@awesomate/hosting-mcp 0.19.1 → 0.20.0

package/dist/index.js

@@ -11593,7 +11593,7 @@ var require_formdata = __commonJS({
     var { File: NativeFile } = __require("node:buffer");
     var nodeUtil = __require("node:util");
     var File2 = globalThis.File ?? NativeFile;
-    var FormData = class _FormData {
+    var FormData2 = class _FormData {
       constructor(form) {
         webidl.util.markAsUncloneable(this);
         if (form !== void 0) {
@@ -11695,8 +11695,8 @@ var require_formdata = __commonJS({
         return `FormData ${output.slice(output.indexOf("]") + 2)}`;
       }
     };
-    iteratorMixin("FormData", FormData, kState, "name", "value");
-    Object.defineProperties(FormData.prototype, {
+    iteratorMixin("FormData", FormData2, kState, "name", "value");
+    Object.defineProperties(FormData2.prototype, {
       append: kEnumerableProperty,
       delete: kEnumerableProperty,
       get: kEnumerableProperty,
@@ -11724,7 +11724,7 @@ var require_formdata = __commonJS({
       }
       return { name, value };
     }
-    module.exports = { FormData, makeEntry };
+    module.exports = { FormData: FormData2, makeEntry };
   }
 });
 
@@ -11994,7 +11994,7 @@ var require_body = __commonJS({
       extractMimeType,
       utf8DecodeBytes
     } = require_util3();
-    var { FormData } = require_formdata();
+    var { FormData: FormData2 } = require_formdata();
     var { kState } = require_symbols2();
     var { webidl } = require_webidl();
     var { Blob: Blob2 } = __require("node:buffer");
@@ -12214,13 +12214,13 @@ Content-Type: ${value.type || "application/octet-stream"}\r
                   if (parsed === "failure") {
                     throw new TypeError("Failed to parse body as FormData.");
                   }
-                  const fd = new FormData();
+                  const fd = new FormData2();
                   fd[kState] = parsed;
                   return fd;
                 }
                 case "application/x-www-form-urlencoded": {
                   const entries = new URLSearchParams(value.toString());
-                  const fd = new FormData();
+                  const fd = new FormData2();
                   for (const [name, value2] of entries) {
                     fd.append(name, value2);
                   }
@@ -18891,7 +18891,7 @@ var require_response = __commonJS({
     } = require_constants3();
     var { kState, kHeaders } = require_symbols2();
     var { webidl } = require_webidl();
-    var { FormData } = require_formdata();
+    var { FormData: FormData2 } = require_formdata();
     var { URLSerializer } = require_data_url();
     var { kConstruct } = require_symbols();
     var assert2 = __require("node:assert");
@@ -19204,7 +19204,7 @@ var require_response = __commonJS({
       ReadableStream
     );
     webidl.converters.FormData = webidl.interfaceConverter(
-      FormData
+      FormData2
     );
     webidl.converters.URLSearchParams = webidl.interfaceConverter(
       URLSearchParams
@@ -39897,7 +39897,7 @@ async function hubRequest(config3, method, path, jsonBody, opts = {}) {
     if (res.status === 401) {
       hint = " Your access token is invalid or expired \u2014 ask the user to open the hub Sites page (hub.awesomate.ai/sites), generate a fresh Connect prompt, and re-run the bootstrap.";
     } else if (res.status === 403 && code === "consent_required") {
-      const settingsUrl = body && typeof body === "object" && "settingsUrl" in body && typeof body.settingsUrl === "string" ? body.settingsUrl : "https://hub.awesomate.ai/settings?tab=privacy";
+      const settingsUrl = body && typeof body === "object" && "settingsUrl" in body && typeof body.settingsUrl === "string" ? body.settingsUrl : "https://hub.awesomate.ai/n8n/settings";
       hint = ` This needs a privacy toggle the user must flip themselves \u2014 send them to ${settingsUrl}, wait for them to confirm, then retry. Never suggest a plan upgrade for a consent denial.`;
     } else if (res.status === 403) {
       const missing = body && typeof body === "object" && "missingScopes" in body ? ` (missing: ${JSON.stringify(body.missingScopes)})` : "";
@@ -39924,6 +39924,56 @@ async function hubRequest(config3, method, path, jsonBody, opts = {}) {
   }
   return body;
 }
+async function hubUploadFile(config3, path, file) {
+  let blob;
+  try {
+    const { openAsBlob } = await import("node:fs");
+    if (typeof openAsBlob === "function") {
+      blob = await openAsBlob(file.localPath, { type: file.contentType });
+    } else {
+      throw new Error("openAsBlob unavailable");
+    }
+  } catch {
+    const { readFile } = await import("node:fs/promises");
+    blob = new Blob([await readFile(file.localPath)], { type: file.contentType });
+  }
+  const form = new FormData();
+  form.append("file", blob, file.filename);
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), 6e5);
+  let res;
+  try {
+    res = await (0, import_undici.fetch)(`${config3.apiBase}${path}`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${config3.pat}` },
+      body: form,
+      signal: controller.signal,
+      dispatcher: proxyDispatcher
+    });
+  } catch (err) {
+    const aborted2 = err instanceof Error && err.name === "AbortError";
+    throw new HubApiError(
+      aborted2 ? "The upload timed out after 10 minutes. Large media can exceed this \u2014 try a smaller file, or upload it in the hub at Knowledge \u2192 Sources." : `Could not reach the Awesomate hub at ${config3.apiBase} to upload. This is a connectivity issue, not an auth problem.`,
+      0,
+      null
+    );
+  } finally {
+    clearTimeout(timer);
+  }
