@awesomate/hosting-mcp 0.20.3 → 0.20.5

package/dist/index.js

@@ -3651,49 +3651,49 @@ var require_fast_uri = __commonJS({
       schemelessOptions.skipEscape = true;
       return serialize(resolved, schemelessOptions);
     }
-    function resolveComponent(base, relative, options, skipNormalization) {
+    function resolveComponent(base, relative2, options, skipNormalization) {
       const target = {};
       if (!skipNormalization) {
         base = parse3(serialize(base, options), options);
-        relative = parse3(serialize(relative, options), options);
+        relative2 = parse3(serialize(relative2, options), options);
       }
       options = options || {};
-      if (!options.tolerant && relative.scheme) {
-        target.scheme = relative.scheme;
-        target.userinfo = relative.userinfo;
-        target.host = relative.host;
-        target.port = relative.port;
-        target.path = removeDotSegments(relative.path || "");
-        target.query = relative.query;
+      if (!options.tolerant && relative2.scheme) {
+        target.scheme = relative2.scheme;
+        target.userinfo = relative2.userinfo;
+        target.host = relative2.host;
+        target.port = relative2.port;
+        target.path = removeDotSegments(relative2.path || "");
+        target.query = relative2.query;
       } else {
-        if (relative.userinfo !== void 0 || relative.host !== void 0 || relative.port !== void 0) {
-          target.userinfo = relative.userinfo;
-          target.host = relative.host;
-          target.port = relative.port;
-          target.path = removeDotSegments(relative.path || "");
-          target.query = relative.query;
+        if (relative2.userinfo !== void 0 || relative2.host !== void 0 || relative2.port !== void 0) {
+          target.userinfo = relative2.userinfo;
+          target.host = relative2.host;
+          target.port = relative2.port;
+          target.path = removeDotSegments(relative2.path || "");
+          target.query = relative2.query;
         } else {
-          if (!relative.path) {
+          if (!relative2.path) {
             target.path = base.path;
-            if (relative.query !== void 0) {
-              target.query = relative.query;
+            if (relative2.query !== void 0) {
+              target.query = relative2.query;
             } else {
               target.query = base.query;
             }
           } else {
-            if (relative.path[0] === "/") {
-              target.path = removeDotSegments(relative.path);
+            if (relative2.path[0] === "/") {
+              target.path = removeDotSegments(relative2.path);
             } else {
               if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) {
-                target.path = "/" + relative.path;
+                target.path = "/" + relative2.path;
               } else if (!base.path) {
-                target.path = relative.path;
+                target.path = relative2.path;
               } else {
-                target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative.path;
+                target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative2.path;
               }
               target.path = removeDotSegments(target.path);
             }
-            target.query = relative.query;
+            target.query = relative2.query;
           }
           target.userinfo = base.userinfo;
           target.host = base.host;
@@ -3701,7 +3701,7 @@ var require_fast_uri = __commonJS({
         }
         target.scheme = base.scheme;
       }
-      target.fragment = relative.fragment;
+      target.fragment = relative2.fragment;
       return target;
     }
     function equal(uriA, uriB, options) {
@@ -39994,7 +39994,7 @@ function hubDelete(config3, path, jsonBody) {
 // src/skills.ts
 import { cpSync, existsSync as existsSync2, readdirSync, readFileSync as readFileSync2, rmSync, writeFileSync } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { join as join2, dirname as dirname2 } from "node:path";
+import { join as join2, dirname as dirname2, relative, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 var PACKAGE_ROOT = join2(dirname2(fileURLToPath(import.meta.url)), "..");
 var DEFAULT_SOURCE_ROOT = join2(PACKAGE_ROOT, "skill");
@@ -40015,6 +40015,9 @@ function installedSkillVersion(name) {
 function skillVersions(sourceRoot = DEFAULT_SOURCE_ROOT) {
   return bundledSkillNames(sourceRoot).map((name) => ({ name, installed: installedSkillVersion(name) }));
 }
+function isInstallable(relPath) {
+  return !relPath.split("/").includes("evals");
+}
 function walkFiles(dir, prefix = "") {
   const out = [];
   for (const entry of readdirSync(dir, { withFileTypes: true })) {
@@ -40035,9 +40038,15 @@ function installSkills(version2, sourceRoot = DEFAULT_SOURCE_ROOT) {
     if (!existsSync2(join2(src, "SKILL.md"))) continue;
     const dest = join2(destRoot, entry.name);
     const from = installedSkillVersion(entry.name);
-    cpSync(src, dest, { recursive: true });
+    cpSync(src, dest, {
+      recursive: true,
+      filter: (from2) => {
+        const rel = relative(src, from2);
+        return rel === "" || isInstallable(rel.split(sep).join("/"));
+      }
+    });
     try {
-      const shipped = new Set(walkFiles(src));
