainSnippet(text) {
+  return text.split(SENTINEL_PRE).join("**").split(SENTINEL_POST).join("**");
+}
+async function knowledgeSearch(config3, args) {
+  try {
+    const q = new URLSearchParams();
+    if (args.q) q.set("q", args.q);
+    if (args.kind) q.set("kind", args.kind);
+    for (const [name, values] of [
+      ["topic", args.topic],
+      ["person", args.person],
+      ["place", args.place],
+      ["category", args.category],
+      ["author", args.author],
+      ["year", args.year],
+      ["doc", args.doc]
+    ]) {
+      for (const v of values ?? []) q.append(name, v);
+    }
+    if (args.limit !== void 0) q.set("limit", String(args.limit));
+    if (args.offset !== void 0) q.set("offset", String(args.offset));
+    if (args.include_media) q.set("include", "media");
+    const qs = q.toString();
+    const result = await hubGet(config3, `/api/knowledge/explore${qs ? `?${qs}` : ""}`);
+    const hits = Array.isArray(result.hits) ? result.hits.map((h) => ({
+      ...h,
+      snippet: typeof h.snippet === "string" ? plainSnippet(h.snippet) : h.snippet
+    })) : result.hits;
+    const { highlight: _highlight, ...rest } = result;
+    return {
+      ...rest,
+      hits,
+      note: "Facet counts describe the CURRENT filters; pass repeated facet values to OR within a facet. media URLs (url/poster_url, present with include_media) are presigned and expire in minutes: use them immediately, never store them."
+    };
+  } catch (err) {
+    return mapKnowledgeError(err, config3.apiBase);
+  }
+}
+function mapAgentsError(err, apiBase) {
+  if (err instanceof HubApiError && err.status === 404) {
+    const body = bodyOf(err);
+    if (body && body.error === "not_found") {
+      return { error: "not_found", detail: typeof body.message === "string" ? body.message : "No such agent or resource for this account." };
+    }
+  }
+  return mapKnowledgeError(err, apiBase);
+}
+async function knowledgeAgents(config3, args) {
+  try {
+    if (args.action === "list") {
+      return await hubGet(config3, "/api/knowledge/agents");
+    }
+    if (args.action === "get") {
+      if (!args.agentId) return { error: "agentId is required for get" };
+      return await hubGet(config3, `/api/knowledge/agents/${encodeURIComponent(args.agentId)}`);
+    }
+    if (args.action === "create") {
+      if (args.goal) {
+        const draft = await hubPost(config3, "/api/knowledge/agents/draft", { goal: args.goal });
+        if (!draft.proposal) return { error: "draft_failed", detail: draft };
+        const created = await hubPost(config3, "/api/knowledge/agents", draft.proposal);
+        return { ...created, test_questions: draft.test_questions ?? [], status_note: "Created as a private DRAFT: test it, then publish when the user approves." };
+      }
+      if (!args.name) return { error: "name (or goal) is required for create" };
+      return await hubPost(config3, "/api/knowledge/agents", { name: args.name });
+    }
+    if (args.action === "publish") {
+      if (!args.agentId) return { error: "agentId is required for publish" };
+      const out = await hubPost(config3, `/api/knowledge/agents/${encodeURIComponent(args.agentId)}/publish`, {});
+      return { ...out, status_note: "Live immediately for every key bound to this agent." };
+    }
+    if (!args.agentId || !args.message) return { error: "agentId and message are required for test" };
+    return await hubPost(config3, `/api/knowledge/agents/${encodeURIComponent(args.agentId)}/chat`, {
+      message: args.message,
+      ...args.sessionId ? { session_id: args.sessionId } : {}
+    });
+  } catch (err) {
+    return mapAgentsError(err, config3.apiBase);
+  }
+}
 
 // src/index.ts
 var config2 = null;
@@ -40368,51 +40519,108 @@ function requireConfig() {
   return config2;
 }
 function accountStamp() {
+  const drift = SKILL_DRIFT ? ` \xB7 skills ${SKILL_DRIFT} \u2014 update ready, run awesomate_skill_update` : "";
   if (!config2) return `account: NOT CONNECTED \u2014 ${configError ?? "unknown error"}`;
-  return `account: ${config2.account ?? "unknown (env PAT not matched to a profile)"} (source: ${config2.source})`;
+  return `account: ${config2.account ?? "unknown (env PAT not matched to a profile)"} (source: ${config2.source})${drift}`;
 }
 var SERVER_VERSION = (() => {
   try {
     const pkg = JSON.parse(
-      readFileSync2(join3(dirname3(fileURLToPath2(import.meta.url)), "..", "package.json"), "utf8")
+      readFileSync3(join3(dirname3(fileURLToPath2(import.meta.url)), "..", "package.json"), "utf8")
     );
     return pkg.version ?? "0.0.0";
   } catch {
     return "0.0.0";
   }
 })();
-function skillUpdateInfo() {
-  let installedSkillVersion = null;
+var CHANGELOG = (() => {
   try {
-    installedSkillVersion = readFileSync2(
-      join3(homedir3(), ".claude", "skills", "awesomate-hosting", ".installed-version"),
-      "utf8"
-    ).trim() || null;
+    const raw = JSON.parse(
+      readFileSync3(join3(dirname3(fileURLToPath2(import.meta.url)), "..", "skill", "CHANGELOG.json"), "utf8")
+    );
+    return Array.isArray(raw.versions) ? raw.versions : [];
   } catch {
+    return [];
   }
+})();
+function changelogSince(installed) {
+  if (!installed) return CHANGELOG.slice(0, 3);
+  const idx = CHANGELOG.findIndex((e) => e.version === installed);
+  return idx === -1 ? CHANGELOG.slice(0, 3) : CHANGELOG.slice(0, idx);
+}
+function skillUpdateInfo() {
+  const perSkill = skillVersions();
+  const staleSkills = perSkill.filter((s) => s.installed !== SERVER_VERSION).map((s) => s.name);
+  const oldest = perSkill.reduce(
+    (min, s) => s.installed !== null && (min === null || s.installed < min) ? s.installed : min,
+    null
+  );
+  const updateAvailable = perSkill.length === 0 || staleSkills.length > 0;
   return {
     serverVersion: SERVER_VERSION,
-    installedSkillVersion,
-    updateAvailable: installedSkillVersion !== SERVER_VERSION
+    installedSkillVersion: oldest,
+    updateAvailable,
+    staleSkills,
+    whatsNew: updateAvailable ? changelogSince(oldest).flatMap((e) => e.highlights) : []
   };
 }
-var server = new McpServer({
-  name: "awesomate-hosting",
-  version: SERVER_VERSION
-});
+var SKILL_DRIFT = (() => {
+  const info = skillUpdateInfo();
+  if (!info.updateAvailable) return null;
+  return `${info.installedSkillVersion ?? "unversioned"} \u2192 ${SERVER_VERSION}`;
+})();
+var SERVER_INSTRUCTIONS = [
+  "Awesomate connects this account's WordPress hosting, n8n automations, apps and Knowledge Base to Claude.",
+  "Entry point: call awesomate_get_context once per session FIRST \u2014 it returns the account, plan, limits, an `attention` digest (unread notifications, erroring workflows, token expiry) and skill freshness. The domain contexts (awesomate_n8n_context, awesomate_app_context, awesomate_knowledge_status) come after it, only for their domain.",