+  const text = await res.text();
+  let body;
+  try {
+    body = text ? JSON.parse(text) : null;
+  } catch {
+    body = text;
+  }
+  if (!res.ok) {
+    const serverMsg = body && typeof body === "object" && "message" in body && typeof body.message === "string" ? body.message : body && typeof body === "object" && "error" in body && typeof body.error === "string" ? body.error : `Upload failed (${res.status})`;
+    const hint = res.status === 413 ? " The file exceeds the 100 MB limit. Split it, compress it, or upload it in the hub at Knowledge \u2192 Sources." : res.status === 402 ? " NOTHING was ingested and nothing was purchased \u2014 the ingestion allowance is exhausted. State the pack price (1 credit = $100) and let the user decide in the hub." : "";
+    throw new HubApiError(`${/[.!?]$/.test(serverMsg) ? serverMsg : `${serverMsg}.`}${hint}`, res.status, body);
+  }
+  return body;
+}
 function hubGet(config3, path) {
   return hubRequest(config3, "GET", path);
 }
@@ -40165,7 +40215,7 @@ async function knowledgeSources(config3, args) {
     if (!args.url && !args.sitemap) {
       return {
         error: "invalid_request",
-        note: "add needs url or sitemap. For a local FILE, send the user to the hub: Knowledge \u2192 Sources \u2192 Upload. Files stream there; this tool cannot carry file bytes in v1."
+        note: "add needs url or sitemap. For a local FILE on this machine, use awesomate_knowledge_upload \u2014 it reads the file off disk and streams it, so the bytes never pass through the conversation."
       };
     }
     const body = args.url ? { url: args.url } : { sitemap: args.sitemap, ...args.since ? { since: args.since } : {} };
@@ -40221,9 +40271,24 @@ function renderAnswer(meta, streamedAnswer, streamError = null) {
     locator: s.locator ?? s.section_path ?? null,
     url: s.url ?? null
   }));
+  const answer = typeof meta.answer_plain === "string" && meta.answer_plain ? meta.answer_plain : streamedAnswer;
+  if (sources.length === 0) {
+    return {
+      status: "ok",
+      grounded: false,
+      answer,
+      sources: [],
+      not_in_verified_content: true,
+      configured_fallback: fallback,
+      ...typeof meta.score === "number" ? { score: meta.score } : {},
+      ...session,
+      note: "UNGROUNDED: the platform returned ok but ZERO sources, which means this answer came from the model, NOT from the verified content. Do NOT present it as an answer from their knowledge base, do not quote it as fact, and do not build on it. Tell the user their content does not cover this. If they need it to refuse instead of improvising, the agent's grounding setting is not strict \u2014 a purpose-built agent (awesomate_knowledge_agents) can be scoped and set strict, and that is what should be wired to anything customer-facing."
+    };
+  }
   return {
     status: "ok",
-    answer: typeof meta.answer_plain === "string" && meta.answer_plain ? meta.answer_plain : streamedAnswer,
+    grounded: true,
+    answer,
     sources,
     ...typeof meta.score === "number" ? { score: meta.score } : {},
     ...session,
@@ -40574,6 +40639,36 @@ var SKILL_DRIFT = (() => {
   if (!info.updateAvailable) return null;
   return `${info.installedSkillVersion ?? "unversioned"} \u2192 ${SERVER_VERSION}`;
 })();
+function restartGuidance() {
+  const entry = (process.env.CLAUDE_CODE_ENTRYPOINT ?? "").toLowerCase();
+  const inVsCode = entry.includes("vscode") || Boolean(process.env.VSCODE_IPC_HOOK || process.env.VSCODE_PID);
+  if (inVsCode) {
+    return {
+      surface: "vscode",
+      instruction: 'Open the Command Palette (Cmd+Shift+P on macOS, Ctrl+Shift+P on Windows/Linux) and run "Developer: Reload Window".',
+      certain: true
+    };
+  }
+  if (entry.includes("desktop") || entry.includes("app")) {
+    return {
+      surface: "desktop-app",
+      instruction: "Quit the Claude app completely and open it again, then reopen this project.",
+      certain: true
+    };
+  }
+  if (entry === "cli" || entry.includes("cli")) {
+    return {
+      surface: "terminal",
+      instruction: "Type `exit` (or press Ctrl+C twice) to leave Claude Code, then run `claude` again.",
+      certain: true
+    };
+  }
+  return {
+    surface: entry || "unknown",
+    instruction: "Start a fresh Claude Code session \u2014 however you normally start one (close this session and open a new one). Ask the user how they run Claude Code rather than guessing.",
+    certain: false
+  };
+}
 var SERVER_INSTRUCTIONS = [
   "Awesomate connects this account's WordPress hosting, n8n automations, apps and Knowledge Base to Claude.",
   "Entry point: call awesomate_get_context once per session FIRST \u2014 it returns the account, plan, limits, an `attention` digest (unread notifications, erroring workflows, token expiry) and skill freshness. The domain contexts (awesomate_n8n_context, awesomate_app_context, awesomate_knowledge_status) come after it, only for their domain.",
@@ -40917,12 +41012,18 @@ server.registerTool(
         ...result,
         changed: changed.map((u) => `${u.name}: ${u.from ?? "unversioned"} \u2192 ${u.to}`),
         whatsNew: changelogSince(changed[0]?.from ?? null).flatMap((e) => e.highlights),
-        restart: {
-          note: "Updated skill files load in the next Claude Code session \u2014 one restart lands both the skills and the (self-updating) server.",
-          terminal: "Type exit (or press Ctrl+C twice), then run `claude` again.",
-          vscode: 'Command Palette (Cmd/Ctrl+Shift+P) \u2192 "Developer: Reload Window".',
-          verify: "After restarting, awesomate_get_context should report skill.updateAvailable: false."