+      const shipped = new Set(walkFiles(src).filter(isInstallable));
       for (const rel of walkFiles(dest)) {
         if (rel === ".installed-version") continue;
         if (!shipped.has(rel)) {
@@ -41944,7 +41953,7 @@ var KB_UNPARSEABLE = /* @__PURE__ */ new Set([".doc", ".docx", ".ppt", ".pptx",
 server.registerTool(
   "awesomate_knowledge_upload",
   {
-    description: "Ingest ONE file from the user's own computer into their Knowledge Base (Pro+). Pass a LOCAL PATH \u2014 this server runs on their machine and streams the file to the hub itself, so the file contents never pass through the conversation. Handles documents (pdf, md, txt), business data (csv, tsv, xls, xlsx, json), audio and video (transcribed), and images. Word/PowerPoint/RTF/EPUB files are NOT parseable yet \u2014 the tool refuses them with the workaround (export to PDF, or save as .md/.txt). Max 100 MB per file; bigger media goes through the hub's Knowledge \u2192 Sources page. INGESTING COSTS MONEY and counts against the monthly allowance, so ALWAYS get explicit approval for the specific file(s) first and say what it will consume. For several files, call once per file and report progress \u2014 do not loop silently. Returns a job; poll awesomate_knowledge_sources {action:'jobs'} until it succeeds, then probe the content with awesomate_knowledge_ask before building anything on it. A pack_required response means the allowance is exhausted: nothing was ingested and nothing was purchased.",
+    description: "Ingest ONE file from the user's own computer into their Knowledge Base (Pro+). Pass a LOCAL PATH \u2014 this server runs on their machine and streams the file to the hub itself, so the file contents never pass through the conversation. Handles documents (pdf, md, txt), business data (csv, tsv, xls, xlsx, json), audio and video (transcribed), and images. Word/PowerPoint/RTF/EPUB files are NOT parseable yet \u2014 the tool refuses them with the workaround (export to PDF, or save as .md/.txt). Max 100 MB per file; bigger media goes through the hub's Knowledge \u2192 Sources page. INGESTING COSTS MONEY and counts against the monthly allowance, so ALWAYS get explicit approval for the specific file(s) first and say what it will consume. For several files, call once per file and report progress \u2014 do not loop silently. Returns a job with its live status; poll awesomate_knowledge_sources {action:'jobs'} until it succeeds (a duplicate upload replays the earlier job \u2014 a response already reading succeeded needs no polling), then probe the content with awesomate_knowledge_ask before building anything on it. A pack_required response means the allowance is exhausted: nothing was ingested and nothing was purchased.",
     inputSchema: {
       path: external_exports.string().min(1).max(4096).describe("Path to the file on the user's machine (~ is expanded)"),
       title: external_exports.string().max(300).optional().describe("Display title; defaults to the filename")
@@ -41995,10 +42004,14 @@ server.registerTool(
         filename,
         contentType
       });
+      const body = result;
+      const jobStatus = typeof body.status === "string" ? body.status : "queued";
+      const replayNote = body.replayed === true ? "This file matched an earlier upload, so the platform replayed that job instead of ingesting it twice. " : "";
+      const note = jobStatus === "succeeded" ? `${replayNote}Already ingested \u2014 the job has SUCCEEDED, do not poll for it. Verify with awesomate_knowledge_ask before building on it.` : jobStatus === "failed" || jobStatus === "cancelled" ? `${replayNote}The job reports ${jobStatus} \u2014 read its error via awesomate_knowledge_sources {action:"jobs"}. A job that fails during processing creates no source row, so summary counts stay clean (only failed_jobs_7d shows it).` : `${replayNote}${jobStatus === "running" ? "Ingesting now" : "Queued"} \u2014 NOT yet ingested. Poll awesomate_knowledge_sources {action:"jobs"} and read the job's status AND error: a job that fails during processing creates no source row, so summary counts stay clean (only its failed_jobs_7d field shows it). Big media is transcribed and can take a while. Only after the job reports succeeded, verify with awesomate_knowledge_ask before building on it.`;
       return knowledgeResult({
-        ...result,
+        ...body,
         uploaded: { path: abs, filename, sizeBytes: st.size, contentType },
-        note: `Queued \u2014 NOT yet ingested. Poll awesomate_knowledge_sources {action:"jobs"} and read the job's status AND error: a job that fails during processing creates no source row, so summary counts stay clean (only its failed_jobs_7d field shows it). Big media is transcribed and can take a while. Only after the job reports succeeded, verify with awesomate_knowledge_ask before building on it.`
+        note
       });
     } catch (err) {
       return knowledgeError(err);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awesomate/hosting-mcp",
-  "version": "0.20.3",
+  "version": "0.20.5",
   "description": "Awesomate MCP server — lets Claude manage your Awesomate WordPress hosting, plan, limits, n8n automations, and build Node/static apps + databases",
   "license": "UNLICENSED",
   "type": "module",