+  "The awesomate-* skills are installed on this machine \u2014 load the one matching the task (awesomate-hosting, awesomate-n8n, awesomate-app-builder, awesomate-knowledge, awesomate-seo, awesomate-credentials, awesomate-github, awesomate-database, awesomate-support) before working in that area.",
+  "Reads work on every plan; building/writing generally needs Support Plus or above, and the Knowledge Base needs Pro. Never retry a 403: it carries either an upgrade path (relay it honestly, let the user decide) or a privacy toggle only the user can flip (send them the settings link).",
+  "Every response is stamped `account: <slug>` \u2014 if that is not the account the user expects, stop and fix the connection before doing any work.",
+  SKILL_DRIFT ? `Skill files on this machine are ${SKILL_DRIFT}. Mention it ONCE this session (never mid-task): offer awesomate_skill_update, then a Claude Code restart.` : null
+].filter((line) => line !== null).join("\n");
+var server = new McpServer(
+  {
+    name: "awesomate-hosting",
+    version: SERVER_VERSION
+  },
+  { instructions: SERVER_INSTRUCTIONS }
+);
 function textResult(data) {
   return {
     content: [{ type: "text", text: `${accountStamp()}
 ${JSON.stringify(data, null, 2)}` }]
   };
 }
+var ERROR_BODY_FIELDS = [
+  "code",
+  "recommendedPlan",
+  "deepLink",
+  "upgradeUrl",
+  "settingsUrl",
+  "missingScopes",
+  "plan",
+  "allowed"
+];
 function errorResult(err) {
   const message = err instanceof Error ? err.message : String(err);
-  return { content: [{ type: "text", text: `${accountStamp()}
-${message}` }], isError: true };
+  let text = `${accountStamp()}
+${message}`;
+  if (err instanceof HubApiError && err.body && typeof err.body === "object") {
+    const body = err.body;
+    const details = {};
+    for (const field of ERROR_BODY_FIELDS) {
+      if (body[field] !== void 0 && body[field] !== null) details[field] = body[field];
+    }
+    if (Object.keys(details).length > 0) {
+      text += `
+${JSON.stringify(details, null, 2)}`;
+    }
+  }
+  return { content: [{ type: "text", text }], isError: true };
 }
+var READ_ONLY = { readOnlyHint: true };
+var DESTRUCTIVE = { destructiveHint: true };
 function readTool(name, description, path) {
-  server.registerTool(name, { description, inputSchema: {} }, async () => {
+  server.registerTool(name, { description, inputSchema: {}, annotations: READ_ONLY }, async () => {
     try {
       return textResult(await hubGet(requireConfig(), path));
     } catch (err) {
@@ -40423,6 +40631,7 @@ function readTool(name, description, path) {
 server.registerTool(
   "awesomate_whoami",
   {
+    annotations: READ_ONLY,
     description: "Zero-network identity check: which Awesomate account this session is connected to (slug, plan, token expiry) and WHY (env var, project pin file, sole profile, or default). Call it after connecting, after switching folders, and any time the account in play matters \u2014 if the slug is not the account the user expects, STOP and fix the pin/connection before doing any work.",
     inputSchema: {}
   },
@@ -40446,7 +40655,8 @@ server.registerTool(
 server.registerTool(
   "awesomate_get_context",
   {
-    description: "Call this FIRST each session. Returns the connected Awesomate account: plan, capabilities (shell access), plan limits, scopes this token can exercise, token expiry (warn the user if within 7 days), cPanel routing when provisioned, and skill.updateAvailable \u2014 if true, the local Awesomate skill files are older than this server; run awesomate_skill_update to refresh them in place (new content loads next session \u2014 mention once, finish the current task first). If the token is also near expiry, re-running Connect Claude Code from hub.awesomate.ai/sites refreshes skills AND renews the token in one go.",
+    annotations: READ_ONLY,
+    description: "THE session entry point \u2014 call it FIRST, before any domain context. Returns the connected account: plan, capabilities, limits, scopes, token expiry, cPanel routing, PLUS `attention` ({unreadNotifications, erroringWorkflows7d, patExpiresInDays} \u2014 null means unknown, never zero; when something is non-zero, mention it to the user in one line before starting the asked task), `latestMcpVersion` (if serverVersion still lags it after a restart, the npx cache is stale \u2014 remedy: rm -rf ~/.npm/_npx, then restart), and `skill` ({updateAvailable, staleSkills, whatsNew} \u2014 if updateAvailable, mention ONCE with a whatsNew line, offer awesomate_skill_update, never mid-task). If the token is near expiry (patExpiresInDays < 7), re-running Connect Claude Code from hub.awesomate.ai/sites refreshes skills AND renews the token in one go.",
     inputSchema: {}
   },
   async () => {
@@ -40466,6 +40676,7 @@ readTool(
 server.registerTool(
   "awesomate_n8n_deploy",
   {
+    annotations: DESTRUCTIVE,
     description: "Workflow lifecycle writes on the client's n8n, all consent-gated and audited server-side. Actions: 'validate' (structural + n8n-mcp check of workflowJson \u2014 ALWAYS validate before create_draft), 'create_draft' (creates an INACTIVE '[CLI] ' workflow tagged awm:client-cli; returns its webhook URLs), 'activate'/'deactivate' (activation strips the [CLI] prefix; production webhooks respond only while active; agency-managed workflows are refused), 'promote' (swaps a TESTED draft into the live workflow IN PLACE \u2014 live id + webhookIds preserved so external callers keep working; pass workflowId=the LIVE id and draftId=the tested draft; the draft is archived '[promoted <date>]'; response includes operationId for rollback), 'rollback' (restore a promote's pre-swap state \u2014 pass operationId), 'update_draft' (replace an INACTIVE self-built draft's full JSON in place \u2014 pass workflowId + workflowJson; live workflows are refused, use the promote path), 'delete_draft' (inactive self-built drafts only). Get explicit user approval before activate, promote, rollback, and delete_draft. 429 quota_exceeded = daily plan limit; 403 consent_required \u2192 send user to settingsUrl.",
     inputSchema: {
       action: external_exports.enum(["validate", "create_draft", "update_draft", "activate", "deactivate", "promote", "rollback", "delete_draft"]),
@@ -40540,6 +40751,7 @@ server.registerTool(
 server.registerTool(
   "awesomate_n8n_workflows",
   {
+    annotations: READ_ONLY,
     description: "The client's workflows. No id \u2192 EVERY workflow as a node-level summary in one call (nodeCount, nodeTypes, triggers, usesAi, communityNodes, dates; ?active filter + pagination) \u2014 use this for the session's world picture instead of fetching workflows one by one. With id \u2192 that workflow's JSON: detail 'full' (default \u2014 nodes with parameters, connections, settings) or 'structure' (nodes WITHOUT parameters + connections \u2014 cheap shape check for big workflows). 403 consent_required \u2192 send the user to settingsUrl and re-check.",