-        }
+        restart: (() => {
+          const g = restartGuidance();
+          return {
+            note: "Updated skill files load in the next Claude Code session \u2014 one restart lands both the skills and the (self-updating) server.",
+            // Detected from this session's own environment. Give the user THIS
+            // instruction only — do not read out a list of surfaces.
+            detectedSurface: g.surface,
+            instruction: g.instruction,
+            ...g.certain ? {} : { note2: "Surface could not be detected \u2014 ask the user how they run Claude Code instead of guessing steps." },
+            verify: "After restarting, awesomate_get_context should report skill.updateAvailable: false."
+          };
+        })()
       });
     } catch (err) {
       return errorResult(err);
@@ -41015,7 +41116,7 @@ server.registerTool(
 server.registerTool(
   "awesomate_run_wp_cli",
   {
-    description: "Run an allowlisted WP-CLI command on one of the user's WordPress sites (plugin/theme list+activate+update, cache flush, option get/update, post/media/menu/comment/user list). Installs accept wp.org SLUGS only \u2014 never URLs. args is the command as an array, e.g. ['plugin','list'] or ['plugin','install','wordpress-seo','--activate']. A 400 wp_cli_not_allowed means that command isn't permitted; a 502 wp_cli_unavailable is a temporary server-side issue, not your command.",
+    description: "Run an allowlisted WP-CLI command on one of the user's WordPress sites (plugin/theme list+activate+update, cache flush, option get/update, post/media/menu/comment/user list). ARGUMENTS CANNOT CONTAIN SPACES (letters, digits and -_./=:@+, only) \u2014 so a site title, tagline or any multi-word value is impossible here: use awesomate_wp_settings for those, and awesomate_wp_post for post/page content. Installs accept wp.org SLUGS only \u2014 never URLs. args is the command as an array, e.g. ['plugin','list'] or ['plugin','install','wordpress-seo','--activate']. A 400 wp_cli_not_allowed means that command isn't permitted; a 502 wp_cli_unavailable is a temporary server-side issue, not your command.",
     inputSchema: {
       domain: external_exports.string().describe("The site domain"),
       args: external_exports.array(external_exports.string()).describe("WP-CLI args, e.g. ['plugin','list']")
@@ -41302,7 +41403,6 @@ server.registerTool(
 server.registerTool(
   "awesomate_app_deploy_info",
   {
-    annotations: READ_ONLY,
     description: "READ-ONLY deploy briefing \u2014 this never deploys anything (deploys happen via git push). Reports how to deploy an app, its per-env targets, last-deploy/health state, and how to promote (dev\u2192staging\u2192main) or roll back (git revert + push). Node apps deploy via git push (dev/staging/main \u2192 GitHub Actions \u2192 cPanel). Use the awesomate-github skill to wire push-to-deploy the first time.",
     inputSchema: { appId: external_exports.number().int().positive().describe("The app id") }
   },
@@ -41431,7 +41531,7 @@ server.registerTool(
 server.registerTool(
   "awesomate_knowledge_sources",
   {
-    description: "The knowledge base's content sources. action 'list' \u2014 ONE page of sources, most recently ingested first (default 50, max 200 via limit): read `page.has_more`/`next_cursor` and pass cursor to continue \u2014 a page is never the whole library. 'summary' \u2014 exact whole-library counts {total, by_kind, chunks, indexed_chunks, failed_sources}: use THIS to say what the knowledge base contains. 'jobs' \u2014 ingest job statuses (optional status filter: queued|running|succeeded|failed). 'add' \u2014 ingest a public page {url} or a whole site {sitemap, since?}; ALWAYS get explicit approval first (ingest costs money and counts against quota), and for local FILES send the user to the hub's Knowledge \u2192 Sources upload page \u2014 this tool cannot carry file bytes. A pack_required response means the allowance is exhausted: NOTHING was purchased \u2014 present the pack price (1 credit = $100) and let the user buy from the hub if they want it. 'remove' {sourceId} \u2014 deletes the source AND its indexed content; explicit approval required.",
+    description: "The knowledge base's content sources. action 'list' \u2014 ONE page of sources, most recently ingested first (default 50, max 200 via limit): read `page.has_more`/`next_cursor` and pass cursor to continue \u2014 a page is never the whole library. 'summary' \u2014 exact whole-library counts {total, by_kind, chunks, indexed_chunks, failed_sources}: use THIS to say what the knowledge base contains. 'jobs' \u2014 ingest job statuses (optional status filter: queued|running|succeeded|failed). 'add' \u2014 ingest a public page {url} or a whole site {sitemap, since?}; ALWAYS get explicit approval first (ingest costs money and counts against quota), for a local FILE on the user's machine use awesomate_knowledge_upload instead (it streams the file from disk; this tool takes URLs only). A pack_required response means the allowance is exhausted: NOTHING was purchased \u2014 present the pack price (1 credit = $100) and let the user buy from the hub if they want it. 'remove' {sourceId} \u2014 deletes the source AND its indexed content; explicit approval required.",
