@awesomate/hosting-mcp 0.6.2 → 0.7.0

package/dist/index.js

@@ -2980,7 +2980,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve.call(this, root, ref);
+      let _sch = resolve2.call(this, root, ref);
       if (_sch === void 0) {
         const schema = (_a = root.localRefs) === null || _a === void 0 ? void 0 : _a[ref];
         const { schemaId } = this.opts;
@@ -3007,7 +3007,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve(root, ref) {
+    function resolve2(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -3638,7 +3638,7 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve(baseURI, relativeURI, options) {
+    function resolve2(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const resolved = resolveComponent(parse3(baseURI, schemelessOptions), parse3(relativeURI, schemelessOptions), schemelessOptions, true);
       schemelessOptions.skipEscape = true;
@@ -3902,7 +3902,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize,
-      resolve,
+      resolve: resolve2,
       resolveComponent,
       equal,
       serialize,
@@ -18985,7 +18985,7 @@ var Protocol = class {
           return;
         }
         const pollInterval = task2.pollInterval ?? this._options?.defaultTaskPollInterval ?? 1e3;
-        await new Promise((resolve) => setTimeout(resolve, pollInterval));
+        await new Promise((resolve2) => setTimeout(resolve2, pollInterval));
         options?.signal?.throwIfAborted();
       }
     } catch (error2) {
@@ -19002,7 +19002,7 @@ var Protocol = class {
    */
   request(request, resultSchema, options) {
     const { relatedRequestId, resumptionToken, onresumptiontoken, task, relatedTask } = options ?? {};
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       const earlyReject = (error2) => {
         reject(error2);
       };
@@ -19080,7 +19080,7 @@ var Protocol = class {
           if (!parseResult.success) {
             reject(parseResult.error);
           } else {
-            resolve(parseResult.data);
+            resolve2(parseResult.data);
           }
         } catch (error2) {
           reject(error2);
@@ -19341,12 +19341,12 @@ var Protocol = class {
       }
     } catch {
     }
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       if (signal.aborted) {
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
         return;
       }
-      const timeoutId = setTimeout(resolve, interval);
+      const timeoutId = setTimeout(resolve2, interval);
       signal.addEventListener("abort", () => {
         clearTimeout(timeoutId);
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
@@ -20446,7 +20446,7 @@ var McpServer = class {
     let task = createTaskResult.task;
     const pollInterval = task.pollInterval ?? 5e3;
     while (task.status !== "completed" && task.status !== "failed" && task.status !== "cancelled") {
-      await new Promise((resolve) => setTimeout(resolve, pollInterval));
+      await new Promise((resolve2) => setTimeout(resolve2, pollInterval));
       const updatedTask = await extra.taskStore.getTask(taskId);
       if (!updatedTask) {
         throw new McpError(ErrorCode.InternalError, `Task ${taskId} not found during polling`);
@@ -21095,12 +21095,12 @@ var StdioServerTransport = class {
     this.onclose?.();
   }
   send(message) {
-    return new Promise((resolve) => {
+    return new Promise((resolve2) => {
       const json = serializeMessage(message);
       if (this._stdout.write(json)) {
-        resolve();
+        resolve2();
       } else {
-        this._stdout.once("drain", resolve);
+        this._stdout.once("drain", resolve2);
       }
     });
   }
@@ -21109,43 +21109,168 @@ var StdioServerTransport = class {
 // src/index.ts
 import { readFileSync as readFileSync2 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { join as join2, dirname } from "node:path";
+import { join as join2, dirname as dirname2 } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // src/config.ts
-import { readFileSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { dirname, isAbsolute, join, resolve } from "node:path";
 var DEFAULT_API_BASE = "https://hub.awesomate.ai";
-function loadConfig() {
-  let fileCreds = {};
-  const credPath = join(homedir(), ".awesomate", "credentials.json");
+var PIN_FILENAME = ".awesomate.json";
+function credentialsPath() {
+  return join(homedir(), ".awesomate", "credentials.json");
+}
+function readJsonObject(path, label) {
+  let raw;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch (err) {
+    if (err?.code !== "ENOENT") {
+      console.error(`[awesomate-hosting-mcp] could not read ${label} at ${path}: ${err.message}`);
+    }
+    return null;
+  }
   try {
-    const raw = readFileSync(credPath, "utf8");
     const parsed = JSON.parse(raw);
-    if (parsed && typeof parsed === "object") {
-      fileCreds = parsed;
-    } else {
-      console.error(`[awesomate-hosting-mcp] ${credPath} is not a JSON object \u2014 ignoring it.`);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      return parsed;
     }
+    console.error(`[awesomate-hosting-mcp] ${path} is not a JSON object \u2014 ignoring it.`);
   } catch (err) {
-    if (err?.code && err.code !== "ENOENT") {
-      console.error(
-        `[awesomate-hosting-mcp] could not read ${credPath} (${err.message}) \u2014 falling back to env vars.`
+    console.error(`[awesomate-hosting-mcp] ${path} is not valid JSON (${err.message}) \u2014 ignoring it.`);
+  }
+  return null;
+}
+function readProfiles(credPath = credentialsPath()) {
+  const file = readJsonObject(credPath, "credentials") ?? {};
+  const profiles = {};
+  if (file.profiles && typeof file.profiles === "object") {
