@awesomate/hosting-mcp 0.6.2 → 0.7.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awesomate/hosting-mcp",
-  "version": "0.6.2",
+  "version": "0.7.1",
   "description": "Awesomate MCP server — lets Claude manage your Awesomate WordPress hosting, plan, limits, and n8n automations",
   "license": "UNLICENSED",
   "type": "module",
@@ -19,10 +19,12 @@
   "scripts": {
     "build": "esbuild src/index.ts --bundle --platform=node --target=node18 --format=esm --outfile=dist/index.js --banner:js='#!/usr/bin/env node' --external:node:*",
     "typecheck": "tsc --noEmit",
-    "prepublishOnly": "npm run typecheck && npm run build"
+    "test": "esbuild src/config.ts --bundle --platform=node --target=node18 --format=esm --outfile=test/.build/config.mjs --external:node:* && node --test test/",
+    "prepublishOnly": "npm run typecheck && npm run test && npm run build"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
+    "undici": "^6.21.0",
     "zod": "^3.24.1"
   },
   "devDependencies": {

package/skill/awesomate-hosting/SKILL.md

@@ -24,8 +24,14 @@ generation, defer to WordPress Studio and any installed WordPress skills
 
 ## 0. First run — orient before acting
 
-On the first hosting request in a session, call **`awesomate_get_context`** once
-(then `awesomate_get_limits` if you're about to create/change anything). From the
+On the first hosting request in a session, call **`awesomate_whoami`** — it's
+zero-network and tells you WHICH account this folder is connected to and why
+(`source`: a `.awesomate.json` folder pin, `AWESOMATE_ACCOUNT`, the sole
+profile, or the default profile). **If the slug isn't the account the user is
+talking about, stop and fix the connection before doing any work** — every
+subsequent tool response is stamped with `account: <slug> (source: …)`; treat a
+mismatch there the same way. Then call **`awesomate_get_context`** once (then
+`awesomate_get_limits` if you're about to create/change anything). From the
 context note three things and cache them for the session:
 
 - **`plan`** and **`capabilities.shell`** — this decides which branch below you're on.
@@ -41,13 +47,65 @@ context note three things and cache them for the session:
 If `awesomate_get_context` fails with a connectivity error, it's the user's
 network or the API base — not an auth problem; say so.
 
+### Multiple accounts on one machine
+
+`~/.awesomate/credentials.json` can hold several account **profiles** (one per
+slug), and each project folder is bound to one via a committable
+`.awesomate.json` pin (`{"account": "<slug>"}`) written by the bootstrap in the
+folder it ran in. Resolution order: `AWESOMATE_PAT` env → `AWESOMATE_ACCOUNT`
+env → nearest folder pin (walking up, stopping at `$HOME`) → sole profile →
+`defaultProfile`. A pin naming a missing profile is a **hard error, never a
+fallback** — that's deliberate.
+
+- **Wrong account connected?** Compare `awesomate_whoami` against the folder's
+  `.awesomate.json`. Fix by editing the pin (if the profile exists) or by
+  running Connect Claude Code from the hub **while logged into the right hub
+  account, from the right folder** — the connect command carries
+  `--account <slug>` and the bootstrap aborts on a mismatch instead of storing
+  anything.
+- **"Multiple accounts … folder isn't pinned" error?** Create the pin file or
+  set `AWESOMATE_ACCOUNT`. Don't guess an account for the user.
+- Connecting a second account never disconnects the first; re-pairing an
+  account just refreshes its profile.
+- The bootstrap prints a final `AWESOMATE CONNECT: SUCCESS account=<slug>` (or
+  `PARTIAL … issues=…` / `FAILED reason=…`) sentinel — when a connect ran as a
+  `!` bang command, check for that line instead of assuming success from
+  silence. `PARTIAL` means the token/pin are stored but a step (listed in
+  `issues=`) needs the printed manual fix.
+
+### Sandboxed / ephemeral environments (cloud agent containers)
+
+- **Egress proxy**: if `HTTPS_PROXY`/`HTTP_PROXY` is set, the environment
+  forces traffic through a proxy that Node's built-in fetch ignores — requests
+  bypass it and the gateway answers 403, which looks like a bad code/token but
+  is a transport failure. The bootstrap and MCP server handle this themselves
+  (undici env-proxy agent); if an older version is in play, prefix commands
+  with `NODE_USE_ENV_PROXY=1`. Diagnostic: `curl` works but `node -e "fetch(…)"`
+  403s → proxy bypass, not credentials.
+- **Interrupted connect?** Setup codes are re-runnable for their whole
+  10-minute life (each run mints a fresh token), and `--pat amt_pat_…` resumes
+  with an already-redeemed token — never tell the user their code is spent
+  unless the API literally said so.
+- **Nothing persists**: `~/.awesomate`, the skill copy, and the MCP
+  registration all vanish with the container. Treat a container connect as a
+  diagnosis/test, and tell the user a real workstation is needed for a lasting
+  install.
+- **No ssh client**: containers usually lack `ssh-keygen`/`ssh`, so deploy and
+  shell are unavailable — reads and management calls still work. The bootstrap
+  skips SSH with a note rather than failing.
+- Never probe connectivity with a POST to `/redeem` — it's state-changing. Use
+  `GET {apiBase}/api/hosting-access/context` (401 without a token still proves
+  reachability).
+
 If this skill is loaded but **no `awesomate_*` tools exist in the session at
 all**, the MCP server was registered after Claude Code started (the bootstrap
 just ran). Don't investigate settings files or reinstall anything — and don't
 make a restart the precondition for showing the user their own data. The
-skill works right now over REST: read `apiBase` and `pat` from
-`~/.awesomate/credentials.json` (never echo the pat into the conversation)
-and GET with `Authorization: Bearer <pat>`:
+skill works right now over REST — resolve the ACTIVE profile first (run
+`node ~/.claude/skills/awesomate-hosting/scripts/resolve-account.mjs --api` to
+get `API`/`PAT`/`ACCT`; never read top-level `pat` directly when a `profiles`
+map exists, and never echo the pat into the conversation) and GET with
+`Authorization: Bearer <pat>`:
 