     inputSchema: {
       action: external_exports.enum(["list", "summary", "add", "remove", "jobs"]),
       url: external_exports.string().url().optional().describe("add: one public page / blog post / YouTube link"),
@@ -41457,7 +41557,7 @@ server.registerTool(
   "awesomate_knowledge_search",
   {
     annotations: READ_ONLY,
-    description: "Instant search over the knowledge library with live facet counts: the fastest way to see WHAT is in there and to find the exact video moment, book page, dataset or web section. Returns hits (title, kind, locator like t=612-640 or p.42, snippet with **matched words**, score) plus facets {kind, year, category, author, people, places, topics} whose counts describe the current filters: repeat a facet value to OR within it, combine facets to AND. include_media adds presigned url/poster_url to hits: they expire in minutes, use immediately, never store. Keyword-only and free (no answer quota); for a verified ANSWER use awesomate_knowledge_ask, optionally with the same filters.",
+    description: "Instant search over the knowledge library with live facet counts: the fastest way to see WHAT is in there and to find the exact video moment, book page, dataset or web section. Returns hits (title, kind, locator like t=612-640 or p.42, snippet with **matched words**, score) plus facets {kind, year, category, author, people, places, topics} whose counts describe the current filters: repeat a facet value to OR within it, combine facets to AND. include_media adds presigned url/poster_url to hits: they expire in minutes, use immediately, never store. Keyword-only and free (no answer quota); for a verified ANSWER use awesomate_knowledge_ask, optionally with the same filters. Citations from awesomate_knowledge_ask carry NO media URLs \u2014 when a cited source is an image/video and the user wants to SEE it, re-query here with include_media (ideally filtered by its doc id). The returned url/poster_url expire in minutes: fine to show in chat, never safe to embed in a page \u2014 see the awesomate-knowledge skill's showing-media.md.",
     inputSchema: {
       q: external_exports.string().max(2e3).optional().describe("Search words; empty lists the library filtered by the facets"),
       kind: external_exports.enum(["book", "document", "web", "image", "video", "audio", "post", "dataset"]).optional(),
@@ -41656,7 +41756,7 @@ server.registerTool(
   "awesomate_n8n_findings",
   {
     annotations: READ_ONLY,
-    description: "Findings from Awesomate's automated error analyzer for THIS account (Pro/Embedded + the 'AI error analysis' privacy toggle): severity, workflow, occurrences, a plain-language clientSummary, needsClientAction (something only the user can fix \u2014 expired logins, third-party quotas), and fixReady (a reviewed fix is prepared \u2014 raise it with awesomate_support to have it applied). Read-only. An empty list on a healthy instance is the good state, not an error.",
+    description: "Findings from Awesomate's automated error analyzer for THIS account (Pro/Embedded + the 'Enable AI Error Diagnosis' privacy toggle (n8n \u2192 Settings \u2192 Privacy)): severity, workflow, occurrences, a plain-language clientSummary, needsClientAction (something only the user can fix \u2014 expired logins, third-party quotas), and fixReady (a reviewed fix is prepared \u2014 raise it with awesomate_support to have it applied). Read-only. An empty list on a healthy instance is the good state, not an error.",
     inputSchema: { limit: external_exports.number().int().min(1).max(100).optional() }
   },
   async ({ limit }) => {
@@ -41690,7 +41790,7 @@ readTool(
 );
 readTool(
   "awesomate_privacy_settings",
-  "READ which privacy/consent toggles are on or off for this account \u2014 call it when a tool returns 403 consent_required so you can name the exact toggle instead of guessing. Toggles are changed ONLY by the user in the hub (Settings \u2192 Privacy, hub.awesomate.ai/settings?tab=privacy); there is deliberately no write here.",
+  "READ which privacy/consent toggles are on or off for this account \u2014 call it when a tool returns 403 consent_required so you can name the exact toggle instead of guessing. Toggles are changed ONLY by the user in the hub (n8n \u2192 Settings \u2192 Privacy, hub.awesomate.ai/n8n/settings); there is deliberately no write here.",
   "/api/client-settings/privacy"
 );
 server.registerTool(
@@ -41782,6 +41882,116 @@ server.registerTool(
     }
   }
 );
+server.registerTool(
+  "awesomate_wp_settings",
+  {
+    description: `Change a WordPress site's core settings \u2014 THE tool for "change my site title" / tagline. Use this, never awesomate_run_wp_cli, for any value containing spaces: that tool's argument gate rejects spaces outright, so \`option update blogname "My Business Name"\` cannot work there. Fields (send only what you're changing): title, tagline, timezone (IANA, e.g. Australia/Sydney), dateFormat, timeFormat, postsPerPage (1-100), searchEngineVisible (false hides the site from search engines \u2014 confirm before setting it). Support Plus+ and audited; flushes the object cache so the change shows. Snapshot first with awesomate_snapshot_site if this is the session's first change to a live site.`,