+    for (const [key, profile] of Object.entries(file.profiles)) {
+      if (profile && typeof profile === "object" && typeof profile.pat === "string") {
+        profiles[key] = profile;
+      }
+    }
+  } else if (typeof file.pat === "string" && file.pat) {
+    profiles[file.slug || "default"] = {
+      apiBase: file.apiBase,
+      pat: file.pat,
+      contactId: file.contactId,
+      slug: file.slug,
+      email: file.email,
+      plan: file.plan,
+      expiresAt: file.expiresAt,
+      cpanel: file.cpanel,
+      ssh: file.ssh
+    };
+  }
+  const defaultProfile = typeof file.defaultProfile === "string" && profiles[file.defaultProfile] ? file.defaultProfile : null;
+  return { profiles, defaultProfile };
+}
+function findPinFile(startDir = process.cwd()) {
+  const explicit = process.env.AWESOMATE_PIN_FILE;
+  if (explicit) {
+    const path = isAbsolute(explicit) ? explicit : resolve(startDir, explicit);
+    return existsSync(path) ? path : null;
+  }
+  const home = resolve(homedir());
+  let dir = resolve(startDir);
+  for (; ; ) {
+    const candidate = join(dir, PIN_FILENAME);
+    if (existsSync(candidate)) return candidate;
+    if (dir === home) return null;
+    const parent = dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+function profileList(profiles) {
+  const names = Object.keys(profiles);
+  return names.length ? names.join(", ") : "(none \u2014 run Connect Claude Code from hub.awesomate.ai/sites)";
+}
+function fromProfile(key, profile, source, credPath, pinPath, availableProfiles) {
+  const pat = profile.pat ?? "";
+  if (!pat.startsWith("amt_pat_")) {
+    throw new Error(
+      `Profile "${key}" in ${credPath} has a malformed access token \u2014 re-run Connect Claude Code from hub.awesomate.ai/sites for this account.`
+    );
+  }
+  return {
+    apiBase: (process.env.AWESOMATE_API_BASE || profile.apiBase || DEFAULT_API_BASE).replace(/\/$/, ""),
+    pat,
+    account: profile.slug ?? key,
+    email: profile.email ?? null,
+    plan: profile.plan ?? null,
+    expiresAt: profile.expiresAt ?? null,
+    source,
+    credPath,
+    pinPath,
+    availableProfiles
+  };
+}
+function loadConfig() {
+  const credPath = credentialsPath();
+  const { profiles, defaultProfile } = readProfiles(credPath);
+  const available = Object.keys(profiles);
+  const envPat = process.env.AWESOMATE_PAT;
+  if (envPat) {
+    if (!envPat.startsWith("amt_pat_")) {
+      throw new Error("AWESOMATE_PAT does not look like an Awesomate access token (expected amt_pat_ prefix).");
+    }
+    const matched = Object.entries(profiles).find(([, p]) => p.pat === envPat);
+    return {
+      apiBase: (process.env.AWESOMATE_API_BASE || matched?.[1].apiBase || DEFAULT_API_BASE).replace(/\/$/, ""),
+      pat: envPat,
+      account: matched ? matched[1].slug ?? matched[0] : null,
+      email: matched?.[1].email ?? null,
+      plan: matched?.[1].plan ?? null,
+      expiresAt: matched?.[1].expiresAt ?? null,
+      source: "env-pat",
+      credPath,
+      pinPath: null,
+      availableProfiles: available
+    };
+  }
+  const envAccount = process.env.AWESOMATE_ACCOUNT;
+  if (envAccount) {
+    const profile = profiles[envAccount];
+    if (!profile) {
+      throw new Error(
+        `AWESOMATE_ACCOUNT="${envAccount}" has no matching profile in ${credPath}. Available profiles: ${profileList(profiles)}. Connect that account from hub.awesomate.ai/sites (logged in as it) to add its profile.`
       );
     }
+    return fromProfile(envAccount, profile, "env-account", credPath, null, available);
   }
-  const pat = process.env.AWESOMATE_PAT || fileCreds.pat || "";
-  const apiBase = (process.env.AWESOMATE_API_BASE || fileCreds.apiBase || DEFAULT_API_BASE).replace(/\/$/, "");
-  if (!pat) {
+  const pinPath = findPinFile();
+  if (pinPath) {
+    const pin = readJsonObject(pinPath, "project pin");
+    const account = pin && typeof pin.account === "string" ? pin.account : null;
+    if (!account) {
+      throw new Error(`${pinPath} exists but has no "account" field. Expected: {"account": "<slug>"}.`);
+    }
+    const profile = profiles[account];
+    if (!profile) {
+      throw new Error(
+        `This folder is pinned to account "${account}" (${pinPath}) but no matching profile exists in ${credPath}. Available profiles: ${profileList(profiles)}. Fix the pin, or connect "${account}" from hub.awesomate.ai/sites while logged into that account.`
+      );
+    }
+    return fromProfile(account, profile, "pin", credPath, pinPath, available);
+  }
+  if (available.length === 1) {
+    const key = available[0];
+    return fromProfile(key, profiles[key], "sole-profile", credPath, null, available);
+  }
+  if (defaultProfile) {
+    return fromProfile(defaultProfile, profiles[defaultProfile], "default-profile", credPath, null, available);
+  }
+  if (available.length === 0) {
     throw new Error(
-      "No Awesomate access token found. Set AWESOMATE_PAT or run the bootstrap from the hub Sites page (it writes ~/.awesomate/credentials.json)."
+      `No Awesomate access token found. Set AWESOMATE_PAT or run Connect Claude Code from hub.awesomate.ai/sites (it writes ${credPath}).`
     );
   }
-  if (!pat.startsWith("amt_pat_")) {
-    throw new Error("AWESOMATE_PAT does not look like an Awesomate access token (expected amt_pat_ prefix).");
-  }
-  return { apiBase, pat };
+  throw new Error(
+    `Multiple Awesomate accounts are connected (${profileList(profiles)}) but this folder isn't pinned to one. Create a ${PIN_FILENAME} in the project root with {"account": "<slug>"}, set AWESOMATE_ACCOUNT, or set defaultProfile in credentials.json.`
+  );
 }
 
