@awesomate/hosting-mcp 0.20.5 → 0.20.7

package/dist/index.js

@@ -39754,13 +39754,13 @@ function findPinFile(startDir = process.cwd()) {
 }
 function profileList(profiles) {
   const names = Object.keys(profiles);
-  return names.length ? names.join(", ") : "(none \u2014 run Connect Claude Code from hub.awesomate.ai/sites)";
+  return names.length ? names.join(", ") : "(none \u2014 run Connect Claude Code from hub.awesomate.ai/claude)";
 }
 function fromProfile(key, profile, source, credPath, pinPath, availableProfiles) {
   const pat = profile.pat ?? "";
   if (!pat.startsWith("amt_pat_")) {
     throw new Error(
-      `Profile "${key}" in ${credPath} has a malformed access token \u2014 re-run Connect Claude Code from hub.awesomate.ai/sites for this account.`
+      `Profile "${key}" in ${credPath} has a malformed access token \u2014 re-run Connect Claude Code from hub.awesomate.ai/claude for this account.`
     );
   }
   return {
@@ -39804,7 +39804,7 @@ function loadConfig() {
     const profile = profiles[envAccount];
     if (!profile) {
       throw new Error(
-        `AWESOMATE_ACCOUNT="${envAccount}" has no matching profile in ${credPath}. Available profiles: ${profileList(profiles)}. Connect that account from hub.awesomate.ai/sites (logged in as it) to add its profile.`
+        `AWESOMATE_ACCOUNT="${envAccount}" has no matching profile in ${credPath}. Available profiles: ${profileList(profiles)}. Connect that account from hub.awesomate.ai/claude (logged in as it) to add its profile.`
       );
     }
     return fromProfile(envAccount, profile, "env-account", credPath, null, available);
@@ -39819,7 +39819,7 @@ function loadConfig() {
     const profile = profiles[account];
     if (!profile) {
       throw new Error(
-        `This folder is pinned to account "${account}" (${pinPath}) but no matching profile exists in ${credPath}. Available profiles: ${profileList(profiles)}. Fix the pin, or connect "${account}" from hub.awesomate.ai/sites while logged into that account.`
+        `This folder is pinned to account "${account}" (${pinPath}) but no matching profile exists in ${credPath}. Available profiles: ${profileList(profiles)}. Fix the pin, or connect "${account}" from hub.awesomate.ai/claude while logged into that account.`
       );
     }
     return fromProfile(account, profile, "pin", credPath, pinPath, available);
@@ -39833,7 +39833,7 @@ function loadConfig() {
   }
   if (available.length === 0) {
     throw new Error(
-      `No Awesomate access token found. Set AWESOMATE_PAT or run Connect Claude Code from hub.awesomate.ai/sites (it writes ${credPath}).`
+      `No Awesomate access token found. Set AWESOMATE_PAT or run Connect Claude Code from hub.awesomate.ai/claude (it writes ${credPath}).`
     );
   }
   throw new Error(
@@ -39899,9 +39899,9 @@ async function hubRequest(config3, method, path, jsonBody, opts = {}) {
     const code = body && typeof body === "object" && "code" in body && typeof body.code === "string" ? body.code : null;
     let hint = "";
     if (res.status === 401) {
-      hint = " Your access token is invalid or expired \u2014 ask the user to open the hub Sites page (hub.awesomate.ai/sites), generate a fresh Connect prompt, and re-run the bootstrap.";
+      hint = " Your access token is invalid or expired \u2014 ask the user to open the hub Claude page (hub.awesomate.ai/claude), generate a fresh Connect prompt, and re-run the bootstrap.";
     } else if (res.status === 403 && code === "consent_required") {
-      const settingsUrl = body && typeof body === "object" && "settingsUrl" in body && typeof body.settingsUrl === "string" ? body.settingsUrl : "https://hub.awesomate.ai/n8n/settings";
+      const settingsUrl = body && typeof body === "object" && "settingsUrl" in body && typeof body.settingsUrl === "string" ? body.settingsUrl : "https://hub.awesomate.ai/settings?tab=privacy";
       hint = ` This needs a privacy toggle the user must flip themselves \u2014 send them to ${settingsUrl}, wait for them to confirm, then retry. Never suggest a plan upgrade for a consent denial.`;
     } else if (res.status === 403) {
       const missing = body && typeof body === "object" && "missingScopes" in body ? ` (missing: ${JSON.stringify(body.missingScopes)})` : "";
@@ -40770,7 +40770,7 @@ server.registerTool(
   "awesomate_get_context",
   {
     annotations: READ_ONLY,
-    description: "THE session entry point \u2014 call it FIRST, before any domain context. Returns the connected account: plan, capabilities, limits, scopes, token expiry, cPanel routing, PLUS `attention` ({unreadNotifications, erroringWorkflows7d, patExpiresInDays} \u2014 null means unknown, never zero; when something is non-zero, mention it to the user in one line before starting the asked task), `latestMcpVersion` (if serverVersion still lags it after a restart, the npx cache is stale \u2014 remedy: rm -rf ~/.npm/_npx, then restart), and `skill` ({updateAvailable, staleSkills, whatsNew} \u2014 if updateAvailable, mention ONCE with a whatsNew line, offer awesomate_skill_update, never mid-task). If the token is near expiry (patExpiresInDays < 7), re-running Connect Claude Code from hub.awesomate.ai/sites refreshes skills AND renews the token in one go.",
+    description: "THE session entry point \u2014 call it FIRST, before any domain context. Returns the connected account: plan, capabilities, limits, scopes, token expiry, cPanel routing, PLUS `attention` ({unreadNotifications, erroringWorkflows7d, patExpiresInDays} \u2014 null means unknown, never zero; when something is non-zero, mention it to the user in one line before starting the asked task), `latestMcpVersion` (if serverVersion still lags it after a restart, the npx cache is stale \u2014 remedy: rm -rf ~/.npm/_npx, then restart), and `skill` ({updateAvailable, staleSkills, whatsNew} \u2014 if updateAvailable, mention ONCE with a whatsNew line, offer awesomate_skill_update, never mid-task). If the token is near expiry (patExpiresInDays < 7), re-running Connect Claude Code from hub.awesomate.ai/claude refreshes skills AND renews the token in one go.",
     inputSchema: {}
   },
   async () => {
@@ -41804,7 +41804,7 @@ readTool(
 );
 readTool(
   "awesomate_privacy_settings",
-  "READ which privacy/consent toggles are on or off for this account \u2014 call it when a tool returns 403 consent_required so you can name the exact toggle instead of guessing. Toggles are changed ONLY by the user in the hub (n8n \u2192 Settings \u2192 Privacy, hub.awesomate.ai/n8n/settings); there is deliberately no write here.",
+  "READ which privacy/consent toggles are on or off for this account \u2014 call it when a tool returns 403 consent_required so you can name the exact toggle instead of guessing. Toggles are changed ONLY by the user in the hub (Settings \u2192 Privacy, hub.awesomate.ai/settings?tab=privacy); there is deliberately no write here.",
   "/api/client-settings/privacy"
 );
 server.registerTool(
@@ -41877,6 +41877,26 @@ server.registerTool(
     }
   }
 );
+server.registerTool(
+  "awesomate_site_audit",
+  {
+    description: "Run the SEO + AEO build gates against ONE live page the user owns, fetched AS GPTBot. Returns pass/fail per gate with specific fixes: is the content in the raw HTML at all (a React/Vue site is invisible to ChatGPT, Claude and Perplexity \u2014 only Gemini and Applebot run JavaScript), can the four retrieval bots reach it, is there an accidental noindex/nosnippet, does the canonical point at THIS domain (a leftover pointing at a Replit/Vercel/staging host silently de-indexes the real site), is the structured data valid AND mirrored in visible text, is the content structured so a single section survives being quoted, robots.txt + sitemap, and time-to-first-byte. Run it after building or changing any public page, and before telling the user their site is discoverable \u2014 reads on every plan. Two gates are reported as `skipped` because they need a headless browser or a full crawl; treat skipped as unknown, never as passing.",
+    inputSchema: {
+      domain: external_exports.string().min(3).max(253).describe("a domain on the user's own hosting account"),
+      path: external_exports.string().max(400).optional().describe("page path to audit, default /")
+    },
+    annotations: READ_ONLY
+  },
+  async ({ domain, path }) => {
+    try {
+      const dom = encodeURIComponent(domain.toLowerCase());
+      const q = path && path !== "/" ? `?path=${encodeURIComponent(path)}` : "";
+      return textResult(await hubGet(requireConfig(), `/api/client-hosting/sites/${dom}/audit${q}`));
+    } catch (err) {
+      return errorResult(err);
+    }
+  }
+);
 server.registerTool(
   "awesomate_wp_media_import",
   {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awesomate/hosting-mcp",
-  "version": "0.20.5",
+  "version": "0.20.7",
   "description": "Awesomate MCP server — lets Claude manage your Awesomate WordPress hosting, plan, limits, n8n automations, and build Node/static apps + databases",
   "license": "UNLICENSED",
   "type": "module",