     inputSchema: {
       id: external_exports.string().optional().describe("Workflow id for a single-workflow read; omit for the all-workflows summary"),
@@ -40575,6 +40787,7 @@ server.registerTool(
 server.registerTool(
   "awesomate_n8n_inspect",
   {
+    annotations: READ_ONLY,
     description: `Instance inventory reads, one tool: 'nodes' (distinct node types in use, counts, versions, community/AI flags), 'datatables' (tables + columns + row counts), 'datatable_rows' (pass datatableId; limit \u2264 100), 'possibilities' (facts for "what could I automate": connected services with live-usage cross-check, unused connections, top nodes, AI tools [null = unknown, not none], community packages, counts \u2014 YOU turn these into suggestions, grounded only in what's actually there), 'credentials' (names/types/inferred service \u2014 never secrets), 'variables' ($vars keys). All consent-gated server-side; 403 consent_required \u2192 settingsUrl.`,
     inputSchema: {
       what: external_exports.enum(["nodes", "datatables", "datatable_rows", "possibilities", "credentials", "variables"]),
@@ -40606,7 +40819,8 @@ server.registerTool(
 server.registerTool(
   "awesomate_n8n_executions",
   {
-    description: "Execution reads. workflowId \u2192 recent executions of that workflow. executionId \u2192 full detail with error summary. executionId + debug:true \u2192 node-by-node decode (statuses, timings, errors, 2 example items per node) \u2014 the best failure-diagnosis view; needs the 'error content analysis' privacy toggle (403 consent_required \u2192 settingsUrl), and responses with tooLarge:true mean the payload exceeded 15MB \u2014 fall back to the non-debug detail.",
+    annotations: READ_ONLY,
+    description: "Execution reads. workflowId \u2192 recent executions of that workflow. executionId \u2192 detail with errorSummary \u2014 trust errorSummary.failingNode only when confident:true (structural decode; also carries errorType/code/lastNodeExecuted); when confident:false it came from a heuristic and may name a node that does not exist \u2014 verify against the workflow before editing anything. executionId + debug:true \u2192 node-by-node decode (statuses, timings, errors, 2 example items per node) \u2014 the best failure-diagnosis view; needs the 'error content analysis' privacy toggle (403 consent_required \u2192 settingsUrl), and responses with tooLarge:true mean the payload exceeded 15MB \u2014 fall back to the non-debug detail. For 'what is failing across ALL my workflows', use awesomate_n8n_errors instead.",
     inputSchema: {
       workflowId: external_exports.string().optional(),
       executionId: external_exports.string().optional(),
@@ -40634,6 +40848,7 @@ server.registerTool(
 server.registerTool(
   "awesomate_n8n_node_docs",
   {
+    annotations: READ_ONLY,
     description: "Live n8n documentation, 500+ nodes + 2,500+ community templates \u2014 ALWAYS prefer this over memory for node schemas and typeVersions. tools: search_nodes {query}, get_node {nodeType \u2014 full form like 'n8n-nodes-base.gmail' works, add detail:'full' for everything}, search_templates {query} / get_template {templateId} (real importable community workflows \u2014 great starting points), validate_node {nodeType, config}, tools_documentation {}. Works on every plan, no consent needed. 503 node_catalog_unavailable \u2192 use the skill's references/vendor/ files instead; 422 catalog_tool_error \u2192 YOUR args were wrong (message says why), the catalog is fine.",
     inputSchema: {
       tool: external_exports.enum(["search_nodes", "get_node", "search_templates", "get_template", "validate_node", "tools_documentation"]),
@@ -40651,6 +40866,7 @@ server.registerTool(
 server.registerTool(
   "awesomate_n8n_datatable_write",
   {
+    annotations: DESTRUCTIVE,
     description: "Datatable writes (Support Plus+, consent-gated, audited). 'create' {name, columns:[{name,type?}], workflowId?} \u2014 ALWAYS pass workflowId when the table serves a specific workflow (datatables resolve PER PROJECT at runtime; workflowId threads that workflow's project; a projectWarning in the response means pass it). 'add_column' {tableId, name, type?} \u2014 needs the 'direct database writes' privacy toggle; names: letters/digits/underscores only. 'insert' {tableId, rows:[...]} (\u2264100), 'update' {tableId, filter, data}, 'delete_rows' {tableId, filter \u2014 REQUIRED, there is no delete-all}. Writes only work on tables created through Claude Code (403 not_self_created otherwise \u2014 agency tables are off limits). Get explicit user approval before delete_rows.",
     inputSchema: {
       action: external_exports.enum(["create", "add_column", "insert", "update", "delete_rows"]),
@@ -40685,13 +40901,24 @@ server.registerTool(
 server.registerTool(
   "awesomate_skill_update",
   {
-    description: "Refresh the locally installed Awesomate skills from this (always-latest) server package \u2014 run when awesomate_get_context reports skill.updateAvailable. Copies every bundled skill into ~/.claude/skills and re-stamps versions. New skill content applies from the NEXT Claude Code session; finish the current task first, then suggest a restart.",
+    description: "The one-step updater for the locally installed Awesomate skills \u2014 run when any response stamp or awesomate_get_context reports an update ready. Refreshes ALL bundled skills in ~/.claude/skills from this (always-latest) server package, removes files newer bundles no longer ship, re-stamps versions, and returns per-skill from\u2192to plus what's-new lines and the exact restart step. New skill content applies from the NEXT Claude Code session; finish the current task first, then hand the user the restart instruction verbatim.",
     inputSchema: {}
   },
   async () => {
     try {
       const result = installSkills(SERVER_VERSION);
-      return textResult({ ...result, note: "Updated skill files load in the next Claude Code session." });
+      const changed = result.updates.filter((u) => u.from !== u.to);
+      return textResult({
+        ...result,
+        changed: changed.map((u) => `${u.name}: ${u.from ?? "unversioned"} \u2192 ${u.to}`),
+        whatsNew: changelogSince(changed[0]?.from ?? null).flatMap((e) => e.highlights),
+        restart: {
+          note: "Updated skill files load in the next Claude Code session \u2014 one restart lands both the skills and the (self-updating) server.",
+          terminal: "Type exit (or press Ctrl+C twice), then run `claude` again.",
+          vscode: 'Command Palette (Cmd/Ctrl+Shift+P) \u2192 "Developer: Reload Window".',
+          verify: "After restarting, awesomate_get_context should report skill.updateAvailable: false."