 // src/http.ts
@@ -21219,11 +21344,22 @@ function hubDelete(config3, path) {
 }
 
 // src/index.ts
-var config2;
+var config2 = null;
+var configError = null;
+function requireConfig() {
+  if (!config2) {
+    throw new Error(configError ?? "Awesomate account not configured.");
+  }
+  return config2;
+}
+function accountStamp() {
+  if (!config2) return `account: NOT CONNECTED \u2014 ${configError ?? "unknown error"}`;
+  return `account: ${config2.account ?? "unknown (env PAT not matched to a profile)"} (source: ${config2.source})`;
+}
 var SERVER_VERSION = (() => {
   try {
     const pkg = JSON.parse(
-      readFileSync2(join2(dirname(fileURLToPath(import.meta.url)), "..", "package.json"), "utf8")
+      readFileSync2(join2(dirname2(fileURLToPath(import.meta.url)), "..", "package.json"), "utf8")
     );
     return pkg.version ?? "0.0.0";
   } catch {
@@ -21250,21 +21386,48 @@ var server = new McpServer({
   version: SERVER_VERSION
 });
 function textResult(data) {
-  return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
+  return {
+    content: [{ type: "text", text: `${accountStamp()}
+${JSON.stringify(data, null, 2)}` }]
+  };
 }
 function errorResult(err) {
   const message = err instanceof Error ? err.message : String(err);
-  return { content: [{ type: "text", text: message }], isError: true };
+  return { content: [{ type: "text", text: `${accountStamp()}
+${message}` }], isError: true };
 }
 function readTool(name, description, path) {
   server.registerTool(name, { description, inputSchema: {} }, async () => {
     try {
-      return textResult(await hubGet(config2, path));
+      return textResult(await hubGet(requireConfig(), path));
     } catch (err) {
       return errorResult(err);
     }
   });
 }
+server.registerTool(
+  "awesomate_whoami",
+  {
+    description: "Zero-network identity check: which Awesomate account this session is connected to (slug, plan, token expiry) and WHY (env var, project pin file, sole profile, or default). Call it after connecting, after switching folders, and any time the account in play matters \u2014 if the slug is not the account the user expects, STOP and fix the pin/connection before doing any work.",
+    inputSchema: {}
+  },
+  async () => {
+    if (!config2) {
+      return errorResult(new Error(configError ?? "Awesomate account not configured."));
+    }
+    return textResult({
+      account: config2.account,
+      email: config2.email,
+      plan: config2.plan,
+      tokenExpiresAt: config2.expiresAt,
+      apiBase: config2.apiBase,
+      source: config2.source,
+      credentialsFile: config2.credPath,
+      pinFile: config2.pinPath,
+      availableProfiles: config2.availableProfiles
+    });
+  }
+);
 server.registerTool(
   "awesomate_get_context",
   {
@@ -21273,7 +21436,7 @@ server.registerTool(
   },
   async () => {
     try {
-      const ctx = await hubGet(config2, "/api/hosting-access/context");
+      const ctx = await hubGet(requireConfig(), "/api/hosting-access/context");
       return textResult({ ...ctx, skill: skillUpdateInfo() });
     } catch (err) {
       return errorResult(err);
@@ -21300,21 +21463,21 @@ server.registerTool(
   async ({ action, workflowJson, workflowId, draftId, operationId }) => {
     try {
       if (action === "validate") {
-        return textResult(await hubPost(config2, "/api/my-n8n/machine/workflows/validate", { workflow: workflowJson }));
+        return textResult(await hubPost(requireConfig(), "/api/my-n8n/machine/workflows/validate", { workflow: workflowJson }));
       }
       if (action === "create_draft") {
-        return textResult(await hubPost(config2, "/api/my-n8n/machine/workflows/draft", workflowJson ?? {}));
+        return textResult(await hubPost(requireConfig(), "/api/my-n8n/machine/workflows/draft", workflowJson ?? {}));
       }
       if (action === "rollback") {
         if (!operationId) return errorResult(new Error("operationId is required for rollback"));
         return textResult(
-          await hubPost(config2, `/api/my-n8n/machine/operations/${encodeURIComponent(operationId)}/rollback`, {})
+          await hubPost(requireConfig(), `/api/my-n8n/machine/operations/${encodeURIComponent(operationId)}/rollback`, {})
         );
       }
       if (!workflowId) return errorResult(new Error(`workflowId is required for ${action}`));
       if (action === "activate" || action === "deactivate") {
         return textResult(
-          await hubPost(config2, `/api/my-n8n/machine/workflows/${encodeURIComponent(workflowId)}/activate`, {
+          await hubPost(requireConfig(), `/api/my-n8n/machine/workflows/${encodeURIComponent(workflowId)}/activate`, {
             active: action === "activate"
           })
         );
@@ -21322,11 +21485,11 @@ server.registerTool(
       if (action === "promote") {
         if (!draftId) return errorResult(new Error("draftId is required for promote"));
         return textResult(
-          await hubPost(config2, `/api/my-n8n/machine/workflows/${encodeURIComponent(workflowId)}/promote`, { draftId })
+          await hubPost(requireConfig(), `/api/my-n8n/machine/workflows/${encodeURIComponent(workflowId)}/promote`, { draftId })
         );
       }
       return textResult(
-        await hubDelete(config2, `/api/my-n8n/machine/workflows/${encodeURIComponent(workflowId)}`)
+        await hubDelete(requireConfig(), `/api/my-n8n/machine/workflows/${encodeURIComponent(workflowId)}`)
       );
     } catch (err) {
       return errorResult(err);
@@ -21345,7 +21508,7 @@ server.registerTool(
   async ({ workflowId, payload }) => {
     try {
       return textResult(
-        await hubPost(config2, `/api/my-n8n/machine/workflows/${encodeURIComponent(workflowId)}/test-fire`, { payload })
+        await hubPost(requireConfig(), `/api/my-n8n/machine/workflows/${encodeURIComponent(workflowId)}/test-fire`, { payload })
       );
     } catch (err) {
       return errorResult(err);
@@ -21406,7 +21569,7 @@ server.registerTool(
   async ({ domain, reason }) => {
     try {
       return textResult(
-        await hubPost(config2, `/api/hosting-access/sites/${encodeURIComponent(domain)}/snapshot`, { reason })
+        await hubPost(requireConfig(), `/api/hosting-access/sites/${encodeURIComponent(domain)}/snapshot`, { reason })
       );
     } catch (err) {
       return errorResult(err);
@@ -21421,7 +21584,7 @@ server.registerTool(
   },
   async ({ domain }) => {
     try {
-      return textResult(await hubGet(config2, `/api/hosting-access/sites/${encodeURIComponent(domain)}/snapshots`));
+      return textResult(await hubGet(requireConfig(), `/api/hosting-access/sites/${encodeURIComponent(domain)}/snapshots`));
     } catch (err) {
       return errorResult(err);
     }
@@ -21439,7 +21602,7 @@ server.registerTool(
   async ({ domain, snapshotId }) => {
     try {
       return textResult(
-        await hubPost(config2, `/api/hosting-access/sites/${encodeURIComponent(domain)}/rollback`, { snapshotId })
+        await hubPost(requireConfig(), `/api/hosting-access/sites/${encodeURIComponent(domain)}/rollback`, { snapshotId })
       );
     } catch (err) {
       return errorResult(err);
@@ -21447,10 +21610,15 @@ server.registerTool(
   }
 );
 async function main() {
-  config2 = loadConfig();
+  try {
+    config2 = loadConfig();
+  } catch (err) {
+    configError = err instanceof Error ? err.message : String(err);
+    console.error(`[awesomate-hosting-mcp] account not resolved: ${configError}`);
+  }
   const transport = new StdioServerTransport();
   await server.connect(transport);
-  console.error("[awesomate-hosting-mcp] connected (stdio)");
+  console.error(`[awesomate-hosting-mcp] connected (stdio) \u2014 ${accountStamp()}`);
 }
 main().catch((err) => {
   console.error(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awesomate/hosting-mcp",
-  "version": "0.6.2",
+  "version": "0.7.0",
   "description": "Awesomate MCP server — lets Claude manage your Awesomate WordPress hosting, plan, limits, and n8n automations",
   "license": "UNLICENSED",
   "type": "module",
@@ -19,7 +19,8 @@
   "scripts": {
     "build": "esbuild src/index.ts --bundle --platform=node --target=node18 --format=esm --outfile=dist/index.js --banner:js='#!/usr/bin/env node' --external:node:*",
     "typecheck": "tsc --noEmit",
-    "prepublishOnly": "npm run typecheck && npm run build"
+    "test": "esbuild src/config.ts --bundle --platform=node --target=node18 --format=esm --outfile=test/.build/config.mjs --external:node:* && node --test test/",
+    "prepublishOnly": "npm run typecheck && npm run test && npm run build"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",

package/skill/awesomate-hosting/SKILL.md

@@ -24,8 +24,14 @@ generation, defer to WordPress Studio and any installed WordPress skills
 