package/skill/CHANGELOG.json

@@ -1,5 +1,19 @@
 {
   "versions": [
+    {
+      "version": "0.20.7",
+      "highlights": [
+        "Your Knowledge Base can now go on your website: install the Verified Content Chat Agent from the hub Library and it answers visitors from the agent you published, with sources on every reply",
+        "Fixed: a credential Awesomate creates in your n8n now shows up immediately in the list Claude reads, instead of after the weekly refresh"
+      ]
+    },
+    {
+      "version": "0.20.6",
+      "highlights": [
+        "Ask Claude to check any page and it now runs a full findability audit - whether AI assistants can actually read and quote it, not just whether Google can find it",
+        "Catches the faults that silently make a site invisible to ChatGPT and Perplexity, like content that only appears once the browser runs it"
+      ]
+    },
     {
       "version": "0.20.5",
       "highlights": [

package/skill/awesomate-app-builder/SKILL.md

@@ -78,7 +78,7 @@ inventory (`awesomate_n8n_inspect {what:'credentials'}`) and say e.g. *"you alre
 have Gmail connected in n8n — want the form to email you through that?"*
 That read is **consent-gated**: it needs the **"Allow Claude Code to Build
 n8n Workflows"** toggle (n8n → Settings → Privacy,
-hub.awesomate.ai/n8n/settings; also on hub.awesomate.ai/n8n/settings),
+hub.awesomate.ai/settings?tab=privacy; also on hub.awesomate.ai/settings?tab=privacy),
 which is **off by default** — so on a fresh account it comes back 403
 `consent_required`. That's not a failure to work around: call
 `awesomate_privacy_settings` to name the exact toggle, ask the user to flip

package/skill/awesomate-app-builder/references/stack-decision.md

@@ -68,7 +68,7 @@ credentials are already connected there, so there's nothing new to set up.
   sheet?"* That read needs the **"Allow Claude Code to Build n8n Workflows"**
   privacy toggle, which is off by default — a 403 `consent_required` means
   call `awesomate_privacy_settings`, name the toggle, and ask the user to flip
-  it at hub.awesomate.ai/n8n/settings.
+  it at hub.awesomate.ai/settings?tab=privacy.
 - Build the workflow with the **awesomate-n8n** skill (webhook trigger →
   action), take its **webhook URL**, and wire it into the app.
   - **Node app:** `awesomate_n8n_attach_to_app` — it stores