 | MCP tool | REST equivalent |
 |---|---|

package/skill/awesomate-hosting/scripts/bootstrap.mjs

@@ -2,24 +2,35 @@
 /**
  * Awesomate Hosting — one-time bootstrap.
  *
- * Redeems the single-use setup code from the hub's "Connect Claude Code" prompt
- * for a durable, scoped access token; stores it locally; and (on Support Plus+)
- * generates an SSH keypair and authorizes the PUBLIC key on the client's own
- * cPanel account. The private key never leaves this machine; the setup code is
- * the only secret that ever crossed the clipboard, and it's single-use + short-
- * lived.
+ * Redeems the setup code from the hub's "Connect Claude Code" prompt for a
+ * durable, scoped access token; stores it as a PROFILE (multi-account safe);
+ * pins the current folder to that account; and (on Support Plus+) generates an
+ * SSH keypair and authorizes the PUBLIC key on the client's own cPanel
+ * account. The private key never leaves this machine; the setup code is the
+ * only secret that ever crossed the clipboard, and it's short-lived. The
+ * access token itself is never printed.
  *
  * Usage (Claude runs this — the user doesn't touch a terminal):
- *   node bootstrap.mjs --code amt_bs_XXXX [--api https://hub.awesomate.ai]
+ *   node bootstrap.mjs --code amt_bs_XXXX [--account <slug>] [--pin-dir <dir>]
+ *   node bootstrap.mjs --pat amt_pat_XXXX [--account <slug>]   # resume: skip redeem
  *
- * Dependency-free: Node 18+ built-ins only (global fetch, node:fs/os/path,
- * child_process for ssh-keygen).
+ * --account asserts WHICH account this connect is for — mismatch aborts before
+ * anything is written. --pat resumes a half-finished bootstrap with an
+ * already-redeemed token (no fresh code needed). Setup codes are replayable
+ * for their whole 10-minute life, so re-running the same command is also safe.
+ *
+ * Proxied environments (cloud agent sandboxes): Node's built-in fetch ignores
+ * HTTP(S)_PROXY, so this script routes through undici's EnvHttpProxyAgent when
+ * a proxy is configured (falling back to a one-shot re-exec with
+ * NODE_USE_ENV_PROXY=1 when undici isn't resolvable).
+ *
+ * Node 18+ built-ins only, plus undici when running from the npm package.
  */
 