 ## 0. First run — orient before acting
 
-On the first hosting request in a session, call **`awesomate_get_context`** once
-(then `awesomate_get_limits` if you're about to create/change anything). From the
+On the first hosting request in a session, call **`awesomate_whoami`** — it's
+zero-network and tells you WHICH account this folder is connected to and why
+(`source`: a `.awesomate.json` folder pin, `AWESOMATE_ACCOUNT`, the sole
+profile, or the default profile). **If the slug isn't the account the user is
+talking about, stop and fix the connection before doing any work** — every
+subsequent tool response is stamped with `account: <slug> (source: …)`; treat a
+mismatch there the same way. Then call **`awesomate_get_context`** once (then
+`awesomate_get_limits` if you're about to create/change anything). From the
 context note three things and cache them for the session:
 
 - **`plan`** and **`capabilities.shell`** — this decides which branch below you're on.
@@ -41,13 +47,39 @@ context note three things and cache them for the session:
 If `awesomate_get_context` fails with a connectivity error, it's the user's
 network or the API base — not an auth problem; say so.
 
+### Multiple accounts on one machine
+
+`~/.awesomate/credentials.json` can hold several account **profiles** (one per
+slug), and each project folder is bound to one via a committable
+`.awesomate.json` pin (`{"account": "<slug>"}`) written by the bootstrap in the
+folder it ran in. Resolution order: `AWESOMATE_PAT` env → `AWESOMATE_ACCOUNT`
+env → nearest folder pin (walking up, stopping at `$HOME`) → sole profile →
+`defaultProfile`. A pin naming a missing profile is a **hard error, never a
+fallback** — that's deliberate.
+
+- **Wrong account connected?** Compare `awesomate_whoami` against the folder's
+  `.awesomate.json`. Fix by editing the pin (if the profile exists) or by
+  running Connect Claude Code from the hub **while logged into the right hub
+  account, from the right folder** — the connect command carries
+  `--account <slug>` and the bootstrap aborts on a mismatch instead of storing
+  anything.
+- **"Multiple accounts … folder isn't pinned" error?** Create the pin file or
+  set `AWESOMATE_ACCOUNT`. Don't guess an account for the user.
+- Connecting a second account never disconnects the first; re-pairing an
+  account just refreshes its profile.
+- The bootstrap prints a final `AWESOMATE CONNECT: SUCCESS account=<slug>` (or
+  `FAILED reason=…`) sentinel — when a connect ran as a `!` bang command, check
+  for that line instead of assuming success from silence.
+
 If this skill is loaded but **no `awesomate_*` tools exist in the session at
 all**, the MCP server was registered after Claude Code started (the bootstrap
 just ran). Don't investigate settings files or reinstall anything — and don't
 make a restart the precondition for showing the user their own data. The
-skill works right now over REST: read `apiBase` and `pat` from
-`~/.awesomate/credentials.json` (never echo the pat into the conversation)
-and GET with `Authorization: Bearer <pat>`:
+skill works right now over REST — resolve the ACTIVE profile first (run
+`node ~/.claude/skills/awesomate-hosting/scripts/resolve-account.mjs --api` to
+get `API`/`PAT`/`ACCT`; never read top-level `pat` directly when a `profiles`
+map exists, and never echo the pat into the conversation) and GET with
+`Authorization: Bearer <pat>`:
 
 | MCP tool | REST equivalent |
 |---|---|

package/skill/awesomate-hosting/scripts/bootstrap.mjs

@@ -3,23 +3,28 @@
  * Awesomate Hosting — one-time bootstrap.
  *
  * Redeems the single-use setup code from the hub's "Connect Claude Code" prompt
- * for a durable, scoped access token; stores it locally; and (on Support Plus+)
+ * for a durable, scoped access token; stores it as a PROFILE (multi-account
+ * safe); pins the current folder to that account; and (on Support Plus+)
  * generates an SSH keypair and authorizes the PUBLIC key on the client's own
  * cPanel account. The private key never leaves this machine; the setup code is
  * the only secret that ever crossed the clipboard, and it's single-use + short-
- * lived.
+ * lived. The access token itself is never printed.
  *
  * Usage (Claude runs this — the user doesn't touch a terminal):
- *   node bootstrap.mjs --code amt_bs_XXXX [--api https://hub.awesomate.ai]
+ *   node bootstrap.mjs --code amt_bs_XXXX [--account <slug>] [--api https://hub.awesomate.ai]
+ *
+ * --account asserts WHICH account the code is expected to connect. If the
+ * redeemed identity doesn't match, the bootstrap aborts before writing
+ * anything — connecting the wrong account loudly beats connecting it silently.
  *
  * Dependency-free: Node 18+ built-ins only (global fetch, node:fs/os/path,
- * child_process for ssh-keygen).
+ * child_process for ssh-keygen + the claude CLI).
  */
 
 import { execFileSync } from 'node:child_process';
 import { existsSync, mkdirSync, writeFileSync, chmodSync, readFileSync, cpSync, readdirSync } from 'node:fs';
 import { homedir, hostname } from 'node:os';
-import { join, dirname } from 'node:path';
+import { join, dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 function arg(name, fallback) {
@@ -28,9 +33,11 @@ function arg(name, fallback) {
 }
 
 const code = arg('code');
+const expectedAccount = arg('account', null);
 const apiBase = (arg('api', 'https://hub.awesomate.ai')).replace(/\/$/, '');
 if (!code || !code.startsWith('amt_bs_')) {
   console.error('Missing/invalid --code. Copy a fresh setup prompt from hub.awesomate.ai/sites.');
+  console.error('AWESOMATE CONNECT: FAILED reason=bad-code');
   process.exit(1);
 }
 
@@ -38,11 +45,16 @@ const dir = join(homedir(), '.awesomate');
 const keysDir = join(dir, 'keys');
 const credPath = join(dir, 'credentials.json');
 const keyPath = join(keysDir, 'id_ed25519');
+const PIN_FILENAME = '.awesomate.json';
 