package/skill/CHANGELOG.json

@@ -1,5 +1,12 @@
 {
   "versions": [
+    {
+      "version": "0.20.5",
+      "highlights": [
+        "Claude can build you a real web page served straight from your n8n - a branded form, a phone camera app your team saves to their home screen, or an approval page - with no hosting to set up",
+        "Your skills folder stays clean: our internal test files are no longer copied onto your machine"
+      ]
+    },
     {
       "version": "0.20.3",
       "highlights": [
@@ -54,13 +61,13 @@
       "highlights": [
         "Search your knowledge base with filters and ask questions within a slice of your content",
         "People & entities: your knowledge base now recognises who appears in your content, and you can name and merge them",
-        "Build AI agents from your own content \u2014 drafted, tested privately, and published only when you approve"
+        "Build AI agents from your own content — drafted, tested privately, and published only when you approve"
       ]
     },
     {
       "version": "0.14.0",
       "highlights": [
-        "Tools built for business owners, not developers \u2014 plain-language answers about your account, plan and limits",
+        "Tools built for business owners, not developers — plain-language answers about your account, plan and limits",
         "New support skill: get help, understand credits, or request a done-for-you build without leaving Claude",
         "New database skill: Claude picks the right place to keep your data and sets it up for you"
       ]

package/skill/awesomate-n8n/SKILL.md

@@ -118,6 +118,7 @@ they're blocked on a restart.
 | Changing a LIVE workflow | [upgrade-loop.md](references/upgrade-loop.md) |
 | "What could I automate?" | [possibilities.md](references/possibilities.md) |
 | WordPress form → n8n | [wp-form-handler.md](references/wp-form-handler.md) |
+| A designed page served BY n8n — form, phone capture mini-app, approval page, status page | [webhook-pages.md](references/webhook-pages.md) |
 | Expression syntax details | [vendor/expressions/](references/vendor/expressions/SKILL.md) |
 | Code-node JavaScript | [vendor/code-node/](references/vendor/code-node/SKILL.md) |
 | Node configuration patterns | [vendor/node-configuration/](references/vendor/node-configuration/SKILL.md) |

package/skill/awesomate-n8n/evals/webhook-page-build/graders/grader.md

@@ -0,0 +1,36 @@
+# Grader: webhook-page-build
+
+Judge the transcript (assistant text, tool calls, tool results) against every criterion.
+Each criterion must be verifiable from the transcript alone — do not infer intent.
+Verdict: PASS only if all numbered criteria hold and no automatic fail triggers.
+
+## Pass criteria
+
+1. The first `awesomate_n8n_*` tool call in the transcript is `awesomate_n8n_context`.
+   Non-n8n tool calls may precede it.
+2. The design uses TWO webhook trigger nodes on the SAME path — one GET (renders the
+   page) and one POST (receives the photos) — both with `responseMode: "responseNode"`.
+   No Form Trigger anywhere.
+3. Branding is grounded in the business variables: the design includes a Set/config node
+   mapping `$vars.brand_primary_color` / `$vars.brand_secondary_color` /
+   `$vars.biz_logo_url` (or explicitly checks the live variables via
+   `awesomate_n8n_inspect {what:'variables'}`), each with a fallback — never hardcoded
+   colors presented as "your brand" without checking.
+4. Save-to-home-screen is handled correctly: a manifest served from the same webhook via
+   a query parameter, with an ABSOLUTE `start_url` under `/webhook/`, and the access key
+   echoed into `start_url`. The design does NOT rely on localStorage for the key.
+5. Photo upload uses client-side downscale (canvas → JPEG) POSTed as base64 JSON to the
+   same webhook path — or the assistant explicitly justifies multipart binary and routes
+   processing through non-Code nodes.
+6. Access control is an IF-node key gate (key from `$vars` or a stored value) — not the
+   webhook's `onlyRunIf` option referencing `$vars`.
+7. The design is presented for approval before any `create_draft` call, and testing is
+   described against the LIVE published URL (curl or equivalent), not validation alone.
+
+## Automatic fails
+
+- Any reliance on localStorage/cookies/service workers without a stated fallback.
+- `start_url` or manifest icon given as a relative path (".", "./", bare filename).
+- `create_draft`, `activate`, or `awesomate_n8n_test` called before user approval.
+- Proposes external hosting (separate site, S3, static host) for the page itself.
+- Asks the user for their n8n API key.