package/skill/awesomate-credentials/SKILL.md

@@ -123,7 +123,7 @@ A secret for an n8n workflow belongs on the n8n instance (awesomate-n8n
 skill), never in an app `.env`. Those tools are consent-gated: if one comes
 back 403 `consent_required`, call `awesomate_privacy_settings` — it names
 the exact toggle that's off, so you can send the user to the right switch at
-hub.awesomate.ai/n8n/settings instead of guessing. You can't flip it
+hub.awesomate.ai/settings?tab=privacy instead of guessing. You can't flip it
 for them.
 
 ## Fallback: the file-drop flow

package/skill/awesomate-database/SKILL.md

@@ -28,8 +28,8 @@ automation-shaped. Inspect what exists with
 `awesomate_n8n_inspect {what:'datatables'}`.
 **Both the write AND that read are gated:** Support Plus or above, plus the
 privacy toggle **"Allow Claude Code to Build n8n Workflows"** — n8n →
-Settings → Privacy (hub.awesomate.ai/n8n/settings, or the same toggles at
-hub.awesomate.ai/n8n/settings, which is what the 403's
+Settings → Privacy (hub.awesomate.ai/settings?tab=privacy, or the same toggles at
+hub.awesomate.ai/settings?tab=privacy, which is what the 403's
 `settingsUrl` points at). It is **off by default**, so on a fresh account
 both the read and the write come back 403 `consent_required`. Call
 `awesomate_privacy_settings` to name the exact toggle that's off, send the

package/skill/awesomate-hosting/SKILL.md

@@ -46,7 +46,7 @@ once (plus `awesomate_get_limits` before any create/change) and cache:
   asked task, then get on with the task. `null` means unknown, never zero —
   say nothing on null.
 - **`patExpiresAt`** — within ~7 days, or any 401: re-run the setup prompt at
-  **hub.awesomate.ai/sites → Connect Claude Code** to refresh the token.
+  **hub.awesomate.ai/claude → Connect Claude Code** to refresh the token.
 - **`skill.updateAvailable`** — covers all nine skills; the local files are
   older than the MCP server. Mention it ONCE per session, with the what's-new
   line the context includes, and offer to run `awesomate_skill_update`. Its
@@ -105,6 +105,7 @@ proxy failures, resuming a connect, support report) ·
 | `awesomate_domain_add` | Attach a custom domain to a site |
 | `awesomate_dns_check` | Live answer to "where does this domain actually point" — before and after any DNS change |
 | `awesomate_site_uptime` | 30-day availability, incidents, downtime per domain (cached, free) |
+| `awesomate_site_audit` | SEO + AEO build gates for one page, fetched as GPTBot — content present without JS, retrieval bots reachable, canonical, schema, structure, speed. Not plan-gated. Run it after any public-page change, and see the awesomate-seo skill for the fixes |
 | `awesomate_snapshot_site` | Before ANY change to a live site — files + DB restore point |
 | `awesomate_list_snapshots` | What restore points a site has |
 | `awesomate_rollback_site` | Restore a snapshot after something went wrong (confirm first) |
@@ -114,7 +115,7 @@ proxy failures, resuming a connect, support report) ·
 | `awesomate_wp_post` | Create/update/read a WP post or page — drafts by default (writes are Support Plus+) |
 | `awesomate_wp_media_import` | Pull an image/file into the WP media library from an https URL (Support Plus+) |
 | `awesomate_uninstall_site` | Remove a WordPress install (destructive — confirm explicitly) |
-| `awesomate_privacy_settings` | Read which privacy/consent toggles are on — explain a 403 `consent_required` precisely (the user flips toggles themselves under n8n → Settings → Privacy at hub.awesomate.ai/n8n/settings) |
+| `awesomate_privacy_settings` | Read which privacy/consent toggles are on — explain a 403 `consent_required` precisely (the user flips toggles themselves under Settings → Privacy at hub.awesomate.ai/settings?tab=privacy) |
 | `awesomate_notifications` | The hub notification bell — `list` unread (quota warnings, quote ready, support-access events), `read`/`read_all` to clear |
 | `awesomate_dashboard_metrics` | Account-wide numbers: executions by status, error rate, time saved, chat sessions, 7-day trend |
 | `awesomate_account_report` | A monthly-report-shaped read: working / not working / engagement / commercials |

package/skill/awesomate-hosting/scripts/bootstrap.mjs

@@ -67,7 +67,7 @@ if (process.argv.includes('--update')) {
 }
 
 if (!resumePat && (!code || !code.startsWith('amt_bs_'))) {
-  console.error('Missing/invalid --code. Copy a fresh setup prompt from hub.awesomate.ai/sites (or resume with --pat if you already hold a token).');
+  console.error('Missing/invalid --code. Copy a fresh setup prompt from hub.awesomate.ai/claude (or resume with --pat if you already hold a token).');
   console.error('AWESOMATE CONNECT: FAILED reason=bad-code');
   process.exit(1);
 }
@@ -596,7 +596,7 @@ async function main() {
 main().catch((err) => {
   console.error('Bootstrap failed:', err.message);
   if (err.isApiError && err.status === 401) {
-    console.error('Grab a fresh code from hub.awesomate.ai/sites — codes last 10 minutes (and stay re-runnable within that window).');
+    console.error('Grab a fresh code from hub.awesomate.ai/claude — codes last 10 minutes (and stay re-runnable within that window).');
   }
   console.error(SUPPORT_HINT);
   console.error('AWESOMATE CONNECT: FAILED reason=error');

package/skill/awesomate-hosting/scripts/deploy.sh

@@ -25,7 +25,7 @@
 set -euo pipefail
 
 CRED="$HOME/.awesomate/credentials.json"
-[ -f "$CRED" ] || { echo "Not connected — run the Connect Claude Code setup from hub.awesomate.ai/sites first."; exit 1; }
+[ -f "$CRED" ] || { echo "Not connected — run the Connect Claude Code setup from hub.awesomate.ai/claude first."; exit 1; }
 