-async function post(path, { body, token } = {}) {
+async function request(method, path, { body, token } = {}) {
   const headers = { 'Content-Type': 'application/json' };
   if (token) headers.Authorization = `Bearer ${token}`;
-  const res = await fetch(`${apiBase}${path}`, { method: 'POST', headers, body: JSON.stringify(body ?? {}) });
+  const res = await fetch(`${apiBase}${path}`, {
+    method,
+    headers,
+    body: method === 'GET' ? undefined : JSON.stringify(body ?? {}),
+  });
   const text = await res.text();
   let json;
   try { json = text ? JSON.parse(text) : null; } catch { json = text; }
@@ -52,12 +64,84 @@ async function post(path, { body, token } = {}) {
   }
   return json;
 }
+const post = (path, opts) => request('POST', path, opts);
+const get = (path, opts) => request('GET', path, opts);
+
+function readJsonFile(path) {
+  try {
+    const parsed = JSON.parse(readFileSync(path, 'utf8'));
+    return parsed && typeof parsed === 'object' ? parsed : null;
+  } catch { return null; }
+}
+
+/**
+ * Merge one account profile into credentials.json (v2 multi-profile shape).
+ * Existing profiles for OTHER accounts are preserved — connecting a second
+ * account must never disconnect the first. Top-level v1 fields are kept as a
+ * mirror of the default profile because already-installed skill scripts
+ * (ssh-connect.sh / deploy.sh / pull-live.sh copies from older versions) read
+ * them directly until the skill is refreshed.
+ */
+function mergeProfile(profile) {
+  const existing = readJsonFile(credPath) ?? {};
+  const profiles = { ...(existing.profiles ?? {}) };
+
+  // v1 file: lift the old top-level account into the profiles map first so it
+  // survives this connect.
+  if (!existing.profiles && typeof existing.pat === 'string' && existing.pat) {
+    const legacyKey = existing.slug || 'default';
+    profiles[legacyKey] = {
+      apiBase: existing.apiBase, pat: existing.pat, contactId: existing.contactId,
+      slug: existing.slug, email: existing.email, plan: existing.plan,
+      expiresAt: existing.expiresAt, cpanel: existing.cpanel, ssh: existing.ssh,
+    };
+  }
+
+  profiles[profile.slug] = { ...(profiles[profile.slug] ?? {}), ...profile };
+
+  let defaultProfile = existing.defaultProfile;
+  if (defaultProfile && !profiles[defaultProfile]) defaultProfile = undefined;
+  if (!defaultProfile && Object.keys(profiles).length === 1) defaultProfile = profile.slug;
+  if (existing.defaultProfile && existing.defaultProfile !== profile.slug && profiles[existing.defaultProfile]) {
+    console.log(`• defaultProfile stays "${existing.defaultProfile}" — this folder is pinned to "${profile.slug}" instead.`);
+  }
+
+  // The v1 mirror follows the default profile when one is set; otherwise the
+  // account just connected (matching the old last-connect-wins behavior for
+  // legacy readers, without losing the other profiles).
+  const mirrorSource = (defaultProfile && profiles[defaultProfile]) || profile;
+  const creds = {
+    version: 2,
+    ...(defaultProfile ? { defaultProfile } : {}),
+    profiles,
+    apiBase: mirrorSource.apiBase, pat: mirrorSource.pat, contactId: mirrorSource.contactId,
+    slug: mirrorSource.slug, email: mirrorSource.email ?? null, plan: mirrorSource.plan,
+    cpanel: mirrorSource.cpanel ?? null, expiresAt: mirrorSource.expiresAt ?? null,
+    ...(mirrorSource.ssh ? { ssh: mirrorSource.ssh } : {}),
+  };
 
-function writeCreds(creds) {
   mkdirSync(dir, { recursive: true, mode: 0o700 });
   chmodSync(dir, 0o700);
   writeFileSync(credPath, JSON.stringify(creds, null, 2));
   chmodSync(credPath, 0o600);
+  return creds;
+}
+
+/** Pin the folder bootstrap ran in to this account. Never pins $HOME. */
+function writePin(slug) {
+  const cwd = resolve(process.cwd());
+  if (cwd === resolve(homedir())) {
+    console.log(`• Running from the home directory — not writing a ${PIN_FILENAME} pin. Re-run Connect from the project folder to pin it.`);
+    return null;
+  }
+  const pinPath = join(cwd, PIN_FILENAME);
+  const existing = readJsonFile(pinPath);
+  if (existing?.account && existing.account !== slug) {
+    console.log(`• Re-pinning this folder: ${existing.account} → ${slug}.`);
+  }
+  writeFileSync(pinPath, `${JSON.stringify({ version: 1, account: slug }, null, 2)}\n`);
+  console.log(`✓ Pinned ${cwd} to account "${slug}" (${PIN_FILENAME}).`);
+  return pinPath;
 }
 
 /**
@@ -119,23 +203,116 @@ function installSkill() {
   return true;
 }
 
+function claudeCli(args) {
+  return execFileSync('claude', args, { stdio: ['ignore', 'pipe', 'pipe'], encoding: 'utf8' });
+}
+
+const MANUAL_ADD =
+  'claude mcp add --scope user awesomate-hosting -- npx -y -p @awesomate/hosting-mcp awesomate-hosting-mcp';
+
+/**
+ * Converge on exactly one env-free, user-scope MCP registration.
+ *
+ * Legacy bootstraps baked AWESOMATE_PAT into the registration env — env beats
+ * credentials.json inside the server, so those registrations keep serving a
+ * STALE account forever after a re-pair. Remove every registration that
+ * carries the env var (user scope, plus this project's .mcp.json / local
+ * scope), then add the clean one. Registrations in OTHER projects' local
+ * scopes can't be removed from here — those are reported for manual cleanup.
+ *
+ * Throws on failure: a wrong registration is exactly the silent-wrong-account
+ * bug this bootstrap exists to prevent.
+ */
+function ensureMcpRegistration() {
+  const cwd = resolve(process.cwd());
+  const claudeConfig = readJsonFile(join(homedir(), '.claude.json')) ?? {};
+  const warnings = [];
+
+  const scopesToClean = [];
+  if (claudeConfig.mcpServers?.['awesomate-hosting']?.env?.AWESOMATE_PAT) scopesToClean.push('user');
+  if (readJsonFile(join(cwd, '.mcp.json'))?.mcpServers?.['awesomate-hosting']?.env?.AWESOMATE_PAT) scopesToClean.push('project');
+  for (const [projectDir, project] of Object.entries(claudeConfig.projects ?? {})) {
+    if (!project?.mcpServers?.['awesomate-hosting']?.env?.AWESOMATE_PAT) continue;
+    if (resolve(projectDir) === cwd) scopesToClean.push('local');
+    else warnings.push(`cd ${projectDir} && claude mcp remove awesomate-hosting -s local`);
+  }
+
+  for (const scope of scopesToClean) {
+    claudeCli(['mcp', 'remove', 'awesomate-hosting', '-s', scope]);
+    console.log(`✓ Removed legacy ${scope}-scope registration (had a token baked into its env).`);
+  }
+
+  const userEntry = claudeConfig.mcpServers?.['awesomate-hosting'];
+  const userEntryIsClean =
+    userEntry && !userEntry.env?.AWESOMATE_PAT && !scopesToClean.includes('user') &&
+    JSON.stringify(userEntry.args ?? []).includes('awesomate-hosting-mcp');
+  if (userEntryIsClean) {
+    console.log('✓ MCP server already registered (user scope, env-free) — account selection comes from the folder pin.');
+  } else {
+    if (userEntry && !scopesToClean.includes('user')) {
+      // Exists but is odd (wrong command, partial env) — replace it.
+      try { claudeCli(['mcp', 'remove', 'awesomate-hosting', '-s', 'user']); } catch { /* may not exist at this scope */ }
+    }
+    claudeCli(['mcp', 'add', '--scope', 'user', 'awesomate-hosting', '--',
+      'npx', '-y', '-p', '@awesomate/hosting-mcp', 'awesomate-hosting-mcp']);
+    console.log('✓ Registered the Awesomate Hosting MCP server (user scope, env-free — the folder pin picks the account).');
+  }
+
+  for (const w of warnings) {
+    console.log(`• Another project still has a legacy registration with a baked-in token. From that project run:\n    ${w}`);
+  }
+}
+
 async function main() {
   console.log(`Redeeming setup code against ${apiBase} …`);
   const redeemed = await post('/api/hosting-access/redeem', {
     body: { code, machineLabel: `Claude Code on ${hostname()}` },
   });
 