+        }
+      });
     } catch (err) {
       return errorResult(err);
     }
@@ -40731,6 +40958,7 @@ server.registerTool(
 server.registerTool(
   "awesomate_request_build",
   {
+    annotations: DESTRUCTIVE,
     description: "Submit a DONE-FOR-YOU automation request \u2014 the Awesomate team builds it, for clients who'd rather not build it themselves or whose request is beyond what you can build here. This SPENDS 1 CREDIT ($100). Two steps, always: call WITHOUT confirmCredit first \u2014 it returns the cost and the user's available balance and spends nothing; state both to the user in plain words, get an explicit yes, THEN call again with confirmCredit:true. Needs a wizard-enabled plan (Pro/Embedded) \u2014 a Support Plus user gets upgrade_required, relay it honestly. On success returns a tracking URL (progress shows on My Automations).",
     inputSchema: {
       title: external_exports.string().describe("Short name for the automation"),
@@ -40799,6 +41027,7 @@ server.registerTool(
 server.registerTool(
   "awesomate_uninstall_site",
   {
+    annotations: DESTRUCTIVE,
     description: "Permanently delete a WordPress site (files + database). IRREVERSIBLE \u2014 snapshot first if the user might want it back, and always get explicit confirmation. You MUST pass confirm equal to the exact domain, or the hub refuses. Support Plus+.",
     inputSchema: {
       domain: external_exports.string().describe("The site domain to delete"),
@@ -40875,6 +41104,7 @@ var PLAN_LADDER_FALLBACK = {
 server.registerTool(
   "awesomate_get_plan_features",
   {
+    annotations: READ_ONLY,
     description: "The Awesomate plan ladder: what each plan includes for hosting (WordPress sites, custom domains, hosted apps, cPanel, shell/Claude Code access) and which plans are purchasable. Fetched live from the hub (single source of truth) with a static fallback. Use to explain what an upgrade unlocks; live per-account usage comes from awesomate_get_limits.",
     inputSchema: {}
   },
@@ -40915,6 +41145,7 @@ server.registerTool(
 server.registerTool(
   "awesomate_list_snapshots",
   {
+    annotations: READ_ONLY,
     description: "List a site\u2019s available snapshots (newest first) with their ids, timestamps, and reasons. Requires shell access (Support Plus+).",
     inputSchema: { domain: external_exports.string().describe("The site domain") }
   },
@@ -40929,6 +41160,7 @@ server.registerTool(
 server.registerTool(
   "awesomate_rollback_site",
   {
+    annotations: DESTRUCTIVE,
     description: "Restore a site to a previous snapshot (files + database). The current state is auto-snapshotted first, so a rollback is itself reversible (see preRollbackSnapshotId in the result). Confirm with the user before rolling back \u2014 it overwrites the live site. Requires shell access (Support Plus+).",
     inputSchema: {
       domain: external_exports.string().describe("The site domain"),
@@ -40966,6 +41198,7 @@ server.registerTool(
 server.registerTool(
   "awesomate_site_staging_promote",
   {
+    annotations: DESTRUCTIVE,
     description: "Publish the staging copy to the LIVE site (overwrites live files + database with staging). The live site is auto-snapshotted first \u2014 the result includes preSnapshotId, which awesomate_rollback_site can restore if anything looks wrong. **Confirm with the user before promoting \u2014 it replaces the live site.** Requires shell access (Support Plus+).",
     inputSchema: {
       domain: external_exports.string().describe("The LIVE site domain whose staging copy should go live")
@@ -40984,6 +41217,7 @@ server.registerTool(
 server.registerTool(
   "awesomate_site_staging_discard",
   {
+    annotations: DESTRUCTIVE,
     description: "Delete the staging copy of a site (staging WP install + its awesomate.dev address; the live site is untouched). **Confirm with the user before discarding \u2014 unpromoted staging changes are lost.** Requires shell access (Support Plus+).",
     inputSchema: {
       domain: external_exports.string().describe("The LIVE site domain whose staging copy should be discarded")
@@ -41012,6 +41246,7 @@ readTool(
 server.registerTool(
   "awesomate_app_get",
   {
+    annotations: READ_ONLY,
     description: "Get one app plus its environments (subdomains, ports, db engine/name, deploy + health state). Poll this after awesomate_app_create \u2014 status goes provisioning \u2192 active | failed (read provision_error on failure).",
     inputSchema: { appId: external_exports.number().int().positive().describe("The app id from awesomate_app_list / _create") }
   },
@@ -41047,6 +41282,7 @@ server.registerTool(
 server.registerTool(
   "awesomate_app_scaffold",
   {
+    annotations: READ_ONLY,
     description: "Fetch the app's starter files (its template rendered against the live app metadata \u2014 subdomains, control-plane URL, repo \u2014 with placeholders already substituted). Call after awesomate_app_create reaches status=active: write each returned file into a fresh local project folder at its relative path, then run npm install (Node apps) and follow the bundled CLAUDE.md. This is how the starter code gets onto the user's machine \u2014 don't reconstruct templates by hand.",
     inputSchema: { appId: external_exports.number().int().positive().describe("The app id from awesomate_app_create / _list") }
   },
@@ -41059,9 +41295,10 @@ server.registerTool(
   }
 );
 server.registerTool(
-  "awesomate_app_deploy",
+  "awesomate_app_deploy_info",
   {
-    description: "Report how to deploy an app, its per-env targets, last-deploy/health state, and how to promote (dev\u2192staging\u2192main) or roll back (git revert + push). Node apps deploy via git push (dev/staging/main \u2192 GitHub Actions \u2192 cPanel). Use the awesomate-github skill to wire push-to-deploy the first time.",
+    annotations: READ_ONLY,
+    description: "READ-ONLY deploy briefing \u2014 this never deploys anything (deploys happen via git push). Reports how to deploy an app, its per-env targets, last-deploy/health state, and how to promote (dev\u2192staging\u2192main) or roll back (git revert + push). Node apps deploy via git push (dev/staging/main \u2192 GitHub Actions \u2192 cPanel). Use the awesomate-github skill to wire push-to-deploy the first time.",
     inputSchema: { appId: external_exports.number().int().positive().describe("The app id") }
   },
   async ({ appId }) => {
@@ -41112,6 +41349,7 @@ server.registerTool(
 server.registerTool(