 FROM="" DOMAIN="" DOCROOT="" LOCAL_URL="" LIVE_URL="" WITH_DB=0 ASSUME_YES=0
 while [ "$#" -gt 0 ]; do

package/skill/awesomate-hosting/scripts/pull-live.sh

@@ -11,7 +11,7 @@
 set -euo pipefail
 
 CRED="$HOME/.awesomate/credentials.json"
-[ -f "$CRED" ] || { echo "Not connected — run the Connect Claude Code setup from hub.awesomate.ai/sites first."; exit 1; }
+[ -f "$CRED" ] || { echo "Not connected — run the Connect Claude Code setup from hub.awesomate.ai/claude first."; exit 1; }
 
 DOMAIN="" TO="" DOCROOT=""
 while [ "$#" -gt 0 ]; do

package/skill/awesomate-hosting/scripts/resolve-account.mjs

@@ -70,7 +70,7 @@ if (process.env.AWESOMATE_ACCOUNT) {
     if (!profiles[key]) {
       fail(
         `This folder is pinned to account "${key}" (${pinPath}) but no matching profile exists in ${credPath}. ` +
-          `Available: ${names.join(', ') || '(none)'}. Connect "${key}" from hub.awesomate.ai/sites (logged in as it) or fix the pin.`,
+          `Available: ${names.join(', ') || '(none)'}. Connect "${key}" from hub.awesomate.ai/claude (logged in as it) or fix the pin.`,
       );
     }
   } else if (names.length === 1) {
@@ -78,7 +78,7 @@ if (process.env.AWESOMATE_ACCOUNT) {
   } else if (file.defaultProfile && profiles[file.defaultProfile]) {
     key = file.defaultProfile;
   } else if (names.length === 0) {
-    fail('Not connected. Run the Connect Claude Code setup from hub.awesomate.ai/sites.');
+    fail('Not connected. Run the Connect Claude Code setup from hub.awesomate.ai/claude.');
   } else {
     fail(
       `Multiple accounts are connected (${names.join(', ')}) and this folder isn't pinned to one. ` +

package/skill/awesomate-hosting/scripts/ssh-connect.sh

@@ -6,7 +6,7 @@
 #   ssh-connect.sh 'wp --info'     # one-off command
 set -euo pipefail
 CRED="$HOME/.awesomate/credentials.json"
-[ -f "$CRED" ] || { echo "Not connected. Run bootstrap first (Connect Claude Code on hub.awesomate.ai/sites)."; exit 1; }
+[ -f "$CRED" ] || { echo "Not connected. Run bootstrap first (Connect Claude Code on hub.awesomate.ai/claude)."; exit 1; }
 
 # Resolve WHICH account (folder pin / AWESOMATE_ACCOUNT / sole profile) and its
 # ssh block via the shared resolver. Capture then eval so a resolver failure

package/skill/awesomate-knowledge/SKILL.md

@@ -31,7 +31,7 @@ platform's answer beats anything you remember.
      link once, honestly, then help within what reads allow. Never retry
      into the gate.
    - `consent.knowledge_platform_enabled: false` → the user must turn it on
-     themselves: hub.awesomate.ai/n8n/settings, under the heading
+     themselves: hub.awesomate.ai/settings?tab=privacy, under the heading
      **"Knowledge Base"**, the toggle **"Send My Content to the Knowledge
      Platform"**. Name it exactly like that — one heading and one switch, so
      they can find it without hunting. You cannot flip it for them, and

package/skill/awesomate-knowledge/references/from-your-files.md

@@ -106,10 +106,12 @@ Two destinations. Ask which they want; do not assume.
 
 **A chat on their existing website — via n8n.** This is usually the right
 answer, and the plumbing is already provisioned. See
-`references/n8n-connection.md`: the hub creates the scope credential and the
-`knowledge_answer` tool. Build the workflow with the awesomate-n8n skill
-(Chat Trigger or Webhook -> AI Agent with the `knowledge_answer` tool ->
-Respond), test it, promote it, and give them the webhook URL to embed. Read
+`references/n8n-connection.md` §3: they install the **Verified Content Chat
+Agent** card from the hub Library (`/templates`); it runs the agent they
+published, publishes on install, and the Chat URL goes into the embed
+snippet. Only when they want their OWN agent node (extra tools, a different
+model) build it with the awesomate-n8n skill instead — Chat Trigger -> AI
+Agent with the `knowledge_answer` library tool -> Respond — and read
 `awesomate-n8n/references/ai-agents.md` before designing the agent node.
 
 **A standalone page or app — via the app builder.** When they want a hosted

package/skill/awesomate-knowledge/references/n8n-connection.md

@@ -34,18 +34,45 @@ their own agent on top and accept ungated composition.
 