-  const creds = {
+  const slug = redeemed.slug ?? null;
+  if (!slug) {
+    console.error('The hub did not return an account slug for this code — cannot safely store a profile. Contact Awesomate support.');
+    console.error('AWESOMATE CONNECT: FAILED reason=no-slug');
+    process.exit(1);
+  }
+  // Wrong-account guard: abort BEFORE writing anything.
+  if (expectedAccount && expectedAccount !== slug) {
+    console.error(`This setup code belongs to account "${slug}" but this connect was for "${expectedAccount}".`);
+    console.error(`You are probably logged into the wrong hub account — log into ${expectedAccount}'s hub account and copy a fresh Connect prompt.`);
+    console.error(`AWESOMATE CONNECT: FAILED reason=account-mismatch expected=${expectedAccount} got=${slug}`);
+    process.exit(1);
+  }
+
+  // Server-side identity check with the NEW token before trusting it.
+  let context = null;
+  try {
+    context = await get('/api/hosting-access/context', { token: redeemed.pat });
+  } catch (err) {
+    console.error(`Token verification failed (${err.message}) — not storing it. Re-run with a fresh code from hub.awesomate.ai/sites.`);
+    console.error('AWESOMATE CONNECT: FAILED reason=verify-failed');
+    process.exit(1);
+  }
+  const ctxSlug = context?.slug ?? context?.account?.slug ?? null;
+  if (ctxSlug && ctxSlug !== slug) {
+    console.error(`Identity mismatch: redeem said "${slug}" but the token resolves to "${ctxSlug}". Not storing it — contact Awesomate support.`);
+    console.error('AWESOMATE CONNECT: FAILED reason=identity-mismatch');
+    process.exit(1);
+  }
+
+  const profile = {
     apiBase,
     pat: redeemed.pat,
     contactId: redeemed.contactId,
-    slug: redeemed.slug ?? null,
+    slug,
+    email: redeemed.email ?? context?.email ?? context?.account?.email ?? null,
     plan: redeemed.plan,
     cpanel: redeemed.cpanel ?? null,
     expiresAt: redeemed.expiresAt ?? null,
   };
-  writeCreds(creds);
-  console.log(`✓ Access token stored at ${credPath} (chmod 600). Plan: ${redeemed.plan}.`);
+  mergeProfile(profile);
+  console.log(`✓ Access token stored as profile "${slug}" in ${credPath} (chmod 600). Plan: ${redeemed.plan}.`);
+
+  const pinPath = writePin(slug);
 
   // Install the skill + register the MCP server FIRST — these always work and
   // don't depend on hosting being fully provisioned. SSH comes last so that a
@@ -144,19 +321,13 @@ async function main() {
     console.log(`• Could not auto-install the skill (${err.message}) — continuing; you can copy skill/ manually.`);
   }
 
-  // Register the MCP server. Prefer the Claude CLI if present; otherwise print
-  // the config for Claude to apply.
-  const cmd = `claude mcp add awesomate-hosting --env AWESOMATE_PAT=${redeemed.pat} --env AWESOMATE_API_BASE=${apiBase} -- npx -y -p @awesomate/hosting-mcp awesomate-hosting-mcp`;
-  let registered = false;
   try {
-    execFileSync('claude', ['mcp', 'add', 'awesomate-hosting', '--env', `AWESOMATE_PAT=${redeemed.pat}`, '--env', `AWESOMATE_API_BASE=${apiBase}`, '--', 'npx', '-y', '-p', '@awesomate/hosting-mcp', 'awesomate-hosting-mcp'], { stdio: 'ignore' });
-    registered = true;
-    console.log('✓ Registered the Awesomate Hosting MCP server with Claude Code.');
-  } catch {
-    console.log('\nAdd the Awesomate Hosting MCP server to this project — run:');
-    console.log(`  ${cmd}`);
-    console.log('…or add to .mcp.json:');
-    console.log(JSON.stringify({ mcpServers: { 'awesomate-hosting': { command: 'npx', args: ['-y', '-p', '@awesomate/hosting-mcp', 'awesomate-hosting-mcp'], env: { AWESOMATE_PAT: redeemed.pat, AWESOMATE_API_BASE: apiBase } } } }, null, 2));
+    ensureMcpRegistration();
+  } catch (err) {
+    console.error(`MCP registration failed: ${err.message}`);
+    console.error(`Register it manually (no token goes in the command — the folder pin picks the account):\n  ${MANUAL_ADD}`);
+    console.error(`AWESOMATE CONNECT: FAILED reason=mcp-registration account=${slug}`);
+    process.exit(1);
   }
 