package/skill/awesomate-n8n/evals/webhook-page-build/prompt.md

@@ -0,0 +1 @@
+Build me a page my technicians can open on their phones to snap photos of completed jobs. It should look like our brand, they should be able to save it to their home screen, and the photos should end up in my n8n so I can process them.

package/skill/awesomate-n8n/references/webhook-pages.md

@@ -0,0 +1,137 @@
+# Webhook pages: designed HTML pages served straight from your n8n
+
+A webhook can serve a full, beautiful web page — a branded form, a phone camera-capture
+mini-app the user saves to their home screen, an approval page that resumes a paused
+workflow, a live status page. No hosting, no CORS, no deploy pipeline: the page exists
+while the workflow is active.
+
+**Never hand-build the page's URL.** `awesomate_n8n_deploy` returns a `webhooks` array —
+`{ node, url, method }` per trigger — and that `url` is the live address. Most instances
+are `https://<slug>.awesomate.io`, but not all of them are, so a constructed hostname is
+a guess that fails silently for the clients on a different domain. `awesomate_n8n_context`
+carries the same truth as `instanceUrl`. Give the user the URL you were handed.
+
+**The contract: GET renders, POST acts.** Two webhook trigger nodes on the SAME path —
+one `httpMethod: GET`, one `POST`, both `responseMode: "responseNode"`. Never let a GET
+change anything: email scanners and link previewers click every URL they see. A webhook
+set to `onReceived` refuses to run (500 "Unused Respond to Webhook node") if any Respond
+node exists in the workflow — always use `responseNode` in page workflows. Exception: in
+Wait-based approval flows the signed resume URL IS the act side, so the render webhook can be
+GET-only; add a POST twin only when the page posts back to itself.
+
+## Rendering a page
+
+Webhook (GET) → Set "Workflow Config" → IF key gate → Code "Render Page" → Respond to Webhook.
+
+- The Code node returns `{ status_code, html }`, escaping every interpolated value with a
+  local `esc()` helper (`& < > "`).
+- Respond node: `respondWith: "text"`, `responseBody: ={{ $json.html }}`,
+  `options.responseCode: ={{ $json.status_code }}`, header
+  `Content-Type: text/html; charset=utf-8`. Every outcome branch (success, already-done,
+  invalid) must converge into ONE respond node — an unwired branch silently swallows the
+  response.
+- To pass config to the page's JavaScript safely, embed
+  `<script id="__cfg" type="application/json">BASE64</script>` and read it with
+  `JSON.parse(atob(document.getElementById("__cfg").textContent))` — immune to quote
+  escaping.
+
+## Brand the page from the business variables
+
+Start the workflow with a "Workflow Config" Set node (Include Other Fields ON) mapping the
+brand kit with fallbacks — dot notation only:
+
+```
+brand_primary   ={{ $vars.brand_primary_color || '' }}
+brand_secondary ={{ $vars.brand_secondary_color || '' }}
+brand_font      ={{ $vars.brand_font_primary || '' }}
+logo_url        ={{ $vars.biz_logo_url || '' }}
+biz_name        ={{ $vars.biz_name || '' }}
+```
+
+In the page, feed these into CSS custom properties (`:root{--brand:…}`) with a tasteful
+default palette in the Code node for any unset key. Every page you build this way is
+automatically on-brand for the business, and re-brands itself if the variables change.
+
+## What the browser can and can't do (important)
+
+n8n serves your HTML with a security sandbox header (no iframe — your page is delivered
+verbatim). Measured behavior:
+
+- **Works:** JavaScript, `fetch()` back to the same webhook (relative or absolute path,
+  no CORS setup needed), plain `<form method="POST">` submits, links, redirects, phone
+  camera inputs (`<input type="file" accept="image/*" capture>`).
+- **Blocked (throws SecurityError):** localStorage, cookies, service workers.
+
+So: **state rides the URL** — query parameters, hidden form fields, and (for installed
+mini-apps) the key echoed into the manifest `start_url`. Never rely on localStorage.
+
+## Getting data in — three modes
+
+| Mode | The workflow receives | Use for |
+|---|---|---|
+| Plain `<form method=POST>` | Parsed fields in `$json.body` | Zero-JS forms, approve/reject buttons |