-import { execFileSync } from 'node:child_process';
-import { existsSync, mkdirSync, writeFileSync, chmodSync, readFileSync, cpSync, readdirSync } from 'node:fs';
+import { execFileSync, spawnSync } from 'node:child_process';
+import { existsSync, mkdirSync, writeFileSync, chmodSync, readFileSync, cpSync, readdirSync, renameSync, statSync } from 'node:fs';
 import { homedir, hostname } from 'node:os';
-import { join, dirname } from 'node:path';
+import { join, dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 function arg(name, fallback) {
@@ -28,9 +39,19 @@ function arg(name, fallback) {
 }
 
 const code = arg('code');
+const resumePat = arg('pat');
+const expectedAccount = arg('account', null);
+const pinDirArg = arg('pin-dir', null);
 const apiBase = (arg('api', 'https://hub.awesomate.ai')).replace(/\/$/, '');
-if (!code || !code.startsWith('amt_bs_')) {
-  console.error('Missing/invalid --code. Copy a fresh setup prompt from hub.awesomate.ai/sites.');
+
+if (!resumePat && (!code || !code.startsWith('amt_bs_'))) {
+  console.error('Missing/invalid --code. Copy a fresh setup prompt from hub.awesomate.ai/sites (or resume with --pat if you already hold a token).');
+  console.error('AWESOMATE CONNECT: FAILED reason=bad-code');
+  process.exit(1);
+}
+if (resumePat && !resumePat.startsWith('amt_pat_')) {
+  console.error('--pat does not look like an Awesomate access token (expected amt_pat_ prefix).');
+  console.error('AWESOMATE CONNECT: FAILED reason=bad-pat');
   process.exit(1);
 }
 
@@ -38,26 +59,179 @@ const dir = join(homedir(), '.awesomate');
 const keysDir = join(dir, 'keys');
 const credPath = join(dir, 'credentials.json');
 const keyPath = join(keysDir, 'id_ed25519');
+const PIN_FILENAME = '.awesomate.json';
+
+// ---------------------------------------------------------------------------
+// Proxy-aware fetch. Node's built-in fetch does NOT honor HTTP(S)_PROXY —
+// in sandboxes that force egress through a proxy, requests bypass it and the
+// gateway answers 403, which looks exactly like a credential failure. Route
+// through undici's EnvHttpProxyAgent when a proxy env var is set.
+// ---------------------------------------------------------------------------
+const PROXY_URL =
+  process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY || process.env.http_proxy || '';
+let doFetch = fetch;
+
+async function initProxySupport() {
+  if (!PROXY_URL) return;
+  // undici tags EnvHttpProxyAgent experimental and warns on construction —
+  // noise in the middle of connect output. Keep every other warning.
+  process.removeAllListeners('warning');
+  process.on('warning', (w) => {
+    if (!/EnvHttpProxyAgent/.test(String(w.message))) console.error(w.stack ?? String(w.message));
+  });
+  try {
+    // Resolves when running from the npm package (undici is a dependency).
+    const undici = await import('undici');
+    const dispatcher = new undici.EnvHttpProxyAgent();
+    doFetch = (url, opts = {}) => undici.fetch(url, { ...opts, dispatcher });
+    console.log(`• Egress proxy detected — routing hub requests through ${PROXY_URL}.`);
+  } catch {
+    // Running from an installed skill copy with no node_modules. Re-exec once
+    // with NODE_USE_ENV_PROXY=1 (built-in fetch honors proxies on newer Node;
+    // the env var is ignored where unsupported, so this is at worst a no-op).
+    if (process.env.AWESOMATE_PROXY_REEXEC !== '1') {
+      const r = spawnSync(process.execPath, process.argv.slice(1), {
+        stdio: 'inherit',
+        env: { ...process.env, NODE_USE_ENV_PROXY: '1', AWESOMATE_PROXY_REEXEC: '1' },
+      });
+      process.exit(r.status ?? 1);
+    }
+    console.log(`• Egress proxy detected (${PROXY_URL}) but proxy support is unavailable in this runtime — requests may be blocked by the gateway.`);
+  }
+}
+
+const proxyAdvice = () =>
+  PROXY_URL
+    ? ` An egress proxy is configured (${PROXY_URL}); if this persists, re-run the command prefixed with NODE_USE_ENV_PROXY=1.`
+    : '';
 