   "awesomate_app_health",
   {
+    annotations: READ_ONLY,
     description: "Probe an app's environments live and report health. Node envs hit /api/ready (200 = deployed + DB up + migrations applied); static hits the root. An env that isn't deployed yet reports unreachable \u2014 expected, not a failure. Use after a deploy to confirm it came up, or when the user says something's down.",
     inputSchema: { appId: external_exports.number().int().positive().describe("The app id") }
   },
@@ -41159,6 +41397,7 @@ ${scrubKeyMaterial(message)}` }],
 server.registerTool(
   "awesomate_knowledge_status",
   {
+    annotations: READ_ONLY,
     description: "Call FIRST for any Knowledge Base work. The account's knowledge tenant state (provisioning/active/suspended), plan entitlement, consent flag, month-to-date usage vs included quota, and purchased packs. upgrade_required:true \u2192 relay the included upsell copy + billing link honestly, do NOT retry. available:false \u2192 this hub doesn't serve Knowledge Base yet (kill switch / old hub) \u2014 also not retryable. Reads work on every plan.",
     inputSchema: {}
   },
@@ -41209,18 +41448,56 @@ server.registerTool(
     }
   }
 );
+server.registerTool(
+  "awesomate_knowledge_search",
+  {
+    annotations: READ_ONLY,
+    description: "Instant search over the knowledge library with live facet counts: the fastest way to see WHAT is in there and to find the exact video moment, book page, dataset or web section. Returns hits (title, kind, locator like t=612-640 or p.42, snippet with **matched words**, score) plus facets {kind, year, category, author, people, places, topics} whose counts describe the current filters: repeat a facet value to OR within it, combine facets to AND. include_media adds presigned url/poster_url to hits: they expire in minutes, use immediately, never store. Keyword-only and free (no answer quota); for a verified ANSWER use awesomate_knowledge_ask, optionally with the same filters.",
+    inputSchema: {
+      q: external_exports.string().max(2e3).optional().describe("Search words; empty lists the library filtered by the facets"),
+      kind: external_exports.enum(["book", "document", "web", "image", "video", "audio", "post", "dataset"]).optional(),
+      topic: external_exports.array(external_exports.string().max(200)).max(10).optional(),
+      person: external_exports.array(external_exports.string().max(200)).max(10).optional(),
+      place: external_exports.array(external_exports.string().max(200)).max(10).optional(),
+      category: external_exports.array(external_exports.string().max(200)).max(10).optional(),
+      author: external_exports.array(external_exports.string().max(200)).max(10).optional(),
+      year: external_exports.array(external_exports.string().regex(/^\d{4}$/)).max(10).optional(),
+      doc: external_exports.array(external_exports.string().max(200)).max(50).optional().describe("Restrict to these doc_ids (from earlier hits)"),
+      limit: external_exports.number().int().min(1).max(50).optional(),
+      offset: external_exports.number().int().min(0).max(2e3).optional(),
+      include_media: external_exports.boolean().optional().describe("Add presigned url/poster_url to hits; they expire in minutes")
+    }
+  },
+  async (args) => {
+    try {
+      return knowledgeResult(await knowledgeSearch(requireConfig(), args));
+    } catch (err) {
+      return knowledgeError(err);
+    }
+  }
+);
 server.registerTool(
   "awesomate_knowledge_ask",
   {
     description: `Ask the account's knowledge base a question and get the VERIFIED answer with numbered sources (title, locator, url) \u2014 the test surface for 'is my content in there and answering well'. Read status: ok \u2192 present answer + sources. no_results / failed_validation (not_in_verified_content:true) \u2192 the verified content has no answer: relay that honestly (use configured_fallback), never fill the gap from memory \u2014 an honest "it doesn't know" is the feature working. error (platform_error:true) \u2192 the platform itself failed (model/API/infra): NOT a content gap \u2014 never tell the user their content lacks the answer; retry once, then awesomate_support. Counts against the monthly answers quota.`,
     inputSchema: {
       question: external_exports.string().min(1).max(2e3),
-      session: external_exports.string().max(128).optional().describe("Stable id to keep follow-up questions in one conversation thread")
+      session: external_exports.string().max(128).optional().describe("Stable id to keep follow-up questions in one conversation thread"),
+      filters: external_exports.object({
+        kind: external_exports.enum(["book", "document", "web", "image", "video", "audio", "post", "dataset"]).optional(),
+        topic: external_exports.array(external_exports.string().max(200)).max(10).optional(),
+        person: external_exports.array(external_exports.string().max(200)).max(10).optional(),
+        place: external_exports.array(external_exports.string().max(200)).max(10).optional(),
+        category: external_exports.array(external_exports.string().max(200)).max(10).optional(),
+        author: external_exports.array(external_exports.string().max(200)).max(10).optional(),
+        year: external_exports.array(external_exports.string().regex(/^\d{4}$/)).max(10).optional(),
+        doc: external_exports.array(external_exports.string().max(200)).max(50).optional().describe("doc_ids from search hits")
+      }).optional().describe("Ask within a slice of the library: EXACTLY the awesomate_knowledge_search input shapes, reusable verbatim; filters only ever narrow")
     }
   },
-  async ({ question, session }) => {
+  async ({ question, session, filters }) => {
     try {
-      return knowledgeResult(await knowledgeAsk(requireConfig(), { question, session }));
+      return knowledgeResult(await knowledgeAsk(requireConfig(), { question, session, filters }));
     } catch (err) {
       return knowledgeError(err);
     }
@@ -41239,7 +41516,7 @@ server.registerTool(
         tone: external_exports.string().max(500).optional()
       }).optional().describe("set only: persona fields to change"),
       no_answer_message: external_exports.string().max(1e3).optional().describe("set only: wording used when the content has no answer"),
-      model_tier: external_exports.enum(["sonnet", "opus"]).optional().describe("set only: opus needs the Embedded plan"),