 ## 3. The bundle — "Verified Content Chat Agent"
 
-One redeem token installs: the public chat webhook workflow (speaks the
-`@n8n/chat` embed widget contract), a Setup Tool sub-workflow, and the
-"Knowledge Bot Setup" Chat Hub agent whose FIRST action is a connection
-check that reads back "connected to <business name>'s knowledge base with
-N sources" — the human confirmation the scope is right. Every `kb_*`
-variable has a fallback: zero config to first reply.
-
-Flow you drive: confirm the knowledge base is active with indexed content →
-redeem the bundle token (the user gets it from Awesomate) via the hub's
-Templates page or `POST /api/client-settings/redeem {token}` → hand the
-user to "Knowledge Bot Setup" in Chat Hub for greeting/name/origins → the
-setup agent activates and tests the bot and hands over the embed snippet.
+One library card installs the public chat workflow that speaks the
+`@n8n/chat` embed widget contract. There is **no AI Agent node in it**: the
+agent the member published in the hub (Knowledge → Agents) IS the agent —
+its system message, grounding mode, scope and no-answer message run on the
+platform, and n8n only relays. Chat Trigger → `POST /v1/answer` with
+`agent_id` (scope credential above) → a Code node that renders the N1
+contract (§4) → the widget.
+
+Variables (all read from `$vars`, all with fallbacks):
+
+- `kb_agent_id` — **set automatically at install** when the member has
+  exactly one published, unsuspended agent. Two or more is their choice:
+  preflight lists it as manual setup and the value is the agent id shown in
+  the hub. Unset, `/v1/answer` falls back to the tenant's default agent.
+- `kb_allowed_origins` — the website origin (CORS). Default: any.
+- `kb_fallback_message` — shown only when the platform itself could not be
+  reached (401/429/timeout). A verified "no answer" shows the agent's own
+  no-answer message, never this.
+
+Flow you drive: confirm the knowledge base is active with indexed content and
+one published agent → the member installs the bundle from the hub's
+**Library** page (`/templates`, card "Verified Content Chat Agent"; a redeem
+token via `POST /api/client-settings/redeem {token}` also works if Awesomate
+hands one over) → the workflow publishes on install once the scope credential
+is verified → open "When chat message received", copy the **Chat URL**, and
+give them the embed snippet (it is also in the workflow's HOW IT WORKS note):
+
+```html
+<link href="https://cdn.jsdelivr.net/npm/@n8n/chat/dist/style.css" rel="stylesheet" />
+<script type="module">
+import { createChat } from 'https://cdn.jsdelivr.net/npm/@n8n/chat/dist/chat.bundle.es.js';
+createChat({ webhookUrl: '<the Chat URL>' });
+</script>
+```
+
+Not yet shipped (do not promise them): a "Knowledge Bot Setup" Chat Hub
+agent that walks the member through greeting/name/origins, and the hosted
+widget with a per-site install flow. Until then the sticky notes in the
+workflow are the setup guide.
 
 If the member already has their own agent workflow, attach the
 `knowledge_answer` tool from the library to it instead — same credential,

package/skill/awesomate-n8n/SKILL.md

@@ -30,11 +30,11 @@ as outcomes ("your form now emails you") with URLs.
 2. `awesomate_n8n_context` — cache the result:
    - `consented: false` → give the user the `settingsUrl` and tell them
      where it lands: **n8n → Settings → Privacy** at
-     `hub.awesomate.ai/n8n/settings` → "Allow Claude Code to Build n8n
+     `hub.awesomate.ai/settings?tab=privacy` → "Allow Claude Code to Build n8n
      Workflows". Privacy moved there; the plain `/settings` page no longer
      has it (old `?tab=privacy` links just redirect). Wait, then re-check.
    - `403 missingScopes` → token predates n8n support — reconnect from
-     hub.awesomate.ai/sites (Connect Claude Code card).
+     hub.awesomate.ai/claude (Connect Claude Code card).
    - `capabilities.builder: false` → reads only; building is Support Plus+.
      Be honest about it once, then help fully within reads.
    - `capabilities.variant` → FFMPEG variants have the media community

package/skill/awesomate-n8n/references/error-handling.md

@@ -82,7 +82,7 @@ use it to explain and prioritise, not as a substitute for your own diagnosis
 of the execution data. On a 403, the plan or the toggle is the reason —
 `awesomate_privacy_settings` (hosting skill) tells you which; the user flips
 toggles themselves under **n8n → Settings → Privacy** at
-hub.awesomate.ai/n8n/settings — the one for this tool is labelled
+hub.awesomate.ai/settings?tab=privacy — the one for this tool is labelled
 **"Enable AI Error Diagnosis"**.
 
 ## 5. What to do when you inherit a workflow with no plan

package/skill/awesomate-n8n/references/platform-notes.md

@@ -74,7 +74,7 @@ trust this file.
     real error. Use it instead of guessing from the summary. It is gated on
     the client's `error_content_analysis` privacy toggle (default OFF) — on
     a consent refusal, ask the user to enable it under **n8n → Settings →
-    Privacy** at `hub.awesomate.ai/n8n/settings` (Privacy moved off the plain
+    Privacy** at `hub.awesomate.ai/settings?tab=privacy` (Privacy moved off the plain
     `/settings` page; old `?tab=privacy` links redirect there);
     never work around the gate.
 