-async function post(path, { body, token } = {}) {
+async function request(method, path, { body, token } = {}) {
   const headers = { 'Content-Type': 'application/json' };
   if (token) headers.Authorization = `Bearer ${token}`;
-  const res = await fetch(`${apiBase}${path}`, { method: 'POST', headers, body: JSON.stringify(body ?? {}) });
+  let res;
+  try {
+    res = await doFetch(`${apiBase}${path}`, {
+      method,
+      headers,
+      body: method === 'GET' ? undefined : JSON.stringify(body ?? {}),
+    });
+  } catch (err) {
+    const detail = err?.cause?.code ?? err?.code ?? err?.message ?? 'network error';
+    throw new Error(`Could not reach ${apiBase} (${detail}). This is a NETWORK problem, not a code/token problem.${proxyAdvice()}`);
+  }
   const text = await res.text();
   let json;
   try { json = text ? JSON.parse(text) : null; } catch { json = text; }
+  const apiError = json && typeof json === 'object' && typeof json.error === 'string' ? json.error : null;
   if (!res.ok) {
-    const msg = json && typeof json === 'object' && json.error ? json.error : `HTTP ${res.status}`;
-    throw new Error(`${path} failed: ${msg}`);
+    if (apiError) {
+      const e = new Error(`${path} failed: ${apiError}`);
+      e.isApiError = true;
+      e.status = res.status;
+      throw e;
+    }
+    // No structured error body → the response almost certainly came from an
+    // egress gateway / firewall, not from the hub. Say so instead of blaming
+    // the code — that misdirection is expensive.
+    throw new Error(
+      `${path} returned HTTP ${res.status} without an API error body — the request likely never reached hub.awesomate.ai (egress proxy or firewall in the way).${proxyAdvice()}`,
+    );
   }
   return json;
 }
+const post = (path, opts) => request('POST', path, opts);
+const get = (path, opts) => request('GET', path, opts);
+
+function readJsonFile(path) {
+  try {
+    const parsed = JSON.parse(readFileSync(path, 'utf8'));
+    return parsed && typeof parsed === 'object' ? parsed : null;
+  } catch { return null; }
+}
+
+/** Atomic JSON write (tmp + rename) so a crash can't leave a torn file. */
+function writeJsonFile(path, value) {
+  const tmp = `${path}.tmp-${process.pid}`;
+  writeFileSync(tmp, `${JSON.stringify(value, null, 2)}\n`);
+  renameSync(tmp, path);
+}
+
+/**
+ * Merge one account profile into credentials.json (v2 multi-profile shape).
+ * Existing profiles for OTHER accounts are preserved — connecting a second
+ * account must never disconnect the first. Top-level v1 fields are kept as a
+ * mirror of the default profile because already-installed skill scripts
+ * (ssh-connect.sh / deploy.sh / pull-live.sh copies from older versions) read
+ * them directly until the skill is refreshed.
+ */
+function mergeProfile(profile) {
+  const existing = readJsonFile(credPath) ?? {};
+  const profiles = { ...(existing.profiles ?? {}) };
+
+  // v1 file: lift the old top-level account into the profiles map first so it
+  // survives this connect.
+  if (!existing.profiles && typeof existing.pat === 'string' && existing.pat) {
+    const legacyKey = existing.slug || 'default';
+    profiles[legacyKey] = {
+      apiBase: existing.apiBase, pat: existing.pat, contactId: existing.contactId,
+      slug: existing.slug, email: existing.email, plan: existing.plan,
+      expiresAt: existing.expiresAt, cpanel: existing.cpanel, ssh: existing.ssh,
+    };
+  }
+
+  profiles[profile.slug] = { ...(profiles[profile.slug] ?? {}), ...profile };
+
+  let defaultProfile = existing.defaultProfile;
+  if (defaultProfile && !profiles[defaultProfile]) defaultProfile = undefined;
+  if (!defaultProfile && Object.keys(profiles).length === 1) defaultProfile = profile.slug;
+  if (existing.defaultProfile && existing.defaultProfile !== profile.slug && profiles[existing.defaultProfile]) {
+    console.log(`• defaultProfile stays "${existing.defaultProfile}" — this folder is pinned to "${profile.slug}" instead.`);
+  }
+
+  // The v1 mirror follows the default profile when one is set; otherwise the
+  // account just connected (matching the old last-connect-wins behavior for
+  // legacy readers, without losing the other profiles).
+  const mirrorSource = (defaultProfile && profiles[defaultProfile]) || profile;
+  const creds = {
+    version: 2,
+    ...(defaultProfile ? { defaultProfile } : {}),
+    profiles,
+    apiBase: mirrorSource.apiBase, pat: mirrorSource.pat, contactId: mirrorSource.contactId,
+    slug: mirrorSource.slug, email: mirrorSource.email ?? null, plan: mirrorSource.plan,
+    cpanel: mirrorSource.cpanel ?? null, expiresAt: mirrorSource.expiresAt ?? null,
+    ...(mirrorSource.ssh ? { ssh: mirrorSource.ssh } : {}),
+  };
 