   // SSH key (Support Plus+): best-effort. If it fails (e.g. hosting not fully
@@ -166,7 +337,7 @@ async function main() {
     try {
       if (!existsSync(keyPath)) {
         mkdirSync(keysDir, { recursive: true, mode: 0o700 });
-        execFileSync('ssh-keygen', ['-t', 'ed25519', '-f', keyPath, '-N', '', '-C', `awesomate:${redeemed.slug ?? 'site'}`], { stdio: 'ignore' });
+        execFileSync('ssh-keygen', ['-t', 'ed25519', '-f', keyPath, '-N', '', '-C', `awesomate:${slug}`], { stdio: 'pipe' });
         chmodSync(keyPath, 0o600);
       }
       const publicKey = readFileSync(`${keyPath}.pub`, 'utf8').trim();
@@ -174,8 +345,8 @@ async function main() {
         token: redeemed.pat,
         body: { publicKey, label: `Claude Code on ${hostname()}` },
       });
-      creds.ssh = { host: reg.sshHost, user: reg.sshUser, port: reg.sshPort ?? 22, keyPath, fingerprint: reg.fingerprint };
-      writeCreds(creds);
+      profile.ssh = { host: reg.sshHost, user: reg.sshUser, port: reg.sshPort ?? 22, keyPath, fingerprint: reg.fingerprint };
+      mergeProfile(profile);
       console.log(`✓ SSH key authorized on ${reg.sshUser}@${reg.sshHost} (jailed to your account).`);
     } catch (err) {
       console.log(`• SSH key not registered yet: ${err.message}`);
@@ -185,12 +356,16 @@ async function main() {
     console.log('• Plan has no shell access — read/status mode. Upgrade to Support Plus for SSH + deploy.');
   }
 
-  console.log('\nSetup complete. Next: ask me to read your plan, list your sites, and tell you what we can do.');
-  if (!registered) console.log('(The skill works in your current Claude session right away via its REST fallback — restart Claude Code when convenient to load the MCP tools.)');
+  const who = profile.email ? `${slug} (${profile.email}, plan ${redeemed.plan})` : `${slug} (plan ${redeemed.plan})`;
+  console.log(`\n✓ Connected: ${who}${pinPath ? ` — pinned ${dirname(pinPath)}` : ''}`);
+  console.log('Setup complete. Next: run awesomate_whoami to confirm the account, then ask me to read your plan and list your sites.');
+  console.log('(The skill works in your current Claude session right away via its REST fallback — restart Claude Code when convenient to load the MCP tools.)');
+  console.log(`AWESOMATE CONNECT: SUCCESS account=${slug} pin=${pinPath ?? 'none'}`);
 }
 
 main().catch((err) => {
   console.error('Bootstrap failed:', err.message);
   console.error('If the code expired or was already used, grab a fresh one from hub.awesomate.ai/sites.');
+  console.error('AWESOMATE CONNECT: FAILED reason=error');
   process.exit(1);
 });

package/skill/awesomate-hosting/scripts/deploy.sh

@@ -52,18 +52,17 @@ done
   echo "--from wp-content looks empty (no themes/ or plugins/). Refusing to --delete against live."; exit 1; }
 case "$DOMAIN" in *[!a-z0-9.-]*|"") echo "Invalid --domain."; exit 1;; esac
 
-# Read connection details + PAT (node is present wherever the MCP runs).
-# Capture first, THEN eval — so a no-shell plan (node exits 2) aborts here with
-# its own message instead of leaving $U/$P/… unset for `set -u` to trip on later.
-if ! CREDS_EVAL="$(node -e '
-const c = require(process.env.HOME + "/.awesomate/credentials.json");
-if (!c.ssh) { console.error("Your plan does not include shell access (Support Plus+ required)."); process.exit(2); }
-const q = (s) => "'"'"'" + String(s == null ? "" : s).replace(/'"'"'/g, "") + "'"'"'";
-console.log(`H=${q(c.ssh.host)}; U=${q(c.ssh.user)}; P=${q(c.ssh.port||22)}; K=${q(c.ssh.keyPath)}; API=${q(c.apiBase)}; PAT=${q(c.pat)}`);
-')"; then
+# Resolve the account (folder pin / AWESOMATE_ACCOUNT / sole profile) and its
+# connection details + PAT via the shared resolver (node is present wherever
+# the MCP runs). Capture first, THEN eval — so a resolver failure (no-shell
+# plan exits 2, unpinned multi-account exits 1) aborts here with its own
+# message instead of leaving $U/$P/… unset for `set -u` to trip on later.
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+if ! CREDS_EVAL="$(node "$SCRIPT_DIR/resolve-account.mjs" --ssh --api)"; then
   exit 1
 fi
 eval "$CREDS_EVAL"
+echo "→ account: $ACCT"
 
 # Harden every credentials-derived field BEFORE it reaches ssh/rsync/scp. rsync
 # re-tokenizes its -e remote-shell string on whitespace (ignoring shell quotes),

package/skill/awesomate-hosting/scripts/pull-live.sh

@@ -25,15 +25,13 @@ done
 [ -n "$DOMAIN" ] && [ -n "$TO" ] || { echo "Usage: pull-live.sh --domain <live-domain> --to <local-dir> [--docroot PATH]"; exit 1; }
 case "$DOMAIN" in *[!a-z0-9.-]*|"") echo "Invalid --domain."; exit 1;; esac
 
-if ! CREDS_EVAL="$(node -e '
-const c = require(process.env.HOME + "/.awesomate/credentials.json");
-if (!c.ssh) { console.error("Your plan does not include shell access (Support Plus+ required)."); process.exit(2); }
-const q = (s) => "'"'"'" + String(s == null ? "" : s).replace(/'"'"'/g, "") + "'"'"'";
-console.log(`H=${q(c.ssh.host)}; U=${q(c.ssh.user)}; P=${q(c.ssh.port||22)}; K=${q(c.ssh.keyPath)}`);
-')"; then
+# Shared resolver: folder pin / AWESOMATE_ACCOUNT / sole profile → ssh block.
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+if ! CREDS_EVAL="$(node "$SCRIPT_DIR/resolve-account.mjs" --ssh)"; then
   exit 1
 fi
 eval "$CREDS_EVAL"
+echo "→ account: $ACCT"
 
 # Harden credentials-derived fields before they reach rsync/scp/ssh — rsync
 # word-splits its -e remote-shell string, so whitespace here could inject ssh