package/skill/awesomate-n8n/references/rest-fallback.md

@@ -62,7 +62,7 @@ the conversation or logs.
 - `403 consent_required` + `flag` + `settingsUrl` → relay the link, re-check
   after the user toggles (a null `settingsUrl` means contact support).
 - `403 missingScopes` → token predates n8n support — reconnect from
-  hub.awesomate.ai/sites.
+  hub.awesomate.ai/claude.
 - `429 quota_exceeded` → the plan's daily cap; stop, don't retry-loop.
 - `503 node_catalog_unavailable` → use `references/vendor/` knowledge.
 - `404` on a path in this table → check the path against this file

package/skill/awesomate-n8n/references/troubleshooting.md

@@ -49,9 +49,9 @@ rebuilt (a rebuilt instance shows 0 workflows and invalidates every old key).
 5. `awesomate_n8n_executions {executionId, debug: true}` — node-level output
    data. Requires `error_content_analysis` consent:
    - `403 consent_required` → give the user the `settingsUrl` from the error
-     response and stop; they enable it under **n8n → Settings → Privacy** at
-     `hub.awesomate.ai/n8n/settings` (the plain `/settings` page no longer
-     carries Privacy; old `?tab=privacy` links redirect there).
+     response and stop; they enable it under **Settings → Privacy** at
+     `hub.awesomate.ai/settings?tab=privacy` (old `/n8n/settings?section=privacy`
+     links redirect there).
    - `tooLarge: true` → payload over 15MB. Use the summary in the response;
      do NOT retry hoping for the full payload.
 6. Node behaving strangely rather than erroring → check its schema with

package/skill/awesomate-seo/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: awesomate-seo
-description: Make the user's site findable — by Google AND by AI assistants. Adds title/meta/Open Graph tags, sitemap.xml, robots.txt, canonical tags, JSON-LD structured data, and a general llms.txt. Works for static sites, Node apps, and WordPress. Use when the user says "SEO", "get found on Google", "rank higher", "make my site discoverable", "sitemap", "meta tags", "schema", or after building/changing a public site. Companion to awesomate-app-builder.
+description: Make the user's site findable by Google AND quotable by AI assistants (SEO + AEO). Runs the build gates with awesomate_site_audit, then fixes what fails: title/meta/Open Graph, sitemap.xml, robots.txt, canonical tags, JSON-LD, answer-shaped content structure, and llms.txt. Works for static sites, Node apps, and WordPress. Use when the user says "SEO", "AEO", "GEO", "answer engine optimisation", "get found on Google", "get cited by ChatGPT", "rank higher", "make my site discoverable", "sitemap", "meta tags", "schema", or after building/changing any public page. Companion to awesomate-app-builder.
 ---
 
 # Awesomate SEO — get found on Google and AI
@@ -43,11 +43,13 @@ branch honestly.
 `plugin list`) — the whole route is behind the write gate, so "just reading
 the options" is not a way round it. The account-level reads do work
 (`awesomate_get_context`, `awesomate_list_sites`, `awesomate_list_domains`,
-`awesomate_dns_check`, `awesomate_site_uptime`).
+`awesomate_dns_check`, `awesomate_site_uptime`, and **`awesomate_site_audit`** —
+the full gate sweep works on every plan, because it reads the public page).
 
 **What Essentials CAN do — which is most of the value:** audit and advise
-from the outside. `curl` the pages, the sitemap, robots.txt and the rendered
-HTML; combine that with what they tell you; then produce the exact changes —
+from the outside. Start with `awesomate_site_audit` — it runs the whole sweep
+in one call and is NOT plan-gated, so an Essentials user gets exactly the same
+findings as anyone else. Then produce the exact changes —
 the titles and descriptions to paste, the JSON-LD block, the llms.txt
 content, which plugin to install and where its settings live. They apply
 them in wp-admin; you verify by fetching the live page again. Say that up
@@ -67,12 +69,18 @@ formats + length limits. In short, per site:
 3. **`sitemap.xml`** at the root — list every real URL with `<loc>` (+ `<lastmod>`).
 4. **JSON-LD** (`<script type="application/ld+json">`) — the right schema.org
    type (`Organization` / `WebSite` / `Product` / `Article` / `LocalBusiness`).
-5. **`llms.txt`** at the root — a short, plain-markdown summary of what the
-   site/business is and its key pages, so AI assistants can understand and cite
-   it. (This is the general, non-shop counterpart to the Woo `llms.txt`.)
-   Be honest about what it does: Google ignores it — it serves the *other*
-   assistants. For Google's AI features, normal SEO is the whole strategy.
-   Details + crawler/rendering gotchas: [references/ai-discoverability.md](references/ai-discoverability.md).
+5. **Answer-shaped content** — the part that decides whether the page is
+   actually *quoted* rather than merely found: answer-first sections of 120–180
+   words, no section opening with "it"/"this"/"also", comparisons in a real
+   `<table>`, specific numbers and dates inline, and every schema fact also
+   present in the visible copy.
+   Full discipline: [references/answer-structure.md](references/answer-structure.md).
+   This is the highest-leverage item on the list and the one most often skipped.
+6. **`llms.txt`** at the root — cheap, so write it, but keep it in proportion:
+   Google ignores it entirely and one study of 137,210 domains found 97% of
+   published files got zero requests. Generate it, never present it as a pillar,
+   never bill for it. Crawler/rendering gotchas:
+   [references/ai-discoverability.md](references/ai-discoverability.md).
 
 Then commit + deploy (awesomate-github). On content changes, update the
 affected `<head>` tags, `sitemap.xml` `<lastmod>`, and `llms.txt`.
@@ -142,7 +150,24 @@ On WordPress those three come from:
 the robots rules, the JSON-LD block, and tell them precisely where each goes
 — that is the useful half, and it works on every plan.
 