-function writeCreds(creds) {
   mkdirSync(dir, { recursive: true, mode: 0o700 });
   chmodSync(dir, 0o700);
-  writeFileSync(credPath, JSON.stringify(creds, null, 2));
+  writeJsonFile(credPath, creds);
   chmodSync(credPath, 0o600);
+  return creds;
+}
+
+/**
+ * Pin a folder to this account. --pin-dir overrides the implicit cwd (useful
+ * when the bootstrap is run from somewhere other than the project root).
+ * Never pins $HOME.
+ */
+function writePin(slug) {
+  const target = resolve(pinDirArg || process.cwd());
+  if (pinDirArg && !(existsSync(target) && statSync(target).isDirectory())) {
+    console.log(`• --pin-dir ${pinDirArg} is not an existing directory — skipping the pin. Create it and add ${PIN_FILENAME} with {"account": "${slug}"}.`);
+    return null;
+  }
+  if (target === resolve(homedir())) {
+    console.log(`• Target is the home directory — not writing a ${PIN_FILENAME} pin. Re-run from the project folder (or pass --pin-dir) to pin it.`);
+    return null;
+  }
+  const pinPath = join(target, PIN_FILENAME);
+  const existing = readJsonFile(pinPath);
+  if (existing?.account && existing.account !== slug) {
+    console.log(`• Re-pinning ${target}: ${existing.account} → ${slug}.`);
+  }
+  writeJsonFile(pinPath, { version: 1, account: slug });
+  console.log(`✓ Pinned ${target} to account "${slug}" (${PIN_FILENAME}).`);
+  return pinPath;
 }
 
 /**
@@ -68,12 +242,6 @@ function writeCreds(creds) {
  * failure here never aborts the rest of setup.
  */
 function installSkill() {
-  // bootstrap.mjs lives at <skill>/scripts/bootstrap.mjs → the skill dir is
-  // `..` and every sibling of it under the package's skill/ dir is another
-  // bundled skill (e.g. awesomate-n8n). Install them all. When bootstrap is
-  // re-run from an already-installed copy (~/.claude/skills/...), the parent
-  // is the user's whole skills folder — in that case only reinstall this one
-  // skill, never its unrelated siblings.
   const hostingSkill = dirname(dirname(fileURLToPath(import.meta.url)));
   const skillRoot = dirname(hostingSkill);
   // Only the package layout (skill/<name>/) has bundled siblings; from an
@@ -119,54 +287,179 @@ function installSkill() {
   return true;
 }
 