+    inputSchema: {
+      domain: external_exports.string().min(3).max(253).describe("The site domain, e.g. mybusiness.awesomate.site"),
+      title: external_exports.string().min(1).max(200).optional().describe("Site title (blogname)"),
+      tagline: external_exports.string().max(300).optional().describe("Tagline (blogdescription)"),
+      timezone: external_exports.string().max(64).optional(),
+      dateFormat: external_exports.string().max(40).optional(),
+      timeFormat: external_exports.string().max(40).optional(),
+      postsPerPage: external_exports.number().int().min(1).max(100).optional(),
+      searchEngineVisible: external_exports.boolean().optional()
+    }
+  },
+  async ({ domain, ...fields }) => {
+    try {
+      const dom = encodeURIComponent(domain.toLowerCase());
+      const payload = Object.fromEntries(Object.entries(fields).filter(([, v]) => v !== void 0));
+      return textResult(await hubPatch(requireConfig(), `/api/client-hosting/sites/${dom}/settings`, payload));
+    } catch (err) {
+      return errorResult(err);
+    }
+  }
+);
+var KB_UPLOAD_TYPES = {
+  ".pdf": "application/pdf",
+  ".doc": "application/msword",
+  ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  ".ppt": "application/vnd.ms-powerpoint",
+  ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  ".xls": "application/vnd.ms-excel",
+  ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  ".csv": "text/csv",
+  ".txt": "text/plain",
+  ".md": "text/markdown",
+  ".rtf": "application/rtf",
+  ".html": "text/html",
+  ".htm": "text/html",
+  ".json": "application/json",
+  ".epub": "application/epub+zip",
+  ".mp3": "audio/mpeg",
+  ".m4a": "audio/mp4",
+  ".wav": "audio/wav",
+  ".mp4": "video/mp4",
+  ".mov": "video/quicktime",
+  ".m4v": "video/x-m4v",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".webp": "image/webp"
+};
+var KB_MAX_UPLOAD_BYTES = 100 * 1024 * 1024;
+server.registerTool(
+  "awesomate_knowledge_upload",
+  {
+    description: "Ingest ONE file from the user's own computer into their Knowledge Base (Pro+). Pass a LOCAL PATH \u2014 this server runs on their machine and streams the file to the hub itself, so the file contents never pass through the conversation. Handles documents (pdf, docx, pptx, xlsx, csv, txt, md, epub), audio and video (transcribed), and images. Max 100 MB per file; bigger media goes through the hub's Knowledge \u2192 Sources page. INGESTING COSTS MONEY and counts against the monthly allowance, so ALWAYS get explicit approval for the specific file(s) first and say what it will consume. For several files, call once per file and report progress \u2014 do not loop silently. Returns a job; poll awesomate_knowledge_sources {action:'jobs'} until it succeeds, then probe the content with awesomate_knowledge_ask before building anything on it. A pack_required response means the allowance is exhausted: nothing was ingested and nothing was purchased.",
+    inputSchema: {
+      path: external_exports.string().min(1).max(4096).describe("Path to the file on the user's machine (~ is expanded)"),
+      title: external_exports.string().max(300).optional().describe("Display title; defaults to the filename")
+    }
+  },
+  async ({ path: rawPath, title }) => {
+    try {
+      const { statSync, existsSync: existsSync3 } = await import("node:fs");
+      const { resolve: resolve2, basename, extname } = await import("node:path");
+      const expanded = rawPath.startsWith("~") ? join3(homedir3(), rawPath.slice(1).replace(/^[/\\]/, "")) : rawPath;
+      const abs = resolve2(expanded);
+      if (!existsSync3(abs)) {
+        return errorResult(
+          new Error(
+            `No file at ${abs}. Check the path with the user \u2014 a path that works in their shell may differ from this server's working directory, so prefer an absolute path.`
+          )
+        );
+      }
+      const st = statSync(abs);
+      if (st.isDirectory()) {
+        return errorResult(
+          new Error(
+            `${abs} is a folder, not a file. This tool takes one file at a time \u2014 list the folder, agree with the user which files to ingest, then call once per file.`
+          )
+        );
+      }
+      if (!st.isFile()) return errorResult(new Error(`${abs} is not a regular file.`));
+      if (st.size === 0) return errorResult(new Error(`${abs} is empty \u2014 nothing to ingest.`));
+      if (st.size > KB_MAX_UPLOAD_BYTES) {
+        return errorResult(
+          new Error(
+            `${basename(abs)} is ${(st.size / 1024 / 1024).toFixed(1)} MB, over the 100 MB limit. Split or compress it, or have the user upload it in the hub at Knowledge \u2192 Sources.`
+          )
+        );
+      }
+      const ext = extname(abs).toLowerCase();
+      const contentType = KB_UPLOAD_TYPES[ext] ?? "application/octet-stream";
+      const filename = title?.trim() ? `${title.trim()}${ext}` : basename(abs);
+      const result = await hubUploadFile(requireConfig(), "/api/knowledge/sources", {
+        localPath: abs,
+        filename,
+        contentType
+      });
+      return knowledgeResult({
+        ...result,
+        uploaded: { path: abs, filename, sizeBytes: st.size, contentType },