+      model_tier: external_exports.enum(["flash", "sonnet", "opus"]).optional().describe("set only: flash is the fastest (Gemini Flash, same citation checks), sonnet the thorough default, opus needs the Embedded plan"),
       datasets: external_exports.array(external_exports.string().max(64)).max(16).optional().describe("set only: datasets the agent may answer from")
     }
   },
@@ -41253,6 +41530,27 @@ server.registerTool(
     }
   }
 );
+server.registerTool(
+  "awesomate_knowledge_agents",
+  {
+    description: "The agent builder (multi-agent; the older awesomate_knowledge_agent tool is the single workspace default). action 'list' \u2014 every agent with status (draft/published vN/suspended). 'get' {agentId} \u2014 full config incl. system message and scope. 'create' {goal} \u2014 AI drafts the whole setup (instructions, scope, tone, test questions) from the account's own content and saves it as a PRIVATE DRAFT (never live, nothing lost); or {name} for a blank draft. 'test' {agentId, message, sessionId?} \u2014 chat with the DRAFT config: free, unmetered, the right way to check behaviour before going live. 'publish' {agentId} \u2014 makes the draft LIVE immediately for every key bound to the agent: get the user's explicit approval first, and read the version back. Editing fields, policies, API keys and the request log live in the hub UI (Knowledge \u2192 Agents); keys are shown once there and never pass through this tool.",
+    inputSchema: {
+      action: external_exports.enum(["list", "get", "create", "publish", "test"]),
+      agentId: external_exports.string().max(64).optional().describe("get/publish/test: agent_id from list"),
+      name: external_exports.string().max(80).optional().describe("create: blank draft with this name"),
+      goal: external_exports.string().max(2e3).optional().describe("create: describe the agent and AI drafts it from the account content"),
+      message: external_exports.string().max(4e3).optional().describe("test: the question to ask the draft"),
+      sessionId: external_exports.string().max(128).optional().describe("test: keep follow-ups in one thread")
+    }
+  },
+  async (args) => {
+    try {
+      return knowledgeResult(await knowledgeAgents(requireConfig(), args));
+    } catch (err) {
+      return knowledgeError(err);
+    }
+  }
+);
 server.registerTool(
   "awesomate_knowledge_people",
   {
@@ -41279,6 +41577,274 @@ server.registerTool(
     }
   }
 );
+server.registerTool(
+  "awesomate_knowledge_data",
+  {
+    description: "The knowledge platform's business-data warehouse (Pro+). action 'metrics' \u2014 headline numbers for the data tab. 'datasets' \u2014 the datasets imported and their columns: read this FIRST, measures/dimensions must name real columns. 'imports' \u2014 import job statuses. 'query' {dataset, measures:[{column, agg}], plus optional dimensions/filters passed through} \u2014 answer QUANTITATIVE questions from the user's own imported business data (revenue by month, top customers); read-only, results come back as rows to present honestly. New data is imported in the hub UI, not here.",
+    inputSchema: {
+      action: external_exports.enum(["metrics", "datasets", "imports", "query"]),
+      dataset: external_exports.string().max(80).optional().describe("query: dataset name from datasets"),
+      measures: external_exports.array(external_exports.object({ column: external_exports.string().max(80), agg: external_exports.string().max(10) })).max(8).optional().describe("query: e.g. [{column:'amount', agg:'sum'}]"),
+      dimensions: external_exports.array(external_exports.string().max(80)).max(6).optional().describe("query: group-by columns"),
+      filters: external_exports.array(external_exports.record(external_exports.unknown())).max(10).optional().describe("query: filter objects, passed through"),
+      limit: external_exports.number().int().min(1).max(500).optional()
+    }
+  },
+  async ({ action, dataset, measures, dimensions, filters, limit }) => {
+    try {
+      const cfg = requireConfig();
+      if (action === "query") {
+        return knowledgeResult(
+          await hubPost(cfg, "/api/knowledge/data/query", { dataset, measures, dimensions, filters, limit })
+        );
+      }
+      return knowledgeResult(await hubGet(cfg, `/api/knowledge/data/${action}`));
+    } catch (err) {
+      return knowledgeError(err);
+    }
+  }
+);
+server.registerTool(
+  "awesomate_n8n_kpis",
+  {
+    annotations: READ_ONLY,
+    description: "Automation KPIs from the hub's monitoring: executions, error rate, avg + p95 duration, time saved, 7-day-vs-prior deltas. No workflowId \u2192 the whole instance (the headline numbers for any report). With workflowId \u2192 that workflow, plus last_error_at and clean_days. Needs the 'aggregate monitoring' privacy toggle (on by default). Pair with awesomate_n8n_errors for what is failing and awesomate_site_uptime for the hosting side.",
+    inputSchema: { workflowId: external_exports.string().max(64).optional() }
+  },
+  async ({ workflowId }) => {
+    try {
+      const cfg = requireConfig();
+      const path = workflowId ? `/api/my-n8n/workflows/${encodeURIComponent(workflowId)}/kpis` : "/api/my-n8n/kpis";
+      return textResult(await hubGet(cfg, path));
+    } catch (err) {
+      return errorResult(err);
+    }
+  }
+);
+server.registerTool(
+  "awesomate_n8n_errors",
+  {
+    annotations: READ_ONLY,
+    description: "What is broken across the WHOLE instance \u2014 error events grouped by fingerprint (category, workflow, node, occurrences, first/last seen), newest first. THE first call when the user says 'something is failing' or at the start of an n8n session (a quick 7-day sweep; stay silent when it's clean). Counts and categories only \u2014 drill into a specific failure with awesomate_n8n_executions. days defaults to 30 (max 90).",
+    inputSchema: {
+      days: external_exports.number().int().min(1).max(90).optional(),
+      limit: external_exports.number().int().min(1).max(100).optional()
+    }
+  },
+  async ({ days, limit }) => {
+    try {
+      const qs = new URLSearchParams();
+      if (days) qs.set("days", String(days));
+      if (limit) qs.set("limit", String(limit));
+      return textResult(await hubGet(requireConfig(), `/api/my-n8n/errors${qs.size ? `?${qs}` : ""}`));
+    } catch (err) {
+      return errorResult(err);
+    }
+  }
+);
+readTool(
+  "awesomate_n8n_storage",