+const CLEAN_ENTRY = {
+  command: 'npx',
+  args: ['-y', '-p', '@awesomate/hosting-mcp', 'awesomate-hosting-mcp'],
+};
+const MANUAL_ADD_JSON = JSON.stringify({ mcpServers: { 'awesomate-hosting': CLEAN_ENTRY } }, null, 2);
+
+/**
+ * Converge on exactly one env-free, user-scope MCP registration by editing the
+ * config files DIRECTLY — `claude mcp add` flag syntax has drifted between CLI
+ * versions (--scope/-s rejected on some), and a registration is too important
+ * to hang off a moving target.
+ *
+ * Legacy bootstraps baked AWESOMATE_PAT into the registration env — env beats
+ * credentials.json inside the server, so those registrations keep serving a
+ * STALE account forever after a re-pair. Remove every entry that carries the
+ * env var (user scope, this project's local scope + .mcp.json); entries in
+ * OTHER projects are reported for manual cleanup, not touched.
+ */
+function ensureMcpRegistration() {
+  const cwd = resolve(process.cwd());
+  const claudeJsonPath = join(homedir(), '.claude.json');
+
+  let cfg = {};
+  if (existsSync(claudeJsonPath)) {
+    cfg = readJsonFile(claudeJsonPath);
+    if (!cfg) {
+      throw new Error(`${claudeJsonPath} exists but is not valid JSON — refusing to rewrite it. Fix the file, then add:\n${MANUAL_ADD_JSON}`);
+    }
+  }
+
+  const entry = cfg.mcpServers?.['awesomate-hosting'];
+  const entryIsClean =
+    entry && !entry.env?.AWESOMATE_PAT && JSON.stringify(entry.args ?? []).includes('awesomate-hosting-mcp');
+
+  let changed = false;
+  if (!entryIsClean) {
+    cfg.mcpServers = { ...(cfg.mcpServers ?? {}), 'awesomate-hosting': CLEAN_ENTRY };
+    changed = true;
+    console.log(
+      entry?.env?.AWESOMATE_PAT
+        ? '✓ Replaced the legacy user-scope registration (had a token baked into its env) with an env-free one.'
+        : '✓ Registered the Awesomate Hosting MCP server (user scope, env-free — the folder pin picks the account).',
+    );
+  } else {
+    console.log('✓ MCP server already registered (user scope, env-free) — account selection comes from the folder pin.');
+  }
+
+  // This project's local-scope entry (lives under projects[cwd] in ~/.claude.json).
+  const localEntry = cfg.projects?.[cwd]?.mcpServers?.['awesomate-hosting'];
+  if (localEntry?.env?.AWESOMATE_PAT) {
+    delete cfg.projects[cwd].mcpServers['awesomate-hosting'];
+    changed = true;
+    console.log("✓ Removed this project's legacy local-scope registration (token baked into env).");
+  }
+  // Other projects: report, don't touch.
+  for (const [projectDir, project] of Object.entries(cfg.projects ?? {})) {
+    if (resolve(projectDir) === cwd) continue;
+    if (project?.mcpServers?.['awesomate-hosting']?.env?.AWESOMATE_PAT) {
+      console.log(`• ${projectDir} still has a legacy registration with a baked-in token — from that folder run the Connect command again, or remove the awesomate-hosting entry from its local MCP config.`);
+    }
+  }
+
+  if (changed) writeJsonFile(claudeJsonPath, cfg);
+
+  // Project-scope .mcp.json in cwd.
+  const mcpJsonPath = join(cwd, '.mcp.json');
+  const mcpJson = readJsonFile(mcpJsonPath);
+  if (mcpJson?.mcpServers?.['awesomate-hosting']?.env?.AWESOMATE_PAT) {
+    delete mcpJson.mcpServers['awesomate-hosting'];
+    writeJsonFile(mcpJsonPath, mcpJson);
+    console.log('✓ Removed the legacy project-scope (.mcp.json) registration (token baked into env).');
+  }
+}
+
 async function main() {
-  console.log(`Redeeming setup code against ${apiBase} …`);
-  const redeemed = await post('/api/hosting-access/redeem', {
-    body: { code, machineLabel: `Claude Code on ${hostname()}` },
-  });
+  await initProxySupport();
+  const issues = [];
 