+        note: `Queued \u2014 NOT yet ingested. Poll awesomate_knowledge_sources {action:"jobs"} and read the job's status AND error: a job that fails during processing creates no source row, so summary/failed_sources still look clean and the failure is invisible there. Big media is transcribed and can take a while. Only after the job reports succeeded, verify with awesomate_knowledge_ask before building on it.`
+      });
+    } catch (err) {
+      return knowledgeError(err);
+    }
+  }
+);
 server.registerPrompt(
   "awesomate-status",
   {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awesomate/hosting-mcp",
-  "version": "0.19.1",
+  "version": "0.20.0",
   "description": "Awesomate MCP server — lets Claude manage your Awesomate WordPress hosting, plan, limits, n8n automations, and build Node/static apps + databases",
   "license": "UNLICENSED",
   "type": "module",
@@ -19,7 +19,7 @@
   "scripts": {
     "build": "esbuild src/index.ts --bundle --platform=node --target=node18 --format=esm --outfile=dist/index.js --banner:js='#!/usr/bin/env node\nimport { createRequire as __awmCreateRequire } from \"node:module\"; const require = __awmCreateRequire(import.meta.url);' --external:node:*",
     "typecheck": "tsc --noEmit",
-    "test": "npm run build && esbuild src/config.ts --bundle --platform=node --target=node18 --format=esm --outfile=test/.build/config.mjs --external:node:* && esbuild src/knowledge.ts --bundle --platform=node --target=node18 --format=esm --outfile=test/.build/knowledge.mjs --banner:js='import { createRequire as __awmCreateRequire } from \"node:module\"; const require = __awmCreateRequire(import.meta.url);' --external:node:* && esbuild src/skills.ts --bundle --platform=node --target=node18 --format=esm --outfile=test/.build/skills.mjs --external:node:* && node --test test/*.test.mjs",
+    "test": "npm run build && esbuild src/config.ts --bundle --platform=node --target=node18 --format=esm --outfile=test/.build/config.mjs --external:node:* && esbuild src/knowledge.ts --bundle --platform=node --target=node18 --format=esm --outfile=test/.build/knowledge.mjs --banner:js='import { createRequire as __awmCreateRequire } from \"node:module\"; const require = __awmCreateRequire(import.meta.url);' --external:node:* && esbuild src/skills.ts --bundle --platform=node --target=node18 --format=esm --outfile=test/.build/skills.mjs --external:node:* && esbuild src/http.ts --bundle --platform=node --target=node18 --format=esm --outfile=test/.build/http.mjs --banner:js='import { createRequire as __awmCreateRequire } from \"node:module\"; const require = __awmCreateRequire(import.meta.url);' --external:node:* && node --test test/*.test.mjs",
     "prepublishOnly": "npm run typecheck && npm run test"
   },
   "dependencies": {

package/skill/CHANGELOG.json

@@ -1,5 +1,19 @@
 {
   "versions": [
+    {
+      "version": "0.20.0",
+      "highlights": [
+        "Add your own documents, audio and video to your Knowledge Base straight from your computer - just point Claude at the files",
+        "Claude can take you all the way from your files to a tested chat agent live on your website"
+      ]
+    },
+    {
+      "version": "0.19.2",
+      "highlights": [
+        "Change your site title or tagline just by asking - multi-word names now work",
+        "Claude tells you how to restart in the way that matches how you actually run it, instead of listing every option"
+      ]
+    },
     {
       "version": "0.19.1",
       "highlights": [
@@ -20,13 +34,13 @@
       "highlights": [
         "Search your knowledge base with filters and ask questions within a slice of your content",
         "People & entities: your knowledge base now recognises who appears in your content, and you can name and merge them",
-        "Build AI agents from your own content \u2014 drafted, tested privately, and published only when you approve"
+        "Build AI agents from your own content — drafted, tested privately, and published only when you approve"
       ]
     },
     {
       "version": "0.14.0",
       "highlights": [
-        "Tools built for business owners, not developers \u2014 plain-language answers about your account, plan and limits",
+        "Tools built for business owners, not developers — plain-language answers about your account, plan and limits",
         "New support skill: get help, understand credits, or request a done-for-you build without leaving Claude",
         "New database skill: Claude picks the right place to keep your data and sets it up for you"
       ]

package/skill/awesomate-app-builder/SKILL.md

@@ -45,7 +45,24 @@ decision brain. The short version, matched to what they say:
 - **Landing page / capture leads / one-pager / "just needs to look good and
   be found"** → **static site** (`kind: 'static'`). Fastest possible load,
   no database. This is the right default for marketing pages — don't reach for
-  a full app.
+  a full app. Know what you give up, and check it against the job BEFORE
+  creating, because the stack can't be changed afterwards:
+  - **No server-side environment.** `awesomate_app_set_env` returns 400 for
+    a static app — there is nowhere to put a secret. Anything the page must
+    keep private (an API key, a webhook URL you don't want public) rules
+    static out.