+  "What the n8n instance's data actually weighs: execution-table bytes, whole-database size, a per-table breakdown, and the last-24h per-workflow write offenders. Use it when executions feel slow, before suggesting cleanup, and as an OPPORTUNITY signal \u2014 heavy binary/media data is a cue to suggest a purpose-built app (awesomate-app-builder) for browsing it. Integers only; content never leaves the instance.",
+  "/api/my-n8n/machine/storage"
+);
+server.registerTool(
+  "awesomate_n8n_findings",
+  {
+    annotations: READ_ONLY,
+    description: "Findings from Awesomate's automated error analyzer for THIS account (Pro/Embedded + the 'AI error analysis' privacy toggle): severity, workflow, occurrences, a plain-language clientSummary, needsClientAction (something only the user can fix \u2014 expired logins, third-party quotas), and fixReady (a reviewed fix is prepared \u2014 raise it with awesomate_support to have it applied). Read-only. An empty list on a healthy instance is the good state, not an error.",
+    inputSchema: { limit: external_exports.number().int().min(1).max(100).optional() }
+  },
+  async ({ limit }) => {
+    try {
+      const qs = limit ? `?limit=${limit}` : "";
+      return textResult(await hubGet(requireConfig(), `/api/my-n8n/machine/findings${qs}`));
+    } catch (err) {
+      return errorResult(err);
+    }
+  }
+);
+readTool(
+  "awesomate_site_uptime",
+  "Uptime for every monitored hosted site: current up/down state, 30-day availability %, incident count, downtime seconds. Served from the hub's cache \u2014 free and instant, safe to include in any report or health sweep. A site missing from the list simply is not monitored yet, not down.",
+  "/api/client-hosting/uptime"
+);
+readTool(
+  "awesomate_dns_check",
+  "Live DNS check for the account's primary domain \u2014 where it ACTUALLY resolves right now versus where Awesomate hosting expects it. The first call when 'my domain isn't working': it separates a DNS problem (user must change records at their registrar) from a hosting problem (ours).",
+  "/api/client-hosting/dns-check"
+);
+readTool(
+  "awesomate_dashboard_metrics",
+  "The account-wide dashboard aggregate in one call: executions by status, error rate, time saved, workflows total/active, chat sessions + unique users (30d), active users (7d), a 7-day daily exec/error trend, and the most recent live-workflow failure. The single best data source for a status update or weekly report; combine with awesomate_site_uptime and awesomate_knowledge_status for the full picture.",
+  "/api/client-dashboard/metrics"
+);
+readTool(
+  "awesomate_account_report",
+  "A monthly-report-shaped read of the account: what's working (workflows, executions, success rate, chat, hosted sites), what's not (error clusters, open alerts), engagement (logins, credits, webinars) and commercials. Sections are independently fault-tolerant \u2014 null means 'could not be read right now', never zero. Assemble the user-facing story from these sections in THEIR language; don't paste the raw JSON at them.",
+  "/api/client-report"
+);
+readTool(
+  "awesomate_privacy_settings",
+  "READ which privacy/consent toggles are on or off for this account \u2014 call it when a tool returns 403 consent_required so you can name the exact toggle instead of guessing. Toggles are changed ONLY by the user in the hub (Settings \u2192 Privacy, hub.awesomate.ai/settings?tab=privacy); there is deliberately no write here.",
+  "/api/client-settings/privacy"
+);
+server.registerTool(
+  "awesomate_notifications",
+  {
+    description: "The account's hub notification bell \u2014 the only channel where Awesomate pushes to the client: knowledge quota warnings (80%/100%), 'your quote is ready', support-access events. action 'list' {limit?} \u2192 notifications + unread count (surface unread ones once per session, in one line). 'read' {id} / 'read_all' \u2192 mark seen after you've relayed them. Not for sending anything.",
+    inputSchema: {
+      action: external_exports.enum(["list", "read", "read_all"]),
+      id: external_exports.number().int().positive().optional().describe("read: the notification id"),
+      limit: external_exports.number().int().min(1).max(100).optional().describe("list: default 30")
+    }
+  },
+  async ({ action, id, limit }) => {
+    try {
+      const cfg = requireConfig();
+      if (action === "list") {
+        const qs = limit ? `?limit=${limit}` : "";
+        return textResult(await hubGet(cfg, `/api/notifications${qs}`));
+      }
+      if (action === "read") {
+        if (!id) return errorResult(new Error("action 'read' needs id"));
+        return textResult(await hubPost(cfg, `/api/notifications/${id}/read`));
+      }
+      return textResult(await hubPost(cfg, "/api/notifications/read-all"));
+    } catch (err) {
+      return errorResult(err);
+    }
+  }
+);
+server.registerTool(
+  "awesomate_wp_post",
+  {
+    description: "Create, update or read a WordPress post/page on the user's own Awesomate-hosted site \u2014 titles and content with spaces/HTML are fine (unlike awesomate_run_wp_cli). 'create' {domain, title, content?, status?, postType?: post|page, excerpt?, slug?} \u2014 lands as a DRAFT unless status:'publish' is explicit; never publish content the user hasn't seen or approved. 'update' {domain, postId, any of title/content/excerpt/slug/status}. 'get' {domain, postId, includeContent?}. Writes need Support Plus+ and are audited; snapshot the site first (awesomate_snapshot_site) before the session's first content change on a live site. Find post ids via awesomate_run_wp_cli ['post','list'].",
+    inputSchema: {
+      action: external_exports.enum(["create", "update", "get"]),
+      domain: external_exports.string().min(3).max(253).describe("The site domain, e.g. mybusiness.awesomate.site"),
+      postId: external_exports.number().int().positive().optional().describe("update/get"),
+      postType: external_exports.enum(["post", "page"]).optional().describe("create only; default post"),
+      title: external_exports.string().max(300).optional(),
+      content: external_exports.string().max(15e4).optional().describe("HTML or plain text"),
+      excerpt: external_exports.string().max(1e3).optional(),
+      slug: external_exports.string().max(190).optional().describe("URL slug, [a-z0-9-]"),
+      status: external_exports.enum(["draft", "publish", "pending", "private"]).optional(),
+      includeContent: external_exports.boolean().optional().describe("get only")
+    }
+  },