-  const creds = {
+  // ── Identity: redeem a code, or verify a resumed PAT ─────────────────────
+  let redeemed;
+  if (resumePat) {
+    console.log(`Resuming with an existing access token — verifying against ${apiBase} …`);
+    const ctx = await get('/api/hosting-access/context', { token: resumePat });
+    redeemed = {
+      pat: resumePat,
+      contactId: ctx.contactId,
+      slug: ctx.slug ?? null,
+      email: ctx.email ?? null,
+      plan: ctx.plan,
+      shellAccess: Boolean(ctx.capabilities?.shell),
+      cpanel: ctx.cpanel ?? null,
+      expiresAt: ctx.patExpiresAt ?? null,
+    };
+  } else {
+    console.log(`Redeeming setup code against ${apiBase} …`);
+    redeemed = await post('/api/hosting-access/redeem', {
+      body: { code, machineLabel: `Claude Code on ${hostname()}` },
+    });
+  }
+
+  const slug = redeemed.slug ?? null;
+  if (!slug) {
+    console.error('The hub did not return an account slug — cannot safely store a profile. Contact Awesomate support.');
+    console.error('AWESOMATE CONNECT: FAILED reason=no-slug');
+    process.exit(1);
+  }
+  // Wrong-account guard: abort BEFORE writing anything.
+  if (expectedAccount && expectedAccount !== slug) {
+    console.error(`This ${resumePat ? 'token' : 'setup code'} belongs to account "${slug}" but this connect was for "${expectedAccount}".`);
+    console.error(`You are probably logged into the wrong hub account — log into ${expectedAccount}'s hub account and copy a fresh Connect prompt.`);
+    console.error(`AWESOMATE CONNECT: FAILED reason=account-mismatch expected=${expectedAccount} got=${slug}`);
+    process.exit(1);
+  }
+
+  // Server-side identity check with the NEW token before trusting it (the
+  // resume path already did exactly this to build `redeemed`).
+  if (!resumePat) {
+    let context = null;
+    try {
+      context = await get('/api/hosting-access/context', { token: redeemed.pat });
+    } catch (err) {
+      console.error(`Token verification failed (${err.message}) — not storing it. Re-run the same command (setup codes stay valid for 10 minutes).`);
+      console.error('AWESOMATE CONNECT: FAILED reason=verify-failed');
+      process.exit(1);
+    }
+    const ctxSlug = context?.slug ?? null;
+    if (ctxSlug && ctxSlug !== slug) {
+      console.error(`Identity mismatch: redeem said "${slug}" but the token resolves to "${ctxSlug}". Not storing it — contact Awesomate support.`);
+      console.error('AWESOMATE CONNECT: FAILED reason=identity-mismatch');
+      process.exit(1);
+    }
+    redeemed.email = redeemed.email ?? context?.email ?? null;
+  }
+
+  const profile = {
     apiBase,
     pat: redeemed.pat,
     contactId: redeemed.contactId,
-    slug: redeemed.slug ?? null,
+    slug,
+    email: redeemed.email ?? null,
     plan: redeemed.plan,
     cpanel: redeemed.cpanel ?? null,
     expiresAt: redeemed.expiresAt ?? null,
   };
-  writeCreds(creds);
-  console.log(`✓ Access token stored at ${credPath} (chmod 600). Plan: ${redeemed.plan}.`);
+  mergeProfile(profile);
+  console.log(`✓ Access token stored as profile "${slug}" in ${credPath} (chmod 600). Plan: ${redeemed.plan}.`);
+
+  const pinPath = writePin(slug);
 
   // Install the skill + register the MCP server FIRST — these always work and
-  // don't depend on hosting being fully provisioned. SSH comes last so that a
-  // shell/provisioning hiccup can't strand the skill or MCP.
+  // don't depend on hosting being fully provisioned. Neither is allowed to
+  // strand the other or SSH: every step from here is collected, not fatal.
   try { installSkill(); } catch (err) {
     console.log(`• Could not auto-install the skill (${err.message}) — continuing; you can copy skill/ manually.`);
   }
 
-  // Register the MCP server. Prefer the Claude CLI if present; otherwise print
-  // the config for Claude to apply.
-  const cmd = `claude mcp add awesomate-hosting --env AWESOMATE_PAT=${redeemed.pat} --env AWESOMATE_API_BASE=${apiBase} -- npx -y -p @awesomate/hosting-mcp awesomate-hosting-mcp`;
-  let registered = false;
   try {
-    execFileSync('claude', ['mcp', 'add', 'awesomate-hosting', '--env', `AWESOMATE_PAT=${redeemed.pat}`, '--env', `AWESOMATE_API_BASE=${apiBase}`, '--', 'npx', '-y', '-p', '@awesomate/hosting-mcp', 'awesomate-hosting-mcp'], { stdio: 'ignore' });
-    registered = true;
-    console.log('✓ Registered the Awesomate Hosting MCP server with Claude Code.');
-  } catch {
-    console.log('\nAdd the Awesomate Hosting MCP server to this project — run:');
-    console.log(`  ${cmd}`);
-    console.log('…or add to .mcp.json:');
-    console.log(JSON.stringify({ mcpServers: { 'awesomate-hosting': { command: 'npx', args: ['-y', '-p', '@awesomate/hosting-mcp', 'awesomate-hosting-mcp'], env: { AWESOMATE_PAT: redeemed.pat, AWESOMATE_API_BASE: apiBase } } } }, null, 2));
+    ensureMcpRegistration();
+  } catch (err) {
+    issues.push('mcp-registration');
+    console.error(`• MCP registration failed: ${err.message}`);
+    console.error(`  Add it manually (no token goes in the config — the folder pin picks the account):\n${MANUAL_ADD_JSON}`);
   }
 