+  - **`awesomate_n8n_attach_to_app` is Node-only.** So the "form posts to
+    their n8n" pattern needs a Node app, unless the webhook URL being public
+    is genuinely acceptable.
+  - **No separate dev site.** All three environment URLs point at the same
+    single subdomain — there's no dev copy to review on, so every change is
+    live the moment it's published.
+  - **No deploy workflow.** The static template is just the page files, so
+    pushing to GitHub does not publish it (see the awesomate-github skill's
+    §2 — deploy wiring needs Awesomate support).
+
+  If the page needs a webhook URL, a secret, or a place to test before it
+  goes live, it's a **Node app**. Say that in one line and move on.
 - **App with logins / custom logic / a dashboard / an API** → **Node app**
   (`kind: 'node'`). Pick **postgres** when the data is relational / needs
   concurrency / JSON / analytics; **mysql** for simple cases.
@@ -58,7 +75,14 @@ If the app needs to **send an email, look something up in their apps (Sheets,
 CRM, a database), or use AI** — their **own n8n** is often the fastest path,
 because their credentials are already connected there. Check the credential
 inventory (`awesomate_n8n_inspect {what:'credentials'}`) and say e.g. *"you already
-have Gmail connected in n8n — want the form to email you through that?"* Use
+have Gmail connected in n8n — want the form to email you through that?"*
+That read is **consent-gated**: it needs the **"Allow Claude Code to Build
+n8n Workflows"** toggle (n8n → Settings → Privacy,
+hub.awesomate.ai/n8n/settings; also on hub.awesomate.ai/n8n/settings),
+which is **off by default** — so on a fresh account it comes back 403
+`consent_required`. That's not a failure to work around: call
+`awesomate_privacy_settings` to name the exact toggle, ask the user to flip
+it, re-check, and meanwhile design as if you don't know what's connected. Use
 the **awesomate-n8n** skill to build the workflow, then store its webhook URL
 in the app (see the awesomate-credentials skill) and call it from the app.
 Don't reach for n8n for pure in-app logic with no external app/credential — a
@@ -108,6 +132,29 @@ target; never touch prod without an explicit ask.**
    by policy), then `awesomate_app_health` to confirm it came up (Node:
    `/api/ready`). Show the user the live dev URL and let them try it. Iterate
    on dev until they're happy.
+   **That dev address is Node-only.** A static app has ONE address —
+   `{app}.{slug}.awesomate.app` — and `awesomate_app_get` reports it for dev,
+   staging and prod alike. There is no separate copy to review on, so with a
+   static site "post it to dev first" isn't an option you can honestly offer:
+   say the change goes live, and get the yes before publishing. Read the real
+   addresses from `awesomate_app_get` rather than constructing them — an
+   account without the branded domains falls back to subdomains of its own
+   primary domain (`dev-{app}.{domain}`).
+   **Publishing to their WordPress site** (as opposed to an app) has its own
+   tools, and `awesomate_run_wp_cli` is the wrong one for content: its
+   argument gate rejects spaces outright, so a title or tagline can't go
+   through it.
+   - `awesomate_wp_post` — create/update/read a post or page, with real
+     titles and HTML. It lands as a **DRAFT** unless you explicitly pass
+     `status:'publish'`; never publish something the user hasn't read.
+   - `awesomate_wp_media_import` — pull one image in by https URL (it cannot
+     read local files) and get back an `attachmentId` to reference.
+   - `awesomate_wp_settings` — site title, tagline, timezone, date/time
+     format, posts per page, search-engine visibility.
+
+   Snapshot the site (`awesomate_snapshot_site`) before the session's first
+   change to a live WordPress site.
+
 7. **Wrap-up / promote** — only when the user approves, promote **dev → staging
    → main** (merge + push per branch). `awesomate_app_deploy_info` reports the
    branch→env map + last-deploy state (it never deploys — `git push` does). Prod is `main`. **Before merging to
@@ -141,7 +188,10 @@ app with a UI, an n8n data table (awesomate-n8n skill) beats building an app
 - A `409` with code `app_limit` = the plan's app allowance is full (Support
   Plus 5, Pro 20 — `awesomate_app_context.limits` has the live numbers).
   Don't retry; tell the user and surface the `recommendedPlan`/`deepLink`
-  from the error. Deleting an unused app also frees a slot.
+  from the error. **There is no delete-app tool or route** — don't offer
+  "delete an old one to free a slot", because neither you nor the user can.
+  The honest options are an upgrade or asking support (awesomate-support
+  skill) to remove an app.
 - Never invent that a capability exists — read `awesomate_app_context` first.
 - Never print a secret or commit a `.env` (the credentials + github skills
   enforce this).