+| `fetch` + JSON, files as base64 | `body.files[].data` — readable in Code nodes (sniff magic bytes: `JVBERi`→pdf, `iVBORw0KGgo`→png, `/9j/`→jpeg) | Camera capture; anything Code must inspect. Downscale photos client-side first (canvas, 1600px JPEG q0.85, white background fill) |
+| Multipart (native file form / FormData) | Binary properties (name/type/size; bytes NOT readable in Code nodes) | Large files; process with Extract From File or HTTP nodes |
+
+POST back to `location.pathname` — same origin, zero configuration. Respond with a small
+HTML page confirming what was received.
+
+## Multi-view apps and assets from one webhook
+
+Route on a query parameter (`?view=home|form|manifest|icon`), never on `/:path` segments
+(those change the URL shape). A Switch node fans out to one Respond node per response
+type: pages (text/html), a web-app manifest (`application/manifest+json`), even a binary
+PNG icon (Code nodes can return binary:
+`{ json, binary: { data: { data: b64, mimeType: 'image/png', fileName } } }`). Redirects
+return **307**. n8n sets its own cache lifetimes per content type — version assets with a
+query param, not cache headers.
+
+## Save-to-home-screen mini-apps (phones)
+
+- **Always ship an icon.** Serve a 512×512 PNG from an `?view=icon` route and reference it
+  from BOTH the `apple-touch-icon` link and the manifest `icons` entry — without it iOS
+  installs a screenshot of the page and Android shows a letter tile. Use the business logo
+  (`$vars.biz_logo_url`) when set, else a brand-gradient placeholder.
+- Page head: `<link rel="manifest" href="?view=manifest&key=K">`,
+  `<link rel="apple-touch-icon" href="?view=icon&key=K">`,
+  `apple-mobile-web-app-capable` + `mobile-web-app-capable` + `theme-color` metas.
+- Manifest: `display: "standalone"`, **absolute** paths everywhere
+  (`start_url: "/webhook/<path>?view=app&key=K"`, `scope: "/webhook/"`, absolute icon
+  src) — a relative `start_url` 404s. **Echo the access key into `start_url`**: it is the
+  only persistence that survives installation.
+- iPhone: Share → Add to Home Screen gives a standalone branded app. Android: "Add to
+  Home screen" works as a shortcut; the full install prompt needs a service worker, which
+  the sandbox blocks — treat Android as shortcut-only.
+- iOS snapshots the manifest at install time: if you fix it later, users must remove and
+  re-add the icon.
+
+## Approval pages that resume a paused workflow
+
+1. Before a Wait node, capture `$execution.resumeUrl` (n8n signs it — unguessable) and
+   deliver it: email it, or respond to the start request with a designed page linking to
+   your approval view.
+2. Wait node: `resume: "webhook"`, `httpMethod: "POST"`, a wait-time limit, and
+   `responseMode: "responseNode"` (set it even though the UI hides it — without it the
+   approval click gets a JSON ack instead of your page).
+3. The approval page renders Approve/Reject as `<form method="POST" action="<resumeUrl>">`.
+4. A Respond node AFTER the Wait answers the click with a designed confirmation page.
+   Replaying a used resume URL returns 409 — safe by default.
+
+## Access control
+
+- Customer one-shot links: generate a long random token, store only its SHA-256 hash
+  (in a data table or your workflow's database, with `{token_hash, record_id, status,
+  expires_at}`), look up by hash with an expiry, and return a vague 410 for anything
+  unknown. Lookup errors fail CLOSED (410, never render). Sensible expiries: days for
+  record links, hours for approval waits.
+- Team pages / mini-apps: a key in `$vars`, checked by an **IF node as the first step**
+  (never the webhook's `onlyRunIf` option with `$vars` — it fails open).
+- Every page request is one workflow execution — designed for human-scale traffic, not
+  public high-volume sites. Inline all CSS/JS and embed images as data URIs (response
+  size is generous — multi-MB pages are fine).
+
+## When NOT to use a webhook page
+
+Login sessions and multi-user accounts (no cookies), public high-traffic sites, or a real
+app with a database UI — those belong on hosting (awesomate-app-builder). A quick internal
+form with no design needs can stay on n8n's Form node.