   // SSH key (Support Plus+): best-effort. If it fails (e.g. hosting not fully
-  // provisioned yet), keep the token + skill + MCP — deploy/shell just aren't
-  // ready until it's registered, which the skill can retry later.
+  // provisioned yet, or no ssh tooling in this environment), keep the token +
+  // skill + MCP — deploy/shell just aren't ready until it's registered, which
+  // the skill can retry later.
   if (redeemed.shellAccess) {
     try {
       if (!existsSync(keyPath)) {
         mkdirSync(keysDir, { recursive: true, mode: 0o700 });
-        execFileSync('ssh-keygen', ['-t', 'ed25519', '-f', keyPath, '-N', '', '-C', `awesomate:${redeemed.slug ?? 'site'}`], { stdio: 'ignore' });
+        execFileSync('ssh-keygen', ['-t', 'ed25519', '-f', keyPath, '-N', '', '-C', `awesomate:${slug}`], { stdio: 'pipe' });
         chmodSync(keyPath, 0o600);
       }
       const publicKey = readFileSync(`${keyPath}.pub`, 'utf8').trim();
@@ -174,23 +467,37 @@ async function main() {
         token: redeemed.pat,
         body: { publicKey, label: `Claude Code on ${hostname()}` },
       });
-      creds.ssh = { host: reg.sshHost, user: reg.sshUser, port: reg.sshPort ?? 22, keyPath, fingerprint: reg.fingerprint };
-      writeCreds(creds);
+      profile.ssh = { host: reg.sshHost, user: reg.sshUser, port: reg.sshPort ?? 22, keyPath, fingerprint: reg.fingerprint };
+      mergeProfile(profile);
       console.log(`✓ SSH key authorized on ${reg.sshUser}@${reg.sshHost} (jailed to your account).`);
     } catch (err) {
-      console.log(`• SSH key not registered yet: ${err.message}`);
-      console.log('  Everything else is set up. This usually means hosting isn\'t fully provisioned — contact Awesomate support, then ask me to "retry SSH setup".');
+      if (err?.code === 'ENOENT') {
+        console.log('• No ssh-keygen in this environment — skipping SSH setup. Deploy and shell need a real workstation; reads and management calls work fine here.');
+      } else {
+        console.log(`• SSH key not registered yet: ${err.message}`);
+        console.log('  Everything else is set up. This usually means hosting isn\'t fully provisioned — contact Awesomate support, then ask me to "retry SSH setup".');
+      }
     }
   } else {
     console.log('• Plan has no shell access — read/status mode. Upgrade to Support Plus for SSH + deploy.');
   }
 
-  console.log('\nSetup complete. Next: ask me to read your plan, list your sites, and tell you what we can do.');
-  if (!registered) console.log('(The skill works in your current Claude session right away via its REST fallback — restart Claude Code when convenient to load the MCP tools.)');
+  const who = profile.email ? `${slug} (${profile.email}, plan ${redeemed.plan})` : `${slug} (plan ${redeemed.plan})`;
+  console.log(`\n✓ Connected: ${who}${pinPath ? ` — pinned ${dirname(pinPath)}` : ''}`);
+  console.log('Setup complete. Next: run awesomate_whoami to confirm the account, then ask me to read your plan and list your sites.');
+  console.log('(The skill works in your current Claude session right away via its REST fallback — restart Claude Code when convenient to load the MCP tools.)');
+  if (issues.length) {
+    console.log(`AWESOMATE CONNECT: PARTIAL account=${slug} pin=${pinPath ?? 'none'} issues=${issues.join(',')}`);
+    process.exit(1);
+  }
+  console.log(`AWESOMATE CONNECT: SUCCESS account=${slug} pin=${pinPath ?? 'none'}`);
 }
 
 main().catch((err) => {
   console.error('Bootstrap failed:', err.message);
-  console.error('If the code expired or was already used, grab a fresh one from hub.awesomate.ai/sites.');
+  if (err.isApiError && err.status === 401) {
+    console.error('Grab a fresh code from hub.awesomate.ai/sites — codes last 10 minutes (and stay re-runnable within that window).');
+  }
+  console.error('AWESOMATE CONNECT: FAILED reason=error');
   process.exit(1);
 });