package/skill/awesomate-app-builder/references/stack-decision.md

@@ -10,7 +10,22 @@ confirm before building. **Never default to WordPress.**
 |---|---|---|
 | "I already have a WordPress site" / a blog / publishes content regularly / **wants to rank on Google & AI** | **WordPress** | Best CMS for indexable content, sitemaps, schema. Hand to the awesomate-hosting skill to provision, then run **awesomate-seo**. Existing WP elsewhere → migrate it, don't rebuild: [wp-migrate.md](wp-migrate.md) (also covers WP ↔ app coexistence on subdomains). |
 | Sell products / online shop | **WordPress + WooCommerce** | Provision via the awesomate-hosting skill, install WooCommerce over WP-CLI, then run **awesomate-seo** (product pages need `Product` JSON-LD + real product data). |
-| A landing page / capture leads / a one-pager / "just needs to look good and be found" | **static site** (`kind: 'static'`) | Served straight from the cPanel docroot — no database, no server process, fastest load. Add SEO + a lead form (below). The right default for marketing pages. |
+| A landing page / capture leads / a one-pager / "just needs to look good and be found" | **static site** (`kind: 'static'`) | Served straight from the cPanel docroot — no database, no server process, fastest load. Add SEO + a lead form (below). The right default for marketing pages — but see the three limits under the table before you commit to it. |
+
+**What a static site cannot do** (the stack can't be changed later, so check
+this against the job first):
+
+- **No server-side environment.** `awesomate_app_set_env` returns 400 for a
+  static app. Anything the page must keep secret has nowhere to live — it
+  would be in the page source, readable by anyone.
+- **`awesomate_n8n_attach_to_app` is Node-only.** A static lead form can only
+  POST to an n8n webhook URL that is **hardcoded in the page and therefore
+  public**. Sometimes that's acceptable (a plain lead capture behind n8n-side
+  validation); when it isn't, it's a Node app.
+- **No separate dev site.** All three environment URLs are the same single
+  subdomain, so there's nowhere to review a change before it's live.
+- **No deploy workflow.** The static template is just the page files —
+  pushing to GitHub does not publish it (awesomate-github §2).
 | A tool/app with **logins, custom logic, a dashboard, or an API** | **Node app** (`kind: 'node'`) | A real backend + database. |
 
 ### Within a Node app: which starter template?
@@ -47,18 +62,30 @@ If the ask includes **email someone, look something up in their apps, save a
 lead somewhere, or use AI**, that's usually a job for their **own n8n** — their
 credentials are already connected there, so there's nothing new to set up.
 
-- Check `GET /api/my-n8n/machine/credentials` (names/types only) and offer what
-  they already have: *"You've got Gmail + Google Sheets connected — want the
-  form to email you and add the lead to a sheet?"*
+- Check what's connected with `awesomate_n8n_inspect {what:'credentials'}`
+  (names/types only) and offer what they already have: *"You've got Gmail +
+  Google Sheets connected — want the form to email you and add the lead to a
+  sheet?"* That read needs the **"Allow Claude Code to Build n8n Workflows"**
+  privacy toggle, which is off by default — a 403 `consent_required` means
+  call `awesomate_privacy_settings`, name the toggle, and ask the user to flip
+  it at hub.awesomate.ai/n8n/settings.
 - Build the workflow with the **awesomate-n8n** skill (webhook trigger →
-  action), take its **webhook URL**, and store it in the app as
-  `N8N_WEBHOOK_URL` via the **awesomate-credentials** skill. The static
-  template's lead form and the Node template's `src/lib/n8n.ts` both POST there.
+  action), take its **webhook URL**, and wire it into the app.
+  - **Node app:** `awesomate_n8n_attach_to_app` — it stores
+    `N8N_WEBHOOK_URL` plus a generated `N8N_WEBHOOK_SECRET` (encrypted +
+    injected) and returns the secret so you can add the matching
+    `X-Awesomate-Webhook-Secret` check on the n8n side. `src/lib/n8n.ts`
+    POSTs there.
+  - **Static site:** there is no app environment, so the URL sits in the page
+    source, public. Tell the user that plainly, and defend the workflow on the
+    n8n side instead (validation, rate limiting) — or use a Node app.
 - Skip n8n for pure in-app logic with no external app/credential/AI — a webhook
   round-trip just adds latency and a failure point.
 
 ## Always, for any public site
 Offer **awesomate-seo** (meta/OG tags, `sitemap.xml`, `robots.txt`, JSON-LD, a
 general `llms.txt`) so it's findable by search engines *and* AI assistants — and
-**awesomate-github** so their work is version-controlled and deploys on push
-from day one.
+**awesomate-github** so their work is version-controlled from day one.
+Push-to-deploy is a second step and not one you can finish alone: the Actions
+workflow needs SSH repo secrets no client-side tool returns, so set up the repo
+and hand the deploy wiring to Awesomate support (awesomate-github §2).

package/skill/awesomate-app-builder/references/wp-migrate.md

@@ -26,8 +26,10 @@ until you're happy."*
    installed on the new site.
 4. **Verify before DNS.** Browse the copy on its Awesomate URL: pages,
    images, forms, admin login, HTTPS. Run **awesomate-seo** (sitemap,
-   robots, meta) and offer the **wp-security-review** skill — a migrated
-   site imports its old plugins, and stale plugins are the top WP risk.
+   robots, meta). A migrated site brings its old plugins with it and stale
+   plugins are the top WP risk, so check for outdated ones
+   (`awesomate_run_wp_cli ['plugin','list']`), update what's safe to update,
+   and flag anything abandoned to the user.
 5. **Cut over DNS** — point the domain at Awesomate (add it as a custom
    domain first; plan limits apply). Old site stays live as the fallback
    until the user confirms; propagation can take up to a day and both