-## 3. Verify
+## 3. Verify — run the gates, don't eyeball it
+
+**`awesomate_site_audit { domain, path }`** runs the mechanical gates against
+the live page, fetched *as GPTBot*, and returns pass/fail with specific fixes:
+content present without JavaScript, all four retrieval bots reachable, no
+accidental `noindex`/`nosnippet`, canonical pointing at this domain, valid
+structured data whose facts also appear in the copy, section structure,
+robots.txt + sitemap, and time-to-first-byte.
+
+Run it after building or changing any public page, and **before telling the user
+their site is discoverable**. Checking in a browser is not equivalent — the
+browser runs the JavaScript that hides the biggest failure.
+
+Two gates come back `skipped` because they need a headless browser (content
+revealed only on click) or a full crawl (internal 404s). **Skipped means
+unknown, not passing** — say so rather than reporting a clean sweep.
+
+Then confirm by hand what the tool can't judge:
 - `robots.txt` and `sitemap.xml` (or the WP sitemap) return 200 at the root.
 - Each key page has a unique title + description and valid JSON-LD (no syntax
   errors — a broken `application/ld+json` block is worse than none).

package/skill/awesomate-seo/references/ai-discoverability.md

@@ -23,7 +23,7 @@ it, but present it as that, never as a Google requirement.
 
 | Kind | Bots | Blocking means |
 |---|---|---|
-| Search-indexing | OAI-SearchBot, Claude-SearchBot, PerplexityBot | The site can't be cited in that assistant's answers. **Allow these.** |
+| Search-indexing | OAI-SearchBot, Claude-SearchBot, PerplexityBot, **Bingbot** | The site can't be cited in that assistant's answers. **Allow these.** Bingbot belongs here because Copilot and several assistants ground on Bing's index. |
 | Training | GPTBot, ClaudeBot, Google-Extended, CCBot, Applebot-Extended, Meta-ExternalAgent | Owner's policy choice about model training; doesn't remove the site from answers |
 | User-triggered retrieval | ChatGPT-User, Perplexity-User, Claude-User | Fetches when a live user asks; may not fully respect robots.txt |
 
@@ -75,14 +75,34 @@ the edge. Where to fix it:
 - **Awesomate-managed domain** (`*.awesomate.site` etc.): the zone is managed
   by Awesomate — the user can't change it. Raise it via `awesomate_support`
   so the zone's AI Crawl Control settings get reviewed.
-- **Custom domain on the user's own Cloudflare account**: they fix it
-  themselves in the Cloudflare dashboard → Security → Bots → AI Crawlers.
+- **Custom domain on the user's own Cloudflare account**: fix it with a WAF
+  custom rule, action **Skip**, expression:
 
-## AI crawlers do not run JavaScript
+  ```
+  cf.verified_bot_category in {"AI Crawler" "Search Engine Crawler"}
+  ```
 
-Only Googlebot renders JS. GPTBot, ClaudeBot, PerplexityBot, and the other AI
-crawlers read the **raw HTML response**. A client-rendered app (React/Vue SPA)
-is invisible to every AI assistant regardless of its meta tags and llms.txt.
+  Match on the **verified category, never on user-agent strings** — a UA
+  allowlist is trivially spoofed and silently rots as bots are renamed.
+  Cloudflare's own AI-bot toggle does not separate citation bots from training
+  bots, which is why the toggle alone is the wrong instrument.
+
+Verified 2026-09-02 across awesomate.ai, hub.awesomate.ai and eight live client
+sites: all four retrieval bots got **200**, so this is not currently biting the
+fleet. Re-check per site rather than assuming either way — it is a per-zone
+setting and new zones are steered into blocking at signup.
+
+## Most AI crawlers do not run JavaScript
+
+**Googlebot, Gemini and Applebot render JS. GPTBot, ClaudeBot, PerplexityBot,
+OAI-SearchBot and Claude-SearchBot do not** — they read the **raw HTML
+response**. So a client-rendered app (React/Vue/Next SPA without SSR) is
+invisible to ChatGPT, Claude and Perplexity regardless of its meta tags,
+schema or llms.txt.
+
+`awesomate_site_audit` checks this automatically (gate G1) — run it rather
+than eyeballing the page in a browser, which renders the JS and hides the
+problem.
 
 Red flags — check the raw response, not the browser:
 
@@ -100,6 +120,29 @@ app projects, static marketing/landing pages in front of the app is usually
 enough. Don't rebuild a working app over this, but never claim AI
 discoverability for client-rendered content.
 
+## The accidental opt-out — check before blaming anything else
+
+A page can be perfectly built, reachable and fast, and still be barred from
+every AI answer by one directive. Sweep for these before investigating
+anything subtler:
+
+- `<meta name="robots" content="noindex">` — out of search AND AI answers
+- `nosnippet` or `max-snippet:0` — nothing may be quoted, which is the same as
+  being uncitable even though the page still ranks
+- an `X-Robots-Tag` response **header** carrying any of the above (easy to miss:
+  it is not in the HTML, so viewing source shows nothing)
+- a staging `robots.txt` that shipped to production with `Disallow: /`
+- in Search Console, the Search generative AI control left off
+
+The usual causes are an SEO plugin default, a staging file promoted by mistake,
+or a "private launch" setting nobody turned back off. `awesomate_site_audit`
+covers the meta and header cases (gate G3); the Search Console control has to be
+checked by the owner in their own account.
+
+Note that blocking `Google-Extended` does **not** remove a site from AI
+Overviews or AI Mode — that control is about training, not answers. Don't
+"fix" it expecting a visibility change.
+
 ## llms.txt rules
 
 - Optional inventory for non-Google assistants — Google ignores it.