package/skill/awesomate-hosting/scripts/resolve-account.mjs

@@ -0,0 +1,100 @@
+#!/usr/bin/env node
+/**
+ * Shared account resolver for the awesomate-hosting skill scripts.
+ *
+ * Mirrors the MCP server's precedence exactly (mcp/src/config.ts):
+ *   AWESOMATE_ACCOUNT env → .awesomate.json pin (walked up from cwd, stopping
+ *   at $HOME) → sole profile → defaultProfile → legacy v1 top-level fields.
+ * A pin naming a missing profile is a hard error — never a silent fallback.
+ *
+ * Prints shell-eval assignments (single-quoted, quote-stripped values — same
+ * hardening contract the callers' charclass gates assume):
+ *   node resolve-account.mjs --ssh   # ACCT + H/U/P/K
+ *   node resolve-account.mjs --api   # ACCT + API/PAT
+ * Flags combine. Exit 1 = no resolvable account, exit 2 = no shell access.
+ */
+
+import { existsSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join, dirname, resolve } from 'node:path';
+
+function readJson(path) {
+  try {
+    const parsed = JSON.parse(readFileSync(path, 'utf8'));
+    return parsed && typeof parsed === 'object' ? parsed : null;
+  } catch { return null; }
+}
+
+function fail(msg, code = 1) { console.error(msg); process.exit(code); }
+
+const credPath = join(homedir(), '.awesomate', 'credentials.json');
+const file = readJson(credPath) ?? {};
+
+const profiles = {};
+if (file.profiles && typeof file.profiles === 'object') {
+  for (const [key, profile] of Object.entries(file.profiles)) {
+    if (profile && typeof profile.pat === 'string') profiles[key] = profile;
+  }
+} else if (typeof file.pat === 'string' && file.pat) {
+  profiles[file.slug || 'default'] = file; // legacy v1 single-account file
+}
+const names = Object.keys(profiles);
+
+function findPin() {
+  const explicit = process.env.AWESOMATE_PIN_FILE;
+  if (explicit) return existsSync(explicit) ? explicit : null;
+  const home = resolve(homedir());
+  let dir = resolve(process.cwd());
+  for (;;) {
+    const candidate = join(dir, '.awesomate.json');
+    if (existsSync(candidate)) return candidate;
+    if (dir === home) return null;
+    const parent = dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+
+let key = null;
+if (process.env.AWESOMATE_ACCOUNT) {
+  key = process.env.AWESOMATE_ACCOUNT;
+  if (!profiles[key]) {
+    fail(`AWESOMATE_ACCOUNT="${key}" has no matching profile in ${credPath}. Available: ${names.join(', ') || '(none)'}.`);
+  }
+} else {
+  const pinPath = findPin();
+  if (pinPath) {
+    const pin = readJson(pinPath);
+    key = pin && typeof pin.account === 'string' ? pin.account : null;
+    if (!key) fail(`${pinPath} exists but has no "account" field. Expected: {"account": "<slug>"}.`);
+    if (!profiles[key]) {
+      fail(
+        `This folder is pinned to account "${key}" (${pinPath}) but no matching profile exists in ${credPath}. ` +
+          `Available: ${names.join(', ') || '(none)'}. Connect "${key}" from hub.awesomate.ai/sites (logged in as it) or fix the pin.`,
+      );
+    }
+  } else if (names.length === 1) {
+    key = names[0];
+  } else if (file.defaultProfile && profiles[file.defaultProfile]) {
+    key = file.defaultProfile;
+  } else if (names.length === 0) {
+    fail('Not connected. Run the Connect Claude Code setup from hub.awesomate.ai/sites.');
+  } else {
+    fail(
+      `Multiple accounts are connected (${names.join(', ')}) and this folder isn't pinned to one. ` +
+        'Create .awesomate.json {"account": "<slug>"} in the project root or set AWESOMATE_ACCOUNT.',
+    );
+  }
+}
+
+const profile = profiles[key];
+const q = (s) => "'" + String(s == null ? '' : s).replace(/'/g, '') + "'";
+const out = [`ACCT=${q(profile.slug ?? key)}`];
+if (process.argv.includes('--ssh')) {
+  if (!profile.ssh) fail('Your plan does not include shell access (Support Plus+ required).', 2);
+  out.push(`H=${q(profile.ssh.host)}`, `U=${q(profile.ssh.user)}`, `P=${q(profile.ssh.port || 22)}`, `K=${q(profile.ssh.keyPath)}`);
+}
+if (process.argv.includes('--api')) {
+  out.push(`API=${q(profile.apiBase || 'https://hub.awesomate.ai')}`, `PAT=${q(profile.pat)}`);
+}
+console.log(out.join('; '));

package/skill/awesomate-hosting/scripts/ssh-connect.sh

@@ -8,12 +8,12 @@ set -euo pipefail
 CRED="$HOME/.awesomate/credentials.json"
 [ -f "$CRED" ] || { echo "Not connected. Run bootstrap first (Connect Claude Code on hub.awesomate.ai/sites)."; exit 1; }
 
-# Parse the ssh block with node (present wherever the MCP runs via npx).
-eval "$(node -e '
-const c = require(process.env.HOME + "/.awesomate/credentials.json");
-if (!c.ssh) { console.error("Your plan does not include shell access (Support Plus+ required)."); process.exit(2); }
-const q = (s) => "'"'"'" + String(s).replace(/'"'"'/g, "") + "'"'"'";
-console.log(`H=${q(c.ssh.host)}; U=${q(c.ssh.user)}; P=${q(c.ssh.port||22)}; K=${q(c.ssh.keyPath)}`);
-')"
+# Resolve WHICH account (folder pin / AWESOMATE_ACCOUNT / sole profile) and its
+# ssh block via the shared resolver. Capture then eval so a resolver failure
+# aborts with its own message instead of tripping set -u later.
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+if ! CREDS_EVAL="$(node "$SCRIPT_DIR/resolve-account.mjs" --ssh)"; then exit 1; fi
+eval "$CREDS_EVAL"
+echo "→ account: $ACCT" >&2
 
 exec ssh -i "$K" -p "$P" -o StrictHostKeyChecking=accept-new "$U@$H" "$@"

package/skill/awesomate-n8n/SKILL.md

@@ -20,7 +20,13 @@ promote back, and delete drafts — via the `awesomate_n8n_deploy` and
 
 ## 0. First run (every session)
 
-Call `awesomate_n8n_context` once before any n8n work and cache the result:
+Run `awesomate_whoami` first — n8n tools act on whichever ACCOUNT this folder
+resolves to (folder `.awesomate.json` pin / `AWESOMATE_ACCOUNT` / sole
+profile; see the awesomate-hosting skill's multi-account section). If the slug
+isn't the instance the user means, stop and fix the pin/connection before any
+n8n work. Every tool response is stamped `account: <slug>` — watch it.
+
+Then call `awesomate_n8n_context` once before any n8n work and cache the result:
 
 - `consented: false` → give the user the `settingsUrl` link (Settings →
   Privacy → "Allow Claude Code to Build n8n Workflows"), wait for them to
@@ -40,8 +46,11 @@ $env, `$json.body`, task-runner limits, activation semantics).
 
 ## 1. Reads
 
-PAT as `Authorization: Bearer <pat>` (from `~/.awesomate/credentials.json`)
-against `apiBase`. Never echo the PAT into the conversation.
+PAT as `Authorization: Bearer <pat>` against `apiBase`. Resolve the ACTIVE
+profile's pat — `node ~/.claude/skills/awesomate-hosting/scripts/resolve-account.mjs --api`
+— never read `credentials.json`'s top-level `pat` directly when a `profiles`
+map exists (it mirrors the default profile, not necessarily this folder's
+account). Never echo the PAT into the conversation.
 
 | What | Endpoint |
 |---|---|