+  async ({ action, domain, postId, postType, title, content, excerpt, slug, status, includeContent }) => {
+    try {
+      const cfg = requireConfig();
+      const dom = encodeURIComponent(domain.toLowerCase());
+      if (action === "get") {
+        if (!postId) return errorResult(new Error("action 'get' needs postId"));
+        const qs = includeContent ? "?includeContent=1" : "";
+        return textResult(await hubGet(cfg, `/api/client-hosting/sites/${dom}/posts/${postId}${qs}`));
+      }
+      return textResult(
+        await hubPost(cfg, `/api/client-hosting/sites/${dom}/posts`, {
+          action,
+          postId,
+          postType,
+          title,
+          content,
+          excerpt,
+          slug,
+          status
+        })
+      );
+    } catch (err) {
+      return errorResult(err);
+    }
+  }
+);
+server.registerTool(
+  "awesomate_wp_media_import",
+  {
+    description: "Import ONE media item into the user's WordPress media library by https URL (Support Plus+, audited). Returns the attachmentId to reference from posts. URLs only \u2014 this cannot read local files; for a local file, upload it somewhere reachable first or use wp-admin. Ask before importing anything the user didn't explicitly provide.",
+    inputSchema: {
+      domain: external_exports.string().min(3).max(253),
+      url: external_exports.string().url().max(2048).describe("https URL of the image/file"),
+      title: external_exports.string().max(300).optional()
+    }
+  },
+  async ({ domain, url, title }) => {
+    try {
+      const dom = encodeURIComponent(domain.toLowerCase());
+      return textResult(await hubPost(requireConfig(), `/api/client-hosting/sites/${dom}/media`, { url, title }));
+    } catch (err) {
+      return errorResult(err);
+    }
+  }
+);
+server.registerPrompt(
+  "awesomate-status",
+  {
+    description: "One-screen health digest: account, automations, sites, knowledge, anything needing attention."
+  },
+  () => ({
+    messages: [
+      {
+        role: "user",
+        content: {
+          type: "text",
+          text: "Give me a one-screen Awesomate status. Call awesomate_get_context (attention block), awesomate_dashboard_metrics, awesomate_n8n_errors (7 days) and awesomate_site_uptime, then summarize in plain language: what ran, what failed (if anything), site uptime, and anything waiting on me \u2014 unread notifications, expiring token, available update. Lead with whatever needs attention; keep it short if everything is green."
+        }
+      }
+    ]
+  })
+);
+server.registerPrompt(
+  "awesomate-checkup",
+  {
+    description: "Run the full health sweep: automations, error findings, uptime, DNS, storage, SEO basics."
+  },
+  () => ({
+    messages: [
+      {
+        role: "user",
+        content: {
+          type: "text",
+          text: "Run a full Awesomate checkup and fix what you safely can. Sweep: awesomate_n8n_errors (30 days) + awesomate_n8n_kpis; awesomate_n8n_findings if my plan supports it; awesomate_site_uptime + awesomate_dns_check; awesomate_n8n_storage for anything unusually heavy; and the awesomate-seo skill's upkeep checks on my main site. Report only exceptions in my language, propose fixes before applying anything, and never publish or delete without asking."
+        }
+      }
+    ]
+  })
+);
+server.registerPrompt(
+  "awesomate-report",
+  {
+    description: "Assemble this account's business report: what worked, what broke, engagement, value delivered."
+  },
+  () => ({
+    messages: [
+      {
+        role: "user",
+        content: {
+          type: "text",
+          text: "Build my Awesomate report. Pull awesomate_account_report, awesomate_dashboard_metrics, awesomate_site_uptime and awesomate_knowledge_status (skip sections that are not available on my plan), then write it for a business owner: what my automations did for me, what needs attention, and one concrete suggestion for next month. Offer to set this up as a recurring weekly email via an n8n workflow (awesomate-n8n skill, recurring-reports recipe)."
+        }
+      }
+    ]
+  })
+);
+server.registerPrompt(
+  "awesomate-ideas",
+  {
+    description: "Grounded automation ideas from what this account actually has \u2014 with what each would save."
+  },
+  () => ({
+    messages: [
+      {
+        role: "user",
+        content: {
+          type: "text",
+          text: "Suggest what I should automate next \u2014 grounded ONLY in what I actually have. Inventory first: awesomate_n8n_inspect (possibilities + credentials), awesomate_n8n_storage, awesomate_knowledge_status, and my site's content shape (awesomate_run_wp_cli post/media list counts). Then give me at most three ideas, each with: what it does, what it replaces or saves (hours per week or a subscription), and whether I can build it with you now or it's a done-for-you build (1 credit = $100). No generic ideas \u2014 every suggestion must cite something from my inventory."
+        }
+      }
+    ]
+  })
+);
 async function main() {
   try {
     config2 = loadConfig();
@@ -41286,10 +41852,34 @@ async function main() {
     configError = err instanceof Error ? err.message : String(err);
     console.error(`[awesomate-hosting-mcp] account not resolved: ${configError}`);
   }
+  if (SKILL_DRIFT && autoUpdateEnabled()) {
+    try {
+      const result = installSkills(SERVER_VERSION);
+      console.error(
+        `[awesomate-hosting-mcp] skills auto-updated to ${SERVER_VERSION} (${result.installed.length} skills${result.removedOrphans.length ? `, ${result.removedOrphans.length} orphaned files removed` : ""}) \u2014 applies next session`
+      );
+    } catch (err) {
+      console.error(
+        "[awesomate-hosting-mcp] skills auto-update failed (non-fatal):",
+        err instanceof Error ? err.message : err
+      );
+    }
+  }
   const transport = new StdioServerTransport();
   await server.connect(transport);
   console.error(`[awesomate-hosting-mcp] connected (stdio) \u2014 ${accountStamp()}`);
 }
+function autoUpdateEnabled() {
+  const env = process.env.AWESOMATE_SKILLS_AUTOUPDATE;
+  if (env === "1" || env === "true") return true;
+  if (env === "0" || env === "false") return false;
+  try {
+    const raw = JSON.parse(readFileSync3(join3(homedir3(), ".awesomate", "credentials.json"), "utf8"));
+    return raw.autoUpdateSkills === true;
+  } catch {
+    return false;
+  }
+}
 main().catch((err) => {
   console.error(
     "[awesomate-hosting-mcp] fatal:",