package/skill/awesomate-seo/references/answer-structure.md

@@ -0,0 +1,128 @@
+# Writing to be quoted — structure for AI answers
+
+SEO gets a page found. This gets a page **cited**. Answer engines retrieve
+**passages, not pages**: they lift a section, attribute it, and drop the rest.
+So the section — not the page — is the unit of competition, and a section that
+cannot stand alone cannot be quoted.
+
+Run `awesomate_site_audit` to catch the mechanical faults (gate G8). It cannot
+judge whether an answer is any good; that part is a human read.
+
+## The one rule that matters most
+
+**Answer first.** Under every heading, the first 40–60 words must be a
+complete, standalone statement that names the subject.
+
+Roughly **55% of AI Overview citations come from the first 30% of the page**, so
+an answer buried under three paragraphs of preamble is an answer nobody quotes.
+
+```
+Bad:   ## Our pricing
+       It depends on a few things. Every job is different, and we always…
+
+Good:  ## Our pricing
+       Robs Plumbing charges $180 for a standard callout in metropolitan Perth,
+       including the first 30 minutes on site. Emergency after-hours callouts
+       are $290. Quotes for larger jobs are free and fixed.
+```
+
+The second one survives being lifted out of the page. The first one is useless
+the moment it loses its heading.
+
+## Never open a section with a back-reference
+
+"It", "this", "that", "these", "they", "also", "however", "as above", "as
+mentioned". Once a section is extracted, there is no "above" — the subject has
+vanished. Name it again, every time, even when it reads slightly repetitively on
+the page. Repetition is the cost of being quotable, and it is a small cost.
+
+## Section length: 120–180 words
+
+Long enough to answer, short enough to be one clean retrieval unit. A 900-word
+section under one heading competes with itself: the engine has to choose which
+part to lift, and often lifts none of it. Split it and give each part a heading.
+
+## Say the specific thing
+
+Vague copy loses to specific copy, measurably. Adding **quotations from credible
+sources raised a source's share of an AI answer by roughly 41%, statistics by
+about 31%, and citations by about 28%**.
+
+So: real numbers, real dates, named sources, units and currency **inline in the
+sentence** rather than implied by a table header or an image.
+
+```
+Bad:   We serve the whole metro area and have done for years.
+Good:  We service Perth from Joondalup to Rockingham, and have since 2009.
+```
+
+## Comparisons go in a real `<table>`
+
+`<table>` with `<th>`, never styled divs and never an image of a table. A
+comparison rendered as divs is a wall of unlabelled fragments to a parser; an
+image of a price list is invisible to everything. This is the single most
+common way a genuinely useful pricing page fails to get cited.
+
+## Headings: descriptive, with the question phrasing in the first line
+
+The evidence here is genuinely mixed, so hold it loosely:
+
+- **FAQ *schema* shows a small negative correlation** with citations (one
+  analysis: 3.6 citations with it against 4.2 without). The effect is modest and
+  probably confounded — FAQ blocks tend to sit on thin support pages that would
+  earn fewer citations anyway. Google also retired FAQ rich results in May 2026.
+- **Question-shaped *content*, on the other hand, is the extraction unit
+  everyone describes**: a question followed by a 40–80 word answer.
+
+The safe position that satisfies both readings: **plain descriptive headings,
+with the question phrasing carried in the first body line.** You keep the
+question language on the page where models read it, without betting the page on
+FAQ markup.
+
+Keep real FAQs because users want them. Just don't expect the schema to be the
+lever.
+
+## Every schema fact must also be visible
+
+The hard rule, and the one most often broken: **no fact may exist only in
+JSON-LD.** Models read the rendered text; structured data helps machines agree
+on entities, but a phone number, address or price that appears *only* in the
+markup is invisible to the thing you are optimising for.
+
+`awesomate_site_audit` cross-checks this automatically (gate G7b) and lists any
+schema value missing from the page copy. The fix is always **add it to the
+page** — never delete it from the schema.
+
+## Freshness
+
+A visible "Last updated" date, matching `dateModified` in the JSON-LD. Bump it
+only on substantive change; a date that moves nightly while the words stay the
+same is a stale-content signal, not a freshness one.
+
+Sensible cadence: pricing quarterly, comparisons six-monthly, evergreen guides
+annually.
+
+## What not to bother with
+
+- **llms.txt as a priority.** Generate it if it's free — it is one small file —
+  but one study of 137,210 domains found 97% of published files received zero
+  requests, and Google ignores it outright. Never present it as a pillar, and
+  never bill for it.
+- **Speakable schema.** No engine confirms using it.
+- **Hidden text or instructions aimed at crawlers.** Zero measured effect, and
+  classed as spam by both Google and Microsoft.
+- **Mass AI-written listicles.** Hit hard by the August 2026 spam update, and an
+  organic penalty propagates into AI visibility.
+
+## Local businesses: the profile usually outranks the site
+
+For anything with a location or a service area, **Google Business Profile
+supplies about 67% of local citations in AI Overviews** — more than the website
+does. So a correct primary category, the full services list, real hours and
+real photos are higher-leverage than another page of copy.
+
+Keep the name, address and phone **identical** across the site, the profile and
+the main directories for the vertical. Contradictions are what stop an engine
+treating the business as one confident entity. For AU service businesses that
+means ProductReview.com.au plus the relevant trade directories — not a blast to
+hundreds of listing sites, which does nothing.

package/skill/awesomate-support/SKILL.md

@@ -135,7 +135,7 @@ to the Awesomate team, who scope, build, test, and deliver it.
   to do rather than opening a ticket.
 - **A 403 that mentions consent is a toggle, not a bug.** Call
   `awesomate_privacy_settings` to see exactly which toggle is off, name it,
-  and send them to hub.awesomate.ai/n8n/settings. You cannot flip it
+  and send them to hub.awesomate.ai/settings?tab=privacy. You cannot flip it
   for them, and there is deliberately no tool that can.
 
 ## 6. Hard rules